@modelprofile.com/authswitch 6.2.0 → 6.4.0

package/ts/classes.authorityframing.ts

@@ -0,0 +1,21 @@
+const maxFrameBytes = 1024 * 1024;
+
+/** One bounded UTF-8 JSON line. Decode only after the complete byte frame arrives. */
+export class AuthSwitchAuthorityFrameReader {
+  private readonly chunks: Buffer[] = [];
+  private bytes = 0;
+
+  public add(chunk: Buffer): string | null {
+    if (chunk.length > maxFrameBytes - this.bytes) throw new Error('Authswitch authority frame is too large.');
+    this.chunks.push(chunk);
+    this.bytes += chunk.length;
+    const end = chunk.indexOf(0x0a);
+    if (end < 0) return null;
+    if (end !== chunk.length - 1) throw new Error('Authswitch authority frame contains trailing data.');
+    const frame = Buffer.concat(this.chunks, this.bytes);
+    return new TextDecoder('utf-8', { fatal: true }).decode(frame.subarray(0, frame.length - 1));
+  }
+}
+
+export const authSwitchAuthorityFrameBytes = (value: string): number => Buffer.byteLength(value, 'utf8') + 1;
+export const maxAuthSwitchAuthorityFrameBytes = maxFrameBytes;

package/ts/classes.authoritymodels.ts

@@ -0,0 +1,367 @@
+import * as plugins from './plugins.js';
+
+export interface IStoredAuthorityMeta {
+  id: 'authswitch-authority';
+  epoch: string;
+  revision: number;
+  updateId: string;
+}
+
+/** Identity and presentation only. No refresh grant or native-home ownership lives here. */
+export interface IStoredAuthorityAccount {
+  id: string;
+  providerId: string;
+  issuer: string;
+  subject: string;
+  workspaceId: string;
+  label: string;
+  email: string | null;
+  plan: string | null;
+  primaryGrantId: string | null;
+  removed: boolean;
+  revision: number;
+  statusObservedAt: string;
+  updateId: string;
+}
+
+export type TStoredGrantPurpose =
+  | 'openai_managed' | 'claude_host_native' | 'claude_container_setup' | 'opencode_native';
+
+/** Each purpose has its own grant, ownership, generation and refresh state. */
+export interface IStoredAuthorityGrant {
+  id: string;
+  accountId: string;
+  providerId: string;
+  purpose: TStoredGrantPurpose;
+  audience: string;
+  state: 'ready' | 'exchange_may_have_been_sent' | 'retry_wait' | 'needs_reauth' | 'native' | 'legacy_native_pending' | 'removed';
+  owner: 'daemon' | 'claude_native' | 'legacy_native' | 'none';
+  grantGeneration: number;
+  authorizationGeneration: number;
+  revision: number;
+  ciphertext: string | null;
+  accessExpiresAt: string | null;
+  attemptId: string | null;
+  retryAt: string | null;
+  retryCount: number;
+  problem: 'none' | 'provider_unavailable' | 'exchange_uncertain' | 'provider_rejected' | 'native_owner';
+  statusObservedAt: string;
+  updateId: string;
+}
+
+export interface IStoredAuthorityBinding {
+  id: string;
+  accountId: string;
+  grantId: string;
+  runtime: 'flex' | 'codex' | 'opencode' | 'claude';
+  scopeId: string;
+  incarnationId: string;
+  revision: number;
+  grantAuthorizationGeneration: number;
+  capabilityHash: string;
+  updateId: string;
+}
+
+/** Codex enrollment is separate from a refresh grant and sealed under its own record ID. */
+export interface IStoredAuthorityEnrollment {
+  id: string;
+  accountId: string;
+  ciphertext: string;
+  revision: number;
+  updateId: string;
+}
+
+/** Journal for a native-home handoff. A prepared grant is never usable. */
+export interface IStoredAuthorityHandoff {
+  id: string;
+  accountId: string;
+  grantId: string;
+  nativeHomeId: string;
+  direction: 'to_native' | 'to_daemon';
