@modelprofile.com/authswitch 7.0.0 → 8.1.0

package/ts/classes.authoritydatabase.ts

@@ -8,7 +8,7 @@ import {
   assertStoredAuthorityBinding, assertStoredAuthorityClaudeHandoff, assertStoredAuthorityClaudeHome,
   assertStoredAuthorityEnrollment, assertStoredAuthorityGrant,
   assertStoredAuthorityHandoff, assertStoredAuthorityMigrationLedger, assertStoredAuthorityOperation,
-  assertStoredAuthorityUsage,
+  assertStoredAuthorityUsage, grantRefresherTransferRefusal, transfersGrantRefresher,
   type IStoredAuthorityAccount, type IStoredAuthorityBinding, type IStoredAuthorityClaudeHandoff,
   type IStoredAuthorityClaudeHome, type IStoredAuthorityCodexHome, type IStoredAuthorityEnrollment,
   type IStoredAuthorityEvent, type IStoredAuthorityGrant, type IStoredAuthorityHandoff,
@@ -16,9 +16,7 @@ import {
   type IStoredAuthorityOperation, type IStoredAuthorityPreuseOperation, type IStoredAuthorityUsage,
 } from './classes.authoritymodels.js';
 import type { IAuthSwitchStoredUsage, IAuthSwitchUsageContext } from './classes.authorityusage.js';
-import { authorityModel, authorityModelRegistry, authorityStoredRecords,
-  assertAuthorityStoredRecord, type IAuthorityStoredRecord } from './classes.authorityregistry.js';
-import type { IAuthorityBackupSnapshotAttempt, IAuthorityBackupSourceCapsule } from './classes.authoritybackup.js';
+import { authorityModelRegistry } from './classes.authorityregistry.js';
 import { runAuthorityMigrations } from './ts_migration/index.js';
 
 export interface IAuthSwitchAuthorityDatabaseOptions {
@@ -26,15 +24,8 @@ export interface IAuthSwitchAuthorityDatabaseOptions {
   socketPath: string;
 }
 
-export interface IAuthoritySnapshotCaptureOptions {
-  /** Recreate capsules on every transaction retry from a source already held under qualified exclusion. */
-  sourceFactory: () => AsyncIterable<IAuthorityBackupSourceCapsule>;
-  signal?: AbortSignal;
-  pageSize?: number;
-}
-
 type TEventKind = IStoredAuthorityEvent['kind'];
-type TSession = plugins.smartdata.SmartdataSession;
+type TSession = plugins.nosqldb.SmartdataSession;
 type TStoredAuthorityDeviceOperationAdmission = Omit<IStoredAuthorityDeviceOperation, 'expectedGrantGeneration'>;
 type TClaudeHandoffDraft = {
   home: IStoredAuthorityClaudeHome;
@@ -72,10 +63,9 @@ const storedOperation = (stored: Parameters<typeof AuthSwitchAuthorityOperationM
 
 /** Separate account, grant, binding and journal records; the only global record is a revision counter. */
 export class AuthSwitchAuthorityDatabase {
-  private engine?: plugins.smartdb.LocalSmartDb;
-  private database?: plugins.smartdata.SmartdataDb;
+  private engine?: plugins.nosqldbEngine.LocalNoSqlDb;
+  private database?: plugins.nosqldb.SmartdataDb;
   private started = false;
-  private mode: 'normal' | 'closed_restore' | null = null;
 
   constructor(private readonly options: IAuthSwitchAuthorityDatabaseOptions) {}
 
@@ -88,20 +78,18 @@ export class AuthSwitchAuthorityDatabase {
     await plugins.fs.promises.chmod(pathArg, 0o700);
   }
 
