@modelprofile.com/authswitch 8.0.0 → 8.1.0

package/dist_ts/ts_migration/legacysources/nativestores.js

@@ -0,0 +1,207 @@
+import * as plugins from '../../plugins.js';
+import { CodexHome } from '../../classes.codexhome.js';
+import { accessProofAvailable, accessTokenExpiry, claudeSourceIdentity, EXPIRED_ACCESS_PROBLEM, legacyHash, legacySourceDigest, legacySourceId, openAiSourceIdentity, openCodeOpenAiIdentity, parseLegacyJson, readLegacyFile } from './shared.js';
+/**
+ * Reads the native stores the vendor tools own: Codex's home, Claude Code's credential pair and OpenCode's
+ * provider file.
+ *
+ * These are never imported in the sense a stash record is. The native tool keeps refreshing its own store,
+ * so the authority registers the account and holds the grant as a projection it must not refresh -- two
+ * refreshers on one rotating refresh token strand each other. Their ledger rows are therefore earned with a
+ * proof that rotates nothing: a provider read with the access token already in the store.
+ */
+const ENROLLMENT_TABLE = 'remote_control_enrollments';
+/**
+ * Counts Codex's remote-control enrollments without changing them.
+ *
+ * `RemoteControlStore.read()` turns every failure into an empty list, which is right for a switch and wrong
+ * for an inventory: it would report "no enrollments" for a database that is merely locked, and the owner
+ * would approve a cutover that loses pairings. This read distinguishes the two.
+ */
+const countCodexEnrollments = (codexHome) => {
+    const statePath = codexHome.statePath;
+    if (statePath === null)
+        return { count: 0, problem: null };
+    const { DatabaseSync } = plugins.loadSqlite();
+    let database;
+    try {
+        database = new DatabaseSync(statePath, { readOnly: true });
+        database.exec('pragma busy_timeout = 5000');
+        const table = database.prepare(`select name from sqlite_master where type = 'table' and name = ?`)
+            .get(ENROLLMENT_TABLE);
+        if (table === undefined)
+            return { count: 0, problem: null };
+        const row = database.prepare(`select count(*) as count from ${ENROLLMENT_TABLE}`).get();
+        const count = Number(row?.count);
+        return Number.isSafeInteger(count)
+            ? { count, problem: null }
+            : { count: null, problem: 'the Codex state database returned no enrollment count' };
+    }
+    catch {
+        // A WAL database Codex holds open cannot always be opened read-only; that is unknown, never zero.
+        return { count: null, problem: 'the Codex state database could not be read, so its enrollments are unknown' };
+    }
+    finally {
+        database?.close();
+    }
+};
+const nativeRecord = (sourceKind, path, files, problems) => {
+    const sourcePathHash = legacyHash(path);
+    return {
+        id: legacySourceId(sourceKind, sourcePathHash),
+        sourceKind,
+        path,
+        sourcePathHash,
+        sourceDigest: legacySourceDigest(files),
+        treatment: 'refuse',
+        proof: 'none',
+        accountId: null,
+        subject: null,
+        workspaceId: null,
+        providerId: null,
+        email: null,
+        plan: null,
+        label: null,
+        accessExpiresAt: null,
+        enrollmentCount: null,
+        problems,
+    };
+};
+/** Marks a projection source ready, or explains why its non-rotating proof cannot be taken right now. */
+const asProjection = (record, now) => {
+    record.treatment = 'project';
+    record.proof = 'access_token_read';
+    if (!accessProofAvailable(record.accessExpiresAt, now))
+        record.problems.push(EXPIRED_ACCESS_PROBLEM);
+    return record;
+};
+const readCodexNative = (locations, now) => {
+    const path = plugins.path.join(locations.codexHome, 'auth.json');
+    const read = readLegacyFile(path, 'auth.json');
+    if (read.problem === null && read.file === null)
+        return null;
+    const files = read.file ? [read.file] : [];
+    const problems = read.problem ? [read.problem] : [];
+    const record = nativeRecord('codex_native', path, files, problems);
+    const enrollments = countCodexEnrollments(new CodexHome(locations.codexHome));
+    record.enrollmentCount = enrollments.count;
+    if (enrollments.problem)
+        problems.push(enrollments.problem);
+    if (!read.file)
+        return record;
+    const parsed = parseLegacyJson(read.file.raw);
+    const tokens = parsed?.tokens;
+    const tokenRecord = tokens && typeof tokens === 'object' && !Array.isArray(tokens)
+        ? tokens : null;
+    const idToken = typeof tokenRecord?.id_token === 'string' ? tokenRecord.id_token : null;
+    const identity = idToken === null ? null : openAiSourceIdentity(idToken);
+    if (identity === null) {
+        problems.push('the active Codex credential carries no ChatGPT identity the authority can hold');
+        return record;
+    }
+    record.providerId = 'openai';
+    record.accountId = identity.accountId;
+    record.subject = identity.subject;
+    record.workspaceId = identity.workspaceId;
+    record.email = identity.email;
+    record.plan = identity.plan;
+    record.label = identity.email;
+    record.accessExpiresAt = accessTokenExpiry(typeof tokenRecord?.access_token === 'string' ? tokenRecord.access_token : null);
+    return asProjection(record, now);
+};
+const readClaudeNative = (locations, now) => {
+    const credentials = readLegacyFile(locations.claudeCredentialFile, '.credentials.json');
+    const config = readLegacyFile(locations.claudeConfigFile, '.claude.json');
+    if (credentials.problem === null && credentials.file === null)
+        return null;
+    const files = [credentials.file, config.file].filter((file) => file !== null);
+    const problems = [credentials.problem, config.problem].filter((problem) => problem !== null);
+    const record = nativeRecord('claude_native', locations.claudeCredentialFile, files, problems);
+    if (!credentials.file)
+        return record;
+    const credentialData = parseLegacyJson(credentials.file.raw);
+    const configData = config.file === null ? null : parseLegacyJson(config.file.raw);
+    if (configData === null)
+        problems.push('the Claude account metadata file is missing or not a JSON object');
+    const identity = claudeSourceIdentity({
+        claudeAiOauth: credentialData?.claudeAiOauth, oauthAccount: configData?.oauthAccount
+    });
+    if (identity === null) {
+        problems.push('the native Claude login or its account metadata is incomplete');
+        return record;
+    }
+    record.providerId = 'anthropic';
+    record.accountId = identity.accountId;
+    record.subject = identity.subject;
+    record.workspaceId = identity.workspaceId;
+    record.email = identity.email;
+    record.label = identity.email;
+    record.accessExpiresAt = identity.accessExpiresAt;
+    return asProjection(record, now);
+};
+/**
+ * One row per provider entry of OpenCode's `auth.json`.
+ *
+ * The entries share a file, so the source location names the entry -- `<file>#<provider>` -- and the digest
+ * covers that entry's bytes. A change to one provider therefore does not invalidate another's ledger row.
+ */
+const readOpenCodeNative = (locations, now) => {
+    const read = readLegacyFile(locations.openCodeAuthFile, 'auth.json');
+    if (read.problem !== null)
+        return { sources: [], problems: [`OpenCode ${read.problem}`] };
+    if (read.file === null)
+        return { sources: [], problems: [] };
+    const parsed = parseLegacyJson(read.file.raw);
+    if (parsed === null)
+        return { sources: [], problems: ['OpenCode auth.json is not a JSON object'] };
+    const sources = [];
+    for (const [provider, value] of Object.entries(parsed).sort(([left], [right]) => left.localeCompare(right))) {
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            continue;
+        const entry = value;
+        const path = `${locations.openCodeAuthFile}#${provider}`;
+        const record = nativeRecord('opencode_native', path, [{ name: provider, raw: JSON.stringify(entry) }], []);
+        record.label = provider;
+        if (entry.type !== 'oauth') {
+            record.problems.push(`the ${provider} entry is a ${String(entry.type)} credential, not a login the authority can hold`);
+            sources.push(record);
+            continue;
+        }
+        if (provider !== 'openai') {
+            // OpenCode identifies a non-OpenAI OAuth entry by a token fingerprint, which is not a provider
+            // identity: there is nothing to bind an authority account to. Its account is added from its own store.
