@modelprofile.com/authswitch 7.0.0 → 8.1.0

package/ts/classes.authoritypreuse.ts

@@ -115,7 +115,6 @@ export class AuthSwitchAuthorityPreuse {
   private async admit(input: IAuthSwitchAuthorityPreuseRequest, requestHash: string,
     requestedModel: string | null,
     admitFresh: TAuthSwitchAuthorityPreuseFreshAdmission): Promise<IAuthSwitchPreuseOperation> {
-    await this.database.assertOpenAdmission();
     if (this.closed) throw new Error('Authswitch preuse is closing.');
     const prior = await this.database.readOperation(input.operationId);
     if (prior) {

package/ts/classes.authorityregistry.ts

@@ -4,73 +4,40 @@ import {
   AuthSwitchAuthorityClaudeHomeModel, AuthSwitchAuthorityCodexHomeModel, AuthSwitchAuthorityEnrollmentModel,
   AuthSwitchAuthorityEventModel, AuthSwitchAuthorityGrantModel, AuthSwitchAuthorityHandoffModel,
   AuthSwitchAuthorityMetaModel, AuthSwitchAuthorityMigrationLedgerModel, AuthSwitchAuthorityOperationModel,
-  AuthSwitchAuthorityUsageModel, assertStoredAuthorityAccount, assertStoredAuthorityBinding,
-  assertStoredAuthorityClaudeHandoff, assertStoredAuthorityClaudeHome, assertStoredAuthorityCodexHome,
-  assertStoredAuthorityEnrollment, assertStoredAuthorityEvent, assertStoredAuthorityGrant,
-  assertStoredAuthorityHandoff, assertStoredAuthorityMeta, assertStoredAuthorityMigrationLedger,
-  assertStoredAuthorityOperationDocument, assertStoredAuthorityUsage,
+  AuthSwitchAuthorityUsageModel,
 } from './classes.authoritymodels.js';
 
-export interface IAuthorityStoredRecord { model: string; id: string; value: unknown }
-
 interface IAuthorityModelEntry {
   readonly name: string;
-  initialize(db: plugins.smartdata.SmartdataDb): Promise<void>;
+  initialize(db: plugins.nosqldb.SmartdataDb): Promise<void>;
   prepare(): Promise<void>;
-  assert(value: unknown): void;
-  page(after: string | null, limit: number, session?: plugins.smartdata.SmartdataSession,
-    signal?: AbortSignal): Promise<IAuthorityStoredRecord[]>;
-  insert(record: IAuthorityStoredRecord, session?: plugins.smartdata.SmartdataSession): Promise<void>;
 }
 
-const define = <TPersisted extends { id: string },
-  TModel extends TPersisted & plugins.smartdata.SmartDataDbDoc<TModel, TPersisted>>(
-    name: string,
-    model: { new(): TModel; init(): Promise<void>; exact: plugins.smartdata.TExact<TModel> },
-    assertDocument: (value: unknown) => asserts value is TPersisted,
-  ): IAuthorityModelEntry => Object.freeze({
+const define = (name: string, model: { init(): Promise<void>; exact: { prepare(): Promise<void> } }): IAuthorityModelEntry =>
+  Object.freeze({
     name,
-    initialize: async (db: plugins.smartdata.SmartdataDb) => {
-      plugins.smartdata.setDefaultManagerForDoc({ db }, model);
+    initialize: async (db: plugins.nosqldb.SmartdataDb) => {
+      plugins.nosqldb.setDefaultManagerForDoc({ db }, model);
       await model.init();
     },
     prepare: () => model.exact.prepare(),
-    assert: (value: unknown) => { assertDocument(value); },
-    page: async (after: string | null, limit: number, session?: plugins.smartdata.SmartdataSession,
-      signal?: AbortSignal): Promise<IAuthorityStoredRecord[]> => {
-      const query = {
-        filter: after === null ? {} : { id: { $gt: after } }, sort: { id: 1 }, limit, session, signal,
-      } as Parameters<typeof model.exact.findStored>[0];
-      const stored = await model.exact.findStored(query);
-      return stored.map(item => {
-        const value = model.exact.toPersisted(item);
-        return { model: name, id: value.id, value };
-      });
-    },
-    insert: async (record: IAuthorityStoredRecord, session?: plugins.smartdata.SmartdataSession): Promise<void> => {
-      assertDocument(record.value);
-      if (record.value.id !== record.id) throw new Error('Authority restore record identity differs from its key.');
-      const result = await model.exact.insert(record.value as unknown as Parameters<typeof model.exact.insert>[0],
-        { session });
-      if (result.status !== 'inserted') throw new Error('Authority restore record already exists.');
-    },
   });
 
