@modelprofile.com/authswitch 6.5.0 → 7.0.0

package/dist_ts/classes.authoritydatabase.d.ts

@@ -1,25 +1,58 @@
-import { type IStoredAuthorityAccount, type IStoredAuthorityBinding, type IStoredAuthorityCodexHome, type IStoredAuthorityEnrollment, type IStoredAuthorityEvent, type IStoredAuthorityGrant, type IStoredAuthorityHandoff, type IStoredAuthorityMeta, type IStoredAuthorityMigrationLedger } from './classes.authoritymodels.js';
+import * as plugins from './plugins.js';
+import { type IStoredAuthorityAccount, type IStoredAuthorityBinding, type IStoredAuthorityClaudeHandoff, type IStoredAuthorityClaudeHome, type IStoredAuthorityCodexHome, type IStoredAuthorityEnrollment, type IStoredAuthorityEvent, type IStoredAuthorityGrant, type IStoredAuthorityHandoff, type IStoredAuthorityDeviceOperation, type IStoredAuthorityMeta, type IStoredAuthorityMigrationLedger, type IStoredAuthorityOperation, type IStoredAuthorityPreuseOperation } from './classes.authoritymodels.js';
+import type { IAuthSwitchStoredUsage, IAuthSwitchUsageContext } from './classes.authorityusage.js';
+import { type IAuthorityStoredRecord } from './classes.authorityregistry.js';
+import type { IAuthorityBackupSnapshotAttempt, IAuthorityBackupSourceCapsule } from './classes.authoritybackup.js';
 export interface IAuthSwitchAuthorityDatabaseOptions {
     dataDirectory: string;
     socketPath: string;
 }
+export interface IAuthoritySnapshotCaptureOptions {
+    /** Recreate capsules on every transaction retry from a source already held under qualified exclusion. */
+    sourceFactory: () => AsyncIterable<IAuthorityBackupSourceCapsule>;
+    signal?: AbortSignal;
+    pageSize?: number;
+}
+type TSession = plugins.smartdata.SmartdataSession;
+type TStoredAuthorityDeviceOperationAdmission = Omit<IStoredAuthorityDeviceOperation, 'expectedGrantGeneration'>;
+type TClaudeHandoffDraft = {
+    home: IStoredAuthorityClaudeHome;
+    handoff: IStoredAuthorityClaudeHandoff;
+    outgoing: IStoredAuthorityGrant;
+    incoming: IStoredAuthorityGrant;
+};
 /** Separate account, grant, binding and journal records; the only global record is a revision counter. */
 export declare class AuthSwitchAuthorityDatabase {
     private readonly options;
     private engine?;
     private database?;
     private started;
+    private mode;
     constructor(options: IAuthSwitchAuthorityDatabaseOptions);
     private privateDirectory;
-    start(): Promise<void>;
+    start(options?: {
+        mode?: 'normal' | 'closed_restore';
+    }): Promise<void>;
     private db;
     private transaction;
+    /** One repeatable SmartData transaction per capture attempt; portable staging happens inside visit. */
+    captureBackupSnapshot(options: IAuthoritySnapshotCaptureOptions, visit: (attempt: IAuthorityBackupSnapshotAttempt) => Promise<void>): Promise<void>;
+    /** Reopened closed restore readback uses the same exhaustive registry and stable keyset order. */
+    readStoredRecords(options?: {
+        signal?: AbortSignal;
+        pageSize?: number;
+    }): AsyncIterable<IAuthorityStoredRecord>;
+    restoreClosedMeta(meta: IStoredAuthorityMeta): Promise<void>;
+    insertClosedRestoredRecord(record: IAuthorityStoredRecord): Promise<void>;
+    assertOpenAdmission(): Promise<void>;
     readMeta(): Promise<IStoredAuthorityMeta>;
     readAccount(id: string): Promise<IStoredAuthorityAccount | null>;
     readBinding(id: string): Promise<IStoredAuthorityBinding | null>;
     readCodexHome(id: string): Promise<IStoredAuthorityCodexHome | null>;
+    /** Durable home claims must be inspected even when the daemon has lost its process map. */
+    codexHomesForAccount(accountId: string, after: string | null): Promise<IStoredAuthorityCodexHome[]>;
     /** Home path identity is hashed by the caller; no vendor files or raw paths enter SmartData. */
-    reserveCodexHome(accountId: string, scopeId: string, homeId: string, updateId: string): Promise<{
+    reserveCodexHome(accountId: string, grantId: string, scopeId: string, homeId: string, updateId: string): Promise<{
         newlyRegistered: boolean;
     }>;
     /** Pre-spawn claim is durable; the exact socket lets a later daemon detect a child born before PID readback. */
@@ -34,21 +67,95 @@ export declare class AuthSwitchAuthorityDatabase {
     readEnrollment(id: string): Promise<IStoredAuthorityEnrollment | null>;
     readHandoff(id: string): Promise<IStoredAuthorityHandoff | null>;
     readMigrationLedger(id: string): Promise<IStoredAuthorityMigrationLedger | null>;