+  phase: 'prepared' | 'source_stopped' | 'target_written' | 'verified' | 'committed' | 'needs_reauth' | 'aborted';
+  operationId: string;
+  sourceDigest: string;
+  verifiedSourceDigest: string | null;
+  backupDigest: string | null;
+  revision: number;
+  statusObservedAt: string;
+  updateId: string;
+}
+
+/** One-time legacy source inventory; source path is hashed, never exposed in snapshots. */
+export interface IStoredAuthorityMigrationLedger {
+  id: string;
+  version: number;
+  sourceKind: 'authswitch_stash' | 'authswitch_backup' | 'agl_flex' | 'codex_native' | 'opencode_native' | 'claude_native';
+  sourcePathHash: string;
+  sourceDigest: string;
+  status: 'pending_native_owner' | 'prepared' | 'verified' | 'complete' | 'quarantined';
+  accountId: string | null;
+  grantId: string | null;
+  backupDigest: string | null;
+  revision: number;
+  statusObservedAt: string;
+  updateId: string;
+}
+
+export interface IStoredAuthorityEvent {
+  id: string;
+  epoch: string;
+  revision: number;
+  kind: 'account' | 'binding';
+  accountId: string;
+}
+
+const object = (value: unknown): value is Record<string, unknown> =>
+  value !== null && typeof value === 'object' && !Array.isArray(value)
+  && [Object.prototype, null].includes(Object.getPrototypeOf(value));
+const exactKeys = (value: Record<string, unknown>, keys: readonly string[]): boolean =>
+  Object.keys(value).length === keys.length && keys.every(key => Object.hasOwn(value, key));
+const bounded = (value: unknown, max = 512): value is string =>
+  typeof value === 'string' && value.length > 0 && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
+const iso = (value: unknown): value is string =>
+  typeof value === 'string' && Number.isFinite(Date.parse(value)) && new Date(value).toISOString() === value;
+const uuid = (value: unknown): value is string => typeof value === 'string' && /^[a-f0-9-]{36}$/.test(value);
+const hash = (value: unknown): value is string => typeof value === 'string' && /^[a-f0-9]{64}$/.test(value);
+const revision = (value: unknown): value is number => Number.isSafeInteger(value) && Number(value) >= 0;
+const ciphertext = (value: unknown): boolean => value === null
+  || (typeof value === 'string' && value.length > 0 && value.length <= 131072 && /^[A-Za-z0-9_-]+$/.test(value));
+
+export const assertStoredAuthorityMeta: (value: unknown) => asserts value is IStoredAuthorityMeta = value => {
+  if (!object(value) || !exactKeys(value, ['id', 'epoch', 'revision', 'updateId'])
+    || value.id !== 'authswitch-authority' || !uuid(value.epoch)
+    || !revision(value.revision) || !uuid(value.updateId)) throw new Error('Invalid authswitch authority metadata.');
+};
+
+export const assertStoredAuthorityAccount: (value: unknown) => asserts value is IStoredAuthorityAccount = value => {
+  if (!object(value) || !exactKeys(value, ['id', 'providerId', 'issuer', 'subject', 'workspaceId', 'label',
+    'email', 'plan', 'primaryGrantId', 'removed', 'revision', 'statusObservedAt', 'updateId'])
+    || !hash(value.id) || typeof value.providerId !== 'string'
+    || !/^[a-z][a-z0-9-]{0,63}$/.test(value.providerId)
+    || !bounded(value.issuer) || !bounded(value.subject) || !bounded(value.workspaceId)
+    || !bounded(value.label, 128) || (value.email !== null && !bounded(value.email, 320))
+    || (value.plan !== null && !bounded(value.plan, 128))
+    || (value.primaryGrantId !== null && !hash(value.primaryGrantId))
+    || typeof value.removed !== 'boolean' || !revision(value.revision)
