@modelprofile.com/authswitch 7.0.0 → 8.1.0

package/ts/ts_migration/legacysources/authswitchstores.ts

@@ -0,0 +1,211 @@
+import * as plugins from '../../plugins.js';
+import { accessTokenExpiry, claudeSourceIdentity, legacyHash, legacySourceDigest, legacySourceId,
+  openAiSourceIdentity, openCodeOpenAiIdentity, parseLegacyJson, readLegacyFile,
+  type ILegacySourceFile, type ILegacySourceLocations, type ILegacySourceRecord,
+  type ILegacySourceReport } from './shared.js';
+
+/**
+ * Reads authswitch's own legacy stores: the Codex stash directories of `StashStore` and the saved records of
+ * `CredentialStore`.
+ *
+ * Both are copies authswitch made for itself. No other tool refreshes them, so the authority can become
+ * their owner outright -- unlike a native store, where the vendor tool keeps refreshing.
+ *
+ * `StashStore.list()` skips an incomplete directory and `CredentialStore.list()` throws on a malformed
+ * record; neither behaviour is acceptable here, because a source the owner cannot see is a source the
+ * cutover would delete unexamined. Every directory and every record is reported, with its defect.
+ */
+
+const STASH_AUTH_FILE = 'auth.json';
+const STASH_META_FILE = 'stash.json';
+/** The harness namespaces authswitch itself wrote, and the store layout each one uses. */
+const STASH_HARNESSES = ['codex'];
+const RECORD_HARNESSES = ['claude', 'opencode'];
+const RECORD_FILE = /^[a-f0-9]{64}\.json$/;
+
+const baseRecord = (path: string, files: readonly ILegacySourceFile[]): Pick<ILegacySourceRecord,
+'id' | 'sourceKind' | 'path' | 'sourcePathHash' | 'sourceDigest'> => {
+  const sourcePathHash = legacyHash(path);
+  return {
+    id: legacySourceId('authswitch_stash', sourcePathHash),
+    sourceKind: 'authswitch_stash',
+    path,
+    sourcePathHash,
+    sourceDigest: legacySourceDigest(files),
+  };
+};
+
+/** One `~/.authswitch/codex/<slug>` directory: a Codex credential plus the enrollments saved with it. */
+const readStashDirectory = (path: string): ILegacySourceRecord => {
+  const problems: string[] = [];
+  const files: ILegacySourceFile[] = [];
+  for (const name of [STASH_AUTH_FILE, STASH_META_FILE]) {
+    const read = readLegacyFile(plugins.path.join(path, name), name);
+    if (read.problem) problems.push(read.problem);
+    else if (read.file === null) problems.push(`${name} is missing`);
+    else files.push(read.file);
+  }
+  const record: ILegacySourceRecord = {
+    ...baseRecord(path, files),
+    treatment: 'refuse',
+    proof: 'none',
+    accountId: null,
+    subject: null,
+    workspaceId: null,
+    providerId: null,
+    email: null,
+    plan: null,
+    label: null,
+    accessExpiresAt: null,
+    enrollmentCount: null,
+    problems,
+  };
+  const auth = files.find(file => file.name === STASH_AUTH_FILE);
+  const meta = files.find(file => file.name === STASH_META_FILE);
+  if (meta) {
+    const parsed = parseLegacyJson(meta.raw);
+    if (!parsed) problems.push(`${STASH_META_FILE} is not a JSON object`);
+    else {
+      record.label = typeof parsed.email === 'string' ? parsed.email : null;
+      record.enrollmentCount = Array.isArray(parsed.enrollments) ? parsed.enrollments.length : null;
+      if (record.enrollmentCount === null) problems.push(`${STASH_META_FILE} carries no enrollment list`);
+    }
+  }
+  if (!auth) return record;
+  const parsed = parseLegacyJson(auth.raw);
+  const tokens = parsed?.tokens;
+  const tokenRecord = tokens && typeof tokens === 'object' && !Array.isArray(tokens)
+    ? tokens as Record<string, unknown> : null;
+  const idToken = typeof tokenRecord?.id_token === 'string' ? tokenRecord.id_token : null;
+  const refreshToken = typeof tokenRecord?.refresh_token === 'string' ? tokenRecord.refresh_token : null;
+  const identity = idToken === null ? null : openAiSourceIdentity(idToken);
+  if (identity === null) {
+    // An API-key credential is a stash authswitch can restore but not an OAuth grant the authority can hold.