-  public async start(options: { mode?: 'normal' | 'closed_restore' } = {}): Promise<void> {
+  public async start(): Promise<void> {
     if (this.started || this.engine || this.database) throw new Error('Authswitch database is already starting or started.');
-    const mode = options.mode ?? 'normal';
-    if (mode !== 'normal' && mode !== 'closed_restore') throw new Error('Invalid authority database start mode.');
     await this.privateDirectory(this.options.dataDirectory);
     await this.privateDirectory(plugins.path.dirname(this.options.socketPath));
-    const engine = new plugins.smartdb.LocalSmartDb({ folderPath: this.options.dataDirectory, socketPath: this.options.socketPath });
+    const engine = new plugins.nosqldbEngine.LocalNoSqlDb({ folderPath: this.options.dataDirectory, socketPath: this.options.socketPath });
     this.engine = engine;
     try {
       const connection = await engine.start();
-      const database = new plugins.smartdata.SmartdataDb({ mongoDbUrl: connection.connectionUri, mongoDbName: 'authswitch' });
+      const database = new plugins.nosqldb.SmartdataDb({ mongoDbUrl: connection.connectionUri, mongoDbName: 'authswitch' });
       this.database = database;
       await database.init();
-      // The LocalSmartDb root lease excludes another engine during this catalog admission.
+      // The LocalNoSqlDb root lease excludes another engine during this catalog admission.
       const inventory = await database.inspectNamespace({ maxCollections: 1024,
         documentCountUpTo: 0, timeoutMs: 30_000 });
       const names = new Set(authorityModelRegistry.map(entry => entry.name));
@@ -111,10 +99,7 @@ export class AuthSwitchAuthorityDatabase {
         }
       }
       const fresh = inventory.collections.length === 0;
-      if (mode === 'closed_restore' && !fresh) {
-        throw new Error('Closed authority restore requires an empty database.');
-      }
-      if (mode === 'normal' && !fresh) {
+      if (!fresh) {
         if (!inventory.collections.some(item => item.collectionName === 'authswitch_authority_meta')) {
           throw new Error('Existing authswitch authority database has no metadata collection.');
         }
@@ -122,19 +107,16 @@ export class AuthSwitchAuthorityDatabase {
       }
       await Promise.all(authorityModelRegistry.map(entry => entry.initialize(database)));
       await Promise.all(authorityModelRegistry.map(entry => entry.prepare()));
-      if (mode === 'normal') {
-        if (fresh) {
-          const initial: IStoredAuthorityMeta = {
-            id: 'authswitch-authority', schemaVersion: 2, admission: 'open',
-            epoch: plugins.crypto.randomUUID(), revision: 0, updateId: plugins.crypto.randomUUID(),
-          };
-          const result = await AuthSwitchAuthorityMetaModel.exact.insert(initial);
-          if (result.status !== 'inserted') throw new Error('Authswitch authority could not initialize.');
-        } else if (!await AuthSwitchAuthorityMetaModel.exact.findStoredOne({ id: 'authswitch-authority' })) {
-          throw new Error('Existing authswitch authority metadata is missing.');
-        }
+      if (fresh) {
+        const initial: IStoredAuthorityMeta = {
+          id: 'authswitch-authority',
+          epoch: plugins.crypto.randomUUID(), revision: 0, updateId: plugins.crypto.randomUUID(),
+        };
+        const result = await AuthSwitchAuthorityMetaModel.exact.insert(initial);
+        if (result.status !== 'inserted') throw new Error('Authswitch authority could not initialize.');
+      } else if (!await AuthSwitchAuthorityMetaModel.exact.findStoredOne({ id: 'authswitch-authority' })) {
+        throw new Error('Existing authswitch authority metadata is missing.');
       }
-      this.mode = mode;
       this.started = true;
     } catch (error) {
       try { await this.stop(); } catch { /* Preserve the original startup error. */ }
@@ -142,7 +124,7 @@ export class AuthSwitchAuthorityDatabase {
     }
   }
 
-  private db(): plugins.smartdata.SmartdataDb {
+  private db(): plugins.nosqldb.SmartdataDb {
     if (!this.started || !this.database) throw new Error('Authswitch database is unavailable.');
     return this.database;
   }
@@ -156,70 +138,6 @@ export class AuthSwitchAuthorityDatabase {
     } finally { await session.close(); }
   }
 