+    || !iso(value.statusObservedAt) || !uuid(value.updateId)) throw new Error('Invalid authswitch account record.');
+};
+
+export const assertStoredAuthorityGrant: (value: unknown) => asserts value is IStoredAuthorityGrant = value => {
+  if (!object(value) || !exactKeys(value, ['id', 'accountId', 'providerId', 'purpose', 'audience',
+    'state', 'owner', 'grantGeneration', 'authorizationGeneration', 'revision', 'ciphertext',
+    'accessExpiresAt', 'attemptId', 'retryAt', 'retryCount', 'problem', 'statusObservedAt', 'updateId'])
+    || !hash(value.id) || !hash(value.accountId)
+    || typeof value.providerId !== 'string' || !/^[a-z][a-z0-9-]{0,63}$/.test(value.providerId)
+    || !['openai_managed', 'claude_host_native', 'claude_container_setup', 'opencode_native'].includes(String(value.purpose))
+    || !bounded(value.audience)
+    || !['ready', 'exchange_may_have_been_sent', 'retry_wait', 'needs_reauth', 'native', 'legacy_native_pending', 'removed'].includes(String(value.state))
+    || !['daemon', 'claude_native', 'legacy_native', 'none'].includes(String(value.owner))
+    || !revision(value.grantGeneration) || !revision(value.authorizationGeneration)
+    || !revision(value.revision) || !ciphertext(value.ciphertext)
+    || (value.accessExpiresAt !== null && !iso(value.accessExpiresAt))
+    || (value.attemptId !== null && !uuid(value.attemptId))
+    || (value.retryAt !== null && !iso(value.retryAt))
+    || !revision(value.retryCount)
+    || !['none', 'provider_unavailable', 'exchange_uncertain', 'provider_rejected', 'native_owner'].includes(String(value.problem))
+    || !iso(value.statusObservedAt) || !uuid(value.updateId)) throw new Error('Invalid authswitch grant record.');
+  if (['ready', 'exchange_may_have_been_sent', 'retry_wait'].includes(String(value.state))
+    && (value.owner !== 'daemon' || value.ciphertext === null)) throw new Error('An active daemon grant is missing.');
+  if ((value.state === 'exchange_may_have_been_sent') !== (value.attemptId !== null)) throw new Error('Invalid refresh attempt marker.');
+  if ((value.state === 'retry_wait') !== (value.retryAt !== null)) throw new Error('Invalid refresh retry marker.');
+  if (value.state === 'removed' && (value.ciphertext !== null || value.owner !== 'none')) throw new Error('A removed grant was retained.');
+  if (value.state === 'legacy_native_pending' && value.owner !== 'legacy_native') throw new Error('A legacy native grant cannot be daemon-owned.');
+  if (value.purpose === 'openai_managed' && value.providerId !== 'openai') throw new Error('OpenAI grant provider mismatch.');
+  if (value.purpose === 'claude_container_setup' && value.owner === 'claude_native') throw new Error('Container setup grant has a native host owner.');
+};
+
+export const assertStoredAuthorityBinding: (value: unknown) => asserts value is IStoredAuthorityBinding = value => {
+  if (!object(value) || !exactKeys(value, ['id', 'accountId', 'grantId', 'runtime', 'scopeId', 'incarnationId',
+    'revision', 'grantAuthorizationGeneration', 'capabilityHash', 'updateId'])
+    || !hash(value.id) || !hash(value.accountId) || !hash(value.grantId)
+    || !['flex', 'codex', 'opencode', 'claude'].includes(String(value.runtime))
+    || !bounded(value.scopeId, 512) || !bounded(value.incarnationId, 256)
+    || !revision(value.revision) || !revision(value.grantAuthorizationGeneration)
+    || !hash(value.capabilityHash)
+    || !uuid(value.updateId)) throw new Error('Invalid authswitch binding record.');
+};
+
+export const assertStoredAuthorityEnrollment: (value: unknown) => asserts value is IStoredAuthorityEnrollment = value => {
