@modelprofile.com/authswitch 8.0.0 → 8.2.0

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@modelprofile.com/authswitch',
-    version: '8.0.0',
+    version: '8.2.0',
     description: 'Manage Codex, OpenCode and Claude Code accounts with guided switching and live usage status'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSw4QkFBOEI7SUFDcEMsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLDZGQUE2RjtDQUMzRyxDQUFBIn0=

package/dist_ts/authority-contract.d.ts

@@ -1,6 +1,52 @@
 import type { ITypedRequest } from '@api.global/typedrequest-interfaces';
 import type { IAuthSwitchUsageSnapshot } from './classes.authorityusage.js';
 export type { IAuthSwitchUsageSnapshot } from './classes.authorityusage.js';
+/**
+ * Why the authority declined, as a closed set a client branches on without reading the text.
+ *
+ * A refusal is an answer: the daemon did the check, nothing was left half-done, and the message says what
+ * the owner does instead. Everything else stays a fault whose text the transport replaces, and a caller
+ * must never present a fault as if it said what to do next.
+ */
+export type TAuthSwitchRefusalCode = 'authority_closing' | 'not_found' | 'account_changed' | 'account_busy' | 'login_unavailable' | 'native_owner_holds_login' | 'claude_home_unregistered' | 'claude_handoff_pending' | 'claude_receipt_missing' | 'import_refusal';
+/** The marker the importer has published since 8.1.0; it keeps its own value on the wire. */
+export declare const authSwitchImportRefusalMarker = "authswitch_import_refusal";
+export declare const authSwitchRefusalReason = "authswitch_refusal";
+export type TAuthSwitchRefusalReason = typeof authSwitchRefusalReason | typeof authSwitchImportRefusalMarker;
+/** Everything a refusal puts on the wire beside its message: two literals, never a value of its own. */
+export interface IAuthSwitchRefusalData {
+    reason: TAuthSwitchRefusalReason;
+    code: TAuthSwitchRefusalCode;
+}
+/** What the owner is told when the answer is an instruction rather than a fault. */
+export interface IAuthSwitchRefusal {
+    code: TAuthSwitchRefusalCode;
+    /** The instruction, authored by the handler that declined. */
+    instruction: string;
+}
+/**
+ * One refusal, thrown by a handler and turned into a marked answer by the router that owns the wire.
+ *
+ * It accepts nothing but a code of the closed set and the text the owner is to read, and builds the marker
+ * from the code alone, so no handler can attach a value of its own to what a client branches on.
+ */
+export declare class AuthSwitchRefusal extends Error {
+    readonly code: TAuthSwitchRefusalCode;
+    constructor(code: TAuthSwitchRefusalCode, instruction: string);
+    /** Everything this refusal puts on the wire beside its message. */
+    get data(): IAuthSwitchRefusalData;
+}
+/**
+ * The refusal an error answer carries, or null when it is a fault whose text says nothing.
+ *
+ * This is the only reader of `errorData` in the package: the importer's published predicate is expressed
+ * through it, so a caller never has to know which of the two markers a route uses.
+ *
+ * 8.1.0 marked the importer's refusal with the reason alone. A per-user daemon keeps running across an
+ * upgrade until its owner restarts it, so a newer client still meets that payload, and it names the one
+ * refusal that release could answer with -- which is why it is read rather than treated as a fault.
+ */
+export declare const asAuthSwitchRefusal: (error: unknown) => IAuthSwitchRefusal | null;
 /** Credential-free account management contract. Safe to import in browser code. */
 export type TAuthSwitchLoginPurpose = 'openai_managed' | 'claude_host_native' | 'claude_container_setup' | 'opencode_native';
 export type TAuthSwitchLoginHealth = 'ready' | 'refreshing' | 'retry_wait' | 'needs_reauth' | 'unverified' | 'pending_handoff' | 'handoff_quarantined' | 'removed';
@@ -231,6 +277,14 @@ export interface IAuthSwitchPreuseOperation {
     finishedAt: string | null;
     revision: number;
 }
+/**
+ * Why the host could not prove that Claude Code uses its own native login.
+ *
+ * Each value names one condition of that proof, so an owner is told what to change: install the supported
+ * release, sign in to a subscriber plan, remove a credential override or a settings source, let the
+ * profile read succeed, or close the running session.