-/** The sole authority collection inventory, in portable model+stable-ID order. */
+/** The sole authority collection inventory: startup admits exactly these collections and prepares each one. */
 export const authorityModelRegistry: readonly IAuthorityModelEntry[] = Object.freeze([
-  define('authswitch_authority_accounts', AuthSwitchAuthorityAccountModel, assertStoredAuthorityAccount),
-  define('authswitch_authority_bindings', AuthSwitchAuthorityBindingModel, assertStoredAuthorityBinding),
-  define('authswitch_authority_claude_handoffs', AuthSwitchAuthorityClaudeHandoffModel, assertStoredAuthorityClaudeHandoff),
-  define('authswitch_authority_claude_homes', AuthSwitchAuthorityClaudeHomeModel, assertStoredAuthorityClaudeHome),
-  define('authswitch_authority_codex_homes', AuthSwitchAuthorityCodexHomeModel, assertStoredAuthorityCodexHome),
-  define('authswitch_authority_enrollments', AuthSwitchAuthorityEnrollmentModel, assertStoredAuthorityEnrollment),
-  define('authswitch_authority_events', AuthSwitchAuthorityEventModel, assertStoredAuthorityEvent),
-  define('authswitch_authority_grants', AuthSwitchAuthorityGrantModel, assertStoredAuthorityGrant),
-  define('authswitch_authority_handoffs', AuthSwitchAuthorityHandoffModel, assertStoredAuthorityHandoff),
-  define('authswitch_authority_meta', AuthSwitchAuthorityMetaModel, assertStoredAuthorityMeta),
-  define('authswitch_authority_migration_ledger', AuthSwitchAuthorityMigrationLedgerModel, assertStoredAuthorityMigrationLedger),
-  define('authswitch_authority_operations', AuthSwitchAuthorityOperationModel, assertStoredAuthorityOperationDocument),
-  define('authswitch_authority_usage', AuthSwitchAuthorityUsageModel, assertStoredAuthorityUsage),
+  define('authswitch_authority_accounts', AuthSwitchAuthorityAccountModel),
+  define('authswitch_authority_bindings', AuthSwitchAuthorityBindingModel),
+  define('authswitch_authority_claude_handoffs', AuthSwitchAuthorityClaudeHandoffModel),
+  define('authswitch_authority_claude_homes', AuthSwitchAuthorityClaudeHomeModel),
+  define('authswitch_authority_codex_homes', AuthSwitchAuthorityCodexHomeModel),
+  define('authswitch_authority_enrollments', AuthSwitchAuthorityEnrollmentModel),
+  define('authswitch_authority_events', AuthSwitchAuthorityEventModel),
+  define('authswitch_authority_grants', AuthSwitchAuthorityGrantModel),
+  define('authswitch_authority_handoffs', AuthSwitchAuthorityHandoffModel),
+  define('authswitch_authority_meta', AuthSwitchAuthorityMetaModel),
+  define('authswitch_authority_migration_ledger', AuthSwitchAuthorityMigrationLedgerModel),
+  define('authswitch_authority_operations', AuthSwitchAuthorityOperationModel),
+  define('authswitch_authority_usage', AuthSwitchAuthorityUsageModel),
 ]);
 