+            record.problems.push(`the ${provider} entry carries no provider identity the authority can bind an account to`);
+            sources.push(record);
+            continue;
+        }
+        const { identity, accessExpiresAt } = openCodeOpenAiIdentity(entry);
+        record.accessExpiresAt = accessExpiresAt;
+        if (identity === null) {
+            record.problems.push('the OpenAI entry carries no identity the authority can hold');
+            sources.push(record);
+            continue;
+        }
+        record.providerId = 'openai';
+        record.accountId = identity.accountId;
+        record.subject = identity.subject;
+        record.workspaceId = identity.workspaceId;
+        record.email = identity.email;
+        record.plan = identity.plan;
+        record.label = identity.email ?? provider;
+        sources.push(asProjection(record, now));
+    }
+    return { sources, problems: [] };
+};
+export const readNativeStores = (locations, now) => {
+    const sources = [];
+    const problems = [];
+    for (const record of [readCodexNative(locations, now), readClaudeNative(locations, now)]) {
+        if (record !== null)
+            sources.push(record);
+    }
+    const openCode = readOpenCodeNative(locations, now);
+    sources.push(...openCode.sources);
+    problems.push(...openCode.problems);
+    return { sources, problems };
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmF0aXZlc3RvcmVzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vdHMvdHNfbWlncmF0aW9uL2xlZ2FjeXNvdXJjZXMvbmF0aXZlc3RvcmVzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sa0JBQWtCLENBQUM7QUFDNUMsT0FBTyxFQUFFLFNBQVMsRUFBRSxNQUFNLDRCQUE0QixDQUFDO0FBQ3ZELE9BQU8sRUFBRSxvQkFBb0IsRUFBRSxpQkFBaUIsRUFBRSxvQkFBb0IsRUFBRSxzQkFBc0IsRUFBRSxVQUFVLEVBQ3hHLGtCQUFrQixFQUFFLGNBQWMsRUFBRSxvQkFBb0IsRUFBRSxzQkFBc0IsRUFBRSxlQUFlLEVBQ2pHLGNBQWMsRUFDWSxNQUFNLGFBQWEsQ0FBQztBQUdoRDs7Ozs7Ozs7R0FRRztBQUVILE1BQU0sZ0JBQWdCLEdBQUcsNEJBQTRCLENBQUM7QUFFdEQ7Ozs7OztHQU1HO0FBQ0gsTUFBTSxxQkFBcUIsR0FBRyxDQUFDLFNBQW9CLEVBQW9ELEVBQUU7SUFDdkcsTUFBTSxTQUFTLEdBQUcsU0FBUyxDQUFDLFNBQVMsQ0FBQztJQUN0QyxJQUFJLFNBQVMsS0FBSyxJQUFJO1FBQUUsT0FBTyxFQUFFLEtBQUssRUFBRSxDQUFDLEVBQUUsT0FBTyxFQUFFLElBQUksRUFBRSxDQUFDO0lBQzNELE1BQU0sRUFBRSxZQUFZLEVBQUUsR0FBRyxPQUFPLENBQUMsVUFBVSxFQUFFLENBQUM7SUFDOUMsSUFBSSxRQUF1RCxDQUFDO0lBQzVELElBQUksQ0FBQztRQUNILFFBQVEsR0FBRyxJQUFJLFlBQVksQ0FBQyxTQUFTLEVBQUUsRUFBRSxRQUFRLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztRQUMzRCxRQUFRLENBQUMsSUFBSSxDQUFDLDRCQUE0QixDQUFDLENBQUM7UUFDNUMsTUFBTSxLQUFLLEdBQUcsUUFBUSxDQUFDLE9BQU8sQ0FBQyxrRUFBa0UsQ0FBQzthQUMvRixHQUFHLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztRQUN6QixJQUFJLEtBQUssS0FBSyxTQUFTO1lBQUUsT0FBTyxFQUFFLEtBQUssRUFBRSxDQUFDLEVBQUUsT0FBTyxFQUFFLElBQUksRUFBRSxDQUFDO1FBQzVELE1BQU0sR0FBRyxHQUFHLFFBQVEsQ0FBQyxPQUFPLENBQUMsaUNBQWlDLGdCQUFnQixFQUFFLENBQUMsQ0FBQyxHQUFHLEVBQ3BELENBQUM7UUFDbEMsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLEdBQUcsRUFBRSxLQUFLLENBQUMsQ0FBQztRQUNqQyxPQUFPLE1BQU0sQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDO1lBQ2hDLENBQUMsQ0FBQyxFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsSUFBSSxFQUFFO1lBQzFCLENBQUMsQ0FBQyxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsT0FBTyxFQUFFLHVEQUF1RCxFQUFFLENBQUM7SUFDeEYsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLGtHQUFrRztRQUNsRyxPQUFPLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBRSxPQUFPLEVBQUUsNEVBQTRFLEVBQUUsQ0FBQztJQUNoSCxDQUFDO1lBQVMsQ0FBQztRQUFDLFFBQVEsRUFBRSxLQUFLLEVBQUUsQ0FBQztJQUFDLENBQUM7QUFDbEMsQ0FBQyxDQUFDO0FBRUYsTUFBTSxZQUFZLEdBQUcsQ0FBQyxVQUF1QyxFQUFFLElBQVksRUFDekUsS0FBbUMsRUFBRSxRQUFrQixFQUF1QixFQUFFO0lBQ2hGLE1BQU0sY0FBYyxHQUFHLFVBQVUsQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUN4QyxPQUFPO1FBQ0wsRUFBRSxFQUFFLGNBQWMsQ0FBQyxVQUFVLEVBQUUsY0FBYyxDQUFDO1FBQzlDLFVBQVU7UUFDVixJQUFJO1FBQ0osY0FBYztRQUNkLFlBQVksRUFBRSxrQkFBa0IsQ0FBQyxLQUFLLENBQUM7UUFDdkMsU0FBUyxFQUFFLFFBQVE7UUFDbkIsS0FBSyxFQUFFLE1BQU07UUFDYixTQUFTLEVBQUUsSUFBSTtRQUNmLE9BQU8sRUFBRSxJQUFJO1FBQ2IsV0FBVyxFQUFFLElBQUk7UUFDakIsVUFBVSxFQUFFLElBQUk7UUFDaEIsS0FBSyxFQUFFLElBQUk7UUFDWCxJQUFJLEVBQUUsSUFBSTtRQUNWLEtBQUssRUFBRSxJQUFJO1FBQ1gsZUFBZSxFQUFFLElBQUk7UUFDckIsZUFBZSxFQUFFLElBQUk7UUFDckIsUUFBUTtLQUNULENBQUM7QUFDSixDQUFDLENBQUM7QUFFRix5R0FBeUc7QUFDekcsTUFBTSxZQUFZLEdBQUcsQ0FBQyxNQUEyQixFQUFFLEdBQVcsRUFBdUIsRUFBRTtJQUNyRixNQUFNLENBQUMsU0FBUyxHQUFHLFNBQVMsQ0FBQztJQUM3QixNQUFNLENBQUMsS0FBSyxHQUFHLG1CQUFtQixDQUFDO0lBQ25DLElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxNQUFNLENBQUMsZUFBZSxFQUFFLEdBQUcsQ0FBQztRQUFFLE1BQU0sQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLHNCQUFzQixDQUFDLENBQUM7SUFDckcsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxlQUFlLEdBQUcsQ0FBQyxTQUFpQyxFQUFFLEdBQVcsRUFBOEIsRUFBRTtJQUNyRyxNQUFNLElBQUksR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsU0FBUyxFQUFFLFdBQVcsQ0FBQyxDQUFDO0lBQ2pFLE1BQU0sSUFBSSxHQUFHLGNBQWMsQ0FBQyxJQUFJLEVBQUUsV0FBVyxDQUFDLENBQUM7SUFDL0MsSUFBSSxJQUFJLENBQUMsT0FBTyxLQUFLLElBQUksSUFBSSxJQUFJLENBQUMsSUFBSSxLQUFLLElBQUk7UUFBRSxPQUFPLElBQUksQ0FBQztJQUM3RCxNQUFNLEtBQUssR0FBRyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO0lBQzNDLE1BQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7SUFDcEQsTUFBTSxNQUFNLEdBQUcsWUFBWSxDQUFDLGNBQWMsRUFBRSxJQUFJLEVBQUUsS0FBSyxFQUFFLFFBQVEsQ0FBQyxDQUFDO0lBQ25FLE1BQU0sV0FBVyxHQUFHLHFCQUFxQixDQUFDLElBQUksU0FBUyxDQUFDLFNBQVMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDO0lBQzlFLE1BQU0sQ0FBQyxlQUFlLEdBQUcsV0FBVyxDQUFDLEtBQUssQ0FBQztJQUMzQyxJQUFJLFdBQVcsQ0FBQyxPQUFPO1FBQUUsUUFBUSxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsT0FBTyxDQUFDLENBQUM7SUFDNUQsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJO1FBQUUsT0FBTyxNQUFNLENBQUM7SUFDOUIsTUFBTSxNQUFNLEdBQUcsZUFBZSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDOUMsTUFBTSxNQUFNLEdBQUcsTUFBTSxFQUFFLE1BQU0sQ0FBQztJQUM5QixNQUFNLFdBQVcsR0FBRyxNQUFNLElBQUksT0FBTyxNQUFNLEtBQUssUUFBUSxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUM7UUFDaEYsQ0FBQyxDQUFDLE1BQWlDLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQztJQUM3QyxNQUFNLE9BQU8sR0FBRyxPQUFPLFdBQVcsRUFBRSxRQUFRLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxXQUFXLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUM7SUFDeEYsTUFBTSxRQUFRLEdBQUcsT0FBTyxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxvQkFBb0IsQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUN6RSxJQUFJLFFBQVEsS0FBSyxJQUFJLEVBQUUsQ0FBQztRQUN0QixRQUFRLENBQUMsSUFBSSxDQUFDLGdGQUFnRixDQUFDLENBQUM7UUFDaEcsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUNELE1BQU0sQ0FBQyxVQUFVLEdBQUcsUUFBUSxDQUFDO0lBQzdCLE1BQU0sQ0FBQyxTQUFTLEdBQUcsUUFBUSxDQUFDLFNBQVMsQ0FBQztJQUN0QyxNQUFNLENBQUMsT0FBTyxHQUFHLFFBQVEsQ0FBQyxPQUFPLENBQUM7SUFDbEMsTUFBTSxDQUFDLFdBQVcsR0FBRyxRQUFRLENBQUMsV0FBVyxDQUFDO0lBQzFDLE1BQU0sQ0FBQyxLQUFLLEdBQUcsUUFBUSxDQUFDLEtBQUssQ0FBQztJQUM5QixNQUFNLENBQUMsSUFBSSxHQUFHLFFBQVEsQ0FBQyxJQUFJLENBQUM7SUFDNUIsTUFBTSxDQUFDLEtBQUssR0FBRyxRQUFRLENBQUMsS0FBSyxDQUFDO0lBQzlCLE1BQU0sQ0FBQyxlQUFlLEdBQUcsaUJBQWlCLENBQ3hDLE9BQU8sV0FBVyxFQUFFLFlBQVksS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxZQUFZLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQ25GLE9BQU8sWUFBWSxDQUFDLE1BQU0sRUFBRSxHQUFHLENBQUMsQ0FBQztBQUNuQyxDQUFDLENBQUM7QUFFRixNQUFNLGdCQUFnQixHQUFHLENBQUMsU0FBaUMsRUFBRSxHQUFXLEVBQThCLEVBQUU7SUFDdEcsTUFBTSxXQUFXLEdBQUcsY0FBYyxDQUFDLFNBQVMsQ0FBQyxvQkFBb0IsRUFBRSxtQkFBbUIsQ0FBQyxDQUFDO0lBQ3hGLE1BQU0sTUFBTSxHQUFHLGNBQWMsQ0FBQyxTQUFTLENBQUMsZ0JBQWdCLEVBQUUsY0FBYyxDQUFDLENBQUM7SUFDMUUsSUFBSSxXQUFXLENBQUMsT0FBTyxLQUFLLElBQUksSUFBSSxXQUFXLENBQUMsSUFBSSxLQUFLLElBQUk7UUFBRSxPQUFPLElBQUksQ0FBQztJQUMzRSxNQUFNLEtBQUssR0FBRyxDQUFDLFdBQVcsQ0FBQyxJQUFJLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLE1BQU0sQ0FBQyxDQUFDLElBQUksRUFBNkIsRUFBRSxDQUFDLElBQUksS0FBSyxJQUFJLENBQUMsQ0FBQztJQUN6RyxNQUFNLFFBQVEsR0FBRyxDQUFDLFdBQVcsQ0FBQyxPQUFPLEVBQUUsTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDLE1BQU0sQ0FBQyxDQUFDLE9BQU8sRUFBcUIsRUFBRSxDQUFDLE9BQU8sS0FBSyxJQUFJLENBQUMsQ0FBQztJQUNoSCxNQUFNLE1BQU0sR0FBRyxZQUFZLENBQUMsZUFBZSxFQUFFLFNBQVMsQ0FBQyxvQkFBb0IsRUFBRSxLQUFLLEVBQUUsUUFBUSxDQUFDLENBQUM7SUFDOUYsSUFBSSxDQUFDLFdBQVcsQ0FBQyxJQUFJO1FBQUUsT0FBTyxNQUFNLENBQUM7SUFDckMsTUFBTSxjQUFjLEdBQUcsZUFBZSxDQUFDLFdBQVcsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDN0QsTUFBTSxVQUFVLEdBQUcsTUFBTSxDQUFDLElBQUksS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsZUFBZSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDbEYsSUFBSSxVQUFVLEtBQUssSUFBSTtRQUFFLFFBQVEsQ0FBQyxJQUFJLENBQUMsa0VBQWtFLENBQUMsQ0FBQztJQUMzRyxNQUFNLFFBQVEsR0FBRyxvQkFBb0IsQ0FBQztRQUNwQyxhQUFhLEVBQUUsY0FBYyxFQUFFLGFBQWEsRUFBRSxZQUFZLEVBQUUsVUFBVSxFQUFFLFlBQVk7S0FBRSxDQUFDLENBQUM7SUFDMUYsSUFBSSxRQUFRLEtBQUssSUFBSSxFQUFFLENBQUM7UUFDdEIsUUFBUSxDQUFDLElBQUksQ0FBQywrREFBK0QsQ0FBQyxDQUFDO1FBQy9FLE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUM7SUFDRCxNQUFNLENBQUMsVUFBVSxHQUFHLFdBQVcsQ0FBQztJQUNoQyxNQUFNLENBQUMsU0FBUyxHQUFHLFFBQVEsQ0FBQyxTQUFTLENBQUM7SUFDdEMsTUFBTSxDQUFDLE9BQU8sR0FBRyxRQUFRLENBQUMsT0FBTyxDQUFDO0