@modelprofile.com/authswitch 7.0.0 → 8.1.0

package/readme.md

@@ -92,8 +92,8 @@ digests and sealed values, while managed Codex reports durable, in-memory and ob
 state independently with fixed problem categories. Continue each independent cursor to inspect
 the complete inventory. Pages are later observations rather than one atomic global snapshot,
 and the authority metadata revision is not a change clock for every native-home record. If the
-management socket is unavailable, an offline caller must leave database and admission state
-unknown instead of starting the database to inspect it.
+management socket is unavailable, an offline caller must leave the database state unknown
+instead of starting the database to inspect it.
 
 The authority CLI uses that daemon surface without constructing the legacy native harness adapters:
 
@@ -110,6 +110,9 @@ authswitch account preuse operation get <operation-id> [--json]
 authswitch account preuse operation cancel <operation-id> [--json]
 authswitch account preuse operation resume <operation-id> [--json]
 authswitch authority doctor [--json]
+authswitch authority import inventory [--json]
+authswitch authority import status [--json]
+authswitch authority import submit <source-id> --digest <source-digest> [--json]
 ```
 
 `account list --json` prints the complete, consistent credential-free authority snapshot.
@@ -164,6 +167,49 @@ If the daemon is unavailable before the first response, it fails with a fixed di
 stderr and leaves stdout empty. The older native-store commands documented below still coexist until the coordinated
 major-version migration and removal; these authority routes never use them.
 
+## The one-time account import
+
+The three `authority import` commands move the accounts that existed before the authority into it.
+
+`import inventory` reads this host and changes nothing: no authority record, no legacy file, no
+credential. It lists every Codex stash directory, saved credential record and native Codex, Claude and
+OpenCode store with the authority account it resolves to, derived from the claims the stored token already
+carries -- no provider is contacted. A malformed or unrecognised entry is reported rather than skipped, so
+an empty result is never mistaken for an empty store. The report carries no token, no token digest and no
+source path; a source is named by a hash of its location and a digest of its bytes.
+
+Each source is classified by who refreshes its login **after** the import.
+
+- **adopt** -- a copy authswitch made for itself, and AGL's own records. Nothing else refreshes such a
+  copy, so the authority takes it over outright. It is verified by one real refresh, which rotates the
+  token: from that moment the legacy copy is dead. That is the point of no return for that account, and the
+  only fallback is one device sign-in.
+- **project** -- a native Codex, Claude or OpenCode store. The vendor tool keeps refreshing its own store,
+  so the authority registers the account, leaves the grant with its native owner and holds no copy of the
+  credential. It is verified by a provider read with the access token already in the store, which rotates
+  nothing. Two refreshers on one rotating refresh token is the failure this avoids.
+
+`import submit` takes the source id and the digest the owner read in the inventory. The daemon re-reads the
+source itself and refuses if the digest changed, so approving one source can never import a different one;
+no credential crosses the socket for a source this package can read. It refuses while an authswitch watch, a
+native harness process or Codex's app-server is running, and an app-server it cannot ask counts as running.
+An adopt whose refresh fails, or whose answer is lost, is never retried: the source is quarantined, its grant
+is left needing re-authentication, and the command says so. A projection fails differently, because nothing
+rotating was ever sent for it: a native store that could not be proven live stays a pending native owner and
+is imported by submitting the same source again once its own tool has refreshed it.
+
+`import status` reads the migration ledger, the grants and the handoffs -- never the host -- and reports, per
+source, where it stands, which owner refreshes its login now, and what to do next: nothing, submit the same
+source again, or sign in to that account again. Submitting a source again is how an interrupted run resumes,
+and the answer comes from the same durable record the daemon decides on: a source whose sign-in was in
+flight when the run died is reported as needing a device sign-in, not as resumable, because a rotating
+refresh token is never sent a second time. Sources that were never submitted have no ledger row and appear
+only in the inventory.
+
+An import deletes nothing: retiring the legacy files is a separate, later step. The authority store is
+deliberately not backed up, so losing it costs one device sign-in per account -- and the remote-control
+enrollments and runtime bindings with it.
+
 `AuthSwitchClient.getUsage(accountId, loginId)` reads OpenAI managed limits or a Claude
 host login's profile and usage through the management socket. The tagged, credential-free
 reading preserves Claude's labelled five-hour, weekly and model windows, plan provenance,
@@ -176,7 +222,7 @@ both status requests and publication, and revalidate the exact credential and co
 source even when serving a cached result. Native grants are never refreshed by the daemon.