+    problems.push('the saved credential carries no ChatGPT identity the authority can hold');
+    return record;
+  }
+  record.providerId = 'openai';
+  record.accountId = identity.accountId;
+  record.subject = identity.subject;
+  record.workspaceId = identity.workspaceId;
+  record.email = identity.email;
+  record.plan = identity.plan;
+  record.label = record.label ?? identity.email;
+  record.accessExpiresAt = accessTokenExpiry(
+    typeof tokenRecord?.access_token === 'string' ? tokenRecord.access_token : null);
+  if (refreshToken === null) problems.push('the saved credential carries no refresh token');
+  else if (problems.length === 0) { record.treatment = 'import'; record.proof = 'rotating_refresh'; }
+  return record;
+};
+
+/** One `~/.authswitch/<harness>/<id>.json` record, validated as `CredentialStore.read` validates it. */
+const readCredentialRecord = (harness: string, path: string, id: string): ILegacySourceRecord => {
+  const problems: string[] = [];
+  const files: ILegacySourceFile[] = [];
+  const read = readLegacyFile(path, `${id}.json`);
+  if (read.problem) problems.push(read.problem);
+  else if (read.file === null) problems.push('the record disappeared while it was being read');
+  else files.push(read.file);
+  const record: ILegacySourceRecord = {
+    ...baseRecord(path, files),
+    treatment: 'refuse',
+    proof: 'none',
+    accountId: null,
+    subject: null,
+    workspaceId: null,
+    providerId: null,
+    email: null,
+    plan: null,
+    label: null,
+    accessExpiresAt: null,
+    enrollmentCount: null,
+    problems,
+  };
+  const file = files[0];
+  if (!file) return record;
+  const parsed = parseLegacyJson(file.raw);
+  if (!parsed || parsed.schemaVersion !== 1 || parsed.id !== id || typeof parsed.slotId !== 'string'
+    || typeof parsed.label !== 'string' || !parsed.credential || typeof parsed.credential !== 'object'
+    || Array.isArray(parsed.credential)) {
+    problems.push('the saved record does not match the credential-store schema');
+    return record;
+  }
+  const credential = parsed.credential as Record<string, unknown>;
+  record.label = parsed.label;
+  if (harness === 'claude') {
+    const identity = claudeSourceIdentity(credential);
+    if (identity === null) problems.push('the saved Claude login or its account metadata is incomplete');
+    else {
+      record.providerId = 'anthropic';
+      record.accountId = identity.accountId;
+      record.subject = identity.subject;
+      record.workspaceId = identity.workspaceId;
+      record.email = identity.email;
+      record.accessExpiresAt = identity.accessExpiresAt;
+      if (typeof credential.claudeAiOauth === 'object' && credential.claudeAiOauth !== null
+        && typeof (credential.claudeAiOauth as Record<string, unknown>).refreshToken !== 'string') {
+        problems.push('the saved Claude login carries no refresh token');
+      }
+    }
+  } else if (parsed.slotId === 'openai') {
+    const { identity, accessExpiresAt } = openCodeOpenAiIdentity(credential);
+    record.accessExpiresAt = accessExpiresAt;
+    if (identity === null) problems.push('the saved OpenAI login carries no identity the authority can hold');
+    else {
+      record.providerId = 'openai';
+      record.accountId = identity.accountId;
+      record.subject = identity.subject;
+      record.workspaceId = identity.workspaceId;
+      record.email = identity.email;
+      record.plan = identity.plan;
+    }
+    if (typeof credential.refresh !== 'string') problems.push('the saved login carries no refresh token');
+  } else {
+    // API keys and other provider entries are credentials, but not grants the authority model can express.