-  /** One repeatable SmartData transaction per capture attempt; portable staging happens inside visit. */
-  public async captureBackupSnapshot(options: IAuthoritySnapshotCaptureOptions,
-    visit: (attempt: IAuthorityBackupSnapshotAttempt) => Promise<void>): Promise<void> {
-    if (typeof options.sourceFactory !== 'function' || typeof visit !== 'function') {
-      throw new Error('Authority backup capture requires an exact source and visitor.');
-    }
-    await this.transaction(async session => {
-      options.signal?.throwIfAborted();
-      const stored = await AuthSwitchAuthorityMetaModel.exact.findStoredOne({ id: 'authswitch-authority' },
-        { session, signal: options.signal });
-      if (!stored) throw new Error('Authority backup metadata is absent.');
-      const meta = AuthSwitchAuthorityMetaModel.exact.toPersisted(stored);
-      if (meta.admission !== 'open') throw new Error('Closed restored authority cannot publish a backup.');
-      let recordsComplete = false;
-      let sourcesComplete = false;
-      const records = async function* (): AsyncGenerator<IAuthorityStoredRecord> {
-        yield* authorityStoredRecords({ session, signal: options.signal, pageSize: options.pageSize });
-        recordsComplete = true;
-      };
-      const sources = async function* (): AsyncGenerator<IAuthorityBackupSourceCapsule> {
-        for await (const source of options.sourceFactory()) {
-          options.signal?.throwIfAborted();
-          yield source;
-        }
-        sourcesComplete = true;
-      };
-      await visit({ epoch: meta.epoch, revision: meta.revision, records: records(), sources: sources() });
-      if (!recordsComplete || !sourcesComplete) {
-        throw new Error('Authority backup visitor did not consume the complete pinned inventory.');
-      }
-      return true;
-    });
-  }
-
-  /** Reopened closed restore readback uses the same exhaustive registry and stable keyset order. */
-  public readStoredRecords(options: { signal?: AbortSignal; pageSize?: number } = {}): AsyncIterable<IAuthorityStoredRecord> {
-    this.db();
-    return authorityStoredRecords(options);
-  }
-
-  public async restoreClosedMeta(meta: IStoredAuthorityMeta): Promise<void> {
-    if (this.mode !== 'closed_restore') throw new Error('Authority database is not a closed restore target.');
-    const record: IAuthorityStoredRecord = { model: 'authswitch_authority_meta', id: meta.id, value: meta };
-    assertAuthorityStoredRecord(record);
-    if (meta.admission !== 'closed_restored') throw new Error('Restored authority metadata must remain closed.');
-    await authorityModel(record.model).insert(record);
-  }
-
-  public async insertClosedRestoredRecord(record: IAuthorityStoredRecord): Promise<void> {
-    if (this.mode !== 'closed_restore' || record.model === 'authswitch_authority_meta') {
-      throw new Error('Authority database is not admitting this restored record.');
-    }
-    if ((await this.readMeta()).admission !== 'closed_restored') {
-      throw new Error('Closed restore metadata must be installed before records.');
-    }
-    assertAuthorityStoredRecord(record);
-    await authorityModel(record.model).insert(record);
-  }
-
-  public async assertOpenAdmission(): Promise<void> {
-    const meta = await this.readMeta();
-    if (meta.admission !== 'open') throw new Error('Restored authority admission is closed pending ownership reconciliation.');
-  }
-
   public async readMeta(): Promise<IStoredAuthorityMeta> {
     this.db();
     const stored = await AuthSwitchAuthorityMetaModel.exact.findStoredOne({ id: 'authswitch-authority' });
@@ -257,7 +175,7 @@ export class AuthSwitchAuthorityDatabase {
     return stored.map(item => AuthSwitchAuthorityCodexHomeModel.exact.toPersisted(item));
   }
 