+  if (!object(value) || !exactKeys(value, ['id', 'accountId', 'ciphertext', 'revision', 'updateId'])
+    || !hash(value.id) || !hash(value.accountId) || !ciphertext(value.ciphertext) || value.ciphertext === null
+    || !revision(value.revision) || !uuid(value.updateId)) throw new Error('Invalid authswitch enrollment record.');
+};
+
+export const assertStoredAuthorityHandoff: (value: unknown) => asserts value is IStoredAuthorityHandoff = value => {
+  if (!object(value) || !exactKeys(value, ['id', 'accountId', 'grantId', 'nativeHomeId', 'direction', 'phase',
+    'operationId', 'sourceDigest', 'verifiedSourceDigest', 'backupDigest', 'revision', 'statusObservedAt', 'updateId'])
+    || !hash(value.id) || !hash(value.accountId) || !hash(value.grantId) || !hash(value.nativeHomeId)
+    || !['to_native', 'to_daemon'].includes(String(value.direction))
+    || !['prepared', 'source_stopped', 'target_written', 'verified', 'committed', 'needs_reauth', 'aborted'].includes(String(value.phase))
+    || !uuid(value.operationId) || !hash(value.sourceDigest)
+    || (value.verifiedSourceDigest !== null && !hash(value.verifiedSourceDigest))
+    || (value.backupDigest !== null && !hash(value.backupDigest))
+    || !revision(value.revision) || !iso(value.statusObservedAt) || !uuid(value.updateId)) {
+    throw new Error('Invalid authswitch handoff record.');
+  }
+  if (['verified', 'committed'].includes(String(value.phase))
+    && (value.backupDigest === null || value.verifiedSourceDigest === null)) {
+    throw new Error('A verified native handoff requires source and backup proof.');
+  }
+};
+
+export const assertStoredAuthorityMigrationLedger: (value: unknown) => asserts value is IStoredAuthorityMigrationLedger = value => {
+  if (!object(value) || !exactKeys(value, ['id', 'version', 'sourceKind', 'sourcePathHash', 'sourceDigest',
+    'status', 'accountId', 'grantId', 'backupDigest', 'revision', 'statusObservedAt', 'updateId'])
+    || !hash(value.id) || !revision(value.version) || value.version === 0
+    || !['authswitch_stash', 'authswitch_backup', 'agl_flex', 'codex_native', 'opencode_native', 'claude_native'].includes(String(value.sourceKind))
+    || !hash(value.sourcePathHash) || !hash(value.sourceDigest)
+    || !['pending_native_owner', 'prepared', 'verified', 'complete', 'quarantined'].includes(String(value.status))
+    || (value.accountId !== null && !hash(value.accountId))
+    || (value.grantId !== null && !hash(value.grantId))
+    || (value.backupDigest !== null && !hash(value.backupDigest))
+    || !revision(value.revision) || !iso(value.statusObservedAt) || !uuid(value.updateId)) {
+    throw new Error('Invalid authswitch migration ledger record.');
+  }
+};
+
+export const assertStoredAuthorityEvent: (value: unknown) => asserts value is IStoredAuthorityEvent = value => {
+  if (!object(value) || !exactKeys(value, ['id', 'epoch', 'revision', 'kind', 'accountId'])
+    || !uuid(value.id) || !uuid(value.epoch) || !revision(value.revision)
+    || !['account', 'binding'].includes(String(value.kind)) || !hash(value.accountId)) throw new Error('Invalid authswitch event record.');
+};
+
+@plugins.smartdata.managed({ collectionName: 'authswitch_authority_meta' })
+@plugins.smartdata.exactPersistence({ assertDocument: assertStoredAuthorityMeta })
+export class AuthSwitchAuthorityMetaModel extends plugins.smartdata.SmartDataDbDoc<AuthSwitchAuthorityMetaModel, IStoredAuthorityMeta> {
+  declare static exact: plugins.smartdata.TExact<AuthSwitchAuthorityMetaModel>;