+    problems.push(`provider ${parsed.slotId} is not a login the authority can hold`);
+  }
+  if (problems.length === 0) { record.treatment = 'import'; record.proof = 'rotating_refresh'; }
+  return record;
+};
+
+export const readAuthSwitchStores = (locations: ILegacySourceLocations): ILegacySourceReport => {
+  const sources: ILegacySourceRecord[] = [];
+  const problems: string[] = [];
+  let entries: plugins.fs.Dirent[];
+  try { entries = plugins.fs.readdirSync(locations.authSwitchHome, { withFileTypes: true }); }
+  catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return { sources, problems };
+    return { sources, problems: [`${locations.authSwitchHome} could not be listed`] };
+  }
+  for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
+    const path = plugins.path.join(locations.authSwitchHome, entry.name);
+    if (!entry.isDirectory()) { problems.push(`${entry.name} is not a harness directory`); continue; }
+    if (STASH_HARNESSES.includes(entry.name)) {
+      let stashes: plugins.fs.Dirent[];
+      try { stashes = plugins.fs.readdirSync(path, { withFileTypes: true }); }
+      catch { problems.push(`${entry.name} could not be listed`); continue; }
+      for (const stash of stashes.sort((left, right) => left.name.localeCompare(right.name))) {
+        if (!stash.isDirectory()) { problems.push(`${entry.name}/${stash.name} is not a stash`); continue; }
+        sources.push(readStashDirectory(plugins.path.join(path, stash.name)));
+      }
+    } else if (RECORD_HARNESSES.includes(entry.name)) {
+      let records: plugins.fs.Dirent[];
+      try { records = plugins.fs.readdirSync(path, { withFileTypes: true }); }
+      catch { problems.push(`${entry.name} could not be listed`); continue; }
+      for (const item of records.sort((left, right) => left.name.localeCompare(right.name))) {
+        // switches.json is authswitch's advisory record of the last switch, not a credential source.
+        if (item.name === 'switches.json' || item.name === '.lock') continue;
+        if (!item.isFile() || !RECORD_FILE.test(item.name)) {
+          problems.push(`${entry.name}/${item.name} is not a saved account record`);
+          continue;
+        }
+        sources.push(readCredentialRecord(entry.name, plugins.path.join(path, item.name),
+          item.name.slice(0, -5)));
+      }
+    } else {
+      // Guessing a store layout would be the one way this migration could lose an account silently.
+      problems.push(`${entry.name} uses no legacy store layout this import knows`);
+    }
+  }
+  return { sources, problems };
+};

package/ts/ts_migration/legacysources/index.ts

@@ -0,0 +1,35 @@
+import { readAuthSwitchStores } from './authswitchstores.js';
+import { readNativeStores } from './nativestores.js';
+import { resolveLegacySourceLocations, type ILegacySourceRecord,
+  type ILegacySourceReport } from './shared.js';
+
+export { resolveLegacySourceLocations } from './shared.js';
+export type { ILegacySourceLocations, ILegacySourceRecord, ILegacySourceReport } from './shared.js';
+export { LegacySourceChangedError, readLegacySourceEnrollments,
+  readLegacySourceMaterial } from './material.js';
+export type { TLegacySourceMaterial } from './material.js';
+
+export interface ILegacySourceOptions {
+  env: NodeJS.ProcessEnv;
+  homeDirectory: string;
+  now: number;
+}
+
+/**
+ * Every legacy credential source this host holds, read and never changed.
+ *
+ * One function so that the import and the inventory always see the same list: a submit re-runs this read to
+ * resolve a source's location from its hash and to re-check its digest, and a discrepancy between what the
+ * owner approved and what is imported would defeat the point of approving anything.
+ */
+export const readLegacySources = (options: ILegacySourceOptions): ILegacySourceReport => {
+  const locations = resolveLegacySourceLocations(options.env, options.homeDirectory);
+  const reports = [readAuthSwitchStores(locations), readNativeStores(locations, options.now)];
+  const sources: ILegacySourceRecord[] = [];
+  const problems: string[] = [];
+  for (const report of reports) {
+    sources.push(...report.sources);
+    problems.push(...report.problems);
+  }
+  return { sources, problems };
+};

package/ts/ts_migration/legacysources/material.ts

@@ -0,0 +1,134 @@
+import * as plugins from '../../plugins.js';
+import { legacySourceDigest, parseLegacyJson, readLegacyFile, type ILegacySourceFile,
+  type ILegacySourceRecord } from './shared.js';
+
+/**
+ * Re-opens the credential of one source, inside the daemon, from the location its hash stands for.
+ *
+ * Nothing carries this material over a socket: a caller names a source by id and digest, and the daemon reads
+ * the bytes itself. The digest is re-checked here, so a source that changed between the owner's approval and
+ * the import is refused rather than imported unseen.