-  /** Home path identity is hashed by the caller; no vendor files or raw paths enter SmartData. */
+  /** Home path identity is hashed by the caller; no vendor files or raw paths enter NoSQLDB. */
   public async reserveCodexHome(accountId: string, grantId: string, scopeId: string, homeId: string,
     updateId: string): Promise<{ newlyRegistered: boolean }> {
     try {
@@ -285,7 +203,7 @@ export class AuthSwitchAuthorityDatabase {
         return { newlyRegistered: true };
       });
     } catch (error) {
-      if (error instanceof plugins.smartdata.SmartdataExactPersistenceError
+      if (error instanceof plugins.nosqldb.SmartdataExactPersistenceError
         && (error.code === 'ambiguous_write' || error.code === 'unique_conflict')) {
         const assigned = await AuthSwitchAuthorityCodexHomeModel.exact.findStoredOne({ id: homeId });
         if (assigned?.accountId === accountId && assigned.grantId === grantId && assigned.scopeId === scopeId
@@ -315,7 +233,7 @@ export class AuthSwitchAuthorityDatabase {
         return true;
       });
     } catch (error) {
-      if (!(error instanceof plugins.smartdata.SmartdataExactPersistenceError) || error.code !== 'ambiguous_write') throw error;
+      if (!(error instanceof plugins.nosqldb.SmartdataExactPersistenceError) || error.code !== 'ambiguous_write') throw error;
       const current = await this.readCodexHome(homeId);
       if (current?.updateId === updateId && JSON.stringify(current.activeRun) === JSON.stringify(activeRun)) return;
       throw new Error('Managed Codex home run outcome is unknown.');
@@ -428,11 +346,6 @@ export class AuthSwitchAuthorityDatabase {
           if (!sameRequest(existing)) throw new Error('Account operation ID belongs to a different request.');
           return { operation: existing, created: false };
         }
-        const metaStored = await AuthSwitchAuthorityMetaModel.exact.findStoredOne(
-          { id: 'authswitch-authority' }, { session });
-        if (!metaStored || AuthSwitchAuthorityMetaModel.exact.toPersisted(metaStored).admission !== 'open') {
-          throw new Error('Authswitch authority admission is closed.');
-        }
         let expectedGrantGeneration: number | null = null;
         if (intent.kind === 'reauth_openai') {
           const accountStored = await AuthSwitchAuthorityAccountModel.exact.findStoredOne(
@@ -456,7 +369,7 @@ export class AuthSwitchAuthorityDatabase {
         return { operation, created: true };
       });
     } catch (error) {
-      if (!(error instanceof plugins.smartdata.SmartdataExactPersistenceError) || error.code !== 'ambiguous_write') throw error;
+      if (!(error instanceof plugins.nosqldb.SmartdataExactPersistenceError) || error.code !== 'ambiguous_write') throw error;
       const stored = await this.readOperation(intent.id);
       if (stored && sameRequest(stored)) {
         return { operation: stored, created: stored.updateId === intent.updateId };
@@ -468,13 +381,8 @@ export class AuthSwitchAuthorityDatabase {
   /** Revalidate the durable owner and exact reauthentication generation after mutable runtime preparation. */
   public async confirmOperationMayStart(operationId: string): Promise<IStoredAuthorityDeviceOperation> {
     return this.transaction(async session => {
-      const metaStored = await AuthSwitchAuthorityMetaModel.exact.findStoredOne(
-        { id: 'authswitch-authority' }, { session });
       const operationStored = await AuthSwitchAuthorityOperationModel.exact.findStoredOne(
         { id: operationId }, { session });
-      if (!metaStored || AuthSwitchAuthorityMetaModel.exact.toPersisted(metaStored).admission !== 'open') {
-        throw new Error('Authswitch authority admission is closed.');
-      }
       if (!operationStored) throw new Error('Account operation was not found.');
       const operation = storedOperation(operationStored);
       if (operation.kind === 'preuse_openai' || operation.state !== 'starting') {
@@ -528,7 +436,7 @@ export class AuthSwitchAuthorityDatabase {
       if (result.status !== 'transitioned') throw new Error('Account operation changed concurrently.');
       return draft;
     } catch (error) {
-      if (!(error instanceof plugins.smartdata.SmartdataExactPersistenceError) || error.code !== 'ambiguous_write') throw error;
+      if (!(error instanceof plugins.nosqldb.SmartdataExactPersistenceError) || error.code !== 'ambiguous_write') throw error;
       const stored = await this.readOperation(operationId);
       if (stored?.kind !== 'preuse_openai' && stored?.updateId === updateId) return stored;
       throw new Error('Account operation transition outcome is unknown.');
@@ -569,7 +477,7 @@ export class AuthSwitchAuthorityDatabase {
         return { operation, created: true };
       });
     } catch (error) {
-      if (!(error instanceof plugins.smartdata.SmartdataExactPersistenceError) || error.code !== 'ambiguous_write') throw error;
+      if (!(error instanceof plugins.nosqldb.SmartdataExactPersistenceError) || error.code !== 'ambiguous_write') throw error;
       const stored = await this.readOperation(operation.id);
       if (stored && sameRequest(stored) && stored.updateId === operation.updateId) {
         return { operation: stored, created: true };
@@ -611,7 +519,7 @@ export class AuthSwitchAuthorityDatabase {
         return draft;
       });
     } catch (error) {
-      if (!(error instanceof plugins.smartdata.SmartdataExactPersistenceError) || error.code !== 'ambiguous_write') throw error;
+      if (!(error instanceof plugins.nosqldb.SmartdataExactPersistenceError) || error.code !== 'ambiguous_write') throw error;
       const stored = await this.readOperation(operationId);
       if (stored?.kind === 'preuse_openai' && stored.updateId === updateId
         && stored.state === 'request_may_have_started') return stored;
@@ -648,7 +556,7 @@ export class AuthSwitchAuthorityDatabase {
       if (result.status !== 'transitioned') throw new Error('Preuse operation changed concurrently.');
       return draft;
     } catch (error) {
-      if (!(error instanceof plugins.smartdata.SmartdataExactPersistenceError) || error.code !== 'ambiguous_write') throw error;
+      if (!(error instanceof plugins.nosqldb.SmartdataExactPersistenceError) || error.code !== 'ambiguous_write') throw error;
       const stored = await this.readOperation(operationId);
       if (stored?.kind === 'preuse_openai' && stored.updateId === updateId) return stored;
       throw new Error('Preuse operation transition outcome is unknown.');
@@ -665,6 +573,19 @@ export class AuthSwitchAuthorityDatabase {
     return stored.map(item => AuthSwitchAuthorityMigrationLedgerModel.exact.toPersisted(item));
   }
 