+  @plugins.smartdata.unI() public id!: 'authswitch-authority';
+  @plugins.smartdata.svDb() public epoch!: string;
+  @plugins.smartdata.svDb() public revision!: number;
+  @plugins.smartdata.svDb() public updateId!: string;
+}
+
+@plugins.smartdata.compoundIndex({ name: 'authority_account_provider_id', key: { providerId: 1, id: 1 } })
+@plugins.smartdata.managed({ collectionName: 'authswitch_authority_accounts' })
+@plugins.smartdata.exactPersistence({ assertDocument: assertStoredAuthorityAccount })
+export class AuthSwitchAuthorityAccountModel extends plugins.smartdata.SmartDataDbDoc<AuthSwitchAuthorityAccountModel, IStoredAuthorityAccount> {
+  declare static exact: plugins.smartdata.TExact<AuthSwitchAuthorityAccountModel>;
+  @plugins.smartdata.unI() public id!: string;
+  @plugins.smartdata.svDb() public providerId!: string;
+  @plugins.smartdata.svDb() public issuer!: string;
+  @plugins.smartdata.svDb() public subject!: string;
+  @plugins.smartdata.svDb() public workspaceId!: string;
+  @plugins.smartdata.svDb() public label!: string;
+  @plugins.smartdata.svDb() public email!: string | null;
+  @plugins.smartdata.svDb() public plan!: string | null;
+  @plugins.smartdata.svDb() public primaryGrantId!: string | null;
+  @plugins.smartdata.svDb() public removed!: boolean;
+  @plugins.smartdata.svDb() public revision!: number;
+  @plugins.smartdata.svDb() public statusObservedAt!: string;
+  @plugins.smartdata.svDb() public updateId!: string;
+}
+
+@plugins.smartdata.compoundIndex({ name: 'authority_grant_state_id', key: { state: 1, id: 1 } })
+@plugins.smartdata.compoundIndex({ name: 'authority_grant_account_id', key: { accountId: 1, id: 1 } })
+@plugins.smartdata.managed({ collectionName: 'authswitch_authority_grants' })
+@plugins.smartdata.exactPersistence({ assertDocument: assertStoredAuthorityGrant })
+export class AuthSwitchAuthorityGrantModel extends plugins.smartdata.SmartDataDbDoc<AuthSwitchAuthorityGrantModel, IStoredAuthorityGrant> {
+  declare static exact: plugins.smartdata.TExact<AuthSwitchAuthorityGrantModel>;
+  @plugins.smartdata.unI() public id!: string;
+  @plugins.smartdata.svDb() public accountId!: string;
+  @plugins.smartdata.svDb() public providerId!: string;
+  @plugins.smartdata.svDb() public purpose!: TStoredGrantPurpose;
+  @plugins.smartdata.svDb() public audience!: string;
+  @plugins.smartdata.svDb() public state!: IStoredAuthorityGrant['state'];
+  @plugins.smartdata.svDb() public owner!: IStoredAuthorityGrant['owner'];
+  @plugins.smartdata.svDb() public grantGeneration!: number;
+  @plugins.smartdata.svDb() public authorizationGeneration!: number;
+  @plugins.smartdata.svDb() public revision!: number;
+  @plugins.smartdata.svDb() public ciphertext!: string | null;
+  @plugins.smartdata.svDb() public accessExpiresAt!: string | null;
+  @plugins.smartdata.svDb() public attemptId!: string | null;
+  @plugins.smartdata.svDb() public retryAt!: string | null;
+  @plugins.smartdata.svDb() public retryCount!: number;
+  @plugins.smartdata.svDb() public problem!: IStoredAuthorityGrant['problem'];
+  @plugins.smartdata.svDb() public statusObservedAt!: string;
+  @plugins.smartdata.svDb() public updateId!: string;
+}
+
+@plugins.smartdata.compoundIndex({ name: 'authority_binding_account_id', key: { accountId: 1, id: 1 } })
+@plugins.smartdata.managed({ collectionName: 'authswitch_authority_bindings' })
+@plugins.smartdata.exactPersistence({ assertDocument: assertStoredAuthorityBinding })