+    readOperation(id: string): Promise<IStoredAuthorityOperation | null>;
+    operationsPage(after: string | null, limit?: number): Promise<{
+        operations: IStoredAuthorityDeviceOperation[];
+        nextCursor: string | null;
+    }>;
+    operationsByState(state: IStoredAuthorityDeviceOperation['state'], after: string | null, limit?: number): Promise<IStoredAuthorityDeviceOperation[]>;
+    preuseOperationsByState(state: IStoredAuthorityPreuseOperation['state'], after: string | null, limit?: number): Promise<IStoredAuthorityPreuseOperation[]>;
+    /** Insert-or-read admission for one exact device-login intent. Existing receipts are never replayed. */
+    createOperation(intent: TStoredAuthorityDeviceOperationAdmission): Promise<{
+        operation: IStoredAuthorityDeviceOperation;
+        created: boolean;
+    }>;
+    /** Revalidate the durable owner and exact reauthentication generation after mutable runtime preparation. */
+    confirmOperationMayStart(operationId: string): Promise<IStoredAuthorityDeviceOperation>;
+    changeOperation(updateId: string, operationId: string, change: (operation: IStoredAuthorityDeviceOperation) => IStoredAuthorityDeviceOperation): Promise<IStoredAuthorityDeviceOperation>;
+    /** Insert-or-read idempotency for one exact preuse request. Existing records are never resumed here. */
+    createPreuseOperation(operation: IStoredAuthorityPreuseOperation): Promise<{
+        operation: IStoredAuthorityPreuseOperation;
+        created: boolean;
+    }>;
+    /** The committed marker precedes the only quota-consuming provider call. */
+    markPreuseRequestMayHaveStarted(operationId: string, updateId: string, model: string, grantGeneration: number, now: string): Promise<IStoredAuthorityPreuseOperation>;
+    changePreuseOperation(updateId: string, operationId: string, change: (operation: IStoredAuthorityPreuseOperation) => IStoredAuthorityPreuseOperation): Promise<IStoredAuthorityPreuseOperation>;
     migrationLedgerByStatus(status: IStoredAuthorityMigrationLedger['status'], after: string | null, limit?: number): Promise<IStoredAuthorityMigrationLedger[]>;
     readAccountAndPrimaryGrant(id: string): Promise<{
         account: IStoredAuthorityAccount | null;
         grant: IStoredAuthorityGrant | null;
     }>;
-    page(accountAfter: string | null, bindingAfter: string | null, limit: number): Promise<{
+    readAccountAndGrant(accountId: string, grantId: string): Promise<{
+        account: IStoredAuthorityAccount | null;
+        grant: IStoredAuthorityGrant | null;
+    }>;
+    /** Epoch, account and exact login are read from one authority snapshot. */
+    readUsageContext(accountId: string, loginId: string): Promise<IAuthSwitchUsageContext | null>;
+    /** Backend-only view used to validate a usage token before and after unsealing. */
+    readUsageAccessView(accountId: string, loginId: string): Promise<{
+        context: IAuthSwitchUsageContext;
+        account: IStoredAuthorityAccount;
+        grant: IStoredAuthorityGrant;
+    } | null>;
+    /** Coherent native source ownership, including the home handoff fence. */
+    readClaudeNativeUsageView(homeId: string, accountId: string, loginId: string): Promise<{
+        context: IAuthSwitchUsageContext;
+        account: IStoredAuthorityAccount;
+        grant: IStoredAuthorityGrant;
+        home: IStoredAuthorityClaudeHome;
+    } | null>;
+    readUsage(accountId: string, loginId: string): Promise<IAuthSwitchStoredUsage | null>;
+    /** Publish one credential-free usage result only if its authority and predecessor still match. */
+    publishUsageIfCurrent(context: IAuthSwitchUsageContext, previousUpdateId: string | null, next: IAuthSwitchStoredUsage): Promise<boolean>;
+    page(accountAfter: string | null, grantAfter: string | null, bindingAfter: string | null, limit: number): Promise<{
         meta: IStoredAuthorityMeta;
-        accounts: Array<{
-            account: IStoredAuthorityAccount;
-            grant: IStoredAuthorityGrant | null;
-        }>;
+        accounts: IStoredAuthorityAccount[];
+        grants: IStoredAuthorityGrant[];
         bindings: IStoredAuthorityBinding[];
         nextAccountCursor: string | null;
+        nextGrantCursor: string | null;
         nextBindingCursor: string | null;
     }>;
+    /**
+     * One bounded, repeatable-read diagnostic page. Its metadata revision is authority state,
+     * not a complete change clock for every native-home record.