+  /** Every migration ledger row in id order, one bounded page at a time. */
+  public async migrationLedgerPage(after: string | null,
+    limit = 128): Promise<{ rows: IStoredAuthorityMigrationLedger[]; nextCursor: string | null }> {
+    this.db();
+    if (!Number.isSafeInteger(limit) || limit < 1 || limit > 256) throw new Error('Invalid migration page size.');
+    const stored = await AuthSwitchAuthorityMigrationLedgerModel.exact.findStored({
+      filter: after ? { id: { $gt: after } } : {}, sort: { id: 1 }, limit: limit + 1,
+    });
+    const rows = stored.slice(0, limit)
+      .map(item => AuthSwitchAuthorityMigrationLedgerModel.exact.toPersisted(item));
+    return { rows, nextCursor: stored.length > limit ? rows[rows.length - 1].id : null };
+  }
+
   public async readAccountAndPrimaryGrant(id: string): Promise<{
     account: IStoredAuthorityAccount | null; grant: IStoredAuthorityGrant | null;
   }> {
@@ -806,7 +727,7 @@ export class AuthSwitchAuthorityDatabase {
         return true;
       });
     } catch (error) {
-      if (!(error instanceof plugins.smartdata.SmartdataExactPersistenceError)) throw error;
+      if (!(error instanceof plugins.nosqldb.SmartdataExactPersistenceError)) throw error;
       if (error.code === 'unique_conflict') return false;
       if (error.code !== 'ambiguous_write') throw error;
       const [stored, event] = await Promise.all([
@@ -1065,9 +986,8 @@ export class AuthSwitchAuthorityDatabase {
         if (accountStored && accountStored.primaryGrantId !== grantId) {
           throw new Error('Primary grant identity cannot be replaced.');
         }
-        if (grantStored && ['legacy_native', 'claude_native'].includes(grantStored.owner)
-          && draft.grant.owner === 'daemon') {
-          throw new Error('Native ownership requires a verified handoff.');
+        if (grantStored && transfersGrantRefresher(grantStored.owner, draft.grant.owner)) {
+          throw new Error(grantRefresherTransferRefusal(grantStored.owner, draft.grant.owner));
         }
         await this.persistAccount(session, accountStored, draft.account);
         await this.persistGrant(session, grantStored, draft.grant);
@@ -1076,7 +996,7 @@ export class AuthSwitchAuthorityDatabase {
         return { meta, ...draft };
       });
     } catch (error) {
-      if (!(error instanceof plugins.smartdata.SmartdataExactPersistenceError) || error.code !== 'ambiguous_write') throw error;
+      if (!(error instanceof plugins.nosqldb.SmartdataExactPersistenceError) || error.code !== 'ambiguous_write') throw error;
       const event = await AuthSwitchAuthorityEventModel.exact.findStoredOne({ id: updateId });
       const { account, grant } = await this.readAccountAndPrimaryGrant(accountId);
       if (event && account?.updateId === updateId && grant?.updateId === updateId) {
@@ -1141,7 +1061,7 @@ export class AuthSwitchAuthorityDatabase {
         return { ...draft, operation: completed };
       });
     } catch (error) {
-      if (!(error instanceof plugins.smartdata.SmartdataExactPersistenceError) || error.code !== 'ambiguous_write') throw error;
+      if (!(error instanceof plugins.nosqldb.SmartdataExactPersistenceError) || error.code !== 'ambiguous_write') throw error;
       const [event, operation, pair] = await Promise.all([
         AuthSwitchAuthorityEventModel.exact.findStoredOne({ id: updateId }),
         this.readOperation(operationId), this.readAccountAndPrimaryGrant(accountId),
@@ -1176,7 +1096,7 @@ export class AuthSwitchAuthorityDatabase {
         if (grant.purpose === 'claude_host_native' && draft.state === 'exchange_may_have_been_sent'
           && grant.state !== 'exchange_may_have_been_sent'
           && !(await this.hasVerifiedClaudeGrantReceipt(account.id, grant.id, session))) {
-          throw new Error('Claude refresh requires a verified import and backup receipt.');
+          throw new Error('Claude refresh requires a verified import receipt.');
         }
         const accountDraft: IStoredAuthorityAccount = { ...account, revision: account.revision + 1,
           statusObservedAt: draft.statusObservedAt, updateId };
@@ -1187,7 +1107,7 @@ export class AuthSwitchAuthorityDatabase {
         return { meta, account: accountDraft, grant: draft };
       });
     } catch (error) {
-      if (!(error instanceof plugins.smartdata.SmartdataExactPersistenceError) || error.code !== 'ambiguous_write') throw error;
+      if (!(error instanceof plugins.nosqldb.SmartdataExactPersistenceError) || error.code !== 'ambiguous_write') throw error;
       const event = await AuthSwitchAuthorityEventModel.exact.findStoredOne({ id: updateId });
       const grant = await this.readGrant(grantId);
       const account = grant ? await this.readAccount(grant.accountId) : null;
@@ -1216,6 +1136,10 @@ export class AuthSwitchAuthorityDatabase {
           || draft.providerId !== account.providerId || draft.updateId !== updateId) {
           throw new Error('Secondary grant identity is invalid.');
         }