+ */
+export type TAuthSwitchClaudeProofFailure = 'unsupported_release' | 'override' | 'profile' | 'profile_unreadable' | 'settings' | 'subscription' | 'running_session';
 /** Credential-free native file ownership result. It makes no claim about a running session's active request. */
 export interface IAuthSwitchClaudeNativeHandoff {
     id: string;
@@ -240,6 +294,8 @@ export interface IAuthSwitchClaudeNativeHandoff {
     phase: 'reserved' | 'prepared' | 'committed' | 'aborted' | 'quarantined';
     problem: 'none' | 'native_uncertain' | 'foreign_or_torn' | 'unsupported_effective_auth' | 'database_uncertain';
     runningEffectiveAuth: 'no_scoped_sessions' | 'unsupported_effective_auth' | null;
+    /** Which condition of the native-login proof failed, when `problem` is `unsupported_effective_auth`. */
+    proofFailure?: TAuthSwitchClaudeProofFailure;
     updatedAt: string;
 }
 export interface IReq_AuthSwitchSwitchClaudeNative extends ITypedRequest {

package/dist_ts/authority-contract.js

@@ -1,3 +1,55 @@
-export {};
+/** The marker the importer has published since 8.1.0; it keeps its own value on the wire. */
+export const authSwitchImportRefusalMarker = 'authswitch_import_refusal';
+export const authSwitchRefusalReason = 'authswitch_refusal';
+const refusalCodes = new Set([
+    'authority_closing', 'not_found', 'account_changed', 'account_busy',
+    'login_unavailable', 'native_owner_holds_login', 'claude_home_unregistered',
+    'claude_handoff_pending', 'claude_receipt_missing', 'import_refusal',
+]);
+const isRefusalCode = (value) => typeof value === 'string' && refusalCodes.has(value);
+/** The importer keeps the marker it published; every other code shares the authority's own. */
+const reasonOf = (code) => code === 'import_refusal' ? authSwitchImportRefusalMarker : authSwitchRefusalReason;
+/**
+ * One refusal, thrown by a handler and turned into a marked answer by the router that owns the wire.
+ *
+ * It accepts nothing but a code of the closed set and the text the owner is to read, and builds the marker
+ * from the code alone, so no handler can attach a value of its own to what a client branches on.
+ */
+export class AuthSwitchRefusal extends Error {
+    code;
+    constructor(code, instruction) {
+        super(instruction);
+        this.code = code;
+    }
+    /** Everything this refusal puts on the wire beside its message. */
+    get data() { return { reason: reasonOf(this.code), code: this.code }; }
+}
+/**
+ * The refusal an error answer carries, or null when it is a fault whose text says nothing.
+ *
+ * This is the only reader of `errorData` in the package: the importer's published predicate is expressed
+ * through it, so a caller never has to know which of the two markers a route uses.
+ *
+ * 8.1.0 marked the importer's refusal with the reason alone. A per-user daemon keeps running across an
+ * upgrade until its owner restarts it, so a newer client still meets that payload, and it names the one
+ * refusal that release could answer with -- which is why it is read rather than treated as a fault.
