Module identity 

Provider-generic seat identity resolution.

One entry point, resolve_seat, answers “which provider account does this access token belong to?” so the login guard, the auth identify backfill and the listing all key duplicate detection on the same value:

• OpenAI Codex — read off the JWT (chatgpt_account_id claim, email from the profile claim). No network.
• Anthropic — tokens are opaque; one read-only GET to the pinned profile endpoint (super::anthropic_profile). Seat = account.uuid.
• Every other provider — no trustworthy identity is exposed; SeatResolution::Unsupported.

Nothing here reads or writes auth.json, and no variant ever carries token material. A failure is reported, never turned into a guess.

Structs

ResolvedSeat

Identity of the seat an access token belongs to. account_id is the provider’s FULL account id (the value stored as accountId and hashed by super::seat_fingerprint); identity is a display-only label such as an email. Neither is a secret.

Enums

SeatResolution

Outcome of resolve_seat.

Functions

identity_http_client

HTTP client with the policy identity lookups (and the token refresh that may precede them) require: no redirects, bounded connect/total timeouts.

resolve_seat

Resolve the seat behind access_token for provider. endpoint_override is a loopback-only test seam for the network-backed providers.

supports_seat_identity

True when resolve_seat can, in principle, return SeatResolution::Resolved for provider. Used by listings to point at slots whose identity is still unverified.