+        // A secondary grant transfers its refresher by a verified handoff as well; one token, one refresher.
+        if (grant && transfersGrantRefresher(grant.owner, draft.owner)) {
+          throw new Error(grantRefresherTransferRefusal(grant.owner, draft.owner));
+        }
         await this.persistGrant(session, grantStored, draft);
         const updatedAccount = { ...account, revision: account.revision + 1,
           statusObservedAt: draft.statusObservedAt, updateId };
@@ -1225,7 +1149,7 @@ export class AuthSwitchAuthorityDatabase {
         return { account: updatedAccount, grant: draft };
       });
     } catch (error) {
-      if (!(error instanceof plugins.smartdata.SmartdataExactPersistenceError) || error.code !== 'ambiguous_write') throw error;
+      if (!(error instanceof plugins.nosqldb.SmartdataExactPersistenceError) || error.code !== 'ambiguous_write') throw error;
       const event = await AuthSwitchAuthorityEventModel.exact.findStoredOne({ id: updateId });
       const account = await this.readAccount(accountId);
       const grant = await this.readGrant(grantId);
@@ -1315,7 +1239,7 @@ export class AuthSwitchAuthorityDatabase {
         return removed;
       });
     } catch (error) {
-      if (!(error instanceof plugins.smartdata.SmartdataExactPersistenceError) || error.code !== 'ambiguous_write') throw error;
+      if (!(error instanceof plugins.nosqldb.SmartdataExactPersistenceError) || error.code !== 'ambiguous_write') throw error;
       const event = await AuthSwitchAuthorityEventModel.exact.findStoredOne({ id: updateId });
       const account = await this.readAccount(accountId);
       if (event && account?.removed && account.updateId === updateId) return account;
@@ -1341,7 +1265,7 @@ export class AuthSwitchAuthorityDatabase {
         return { meta, account: draft };
       });
     } catch (error) {
-      if (!(error instanceof plugins.smartdata.SmartdataExactPersistenceError) || error.code !== 'ambiguous_write') throw error;
+      if (!(error instanceof plugins.nosqldb.SmartdataExactPersistenceError) || error.code !== 'ambiguous_write') throw error;
       const event = await AuthSwitchAuthorityEventModel.exact.findStoredOne({ id: updateId });
       const account = await this.readAccount(accountId);
       if (event && account?.updateId === updateId) return { meta: await this.readMeta(), account };
@@ -1386,7 +1310,7 @@ export class AuthSwitchAuthorityDatabase {
         return { meta, binding: draft };
       });
     } catch (error) {
-      if (!(error instanceof plugins.smartdata.SmartdataExactPersistenceError) || error.code !== 'ambiguous_write') throw error;
+      if (!(error instanceof plugins.nosqldb.SmartdataExactPersistenceError) || error.code !== 'ambiguous_write') throw error;
       const event = await AuthSwitchAuthorityEventModel.exact.findStoredOne({ id: updateId });
       const binding = await this.readBinding(bindingId);
       if (event && binding?.updateId === updateId) return { meta: await this.readMeta(), binding };
@@ -1410,7 +1334,7 @@ export class AuthSwitchAuthorityDatabase {
         return true;
       });
     } catch (error) {
-      if (!(error instanceof plugins.smartdata.SmartdataExactPersistenceError) || error.code !== 'ambiguous_write') throw error;
+      if (!(error instanceof plugins.nosqldb.SmartdataExactPersistenceError) || error.code !== 'ambiguous_write') throw error;
       const event = await AuthSwitchAuthorityEventModel.exact.findStoredOne({ id: updateId });
       const binding = await this.readBinding(bindingId);
       // Every bind mints a fresh random capability. An event plus absence or a different
@@ -1458,7 +1382,7 @@ export class AuthSwitchAuthorityDatabase {
         return draft;
       });
     } catch (error) {
-      if (!(error instanceof plugins.smartdata.SmartdataExactPersistenceError) || error.code !== 'ambiguous_write') throw error;
+      if (!(error instanceof plugins.nosqldb.SmartdataExactPersistenceError) || error.code !== 'ambiguous_write') throw error;
       const event = await AuthSwitchAuthorityEventModel.exact.findStoredOne({ id: updateId });
       const enrollment = await this.readEnrollment(enrollmentId);
       if (event && enrollment?.updateId === updateId) return enrollment;
@@ -1540,7 +1464,7 @@ export class AuthSwitchAuthorityDatabase {
         return draft;
       });
     } catch (error) {
-      if (!(error instanceof plugins.smartdata.SmartdataExactPersistenceError) || error.code !== 'ambiguous_write') throw error;
+      if (!(error instanceof plugins.nosqldb.SmartdataExactPersistenceError) || error.code !== 'ambiguous_write') throw error;
       const event = await AuthSwitchAuthorityEventModel.exact.findStoredOne({ id: updateId });
       const handoff = await this.readHandoff(handoffId);
       const grant = await this.readGrant(grantId);
@@ -1563,7 +1487,7 @@ export class AuthSwitchAuthorityDatabase {
     return stored ? AuthSwitchAuthorityClaudeHandoffModel.exact.toPersisted(stored) : null;
   }
 