 for (let index = 1; index < authorityModelRegistry.length; index++) {
@@ -78,41 +45,3 @@ for (let index = 1; index < authorityModelRegistry.length; index++) {
     throw new Error('Authority model registry must be unique and sorted.');
   }
 }
-
-export const authorityModel = (name: string): IAuthorityModelEntry => {
-  const entry = authorityModelRegistry.find(item => item.name === name);
-  if (!entry) throw new Error('Unclassified authority model cannot be read, backed up or restored.');
-  return entry;
-};
-
-export const assertAuthorityStoredRecord = (record: IAuthorityStoredRecord): void => {
-  if (!record || typeof record.model !== 'string' || typeof record.id !== 'string' || !record.id) {
-    throw new Error('Invalid authority record identity.');
-  }
-  authorityModel(record.model).assert(record.value);
-  if (!record.value || typeof record.value !== 'object' || !('id' in record.value)
-    || record.value.id !== record.id) throw new Error('Invalid authority record identity.');
-};
-
-export async function* authorityStoredRecords(options: {
-  session?: plugins.smartdata.SmartdataSession; signal?: AbortSignal; pageSize?: number;
-} = {}): AsyncGenerator<IAuthorityStoredRecord> {
-  const pageSize = options.pageSize ?? 64;
-  if (!Number.isSafeInteger(pageSize) || pageSize < 1 || pageSize > 256) {
-    throw new Error('Invalid authority record page size.');
-  }
-  for (const entry of authorityModelRegistry) {
-    let after: string | null = null;
-    while (true) {
-      options.signal?.throwIfAborted();
-      const page = await entry.page(after, pageSize, options.session, options.signal);
-      if (!page.length) break;
-      for (const record of page) {
-        assertAuthorityStoredRecord(record);
-        yield record;
-      }
-      after = page[page.length - 1].id;
-      if (page.length < pageSize) break;
-    }
-  }
-}

package/ts/classes.authoritysecrets.ts

@@ -10,7 +10,7 @@ const secretName = (accountId: string): string => {
   return `authswitch.account.${accountId}`;
 };
 
-/** TPM-sealed byte payloads live only as ciphertext in SmartData. */
+/** TPM-sealed byte payloads live only as ciphertext in NoSQLDB. */
 export class AuthSwitchTpmSecretCodec implements IAuthSwitchSecretCodec {
   public async seal(accountId: string, plaintext: Uint8Array): Promise<string> {
     const ciphertext = await plugins.smartsecret.sealSmartSecretTpm2Credential(secretName(accountId), plaintext);

package/ts/classes.authorityusage.ts

@@ -58,7 +58,7 @@ export interface IAuthSwitchUsageAccess {
   grantGeneration: number;
 }
 
-/** Persist through SmartData in the authority integration. No credential belongs in this record. */
+/** Persist through NoSQLDB in the authority integration. No credential belongs in this record. */
 export interface IAuthSwitchStoredUsage {
   context: IAuthSwitchUsageContext;
   updateId: string;
@@ -89,7 +89,7 @@ export interface IAuthSwitchUsageStore {
   /** Read only the exact login's record. The helper discards a mismatched context. */
   read(accountId: string, loginId: string): Promise<IAuthSwitchStoredUsage | null>;
   /**
-   * In one SmartData transaction, re-read epoch/account/login and compare every semantic
+   * In one NoSQLDB transaction, re-read epoch/account/login and compare every semantic
    * context field, compare the previous usage update ID, write next, and append a revisioned
    * account event. The account row revision may increase in that transaction; it is not
    * part of the usage validity key and must not invalidate the reading just published.
@@ -102,7 +102,7 @@ export interface IAuthSwitchUsageStore {
 }
 
