@modelprofile.com/authswitch 2.1.2

package/dist_ts/classes.opencodeharness.js

@@ -0,0 +1,125 @@
+import * as plugins from './plugins.js';
+import { FileHarness } from './classes.fileharness.js';
+import { CredentialStore, credentialHash, credentialRecord, credentialText, readCredentialDocument, requireHarnessStopped } from './classes.credentialstore.js';
+import { CodexAccountStatus } from './classes.codexstatus.js';
+import { writeSecretFileAtomically } from './helpers.js';
+import { beginSavedOpenAiLogin, openCodeCredentialFromLogin } from './classes.login.js';
+import { plainText } from './formatting.js';
+/** OpenCode owns one login per provider. Replacing a slot never replaces the whole provider set. */
+export class OpenCodeHarness extends FileHarness {
+    id = 'opencode';
+    label = 'OpenCode';
+    loginHint = 'Use authswitch opencode login for OpenAI; use opencode auth login for other providers.';
+    loginProviders = [{ providerId: 'openai', label: 'OpenAI', flows: ['device'] }];
+    store;
+    file;
+    env;
+    status;
+    checkStopped;
+    fetcher;
+    constructor(options = {}) {
+        super();
+        this.env = options.env ?? process.env;
+        this.file = plugins.path.join(options.dataHome ?? (this.env.XDG_DATA_HOME || plugins.path.join(plugins.os.homedir(), '.local', 'share')), 'opencode', 'auth.json');
+        this.store = new CredentialStore(this.id, options.stashRoot);
+        this.status = new CodexAccountStatus(options.fetch);
+        this.fetcher = options.fetch;
+        this.checkStopped = options.checkStopped ?? (() => requireHarnessStopped('opencode'));
+    }
+    beforeMutation() { this.checkStopped(); }
+    /** Public identity only, for reconciling a host's OpenAI association after native refresh/restart. */
+    activeOpenAiAccountId() {
+        const account = this.snapshot().accounts.find(item => item.slotId === 'openai');
+        return account ? this.openAiInfo(account.credential).accountId : undefined;
+    }
+    beginLogin(options = { providerId: 'openai', flow: 'device' }) {
+        return beginSavedOpenAiLogin(result => {
+            const saved = this.importCredential('openai', openCodeCredentialFromLogin(result.credential));
+            const account = this.readState().accounts.find(account => account.id === saved.accountId);
+            return { outcome: { lines: [`Saved OpenAI login for ${plainText(account.label)}. Select it to switch OpenCode.`], problems: [] }, account: { id: account.id, label: account.label, slotId: account.slotId } };
+        }, options, this.fetcher);
+    }
+    openAiInfo(entry) {
+        if (entry.type !== 'oauth')
+            return {};
+        let claims;
+        try {
+            claims = plugins.flexAuth.parseOpenAiChatGptTokenInfo(credentialText(entry.access));
+        }
+        catch { /* Opaque tokens can still be preserved. */ }
+        const accountId = credentialText(entry.accountId) ?? claims?.chatgptAccountId;
+        if (entry.accountId && claims?.chatgptAccountId && entry.accountId !== claims.chatgptAccountId)
+            throw new Error('OpenCode OpenAI account ID does not match the credential.');
+        return { accountId, email: claims?.email?.toLowerCase(), plan: claims?.chatgptPlanType };
+    }
+    inspect(credential, slotId) {
+        if (!slotId || slotId.length > 256)
+            throw new Error('Unsupported OpenCode provider ID.');
+        const type = credential.type;
+        let secret;
+        if (type === 'oauth') {
+            if (!credentialText(credential.access) || !credentialText(credential.refresh) || typeof credential.expires !== 'number' || !Number.isFinite(credential.expires))
+                throw new Error('Unsupported OpenCode OAuth credential.');
+            secret = credentialText(credential.refresh);
+        }
+        else if (type === 'api')
+            secret = credentialText(credential.key);
+        else if (type === 'wellknown' && credentialText(credential.key))
+            secret = credentialText(credential.token);
+        if (!secret)
+            throw new Error('Unsupported OpenCode credential; the provider entry was preserved.');
+        const info = slotId === 'openai' ? this.openAiInfo(credential) : {};
+        const fingerprint = credentialHash(secret);
+        const identity = info.accountId ? `oauth:${info.accountId}` : `${type}:${fingerprint}`;
+        const label = info.email ?? (info.accountId ? `openai:${info.accountId}` : `${slotId} ${type === 'api' ? 'API key' : type} ${fingerprint.slice(0, 12)}`);
+        return { slotId, identity, label, credential };
+    }
+    snapshot() {
+        if (this.env.OPENCODE_AUTH_CONTENT !== undefined)
+            return { accounts: [], unavailable: 'OPENCODE_AUTH_CONTENT overrides the credential file. Unset it before managing file logins.' };
+        const data = readCredentialDocument(this.file).data;
+        const accounts = [];
+        const unsupported = [];
+        for (const [provider, value] of Object.entries(data)) {
+            try {
+                accounts.push(this.inspect(credentialRecord(value), provider));
+            }
+            catch {
+                unsupported.push(provider);
+            }
+        }
+        return { accounts, unavailable: unsupported.length ? 'OpenCode contains unsupported credential entries. Resolve them with opencode auth before modifying logins.' : null };
+    }
+    apply(slotId, previous, target) {
+        const snapshot = readCredentialDocument(this.file);
+        if (JSON.stringify(snapshot.data[slotId]) !== JSON.stringify(previous?.credential))
+            throw new Error('OpenCode login changed during the operation; no credential was replaced.');
+        const next = { ...snapshot.data };
+        if (target)
+            Object.defineProperty(next, slotId, { value: target.credential, enumerable: true, configurable: true, writable: true });
+        else
+            delete next[slotId];
+        const raw = JSON.stringify(next, null, 2) + '\n';
+        if (readCredentialDocument(this.file).raw !== snapshot.raw)
+            throw new Error('OpenCode credential file changed during the operation. Try again after OpenCode exits.');
+        plugins.fs.mkdirSync(plugins.path.dirname(this.file), { recursive: true, mode: 0o700 });
+        writeSecretFileAtomically(this.file, raw);
+        if (readCredentialDocument(this.file).raw !== raw)
+            throw new Error('Active login verification failed. The outgoing login remains saved.');
+    }
+    async readAccountStatus(id) {