+     */
+    doctorPage(cursors: {
+        accountAfter: string | null;
+        loginAfter: string | null;
+        codexHomeAfter: string | null;
+        claudeHomeAfter: string | null;
+        claudeHandoffAfter: string | null;
+        nativeHandoffAfter: string | null;
+        migrationAfter: string | null;
+    }, limit: number): Promise<{
+        observedAt: string;
+        meta: IStoredAuthorityMeta;
+        accounts: IStoredAuthorityAccount[];
+        logins: IStoredAuthorityGrant[];
+        codexHomes: IStoredAuthorityCodexHome[];
+        claudeHomes: IStoredAuthorityClaudeHome[];
+        claudeHandoffs: IStoredAuthorityClaudeHandoff[];
+        nativeHandoffs: IStoredAuthorityHandoff[];
+        migrations: IStoredAuthorityMigrationLedger[];
+        nextAccountCursor: string | null;
+        nextLoginCursor: string | null;
+        nextCodexHomeCursor: string | null;
+        nextClaudeHomeCursor: string | null;
+        nextClaudeHandoffCursor: string | null;
+        nextNativeHandoffCursor: string | null;
+        nextMigrationCursor: string | null;
+    }>;
     grantsByState(state: IStoredAuthorityGrant['state'], after: string | null, limit?: number): Promise<IStoredAuthorityGrant[]>;
     grantsForAccount(accountId: string, after: string | null, limit?: number): Promise<IStoredAuthorityGrant[]>;
     eventsAfter(revision: number, limit?: number): Promise<IStoredAuthorityEvent[]>;
@@ -64,6 +171,15 @@ export declare class AuthSwitchAuthorityDatabase {
         account: IStoredAuthorityAccount;
         grant: IStoredAuthorityGrant;
     }>;
+    /** Device-login result, account and grant are one commit; a lost RPC response remains discoverable by operation ID. */
+    commitLoginOperation(updateId: string, operationId: string, accountId: string, grantId: string, change: (account: IStoredAuthorityAccount | null, grant: IStoredAuthorityGrant | null) => {
+        account: IStoredAuthorityAccount;
+        grant: IStoredAuthorityGrant;
+    }): Promise<{
+        account: IStoredAuthorityAccount;
+        grant: IStoredAuthorityGrant;
+        operation: IStoredAuthorityDeviceOperation;
+    }>;
     /** Grant transition and public account revision share a transaction and one event. */
     changeGrant(updateId: string, grantId: string, change: (grant: IStoredAuthorityGrant, account: IStoredAuthorityAccount) => IStoredAuthorityGrant): Promise<{
         meta: IStoredAuthorityMeta;
@@ -81,12 +197,15 @@ export declare class AuthSwitchAuthorityDatabase {
         meta: IStoredAuthorityMeta;
         account: IStoredAuthorityAccount;
     }>;
-    changeBinding(updateId: string, bindingId: string, accountId: string, change: (draft: IStoredAuthorityBinding | null, account: IStoredAuthorityAccount, grant: IStoredAuthorityGrant | null) => IStoredAuthorityBinding): Promise<{
+    changeBinding(updateId: string, bindingId: string, accountId: string, grantId: string, change: (draft: IStoredAuthorityBinding | null, account: IStoredAuthorityAccount, grant: IStoredAuthorityGrant | null) => IStoredAuthorityBinding): Promise<{
         meta: IStoredAuthorityMeta;
         binding: IStoredAuthorityBinding;
     }>;
-    /** Closing an owned runtime revokes only its exact capability/incarnation. */
+    private revokeBindingExact;
+    /** Closing an authority-owned runtime revokes its exact capability after owned cleanup. */