-  /** A backed-up backend import receipt, not an account snapshot, authorizes an inactive Claude grant. */
+  /** A verified backend import receipt, not an account snapshot, authorizes an inactive Claude grant. */
   public async hasVerifiedClaudeGrantReceipt(accountId: string, grantId: string,
     session?: TSession): Promise<boolean> {
     this.db();
@@ -1575,7 +1499,6 @@ export class AuthSwitchAuthorityDatabase {
         filter: { grantId, status }, sort: { id: 1 }, limit: 128, session,
       });
       if (stored.some(item => item.accountId === accountId
-        && item.backupDigest !== null
         && ['authswitch_stash', 'authswitch_backup', 'claude_native'].includes(item.sourceKind))) return true;
       if (stored.length === 128) throw new Error('Claude grant has too many migration receipts to verify.');
     }
@@ -1623,7 +1546,6 @@ export class AuthSwitchAuthorityDatabase {
         const grantStored = await AuthSwitchAuthorityGrantModel.exact.findStoredOne({ id: grantId }, { session });
         const current = await AuthSwitchAuthorityClaudeHomeModel.exact.findStoredOne({ id: homeId }, { session });
         if (!receiptStored || !['verified', 'complete'].includes(receiptStored.status)
-          || receiptStored.backupDigest === null
           || receiptStored.sourceKind !== 'claude_native' || receiptStored.sourcePathHash !== homeId
           || receiptStored.sourceDigest !== sourceDigest || receiptStored.accountId !== accountId
           || receiptStored.grantId !== grantId || !accountStored || accountStored.removed
@@ -1649,7 +1571,7 @@ export class AuthSwitchAuthorityDatabase {
         return home;
       });
     } catch (error) {
-      if (!(error instanceof plugins.smartdata.SmartdataExactPersistenceError)
+      if (!(error instanceof plugins.nosqldb.SmartdataExactPersistenceError)
         || !['ambiguous_write', 'unique_conflict'].includes(error.code)) throw error;
       const home = await this.readClaudeHome(homeId);
       if (home?.updateId === updateId && home.activeAccountId === accountId && home.activeGrantId === grantId) return home;
@@ -1772,7 +1694,6 @@ export class AuthSwitchAuthorityDatabase {
             });
             if (receipts.length === 128) throw new Error('Claude grant receipt set is unbounded.');
             verifiedIncoming ||= receipts.some(item => item.accountId === incoming.accountId
-              && item.backupDigest !== null
               && ['authswitch_stash', 'authswitch_backup', 'claude_native'].includes(item.sourceKind));
           }
           if (draft.handoff.phase !== 'reserved' || home.pendingOperationId !== null
@@ -1843,7 +1764,7 @@ export class AuthSwitchAuthorityDatabase {
         return draft;
       });
     } catch (error) {
-      if (!(error instanceof plugins.smartdata.SmartdataExactPersistenceError) || error.code !== 'ambiguous_write') throw error;
+      if (!(error instanceof plugins.nosqldb.SmartdataExactPersistenceError) || error.code !== 'ambiguous_write') throw error;
       const context = await this.readClaudeHandoffContext(operationId);
       const first = await AuthSwitchAuthorityEventModel.exact.findStoredOne({ id: eventIds[0] });
       const second = await AuthSwitchAuthorityEventModel.exact.findStoredOne({ id: eventIds[1] });
@@ -1860,7 +1781,7 @@ export class AuthSwitchAuthorityDatabase {
     }
   }
 