 export interface IAuthSwitchAuthorityUsageOptions {
-  /** Re-read from the owning SmartData authority. Return null for an absent login. */
+  /** Re-read from the owning NoSQLDB authority. Return null for an absent login. */
   readContext(accountId: string, loginId: string): Promise<IAuthSwitchUsageContext | null>;
   /** Broker-owned access resolution; rejected generation may perform at most one durable refresh. */
   resolveAccess(context: IAuthSwitchUsageContext, rejectedGrantGeneration: number | undefined,

package/ts/classes.claudeauthority.ts

@@ -103,14 +103,12 @@ export class ClaudeNativeAuthority {
   }
 
   public async start(): Promise<void> {
-    await this.database.assertOpenAdmission();
     await this.reconcilePending();
   }
 
   public async refreshInactiveGrant(grantId: string, rejectedGrantGeneration?: number,
     minValidityMs = 300_000,
     expectedGrant?: Pick<IStoredAuthorityGrant, 'revision' | 'grantGeneration' | 'ciphertext'>): Promise<void> {
-    await this.database.assertOpenAdmission();
     if (!isHash(grantId) || this.closed || !Number.isSafeInteger(minValidityMs)
       || minValidityMs < 0 || minValidityMs > 3_600_000
       || (rejectedGrantGeneration !== undefined && (!Number.isSafeInteger(rejectedGrantGeneration)
@@ -139,7 +137,7 @@ export class ClaudeNativeAuthority {
     const account = await this.database.readAccount(grant.accountId);
     if (!account || account.removed) return;
     if (!(await this.database.hasVerifiedClaudeGrantReceipt(account.id, grant.id))) {
-      throw new Error('Claude refresh requires a verified import and backup receipt.');
+      throw new Error('Claude refresh requires a verified import receipt.');
     }
     const login = await this.unsealLogin(account, grant);
     if (rejectedGrantGeneration !== undefined && rejectedGrantGeneration > grant.grantGeneration) {
@@ -231,7 +229,7 @@ export class ClaudeNativeAuthority {
         throw new Error('Inactive Claude status authority changed.');
       }
       if (!(await this.database.hasVerifiedClaudeGrantReceipt(view.account.id, view.grant.id))) {
-        throw new Error('Claude status requires a verified import and backup receipt.');
+        throw new Error('Claude status requires a verified import receipt.');
       }
       const currentLogin = this.statusLogin(view.account, await this.unsealLogin(view.account, view.grant));
       if (!currentLogin.scopes.includes('user:profile')) {
@@ -288,7 +286,6 @@ export class ClaudeNativeAuthority {
     if (this.closed || !isHash(context.accountId) || !isHash(context.loginId)) {
       throw new Error('Invalid or closed Claude native status request.');
     }
-    await this.database.assertOpenAdmission();
     return this.options.adapter.withExclusiveHome(async session => {
       const inspect = async (): Promise<{ context: IAuthSwitchUsageContext; login: IClaudeLogin } | null> => {
         const view = await this.database.readClaudeNativeUsageView(this.options.homeId,
@@ -474,7 +471,6 @@ export class ClaudeNativeAuthority {
     if (!isHash(accountId) || !isHash(loginId) || this.closed) {
       throw new Error('Invalid or closed Claude handoff request.');
     }
-    await this.database.assertOpenAdmission();
     const task = this.performSwitch(accountId, loginId);
     this.activeHandoffs.add(task);
     try { return await task; }

package/ts/classes.claudenative.ts

@@ -87,13 +87,6 @@ export interface IClaudeNativePreparedWrite {
   readonly profile: IClaudeNativeProfileProof;
 }
 