+        const account = this.readCredential(id);
+        if (account.slotId === 'openai' && account.credential.type === 'oauth') {
+            const info = this.openAiInfo(account.credential);
+            if (!info.accountId)
+                return { facts: [], problems: ['The OpenAI login has no account ID for a status lookup.'] };
+            return this.status.readCredential(credentialText(account.credential.access), info.accountId, info.plan);
+        }
+        return { facts: [
+                { section: 'Authentication', label: 'Provider', value: account.slotId },
+                { section: 'Authentication', label: 'Login type', value: String(account.credential.type) },
+                { section: 'Availability', label: 'Account usage and billing', value: 'This provider login does not expose a supported subscription or quota API.' },
+            ], problems: [] };
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5vcGVuY29kZWhhcm5lc3MuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9jbGFzc2VzLm9wZW5jb2RlaGFybmVzcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQUN4QyxPQUFPLEVBQUUsV0FBVyxFQUFnRCxNQUFNLDBCQUEwQixDQUFDO0FBQ3JHLE9BQU8sRUFBRSxlQUFlLEVBQUUsY0FBYyxFQUFFLGdCQUFnQixFQUFFLGNBQWMsRUFBRSxzQkFBc0IsRUFBRSxxQkFBcUIsRUFBRSxNQUFNLDhCQUE4QixDQUFDO0FBQ2hLLE9BQU8sRUFBRSxrQkFBa0IsRUFBRSxNQUFNLDBCQUEwQixDQUFDO0FBQzlELE9BQU8sRUFBRSx5QkFBeUIsRUFBRSxNQUFNLGNBQWMsQ0FBQztBQUV6RCxPQUFPLEVBQUUscUJBQXFCLEVBQUUsMkJBQTJCLEVBQUUsTUFBTSxvQkFBb0IsQ0FBQztBQUN4RixPQUFPLEVBQUUsU0FBUyxFQUFFLE1BQU0saUJBQWlCLENBQUM7QUFXNUMsb0dBQW9HO0FBQ3BHLE1BQU0sT0FBTyxlQUFnQixTQUFRLFdBQVc7SUFDOUIsRUFBRSxHQUFHLFVBQVUsQ0FBQztJQUNoQixLQUFLLEdBQUcsVUFBVSxDQUFDO0lBQ25CLFNBQVMsR0FBRyx3RkFBd0YsQ0FBQztJQUNyRyxjQUFjLEdBQTRCLENBQUMsRUFBRSxVQUFVLEVBQUUsUUFBUSxFQUFFLEtBQUssRUFBRSxRQUFRLEVBQUUsS0FBSyxFQUFFLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQ3RHLEtBQUssQ0FBa0I7SUFDekIsSUFBSSxDQUFTO0lBQ2IsR0FBRyxDQUFvQjtJQUN2QixNQUFNLENBQXFCO0lBQzNCLFlBQVksQ0FBYTtJQUN6QixPQUFPLENBQWdCO0lBRXhDLFlBQVksVUFBbUMsRUFBRTtRQUMvQyxLQUFLLEVBQUUsQ0FBQztRQUNSLElBQUksQ0FBQyxHQUFHLEdBQUcsT0FBTyxDQUFDLEdBQUcsSUFBSSxPQUFPLENBQUMsR0FBRyxDQUFDO1FBQ3RDLElBQUksQ0FBQyxJQUFJLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLFFBQVEsSUFBSSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsYUFBYSxJQUFJLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsT0FBTyxFQUFFLEVBQUUsUUFBUSxFQUFFLE9BQU8sQ0FBQyxDQUFDLEVBQUUsVUFBVSxFQUFFLFdBQVcsQ0FBQyxDQUFDO1FBQ25LLElBQUksQ0FBQyxLQUFLLEdBQUcsSUFBSSxlQUFlLENBQUMsSUFBSSxDQUFDLEVBQUUsRUFBRSxPQUFPLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDN0QsSUFBSSxDQUFDLE1BQU0sR0FBRyxJQUFJLGtCQUFrQixDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUNwRCxJQUFJLENBQUMsT0FBTyxHQUFHLE9BQU8sQ0FBQyxLQUFLLENBQUM7UUFDN0IsSUFBSSxDQUFDLFlBQVksR0FBRyxPQUFPLENBQUMsWUFBWSxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUMscUJBQXFCLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQztJQUN4RixDQUFDO0lBQ1MsY0FBYyxLQUFXLElBQUksQ0FBQyxZQUFZLEVBQUUsQ0FBQyxDQUFDLENBQUM7SUFDekQsc0dBQXNHO0lBQy9GLHFCQUFxQjtRQUMxQixNQUFNLE9BQU8sR0FBRyxJQUFJLENBQUMsUUFBUSxFQUFFLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxNQUFNLEtBQUssUUFBUSxDQUFDLENBQUM7UUFDaEYsT0FBTyxPQUFPLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO0lBQzdFLENBQUM7SUFDTSxVQUFVLENBQUMsVUFBZ0MsRUFBRSxVQUFVLEVBQUUsUUFBUSxFQUFFLElBQUksRUFBRSxRQUFRLEVBQUU7UUFDeEYsT0FBTyxxQkFBcUIsQ0FBQyxNQUFNLENBQUMsRUFBRTtZQUNwQyxNQUFNLEtBQUssR0FBRyxJQUFJLENBQUMsZ0JBQWdCLENBQUMsUUFBUSxFQUFFLDJCQUEyQixDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDO1lBQzlGLE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxTQUFTLEVBQUUsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsT0FBTyxDQUFDLEVBQUUsS0FBSyxLQUFLLENBQUMsU0FBUyxDQUFFLENBQUM7WUFDM0YsT0FBTyxFQUFFLE9BQU8sRUFBRSxFQUFFLEtBQUssRUFBRSxDQUFDLDBCQUEwQixTQUFTLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxpQ0FBaUMsQ0FBQyxFQUFFLFFBQVEsRUFBRSxFQUFFLEVBQUUsRUFBRSxPQUFPLEVBQUUsRUFBRSxFQUFFLEVBQUUsT0FBTyxDQUFDLEVBQUUsRUFBRSxLQUFLLEVBQUUsT0FBTyxDQUFDLEtBQUssRUFBRSxNQUFNLEVBQUUsT0FBTyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUM7UUFDaE4sQ0FBQyxFQUFFLE9BQU8sRUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUM7SUFDNUIsQ0FBQztJQUNPLFVBQVUsQ0FBQyxLQUE4QjtRQUMvQyxJQUFJLEtBQUssQ0FBQyxJQUFJLEtBQUssT0FBTztZQUFFLE9BQU8sRUFBRSxDQUFDO1FBQ3RDLElBQUksTUFBNEQsQ0FBQztRQUNqRSxJQUFJLENBQUM7WUFBQyxNQUFNLEdBQUcsT0FBTyxDQUFDLFFBQVEsQ0FBQywyQkFBMkIsQ0FBQyxjQUFjLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBRSxDQUFDLENBQUM7UUFBQyxDQUFDO1FBQUMsTUFBTSxDQUFDLENBQUMsMkNBQTJDLENBQUMsQ0FBQztRQUNuSixNQUFNLFNBQVMsR0FBRyxjQUFjLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxJQUFJLE1BQU0sRUFBRSxnQkFBZ0IsQ0FBQztRQUM5RSxJQUFJLEtBQUssQ0FBQyxTQUFTLElBQUksTUFBTSxFQUFFLGdCQUFnQixJQUFJLEtBQUssQ0FBQyxTQUFTLEtBQUssTUFBTSxDQUFDLGdCQUFnQjtZQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsMkRBQTJELENBQUMsQ0FBQztRQUM3SyxPQUFPLEVBQUUsU0FBUyxFQUFFLEtBQUssRUFBRSxNQUFNLEVBQUUsS0FBSyxFQUFFLFdBQVcsRUFBRSxFQUFFLElBQUksRUFBRSxNQUFNLEVBQUUsZUFBZSxFQUFFLENBQUM7SUFDM0YsQ0FBQztJQUNTLE9BQU8sQ0FBQyxVQUFtQyxFQUFFLE1BQWM7UUFDbkUsSUFBSSxDQUFDLE1BQU0sSUFBSSxNQUFNLENBQUMsTUFBTSxHQUFHLEdBQUc7WUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLG1DQUFtQyxDQUFDLENBQUM7UUFDekYsTUFBTSxJQUFJLEdBQUcsVUFBVSxDQUFDLElBQUksQ0FBQztRQUM3QixJQUFJLE1BQTBCLENBQUM7UUFDL0IsSUFBSSxJQUFJLEtBQUssT0FBTyxFQUFFLENBQUM7WUFDckIsSUFBSSxDQUFDLGNBQWMsQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxjQUFjLENBQUMsVUFBVSxDQUFDLE9BQU8sQ0FBQyxJQUFJLE9BQU8sVUFBVSxDQUFDLE9BQU8sS0FBSyxRQUFRLElBQUksQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxPQUFPLENBQUM7Z0JBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyx3Q0FBd0MsQ0FBQyxDQUFDO1lBQzNOLE1BQU0sR0FBRyxjQUFjLENBQUMsVUFBVSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQzlDLENBQUM7YUFBTSxJQUFJLElBQUksS0FBSyxLQUFLO1lBQUUsTUFBTSxHQUFHLGNBQWMsQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLENBQUM7YUFDOUQsSUFBSSxJQUFJLEtBQUssV0FBVyxJQUFJLGNBQWMsQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDO1lBQUUsTUFBTSxHQUFHLGNBQWMsQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDM0csSUFBSSxDQUFDLE1BQU07WUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLG9FQUFvRSxDQUFDLENBQUM7UUFDbkcsTUFBTSxJQUFJLEdBQUcsTUFBTSxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQ3BFLE1BQU0sV0FBVyxHQUFHLGNBQWMsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUMzQyxNQUFNLFFBQVEsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxTQUFTLElBQUksQ0FBQyxTQUFTLEVBQUUsQ0FBQyxDQUFDLENBQUMsR0FBRyxJQUFJLElBQUksV0FBVyxFQUFFLENBQUM7UUFDdkYsTUFBTSxLQUFLLEdBQUcsSUFBSSxDQUFDLEtBQUssSUFBSSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLFVBQVUsSUFBSSxDQUFDLFNBQVMsRUFBRSxDQUFDLENBQUMsQ0FBQyxHQUFHLE1BQU0sSUFBSSxJQUFJLEtBQUssS0FBSyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLElBQUksSUFBSSxXQUFXLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDekosT0FBTyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRSxDQUFDO0lBQ2pELENBQUM7SUFDUyxRQUFRO1FBQ2hCLElBQUksSUFBSSxDQUFDLEdBQUcsQ0FBQyxxQkFBcUIsS0FBSyxTQUFTO1lBQUUsT0FBTyxFQUFFLFFBQVEsRUFBRSxFQUFFLEVBQUUsV0FBVyxFQUFFLDRGQUE0RixFQUFFLENBQUM7UUFDckwsTUFBTSxJQUFJLEdBQUcsc0JBQXNCLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDLElBQUksQ0FBQztRQUNwRCxNQUFNLFFBQVEsR0FBbUIsRUFBRSxDQUFDO1FBQ3BDLE1BQU0sV0FBVyxHQUFhLEVBQUUsQ0FBQztRQUNqQyxLQUFLLE1BQU0sQ0FBQyxRQUFRLEVBQUUsS0FBSyxDQUFDLElBQUksTUFBTSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO1lBQ3JELElBQUksQ0FBQztnQkFBQyxRQUFRLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsZ0JBQWdCLENBQUMsS0FBSyxDQUFDLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztZQUFDLENBQUM7WUFDdkUsTUFBTSxDQUFDO2dCQUFDLFdBQVcsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7WUFBQyxDQUFDO1FBQ3ZDLENBQUM7UUFDRCxPQUFPLEVBQUUsUUFBUSxFQUFFLFdBQVcsRUFBRSxXQUFXLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyw0R0FBNEcsQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDN0ssQ0FBQztJQUNTLEtBQUssQ0FBQyxNQUFjLEVBQUUsUUFBa0MsRUFBRSxNQUFnQztRQUNsRyxNQUFNLFFBQVEsR0FBRyxzQkFBc0IsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDbkQsSUFBSSxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUMsS0FBSyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsRUFBRSxVQUFVLENBQUM7WUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLDBFQUEwRSxDQUFDLENBQUM7UUFDaEwsTUFBTSxJQUFJLEdBQUcsRUFBRSxHQUFHLFFBQVEsQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUNsQyxJQUFJLE1BQU07WUFBRSxNQUFNLENBQUMsY0FBYyxDQUFDLElBQUksRUFBRSxNQUFNLEVBQUUsRUFBRSxLQUFLLEVBQUUsTUFBTSxDQUFDLFVBQVUsRUFBRSxVQUFVLEVBQUUsSUFBSSxFQUFFLFlBQVksRUFBRSxJQUFJLEVBQUUsUUFBUSxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7O1lBQy9ILE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQ3pCLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsSUFBSSxFQUFFLElBQUksRUFBRSxDQUFDLENBQUMsR0FBRyxJQUFJLENBQUM7UUFDakQsSUFBSSxzQkFBc0IsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsR0FBRyxLQUFLLFFBQVEsQ0FBQyxHQUFHO1lBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyx3RkFBd0YsQ0FBQyxDQUFDO1FBQ3RLLE9BQU8sQ0FBQyxFQUFFLENBQUMsU0FBUyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxFQUFFLFNBQVMsRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7UUFDeEYseUJBQXlCLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRSxHQUFHLENBQUMsQ0FBQztRQUMxQyxJQUFJLHNCQUFzQixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQyxHQUFHLEtBQUssR0FBRztZQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMscUVBQXFFLENBQUMsQ0FBQztJQUM1SSxDQUFDO0lBQ00sS0FBSyxDQUFDLGlCQUFpQixDQUFDLEVBQVU7UUFDdkMsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLGNBQWMsQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUN4QyxJQUFJLE9BQU8sQ0FBQyxNQUFNLEtBQUssUUFBUSxJQUFJLE9BQU8sQ0FBQyxVQUFVLENBQUMsSUFBSSxLQUFLLE9BQU8sRUFBRSxDQUFDO1lBQ3ZFLE1BQU0sSUFBSSxHQUFHLElBQUksQ0FBQyxVQUFVLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxDQUFDO1lBQ2pELElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUztnQkFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLEVBQUUsRUFBRSxRQUFRLEVBQUUsQ0FBQyx5REFBeUQsQ0FBQyxFQUFFLENBQUM7WUFDakgsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLGNBQWMsQ0FBQyxjQUFjLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUUsRUFBRSxJQUFJLENBQUMsU0FBUyxFQUFFLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUMzRyxDQUFDO1FBQ0QsT0FBTyxFQUFFLEtBQUssRUFBRTtnQkFDZCxFQUFFLE9BQU8sRUFBRSxnQkFBZ0IsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFLEtBQUssRUFBRSxPQUFPLENBQUMsTUFBTSxFQUFFO2dCQUN2RSxFQUFFLE9BQU8sRUFBRSxnQkFBZ0IsRUFBRSxLQUFLLEVBQUUsWUFBWSxFQUFFLEtBQUssRUFBRSxNQUFNLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsRUFBRTtnQkFDMUYsRUFBRSxPQUFPLEVBQUUsY0FBYyxFQUFFLEtBQUssRUFBRSwyQkFBMkIsRUFBRSxLQUFLLEVBQUUsNEVBQTRFLEVBQUU7YUFDckosRUFBRSxRQUFRLEVBQUUsRUFBRSxFQUFFLENBQUM7SUFDcEIsQ0FBQztDQUNGIn0=

package/dist_ts/classes.operations.d.ts

@@ -0,0 +1,44 @@
+import type { IAuthHarness, IHarnessOutcome } from './interfaces.harness.js';
+export type TAuthSwitchMutation = {
+    harnessId: string;
+} & ({
+    action: 'save';
+    accountId?: string;
+    keepActive: boolean;
+} | {
+    action: 'switch' | 'remove';
+    accountId: string;
+});
+export interface IAuthSwitchCoordinationRequest {
+    protocolVersion: 1;
+    /** Identifies credential locations; a host must refuse a different environment. */
+    contextId: string;
+    mutation: TAuthSwitchMutation;
+    /** Consent to wait for current work to finish; never permission to kill an active session. */
+    waitForIdle: boolean;
+}
+export type TAuthSwitchCoordinationResult = {
+    status: 'unavailable';
+} | {
+    status: 'busy';
+    message: string;
+} | {
+    status: 'complete';
+    outcome: IHarnessOutcome;
+};
+export type TAuthSwitchCoordinator = (request: IAuthSwitchCoordinationRequest) => Promise<TAuthSwitchCoordinationResult>;
+export type TAuthSwitchConfirmation = (message: string) => Promise<boolean>;
+export declare const authSwitchEnvironmentId: (env?: NodeJS.ProcessEnv) => string;
+/** Validate the secret-free command boundary, including callers that do not use TypeScript. */
+export declare const assertAuthSwitchMutation: (value: unknown) => asserts value is TAuthSwitchMutation;
+export declare const runAuthSwitchMutation: (harness: IAuthHarness, mutation: TAuthSwitchMutation) => Promise<IHarnessOutcome>;
+/** One mutation path for command, guide and TUI. Supervisors own their complete restart transaction. */
+export declare class AuthSwitchOperations {
+    private readonly coordinator?;
+    constructor(coordinator?: TAuthSwitchCoordinator | undefined);
+    run(harness: IAuthHarness, mutation: TAuthSwitchMutation, confirm?: TAuthSwitchConfirmation): Promise<IHarnessOutcome>;
+}
+/** AGL owns authenticated controller discovery. No AGL dependency, tokens or credential payloads cross this bridge. */
+export declare class AglAuthSwitchCoordinator {
+    coordinate(request: IAuthSwitchCoordinationRequest): Promise<TAuthSwitchCoordinationResult>;
+}

package/dist_ts/classes.operations.js

@@ -0,0 +1,97 @@
+import * as plugins from './plugins.js';
+export const authSwitchEnvironmentId = (env = process.env) => plugins.crypto.createHash('sha256').update(JSON.stringify({
+    home: plugins.os.homedir(),