lBQ2xDLE1BQU0sQ0FBQyxXQUFXLEdBQUcsUUFBUSxDQUFDLFdBQVcsQ0FBQztJQUMxQyxNQUFNLENBQUMsS0FBSyxHQUFHLFFBQVEsQ0FBQyxLQUFLLENBQUM7SUFDOUIsTUFBTSxDQUFDLEtBQUssR0FBRyxRQUFRLENBQUMsS0FBSyxDQUFDO0lBQzlCLE1BQU0sQ0FBQyxlQUFlLEdBQUcsUUFBUSxDQUFDLGVBQWUsQ0FBQztJQUNsRCxPQUFPLFlBQVksQ0FBQyxNQUFNLEVBQUUsR0FBRyxDQUFDLENBQUM7QUFDbkMsQ0FBQyxDQUFDO0FBRUY7Ozs7O0dBS0c7QUFDSCxNQUFNLGtCQUFrQixHQUFHLENBQUMsU0FBaUMsRUFBRSxHQUFXLEVBQXVCLEVBQUU7SUFDakcsTUFBTSxJQUFJLEdBQUcsY0FBYyxDQUFDLFNBQVMsQ0FBQyxnQkFBZ0IsRUFBRSxXQUFXLENBQUMsQ0FBQztJQUNyRSxJQUFJLElBQUksQ0FBQyxPQUFPLEtBQUssSUFBSTtRQUFFLE9BQU8sRUFBRSxPQUFPLEVBQUUsRUFBRSxFQUFFLFFBQVEsRUFBRSxDQUFDLFlBQVksSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDLEVBQUUsQ0FBQztJQUMxRixJQUFJLElBQUksQ0FBQyxJQUFJLEtBQUssSUFBSTtRQUFFLE9BQU8sRUFBRSxPQUFPLEVBQUUsRUFBRSxFQUFFLFFBQVEsRUFBRSxFQUFFLEVBQUUsQ0FBQztJQUM3RCxNQUFNLE1BQU0sR0FBRyxlQUFlLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUM5QyxJQUFJLE1BQU0sS0FBSyxJQUFJO1FBQUUsT0FBTyxFQUFFLE9BQU8sRUFBRSxFQUFFLEVBQUUsUUFBUSxFQUFFLENBQUMseUNBQXlDLENBQUMsRUFBRSxDQUFDO0lBQ25HLE1BQU0sT0FBTyxHQUEwQixFQUFFLENBQUM7SUFDMUMsS0FBSyxNQUFNLENBQUMsUUFBUSxFQUFFLEtBQUssQ0FBQyxJQUFJLE1BQU0sQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxFQUFFLEVBQUUsQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUM1RyxJQUFJLENBQUMsS0FBSyxJQUFJLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQztZQUFFLFNBQVM7UUFDMUUsTUFBTSxLQUFLLEdBQUcsS0FBZ0MsQ0FBQztRQUMvQyxNQUFNLElBQUksR0FBRyxHQUFHLFNBQVMsQ0FBQyxnQkFBZ0IsSUFBSSxRQUFRLEVBQUUsQ0FBQztRQUN6RCxNQUFNLE1BQU0sR0FBRyxZQUFZLENBQUMsaUJBQWlCLEVBQUUsSUFBSSxFQUNqRCxDQUFDLEVBQUUsSUFBSSxFQUFFLFFBQVEsRUFBRSxHQUFHLEVBQUUsSUFBSSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFDeEQsTUFBTSxDQUFDLEtBQUssR0FBRyxRQUFRLENBQUM7UUFDeEIsSUFBSSxLQUFLLENBQUMsSUFBSSxLQUFLLE9BQU8sRUFBRSxDQUFDO1lBQzNCLE1BQU0sQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLE9BQU8sUUFBUSxlQUFlLE1BQU0sQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLGlEQUFpRCxDQUFDLENBQUM7WUFDeEgsT0FBTyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQztZQUNyQixTQUFTO1FBQ1gsQ0FBQztRQUNELElBQUksUUFBUSxLQUFLLFFBQVEsRUFBRSxDQUFDO1lBQzFCLCtGQUErRjtZQUMvRix1R0FBdUc7WUFDdkcsTUFBTSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsT0FBTyxRQUFRLDBFQUEwRSxDQUFDLENBQUM7WUFDaEgsT0FBTyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQztZQUNyQixTQUFTO1FBQ1gsQ0FBQztRQUNELE1BQU0sRUFBRSxRQUFRLEVBQUUsZUFBZSxFQUFFLEdBQUcsc0JBQXNCLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDcEUsTUFBTSxDQUFDLGVBQWUsR0FBRyxlQUFlLENBQUM7UUFDekMsSUFBSSxRQUFRLEtBQUssSUFBSSxFQUFFLENBQUM7WUFDdEIsTUFBTSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsNkRBQTZELENBQUMsQ0FBQztZQUNwRixPQUFPLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1lBQ3JCLFNBQVM7UUFDWCxDQUFDO1FBQ0QsTUFBTSxDQUFDLFVBQVUsR0FBRyxRQUFRLENBQUM7UUFDN0IsTUFBTSxDQUFDLFNBQVMsR0FBRyxRQUFRLENBQUMsU0FBUyxDQUFDO1FBQ3RDLE1BQU0sQ0FBQyxPQUFPLEdBQUcsUUFBUSxDQUFDLE9BQU8sQ0FBQztRQUNsQyxNQUFNLENBQUMsV0FBVyxHQUFHLFFBQVEsQ0FBQyxXQUFXLENBQUM7UUFDMUMsTUFBTSxDQUFDLEtBQUssR0FBRyxRQUFRLENBQUMsS0FBSyxDQUFDO1FBQzlCLE1BQU0sQ0FBQyxJQUFJLEdBQUcsUUFBUSxDQUFDLElBQUksQ0FBQztRQUM1QixNQUFNLENBQUMsS0FBSyxHQUFHLFFBQVEsQ0FBQyxLQUFLLElBQUksUUFBUSxDQUFDO1FBQzFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLE1BQU0sRUFBRSxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQzFDLENBQUM7SUFDRCxPQUFPLEVBQUUsT0FBTyxFQUFFLFFBQVEsRUFBRSxFQUFFLEVBQUUsQ0FBQztBQUNuQyxDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxnQkFBZ0IsR0FBRyxDQUFDLFNBQWlDLEVBQUUsR0FBVyxFQUF1QixFQUFFO0lBQ3RHLE1BQU0sT0FBTyxHQUEwQixFQUFFLENBQUM7SUFDMUMsTUFBTSxRQUFRLEdBQWEsRUFBRSxDQUFDO0lBQzlCLEtBQUssTUFBTSxNQUFNLElBQUksQ0FBQyxlQUFlLENBQUMsU0FBUyxFQUFFLEdBQUcsQ0FBQyxFQUFFLGdCQUFnQixDQUFDLFNBQVMsRUFBRSxHQUFHLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDekYsSUFBSSxNQUFNLEtBQUssSUFBSTtZQUFFLE9BQU8sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDNUMsQ0FBQztJQUNELE1BQU0sUUFBUSxHQUFHLGtCQUFrQixDQUFDLFNBQVMsRUFBRSxHQUFHLENBQUMsQ0FBQztJQUNwRCxPQUFPLENBQUMsSUFBSSxDQUFDLEdBQUcsUUFBUSxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQ2xDLFFBQVEsQ0FBQyxJQUFJLENBQUMsR0FBRyxRQUFRLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDcEMsT0FBTyxFQUFFLE9BQU8sRUFBRSxRQUFRLEVBQUUsQ0FBQztBQUMvQixDQUFDLENBQUMifQ==

package/dist_ts/ts_migration/legacysources/shared.d.ts

@@ -0,0 +1,124 @@
+import type { TAuthSwitchImportProof, TAuthSwitchImportSourceKind, TAuthSwitchImportTreatment } from '../../authority-import-contract.js';
+/**
+ * Shared vocabulary of the legacy-source readers.