-/** Caller-owned copies of the original native bytes before a prepared write. Null means absent. */
-export interface IClaudeNativePreparedSource {
-  readonly before: IClaudeNativeDigests;
-  readonly credentialBytes: Uint8Array | null;
-  readonly configBytes: Uint8Array | null;
-}
-
 export type TClaudeNativePrepareResult =
   | { kind: 'prepared'; plan: IClaudeNativePreparedWrite }
   | Extract<TClaudeNativeWriteResult, { kind: 'not_written' }>;
@@ -108,7 +101,6 @@ export interface IClaudeNativeLockedSession {
     targetLogin: IClaudeNativeLogin;
     expectedIdentity: IClaudeNativeIdentity;
   }): Promise<TClaudeNativePrepareResult>;
-  exportPreparedSource(plan: IClaudeNativePreparedWrite): IClaudeNativePreparedSource;
   writePreparedIfCurrent(plan: IClaudeNativePreparedWrite): TClaudeNativeWriteResult;
   writeIfCurrent(input: {
     expected: IClaudeNativeDigests;
@@ -567,7 +559,7 @@ export class ClaudeNativeAdapter {
     return runningSessions;
   }
 
-  /** The caller keeps its SmartData journal and both ownership transactions inside this callback. */
+  /** The caller keeps its NoSQLDB journal and both ownership transactions inside this callback. */
   public async withExclusiveHome<T>(action: (session: IClaudeNativeLockedSession) => Promise<T>): Promise<T> {
     this.assertSupported();
     return this.locks.holdAsync(async lease => {
@@ -730,29 +722,6 @@ class ClaudeNativeLockedSession implements IClaudeNativeLockedSession {
     return { kind: 'prepared', plan };
   }
 
-  public exportPreparedSource(plan: IClaudeNativePreparedWrite): IClaudeNativePreparedSource {
-    this.lease.assertHeld();
-    this.assertSupported();
-    const prepared = preparedWrites.get(plan);
-    if (!prepared || prepared.session !== this) throw new Error('Claude native write plan is not held by this lease.');
-    const stable = this.readStable();
-    if (!sameDigests(stable, plan.before)
-      || (plan.sourceIdentity === null ? stable.identity !== null
-        : stable.identity === null || !sameIdentity(stable.identity, plan.sourceIdentity))) {
-      throw new Error('Claude native source changed before backup export.');
-    }
-    const original = readPair(this.credentialFile, this.configFile);
-    if (!sameDigests(digests(original), plan.before)
-      || !sameRaw(original.configRaw, prepared.originalConfigRaw)) {
-      throw new Error('Claude native source changed before backup export.');
-    }
-    this.lease.assertHeld();
-    this.assertSupported();
-    return { before: Object.freeze({ ...plan.before }),
-      credentialBytes: original.credentialRaw === null ? null : Buffer.from(original.credentialRaw),
-      configBytes: original.configRaw === null ? null : Buffer.from(original.configRaw) };
-  }
-
   public writePreparedIfCurrent(plan: IClaudeNativePreparedWrite): TClaudeNativeWriteResult {
     this.lease.assertHeld();
     this.assertSupported();

package/ts/classes.codexmanaged.ts

@@ -5,7 +5,7 @@ import type { AuthSwitchAuthorityBroker } from './classes.authoritybroker.js';
 export interface IAuthSwitchManagedCodexOptions {
   /** Private runtime root; only the disposable control socket lives here. */
   runtimeDirectory: string;
-  /** Caller-owned, durable native Codex state home, reserved to one account and scope by SmartData. */
+  /** Caller-owned, durable native Codex state home, reserved to one account and scope by NoSQLDB. */
   codexHomeDirectory: string;
   workspaceDirectory: string;
   executable?: string;

package/ts/index.ts

@@ -26,6 +26,7 @@ export * from './watchpolicy.js';
 export * from './classes.authorityclient.js';
 export * from './classes.authoritycli.js';
 export * from './classes.authoritydaemon.js';
+export * from './classes.authorityimport.js';
 export * from './classes.authorityservice.js';
 