+    stash: plugins.path.resolve(env.AUTHSWITCH_HOME || plugins.path.join(plugins.os.homedir(), '.authswitch')),
+    codex: plugins.path.resolve(env.CODEX_HOME || plugins.path.join(plugins.os.homedir(), '.codex')),
+    data: plugins.path.resolve(env.XDG_DATA_HOME || plugins.path.join(plugins.os.homedir(), '.local/share')),
+    claude: plugins.path.resolve(env.CLAUDE_CONFIG_DIR || plugins.path.join(plugins.os.homedir(), '.claude')),
+    openCodeOverride: env.OPENCODE_AUTH_CONTENT !== undefined,
+})).digest('hex');
+/** Validate the secret-free command boundary, including callers that do not use TypeScript. */
+export const assertAuthSwitchMutation = (value) => {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('Invalid account operation.');
+    const item = value;
+    const keys = item.action === 'save' ? ['harnessId', 'action', 'accountId', 'keepActive'] : ['harnessId', 'action', 'accountId'];
+    if (Object.keys(item).some(key => !keys.includes(key))
+        || typeof item.harnessId !== 'string' || !/^[a-z][a-z0-9-]{0,63}$/.test(item.harnessId)
+        || !['save', 'switch', 'remove'].includes(String(item.action))
+        || (item.accountId !== undefined && (typeof item.accountId !== 'string' || !item.accountId.length || item.accountId.length > 512))
+        || (item.action === 'save' ? typeof item.keepActive !== 'boolean' : typeof item.accountId !== 'string')) {
+        throw new Error('Invalid account operation.');
+    }
+};
+export const runAuthSwitchMutation = async (harness, mutation) => {
+    assertAuthSwitchMutation(mutation);
+    if (harness.id !== mutation.harnessId)
+        throw new Error('Account operation targets a different harness.');
+    switch (mutation.action) {
+        case 'save': return harness.saveCurrent({ keepActive: mutation.keepActive, accountId: mutation.accountId });
+        case 'switch': return harness.switchAccount(mutation.accountId);
+        case 'remove': return harness.removeAccount(mutation.accountId);
+    }
+};
+/** One mutation path for command, guide and TUI. Supervisors own their complete restart transaction. */
+export class AuthSwitchOperations {
+    coordinator;
+    constructor(coordinator) {
+        this.coordinator = coordinator;
+    }
+    async run(harness, mutation, confirm) {
+        assertAuthSwitchMutation(mutation);
+        if (harness.id !== mutation.harnessId)
+            throw new Error('Account operation targets a different harness.');
+        if (this.coordinator && mutation.action !== 'remove') {
+            const request = { protocolVersion: 1, contextId: authSwitchEnvironmentId(), mutation, waitForIdle: false };
+            let result = await this.coordinator(request);
+            if (result.status === 'busy') {
+                if (!confirm || !await confirm(result.message))
+                    return { lines: [], problems: [result.message] };
+                result = await this.coordinator({ ...request, waitForIdle: true });
+            }
+            if (result.status === 'complete')
+                return result.outcome;
+            if (result.status === 'busy')
+                return { lines: [], problems: [result.message] };
+        }
+        return runAuthSwitchMutation(harness, mutation);
+    }
+}
+/** AGL owns authenticated controller discovery. No AGL dependency, tokens or credential payloads cross this bridge. */
+export class AglAuthSwitchCoordinator {
+    async coordinate(request) {
+        assertAuthSwitchMutation(request.mutation);
+        const output = await new Promise((resolve, reject) => {
+            plugins.childProcess.execFile('agl', ['authswitch', '--request', JSON.stringify(request)], {
+                encoding: 'utf8', timeout: 360_000, maxBuffer: 1024 * 1024, windowsHide: true,
+            }, (error, stdout) => {
+                if (error?.code === 'ENOENT') {
+                    resolve(undefined);
+                    return;
+                }
+                if (error) {
+                    reject(new Error('AGL coordination did not complete. Check AGL and account status before retrying; no local credential operation was attempted. Install an AGL version with authswitch support.'));
+                    return;
+                }
+                resolve(stdout);
+            });
+        });
+        if (output === undefined)
+            return { status: 'unavailable' };
+        try {
+            const result = JSON.parse(output);
+            if (result.status === 'unavailable')
+                return { status: 'unavailable' };
+            if (result.status === 'busy' && typeof result.message === 'string' && result.message.length <= 4096)
+                return { status: 'busy', message: result.message };
+            if (result.status === 'complete' && result.outcome && ['lines', 'problems'].every(key => {
+                const items = result.outcome[key];
+                return Array.isArray(items) && items.length <= 100 && items.every(item => typeof item === 'string' && item.length <= 4096);
+            }))
+                return { status: 'complete', outcome: { lines: result.outcome.lines, problems: result.outcome.problems } };
+        }
+        catch { /* Never print raw transport output, which may contain native diagnostics. */ }
+        throw new Error('AGL returned an unsupported coordination response. Check account status before retrying.');
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5vcGVyYXRpb25zLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvY2xhc3Nlcy5vcGVyYXRpb25zLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sY0FBYyxDQUFDO0FBc0J4QyxNQUFNLENBQUMsTUFBTSx1QkFBdUIsR0FBRyxDQUFDLE1BQXlCLE9BQU8sQ0FBQyxHQUFHLEVBQVUsRUFBRSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDO0lBQ2pKLElBQUksRUFBRSxPQUFPLENBQUMsRUFBRSxDQUFDLE9BQU8sRUFBRTtJQUMxQixLQUFLLEVBQUUsT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLGVBQWUsSUFBSSxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDLE9BQU8sRUFBRSxFQUFFLGFBQWEsQ0FBQyxDQUFDO0lBQzFHLEtBQUssRUFBRSxPQUFPLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsVUFBVSxJQUFJLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsT0FBTyxFQUFFLEVBQUUsUUFBUSxDQUFDLENBQUM7SUFDaEcsSUFBSSxFQUFFLE9BQU8sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxhQUFhLElBQUksT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQyxPQUFPLEVBQUUsRUFBRSxjQUFjLENBQUMsQ0FBQztJQUN4RyxNQUFNLEVBQUUsT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLGlCQUFpQixJQUFJLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsT0FBTyxFQUFFLEVBQUUsU0FBUyxDQUFDLENBQUM7SUFDekcsZ0JBQWdCLEVBQUUsR0FBRyxDQUFDLHFCQUFxQixLQUFLLFNBQVM7Q0FDMUQsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO0FBRWxCLCtGQUErRjtBQUMvRixNQUFNLENBQUMsTUFBTSx3QkFBd0IsR0FBNkQsQ0FBQyxLQUFLLEVBQUUsRUFBRTtJQUMxRyxJQUFJLENBQUMsS0FBSyxJQUFJLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQztRQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsNEJBQTRCLENBQUMsQ0FBQztJQUMvRyxNQUFNLElBQUksR0FBRyxLQUFnQyxDQUFDO0lBQzlDLE1BQU0sSUFBSSxHQUFHLElBQUksQ0FBQyxNQUFNLEtBQUssTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDLFdBQVcsRUFBRSxRQUFRLEVBQUUsV0FBVyxFQUFFLFlBQVksQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLFdBQVcsRUFBRSxRQUFRLEVBQUUsV0FBVyxDQUFDLENBQUM7SUFDaEksSUFBSSxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQztXQUNqRCxPQUFPLElBQUksQ0FBQyxTQUFTLEtBQUssUUFBUSxJQUFJLENBQUMsd0JBQXdCLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUM7V0FDcEYsQ0FBQyxDQUFDLE1BQU0sRUFBRSxRQUFRLEVBQUUsUUFBUSxDQUFDLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUM7V0FDM0QsQ0FBQyxJQUFJLENBQUMsU0FBUyxLQUFLLFNBQVMsSUFBSSxDQUFDLE9BQU8sSUFBSSxDQUFDLFNBQVMsS0FBSyxRQUFRLElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sSUFBSSxJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sR0FBRyxHQUFHLENBQUMsQ0FBQztXQUMvSCxDQUFDLElBQUksQ0FBQyxNQUFNLEtBQUssTUFBTSxDQUFDLENBQUMsQ0FBQyxPQUFPLElBQUksQ0FBQyxVQUFVLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxPQUFPLElBQUksQ0FBQyxTQUFTLEtBQUssUUFBUSxDQUFDLEVBQUUsQ0FBQztRQUMxRyxNQUFNLElBQUksS0FBSyxDQUFDLDRCQUE0QixDQUFDLENBQUM7SUFDaEQsQ0FBQztBQUNILENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLHFCQUFxQixHQUFHLEtBQUssRUFBRSxPQUFxQixFQUFFLFFBQTZCLEVBQTRCLEVBQUU7SUFDNUgsd0JBQXdCLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDbkMsSUFBSSxPQUFPLENBQUMsRUFBRSxLQUFLLFFBQVEsQ0FBQyxTQUFTO1FBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxnREFBZ0QsQ0FBQyxDQUFDO0lBQ3pHLFFBQVEsUUFBUSxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ3hCLEtBQUssTUFBTSxDQUFDLENBQUMsT0FBTyxPQUFPLENBQUMsV0FBVyxDQUFDLEVBQUUsVUFBVSxFQUFFLFFBQVEsQ0FBQyxVQUFVLEVBQUUsU0FBUyxFQUFFLFFBQVEsQ0FBQyxTQUFTLEVBQUUsQ0FBQyxDQUFDO1FBQzVHLEtBQUssUUFBUSxDQUFDLENBQUMsT0FBTyxPQUFPLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUNoRSxLQUFLLFFBQVEsQ0FBQyxDQUFDLE9BQU8sT0FBTyxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDbEUsQ0FBQztBQUNILENBQUMsQ0FBQztBQUVGLHdHQUF3RztBQUN4RyxNQUFNLE9BQU8sb0JBQW9CO0lBQ0Y7SUFBN0IsWUFBNkIsV0FBb0M7UUFBcEMsZ0JBQVcsR0FBWCxXQUFXLENBQXlCO0lBQUcsQ0FBQztJQUM5RCxLQUFLLENBQUMsR0FBRyxDQUFDLE9BQXFCLEVBQUUsUUFBNkIsRUFBRSxPQUFpQztRQUN0Ryx3QkFBd0IsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUNuQyxJQUFJLE9BQU8sQ0FBQyxFQUFFLEtBQUssUUFBUSxDQUFDLFNBQVM7WUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLGdEQUFnRCxDQUFDLENBQUM7UUFDekcsSUFBSSxJQUFJLENBQUMsV0FBVyxJQUFJLFFBQVEsQ0FBQyxNQUFNLEtBQUssUUFBUSxFQUFFLENBQUM7WUFDckQsTUFBTSxPQUFPLEdBQW1DLEVBQUUsZUFBZSxFQUFFLENBQUMsRUFBRSxTQUFTLEVBQUUsdUJBQXVCLEVBQUUsRUFBRSxRQUFRLEVBQUUsV0FBVyxFQUFFLEtBQUssRUFBRSxDQUFDO1lBQzNJLElBQUksTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLFdBQVcsQ0FBQyxPQUFPLENBQUMsQ0FBQztZQUM3QyxJQUFJLE1BQU0sQ0FBQyxNQUFNLEtBQUssTUFBTSxFQUFFLENBQUM7Z0JBQzdCLElBQUksQ0FBQyxPQUFPLElBQUksQ0FBQyxNQUFNLE9BQU8sQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDO29CQUFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsRUFBRSxFQUFFLFFBQVEsRUFBRSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO2dCQUNqRyxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsV0FBVyxDQUFDLEVBQUUsR0FBRyxPQUFPLEVBQUUsV0FBVyxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7WUFDckUsQ0FBQztZQUNELElBQUksTUFBTSxDQUFDLE1BQU0sS0FBSyxVQUFVO2dCQUFFLE9BQU8sTUFBTSxDQUFDLE9BQU8sQ0FBQztZQUN4RCxJQUFJLE1BQU0sQ0FBQyxNQUFNLEtBQUssTUFBTTtnQkFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLEVBQUUsRUFBRSxRQUFRLEVBQUUsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUNqRixDQUFDO1FBQ0QsT0FBTyxxQkFBcUIsQ0FBQyxPQUFPLEVBQUUsUUFBUSxDQUFDLENBQUM7SUFDbEQsQ0FBQztDQUNGO0FBRUQsdUhBQXVIO0FBQ3ZILE1BQU0sT0FBTyx3QkFBd0I7SUFDNUIsS0FBSyxDQUFDLFVBQVUsQ0FBQyxPQUF1QztRQUM3RCx3QkFBd0IsQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDM0MsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLE9BQU8sQ0FBcUIsQ0FBQyxPQUFPLEVBQUUsTUFBTSxFQUFFLEVBQUU7WUFDdkUsT0FBTyxDQUFDLFlBQVksQ0FBQyxRQUFRLENBQUMsS0FBSyxFQUFFLENBQUMsWUFBWSxFQUFFLFdBQVcsRUFBRSxJQUFJLENBQUMsU0FBUyxDQUFDLE9BQU8sQ0FBQyxDQUFDLEVBQUU7Z0JBQ3pGLFFBQVEsRUFBRSxNQUFNLEVBQUUsT0FBTyxFQUFFLE9BQU8sRUFBRSxTQUFTLEVBQUUsSUFBSSxHQUFHLElBQUksRUFBRSxXQUFXLEVBQUUsSUFBSTthQUM5RSxFQUFFLENBQUMsS0FBSyxFQUFFLE1BQU0sRUFBRSxFQUFFO2dCQUNuQixJQUFLLEtBQXNDLEVBQUUsSUFBSSxLQUFLLFFBQVEsRUFBRSxDQUFDO29CQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsQ0FBQztvQkFBQyxPQUFPO2dCQUFDLENBQUM7Z0JBQy9GLElBQUksS0FBSyxFQUFFLENBQUM7b0JBQUMsTUFBTSxDQUFDLElBQUksS0FBSyxDQUFDLCtLQUErSyxDQUFDLENBQUMsQ0FBQztvQkFBQyxPQUFPO2dCQUFDLENBQUM7Z0JBQzFOLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FBQztZQUNsQixDQUFDLENBQUMsQ0FBQztRQUNMLENBQUMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxNQUFNLEtBQUssU0FBUztZQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsYUFBYSxFQUFFLENBQUM7UUFDM0QsSUFBSSxDQUFDO1lBQ0gsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQWtDLENBQUM7WUFDbkUsSUFBSSxNQUFNLENBQUMsTUFBTSxLQUFLLGFBQWE7Z0JBQUUsT0FBTyxFQUFFLE1BQU0sRUFBRSxhQUFhLEVBQUUsQ0FBQztZQUN0RSxJQUFJLE1BQU0sQ0FBQyxNQUFNLEtBQUssTUFBTSxJQUFJLE9BQU8sTUFBTSxDQUFDLE9BQU8sS0FBSyxRQUFRLElBQUksTUFBTSxDQUFDLE9BQU8sQ0FBQyxNQUFNLElBQUksSUFBSTtnQkFBRSxPQUFPLEVBQUUsTUFBTSxFQUFFLE1BQU0sRUFBRSxPQUFPLEVBQUUsTUFBTSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ3hKLElBQUksTUFBTSxDQUFDLE1BQU0sS0FBSyxVQUFVLElBQUksTUFBTSxDQUFDLE9BQU8sSUFBSSxDQUFDLE9BQU8sRUFBRSxVQUFVLENBQUMsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLEVBQUU7Z0JBQ3RGLE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUMsR0FBNEIsQ0FBQyxDQUFDO2dCQUMzRCxPQUFPLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxDQUFDLE1BQU0sSUFBSSxHQUFHLElBQUksS0FBSyxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLE9BQU8sSUFBSSxLQUFLLFFBQVEsSUFBSSxJQUFJLENBQUMsTUFBTSxJQUFJLElBQUksQ0FBQyxDQUFDO1lBQzdILENBQUMsQ0FBQztnQkFBRSxPQUFPLEVBQUUsTUFBTSxFQUFFLFVBQVUsRUFBRSxPQUFPLEVBQUUsRUFBRSxLQUFLLEVBQUUsTUFBTSxDQUFDLE9BQU8sQ0FBQyxLQUFLLEVBQUUsUUFBUSxFQUFFLE1BQU0sQ0FBQyxPQUFPLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQztRQUNqSCxDQUFDO1FBQUMsTUFBTSxDQUFDLENBQUMsNkVBQTZFLENBQUMsQ0FBQztRQUN6RixNQUFNLElBQUksS0FBSyxDQUFDLDBGQUEwRixDQUFDLENBQUM7SUFDOUcsQ0FBQztDQUNGIn0=

package/dist_ts/classes.remotecontrol.d.ts

@@ -0,0 +1,46 @@
+import type { IRemoteControlEnrollment } from './interfaces.js';
+import { CodexHome } from './classes.codexhome.js';
+/**
+ * Reads and restores Codex' remote-control enrollments.