+ *
+ * These readers exist for one migration and are deliberately isolated from the runtime: nothing here is a
+ * fallback an ordinary command may reach for. They only read, and they report what they could not read
+ * instead of returning a shorter list -- a silently skipped entry is an account the owner would lose.
+ */
+/** One source as the readers see it. `path` stays inside the daemon; only `sourcePathHash` is published. */
+export interface ILegacySourceRecord {
+    id: string;
+    sourceKind: TAuthSwitchImportSourceKind;
+    path: string;
+    sourcePathHash: string;
+    sourceDigest: string;
+    treatment: TAuthSwitchImportTreatment;
+    proof: TAuthSwitchImportProof;
+    accountId: string | null;
+    /** The provider's own stable identity, kept on the account so a sealed credential can be matched to it. */
+    subject: string | null;
+    workspaceId: string | null;
+    providerId: string | null;
+    email: string | null;
+    plan: string | null;
+    label: string | null;
+    accessExpiresAt: string | null;
+    enrollmentCount: number | null;
+    problems: string[];
+}
+export interface ILegacySourceReport {
+    sources: ILegacySourceRecord[];
+    /** Locations that could not be read at all, so an empty result is never mistaken for an empty store. */
+    problems: string[];
+}
+/**
+ * Where the legacy stores live.
+ *
+ * Each field repeats the rule of the class that owns that location, so a fixture can point the whole reader
+ * at a temporary directory: `authSwitchHome` (ts/classes.credentialstore.ts), `CodexHome`
+ * (ts/classes.codexhome.ts), `ClaudeCodeHarness` (ts/classes.claudecodeharness.ts) and `OpenCodeHarness`
+ * (ts/classes.opencodeharness.ts). Drift in any of those is a bug here, not a reason to guess.
+ */
+export interface ILegacySourceLocations {
+    authSwitchHome: string;
+    codexHome: string;
+    claudeCredentialFile: string;
+    claudeConfigFile: string;
+    openCodeAuthFile: string;
+}
+export declare const resolveLegacySourceLocations: (env: NodeJS.ProcessEnv, homeDirectory: string) => ILegacySourceLocations;
+export declare const legacyHash: (value: string) => string;
+/** The ledger row id of a source. Stable across inventory runs, so a resumed import finds its own row. */
+export declare const legacySourceId: (sourceKind: TAuthSwitchImportSourceKind, sourcePathHash: string) => string;
+/**
+ * The digest that binds an import to exactly these bytes.
+ *
+ * A source is often more than one file -- a stash directory, or Claude's credential/config pair -- so the
+ * digest covers an ordered list of per-file digests rather than one file. The file names are part of it: a
+ * source that gains or loses a file is a different source.
+ */
+export declare const legacySourceDigest: (files: ReadonlyArray<{
+    name: string;
+    raw: string;
+}>) => string;
+export interface ILegacySourceFile {
+    name: string;
+    raw: string;
+}
+/** A bounded read that reports unreadable and absent apart, through the store's own reader. */
+export declare const readLegacyFile: (file: string, name: string) => {
+    file: ILegacySourceFile | null;
+    problem: string | null;
+};
+export declare const parseLegacyJson: (raw: string) => Record<string, unknown> | null;
+export interface IOpenAiSourceIdentity {
+    accountId: string;
+    /** The stable provider identity the account record keeps, so a sealed credential can be matched to it. */
+    subject: string;
+    workspaceId: string;
+    email: string | null;
+    plan: string | null;
+}
+/**
+ * The authority account a ChatGPT login resolves to.
+ *
+ * Derived from the id_token's claims exactly as `AuthSwitchAuthorityBroker.identity` derives it
+ * (ts/classes.authoritybroker.ts), because an import that produced a different account id would create a
+ * second account for a login the owner already has. No provider call is involved: this is a local read of
+ * claims the token already carries, which is what lets the inventory run offline.
+ */
+export declare const openAiSourceIdentity: (idToken: string) => IOpenAiSourceIdentity | null;
+export interface IClaudeSourceIdentity {
+    accountId: string;
+    /** Claude's immutable pair, kept as the account's subject and workspace so a sealed login matches it. */
+    subject: string;
+    workspaceId: string;
+    email: string | null;
+    accessExpiresAt: string | null;
+}
+/**
+ * The authority account a Claude subscriber login resolves to.
+ *
+ * Claude's immutable identity is the account/organization UUID pair that `ClaudeNativeAdapter` proves
+ * against the provider (ts/classes.claudenative.ts). Nothing in the package derived an authority account id
+ * from it before this import, so it follows the OpenAI rule -- provider, subject, workspace -- and stays the
+ * single formula both the inventory and the import use.
+ */
+export declare const claudeSourceIdentity: (credential: Record<string, unknown>) => IClaudeSourceIdentity | null;
+/**
+ * The identity of an OpenCode OpenAI provider entry.
+ *
+ * OpenCode stores no id_token, so `OpenCodeHarness.openAiInfo` (ts/classes.opencodeharness.ts) reads the
+ * claims of the access token instead. An expired or opaque access token therefore leaves such an entry
+ * without a derivable identity, which is reported rather than guessed.
+ */
+export declare const openCodeOpenAiIdentity: (entry: Record<string, unknown>) => {
+    identity: IOpenAiSourceIdentity | null;
+    accessExpiresAt: string | null;
+};
+/** The expiry claim of an access token, as the broker reads it. Absent or unparsable means unknown. */
+export declare const accessTokenExpiry: (accessToken: string | null) => string | null;
+/** Whether a non-rotating proof can still be taken with this access token. */
+export declare const accessProofAvailable: (expiresAt: string | null, now: number) => boolean;
+export declare const EXPIRED_ACCESS_PROBLEM: string;

package/dist_ts/ts_migration/legacysources/shared.js

@@ -0,0 +1,142 @@
+import * as plugins from '../../plugins.js';
+import { readCredentialRaw } from '../../classes.credentialstore.js';
+export const resolveLegacySourceLocations = (env, homeDirectory) => {
+    const claudeConfigDirectory = env.CLAUDE_CONFIG_DIR || plugins.path.join(homeDirectory, '.claude');
+    const dataHome = env.XDG_DATA_HOME || plugins.path.join(homeDirectory, '.local', 'share');
+    return {
+        authSwitchHome: env.AUTHSWITCH_HOME || plugins.path.join(homeDirectory, '.authswitch'),
+        codexHome: env.CODEX_HOME || plugins.path.join(homeDirectory, '.codex'),
+        claudeCredentialFile: plugins.path.join(claudeConfigDirectory, '.credentials.json'),
+        // Claude Code keeps its account metadata beside the home directory, not inside a custom config directory.
