@modelprofile.com/authswitch 8.0.0 → 8.1.0

package/ts/classes.authoritydatabase.ts

@@ -8,7 +8,7 @@ import {
   assertStoredAuthorityBinding, assertStoredAuthorityClaudeHandoff, assertStoredAuthorityClaudeHome,
   assertStoredAuthorityEnrollment, assertStoredAuthorityGrant,
   assertStoredAuthorityHandoff, assertStoredAuthorityMigrationLedger, assertStoredAuthorityOperation,
-  assertStoredAuthorityUsage,
+  assertStoredAuthorityUsage, grantRefresherTransferRefusal, transfersGrantRefresher,
   type IStoredAuthorityAccount, type IStoredAuthorityBinding, type IStoredAuthorityClaudeHandoff,
   type IStoredAuthorityClaudeHome, type IStoredAuthorityCodexHome, type IStoredAuthorityEnrollment,
   type IStoredAuthorityEvent, type IStoredAuthorityGrant, type IStoredAuthorityHandoff,
@@ -573,6 +573,19 @@ export class AuthSwitchAuthorityDatabase {
     return stored.map(item => AuthSwitchAuthorityMigrationLedgerModel.exact.toPersisted(item));
   }
 
+  /** Every migration ledger row in id order, one bounded page at a time. */
+  public async migrationLedgerPage(after: string | null,
+    limit = 128): Promise<{ rows: IStoredAuthorityMigrationLedger[]; nextCursor: string | null }> {
+    this.db();
+    if (!Number.isSafeInteger(limit) || limit < 1 || limit > 256) throw new Error('Invalid migration page size.');
+    const stored = await AuthSwitchAuthorityMigrationLedgerModel.exact.findStored({
+      filter: after ? { id: { $gt: after } } : {}, sort: { id: 1 }, limit: limit + 1,
+    });
+    const rows = stored.slice(0, limit)
+      .map(item => AuthSwitchAuthorityMigrationLedgerModel.exact.toPersisted(item));
+    return { rows, nextCursor: stored.length > limit ? rows[rows.length - 1].id : null };
+  }
+
   public async readAccountAndPrimaryGrant(id: string): Promise<{
     account: IStoredAuthorityAccount | null; grant: IStoredAuthorityGrant | null;
   }> {
@@ -973,9 +986,8 @@ export class AuthSwitchAuthorityDatabase {
         if (accountStored && accountStored.primaryGrantId !== grantId) {
           throw new Error('Primary grant identity cannot be replaced.');
         }
-        if (grantStored && ['legacy_native', 'claude_native'].includes(grantStored.owner)
-          && draft.grant.owner === 'daemon') {
-          throw new Error('Native ownership requires a verified handoff.');
+        if (grantStored && transfersGrantRefresher(grantStored.owner, draft.grant.owner)) {
+          throw new Error(grantRefresherTransferRefusal(grantStored.owner, draft.grant.owner));
         }
         await this.persistAccount(session, accountStored, draft.account);
         await this.persistGrant(session, grantStored, draft.grant);
@@ -1124,6 +1136,10 @@ export class AuthSwitchAuthorityDatabase {
           || draft.providerId !== account.providerId || draft.updateId !== updateId) {
           throw new Error('Secondary grant identity is invalid.');
         }
+        // A secondary grant transfers its refresher by a verified handoff as well; one token, one refresher.
+        if (grant && transfersGrantRefresher(grant.owner, draft.owner)) {
+          throw new Error(grantRefresherTransferRefusal(grant.owner, draft.owner));
+        }
         await this.persistGrant(session, grantStored, draft);
         const updatedAccount = { ...account, revision: account.revision + 1,
           statusObservedAt: draft.statusObservedAt, updateId };