proto: land F2 — download.provideAuth (1.2.0)

The last contract gap blocking an M1 definition-of-done item: CORE's "401
handled" has no return path without it, and B2a's sibling F2 was accepted in
proto-answers-m1.md but never actually landed.

download.provideAuth {taskId, username, password, save?} -> {ok}, exactly as
proposed there. Privileged and Unix-socket-only: a credential-bearing method
must never be reachable from the browser, which is the other half of the
promise event.auth.required's own description already makes ("never back
through this event, never into a log"). It answers the challenge; it does not
itself resume the task -- the daemon retries with the credential attached and
the ordinary event.task.state reports the task leaving retry_wait, the same
as any other state change.

save only tells the daemon whether to persist the credential in the Secret
Service for next time, or use it for this attempt alone -- it never touches
SQLite or a log either way, in keeping with CLAUDE.md's secrets rule.

Three fixtures: the success path, -32010 for a task that no longer exists
(credentials submitted for it are simply discarded), and -32003 confirming
the extension has no path to this method under any transport.

mockd gets a real handler rather than falling through to the generic fixture
responder: it validates the taskId exists (so the -32010 fixture is
replayable) and actually transitions the task out of retry_wait.

Minor bump, 1.1.0 -> 1.2.0: additive method, no existing type touched.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_012fgjnqFCS5h5L7gZTZo3rV

core/generated/velox_proto.hpp

@@ -3,7 +3,7 @@
 //
 // Source:    contracts/schema/**
 // Generator: contracts/codegen/gen_cpp.py
-// Contract:  v1.1.0
+// Contract:  v1.2.0
 //
 // Hand-editing this file is a merge blocker. Fix the schema and regenerate:
 //     python3 contracts/codegen/gen_cpp.py
@@ -27,7 +27,7 @@
 // docs/adr/0009-generated-protocol-library.md.
 namespace velox::proto {
 
-inline constexpr std::string_view kProtocolVersion = "1.1.0";
+inline constexpr std::string_view kProtocolVersion = "1.2.0";
 
 /// Why a payload could not be turned into a typed value. `path` is a JSON Pointer
 /// into the offending document, so a conformance failure names the exact field.
@@ -1004,6 +1004,20 @@ struct DownloadProbeResult {
     std::optional<bool> requiresAuth{};
 };
 
+struct DownloadProvideAuthParams {
+    std::string taskId{};
+    std::string username{};
+    std::string password{};
+    /// true persists the credential in the Secret Service, keyed by host and realm, for future
+    /// downloads from the same site. false or null uses it for this task's retry only. Never
+    /// affects SQLite or the daemon's logs either way.
+    std::optional<bool> save{};
+};
+
+struct DownloadProvideAuthResult {
+    bool ok{};
+};
+
 struct DownloadRefreshUrlParams {
     std::string taskId{};
     std::string url{};
@@ -1454,6 +1468,8 @@ void to_json(nlohmann::json& j, const DownloadListResult& v);
 void to_json(nlohmann::json& j, const DownloadPauseParams& v);
 void to_json(nlohmann::json& j, const DownloadProbeParams& v);
 void to_json(nlohmann::json& j, const DownloadProbeResult& v);
+void to_json(nlohmann::json& j, const DownloadProvideAuthParams& v);
+void to_json(nlohmann::json& j, const DownloadProvideAuthResult& v);
 void to_json(nlohmann::json& j, const DownloadRefreshUrlParams& v);
 void to_json(nlohmann::json& j, const DownloadRefreshUrlResult& v);
 void to_json(nlohmann::json& j, const DownloadRemoveParams& v);
@@ -1599,6 +1615,8 @@ template <> Result<DownloadListResult> parse<DownloadListResult>(const nlohmann:
 template <> Result<DownloadPauseParams> parse<DownloadPauseParams>(const nlohmann::json& j, std::string_view path);
 template <> Result<DownloadProbeParams> parse<DownloadProbeParams>(const nlohmann::json& j, std::string_view path);
 template <> Result<DownloadProbeResult> parse<DownloadProbeResult>(const nlohmann::json& j, std::string_view path);
+template <> Result<DownloadProvideAuthParams> parse<DownloadProvideAuthParams>(const nlohmann::json& j, std::string_view path);
+template <> Result<DownloadProvideAuthResult> parse<DownloadProvideAuthResult>(const nlohmann::json& j, std::string_view path);
 template <> Result<DownloadRefreshUrlParams> parse<DownloadRefreshUrlParams>(const nlohmann::json& j, std::string_view path);
 template <> Result<DownloadRefreshUrlResult> parse<DownloadRefreshUrlResult>(const nlohmann::json& j, std::string_view path);
 template <> Result<DownloadRemoveParams> parse<DownloadRemoveParams>(const nlohmann::json& j, std::string_view path);
@@ -1686,6 +1704,7 @@ enum class Method {
     DownloadList,  // download.list
     DownloadPause,  // download.pause
     DownloadProbe,  // download.probe
+    DownloadProvideAuth,  // download.provideAuth
     DownloadRefreshUrl,  // download.refreshUrl
     DownloadRemove,  // download.remove
     DownloadResume,  // download.resume
@@ -1714,7 +1733,7 @@ enum class Method {
     SettingsSet,  // settings.set
 };
 
-inline constexpr std::size_t kMethodCount = 38;
+inline constexpr std::size_t kMethodCount = 39;
 
 std::string_view to_string(Method m) noexcept;
 std::optional<Method> method_from_string(std::string_view s) noexcept;
@@ -1819,6 +1838,16 @@ public:
     /// lands.
     virtual Result<DownloadProbeResult> on_download_probe(const DownloadProbeParams& params) = 0;
 
+    /// Answer an event.auth.required challenge. The task sits in retry_wait until this arrives; on
+    /// success the daemon retries with the credentials attached and the task resumes on its own —
+    /// this method does not itself start the transfer. Privileged and Unix-socket-only: a
+    /// credential-bearing method must never be reachable from the browser, which is exactly the
+    /// boundary event.auth.required's own description draws ('never back through this event, never
+    /// into a log') — this is the other half of that promise. Credentials are handed to the Secret
+    /// Service, never to SQLite and never logged; save only tells the daemon whether to persist
+    /// them there for next time, or use them for this attempt alone.
+    virtual Result<DownloadProvideAuthResult> on_download_provideAuth(const DownloadProvideAuthParams& params) = 0;
+
     /// IDM's 'Refresh Download Address'. Point an existing task at a freshly-issued URL when a
     /// signed link has expired, keeping every byte already on disk. The daemon re-probes and
     /// compares size and validator: if they still match, the transfer resumes from where it