     revokeBinding(updateId: string, bindingId: string, capabilityHash: string): Promise<boolean>;
+    /** External callers can release only Flex/OpenCode bindings; managed Codex cleanup stays daemon-owned. */
+    releaseExternalBinding(updateId: string, bindingId: string, capabilityHash: string): Promise<boolean>;
     /** Enrollment metadata is sealed by the caller and cannot become detached from an account. */
     changeEnrollment(updateId: string, enrollmentId: string, accountId: string, change: (current: IStoredAuthorityEnrollment | null) => IStoredAuthorityEnrollment): Promise<IStoredAuthorityEnrollment>;
     /** Journal and grant advance together; no intermediate phase may expose an active daemon grant. */
@@ -97,7 +216,53 @@ export declare class AuthSwitchAuthorityDatabase {
         handoff: IStoredAuthorityHandoff;
         grant: IStoredAuthorityGrant;
     }>;
+    readClaudeHome(homeId: string): Promise<IStoredAuthorityClaudeHome | null>;
+    readClaudeHandoff(operationId: string): Promise<IStoredAuthorityClaudeHandoff | null>;
+    /** A backed-up backend import receipt, not an account snapshot, authorizes an inactive Claude grant. */
+    hasVerifiedClaudeGrantReceipt(accountId: string, grantId: string, session?: TSession): Promise<boolean>;
+    claudeHandoffsByPhase(phase: IStoredAuthorityClaudeHandoff['phase'], after: string | null): Promise<IStoredAuthorityClaudeHandoff[]>;
+    claudeHandoffsPage(after: string | null, limit?: number): Promise<{
+        handoffs: IStoredAuthorityClaudeHandoff[];
+        nextCursor: string | null;
+    }>;
+    /** Only a verified backend import receipt may adopt a native home. No startup autodiscovery exists. */
+    registerClaudeHomeFromReceipt(input: {
+        homeId: string;
+        accountId: string;
+        grantId: string;
+        receiptId: string;
+        sourceDigest: string;
+        accountUuid: string;
+        organizationUuid: string;
+        updateId: string;
+        now: string;
+    }): Promise<IStoredAuthorityClaudeHome>;
+    readClaudeHandoffContext(operationId: string): Promise<{
+        handoff: IStoredAuthorityClaudeHandoff;
+        home: IStoredAuthorityClaudeHome;
+        outgoing: IStoredAuthorityGrant;
+        incoming: IStoredAuthorityGrant;
+        outgoingAccount: IStoredAuthorityAccount;
+        incomingAccount: IStoredAuthorityAccount;
+    } | null>;
+    /** One phase advances both grants, home, journal and both account events atomically. */
+    changeClaudeHandoff(input: {
+        operationId: string;
+        homeId: string;
+        incomingGrantId: string;
+        updateId: string;
+        eventIds: readonly [string, string];
+        change: (current: {
+            home: IStoredAuthorityClaudeHome;
+            handoff: IStoredAuthorityClaudeHandoff | null;
+            outgoing: IStoredAuthorityGrant;
+            incoming: IStoredAuthorityGrant;
+            outgoingAccount: IStoredAuthorityAccount;
+            incomingAccount: IStoredAuthorityAccount;
+        }) => TClaudeHandoffDraft;
+    }): Promise<TClaudeHandoffDraft>;
     /** Ledger transitions never silently replace an active credential or waive backup proof. */
     changeMigrationLedger(updateId: string, ledgerId: string, change: (current: IStoredAuthorityMigrationLedger | null) => IStoredAuthorityMigrationLedger): Promise<IStoredAuthorityMigrationLedger>;
     stop(): Promise<void>;
 }
+export {};