-  /** Ledger transitions never silently replace an active credential or waive backup proof. */
+  /** Ledger transitions never silently replace an active credential or waive the verified import. */
   public async changeMigrationLedger(updateId: string, ledgerId: string,
     change: (current: IStoredAuthorityMigrationLedger | null) => IStoredAuthorityMigrationLedger): Promise<IStoredAuthorityMigrationLedger> {
     try {
@@ -1869,7 +1790,12 @@ export class AuthSwitchAuthorityDatabase {
         const draft = change(current ? structuredClone(AuthSwitchAuthorityMigrationLedgerModel.exact.toPersisted(current)) : null);
         if (draft.id !== ledgerId || draft.updateId !== updateId) throw new Error('Migration ledger identity is invalid.');
         assertStoredAuthorityMigrationLedger(draft);
-        if (draft.status === 'complete' && draft.backupDigest === null) throw new Error('Migration completion requires verified backup proof.');
+        // A source may only be considered migrated after a verified import bound to an account, a grant and a
+        // source digest. This deliberately tightens a flow that has no production caller and has never run.
+        if (draft.status === 'complete' && (current?.status !== 'verified'
+          || current.accountId !== draft.accountId || current.grantId !== draft.grantId)) {
+          throw new Error('Migration completion requires a verified import of the same account and grant.');
+        }
         if (current) {
           if (current.status === 'complete' || current.version !== draft.version
             || current.sourceKind !== draft.sourceKind || current.sourcePathHash !== draft.sourcePathHash
@@ -1888,7 +1814,7 @@ export class AuthSwitchAuthorityDatabase {
         return draft;
       });
     } catch (error) {
-      if (!(error instanceof plugins.smartdata.SmartdataExactPersistenceError) || error.code !== 'ambiguous_write') throw error;
+      if (!(error instanceof plugins.nosqldb.SmartdataExactPersistenceError) || error.code !== 'ambiguous_write') throw error;
       const ledger = await this.readMigrationLedger(ledgerId);
       if (ledger?.updateId === updateId) return ledger;
       throw new Error('Authswitch migration ledger write outcome is unknown.');
@@ -1897,7 +1823,6 @@ export class AuthSwitchAuthorityDatabase {
 
   public async stop(): Promise<void> {
     this.started = false;
-    this.mode = null;
     const database = this.database;
     const engine = this.engine;
     this.database = undefined;