@modelprofile.com/authswitch 6.5.0 → 8.0.0

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@modelprofile.com/authswitch',
-    version: '6.5.0',
+    version: '8.0.0',
     description: 'Manage Codex, OpenCode and Claude Code accounts with guided switching and live usage status'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSw4QkFBOEI7SUFDcEMsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLDZGQUE2RjtDQUMzRyxDQUFBIn0=

package/dist_ts/authority-contract.d.ts

@@ -1,20 +1,38 @@
 import type { ITypedRequest } from '@api.global/typedrequest-interfaces';
+import type { IAuthSwitchUsageSnapshot } from './classes.authorityusage.js';
+export type { IAuthSwitchUsageSnapshot } from './classes.authorityusage.js';
 /** Credential-free account management contract. Safe to import in browser code. */
-export type TAuthSwitchAccountHealth = 'ready' | 'refreshing' | 'retry_wait' | 'needs_reauth' | 'native' | 'legacy_native_pending' | 'removed';
+export type TAuthSwitchLoginPurpose = 'openai_managed' | 'claude_host_native' | 'claude_container_setup' | 'opencode_native';
+export type TAuthSwitchLoginHealth = 'ready' | 'refreshing' | 'retry_wait' | 'needs_reauth' | 'unverified' | 'pending_handoff' | 'handoff_quarantined' | 'removed';
 export interface IAuthSwitchAccount {
     id: string;
     providerId: string;
     label: string;
     email: string | null;
     plan: string | null;
-    health: TAuthSwitchAccountHealth;
+    removed: boolean;
+    revision: number;
+    statusObservedAt: string;
+}
+/** One independently owned login. Native ownership does not imply observed health. */
+export interface IAuthSwitchLogin {
+    id: string;
+    accountId: string;
+    providerId: string;
+    purpose: TAuthSwitchLoginPurpose;
     owner: 'daemon' | 'claude_native' | 'legacy_native' | 'none';
+    health: TAuthSwitchLoginHealth;
+    problem: 'none' | 'provider_unavailable' | 'exchange_uncertain' | 'provider_rejected' | 'native_owner';
     grantGeneration: number;
     revision: number;
     accessExpiresAt: string | null;
     retryAt: string | null;
-    problem: 'none' | 'provider_unavailable' | 'exchange_uncertain' | 'provider_rejected' | 'native_owner';
     statusObservedAt: string;
+    capabilities: {
+        canReauthenticate: boolean;
+        canBind: boolean;
+        canPreuse: boolean;
+    };
 }
 export interface IAuthSwitchBinding {
     id: string;
@@ -25,15 +43,140 @@ export interface IAuthSwitchBinding {
     revision: number;
 }
 export interface IAuthSwitchSnapshot {
-    schemaVersion: 1;
+    schemaVersion: 2;
     epoch: string;
     revision: number;
     generatedAt: string;
     accounts: IAuthSwitchAccount[];
+    logins: IAuthSwitchLogin[];
     bindings: IAuthSwitchBinding[];
     nextAccountCursor: string | null;
+    nextLoginCursor: string | null;
     nextBindingCursor: string | null;
 }
+/** Persisted account evidence. No provider request is made while collecting diagnostics. */
+export interface IAuthSwitchDoctorAccountEvidence {
+    id: string;
+    providerId: string;
+    removed: boolean;
+    statusObservedAt: string;
+    evidence: 'stored';
+    liveCheck: 'not_checked';
+}
+/** Persisted login evidence. Stored readiness is not a live provider-health claim. */
+export interface IAuthSwitchDoctorLoginEvidence {
+    id: string;
+    accountId: string;
+    providerId: string;
+    purpose: TAuthSwitchLoginPurpose;
+    owner: 'daemon' | 'claude_native' | 'legacy_native' | 'none';
+    state: 'ready' | 'exchange_may_have_been_sent' | 'retry_wait' | 'needs_reauth' | 'native' | 'legacy_native_pending' | 'handoff_pending' | 'handoff_quarantined' | 'removed';
+    problem: 'none' | 'provider_unavailable' | 'exchange_uncertain' | 'provider_rejected' | 'native_owner';
+    grantGeneration: number;
+    authorizationGeneration: number;