+ *
+ * An enrollment is the record that binds this machine's Codex app-server to a
+ * paired ChatGPT client. Its primary key includes the account id, so enrollments
+ * for several accounts can coexist -- but a credential swap can still leave an
+ * account without its row, which is exactly what breaks remote control after a
+ * naive auth switch. authswitch captures the rows next to the credential and
+ * puts them back when the credential is restored.
+ */
+export declare class RemoteControlStore {
+    readonly codexHome: CodexHome;
+    constructor(codexHomeArg: CodexHome);
+    /** True when a Codex state database exists and carries the enrollment table. */
+    isAvailable(): boolean;
+    /**
+     * Returns the enrollments for one account, or every enrollment when no
+     * account id is given.
+     */
+    read(accountIdArg?: string | null): IRemoteControlEnrollment[];
+    /**
+     * Puts enrollments back, updating any row with the same primary key.
+     *
+     * Throws rather than reporting zero when the database or the table is not
+     * there: restoring remote control is the reason this tool exists, so failing
+     * to do it must surface instead of looking like "there was nothing to do".
+     */
+    restore(enrollmentsArg: IRemoteControlEnrollment[]): number;
+    private hasTable;
+    /**
+     * Refuses to write when Codex has added columns this version does not know
+     * about. `CodexHome` deliberately follows the newest state generation, so a
+     * Codex upgrade can widen this table -- and writing only the columns we know
+     * would quietly reset the rest to their defaults.
+     */
+    private assertKnownColumns;
+    private toEnrollment;
+    /**
+     * Codex keeps the state database in WAL mode and holds it open from the
+     * app-server, so every access takes a busy timeout rather than failing on the
+     * first lock contention.
+     */
+    private withDatabase;
+}

package/dist_ts/classes.remotecontrol.js

@@ -0,0 +1,169 @@
+import * as plugins from './plugins.js';
+import { CodexHome } from './classes.codexhome.js';
+const TABLE_NAME = 'remote_control_enrollments';
+/** The columns authswitch knows how to carry across a switch. */
+const COLUMNS = [
+    'websocket_url',
+    'account_id',
+    'app_server_client_name',
+    'server_id',
+    'environment_id',
+    'server_name',
+    'updated_at',
+    'remote_control_enabled',
+];
+/** The columns that make up the table's primary key. */
+const KEY_COLUMNS = ['websocket_url', 'account_id', 'app_server_client_name'];
+/**
+ * Reads and restores Codex' remote-control enrollments.
+ *
+ * An enrollment is the record that binds this machine's Codex app-server to a
+ * paired ChatGPT client. Its primary key includes the account id, so enrollments
+ * for several accounts can coexist -- but a credential swap can still leave an
+ * account without its row, which is exactly what breaks remote control after a
+ * naive auth switch. authswitch captures the rows next to the credential and
+ * puts them back when the credential is restored.
+ */
+export class RemoteControlStore {
+    codexHome;
+    constructor(codexHomeArg) {
+        this.codexHome = codexHomeArg;
+    }
+    /** True when a Codex state database exists and carries the enrollment table. */
+    isAvailable() {
+        const statePath = this.codexHome.statePath;
+        if (!statePath) {
+            return false;
+        }
+        try {
+            return this.withDatabase(statePath, true, (databaseArg) => this.hasTable(databaseArg));
+        }
+        catch {
+            // A read-only connection cannot create the -shm file a WAL database needs,
+            // so an unclean shutdown can make even the probe fail. Report "not
+            // available" here; the restore path probes over its writable connection.
+            return false;
+        }
+    }
+    /**
+     * Returns the enrollments for one account, or every enrollment when no
+     * account id is given.
+     */
+    read(accountIdArg) {
+        const statePath = this.codexHome.statePath;
+        if (!statePath) {
+            return [];
+        }
+        try {
+            return this.withDatabase(statePath, true, (databaseArg) => {
+                if (!this.hasTable(databaseArg)) {
+                    return [];
+                }
+                const selection = COLUMNS.join(', ');
+                const statement = accountIdArg
+                    ? databaseArg.prepare(`select ${selection} from ${TABLE_NAME} where account_id = ?`)
+                    : databaseArg.prepare(`select ${selection} from ${TABLE_NAME}`);
+                const rows = accountIdArg ? statement.all(accountIdArg) : statement.all();
+                return rows.map((rowArg) => this.toEnrollment(rowArg));
+            });
+        }
+        catch {
+            return [];
+        }
+    }
+    /**
+     * Puts enrollments back, updating any row with the same primary key.
+     *
+     * Throws rather than reporting zero when the database or the table is not
+     * there: restoring remote control is the reason this tool exists, so failing
+     * to do it must surface instead of looking like "there was nothing to do".
+     */
+    restore(enrollmentsArg) {
+        if (enrollmentsArg.length === 0) {
+            return 0;
+        }
+        const statePath = this.codexHome.statePath;
+        if (!statePath) {
+            throw new Error(`no Codex state database found in ${this.codexHome.dir}; cannot restore remote-control enrollments`);
+        }
+        // Opened read-write: the read-only probe cannot create the -shm file a WAL
+        // database needs, and failing there would leave the switch half-applied.
+        return this.withDatabase(statePath, false, (databaseArg) => {
+            if (!this.hasTable(databaseArg)) {
+                throw new Error(`${statePath} has no ${TABLE_NAME} table; this Codex version stores remote-control enrollments elsewhere`);
+            }
+            this.assertKnownColumns(databaseArg, statePath);
+            const placeholders = COLUMNS.map(() => '?').join(', ');
+            const updates = COLUMNS.filter((columnArg) => !KEY_COLUMNS.includes(columnArg))
+                .map((columnArg) => `${columnArg} = excluded.${columnArg}`)
+                .join(', ');
+            const statement = databaseArg.prepare(`insert into ${TABLE_NAME} (${COLUMNS.join(', ')}) values (${placeholders})
+         on conflict(${KEY_COLUMNS.join(', ')}) do update set ${updates}`);
+            databaseArg.exec('begin immediate');
+            try {
+                for (const enrollmentArg of enrollmentsArg) {
+                    statement.run(enrollmentArg.websocketUrl, enrollmentArg.accountId, enrollmentArg.appServerClientName, enrollmentArg.serverId, enrollmentArg.environmentId, enrollmentArg.serverName, enrollmentArg.updatedAt, enrollmentArg.remoteControlEnabled);
+                }
+                databaseArg.exec('commit');
+            }
+            catch (errorArg) {
+                databaseArg.exec('rollback');
+                throw errorArg;
+            }
+            return enrollmentsArg.length;
+        });
+    }
+    hasTable(databaseArg) {
+        const row = databaseArg
+            .prepare(`select name from sqlite_master where type = 'table' and name = ?`)
+            .get(TABLE_NAME);
+        return row !== undefined;
+    }
+    /**
+     * Refuses to write when Codex has added columns this version does not know
+     * about. `CodexHome` deliberately follows the newest state generation, so a
+     * Codex upgrade can widen this table -- and writing only the columns we know
+     * would quietly reset the rest to their defaults.