+ */
+
+/** Exactly the envelope the authority already seals for each provider, so no new stored shape appears. */
+export type TLegacySourceMaterial =
+  | { providerId: 'openai'; credential: { kind: 'chatgptOAuth'; providerId: 'openai'; accessToken: string;
+      refreshToken: string; idToken: string } }
+  | { providerId: 'anthropic'; login: { claudeAiOauth: Record<string, unknown>;
+      oauthAccount: Record<string, unknown> } };
+
+export class LegacySourceChangedError extends Error {
+  constructor() { super('The source changed after it was inventoried; no credential was read.'); }
+}
+
+const files = (record: ILegacySourceRecord, names: readonly string[],
+  base: string): ILegacySourceFile[] => {
+  const read: ILegacySourceFile[] = [];
+  for (const name of names) {
+    const item = readLegacyFile(plugins.path.join(base, name), name);
+    if (item.file === null) throw new LegacySourceChangedError();
+    read.push(item.file);
+  }
+  return read;
+};
+
+const openAiFromTokens = (tokens: unknown): TLegacySourceMaterial | null => {
+  if (!tokens || typeof tokens !== 'object' || Array.isArray(tokens)) return null;
+  const record = tokens as Record<string, unknown>;
+  const accessToken = record.access_token;
+  const refreshToken = record.refresh_token;
+  const idToken = record.id_token;
+  if (typeof accessToken !== 'string' || typeof refreshToken !== 'string'
+    || typeof idToken !== 'string') return null;
+  return { providerId: 'openai',
+    credential: { kind: 'chatgptOAuth', providerId: 'openai', accessToken, refreshToken, idToken } };
+};
+
+const claudeFromComposite = (credential: Record<string, unknown>): TLegacySourceMaterial | null => {
+  const oauth = credential.claudeAiOauth;
+  const account = credential.oauthAccount;
+  if (!oauth || typeof oauth !== 'object' || Array.isArray(oauth)
+    || !account || typeof account !== 'object' || Array.isArray(account)) return null;
+  return { providerId: 'anthropic',
+    login: { claudeAiOauth: oauth as Record<string, unknown>,
+      oauthAccount: account as Record<string, unknown> } };
+};
+
+/** Reads the source named by `record`, proves it is still the inventoried source, and returns its envelope. */
+export const readLegacySourceMaterial = (record: ILegacySourceRecord): TLegacySourceMaterial => {
+  const assertUnchanged = (read: readonly ILegacySourceFile[]): void => {
+    if (legacySourceDigest(read) !== record.sourceDigest) throw new LegacySourceChangedError();
+  };
+  const fail = (): never => { throw new Error('The source holds no credential the authority can seal.'); };
+
+  if (record.sourceKind === 'authswitch_stash' && record.path.endsWith('.json')) {
+    const read = files(record, [plugins.path.basename(record.path)], plugins.path.dirname(record.path));
+    assertUnchanged(read);
+    const parsed = parseLegacyJson(read[0].raw);
+    const credential = parsed?.credential;
+    if (!credential || typeof credential !== 'object' || Array.isArray(credential)) return fail();
+    const material = record.providerId === 'anthropic'
+      ? claudeFromComposite(credential as Record<string, unknown>)
+      : openCodeOpenAi(credential as Record<string, unknown>);
+    return material ?? fail();
+  }
+  if (record.sourceKind === 'authswitch_stash' || record.sourceKind === 'codex_native') {
+    const base = record.sourceKind === 'codex_native' ? plugins.path.dirname(record.path) : record.path;
+    const names = record.sourceKind === 'codex_native' ? ['auth.json'] : ['auth.json', 'stash.json'];
+    const read = files(record, names, base);
+    assertUnchanged(read);
+    return openAiFromTokens(parseLegacyJson(read[0].raw)?.tokens) ?? fail();
+  }
+  if (record.sourceKind === 'claude_native') {
+    const credentials = readLegacyFile(record.path, '.credentials.json');
+    const configFile = plugins.path.join(plugins.path.dirname(record.path), '.claude.json');
+    const config = readLegacyFile(configFile, '.claude.json');
+    const read = [credentials.file, config.file].filter((file): file is ILegacySourceFile => file !== null);
+    assertUnchanged(read);
+    const credentialData = credentials.file === null ? null : parseLegacyJson(credentials.file.raw);
+    const configData = config.file === null ? null : parseLegacyJson(config.file.raw);
+    return claudeFromComposite({ claudeAiOauth: credentialData?.claudeAiOauth,
+      oauthAccount: configData?.oauthAccount }) ?? fail();
+  }
+  if (record.sourceKind === 'opencode_native') {
+    // The provider entries share a file; the location names the entry, and the digest covers that entry only.