+    accessExpiresAt: string | null;
+    retryAt: string | null;
+    statusObservedAt: string;
+    evidence: 'stored';
+    liveCheck: 'not_checked';
+}
+export interface IAuthSwitchDoctorManagedCodex {
+    homeId: string;
+    accountId: string;
+    loginId: string;
+    scopeId: string;
+    health: 'healthy' | 'degraded' | 'unknown';
+    durable: {
+        state: 'idle' | 'launch_prepared' | 'registered';
+        runId: string | null;
+        pid: number | null;
+        startedAt: string | null;
+    };
+    daemon: {
+        state: 'untracked' | 'starting' | 'ready' | 'stopping' | 'degraded';
+        assignment: 'untracked' | 'matches' | 'mismatch';
+    };
+    process: {
+        state: 'not_expected' | 'absent' | 'observed' | 'unknown';
+        identity: 'not_applicable' | 'unregistered' | 'matches' | 'mismatch' | 'unknown';
+        pid: number | null;
+        startedAt: string | null;
+        observedAt: string;
+        problem: 'none' | 'inspection_failed' | 'multiple_claimants';
+    };
+}
+export interface IAuthSwitchDoctorClaudeHome {
+    id: string;
+    activeAccountId: string;
+    activeLoginId: string;
+    pendingOperationId: string | null;
+    status: 'ready' | 'quarantined';
+    revision: number;
+    createdAt: string;
+}
+export interface IAuthSwitchDoctorClaudeHandoff {
+    id: string;
+    homeId: string;
+    outgoingAccountId: string;
+    outgoingLoginId: string;
+    incomingAccountId: string;
+    incomingLoginId: string;
+    phase: 'reserved' | 'prepared' | 'committed' | 'aborted' | 'quarantined';
+    problem: 'none' | 'native_uncertain' | 'foreign_or_torn' | 'unsupported_effective_auth' | 'database_uncertain';
+    runningEffectiveAuth: 'no_scoped_sessions' | 'unsupported_effective_auth' | null;
+    startedAt: string;
+    updatedAt: string;
+    revision: number;
+}
+export interface IAuthSwitchDoctorNativeHandoff {
+    id: string;
+    accountId: string;
+    loginId: string;
+    nativeHomeId: string;
+    direction: 'to_native' | 'to_daemon';
+    phase: 'prepared' | 'source_stopped' | 'target_written' | 'verified' | 'committed' | 'needs_reauth' | 'aborted';
+    operationId: string;
+    revision: number;
+    statusObservedAt: string;
+}
+export interface IAuthSwitchDoctorMigration {
+    id: string;
+    sourceKind: 'authswitch_stash' | 'authswitch_backup' | 'agl_flex' | 'codex_native' | 'opencode_native' | 'claude_native';
+    status: 'pending_native_owner' | 'prepared' | 'verified' | 'complete' | 'quarantined';
+    accountId: string | null;
+    loginId: string | null;
+    revision: number;
+    statusObservedAt: string;
+}
+/** One independently observed diagnostic page. Separate pages are not one atomic global snapshot. */
+export interface IAuthSwitchDoctorPage {
+    observedAt: string;
+    daemon: {
+        state: 'ready' | 'closing';
+        claudeNativeAuthority: 'configured' | 'not_configured';
+        observedAt: string;
+    };
+    database: {
+        state: 'available';
+        observedAt: string;
+        epoch: string;
+        revision: number;
+    };
+    accounts: IAuthSwitchDoctorAccountEvidence[];
+    logins: IAuthSwitchDoctorLoginEvidence[];
+    managedCodex: IAuthSwitchDoctorManagedCodex[];
+    claudeHomes: IAuthSwitchDoctorClaudeHome[];
+    claudeHandoffs: IAuthSwitchDoctorClaudeHandoff[];
+    nativeHandoffs: IAuthSwitchDoctorNativeHandoff[];
+    migrations: IAuthSwitchDoctorMigration[];
+    nextAccountCursor: string | null;
+    nextLoginCursor: string | null;
+    nextCodexHomeCursor: string | null;
+    nextClaudeHomeCursor: string | null;
+    nextClaudeHandoffCursor: string | null;
+    nextNativeHandoffCursor: string | null;
+    nextMigrationCursor: string | null;
+}
 export interface IAuthSwitchAccountEvent {
     epoch: string;