 import { AuthSwitchCli } from './classes.cli.js';
@@ -33,7 +34,8 @@ import { runAuthSwitchAuthorityCli } from './classes.authoritycli.js';
 import { AuthSwitchAuthorityService, resolveAuthSwitchAuthorityPaths, runAuthSwitchAuthorityDaemon } from './classes.authorityservice.js';
 
 export const runCli = async (argvArg: string[] = process.argv.slice(2)): Promise<void> => {
-  if (argvArg[0] === 'account' || (argvArg[0] === 'authority' && argvArg[1] === 'doctor')) {
+  if (argvArg[0] === 'account'
+    || (argvArg[0] === 'authority' && (argvArg[1] === 'doctor' || argvArg[1] === 'import'))) {
     process.exitCode = await runAuthSwitchAuthorityCli(argvArg);
     return;
   }
@@ -57,7 +59,8 @@ export const runCli = async (argvArg: string[] = process.argv.slice(2)): Promise
         return;
       }
     }
-    throw new Error('Usage: authswitch authority daemon | service install|status|enable|start|stop');
+    throw new Error('Usage: authswitch authority daemon | service install|status|enable|start|stop '
+      + '| doctor | import inventory');
   }
   const exitCode = await new AuthSwitchCli().run(argvArg);
   process.exitCode = exitCode;

package/ts/plugins.ts

@@ -5,12 +5,11 @@ import * as path from 'node:path';
 import * as childProcess from 'node:child_process';
 import * as crypto from 'node:crypto';
 import * as net from 'node:net';
-import * as stream from 'node:stream';
 import { createRequire } from 'node:module';
 import { fileURLToPath } from 'node:url';
 import type { DatabaseSync } from 'node:sqlite';
 
-export { childProcess, crypto, fileURLToPath, fs, net, os, path, stream };
+export { childProcess, crypto, fileURLToPath, fs, net, os, path };
 export type { DatabaseSync };
 const nativeRequire = createRequire(import.meta.url);
 /** SQLite is needed only when accessing a Codex state database, not when hosting account APIs. */
@@ -26,17 +25,18 @@ export type TProperLockfile = typeof properLockfile;
 export const loadProperLockfile = (): Promise<TProperLockfile> => import('proper-lockfile');
 
 // @lossless.org modules
-import * as smartbucket from '@lossless.org/client/objectstorage';
+/** Account document models, sessions and exact persistence. */
+import * as nosqldb from '@lossless.org/client/nosqldb';
+/** The embedded engine that hosts the per-user account database behind a private Unix socket. */
+import * as nosqldbEngine from '@lossless.org/nosqldb';
+export { nosqldb, nosqldbEngine };
 
 // @push.rocks modules
 import * as smartconsole from '@push.rocks/smartconsole';
-import * as smartcrypto from '@push.rocks/smartcrypto';
-import * as smartdata from '@push.rocks/smartdata';
-import * as smartdb from '@push.rocks/smartdb';
 import * as smartsecret from '@push.rocks/smartsecret';
 import * as smartdaemon from '@push.rocks/smartdaemon';
 import * as typedrequest from '@api.global/typedrequest';
-export { smartbucket, smartconsole, smartcrypto, smartdata, smartdb, smartsecret, smartdaemon, typedrequest };
+export { smartconsole, smartsecret, smartdaemon, typedrequest };
 
 // @modelprofile.com modules
 import * as flexModels from '@modelprofile.com/flexharness-models';

package/ts/ts_migration/0001_authority_meta.ts

@@ -1,33 +1,45 @@
-import type { SmartdataDb } from '@push.rocks/smartdata';
-import { assertStoredAuthorityMeta } from '../classes.authoritymodels.js';
+import * as plugins from '../plugins.js';
 
 const reserved = new Set(['_id', '_smartdataRevision', '_createdAt', '_updatedAt']);
-const keys = ['id', 'epoch', 'revision', 'updateId'];
+const currentKeys = ['id', 'epoch', 'revision', 'updateId'];
 const uuid = (value: unknown): boolean => typeof value === 'string' && /^[a-f0-9-]{36}$/.test(value);
 