+    const separator = record.path.lastIndexOf('#');
+    const file = record.path.slice(0, separator);
+    const provider = record.path.slice(separator + 1);
+    const read = readLegacyFile(file, 'auth.json');
+    if (read.file === null) throw new LegacySourceChangedError();
+    const entry = parseLegacyJson(read.file.raw)?.[provider];
+    if (!entry || typeof entry !== 'object' || Array.isArray(entry)) throw new LegacySourceChangedError();
+    assertUnchanged([{ name: provider, raw: JSON.stringify(entry) }]);
+    return openCodeOpenAi(entry as Record<string, unknown>) ?? fail();
+  }
+  return fail();
+};
+
+/**
+ * The remote-control enrollments a Codex stash saved beside its credential.
+ *
+ * They are separate from the refresh grant and are the pairing between this machine's Codex app-server and a
+ * ChatGPT client: a migration that dropped them would silently unpair the account.
+ */
+export const readLegacySourceEnrollments = (record: ILegacySourceRecord): Record<string, unknown>[] => {
+  if (record.sourceKind !== 'authswitch_stash' || record.path.endsWith('.json')) return [];
+  const read = readLegacyFile(plugins.path.join(record.path, 'stash.json'), 'stash.json');
+  if (read.file === null) return [];
+  const enrollments = parseLegacyJson(read.file.raw)?.enrollments;
+  return Array.isArray(enrollments)
+    ? enrollments.filter((row): row is Record<string, unknown> =>
+      Boolean(row) && typeof row === 'object' && !Array.isArray(row))
+    : [];
+};
+
+/** An OpenCode OAuth entry: access and refresh, with the identity claims carried by the access token. */
+const openCodeOpenAi = (entry: Record<string, unknown>): TLegacySourceMaterial | null => {
+  const accessToken = entry.access;
+  const refreshToken = entry.refresh;
+  if (typeof accessToken !== 'string' || typeof refreshToken !== 'string') return null;
+  // OpenCode stores no id_token; the access token carries the same claims the authority reads.
+  return { providerId: 'openai',
+    credential: { kind: 'chatgptOAuth', providerId: 'openai', accessToken, refreshToken,
+      idToken: accessToken } };
+};

package/ts/ts_migration/legacysources/nativestores.ts

@@ -0,0 +1,204 @@
+import * as plugins from '../../plugins.js';
+import { CodexHome } from '../../classes.codexhome.js';
+import { accessProofAvailable, accessTokenExpiry, claudeSourceIdentity, EXPIRED_ACCESS_PROBLEM, legacyHash,
+  legacySourceDigest, legacySourceId, openAiSourceIdentity, openCodeOpenAiIdentity, parseLegacyJson,
+  readLegacyFile, type ILegacySourceFile, type ILegacySourceLocations, type ILegacySourceRecord,
+  type ILegacySourceReport } from './shared.js';
+import type { TAuthSwitchImportSourceKind } from '../../authority-import-contract.js';
+
+/**
+ * Reads the native stores the vendor tools own: Codex's home, Claude Code's credential pair and OpenCode's
+ * provider file.
+ *
+ * These are never imported in the sense a stash record is. The native tool keeps refreshing its own store,
+ * so the authority registers the account and holds the grant as a projection it must not refresh -- two
+ * refreshers on one rotating refresh token strand each other. Their ledger rows are therefore earned with a
+ * proof that rotates nothing: a provider read with the access token already in the store.
+ */
+
+const ENROLLMENT_TABLE = 'remote_control_enrollments';
+
+/**
+ * Counts Codex's remote-control enrollments without changing them.
+ *
+ * `RemoteControlStore.read()` turns every failure into an empty list, which is right for a switch and wrong
+ * for an inventory: it would report "no enrollments" for a database that is merely locked, and the owner
+ * would approve a cutover that loses pairings. This read distinguishes the two.