+ */
+export const asAuthSwitchRefusal = (error) => {
+    if (error instanceof AuthSwitchRefusal)
+        return { code: error.code, instruction: error.message };
+    if (typeof error !== 'object' || error === null || !('errorData' in error))
+        return null;
+    const data = error.errorData;
+    if (typeof data !== 'object' || data === null || !('reason' in data))
+        return null;
+    const code = 'code' in data ? data.code : undefined;
+    const instruction = 'message' in error && typeof error.message === 'string' ? error.message : '';
+    if (data.reason === authSwitchImportRefusalMarker) {
+        return code === undefined || code === 'import_refusal' ? { code: 'import_refusal', instruction } : null;
+    }
+    if (data.reason !== authSwitchRefusalReason || !isRefusalCode(code))
+        return null;
+    return { code, instruction };
+};
 /** Runtime capability is returned only to trusted backend callers; do not expose this response in a browser API. */
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aG9yaXR5LWNvbnRyYWN0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvYXV0aG9yaXR5LWNvbnRyYWN0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7QUF5V0Esb0hBQW9IIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aG9yaXR5LWNvbnRyYWN0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvYXV0aG9yaXR5LWNvbnRyYWN0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQXVCQSw2RkFBNkY7QUFDN0YsTUFBTSxDQUFDLE1BQU0sNkJBQTZCLEdBQUcsMkJBQTJCLENBQUM7QUFDekUsTUFBTSxDQUFDLE1BQU0sdUJBQXVCLEdBQUcsb0JBQW9CLENBQUM7QUFpQjVELE1BQU0sWUFBWSxHQUF3QixJQUFJLEdBQUcsQ0FBeUI7SUFDeEUsbUJBQW1CLEVBQUUsV0FBVyxFQUFFLGlCQUFpQixFQUFFLGNBQWM7SUFDbkUsbUJBQW1CLEVBQUUsMEJBQTBCLEVBQUUsMEJBQTBCO0lBQzNFLHdCQUF3QixFQUFFLHdCQUF3QixFQUFFLGdCQUFnQjtDQUNyRSxDQUFDLENBQUM7QUFFSCxNQUFNLGFBQWEsR0FBRyxDQUFDLEtBQWMsRUFBbUMsRUFBRSxDQUN4RSxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksWUFBWSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsQ0FBQztBQUV2RCwrRkFBK0Y7QUFDL0YsTUFBTSxRQUFRLEdBQUcsQ0FBQyxJQUE0QixFQUE0QixFQUFFLENBQzFFLElBQUksS0FBSyxnQkFBZ0IsQ0FBQyxDQUFDLENBQUMsNkJBQTZCLENBQUMsQ0FBQyxDQUFDLHVCQUF1QixDQUFDO0FBRXRGOzs7OztHQUtHO0FBQ0gsTUFBTSxPQUFPLGlCQUFrQixTQUFRLEtBQUs7SUFDMUIsSUFBSSxDQUF5QjtJQUU3QyxZQUFZLElBQTRCLEVBQUUsV0FBbUI7UUFDM0QsS0FBSyxDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQ25CLElBQUksQ0FBQyxJQUFJLEdBQUcsSUFBSSxDQUFDO0lBQ25CLENBQUM7SUFFRCxtRUFBbUU7SUFDbkUsSUFBVyxJQUFJLEtBQTZCLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQztDQUN2RztBQUVEOzs7Ozs7Ozs7R0FTRztBQUNILE1BQU0sQ0FBQyxNQUFNLG1CQUFtQixHQUFHLENBQUMsS0FBYyxFQUE2QixFQUFFO0lBQy9FLElBQUksS0FBSyxZQUFZLGlCQUFpQjtRQUFFLE9BQU8sRUFBRSxJQUFJLEVBQUUsS0FBSyxDQUFDLElBQUksRUFBRSxXQUFXLEVBQUUsS0FBSyxDQUFDLE9BQU8sRUFBRSxDQUFDO0lBQ2hHLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLEtBQUssS0FBSyxJQUFJLElBQUksQ0FBQyxDQUFDLFdBQVcsSUFBSSxLQUFLLENBQUM7UUFBRSxPQUFPLElBQUksQ0FBQztJQUN4RixNQUFNLElBQUksR0FBWSxLQUFLLENBQUMsU0FBUyxDQUFDO0lBQ3RDLElBQUksT0FBTyxJQUFJLEtBQUssUUFBUSxJQUFJLElBQUksS0FBSyxJQUFJLElBQUksQ0FBQyxDQUFDLFFBQVEsSUFBSSxJQUFJLENBQUM7UUFBRSxPQUFPLElBQUksQ0FBQztJQUNsRixNQUFNLElBQUksR0FBWSxNQUFNLElBQUksSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7SUFDN0QsTUFBTSxXQUFXLEdBQUcsU0FBUyxJQUFJLEtBQUssSUFBSSxPQUFPLEtBQUssQ0FBQyxPQUFPLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7SUFDakcsSUFBSSxJQUFJLENBQUMsTUFBTSxLQUFLLDZCQUE2QixFQUFFLENBQUM7UUFDbEQsT0FBTyxJQUFJLEtBQUssU0FBUyxJQUFJLElBQUksS0FBSyxnQkFBZ0IsQ0FBQyxDQUFDLENBQUMsRUFBRSxJQUFJLEVBQUUsZ0JBQWdCLEVBQUUsV0FBVyxFQUFFLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQztJQUMxRyxDQUFDO0lBQ0QsSUFBSSxJQUFJLENBQUMsTUFBTSxLQUFLLHVCQUF1QixJQUFJLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQztRQUFFLE9BQU8sSUFBSSxDQUFDO0lBQ2pGLE9BQU8sRUFBRSxJQUFJLEVBQUUsV0FBVyxFQUFFLENBQUM7QUFDL0IsQ0FBQyxDQUFDO0FBb1hGLG9IQUFvSCJ9

package/dist_ts/authority-import-contract.d.ts

@@ -0,0 +1,211 @@
+import type { ITypedRequest } from '@api.global/typedrequest-interfaces';
+/**
+ * The one-time account import: reading the legacy stores that existed before the authority, and the
+ * credential-free report an owner reads before anything is imported.
