@modelprofile.com/authswitch 7.0.0 → 8.1.0

package/dist_ts/classes.authorityimport.d.ts

@@ -0,0 +1,161 @@
+import * as plugins from './plugins.js';
+import type { AuthSwitchAuthorityDatabase } from './classes.authoritydatabase.js';
+import { type IAuthSwitchSecretCodec } from './classes.authoritysecrets.js';
+import { type IClaudeLogin, type IClaudeStatusRead } from './classes.claudestatus.js';
+import { type TClaudeAuthorityRefreshResult } from './classes.claudetokenrefresh.js';
+import { type THarnessBinary } from './classes.harnessprocesses.js';
+import type { IAuthSwitchImportInventory, IAuthSwitchImportResult, IAuthSwitchImportStatus, TAuthSwitchImportSubmission } from './authority-import-contract.js';
+/**
+ * What this daemon can observe about writers of the legacy stores.
+ *
+ * It cannot observe every writer: a host that uses the legacy library inside its own process is invisible
+ * here, which is why a submission also carries the caller's own assertion. Unknown is never idle.
+ */
+export interface IAuthSwitchImportQuiescence {
+    /** The live pid of the authswitch watch that owns the legacy stores, or null when none runs. */
+    watchHolderPid(): number | null;
+    runningHarnessPids(binary: THarnessBinary): readonly number[];
+    /** Codex's own answer about its app-server. `null` means unknown, which counts as running. */
+    codexAppServerRunning(): boolean | null;
+}
+/**
+ * Exactly the two provider operations an import needs, so nothing here can reach for a third.
+ *
+ * `OpenAiProviderAdapter` satisfies this; naming only what is used keeps the rotating call countable and
+ * makes it visible that a projection never touches `refreshCredential`.
+ */
+export interface IAuthSwitchImportOpenAiOperations {
+    refreshCredential(credential: plugins.flexAccounts.IOpenAiChatGptOAuthCredential): Promise<plugins.flexAccounts.TSmartAiProviderRefreshResult>;
+    getAccountRateLimits(credential: plugins.flexAccounts.TOpenAiChatGptReadCredential): Promise<plugins.flexAccounts.TSmartAiProviderAccountRateLimitsResult>;
+}
+/** The non-rotating Claude proof: one profile read that must name the expected immutable identity. */
+export interface IAuthSwitchImportClaudeStatus {
+    readDetailed(login: IClaudeLogin): Promise<IClaudeStatusRead>;
+}
+/** The rotating Claude refresh, with its own explicit uncertain outcome. */
+export interface IAuthSwitchImportClaudeTokens {
+    refreshForAuthority(oauth: Record<string, unknown>): Promise<TClaudeAuthorityRefreshResult>;
+}
+export interface IAuthSwitchAuthorityImportOptions {
+    /** Locates the legacy stores, exactly as each owning class locates its own. */
+    env?: NodeJS.ProcessEnv;
+    homeDirectory?: string;
+    now?: () => number;
+    /** The one rotating refresh of an imported ChatGPT login, and the non-rotating read that proves one. */
+    openAi?: IAuthSwitchImportOpenAiOperations;
+    claudeStatus?: IAuthSwitchImportClaudeStatus;
+    claudeTokens?: IAuthSwitchImportClaudeTokens;
+    secrets?: IAuthSwitchSecretCodec;
+    quiescence?: IAuthSwitchImportQuiescence;
+}
+/** Reads the host: the watch lock file, the process table and Codex's own daemon status. */
+export declare class AuthSwitchImportHostQuiescence implements IAuthSwitchImportQuiescence {
+    private readonly authSwitchHome;
+    private readonly codexHome;
+    constructor(authSwitchHome: string, codexHome: string);
+    watchHolderPid(): number | null;
+    runningHarnessPids(binary: THarnessBinary): readonly number[];
+    codexAppServerRunning(): boolean | null;
+}
+/** A refusal the owner can act on. It never leaves a half-written import behind. */
+export declare class AuthSwitchImportRefusal extends Error {
+}
+/**
+ * The one-time account import.