+     */
+    assertKnownColumns(databaseArg, statePathArg) {
+        const rows = databaseArg.prepare(`pragma table_info(${TABLE_NAME})`).all();
+        const actual = rows.map((rowArg) => String(rowArg.name));
+        const unexpected = actual.filter((nameArg) => !COLUMNS.includes(nameArg));
+        const missing = COLUMNS.filter((nameArg) => !actual.includes(nameArg));
+        if (unexpected.length > 0 || missing.length > 0) {
+            throw new Error(`${statePathArg} has an unexpected ${TABLE_NAME} schema ` +
+                `(unexpected: ${unexpected.join(', ') || 'none'}; missing: ${missing.join(', ') || 'none'}). ` +
+                'Refusing to restore rather than write a partial row - authswitch needs an update for this Codex version.');
+        }
+    }
+    toEnrollment(rowArg) {
+        return {
+            websocketUrl: String(rowArg.websocket_url ?? ''),
+            accountId: String(rowArg.account_id ?? ''),
+            appServerClientName: String(rowArg.app_server_client_name ?? ''),
+            serverId: String(rowArg.server_id ?? ''),
+            environmentId: String(rowArg.environment_id ?? ''),
+            serverName: String(rowArg.server_name ?? ''),
+            updatedAt: Number(rowArg.updated_at ?? 0),
+            remoteControlEnabled: rowArg.remote_control_enabled === null || rowArg.remote_control_enabled === undefined
+                ? null
+                : Number(rowArg.remote_control_enabled),
+        };
+    }
+    /**
+     * Codex keeps the state database in WAL mode and holds it open from the
+     * app-server, so every access takes a busy timeout rather than failing on the
+     * first lock contention.
+     */
+    withDatabase(pathArg, readOnlyArg, handlerArg) {
+        const database = new plugins.DatabaseSync(pathArg, { readOnly: readOnlyArg });
+        try {
+            database.exec('pragma busy_timeout = 5000');
+            return handlerArg(database);
+        }
+        finally {
+            database.close();
+        }
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5yZW1vdGVjb250cm9sLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvY2xhc3Nlcy5yZW1vdGVjb250cm9sLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sY0FBYyxDQUFDO0FBRXhDLE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSx3QkFBd0IsQ0FBQztBQUVuRCxNQUFNLFVBQVUsR0FBRyw0QkFBNEIsQ0FBQztBQUVoRCxpRUFBaUU7QUFDakUsTUFBTSxPQUFPLEdBQUc7SUFDZCxlQUFlO0lBQ2YsWUFBWTtJQUNaLHdCQUF3QjtJQUN4QixXQUFXO0lBQ1gsZ0JBQWdCO0lBQ2hCLGFBQWE7SUFDYixZQUFZO0lBQ1osd0JBQXdCO0NBQ2hCLENBQUM7QUFFWCx3REFBd0Q7QUFDeEQsTUFBTSxXQUFXLEdBQUcsQ0FBQyxlQUFlLEVBQUUsWUFBWSxFQUFFLHdCQUF3QixDQUFVLENBQUM7QUFFdkY7Ozs7Ozs7OztHQVNHO0FBQ0gsTUFBTSxPQUFPLGtCQUFrQjtJQUNiLFNBQVMsQ0FBWTtJQUVyQyxZQUFZLFlBQXVCO1FBQ2pDLElBQUksQ0FBQyxTQUFTLEdBQUcsWUFBWSxDQUFDO0lBQ2hDLENBQUM7SUFFRCxnRkFBZ0Y7SUFDekUsV0FBVztRQUNoQixNQUFNLFNBQVMsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQztRQUMzQyxJQUFJLENBQUMsU0FBUyxFQUFFLENBQUM7WUFDZixPQUFPLEtBQUssQ0FBQztRQUNmLENBQUM7UUFDRCxJQUFJLENBQUM7WUFDSCxPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsU0FBUyxFQUFFLElBQUksRUFBRSxDQUFDLFdBQVcsRUFBRSxFQUFFLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDO1FBQ3pGLENBQUM7UUFBQyxNQUFNLENBQUM7WUFDUCwyRUFBMkU7WUFDM0UsbUVBQW1FO1lBQ25FLHlFQUF5RTtZQUN6RSxPQUFPLEtBQUssQ0FBQztRQUNmLENBQUM7SUFDSCxDQUFDO0lBRUQ7OztPQUdHO0lBQ0ksSUFBSSxDQUFDLFlBQTRCO1FBQ3RDLE1BQU0sU0FBUyxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsU0FBUyxDQUFDO1FBQzNDLElBQUksQ0FBQyxTQUFTLEVBQUUsQ0FBQztZQUNmLE9BQU8sRUFBRSxDQUFDO1FBQ1osQ0FBQztRQUNELElBQUksQ0FBQztZQUNILE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxTQUFTLEVBQUUsSUFBSSxFQUFFLENBQUMsV0FBVyxFQUFFLEVBQUU7Z0JBQ3hELElBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUM7b0JBQ2hDLE9BQU8sRUFBRSxDQUFDO2dCQUNaLENBQUM7Z0JBQ0QsTUFBTSxTQUFTLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztnQkFDckMsTUFBTSxTQUFTLEdBQUcsWUFBWTtvQkFDNUIsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxPQUFPLENBQUMsVUFBVSxTQUFTLFNBQVMsVUFBVSx1QkFBdUIsQ0FBQztvQkFDcEYsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxPQUFPLENBQUMsVUFBVSxTQUFTLFNBQVMsVUFBVSxFQUFFLENBQUMsQ0FBQztnQkFDbEUsTUFBTSxJQUFJLEdBQUcsWUFBWSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsR0FBRyxFQUFFLENBQUM7Z0JBQzFFLE9BQU8sSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxNQUFpQyxDQUFDLENBQUMsQ0FBQztZQUNwRixDQUFDLENBQUMsQ0FBQztRQUNMLENBQUM7UUFBQyxNQUFNLENBQUM7WUFDUCxPQUFPLEVBQUUsQ0FBQztRQUNaLENBQUM7SUFDSCxDQUFDO0lBRUQ7Ozs7OztPQU1HO0lBQ0ksT0FBTyxDQUFDLGNBQTBDO1FBQ3ZELElBQUksY0FBYyxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUNoQyxPQUFPLENBQUMsQ0FBQztRQUNYLENBQUM7UUFDRCxNQUFNLFNBQVMsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQztRQUMzQyxJQUFJLENBQUMsU0FBUyxFQUFFLENBQUM7WUFDZixNQUFNLElBQUksS0FBSyxDQUNiLG9DQUFvQyxJQUFJLENBQUMsU0FBUyxDQUFDLEdBQUcsNkNBQTZDLENBQ3BHLENBQUM7UUFDSixDQUFDO1FBQ0QsMkVBQTJFO1FBQzNFLHlFQUF5RTtRQUN6RSxPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsU0FBUyxFQUFFLEtBQUssRUFBRSxDQUFDLFdBQVcsRUFBRSxFQUFFO1lBQ3pELElBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUM7Z0JBQ2hDLE1BQU0sSUFBSSxLQUFLLENBQ2IsR0FBRyxTQUFTLFdBQVcsVUFBVSx3RUFBd0UsQ0FDMUcsQ0FBQztZQUNKLENBQUM7WUFDRCxJQUFJLENBQUMsa0JBQWtCLENBQUMsV0FBVyxFQUFFLFNBQVMsQ0FBQyxDQUFDO1lBRWhELE1BQU0sWUFBWSxHQUFHLE9BQU8sQ0FBQyxHQUFHLENBQUMsR0FBRyxFQUFFLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO1lBQ3ZELE1BQU0sT0FBTyxHQUFHLE9BQU8sQ0FBQyxNQUFNLENBQzVCLENBQUMsU0FBUyxFQUFFLEVBQUUsQ0FBQyxDQUFFLFdBQWlDLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxDQUN2RTtpQkFDRSxHQUFHLENBQUMsQ0FBQyxTQUFTLEVBQUUsRUFBRSxDQUFDLEdBQUcsU0FBUyxlQUFlLFNBQVMsRUFBRSxDQUFDO2lCQUMxRCxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7WUFDZCxNQUFNLFNBQVMsR0FBRyxXQUFXLENBQUMsT0FBTyxDQUNuQyxlQUFlLFVBQVUsS0FBSyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxhQUFhLFlBQVk7dUJBQzFELFdBQVcsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLG1CQUFtQixPQUFPLEVBQUUsQ0FDbEUsQ0FBQztZQUVGLFdBQVcsQ0FBQyxJQUFJLENBQUMsaUJBQWlCLENBQUMsQ0FBQztZQUNwQyxJQUFJLENBQUM7Z0JBQ0gsS0FBSyxNQUFNLGFBQWEsSUFBSSxjQUFjLEVBQUUsQ0FBQztvQkFDM0MsU0FBUyxDQUFDLEdBQUcsQ0FDWCxhQUFhLENBQUMsWUFBWSxFQUMxQixhQUFhLENBQUMsU0FBUyxFQUN2QixhQUFhLENBQUMsbUJBQW1CLEVBQ2pDLGFBQWEsQ0FBQyxRQUFRLEVBQ3RCLGFBQWEsQ0FBQyxhQUFhLEVBQzNCLGFBQWEsQ0FBQyxVQUFVLEVBQ3hCLGFBQWEsQ0FBQyxTQUFTLEVBQ3ZCLGFBQWEsQ0FBQyxvQkFBb0IsQ0FDbkMsQ0FBQztnQkFDSixDQUFDO2dCQUNELFdBQVcsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7WUFDN0IsQ0FBQztZQUFDLE9BQU8sUUFBUSxFQUFFLENBQUM7Z0JBQ2xCLFdBQVcsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLENBQUM7Z0JBQzdCLE1BQU0sUUFBUSxDQUFDO1lBQ2pCLENBQUM7WUFDRCxPQUFPLGNBQWMsQ0FBQyxNQUFNLENBQUM7UUFDL0IsQ0FBQyxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRU8sUUFBUSxDQUFDLFdBQXNEO1FBQ3JFLE1BQU0sR0FBRyxHQUFHLFdBQVc7YUFDcEIsT0FBTyxDQUFDLGtFQUFrRSxDQUFDO2FBQzNFLEdBQUcsQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUNuQixPQUFPLEdBQUcsS0FBSyxTQUFTLENBQUM7SUFDM0IsQ0FBQztJQUVEOzs7OztPQUtHO0lBQ0ssa0JBQWtCLENBQ3hCLFdBQXNELEVBQ3RELFlBQW9CO1FBRXBCLE1BQU0sSUFBSSxHQUFHLFdBQVcsQ0FBQyxPQUFPLENBQUMscUJBQXFCLFVBQVUsR0FBRyxDQUFDLENBQUMsR0FBRyxFQUV2RSxDQUFDO1FBQ0YsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDO1FBQ3pELE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLENBQUUsT0FBNkIsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQztRQUNqRyxNQUFNLE9BQU8sR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQztRQUN2RSxJQUFJLFVBQVUsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxJQUFJLE9BQU8sQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDaEQsTUFBTSxJQUFJLEtBQUssQ0FDYixHQUFHLFlBQVksc0JBQXNCLFVBQVUsVUFBVTtnQkFDdkQsZ0JBQWdCLFVBQVUsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksTUFBTSxjQUFjLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksTUFBTSxLQUFLO2dCQUM5RiwwR0FBMEcsQ0FDN0csQ0FBQztRQUNKLENBQUM7SUFDSCxDQUFDO0lBRU8sWUFBWSxDQUFDLE1BQStCO1FBQ2xELE9BQU87WUFDTCxZQUFZLEVBQUUsTUFBTSxDQUFDLE1BQU0sQ0FBQyxhQUFhLElBQUksRUFBRSxDQUFDO1lBQ2hELFNBQVMsRUFBRSxNQUFNLENBQUMsTUFBTSxDQUFDLFVBQVUsSUFBSSxFQUFFLENBQUM7WUFDMUMsbUJBQW1CLEVBQUUsTUFBTSxDQUFDLE1BQU0sQ0FBQyxzQkFBc0IsSUFBSSxFQUFFLENBQUM7WUFDaEUsUUFBUSxFQUFFLE1BQU0sQ0FBQyxNQUFNLENBQUMsU0FBUyxJQUFJLEVBQUUsQ0FBQztZQUN4QyxhQUFhLEVBQUUsTUFBTSxDQUFDLE1BQU0sQ0FBQyxjQUFjLElBQUksRUFBRSxDQUFDO1lBQ2xELFVBQVUsRUFBRSxNQUFNLENBQUMsTUFBTSxDQUFDLFdBQVcsSUFBSSxFQUFFLENBQUM7WUFDNUMsU0FBUyxFQUFFLE1BQU0sQ0FBQyxNQUFNLENBQUMsVUFBVSxJQUFJLENBQUMsQ0FBQztZQUN6QyxvQkFBb0IsRUFDbEIsTUFBTSxDQUFDLHNCQUFzQixLQUFLLElBQUksSUFBSSxNQUFNLENBQUMsc0JBQXNCLEtBQUssU0FBUztnQkFDbkYsQ0FBQyxDQUFDLElBQUk7Z0JBQ04sQ0FBQyxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsc0JBQXNCLENBQUM7U0FDNUMsQ0FBQztJQUNKLENBQUM7SUFFRDs7OztPQUlHO0lBQ0ssWUFBWSxDQUNsQixPQUFlLEVBQ2YsV0FBb0IsRUFDcEIsVUFBeUU7UUFFekUsTUFBTSxRQUFRLEdBQUcsSUFBSSxPQUFPLENBQUMsWUFBWSxDQUFDLE9BQU8sRUFBRSxFQUFFLFFBQVEsRUFBRSxXQUFXLEVBQUUsQ0FBQyxDQUFDO1FBQzlFLElBQUksQ0FBQztZQUNILFFBQVEsQ0FBQyxJQUFJLENBQUMsNEJBQTRCLENBQUMsQ0FBQztZQUM1QyxPQUFPLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUM5QixDQUFDO2dCQUFTLENBQUM7WUFDVCxRQUFRLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDbkIsQ0FBQztJQUNILENBQUM7Q0FDRiJ9

package/dist_ts/classes.service.d.ts

@@ -0,0 +1,47 @@
+import { type IAuthSwitchCoordinationRequest, type TAuthSwitchCoordinationResult, type TAuthSwitchCoordinator } from './classes.operations.js';
+import type { IAuthHarness, IHarnessLoginOptions, IHarnessLoginProvider, IHarnessLoginResult } from './interfaces.harness.js';
+import type { IAccountList } from './interfaces.list.js';
+import type { TAuthLoginPrompt } from './classes.login.js';
+export type TAuthSwitchServiceRequest = {
+    protocolVersion: 1;
+} & ({
+    action: 'list';
+    harnessId?: string;
+} | {
+    action: 'mutate';
+    coordination: IAuthSwitchCoordinationRequest;
+} | ({
+    action: 'login';
+    harnessId: string;
+} & IHarnessLoginOptions) | {
+    action: 'get' | 'cancel';
+    operationId: string;
+});
+/** Disposable operation status. Hosts authenticate callers; neither prompts nor results contain credentials. */
+export interface IAuthSwitchServiceOperation {
+    id: string;
+    contextId: string;
+    state: 'pending' | 'complete' | 'failed';
+    prompt?: TAuthLoginPrompt;
+    accounts?: IAccountList;
+    loginCapabilities?: {
+        harnessId: string;
+        providers: IHarnessLoginProvider[];
+    }[];
+    account?: IHarnessLoginResult['account'];
+    result?: TAuthSwitchCoordinationResult;
+    error?: string;
+}
+export declare const assertAuthSwitchServiceRequest: (value: unknown) => asserts value is TAuthSwitchServiceRequest;
+/** Hosted account manager. Operations outlive HTTP connections and are retained briefly for polling. */
+export declare class AuthSwitchService {
+    private readonly harnesses;
+    private readonly coordinator?;
+    private readonly operations;
+    private closed;
+    constructor(harnesses?: IAuthHarness[], coordinator?: TAuthSwitchCoordinator | undefined);
+    private harness;
+    private snapshot;
+    request(request: TAuthSwitchServiceRequest): Promise<IAuthSwitchServiceOperation>;
+    close(): Promise<void>;
+}