 Pending, quarantined, setup-token-without-profile-scope and other unsupported contexts
 return explicit unavailable status without a provider request. Production native home
-adoption still requires the separate verified migration and backup cutover.
+adoption still requires the separate verified migration cutover.
 
 `AuthSwitchClient.startPreuse()` accepts one client-generated operation UUID and one exact
 OpenAI account/login/purpose. The daemon resolves an access-only grant, optionally reads the
@@ -187,8 +233,6 @@ marker remains `outcome_unknown` and is never replayed. Before-marker refusals a
 Only the request hash, selected model, timing and safe token counts are stored; the prompt,
 generated prose and credentials are absent from persistence and management responses. Account
 removal and targeted reauthentication refuse while that account has an active preuse request.
-Historical restore marks every unresolved preuse receipt `outcome_unknown`, including snapshots
-captured before the marker, because the original authority may have sent after snapshot capture.
 
 A trusted in-process daemon host can call `AuthSwitchAuthorityDaemon.startManagedCodex()`
 for a bound account and workspace. It owns a private Codex 0.155.1 app-server, passes only
@@ -226,27 +270,25 @@ The backend-only Claude native handoff journals an exact two-file write and tran
 ownership between two account grants in one SmartData transaction. An inactive Claude
 grant is refreshed by the daemon only after a durable pre-send marker; pending, native,
 and quarantined grants cannot enter that exchange. A native home and incoming grant
-require source-mapped migration receipts with backup metadata. The ledger field does
-not itself verify a SmartBucket backup, so the default daemon does not configure a
-Claude native home or run this path against real credentials. One-time migration and
-backup verification must precede production activation. Handoff receipts are queryable
-after a lost response. `runningEffectiveAuth: unsupported_effective_auth` means the
-native store changed, while an already-running Claude process's effective login cannot
-be proven externally; qualified live native-store switching still works.
-
-The authority database uses one versioned collection registry for startup preparation,
-ordered backup capture and exact restore readback. Startup rejects unknown collections,
-unknown metadata schemas and an incomplete restored database. Published 6.4/6.5 metadata
-is upgraded in place while account IDs, sealed grants, enrollments and uncertain states
-remain intact. A restored database keeps a durable closed-admission marker across restart;
-the daemon refuses provider and runtime work until a separate ownership-reconciliation
-step can prove it safe to open. Backup capture pins its paged records in one SmartData
-transaction and stages each retry anew before any SmartBucket publication. The closed
-restore rehearsal runs in a separate package-owned child, keeps its temporary source and
-record stream encrypted, restores metadata closed before any other record, then stops and
-reopens the same disposable database for exact stored readback. A receipt is issued only
-after the child has closed and its temporary root has been removed. This rehearsal does
-not perform a production restore or authorize a new authority instance to take ownership.
+require a verified import receipt: a migration ledger row that binds the exact source
+digest to one account and grant. A source counts as migrated only after such a verified
+import. Nothing in this package writes that ledger yet, so the default daemon does not
+configure a Claude native home or run this path against real credentials. Handoff
+receipts are queryable after a lost response.
+`runningEffectiveAuth: unsupported_effective_auth` means the native store changed, while
+an already-running Claude process's effective login cannot be proven externally;
+qualified live native-store switching still works.
+
+The authority database admits exactly the collections of one registry and prepares each
+at startup. Startup rejects unknown collections, unknown metadata schemas and an existing
+store without its metadata document. Published 7.0.0 metadata is upgraded in place to the
+shape 6.4/6.5 already wrote, while account IDs, sealed grants, enrollments and uncertain
+states remain intact. A 7.0.0 store that a restore had marked closed is refused, not opened.
+Startup also removes the backup digest that 6.4.0 to 7.0.0 stored on native handoff and
+migration ledger rows, and refuses a store holding a record only the retired backup and
+restore system could have written.
+The store is deliberately not backed up: its refresh grants are sealed to this host's TPM,
+so a lost store is recovered by one device re-login per account.