+ *
+ * It reads the legacy stores through the isolated migration readers and reports them against the authority's
+ * migration ledger. Nothing here is a runtime fallback: no ordinary authority operation reaches this class,
+ * and it never writes to a legacy store.
+ */
+export declare class AuthSwitchAuthorityImport {
+    private readonly database;
+    private readonly env;
+    private readonly homeDirectory;
+    private readonly now;
+    private readonly openAi;
+    private readonly claudeStatus;
+    private readonly claudeTokens;
+    private readonly secrets;
+    private readonly quiescence;
+    constructor(database: AuthSwitchAuthorityDatabase, options?: IAuthSwitchAuthorityImportOptions);
+    /** The credential-free report. Reads the legacy stores and the ledger; writes nothing. */
+    inventory(): Promise<IAuthSwitchImportInventory>;
+    /**
+     * Where every source the authority knows about stands.
+     *
+     * Read from the migration ledger, the grants and the handoffs only: it opens no legacy store, so it stays
+     * truthful about what the authority decided even if a source has since been moved or deleted on the host.
+     * A source that was never submitted has no ledger row and belongs to the inventory, not here.
+     */
+    status(request?: {
+        after?: string;
+        limit?: number;
+    }): Promise<IAuthSwitchImportStatus>;
+    /**
+     * Imports one source.
+     *
+     * A source whose grant the authority takes over is verified by one real refresh, which rotates its token
+     * and is the point of no return; a source a native tool keeps refreshing is verified by a provider read
+     * that rotates nothing. Every step before the refresh is durable, and the marker that says "the exchange
+     * may have been sent" is the handoff's own `source_stopped` phase: a restart that finds it never replays
+     * the grant, it asks for a device sign-in instead.
+     */
+    submit(request: {
+        submission: TAuthSwitchImportSubmission;
+        callerQuiescent: true;
+        acknowledgeRunOrder: true;
+    }): Promise<IAuthSwitchImportResult>;
+    /** The source a submission names, proven to be the one that was inventoried. */
+    private resolveSource;
+    private externalIdentity;
+    /** Reads the credential the daemon will seal. Only an external submission brings its own. */
+    private material;
+    /**
+     * Refuses while anything that could refresh this source is running.
+     *
+     * Unknown counts as running: an import that guessed idle could rotate a token another owner is using.
+     */
+    private assertQuiescent;
+    private beginLedger;
+    private moveLedger;
+    private stamp;
+    private account;
+    /** Writes the account and its grant, choosing the primary or the secondary transaction by identity. */
+    private putGrant;
+    private baseGrant;
+    /** Refuses a source whose grant another owner already holds, in either direction. */
+    private assertOwnable;
+    /**
+     * A projected source: the account is registered, the grant stays with its native owner, and the proof is a
+     * provider read that rotates nothing. No refresh is ever sent here.
+     */
+    private project;
+    /** The non-rotating proof: the stored access token is asked about itself and must name this account. */
+    private proveWithoutRotation;
+    /**
+     * A source the authority takes over.
+     *
+     * The handoff row is the durable record of how far this went. `source_stopped` is written before the
+     * refresh is sent, so a lost answer is always visible afterwards and is never retried.
+     */
+    private adopt;
+    private moveHandoff;
+    private failHandoff;
+    /**
+     * Marks a source whose sign-in exchange may already have been consumed. That is its only meaning, so the
+     * refusal a later submission gets needs no further reason: the repair is always a device sign-in.
+     */
+    private quarantine;
+    /**
+     * The one rotating refresh. `null` means the outcome is unknown and the grant must never be replayed.
+     *
+     * A thrown error is the same answer as a failed one: once the request left this process, whether the
+     * provider consumed the token is unknowable, so both end in a device sign-in rather than a retry.
+     */
+    private rotate;
+    private rotateOnce;
+    private seal;
+    /** Codex remote-control enrollments travel with the credential; losing them is losing a pairing. */
+    private storeEnrollments;
+    private result;
+}