+export class AuthSwitchAuthorityBindingModel extends plugins.smartdata.SmartDataDbDoc<AuthSwitchAuthorityBindingModel, IStoredAuthorityBinding> {
+  declare static exact: plugins.smartdata.TExact<AuthSwitchAuthorityBindingModel>;
+  @plugins.smartdata.unI() public id!: string;
+  @plugins.smartdata.svDb() public accountId!: string;
+  @plugins.smartdata.svDb() public grantId!: string;
+  @plugins.smartdata.svDb() public runtime!: IStoredAuthorityBinding['runtime'];
+  @plugins.smartdata.svDb() public scopeId!: string;
+  @plugins.smartdata.svDb() public incarnationId!: string;
+  @plugins.smartdata.svDb() public revision!: number;
+  @plugins.smartdata.svDb() public grantAuthorizationGeneration!: number;
+  @plugins.smartdata.svDb() public capabilityHash!: string;
+  @plugins.smartdata.svDb() public updateId!: string;
+}
+
+@plugins.smartdata.compoundIndex({ name: 'authority_enrollment_account_id', key: { accountId: 1, id: 1 } })
+@plugins.smartdata.managed({ collectionName: 'authswitch_authority_enrollments' })
+@plugins.smartdata.exactPersistence({ assertDocument: assertStoredAuthorityEnrollment })
+export class AuthSwitchAuthorityEnrollmentModel extends plugins.smartdata.SmartDataDbDoc<AuthSwitchAuthorityEnrollmentModel, IStoredAuthorityEnrollment> {
+  declare static exact: plugins.smartdata.TExact<AuthSwitchAuthorityEnrollmentModel>;
+  @plugins.smartdata.unI() public id!: string;
+  @plugins.smartdata.svDb() public accountId!: string;
+  @plugins.smartdata.svDb() public ciphertext!: string;
+  @plugins.smartdata.svDb() public revision!: number;
+  @plugins.smartdata.svDb() public updateId!: string;
+}
+
+@plugins.smartdata.compoundIndex({ name: 'authority_handoff_grant_id', key: { grantId: 1, id: 1 } })
+@plugins.smartdata.managed({ collectionName: 'authswitch_authority_handoffs' })
+@plugins.smartdata.exactPersistence({ assertDocument: assertStoredAuthorityHandoff })
+export class AuthSwitchAuthorityHandoffModel extends plugins.smartdata.SmartDataDbDoc<AuthSwitchAuthorityHandoffModel, IStoredAuthorityHandoff> {
+  declare static exact: plugins.smartdata.TExact<AuthSwitchAuthorityHandoffModel>;
+  @plugins.smartdata.unI() public id!: string;
+  @plugins.smartdata.svDb() public accountId!: string;
+  @plugins.smartdata.svDb() public grantId!: string;
+  @plugins.smartdata.svDb() public nativeHomeId!: string;
+  @plugins.smartdata.svDb() public direction!: IStoredAuthorityHandoff['direction'];
+  @plugins.smartdata.svDb() public phase!: IStoredAuthorityHandoff['phase'];
+  @plugins.smartdata.svDb() public operationId!: string;
+  @plugins.smartdata.svDb() public sourceDigest!: string;
+  @plugins.smartdata.svDb() public verifiedSourceDigest!: string | null;
+  @plugins.smartdata.svDb() public backupDigest!: string | null;
+  @plugins.smartdata.svDb() public revision!: number;
+  @plugins.smartdata.svDb() public statusObservedAt!: string;
+  @plugins.smartdata.svDb() public updateId!: string;
+}
+
+@plugins.smartdata.compoundIndex({ name: 'authority_migration_status_id', key: { status: 1, id: 1 } })
+@plugins.smartdata.managed({ collectionName: 'authswitch_authority_migration_ledger' })
+@plugins.smartdata.exactPersistence({ assertDocument: assertStoredAuthorityMigrationLedger })
+export class AuthSwitchAuthorityMigrationLedgerModel extends plugins.smartdata.SmartDataDbDoc<AuthSwitchAuthorityMigrationLedgerModel, IStoredAuthorityMigrationLedger> {
+  declare static exact: plugins.smartdata.TExact<AuthSwitchAuthorityMigrationLedgerModel>;
+  @plugins.smartdata.unI() public id!: string;
+  @plugins.smartdata.svDb() public version!: number;