+        claudeConfigFile: plugins.path.join(env.CLAUDE_CONFIG_DIR || homeDirectory, '.claude.json'),
+        openCodeAuthFile: plugins.path.join(dataHome, 'opencode', 'auth.json'),
+    };
+};
+export const legacyHash = (value) => plugins.crypto.createHash('sha256').update(value).digest('hex');
+/** The ledger row id of a source. Stable across inventory runs, so a resumed import finds its own row. */
+export const legacySourceId = (sourceKind, sourcePathHash) => legacyHash(JSON.stringify(['authswitch-migration-v1', sourceKind, sourcePathHash]));
+/**
+ * The digest that binds an import to exactly these bytes.
+ *
+ * A source is often more than one file -- a stash directory, or Claude's credential/config pair -- so the
+ * digest covers an ordered list of per-file digests rather than one file. The file names are part of it: a
+ * source that gains or loses a file is a different source.
+ */
+export const legacySourceDigest = (files) => legacyHash(JSON.stringify([...files]
+    .sort((left, right) => left.name.localeCompare(right.name))
+    .map(file => [file.name, legacyHash(file.raw)])));
+/** A bounded read that reports unreadable and absent apart, through the store's own reader. */
+export const readLegacyFile = (file, name) => {
+    try {
+        const raw = readCredentialRaw(file);
+        return { file: raw === null ? null : { name, raw }, problem: null };
+    }
+    catch {
+        return { file: null, problem: `${name} is unreadable, malformed or too large` };
+    }
+};
+export const parseLegacyJson = (raw) => {
+    try {
+        const value = JSON.parse(raw);
+        return value && typeof value === 'object' && !Array.isArray(value)
+            ? value : null;
+    }
+    catch {
+        return null;
+    }
+};
+/**
+ * The authority account a ChatGPT login resolves to.
+ *
+ * Derived from the id_token's claims exactly as `AuthSwitchAuthorityBroker.identity` derives it
+ * (ts/classes.authoritybroker.ts), because an import that produced a different account id would create a
+ * second account for a login the owner already has. No provider call is involved: this is a local read of
+ * claims the token already carries, which is what lets the inventory run offline.
+ */
+export const openAiSourceIdentity = (idToken) => {
+    let info;
+    try {
+        info = plugins.flexAuth.parseOpenAiChatGptTokenInfo(idToken);
+    }
+    catch {
+        return null;
+    }
+    if (!info.chatgptUserId || !info.chatgptAccountId)
+        return null;
+    return {
+        accountId: legacyHash(JSON.stringify(['authswitch-account-v1', 'openai',
+            info.chatgptUserId, info.chatgptAccountId])),
+        subject: info.chatgptUserId,
+        workspaceId: info.chatgptAccountId,
+        email: info.email?.toLowerCase() ?? null,
+        plan: info.chatgptPlanType ?? null,
+    };
+};
+/**
+ * The authority account a Claude subscriber login resolves to.
+ *
+ * Claude's immutable identity is the account/organization UUID pair that `ClaudeNativeAdapter` proves
+ * against the provider (ts/classes.claudenative.ts). Nothing in the package derived an authority account id
+ * from it before this import, so it follows the OpenAI rule -- provider, subject, workspace -- and stays the
+ * single formula both the inventory and the import use.
+ */
+export const claudeSourceIdentity = (credential) => {
+    const oauth = credential.claudeAiOauth;
+    const account = credential.oauthAccount;
+    if (!oauth || typeof oauth !== 'object' || Array.isArray(oauth)
+        || !account || typeof account !== 'object' || Array.isArray(account))
+        return null;
+    const oauthRecord = oauth;
+    const accountRecord = account;
+    const accountUuid = accountRecord.accountUuid;
+    const organizationUuid = accountRecord.organizationUuid;
+    if (typeof accountUuid !== 'string' || !accountUuid || typeof organizationUuid !== 'string'
+        || !organizationUuid)
+        return null;
+    const expiresAt = oauthRecord.expiresAt;
+    const email = accountRecord.emailAddress;
+    return {
+        accountId: legacyHash(JSON.stringify(['authswitch-account-v1', 'anthropic',
+            accountUuid, organizationUuid])),
+        subject: accountUuid,
+        workspaceId: organizationUuid,
+        email: typeof email === 'string' && email ? email.toLowerCase() : null,
+        accessExpiresAt: typeof expiresAt === 'number' && Number.isFinite(expiresAt)
+            ? new Date(expiresAt).toISOString() : null,
+    };
+};
+/**
+ * The identity of an OpenCode OpenAI provider entry.
+ *
+ * OpenCode stores no id_token, so `OpenCodeHarness.openAiInfo` (ts/classes.opencodeharness.ts) reads the
+ * claims of the access token instead. An expired or opaque access token therefore leaves such an entry
+ * without a derivable identity, which is reported rather than guessed.
+ */
+export const openCodeOpenAiIdentity = (entry) => {
+    const access = typeof entry.access === 'string' ? entry.access : null;
+    const expires = entry.expires;
+    const accessExpiresAt = typeof expires === 'number' && Number.isFinite(expires)
+        ? new Date(expires).toISOString() : accessTokenExpiry(access);
+    return { identity: access === null ? null : openAiSourceIdentity(access), accessExpiresAt };
+};
+/** The expiry claim of an access token, as the broker reads it. Absent or unparsable means unknown. */
+export const accessTokenExpiry = (accessToken) => {
+    if (!accessToken)
+        return null;
+    try {
+        return plugins.flexAuth.parseOpenAiChatGptTokenInfo(accessToken).expiresAt ?? null;
+    }
+    catch {
+        return null;
+    }
+};
+/** Whether a non-rotating proof can still be taken with this access token. */
+export const accessProofAvailable = (expiresAt, now) => {
+    if (expiresAt === null)
+        return false;
+    const value = Date.parse(expiresAt);
+    return Number.isFinite(value) && value > now;
+};
+export const EXPIRED_ACCESS_PROBLEM = 'the stored access token has expired, so the non-rotating proof is unavailable until the native tool '