+ *
+ * Importing a refresh token is a transfer of ownership, not a copy. The provider rotates a refresh token on
+ * use, so the moment one holder refreshes, every other copy of that token is dead. This contract therefore
+ * separates the classes of legacy source by who refreshes them after the import, and names the proof each
+ * class can offer without rotating anything.
+ */
+/** Mirrors the migration ledger's source kinds, which are the only sources a ledger row can describe. */
+export type TAuthSwitchImportSourceKind = 'authswitch_stash' | 'authswitch_backup' | 'agl_flex' | 'codex_native' | 'opencode_native' | 'claude_native';
+/**
+ * The ledger statuses a source can already hold when an inventory runs.
+ *
+ * - `prepared`: the source is named in the authority and nothing has been sent for it yet.
+ * - `pending_native_owner`: the account is registered and its native tool keeps the refresher, but the
+ *   store could not be proven live. Nothing rotating was ever sent, so it is proven by submitting the
+ *   source again once that tool has refreshed its own store.
+ * - `verified` and `complete`: the import settled; `complete` is the tombstone for that source.
+ * - `quarantined`: a rotating refresh may already have been consumed for this source, so it is never
+ *   submitted again and its account is repaired by a device sign-in.
+ */
+export type TAuthSwitchImportLedgerStatus = 'pending_native_owner' | 'prepared' | 'verified' | 'complete' | 'quarantined';
+/**
+ * What the ownership rule allows for a source.
+ *
+ * - `import`: the authority becomes the single refresher. Nothing else owns this copy, so taking it over
+ *   strands no other holder.
+ * - `project`: a native tool keeps refreshing its own store; the authority registers the account and holds
+ *   the grant as a projection it must never refresh. Two refreshers on one refresh token is the failure this
+ *   avoids.
+ * - `refuse`: the source cannot become an authority grant at all, and the owner signs in again instead.
+ */
+export type TAuthSwitchImportTreatment = 'import' | 'project' | 'refuse';
+/**
+ * What can make this source's ledger row `verified`.
+ *
+ * - `rotating_refresh`: one real refresh through the authority. It proves the refresh token was live and
+ *   makes the authority its holder in the same step -- and it is the point of no return, because the legacy
+ *   copy is stale from that moment.
+ * - `access_token_read`: a provider read with the stored access token alone, matched against the identity
+ *   derived locally from the same source bytes. It rotates nothing, so a native refresher keeps its grant.
+ *   It is available only while that access token is still valid.
+ * - `none`: no proof exists for this source; it cannot be verified and cannot be imported.
+ */
+export type TAuthSwitchImportProof = 'rotating_refresh' | 'access_token_read' | 'none';
+/**
+ * One legacy source as the inventory found it. Credential-free by construction: identity claims and a digest
+ * of the source bytes, never a token, a token digest, or the source path.