-/** One-time published 6.4/6.5 metadata upgrade, under the exclusive LocalSmartDb root owner. */
-export const migrateAuthorityMetaV1 = async (db: SmartdataDb): Promise<void> => {
+/**
+ * Brings the metadata document of every published release to the current shape, under the exclusive
+ * LocalNoSqlDb root owner. 6.4/6.5 wrote exactly the current shape. 7.0.0 added `schemaVersion: 2` and an
+ * `admission` marker; both are removed in one compare-and-set, and an unreleased build that had already
+ * dropped `schemaVersion` loses the marker the same way. A store whose marker is not `open` was closed by a
+ * restore and is refused, never opened. Every other document is refused as unknown.
+ *
+ * The stored shape is the only record of completion: no ledger of applied module ids exists. That is what
+ * makes rewriting this published module in place sound, and it holds only while every accepted shape maps to
+ * the current one in at most one atomic write and the current shape maps to itself.
+ */
+export const migrateAuthorityMeta = async (db: plugins.nosqldb.SmartdataDb): Promise<void> => {
   const collection = db.mongoDb.collection('authswitch_authority_meta');
   const stored = await collection.findOne({ id: 'authswitch-authority' });
   if (!stored) throw new Error('Existing authswitch authority database has no metadata.');
   const body = Object.fromEntries(Object.entries(stored).filter(([key]) => !reserved.has(key)));
-  if (body.schemaVersion === 2) {
-    assertStoredAuthorityMeta(body);
-    return;
-  }
-  if (Object.keys(body).length !== keys.length || !keys.every(key => Object.hasOwn(body, key))
+  const hasSchemaVersion = Object.hasOwn(body, 'schemaVersion');
+  const hasAdmission = Object.hasOwn(body, 'admission');
+  if (Object.keys(body).length !== currentKeys.length + Number(hasSchemaVersion) + Number(hasAdmission)
+    || !currentKeys.every(key => Object.hasOwn(body, key))
+    || (hasSchemaVersion && (!hasAdmission || body.schemaVersion !== 2))
+    || (hasAdmission && body.admission !== 'open' && body.admission !== 'closed_restored')
     || body.id !== 'authswitch-authority' || !uuid(body.epoch) || !uuid(body.updateId)
     || !Number.isSafeInteger(body.revision) || Number(body.revision) < 0) {
     throw new Error('Existing authswitch authority metadata has an unknown schema.');
   }
-  const result = await collection.updateOne({ _id: stored._id, id: 'authswitch-authority',
-    schemaVersion: { $exists: false }, admission: { $exists: false } },
-  { $set: { schemaVersion: 2, admission: 'open' } });
+  if (!hasAdmission) return;
+  if (body.admission !== 'open') {
+    throw new Error('Authswitch authority store was closed by a restore and cannot be opened; '
+      + 'set the store aside and log in to each account again.');
+  }
+  const result = await collection.updateOne(
+    { _id: stored._id, id: 'authswitch-authority', admission: 'open',
+      schemaVersion: hasSchemaVersion ? 2 : { $exists: false } },
+    { $unset: hasSchemaVersion ? { schemaVersion: '', admission: '' } : { admission: '' } });
   if (result.matchedCount !== 1 || result.modifiedCount !== 1) {
     throw new Error('Authswitch authority metadata migration did not commit exactly once.');
   }
-  const migrated = await collection.findOne({ _id: stored._id });
-  if (!migrated) throw new Error('Authswitch authority metadata disappeared during migration.');
-  assertStoredAuthorityMeta(Object.fromEntries(Object.entries(migrated)
-    .filter(([key]) => !reserved.has(key))));
 };