+    + 'refreshes its own store';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2hhcmVkLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vdHMvdHNfbWlncmF0aW9uL2xlZ2FjeXNvdXJjZXMvc2hhcmVkLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sa0JBQWtCLENBQUM7QUFDNUMsT0FBTyxFQUFFLGlCQUFpQixFQUFFLE1BQU0sa0NBQWtDLENBQUM7QUF3RHJFLE1BQU0sQ0FBQyxNQUFNLDRCQUE0QixHQUFHLENBQUMsR0FBc0IsRUFDakUsYUFBcUIsRUFBMEIsRUFBRTtJQUNqRCxNQUFNLHFCQUFxQixHQUFHLEdBQUcsQ0FBQyxpQkFBaUIsSUFBSSxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxhQUFhLEVBQUUsU0FBUyxDQUFDLENBQUM7SUFDbkcsTUFBTSxRQUFRLEdBQUcsR0FBRyxDQUFDLGFBQWEsSUFBSSxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxhQUFhLEVBQUUsUUFBUSxFQUFFLE9BQU8sQ0FBQyxDQUFDO0lBQzFGLE9BQU87UUFDTCxjQUFjLEVBQUUsR0FBRyxDQUFDLGVBQWUsSUFBSSxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxhQUFhLEVBQUUsYUFBYSxDQUFDO1FBQ3RGLFNBQVMsRUFBRSxHQUFHLENBQUMsVUFBVSxJQUFJLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLGFBQWEsRUFBRSxRQUFRLENBQUM7UUFDdkUsb0JBQW9CLEVBQUUsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMscUJBQXFCLEVBQUUsbUJBQW1CLENBQUM7UUFDbkYsMEdBQTBHO1FBQzFHLGdCQUFnQixFQUFFLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxpQkFBaUIsSUFBSSxhQUFhLEVBQUUsY0FBYyxDQUFDO1FBQzNGLGdCQUFnQixFQUFFLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxVQUFVLEVBQUUsV0FBVyxDQUFDO0tBQ3ZFLENBQUM7QUFDSixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxVQUFVLEdBQUcsQ0FBQyxLQUFhLEVBQVUsRUFBRSxDQUNsRCxPQUFPLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO0FBRWxFLDBHQUEwRztBQUMxRyxNQUFNLENBQUMsTUFBTSxjQUFjLEdBQUcsQ0FBQyxVQUF1QyxFQUFFLGNBQXNCLEVBQVUsRUFBRSxDQUN4RyxVQUFVLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDLHlCQUF5QixFQUFFLFVBQVUsRUFBRSxjQUFjLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFFdEY7Ozs7OztHQU1HO0FBQ0gsTUFBTSxDQUFDLE1BQU0sa0JBQWtCLEdBQUcsQ0FBQyxLQUFtRCxFQUFVLEVBQUUsQ0FDaEcsVUFBVSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxHQUFHLEtBQUssQ0FBQztLQUNqQyxJQUFJLENBQUMsQ0FBQyxJQUFJLEVBQUUsS0FBSyxFQUFFLEVBQUUsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUM7S0FDMUQsR0FBRyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLFVBQVUsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQU90RCwrRkFBK0Y7QUFDL0YsTUFBTSxDQUFDLE1BQU0sY0FBYyxHQUFHLENBQUMsSUFBWSxFQUFFLElBQVksRUFDRSxFQUFFO0lBQzNELElBQUksQ0FBQztRQUNILE1BQU0sR0FBRyxHQUFHLGlCQUFpQixDQUFDLElBQUksQ0FBQyxDQUFDO1FBQ3BDLE9BQU8sRUFBRSxJQUFJLEVBQUUsR0FBRyxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxFQUFFLElBQUksRUFBRSxHQUFHLEVBQUUsRUFBRSxPQUFPLEVBQUUsSUFBSSxFQUFFLENBQUM7SUFDdEUsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLE9BQU8sRUFBRSxHQUFHLElBQUksd0NBQXdDLEVBQUUsQ0FBQztJQUNsRixDQUFDO0FBQ0gsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sZUFBZSxHQUFHLENBQUMsR0FBVyxFQUFrQyxFQUFFO0lBQzdFLElBQUksQ0FBQztRQUNILE1BQU0sS0FBSyxHQUFZLElBQUksQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDdkMsT0FBTyxLQUFLLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUM7WUFDaEUsQ0FBQyxDQUFDLEtBQWdDLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQztJQUM5QyxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQUMsT0FBTyxJQUFJLENBQUM7SUFBQyxDQUFDO0FBQzFCLENBQUMsQ0FBQztBQVdGOzs7Ozs7O0dBT0c7QUFDSCxNQUFNLENBQUMsTUFBTSxvQkFBb0IsR0FBRyxDQUFDLE9BQWUsRUFBZ0MsRUFBRTtJQUNwRixJQUFJLElBQXFFLENBQUM7SUFDMUUsSUFBSSxDQUFDO1FBQUMsSUFBSSxHQUFHLE9BQU8sQ0FBQyxRQUFRLENBQUMsMkJBQTJCLENBQUMsT0FBTyxDQUFDLENBQUM7SUFBQyxDQUFDO0lBQ3JFLE1BQU0sQ0FBQztRQUFDLE9BQU8sSUFBSSxDQUFDO0lBQUMsQ0FBQztJQUN0QixJQUFJLENBQUMsSUFBSSxDQUFDLGFBQWEsSUFBSSxDQUFDLElBQUksQ0FBQyxnQkFBZ0I7UUFBRSxPQUFPLElBQUksQ0FBQztJQUMvRCxPQUFPO1FBQ0wsU0FBUyxFQUFFLFVBQVUsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUMsdUJBQXVCLEVBQUUsUUFBUTtZQUNyRSxJQUFJLENBQUMsYUFBYSxFQUFFLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDLENBQUM7UUFDOUMsT0FBTyxFQUFFLElBQUksQ0FBQyxhQUFhO1FBQzNCLFdBQVcsRUFBRSxJQUFJLENBQUMsZ0JBQWdCO1FBQ2xDLEtBQUssRUFBRSxJQUFJLENBQUMsS0FBSyxFQUFFLFdBQVcsRUFBRSxJQUFJLElBQUk7UUFDeEMsSUFBSSxFQUFFLElBQUksQ0FBQyxlQUFlLElBQUksSUFBSTtLQUNuQyxDQUFDO0FBQ0osQ0FBQyxDQUFDO0FBV0Y7Ozs7Ozs7R0FPRztBQUNILE1BQU0sQ0FBQyxNQUFNLG9CQUFvQixHQUFHLENBQUMsVUFBbUMsRUFBZ0MsRUFBRTtJQUN4RyxNQUFNLEtBQUssR0FBRyxVQUFVLENBQUMsYUFBYSxDQUFDO0lBQ3ZDLE1BQU0sT0FBTyxHQUFHLFVBQVUsQ0FBQyxZQUFZLENBQUM7SUFDeEMsSUFBSSxDQUFDLEtBQUssSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUM7V0FDMUQsQ0FBQyxPQUFPLElBQUksT0FBTyxPQUFPLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDO1FBQUUsT0FBTyxJQUFJLENBQUM7SUFDcEYsTUFBTSxXQUFXLEdBQUcsS0FBZ0MsQ0FBQztJQUNyRCxNQUFNLGFBQWEsR0FBRyxPQUFrQyxDQUFDO0lBQ3pELE1BQU0sV0FBVyxHQUFHLGFBQWEsQ0FBQyxXQUFXLENBQUM7SUFDOUMsTUFBTSxnQkFBZ0IsR0FBRyxhQUFhLENBQUMsZ0JBQWdCLENBQUM7SUFDeEQsSUFBSSxPQUFPLFdBQVcsS0FBSyxRQUFRLElBQUksQ0FBQyxXQUFXLElBQUksT0FBTyxnQkFBZ0IsS0FBSyxRQUFRO1dBQ3RGLENBQUMsZ0JBQWdCO1FBQUUsT0FBTyxJQUFJLENBQUM7SUFDcEMsTUFBTSxTQUFTLEdBQUcsV0FBVyxDQUFDLFNBQVMsQ0FBQztJQUN4QyxNQUFNLEtBQUssR0FBRyxhQUFhLENBQUMsWUFBWSxDQUFDO0lBQ3pDLE9BQU87UUFDTCxTQUFTLEVBQUUsVUFBVSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyx1QkFBdUIsRUFBRSxXQUFXO1lBQ3hFLFdBQVcsRUFBRSxnQkFBZ0IsQ0FBQyxDQUFDLENBQUM7UUFDbEMsT0FBTyxFQUFFLFdBQVc7UUFDcEIsV0FBVyxFQUFFLGdCQUFnQjtRQUM3QixLQUFLLEVBQUUsT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLFdBQVcsRUFBRSxDQUFDLENBQUMsQ0FBQyxJQUFJO1FBQ3RFLGVBQWUsRUFBRSxPQUFPLFNBQVMsS0FBSyxRQUFRLElBQUksTUFBTSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUM7WUFDMUUsQ0FBQyxDQUFDLElBQUksSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDLFdBQVcsRUFBRSxDQUFDLENBQUMsQ0FBQyxJQUFJO0tBQzdDLENBQUM7QUFDSixDQUFDLENBQUM7QUFFRjs7Ozs7O0dBTUc7QUFDSCxNQUFNLENBQUMsTUFBTSxzQkFBc0IsR0FBRyxDQUFDLEtBQThCLEVBQ00sRUFBRTtJQUMzRSxNQUFNLE1BQU0sR0FBRyxPQUFPLEtBQUssQ0FBQyxNQUFNLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUM7SUFDdEUsTUFBTSxPQUFPLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQztJQUM5QixNQUFNLGVBQWUsR0FBRyxPQUFPLE9BQU8sS0FBSyxRQUFRLElBQUksTUFBTSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUM7UUFDN0UsQ0FBQyxDQUFDLElBQUksSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDLFdBQVcsRUFBRSxDQUFDLENBQUMsQ0FBQyxpQkFBaUIsQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUNoRSxPQUFPLEVBQUUsUUFBUSxFQUFFLE1BQU0sS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsb0JBQW9CLENBQUMsTUFBTSxDQUFDLEVBQUUsZUFBZSxFQUFFLENBQUM7QUFDOUYsQ0FBQyxDQUFDO0FBRUYsdUdBQXVHO0FBQ3ZHLE1BQU0sQ0FBQyxNQUFNLGlCQUFpQixHQUFHLENBQUMsV0FBMEIsRUFBaUIsRUFBRTtJQUM3RSxJQUFJLENBQUMsV0FBVztRQUFFLE9BQU8sSUFBSSxDQUFDO0lBQzlCLElBQUksQ0FBQztRQUFDLE9BQU8sT0FBTyxDQUFDLFFBQVEsQ0FBQywyQkFBMkIsQ0FBQyxXQUFXLENBQUMsQ0FBQyxTQUFTLElBQUksSUFBSSxDQUFDO0lBQUMsQ0FBQztJQUMzRixNQUFNLENBQUM7UUFBQyxPQUFPLElBQUksQ0FBQztJQUFDLENBQUM7QUFDeEIsQ0FBQyxDQUFDO0FBRUYsOEVBQThFO0FBQzlFLE1BQU0sQ0FBQyxNQUFNLG9CQUFvQixHQUFHLENBQUMsU0FBd0IsRUFBRSxHQUFXLEVBQVcsRUFBRTtJQUNyRixJQUFJLFNBQVMsS0FBSyxJQUFJO1FBQUUsT0FBTyxLQUFLLENBQUM7SUFDckMsTUFBTSxLQUFLLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUNwQyxPQUFPLE1BQU0sQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxHQUFHLEdBQUcsQ0FBQztBQUMvQyxDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxzQkFBc0IsR0FDakMsc0dBQXNHO01BQ3BHLHlCQUF5QixDQUFDIn0=