+ */
+export interface IAuthSwitchImportSource {
+    /** The migration ledger row this source would use. Derived from its kind and path, so it is stable. */
+    id: string;
+    sourceKind: TAuthSwitchImportSourceKind;
+    /** The source location as a hash. The ledger never stores a path and this DTO never exposes one. */
+    sourcePathHash: string;
+    /** Binds a later import to exactly these bytes. Changes whenever the source changes. */
+    sourceDigest: string;
+    treatment: TAuthSwitchImportTreatment;
+    proof: TAuthSwitchImportProof;
+    /** The authority account this source resolves to, derived locally from its identity claims. */
+    accountId: string | null;
+    providerId: string | null;
+    email: string | null;
+    plan: string | null;
+    label: string | null;
+    /** Expiry claim of the stored access token. It decides whether a non-rotating proof is available now. */
+    accessExpiresAt: string | null;
+    /** Remote-control enrollments carried by this source; `null` when they could not be counted. */
+    enrollmentCount: number | null;
+    /** The ledger row for this source, when one already exists. */
+    ledgerStatus: TAuthSwitchImportLedgerStatus | null;
+    /** Why this source cannot be submitted as it stands. An empty list means it can. */
+    problems: string[];
+}
+/** The complete credential-free report. `notice` is what the owner must know before importing anything. */
+export interface IAuthSwitchImportInventory {
+    generatedAt: string;
+    /** Identifies the credential locations this inventory read, as `authSwitchEnvironmentId` computes them. */
+    environmentId: string;
+    notice: string[];
+    sources: IAuthSwitchImportSource[];
+    /** Locations that could not be read at all, so an empty result never looks like an empty store. */
+    problems: string[];
+}
+/** Management-only. Reads legacy stores and the ledger; changes nothing, and carries no credential. */
+export interface IReq_AuthSwitchImportInventory extends ITypedRequest {
+    method: 'authswitch.authority.import.inventory';
+    request: Record<string, never>;
+    response: {
+        inventory: IAuthSwitchImportInventory;
+    };
+}
+/** A ChatGPT login held by a store outside this package, submitted by the backend that owns its format. */
+export interface IAuthSwitchImportOpenAiCredential {
+    providerId: 'openai';
+    accessToken: string;
+    refreshToken: string;
+    idToken: string;
+}
+/**
+ * What is being imported.
+ *
+ * A source this daemon can read itself is named only by its id: the daemon re-runs its readers, resolves the
+ * location from the hash and re-checks the digest, so no credential crosses the socket and no caller can
+ * substitute bytes the owner never approved. Only a store this package cannot read -- AGL's sealed Flex
+ * records -- submits material, and that is the whole reason submit lives on the backend-only runtime socket.
+ */
+export type TAuthSwitchImportSubmission = {
+    kind: 'local';
+    sourceId: string;
+    sourceDigest: string;
+} | {
+    kind: 'external';
+    sourceKind: 'agl_flex';
+    sourcePathHash: string;
+    sourceDigest: string;
+    credential: IAuthSwitchImportOpenAiCredential;
+};
+/** The outcome of one source. `quarantined` always names what to do instead, never a silent failure. */
+export interface IAuthSwitchImportResult {
+    sourceId: string;
+    sourceKind: TAuthSwitchImportSourceKind;
+    treatment: TAuthSwitchImportTreatment;
+    status: TAuthSwitchImportLedgerStatus;
+    accountId: string | null;
+    loginId: string | null;
+    problems: string[];
+}
+/**
+ * What the owner does next with one source.
+ *
+ * - `none`: the import settled; nothing is outstanding.
+ * - `resume`: submit the same source again. Nothing rotating has been sent for this source, so a second
+ *   attempt is safe: an interrupted adopt continues from its durable record, and a native store that could
+ *   not be proven live is proven the moment its own tool has refreshed it.
+ * - `device_login`: this source is finished as a source. Its account needs a fresh device sign-in, because a
+ *   rotating refresh token whose outcome is unknown is never sent a second time.
+ */
+export type TAuthSwitchImportAction = 'none' | 'resume' | 'device_login';
+/**
+ * Marks an error answer whose text is an instruction for the owner, not a report of a fault.
+ *
+ * The daemon sets it on the refusals the importer authors and on nothing else: a refusal any other route
+ * authors carries the authority's own marker, and a failure neither of them decided answers with the
+ * transport's sanitised text, which a caller must never present as if it said what to do next. For a
+ * submit in particular, an unmarked failure means the outcome is unknown and the source must be read with
+ * `authswitch.authority.import.status` rather than submitted again.
+ *
+ * It is one code of the authority's refusal contract (`./authority-contract`), which every route now uses;
+ * this marker keeps its own value on the wire so a consumer written against 8.1.0 keeps working.
+ */
+export declare const authSwitchImportRefusalReason = "authswitch_import_refusal";
+/** True when the daemon answered with an importer refusal, so `error.message` is the instruction to show. */
+export declare const isAuthSwitchImportRefusal: (error: unknown) => boolean;
+/**
+ * Where one source stands, read from the migration ledger, the grant it produced and its handoff.