     revision: number;
@@ -50,15 +193,91 @@ export type TAuthSwitchLoginPrompt = {
 };
 export interface IAuthSwitchOperation {
     id: string;
-    state: 'pending' | 'complete' | 'failed' | 'cancelled';
+    kind: 'add_openai' | 'reauth_openai';
+    purpose: 'openai_managed';
+    targetAccountId: string | null;
+    targetLoginId: string | null;
+    state: 'starting' | 'pending' | 'committing' | 'complete' | 'failed' | 'cancelled' | 'interrupted' | 'outcome_unknown';
     prompt: TAuthSwitchLoginPrompt | null;
-    account: IAuthSwitchAccount | null;
+    result: {
+        accountId: string;
+        loginId: string;
+        accountRevision: number;
+        loginGeneration: number;
+    } | null;
     error: string | null;
+    createdAt: string;
+    updatedAt: string;
+    finishedAt: string | null;
+    revision: number;
+}
+/** Credential-free receipt for one exact, never-replayed quota-consuming request. */
+export interface IAuthSwitchPreuseOperation {
+    id: string;
+    accountId: string;
+    loginId: string;
+    purpose: 'openai_managed';
+    requestedModel: string | null;
+    model: string | null;
+    state: 'preparing' | 'request_may_have_started' | 'complete' | 'not_sent' | 'outcome_unknown';
+    result: {
+        inputTokens: number | null;
+        outputTokens: number | null;
+        totalTokens: number | null;
+    } | null;
+    problem: 'none' | 'target_unavailable' | 'access_unavailable' | 'catalog_unavailable' | 'account_busy' | 'cancelled' | 'authority_closing' | 'interrupted' | 'request_uncertain';
+    createdAt: string;
+    updatedAt: string;
+    finishedAt: string | null;
+    revision: number;
+}
+/** Credential-free native file ownership result. It makes no claim about a running session's active request. */
+export interface IAuthSwitchClaudeNativeHandoff {
+    id: string;
+    homeId: string;
+    outgoingAccountId: string;
+    incomingAccountId: string;
+    phase: 'reserved' | 'prepared' | 'committed' | 'aborted' | 'quarantined';
+    problem: 'none' | 'native_uncertain' | 'foreign_or_torn' | 'unsupported_effective_auth' | 'database_uncertain';
+    runningEffectiveAuth: 'no_scoped_sessions' | 'unsupported_effective_auth' | null;
+    updatedAt: string;
+}
+export interface IReq_AuthSwitchSwitchClaudeNative extends ITypedRequest {
+    method: 'authswitch.authority.claude.switch';
+    request: {
+        accountId: string;
+        loginId: string;
+        purpose: 'claude_host_native';
+    };
+    response: {
+        handoff: IAuthSwitchClaudeNativeHandoff;
+    };
+}
+export interface IReq_AuthSwitchClaudeNativeHandoff extends ITypedRequest {
+    method: 'authswitch.authority.claude.handoff';
+    request: {
+        operationId: string;
+    };
+    response: {
+        handoff: IAuthSwitchClaudeNativeHandoff;
+    };
+}
+export interface IReq_AuthSwitchClaudeNativeHandoffs extends ITypedRequest {
+    method: 'authswitch.authority.claude.handoffs';
+    request: {
+        after?: string;
+        limit?: number;
+    };
+    response: {
+        handoffs: IAuthSwitchClaudeNativeHandoff[];
+        nextCursor: string | null;
+    };
 }
 export interface IReq_AuthSwitchSnapshot extends ITypedRequest {
     method: 'authswitch.authority.snapshot';
     request: {
         accountAfter?: string;
+        loginAfter?: string;
         bindingAfter?: string;
         limit?: number;
     };
@@ -66,6 +285,34 @@ export interface IReq_AuthSwitchSnapshot extends ITypedRequest {
         snapshot: IAuthSwitchSnapshot;
     };
 }
+export interface IReq_AuthSwitchDoctor extends ITypedRequest {
+    method: 'authswitch.authority.doctor';
+    request: {
+        accountAfter?: string;
+        loginAfter?: string;
+        codexHomeAfter?: string;
+        claudeHomeAfter?: string;
+        claudeHandoffAfter?: string;