+ */
+const countCodexEnrollments = (codexHome: CodexHome): { count: number | null; problem: string | null } => {
+  const statePath = codexHome.statePath;
+  if (statePath === null) return { count: 0, problem: null };
+  const { DatabaseSync } = plugins.loadSqlite();
+  let database: InstanceType<typeof DatabaseSync> | undefined;
+  try {
+    database = new DatabaseSync(statePath, { readOnly: true });
+    database.exec('pragma busy_timeout = 5000');
+    const table = database.prepare(`select name from sqlite_master where type = 'table' and name = ?`)
+      .get(ENROLLMENT_TABLE);
+    if (table === undefined) return { count: 0, problem: null };
+    const row = database.prepare(`select count(*) as count from ${ENROLLMENT_TABLE}`).get() as
+      { count?: unknown } | undefined;
+    const count = Number(row?.count);
+    return Number.isSafeInteger(count)
+      ? { count, problem: null }
+      : { count: null, problem: 'the Codex state database returned no enrollment count' };
+  } catch {
+    // A WAL database Codex holds open cannot always be opened read-only; that is unknown, never zero.
+    return { count: null, problem: 'the Codex state database could not be read, so its enrollments are unknown' };
+  } finally { database?.close(); }
+};
+
+const nativeRecord = (sourceKind: TAuthSwitchImportSourceKind, path: string,
+  files: readonly ILegacySourceFile[], problems: string[]): ILegacySourceRecord => {
+  const sourcePathHash = legacyHash(path);
+  return {
+    id: legacySourceId(sourceKind, sourcePathHash),
+    sourceKind,
+    path,
+    sourcePathHash,
+    sourceDigest: legacySourceDigest(files),
+    treatment: 'refuse',
+    proof: 'none',
+    accountId: null,
+    subject: null,
+    workspaceId: null,
+    providerId: null,
+    email: null,
+    plan: null,
+    label: null,
+    accessExpiresAt: null,
+    enrollmentCount: null,
+    problems,
+  };
+};
+
+/** Marks a projection source ready, or explains why its non-rotating proof cannot be taken right now. */
+const asProjection = (record: ILegacySourceRecord, now: number): ILegacySourceRecord => {
+  record.treatment = 'project';
+  record.proof = 'access_token_read';
+  if (!accessProofAvailable(record.accessExpiresAt, now)) record.problems.push(EXPIRED_ACCESS_PROBLEM);
+  return record;
+};
+
+const readCodexNative = (locations: ILegacySourceLocations, now: number): ILegacySourceRecord | null => {
+  const path = plugins.path.join(locations.codexHome, 'auth.json');
+  const read = readLegacyFile(path, 'auth.json');
+  if (read.problem === null && read.file === null) return null;
+  const files = read.file ? [read.file] : [];
+  const problems = read.problem ? [read.problem] : [];
+  const record = nativeRecord('codex_native', path, files, problems);
+  const enrollments = countCodexEnrollments(new CodexHome(locations.codexHome));
+  record.enrollmentCount = enrollments.count;
+  if (enrollments.problem) problems.push(enrollments.problem);
+  if (!read.file) return record;
+  const parsed = parseLegacyJson(read.file.raw);
+  const tokens = parsed?.tokens;
+  const tokenRecord = tokens && typeof tokens === 'object' && !Array.isArray(tokens)
+    ? tokens as Record<string, unknown> : null;
+  const idToken = typeof tokenRecord?.id_token === 'string' ? tokenRecord.id_token : null;
+  const identity = idToken === null ? null : openAiSourceIdentity(idToken);
+  if (identity === null) {
+    problems.push('the active Codex credential carries no ChatGPT identity the authority can hold');
+    return record;
+  }
+  record.providerId = 'openai';
+  record.accountId = identity.accountId;
+  record.subject = identity.subject;
+  record.workspaceId = identity.workspaceId;
+  record.email = identity.email;
+  record.plan = identity.plan;
+  record.label = identity.email;
+  record.accessExpiresAt = accessTokenExpiry(
+    typeof tokenRecord?.access_token === 'string' ? tokenRecord.access_token : null);
+  return asProjection(record, now);
+};
+
+const readClaudeNative = (locations: ILegacySourceLocations, now: number): ILegacySourceRecord | null => {
+  const credentials = readLegacyFile(locations.claudeCredentialFile, '.credentials.json');
+  const config = readLegacyFile(locations.claudeConfigFile, '.claude.json');
+  if (credentials.problem === null && credentials.file === null) return null;