+ *
+ * Only sources the authority has been told about appear here. A source that was never submitted has no
+ * ledger row; `authority import inventory` is the read that looks at the host and lists those.
+ */
+export interface IAuthSwitchImportStatusEntry {
+    sourceId: string;
+    sourceKind: TAuthSwitchImportSourceKind;
+    status: TAuthSwitchImportLedgerStatus;
+    accountId: string | null;
+    loginId: string | null;
+    /**
+     * Who refreshes that login now, or `null` when the ledger row names no grant yet. `none` is the absence of
+     * a refresher: the grant needs a device sign-in before anything can use it again.
+     */
+    owner: 'daemon' | 'claude_native' | 'legacy_native' | 'none' | null;
+    action: TAuthSwitchImportAction;
+    statusObservedAt: string;
+}
+export interface IAuthSwitchImportStatus {
+    generatedAt: string;
+    entries: IAuthSwitchImportStatusEntry[];
+    nextCursor: string | null;
+}
+/** Management-only. Reads durable records only; it opens no legacy store and carries no credential. */
+export interface IReq_AuthSwitchImportStatus extends ITypedRequest {
+    method: 'authswitch.authority.import.status';
+    request: {
+        after?: string;
+        limit?: number;
+    };
+    response: {
+        status: IAuthSwitchImportStatus;
+    };
+}
+/**
+ * Backend-only. One source, one ownership decision.
+ *
+ * Both flags are required and both must be `true`. `callerQuiescent` is the caller's own assertion, because
+ * this daemon can observe a watch, a native process and Codex's app-server but cannot observe a host that
+ * uses the legacy library in its own process. `acknowledgeRunOrder` is the owner's acknowledgement that an
+ * imported source's legacy copy is dead and that the everyday commands must already run on the authority.
+ */
+export interface IReq_AuthSwitchImportSubmit extends ITypedRequest {
+    method: 'authswitch.authority.import.submit';
+    request: {
+        submission: TAuthSwitchImportSubmission;
+        callerQuiescent: true;
+        acknowledgeRunOrder: true;
+    };
+    response: {
+        result: IAuthSwitchImportResult;
+    };
+}

package/dist_ts/authority-import-contract.js

@@ -0,0 +1,17 @@
+import { asAuthSwitchRefusal, authSwitchImportRefusalMarker } from './authority-contract.js';
+/**
+ * Marks an error answer whose text is an instruction for the owner, not a report of a fault.
+ *
+ * The daemon sets it on the refusals the importer authors and on nothing else: a refusal any other route
+ * authors carries the authority's own marker, and a failure neither of them decided answers with the
+ * transport's sanitised text, which a caller must never present as if it said what to do next. For a
+ * submit in particular, an unmarked failure means the outcome is unknown and the source must be read with
+ * `authswitch.authority.import.status` rather than submitted again.
+ *
+ * It is one code of the authority's refusal contract (`./authority-contract`), which every route now uses;
+ * this marker keeps its own value on the wire so a consumer written against 8.1.0 keeps working.
+ */
+export const authSwitchImportRefusalReason = authSwitchImportRefusalMarker;
+/** True when the daemon answered with an importer refusal, so `error.message` is the instruction to show. */
+export const isAuthSwitchImportRefusal = (error) => asAuthSwitchRefusal(error)?.code === 'import_refusal';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aG9yaXR5LWltcG9ydC1jb250cmFjdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL2F1dGhvcml0eS1pbXBvcnQtY29udHJhY3QudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQ0EsT0FBTyxFQUFFLG1CQUFtQixFQUFFLDZCQUE2QixFQUFFLE1BQU0seUJBQXlCLENBQUM7QUFtSjdGOzs7Ozs7Ozs7OztHQVdHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sNkJBQTZCLEdBQUcsNkJBQTZCLENBQUM7QUFFM0UsNkdBQTZHO0FBQzdHLE1BQU0sQ0FBQyxNQUFNLHlCQUF5QixHQUFHLENBQUMsS0FBYyxFQUFXLEVBQUUsQ0FDbkUsbUJBQW1CLENBQUMsS0FBSyxDQUFDLEVBQUUsSUFBSSxLQUFLLGdCQUFnQixDQUFDIn0=