 
 ## Usage
 

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@modelprofile.com/authswitch',
-  version: '7.0.0',
+  version: '8.1.0',
   description: 'Manage Codex, OpenCode and Claude Code accounts with guided switching and live usage status'
 }

package/ts/authority-contract.ts

@@ -169,8 +169,6 @@ export interface IAuthSwitchDoctorPage {
   database: {
     state: 'available';
     observedAt: string;
-    schemaVersion: 2;
-    admission: 'open' | 'closed_restored';
     epoch: string;
     revision: number;
   };
@@ -229,7 +227,7 @@ export interface IAuthSwitchPreuseOperation {
   result: { inputTokens: number | null; outputTokens: number | null; totalTokens: number | null } | null;
   problem: 'none' | 'target_unavailable' | 'access_unavailable' | 'catalog_unavailable'
     | 'account_busy' | 'cancelled' | 'authority_closing' | 'interrupted'
-    | 'request_uncertain' | 'restored_history_uncertain';
+    | 'request_uncertain';
   createdAt: string;
   updatedAt: string;
   finishedAt: string | null;

package/ts/authority-import-contract.ts

@@ -0,0 +1,216 @@
+import type { ITypedRequest } from '@api.global/typedrequest-interfaces';
+
+/**
+ * The one-time account import: reading the legacy stores that existed before the authority, and the
+ * credential-free report an owner reads before anything is imported.
+ *
+ * Importing a refresh token is a transfer of ownership, not a copy. The provider rotates a refresh token on
+ * use, so the moment one holder refreshes, every other copy of that token is dead. This contract therefore
+ * separates the classes of legacy source by who refreshes them after the import, and names the proof each
+ * class can offer without rotating anything.
+ */
+
+/** Mirrors the migration ledger's source kinds, which are the only sources a ledger row can describe. */
+export type TAuthSwitchImportSourceKind = 'authswitch_stash' | 'authswitch_backup' | 'agl_flex'
+  | 'codex_native' | 'opencode_native' | 'claude_native';
+
+/**
+ * The ledger statuses a source can already hold when an inventory runs.
+ *
+ * - `prepared`: the source is named in the authority and nothing has been sent for it yet.
+ * - `pending_native_owner`: the account is registered and its native tool keeps the refresher, but the
+ *   store could not be proven live. Nothing rotating was ever sent, so it is proven by submitting the
+ *   source again once that tool has refreshed its own store.
+ * - `verified` and `complete`: the import settled; `complete` is the tombstone for that source.
+ * - `quarantined`: a rotating refresh may already have been consumed for this source, so it is never
+ *   submitted again and its account is repaired by a device sign-in.
+ */
+export type TAuthSwitchImportLedgerStatus = 'pending_native_owner' | 'prepared' | 'verified' | 'complete'
+  | 'quarantined';
+
+/**
+ * What the ownership rule allows for a source.
+ *
+ * - `import`: the authority becomes the single refresher. Nothing else owns this copy, so taking it over
+ *   strands no other holder.
+ * - `project`: a native tool keeps refreshing its own store; the authority registers the account and holds
+ *   the grant as a projection it must never refresh. Two refreshers on one refresh token is the failure this
+ *   avoids.
+ * - `refuse`: the source cannot become an authority grant at all, and the owner signs in again instead.
+ */
+export type TAuthSwitchImportTreatment = 'import' | 'project' | 'refuse';
+
+/**
+ * What can make this source's ledger row `verified`.
+ *
+ * - `rotating_refresh`: one real refresh through the authority. It proves the refresh token was live and
+ *   makes the authority its holder in the same step -- and it is the point of no return, because the legacy
+ *   copy is stale from that moment.
+ * - `access_token_read`: a provider read with the stored access token alone, matched against the identity
+ *   derived locally from the same source bytes. It rotates nothing, so a native refresher keeps its grant.
+ *   It is available only while that access token is still valid.
+ * - `none`: no proof exists for this source; it cannot be verified and cannot be imported.
+ */
+export type TAuthSwitchImportProof = 'rotating_refresh' | 'access_token_read' | 'none';
+
+/**
+ * One legacy source as the inventory found it. Credential-free by construction: identity claims and a digest
+ * of the source bytes, never a token, a token digest, or the source path.