+        nativeHandoffAfter?: string;
+        migrationAfter?: string;
+        limit?: number;
+    };
+    response: {
+        page: IAuthSwitchDoctorPage;
+    };
+}
+/** Management-only usage read. The DTO contains no access or refresh credential. */
+export interface IReq_AuthSwitchUsage extends ITypedRequest {
+    method: 'authswitch.authority.usage';
+    request: {
+        accountId: string;
+        loginId: string;
+        force?: boolean;
+    };
+    response: {
+        usage: IAuthSwitchUsageSnapshot;
+    };
+}
 export interface IReq_AuthSwitchEvents extends ITypedRequest {
     method: 'authswitch.authority.events';
     request: {
@@ -83,6 +330,7 @@ export interface IReq_AuthSwitchEvents extends ITypedRequest {
 export interface IReq_AuthSwitchBeginAdd extends ITypedRequest {
     method: 'authswitch.authority.add';
     request: {
+        operationId: string;
         providerId: 'openai';
         flow: 'device';
     };
@@ -93,13 +341,27 @@ export interface IReq_AuthSwitchBeginAdd extends ITypedRequest {
 export interface IReq_AuthSwitchBeginReauth extends ITypedRequest {
     method: 'authswitch.authority.reauth';
     request: {
+        operationId: string;
         accountId: string;
+        loginId: string;
+        purpose: 'openai_managed';
         flow: 'device';
     };
     response: {
         operation: IAuthSwitchOperation;
     };
 }
+export interface IReq_AuthSwitchListOperations extends ITypedRequest {
+    method: 'authswitch.authority.operations';
+    request: {
+        after?: string;
+        limit?: number;
+    };
+    response: {
+        operations: IAuthSwitchOperation[];
+        nextCursor: string | null;
+    };
+}
 export interface IReq_AuthSwitchGetOperation extends ITypedRequest {
     method: 'authswitch.authority.operation';
     request: {
@@ -118,6 +380,38 @@ export interface IReq_AuthSwitchCancelOperation extends ITypedRequest {
         operation: IAuthSwitchOperation;
     };
 }
+export interface IReq_AuthSwitchStartPreuse extends ITypedRequest {
+    method: 'authswitch.authority.preuse.start';
+    request: {
+        operationId: string;
+        accountId: string;
+        loginId: string;
+        purpose: 'openai_managed';
+        prompt: string;
+        model?: string;
+    };
+    response: {
+        operation: IAuthSwitchPreuseOperation;
+    };
+}
+export interface IReq_AuthSwitchGetPreuse extends ITypedRequest {
+    method: 'authswitch.authority.preuse.operation';
+    request: {
+        operationId: string;
+    };
+    response: {
+        operation: IAuthSwitchPreuseOperation;
+    };
+}
+export interface IReq_AuthSwitchCancelPreuse extends ITypedRequest {
+    method: 'authswitch.authority.preuse.cancel';
+    request: {
+        operationId: string;
+    };
+    response: {
+        operation: IAuthSwitchPreuseOperation;
+    };
+}
 export interface IReq_AuthSwitchRenameAccount extends ITypedRequest {
     method: 'authswitch.authority.rename';
     request: {

package/dist_ts/authority-contract.js

@@ -1,3 +1,3 @@
 export {};
 /** Runtime capability is returned only to trusted backend callers; do not expose this response in a browser API. */
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aG9yaXR5LWNvbnRyYWN0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvYXV0aG9yaXR5LWNvbnRyYWN0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7QUE0R0Esb0hBQW9IIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aG9yaXR5LWNvbnRyYWN0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvYXV0aG9yaXR5LWNvbnRyYWN0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7QUF5V0Esb0hBQW9IIn0=

package/dist_ts/authority-runtime-contract.d.ts

@@ -5,6 +5,8 @@ export interface IReq_AuthSwitchBindAccount extends ITypedRequest {
     method: 'authswitch.authority.bind';
     request: {