+  @plugins.smartdata.svDb() public sourceKind!: IStoredAuthorityMigrationLedger['sourceKind'];
+  @plugins.smartdata.svDb() public sourcePathHash!: string;
+  @plugins.smartdata.svDb() public sourceDigest!: string;
+  @plugins.smartdata.svDb() public status!: IStoredAuthorityMigrationLedger['status'];
+  @plugins.smartdata.svDb() public accountId!: string | null;
+  @plugins.smartdata.svDb() public grantId!: string | null;
+  @plugins.smartdata.svDb() public backupDigest!: string | null;
+  @plugins.smartdata.svDb() public revision!: number;
+  @plugins.smartdata.svDb() public statusObservedAt!: string;
+  @plugins.smartdata.svDb() public updateId!: string;
+}
+
+@plugins.smartdata.compoundIndex({ name: 'authority_event_revision_id', key: { revision: 1, id: 1 } })
+@plugins.smartdata.managed({ collectionName: 'authswitch_authority_events' })
+@plugins.smartdata.exactPersistence({ assertDocument: assertStoredAuthorityEvent })
+export class AuthSwitchAuthorityEventModel extends plugins.smartdata.SmartDataDbDoc<AuthSwitchAuthorityEventModel, IStoredAuthorityEvent> {
+  declare static exact: plugins.smartdata.TExact<AuthSwitchAuthorityEventModel>;
+  @plugins.smartdata.unI() public id!: string;
+  @plugins.smartdata.svDb() public epoch!: string;
+  @plugins.smartdata.svDb() public revision!: number;
+  @plugins.smartdata.svDb() public kind!: IStoredAuthorityEvent['kind'];
+  @plugins.smartdata.svDb() public accountId!: string;
+}

package/ts/classes.authoritysecrets.ts

@@ -0,0 +1,27 @@
+import * as plugins from './plugins.js';
+
+export interface IAuthSwitchSecretCodec {
+  seal(accountId: string, plaintext: Uint8Array): Promise<string>;
+  unseal(accountId: string, ciphertext: string): Promise<Uint8Array>;
+}
+
+const secretName = (accountId: string): string => {
+  if (!/^[a-f0-9]{64}$/.test(accountId)) throw new Error('Invalid account identity for secret custody.');
+  return `authswitch.account.${accountId}`;
+};
+
+/** TPM-sealed byte payloads live only as ciphertext in SmartData. */
+export class AuthSwitchTpmSecretCodec implements IAuthSwitchSecretCodec {
+  public async seal(accountId: string, plaintext: Uint8Array): Promise<string> {
+    const ciphertext = await plugins.smartsecret.sealSmartSecretTpm2Credential(secretName(accountId), plaintext);
+    try { return Buffer.from(ciphertext).toString('base64url'); }
+    finally { ciphertext.fill(0); }
+  }
+
+  public async unseal(accountId: string, ciphertext: string): Promise<Uint8Array> {
+    if (!/^[A-Za-z0-9_-]{1,131072}$/.test(ciphertext)) throw new Error('Invalid sealed account credential.');
+    const bytes = Buffer.from(ciphertext, 'base64url');
+    try { return await plugins.smartsecret.unsealSmartSecretTpm2Credential(secretName(accountId), bytes); }
+    finally { bytes.fill(0); }
+  }
+}

package/ts/classes.authorityservice.ts

@@ -0,0 +1,83 @@
+import * as plugins from './plugins.js';
+import { AuthSwitchAuthorityDaemon } from './classes.authoritydaemon.js';
+
+export interface IAuthSwitchAuthorityPaths {
+  runtimeDirectory: string;
+  dataDirectory: string;
+  databaseSocketPath: string;
+  authoritySocketPath: string;
+  runtimeSocketPath: string;
+  runtimeSocketDirectory: string;
+}
+
+/** Canonical per-user paths. An explicit runtime directory is also usable by a trusted container host. */
+export const resolveAuthSwitchAuthorityPaths = (runtimeDirectory = process.env.XDG_RUNTIME_DIR): IAuthSwitchAuthorityPaths => {
+  if (!runtimeDirectory || !plugins.path.isAbsolute(runtimeDirectory)) {