+  const files = [credentials.file, config.file].filter((file): file is ILegacySourceFile => file !== null);
+  const problems = [credentials.problem, config.problem].filter((problem): problem is string => problem !== null);
+  const record = nativeRecord('claude_native', locations.claudeCredentialFile, files, problems);
+  if (!credentials.file) return record;
+  const credentialData = parseLegacyJson(credentials.file.raw);
+  const configData = config.file === null ? null : parseLegacyJson(config.file.raw);
+  if (configData === null) problems.push('the Claude account metadata file is missing or not a JSON object');
+  const identity = claudeSourceIdentity({
+    claudeAiOauth: credentialData?.claudeAiOauth, oauthAccount: configData?.oauthAccount });
+  if (identity === null) {
+    problems.push('the native Claude login or its account metadata is incomplete');
+    return record;
+  }
+  record.providerId = 'anthropic';
+  record.accountId = identity.accountId;
+  record.subject = identity.subject;
+  record.workspaceId = identity.workspaceId;
+  record.email = identity.email;
+  record.label = identity.email;
+  record.accessExpiresAt = identity.accessExpiresAt;
+  return asProjection(record, now);
+};
+
+/**
+ * One row per provider entry of OpenCode's `auth.json`.
+ *
+ * The entries share a file, so the source location names the entry -- `<file>#<provider>` -- and the digest
+ * covers that entry's bytes. A change to one provider therefore does not invalidate another's ledger row.
+ */
+const readOpenCodeNative = (locations: ILegacySourceLocations, now: number): ILegacySourceReport => {
+  const read = readLegacyFile(locations.openCodeAuthFile, 'auth.json');
+  if (read.problem !== null) return { sources: [], problems: [`OpenCode ${read.problem}`] };
+  if (read.file === null) return { sources: [], problems: [] };
+  const parsed = parseLegacyJson(read.file.raw);
+  if (parsed === null) return { sources: [], problems: ['OpenCode auth.json is not a JSON object'] };
+  const sources: ILegacySourceRecord[] = [];
+  for (const [provider, value] of Object.entries(parsed).sort(([left], [right]) => left.localeCompare(right))) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) continue;
+    const entry = value as Record<string, unknown>;
+    const path = `${locations.openCodeAuthFile}#${provider}`;
+    const record = nativeRecord('opencode_native', path,
+      [{ name: provider, raw: JSON.stringify(entry) }], []);
+    record.label = provider;
+    if (entry.type !== 'oauth') {
+      record.problems.push(`the ${provider} entry is a ${String(entry.type)} credential, not a login the authority can hold`);
+      sources.push(record);
+      continue;
+    }
+    if (provider !== 'openai') {
+      // OpenCode identifies a non-OpenAI OAuth entry by a token fingerprint, which is not a provider
+      // identity: there is nothing to bind an authority account to. Its account is added from its own store.
+      record.problems.push(`the ${provider} entry carries no provider identity the authority can bind an account to`);
+      sources.push(record);
+      continue;
+    }
+    const { identity, accessExpiresAt } = openCodeOpenAiIdentity(entry);
+    record.accessExpiresAt = accessExpiresAt;
+    if (identity === null) {
+      record.problems.push('the OpenAI entry carries no identity the authority can hold');
+      sources.push(record);
+      continue;
+    }
+    record.providerId = 'openai';
+    record.accountId = identity.accountId;
+    record.subject = identity.subject;
+    record.workspaceId = identity.workspaceId;
+    record.email = identity.email;
+    record.plan = identity.plan;
+    record.label = identity.email ?? provider;
+    sources.push(asProjection(record, now));
+  }
+  return { sources, problems: [] };
+};
+
+export const readNativeStores = (locations: ILegacySourceLocations, now: number): ILegacySourceReport => {
+  const sources: ILegacySourceRecord[] = [];
+  const problems: string[] = [];
+  for (const record of [readCodexNative(locations, now), readClaudeNative(locations, now)]) {
+    if (record !== null) sources.push(record);
+  }
+  const openCode = readOpenCodeNative(locations, now);
+  sources.push(...openCode.sources);
+  problems.push(...openCode.problems);
+  return { sources, problems };
+};