         accountId: string;
+        loginId: string;
+        purpose: 'openai_managed';
         runtime: IAuthSwitchBinding['runtime'];
         scopeId: string;
         incarnationId: string;
@@ -32,3 +34,14 @@ export interface IReq_AuthSwitchResolveAccess extends ITypedRequest {
         grantGeneration: number;
     };
 }
+/** Backend-only release for one exact external runtime capability. */
+export interface IReq_AuthSwitchReleaseBinding extends ITypedRequest {
+    method: 'authswitch.authority.release';
+    request: {
+        bindingId: string;
+        capability: string;
+    };
+    response: {
+        state: 'released' | 'inactive';
+    };
+}

package/dist_ts/classes.accountlist.js

@@ -25,7 +25,8 @@ export const readAccountList = async (harnessesArg) => {
             result.saveUnavailableReason = state.saveUnavailableReason;
             result.credentialDrift = state.credentialDrift ?? [];
             result.accounts = rows.map(({ account, status }) => ({
-                id: account.id, label: account.label, isActive: account.isActive, isStashed: account.isStashed,
+                id: account.id, providerAccountId: account.providerAccountId, label: account.label,
+                isActive: account.isActive, isStashed: account.isStashed,
                 savedAt: account.savedAt, details: [...account.details], ...(account.slotId === undefined ? {} : { slotId: account.slotId }),
                 status: publicStatus(status),
             }));
@@ -36,9 +37,9 @@ export const readAccountList = async (harnessesArg) => {
         harnesses.push(result);
     }
     return {
-        schemaVersion: 2, generatedAt: new Date().toISOString(),
+        schemaVersion: 3, generatedAt: new Date().toISOString(),
         complete: harnesses.every(harness => !harness.problems.length && harness.accounts.every(account => !account.status.problems.length)),
         harnesses,
     };
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5hY2NvdW50bGlzdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL2NsYXNzZXMuYWNjb3VudGxpc3QudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLGVBQWUsRUFBRSxNQUFNLGVBQWUsQ0FBQztBQUloRCx5R0FBeUc7QUFDekcsTUFBTSxZQUFZLEdBQUcsQ0FBQyxTQUFnQyxFQUF5QixFQUFFO0lBQy9FLE1BQU0sT0FBTyxHQUFHLFNBQVMsQ0FBQyxPQUFPLENBQUM7SUFDbEMsT0FBTztRQUNMLEtBQUssRUFBRSxTQUFTLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsVUFBVSxFQUFFLEVBQUUsRUFBRSxDQUFDLENBQUMsRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSxVQUFVLEVBQUUsQ0FBQyxDQUFDO1FBQzlHLFFBQVEsRUFBRSxDQUFDLEdBQUcsU0FBUyxDQUFDLFFBQVEsQ0FBQztRQUNqQyxHQUFHLENBQUMsT0FBTyxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLE9BQU8sRUFBRTtnQkFDMUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxZQUFZLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsWUFBWSxFQUFFLEVBQUUsSUFBSSxFQUFFLE9BQU8sQ0FBQyxZQUFZLENBQUMsSUFBSSxFQUFFLE1BQU0sRUFBRSxPQUFPLENBQUMsWUFBWSxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUM7Z0JBQ3pJLEdBQUcsQ0FBQyxPQUFPLENBQUMsT0FBTyxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLE9BQU8sRUFBRSxFQUFFLHFCQUFxQixFQUFFLE9BQU8sQ0FBQyxPQUFPLENBQUMscUJBQXFCLEVBQUUsU0FBUyxFQUFFLE9BQU8sQ0FBQyxPQUFPLENBQUMsU0FBUyxFQUFFLFFBQVEsRUFBRSxPQUFPLENBQUMsT0FBTyxDQUFDLFFBQVEsRUFBRSxTQUFTLEVBQUUsT0FBTyxDQUFDLE9BQU8sQ0FBQyxTQUFTLEVBQUUsU0FBUyxFQUFFLE9BQU8sQ0FBQyxPQUFPLENBQUMsU0FBUyxFQUFFLEVBQUUsQ0FBQztnQkFDN1EsR0FBRyxDQUFDLE9BQU8sQ0FBQyxZQUFZLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsWUFBWSxFQUFFLE9BQU8sQ0FBQyxZQUFZLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFLGVBQWUsRUFBRSxXQUFXLEVBQUUsT0FBTyxFQUFFLFFBQVEsRUFBRSxRQUFRLEVBQUUsRUFBRSxFQUFFLENBQUMsQ0FBQyxFQUFFLEtBQUssRUFBRSxLQUFLLEVBQUUsZUFBZSxFQUFFLFdBQVcsRUFBRSxPQUFPLEVBQUUsUUFBUSxFQUFFLFFBQVEsRUFBRSxDQUFDLENBQUMsRUFBRSxDQUFDO2dCQUN6UCxHQUFHLENBQUMsT0FBTyxDQUFDLE1BQU0sS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxNQUFNLEVBQUU7d0JBQ2hELFNBQVMsRUFBRSxPQUFPLENBQUMsTUFBTSxDQUFDLFNBQVM7d0JBQ25DLEdBQUcsQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLE9BQU8sS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxPQUFPLEVBQUUsT0FBTyxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxNQUFNLEVBQUUsSUFBSSxFQUFFLFNBQVMsRUFBRSxFQUFFLEVBQUUsQ0FBQyxDQUFDLEVBQUUsTUFBTSxFQUFFLElBQUksRUFBRSxTQUFTLEVBQUUsQ0FBQyxDQUFDLEVBQUUsQ0FBQztxQkFDekosRUFBRSxDQUFDO2FBQ0wsRUFBRSxDQUFDO0tBQ0wsQ0FBQztBQUNKLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLGVBQWUsR0FBRyxLQUFLLEVBQUUsWUFBNEIsRUFBeUIsRUFBRTtJQUMzRixNQUFNLFNBQVMsR0FBMEIsRUFBRSxDQUFDO0lBQzVDLEtBQUssTUFBTSxPQUFPLElBQUksWUFBWSxFQUFFLENBQUM7UUFDbkMsTUFBTSxNQUFNLEdBQXdCLEVBQUUsRUFBRSxFQUFFLE9BQU8sQ0FBQyxFQUFFLEVBQUUsS0FBSyxFQUFFLE9BQU8sQ0FBQyxLQUFLLEVBQUUsU0FBUyxFQUFFLE9BQU8sQ0FBQyxTQUFTLEVBQUUscUJBQXFCLEVBQUUsSUFBSSxFQUFFLFFBQVEsRUFBRSxFQUFFLEVBQUUsZUFBZSxFQUFFLEVBQUUsRUFBRSxRQUFRLEVBQUUsRUFBRSxFQUFFLENBQUM7UUFDekwsSUFBSSxDQUFDO1lBQ0gsTUFBTSxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsR0FBRyxNQUFNLGVBQWUsQ0FBQyxPQUFPLENBQUMsQ0FBQztZQUN2RCxNQUFNLENBQUMscUJBQXFCLEdBQUcsS0FBSyxDQUFDLHFCQUFxQixDQUFDO1lBQzNELE1BQU0sQ0FBQyxlQUFlLEdBQUcsS0FBSyxDQUFDLGVBQWUsSUFBSSxFQUFFLENBQUM7WUFDckQsTUFBTSxDQUFDLFFBQVEsR0FBRyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxPQUFPLEVBQUUsTUFBTSxFQUFFLEVBQUUsRUFBRSxDQUFDLENBQUM7Z0JBQ25ELEVBQUUsRUFBRSxPQUFPLENBQUMsRUFBRSxFQUFFLEtBQUssRUFBRSxPQUFPLENBQUMsS0FBSyxFQUFFLFFBQVEsRUFBRSxPQUFPLENBQUMsUUFBUSxFQUFFLFNBQVMsRUFBRSxPQUFPLENBQUMsU0FBUztnQkFDOUYsT0FBTyxFQUFFLE9BQU8sQ0FBQyxPQUFPLEVBQUUsT0FBTyxFQUFFLENBQUMsR0FBRyxPQUFPLENBQUMsT0FBTyxDQUFDLEVBQUUsR0FBRyxDQUFDLE9BQU8sQ0FBQyxNQUFNLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsTUFBTSxFQUFFLE9BQU8sQ0FBQyxNQUFNLEVBQUUsQ0FBQztnQkFDNUgsTUFBTSxFQUFFLFlBQVksQ0FBQyxNQUFPLENBQUM7YUFDOUIsQ0FBQyxDQUFDLENBQUM7UUFDTixDQUFDO1FBQUMsTUFBTSxDQUFDO1lBQ1AsTUFBTSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsMkNBQTJDLE9BQU8sQ0FBQyxFQUFFLFVBQVUsQ0FBQyxDQUFDO1FBQ3hGLENBQUM7UUFDRCxTQUFTLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQ3pCLENBQUM7SUFDRCxPQUFPO1FBQ0wsYUFBYSxFQUFFLENBQUMsRUFBRSxXQUFXLEVBQUUsSUFBSSxJQUFJLEVBQUUsQ0FBQyxXQUFXLEVBQUU7UUFDdkQsUUFBUSxFQUFFLFNBQVMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsTUFBTSxJQUFJLE9BQU8sQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUNwSSxTQUFTO0tBQ1YsQ0FBQztBQUNKLENBQUMsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5hY2NvdW50bGlzdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL2NsYXNzZXMuYWNjb3VudGxpc3QudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLGVBQWUsRUFBRSxNQUFNLGVBQWUsQ0FBQztBQUloRCx5R0FBeUc7QUFDekcsTUFBTSxZQUFZLEdBQUcsQ0FBQyxTQUFnQyxFQUF5QixFQUFFO0lBQy9FLE1BQU0sT0FBTyxHQUFHLFNBQVMsQ0FBQyxPQUFPLENBQUM7SUFDbEMsT0FBTztRQUNMLEtBQUssRUFBRSxTQUFTLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsVUFBVSxFQUFFLEVBQUUsRUFBRSxDQUFDLENBQUMsRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSxVQUFVLEVBQUUsQ0FBQyxDQUFDO1FBQzlHLFFBQVEsRUFBRSxDQUFDLEdBQUcsU0FBUyxDQUFDLFFBQVEsQ0FBQztRQUNqQyxHQUFHLENBQUMsT0FBTyxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLE9BQU8sRUFBRTtnQkFDMUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxZQUFZLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsWUFBWSxFQUFFLEVBQUUsSUFBSSxFQUFFLE9BQU8sQ0FBQyxZQUFZLENBQUMsSUFBSSxFQUFFLE1BQU0sRUFBRSxPQUFPLENBQUMsWUFBWSxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUM7Z0JBQ3pJLEdBQUcsQ0FBQyxPQUFPLENBQUMsT0FBTyxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLE9BQU8sRUFBRSxFQUFFLHFCQUFxQixFQUFFLE9BQU8sQ0FBQyxPQUFPLENBQUMscUJBQXFCLEVBQUUsU0FBUyxFQUFFLE9BQU8sQ0FBQyxPQUFPLENBQUMsU0FBUyxFQUFFLFFBQVEsRUFBRSxPQUFPLENBQUMsT0FBTyxDQUFDLFFBQVEsRUFBRSxTQUFTLEVBQUUsT0FBTyxDQUFDLE9BQU8sQ0FBQyxTQUFTLEVBQUUsU0FBUyxFQUFFLE9BQU8sQ0FBQyxPQUFPLENBQUMsU0FBUyxFQUFFLEVBQUUsQ0