+    throw new Error('A private XDG_RUNTIME_DIR is required for authswitch authority.');
+  }
+  const home = plugins.os.userInfo().homedir;
+  const dataHome = process.env.XDG_DATA_HOME || plugins.path.join(home, '.local/share');
+  if (!plugins.path.isAbsolute(dataHome)) throw new Error('XDG_DATA_HOME must be an absolute path.');
+  const socketDirectory = plugins.path.join(runtimeDirectory, 'authswitch');
+  const runtimeSocketDirectory = plugins.path.join(socketDirectory, 'runtime');
+  return {
+    runtimeDirectory,
+    dataDirectory: plugins.path.join(dataHome, 'authswitch', 'authority'),
+    databaseSocketPath: plugins.path.join(socketDirectory, 'internal', 'db.sock'),
+    authoritySocketPath: plugins.path.join(socketDirectory, 'management', 'authority.sock'),
+    runtimeSocketPath: plugins.path.join(runtimeSocketDirectory, 'runtime.sock'),
+    runtimeSocketDirectory,
+  };
+};
+
+/** Explicit installer and lifecycle operations for a user-scoped systemd service. */
+export class AuthSwitchAuthorityService {
+  public readonly unit: plugins.smartdaemon.SystemdUnit;
+  public readonly unitFile: plugins.smartdaemon.SystemdUnitFile;
+  public readonly definition: plugins.smartdaemon.SystemdServiceDefinition;
+
+  constructor(runtimeDirectory: string, unitDirectory?: string) {
+    const packageRoot = plugins.path.dirname(plugins.path.dirname(plugins.fileURLToPath(import.meta.url)));
+    const options = { unitName: 'authswitch-authority.service', scope: 'user' as const, runtimeDirectory };
+    this.unit = new plugins.smartdaemon.SystemdUnit(options);
+    this.unitFile = new plugins.smartdaemon.SystemdUnitFile({ ...options, unitDirectory });
+    this.definition = new plugins.smartdaemon.SystemdServiceDefinition({
+      unitName: options.unitName, scope: 'user', description: 'Authswitch account authority', executable: process.execPath,
+      args: [plugins.path.join(packageRoot, 'cli.js'), 'authority', 'daemon'],
+      workingDirectory: packageRoot, restart: 'on-failure', killMode: 'mixed', timeoutStopSeconds: 60,
+    });
+  }
+
+  public async install(): Promise<Readonly<{ changed: boolean; masked: boolean; sha256: string }>> {
+    const previous = await this.unitFile.inspect();
+    const result = await this.unitFile.install(this.definition, previous?.sha256 ?? null);
+    return { changed: result.changed, masked: result.masked, sha256: result.record.sha256 };
+  }
+
+  public inspect(): Promise<plugins.smartdaemon.ISystemdUnitState> { return this.unit.inspect(); }
+  public enable(): Promise<plugins.smartdaemon.ISystemdUnitState> { return this.unit.enable(); }
+  public start(): Promise<plugins.smartdaemon.ISystemdUnitState> { return this.unit.start(); }
+  public stop(): Promise<plugins.smartdaemon.ISystemdUnitState> { return this.unit.stop(); }
+}
+
+export const runAuthSwitchAuthorityDaemon = async (paths = resolveAuthSwitchAuthorityPaths()): Promise<void> => {
+  const daemon = new AuthSwitchAuthorityDaemon({
+    dataDirectory: paths.dataDirectory,
+    socketPath: paths.databaseSocketPath,
+    authoritySocketPath: paths.authoritySocketPath,
+    runtimeSocketPath: paths.runtimeSocketPath,
+  });
+  await daemon.start();
+  await new Promise<void>((resolve, reject) => {
+    let stopping = false;
+    const stop = () => {
+      if (stopping) return;
+      stopping = true;
+      process.off('SIGINT', stop);
+      process.off('SIGTERM', stop);
+      void daemon.close().then(resolve, reject);
+    };
+    process.on('SIGINT', stop);
+    process.on('SIGTERM', stop);
+  });
+};