+ */
+export interface IAuthSwitchImportSource {
+  /** The migration ledger row this source would use. Derived from its kind and path, so it is stable. */
+  id: string;
+  sourceKind: TAuthSwitchImportSourceKind;
+  /** The source location as a hash. The ledger never stores a path and this DTO never exposes one. */
+  sourcePathHash: string;
+  /** Binds a later import to exactly these bytes. Changes whenever the source changes. */
+  sourceDigest: string;
+  treatment: TAuthSwitchImportTreatment;
+  proof: TAuthSwitchImportProof;
+  /** The authority account this source resolves to, derived locally from its identity claims. */
+  accountId: string | null;
+  providerId: string | null;
+  email: string | null;
+  plan: string | null;
+  label: string | null;
+  /** Expiry claim of the stored access token. It decides whether a non-rotating proof is available now. */
+  accessExpiresAt: string | null;
+  /** Remote-control enrollments carried by this source; `null` when they could not be counted. */
+  enrollmentCount: number | null;
+  /** The ledger row for this source, when one already exists. */
+  ledgerStatus: TAuthSwitchImportLedgerStatus | null;
+  /** Why this source cannot be submitted as it stands. An empty list means it can. */
+  problems: string[];
+}
+
+/** The complete credential-free report. `notice` is what the owner must know before importing anything. */
+export interface IAuthSwitchImportInventory {
+  generatedAt: string;
+  /** Identifies the credential locations this inventory read, as `authSwitchEnvironmentId` computes them. */
+  environmentId: string;
+  notice: string[];
+  sources: IAuthSwitchImportSource[];
+  /** Locations that could not be read at all, so an empty result never looks like an empty store. */
+  problems: string[];
+}
+
+/** Management-only. Reads legacy stores and the ledger; changes nothing, and carries no credential. */
+export interface IReq_AuthSwitchImportInventory extends ITypedRequest {
+  method: 'authswitch.authority.import.inventory';
+  request: Record<string, never>;
+  response: { inventory: IAuthSwitchImportInventory };
+}
+
+/** A ChatGPT login held by a store outside this package, submitted by the backend that owns its format. */
+export interface IAuthSwitchImportOpenAiCredential {
+  providerId: 'openai';
+  accessToken: string;
+  refreshToken: string;
+  idToken: string;
+}
+
+/**
+ * What is being imported.
+ *
+ * A source this daemon can read itself is named only by its id: the daemon re-runs its readers, resolves the
+ * location from the hash and re-checks the digest, so no credential crosses the socket and no caller can
+ * substitute bytes the owner never approved. Only a store this package cannot read -- AGL's sealed Flex
+ * records -- submits material, and that is the whole reason submit lives on the backend-only runtime socket.
+ */
+export type TAuthSwitchImportSubmission =
+  | { kind: 'local'; sourceId: string; sourceDigest: string }
+  | { kind: 'external'; sourceKind: 'agl_flex'; sourcePathHash: string; sourceDigest: string;
+      credential: IAuthSwitchImportOpenAiCredential };
+
+/** The outcome of one source. `quarantined` always names what to do instead, never a silent failure. */
+export interface IAuthSwitchImportResult {
+  sourceId: string;
+  sourceKind: TAuthSwitchImportSourceKind;
+  treatment: TAuthSwitchImportTreatment;
+  status: TAuthSwitchImportLedgerStatus;
+  accountId: string | null;
+  loginId: string | null;
+  problems: string[];
+}
+
+/**
+ * What the owner does next with one source.
+ *
+ * - `none`: the import settled; nothing is outstanding.
+ * - `resume`: submit the same source again. Nothing rotating has been sent for this source, so a second
+ *   attempt is safe: an interrupted adopt continues from its durable record, and a native store that could
+ *   not be proven live is proven the moment its own tool has refreshed it.
+ * - `device_login`: this source is finished as a source. Its account needs a fresh device sign-in, because a
+ *   rotating refresh token whose outcome is unknown is never sent a second time.
+ */
+export type TAuthSwitchImportAction = 'none' | 'resume' | 'device_login';
+
+/**
+ * Marks an error answer whose text is an instruction for the owner, not a report of a fault.
+ *
+ * The daemon sets it on the refusals the importer authors and on nothing else. Every other failure answers
+ * with the transport's own sanitised text, which a caller must never present as if it said what to do next --
+ * for a submit in particular, an unmarked failure means the outcome is unknown and the source must be read
+ * with `authswitch.authority.import.status` rather than submitted again.