FBQztnQkFDN1EsR0FBRyxDQUFDLE9BQU8sQ0FBQyxZQUFZLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsWUFBWSxFQUFFLE9BQU8sQ0FBQyxZQUFZLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFLGVBQWUsRUFBRSxXQUFXLEVBQUUsT0FBTyxFQUFFLFFBQVEsRUFBRSxRQUFRLEVBQUUsRUFBRSxFQUFFLENBQUMsQ0FBQyxFQUFFLEtBQUssRUFBRSxLQUFLLEVBQUUsZUFBZSxFQUFFLFdBQVcsRUFBRSxPQUFPLEVBQUUsUUFBUSxFQUFFLFFBQVEsRUFBRSxDQUFDLENBQUMsRUFBRSxDQUFDO2dCQUN6UCxHQUFHLENBQUMsT0FBTyxDQUFDLE1BQU0sS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxNQUFNLEVBQUU7d0JBQ2hELFNBQVMsRUFBRSxPQUFPLENBQUMsTUFBTSxDQUFDLFNBQVM7d0JBQ25DLEdBQUcsQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLE9BQU8sS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxPQUFPLEVBQUUsT0FBTyxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxNQUFNLEVBQUUsSUFBSSxFQUFFLFNBQVMsRUFBRSxFQUFFLEVBQUUsQ0FBQyxDQUFDLEVBQUUsTUFBTSxFQUFFLElBQUksRUFBRSxTQUFTLEVBQUUsQ0FBQyxDQUFDLEVBQUUsQ0FBQztxQkFDekosRUFBRSxDQUFDO2FBQ0wsRUFBRSxDQUFDO0tBQ0wsQ0FBQztBQUNKLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLGVBQWUsR0FBRyxLQUFLLEVBQUUsWUFBNEIsRUFBeUIsRUFBRTtJQUMzRixNQUFNLFNBQVMsR0FBMEIsRUFBRSxDQUFDO0lBQzVDLEtBQUssTUFBTSxPQUFPLElBQUksWUFBWSxFQUFFLENBQUM7UUFDbkMsTUFBTSxNQUFNLEdBQXdCLEVBQUUsRUFBRSxFQUFFLE9BQU8sQ0FBQyxFQUFFLEVBQUUsS0FBSyxFQUFFLE9BQU8sQ0FBQyxLQUFLLEVBQUUsU0FBUyxFQUFFLE9BQU8sQ0FBQyxTQUFTLEVBQUUscUJBQXFCLEVBQUUsSUFBSSxFQUFFLFFBQVEsRUFBRSxFQUFFLEVBQUUsZUFBZSxFQUFFLEVBQUUsRUFBRSxRQUFRLEVBQUUsRUFBRSxFQUFFLENBQUM7UUFDekwsSUFBSSxDQUFDO1lBQ0gsTUFBTSxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsR0FBRyxNQUFNLGVBQWUsQ0FBQyxPQUFPLENBQUMsQ0FBQztZQUN2RCxNQUFNLENBQUMscUJBQXFCLEdBQUcsS0FBSyxDQUFDLHFCQUFxQixDQUFDO1lBQzNELE1BQU0sQ0FBQyxlQUFlLEdBQUcsS0FBSyxDQUFDLGVBQWUsSUFBSSxFQUFFLENBQUM7WUFDckQsTUFBTSxDQUFDLFFBQVEsR0FBRyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxPQUFPLEVBQUUsTUFBTSxFQUFFLEVBQUUsRUFBRSxDQUFDLENBQUM7Z0JBQ25ELEVBQUUsRUFBRSxPQUFPLENBQUMsRUFBRSxFQUFFLGlCQUFpQixFQUFFLE9BQU8sQ0FBQyxpQkFBaUIsRUFBRSxLQUFLLEVBQUUsT0FBTyxDQUFDLEtBQUs7Z0JBQ2xGLFFBQVEsRUFBRSxPQUFPLENBQUMsUUFBUSxFQUFFLFNBQVMsRUFBRSxPQUFPLENBQUMsU0FBUztnQkFDeEQsT0FBTyxFQUFFLE9BQU8sQ0FBQyxPQUFPLEVBQUUsT0FBTyxFQUFFLENBQUMsR0FBRyxPQUFPLENBQUMsT0FBTyxDQUFDLEVBQUUsR0FBRyxDQUFDLE9BQU8sQ0FBQyxNQUFNLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsTUFBTSxFQUFFLE9BQU8sQ0FBQyxNQUFNLEVBQUUsQ0FBQztnQkFDNUgsTUFBTSxFQUFFLFlBQVksQ0FBQyxNQUFPLENBQUM7YUFDOUIsQ0FBQyxDQUFDLENBQUM7UUFDTixDQUFDO1FBQUMsTUFBTSxDQUFDO1lBQ1AsTUFBTSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsMkNBQTJDLE9BQU8sQ0FBQyxFQUFFLFVBQVUsQ0FBQyxDQUFDO1FBQ3hGLENBQUM7UUFDRCxTQUFTLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQ3pCLENBQUM7SUFDRCxPQUFPO1FBQ0wsYUFBYSxFQUFFLENBQUMsRUFBRSxXQUFXLEVBQUUsSUFBSSxJQUFJLEVBQUUsQ0FBQyxXQUFXLEVBQUU7UUFDdkQsUUFBUSxFQUFFLFNBQVMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsTUFBTSxJQUFJLE9BQU8sQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUNwSSxTQUFTO0tBQ1YsQ0FBQztBQUNKLENBQUMsQ0FBQyJ9

package/dist_ts/classes.authoritybroker.d.ts

@@ -1,8 +1,9 @@
 import * as plugins from './plugins.js';
 import type { IAuthSwitchAccount, IAuthSwitchAccountEvent, IAuthSwitchBinding, IAuthSwitchOperation, IAuthSwitchSnapshot } from './authority-contract.js';
 import { AuthSwitchAuthorityDatabase } from './classes.authoritydatabase.js';
+import type { IAuthSwitchUsageContext } from './classes.authorityusage.js';
 import { type IAuthSwitchSecretCodec } from './classes.authoritysecrets.js';
-type TOpenAiProvider = Pick<plugins.flexAccounts.ISmartAiProviderAdapter, 'beginLogin' | 'refreshCredential' | 'inspectCredential' | 'dispose'>;
+type TOpenAiProvider = Pick<plugins.flexAccounts.ISmartAiProviderAdapter, 'beginLogin' | 'refreshCredential' | 'inspectCredential' | 'getAccountRateLimits' | 'dispose'>;
 export interface IAuthSwitchAuthorityBrokerOptions {