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modelprofile.com/authswitch",
-  "version": "8.0.0",
+  "version": "8.1.0",
   "private": false,
   "description": "Manage Codex, OpenCode and Claude Code accounts with guided switching and live usage status",
   "main": "dist_ts/index.js",
@@ -18,6 +18,10 @@
       "types": "./dist_ts/authority-contract.d.ts",
       "import": "./dist_ts/authority-contract.js"
     },
+    "./authority-import-contract": {
+      "types": "./dist_ts/authority-import-contract.d.ts",
+      "import": "./dist_ts/authority-import-contract.js"
+    },
     "./authority-client": {
       "types": "./dist_ts/classes.authorityclient.d.ts",
       "import": "./dist_ts/classes.authorityclient.js"

package/readme.md

@@ -110,6 +110,9 @@ authswitch account preuse operation get <operation-id> [--json]
 authswitch account preuse operation cancel <operation-id> [--json]
 authswitch account preuse operation resume <operation-id> [--json]
 authswitch authority doctor [--json]
+authswitch authority import inventory [--json]
+authswitch authority import status [--json]
+authswitch authority import submit <source-id> --digest <source-digest> [--json]
 ```
 
 `account list --json` prints the complete, consistent credential-free authority snapshot.
@@ -164,6 +167,49 @@ If the daemon is unavailable before the first response, it fails with a fixed di
 stderr and leaves stdout empty. The older native-store commands documented below still coexist until the coordinated
 major-version migration and removal; these authority routes never use them.
 
+## The one-time account import
+
+The three `authority import` commands move the accounts that existed before the authority into it.
+
+`import inventory` reads this host and changes nothing: no authority record, no legacy file, no
+credential. It lists every Codex stash directory, saved credential record and native Codex, Claude and
+OpenCode store with the authority account it resolves to, derived from the claims the stored token already
+carries -- no provider is contacted. A malformed or unrecognised entry is reported rather than skipped, so
+an empty result is never mistaken for an empty store. The report carries no token, no token digest and no
+source path; a source is named by a hash of its location and a digest of its bytes.
+
+Each source is classified by who refreshes its login **after** the import.
+
+- **adopt** -- a copy authswitch made for itself, and AGL's own records. Nothing else refreshes such a
+  copy, so the authority takes it over outright. It is verified by one real refresh, which rotates the
+  token: from that moment the legacy copy is dead. That is the point of no return for that account, and the
+  only fallback is one device sign-in.
+- **project** -- a native Codex, Claude or OpenCode store. The vendor tool keeps refreshing its own store,
+  so the authority registers the account, leaves the grant with its native owner and holds no copy of the
+  credential. It is verified by a provider read with the access token already in the store, which rotates
+  nothing. Two refreshers on one rotating refresh token is the failure this avoids.
+
+`import submit` takes the source id and the digest the owner read in the inventory. The daemon re-reads the
+source itself and refuses if the digest changed, so approving one source can never import a different one;
+no credential crosses the socket for a source this package can read. It refuses while an authswitch watch, a
+native harness process or Codex's app-server is running, and an app-server it cannot ask counts as running.
+An adopt whose refresh fails, or whose answer is lost, is never retried: the source is quarantined, its grant
+is left needing re-authentication, and the command says so. A projection fails differently, because nothing
+rotating was ever sent for it: a native store that could not be proven live stays a pending native owner and
+is imported by submitting the same source again once its own tool has refreshed it.
+
+`import status` reads the migration ledger, the grants and the handoffs -- never the host -- and reports, per
+source, where it stands, which owner refreshes its login now, and what to do next: nothing, submit the same
+source again, or sign in to that account again. Submitting a source again is how an interrupted run resumes,
+and the answer comes from the same durable record the daemon decides on: a source whose sign-in was in
+flight when the run died is reported as needing a device sign-in, not as resumable, because a rotating
+refresh token is never sent a second time. Sources that were never submitted have no ledger row and appear
+only in the inventory.
+
+An import deletes nothing: retiring the legacy files is a separate, later step. The authority store is
+deliberately not backed up, so losing it costs one device sign-in per account -- and the remote-control
+enrollments and runtime bindings with it.
+
 `AuthSwitchClient.getUsage(accountId, loginId)` reads OpenAI managed limits or a Claude
 host login's profile and usage through the management socket. The tagged, credential-free
 reading preserves Claude's labelled five-hour, weekly and model windows, plan provenance,

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@modelprofile.com/authswitch',
-  version: '8.0.0',
+  version: '8.1.0',
   description: 'Manage Codex, OpenCode and Claude Code accounts with guided switching and live usage status'
 }