+ */
+export const authSwitchImportRefusalReason = 'authswitch_import_refusal';
+
+/** True when the daemon answered with an importer refusal, so `error.message` is the instruction to show. */
+export const isAuthSwitchImportRefusal = (error: unknown): boolean => {
+  if (typeof error !== 'object' || error === null || !('errorData' in error)) return false;
+  const data = error.errorData;
+  return typeof data === 'object' && data !== null && 'reason' in data
+    && data.reason === authSwitchImportRefusalReason;
+};
+
+/**
+ * Where one source stands, read from the migration ledger, the grant it produced and its handoff.
+ *
+ * Only sources the authority has been told about appear here. A source that was never submitted has no
+ * ledger row; `authority import inventory` is the read that looks at the host and lists those.
+ */
+export interface IAuthSwitchImportStatusEntry {
+  sourceId: string;
+  sourceKind: TAuthSwitchImportSourceKind;
+  status: TAuthSwitchImportLedgerStatus;
+  accountId: string | null;
+  loginId: string | null;
+  /**
+   * Who refreshes that login now, or `null` when the ledger row names no grant yet. `none` is the absence of
+   * a refresher: the grant needs a device sign-in before anything can use it again.
+   */
+  owner: 'daemon' | 'claude_native' | 'legacy_native' | 'none' | null;
+  action: TAuthSwitchImportAction;
+  statusObservedAt: string;
+}
+
+export interface IAuthSwitchImportStatus {
+  generatedAt: string;
+  entries: IAuthSwitchImportStatusEntry[];
+  nextCursor: string | null;
+}
+
+/** Management-only. Reads durable records only; it opens no legacy store and carries no credential. */
+export interface IReq_AuthSwitchImportStatus extends ITypedRequest {
+  method: 'authswitch.authority.import.status';
+  request: { after?: string; limit?: number };
+  response: { status: IAuthSwitchImportStatus };
+}
+
+/**
+ * Backend-only. One source, one ownership decision.
+ *
+ * Both flags are required and both must be `true`. `callerQuiescent` is the caller's own assertion, because
+ * this daemon can observe a watch, a native process and Codex's app-server but cannot observe a host that
+ * uses the legacy library in its own process. `acknowledgeRunOrder` is the owner's acknowledgement that an
+ * imported source's legacy copy is dead and that the everyday commands must already run on the authority.
+ */
+export interface IReq_AuthSwitchImportSubmit extends ITypedRequest {
+  method: 'authswitch.authority.import.submit';
+  request: {
+    submission: TAuthSwitchImportSubmission;
+    callerQuiescent: true;
+    acknowledgeRunOrder: true;
+  };
+  response: { result: IAuthSwitchImportResult };
+}

package/ts/classes.authoritybroker.ts

@@ -131,7 +131,6 @@ export class AuthSwitchAuthorityBroker {
   public notifyChanged(): void { this.publish(); }
 
   public async start(): Promise<void> {
-    await this.database.assertOpenAdmission();
     const probe = plugins.crypto.randomBytes(32);
     const probeId = idHash('authswitch-custody-probe-v1');
     try {
@@ -199,7 +198,6 @@ export class AuthSwitchAuthorityBroker {
 
   public async refreshDueAccounts(): Promise<void> {
     if (this.closed) return;
-    await this.database.assertOpenAdmission();
     for (const state of ['ready', 'retry_wait'] as const) {
       let after: string | null = null;
       while (true) {
@@ -664,7 +662,6 @@ export class AuthSwitchAuthorityBroker {
   private async resolveManagedAccess(readView: () => Promise<{
     account: IStoredAuthorityAccount; grant: IStoredAuthorityGrant;
   }>, minValidityMs: number, rejectedGrantGeneration?: number): Promise<IAuthSwitchResolvedAccess> {
-    await this.database.assertOpenAdmission();
     for (let attempt = 0; attempt < 4; attempt++) {
       const { account, grant } = await readView();
       if (account.removed || grant.accountId !== account.id || grant.id !== account.primaryGrantId
@@ -732,7 +729,6 @@ export class AuthSwitchAuthorityBroker {
 
   private async performRefresh(accountId: string, minValidityMs: number,
     rejectedGrantGeneration?: number): Promise<void> {
-    await this.database.assertOpenAdmission();
     const initial = await this.database.readAccountAndPrimaryGrant(accountId);
     const initialGrant = initial.grant;
     if (!initial.account || initial.account.removed || !initialGrant || initialGrant.purpose !== 'openai_managed'