     provider?: TOpenAiProvider;
     secrets?: IAuthSwitchSecretCodec;
@@ -16,6 +17,7 @@ export interface IAuthSwitchResolvedAccess {
     expiresAt: string;
     grantGeneration: number;
 }
+export declare const authSwitchBindingCapabilityHash: (capability: string) => string;
 /** One daemon-owned authority. No management DTO contains a refresh grant. */
 export declare class AuthSwitchAuthorityBroker {
     private readonly database;
@@ -23,12 +25,18 @@ export declare class AuthSwitchAuthorityBroker {
     private readonly secrets;
     private readonly now;
     private readonly proactive;
+    private readonly starts;
     private readonly operations;
     private readonly refreshes;
     private readonly listeners;
+    private claudeRefresh?;
+    private maintenance?;
     private timer?;
     private closed;
+    private closing?;
     constructor(database: AuthSwitchAuthorityDatabase, options?: IAuthSwitchAuthorityBrokerOptions);
+    setClaudeRefresher(refresh: (grantId: string) => Promise<void>): void;
+    notifyChanged(): void;
     start(): Promise<void>;
     private schedule;
     refreshDueAccounts(): Promise<void>;
@@ -36,6 +44,7 @@ export declare class AuthSwitchAuthorityBroker {
     private publish;
     snapshot(options?: {
         accountAfter?: string;
+        loginAfter?: string;
         bindingAfter?: string;
         limit?: number;
     }): Promise<IAuthSwitchSnapshot>;
@@ -48,18 +57,25 @@ export declare class AuthSwitchAuthorityBroker {
     private identity;
     private sealCredential;
     private unsealCredential;
-    beginAddOpenAi(): Promise<IAuthSwitchOperation>;
-    beginReauthOpenAi(accountId: string): Promise<IAuthSwitchOperation>;
+    private startDeviceOperation;
+    private finishStartingOperation;
+    beginAddOpenAi(operationId: string): Promise<IAuthSwitchOperation>;
+    beginReauthOpenAi(operationId: string, accountId: string, loginId: string, purpose: 'openai_managed', beforeNew?: () => Promise<void>): Promise<IAuthSwitchOperation>;
     private beginLogin;
-    getOperation(operationId: string): IAuthSwitchOperation;
+    getOperation(operationId: string): Promise<IAuthSwitchOperation>;
+    listOperations(after: string | null, limit?: number): Promise<{
+        operations: IAuthSwitchOperation[];
+        nextCursor: string | null;
+    }>;
     /** Trusted daemon lifecycle hook: hold new managed runtimes out until targeted reauth settles. */
     waitOperation(operationId: string): Promise<void>;
-    private pruneOperations;
     cancelOperation(operationId: string): Promise<IAuthSwitchOperation>;
     renameAccount(accountId: string, expectedRevision: number, label: string): Promise<IAuthSwitchAccount>;
     removeAccount(accountId: string, expectedRevision: number): Promise<IAuthSwitchAccount>;
     bindAccount(input: {
         accountId: string;
+        loginId: string;
+        purpose: 'openai_managed';
         runtime: IAuthSwitchBinding['runtime'];
         scopeId: string;
         incarnationId: string;
@@ -68,7 +84,11 @@ export declare class AuthSwitchAuthorityBroker {
         capability: string;
     }>;
     revokeBinding(bindingId: string, capability: string): Promise<boolean>;
+    releaseExternalBinding(bindingId: string, capability: string): Promise<'released' | 'inactive'>;
     resolveAccess(bindingId: string, capability: string, minValidityMs: number, rejectedGrantGeneration?: number): Promise<IAuthSwitchResolvedAccess>;
+    /** Backend-only access for usage; it never creates or bypasses a runtime binding. */
+    resolveUsageAccess(context: IAuthSwitchUsageContext, rejectedGrantGeneration: number | undefined, minValidityMs: number): Promise<IAuthSwitchResolvedAccess>;
+    private resolveManagedAccess;
     private refreshAccount;
     private performRefresh;
     close(): Promise<void>;