package/ts/ts_migration/0002_remove_backup_records.ts

@@ -0,0 +1,49 @@
+import * as plugins from '../plugins.js';
+
+const digestCollections = ['authswitch_authority_handoffs', 'authswitch_authority_migration_ledger'];
+
+/**
+ * Removes what the retired backup and restore system left in the store, under the exclusive LocalNoSqlDb root
+ * owner. 6.4.0 to 7.0.0 stored a `backupDigest` on every native handoff and migration ledger row; no release
+ * ever wrote a non-null one, so a null digest is unset and a non-null one refuses the store. Only a 7.0.0
+ * restore could mark a preuse receipt `restored_history_uncertain`, and a restore never targeted a real store, so
+ * that receipt refuses the store as well. A verified or complete ledger row must name its imported account and
+ * grant; one that does not was never written by this package and is refused. Every refusal is decided before the
+ * first write, so a refused store is left exactly as it was.
+ *
+ * The stored shape is the only record of completion: no ledger of applied module ids exists. Each row is
+ * rewritten by its own compare-and-set, so an interrupted run leaves rows this module already recognises and the
+ * next start finishes them. Once migrated, a start costs one unindexed pass over the operation receipts, of the
+ * same order as the state reconciliation every start already performs, and passes over two collections that
+ * hold one row per imported source.
+ */
+export const removeAuthorityBackupRecords = async (db: plugins.nosqldb.SmartdataDb): Promise<void> => {
+  const operations = db.mongoDb.collection('authswitch_authority_operations');
+  if (await operations.findOne({ problem: 'restored_history_uncertain' })) {
+    throw new Error('Authswitch authority store holds a receipt written by a restore and cannot be opened; '
+      + 'set the store aside and log in to each account again.');
+  }
+  const ledger = db.mongoDb.collection('authswitch_authority_migration_ledger');
+  if (await ledger.findOne({ status: { $in: ['verified', 'complete'] }, $or: [{ accountId: null }, { grantId: null }] })) {
+    throw new Error('Authswitch authority store holds a verified migration without its imported account and grant.');
+  }
+  const carriers = [];
+  for (const name of digestCollections) {
+    const collection = db.mongoDb.collection(name);
+    if (!await collection.findOne({ backupDigest: { $exists: true } })) continue;
+    if (await collection.findOne({ backupDigest: { $exists: true, $ne: null } })) {
+      throw new Error('Authswitch authority store holds backup proof no release could have recorded.');
+    }
+    carriers.push(collection);
+  }
+  for (const collection of carriers) {
+    const carrier = { backupDigest: { $exists: true } };
+    for (let stored = await collection.findOne(carrier); stored; stored = await collection.findOne(carrier)) {
+      const result = await collection.updateOne({ _id: stored._id, backupDigest: null },
+        { $unset: { backupDigest: '' } });
+      if (result.matchedCount !== 1 || result.modifiedCount !== 1) {
+        throw new Error('Authswitch authority backup record removal did not commit exactly once.');
+      }
+    }
+  }
+};

package/ts/ts_migration/index.ts

@@ -1,7 +1,12 @@
-import type { SmartdataDb } from '@push.rocks/smartdata';
-import { migrateAuthorityMetaV1 } from './0001_authority_meta.js';
+import * as plugins from '../plugins.js';
+import { migrateAuthorityMeta } from './0001_authority_meta.js';
+import { removeAuthorityBackupRecords } from './0002_remove_backup_records.js';
 
-/** The persisted metadata schema version records completion. Order is fixed for later migrations. */
-export const runAuthorityMigrations = async (db: SmartdataDb): Promise<void> => {
-  await migrateAuthorityMetaV1(db);
+/**
+ * Runs on every start of an existing store, in this fixed order. Each module recognises the published shapes it
+ * upgrades and leaves the current shape untouched, so the stored document itself records completion.
+ */
+export const runAuthorityMigrations = async (db: plugins.nosqldb.SmartdataDb): Promise<void> => {
+  await migrateAuthorityMeta(db);
+  await removeAuthorityBackupRecords(db);
 };