@modelprofile.com/authswitch 6.2.0 → 6.4.0

package/dist_ts/classes.authoritysecrets.d.ts

@@ -0,0 +1,9 @@
+export interface IAuthSwitchSecretCodec {
+    seal(accountId: string, plaintext: Uint8Array): Promise<string>;
+    unseal(accountId: string, ciphertext: string): Promise<Uint8Array>;
+}
+/** TPM-sealed byte payloads live only as ciphertext in SmartData. */
+export declare class AuthSwitchTpmSecretCodec implements IAuthSwitchSecretCodec {
+    seal(accountId: string, plaintext: Uint8Array): Promise<string>;
+    unseal(accountId: string, ciphertext: string): Promise<Uint8Array>;
+}

package/dist_ts/classes.authoritysecrets.js

@@ -0,0 +1,30 @@
+import * as plugins from './plugins.js';
+const secretName = (accountId) => {
+    if (!/^[a-f0-9]{64}$/.test(accountId))
+        throw new Error('Invalid account identity for secret custody.');
+    return `authswitch.account.${accountId}`;
+};
+/** TPM-sealed byte payloads live only as ciphertext in SmartData. */
+export class AuthSwitchTpmSecretCodec {
+    async seal(accountId, plaintext) {
+        const ciphertext = await plugins.smartsecret.sealSmartSecretTpm2Credential(secretName(accountId), plaintext);
+        try {
+            return Buffer.from(ciphertext).toString('base64url');
+        }
+        finally {
+            ciphertext.fill(0);
+        }
+    }
+    async unseal(accountId, ciphertext) {
+        if (!/^[A-Za-z0-9_-]{1,131072}$/.test(ciphertext))
+            throw new Error('Invalid sealed account credential.');
+        const bytes = Buffer.from(ciphertext, 'base64url');
+        try {
+            return await plugins.smartsecret.unsealSmartSecretTpm2Credential(secretName(accountId), bytes);
+        }
+        finally {
+            bytes.fill(0);
+        }
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5hdXRob3JpdHlzZWNyZXRzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvY2xhc3Nlcy5hdXRob3JpdHlzZWNyZXRzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sY0FBYyxDQUFDO0FBT3hDLE1BQU0sVUFBVSxHQUFHLENBQUMsU0FBaUIsRUFBVSxFQUFFO0lBQy9DLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDO1FBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyw4Q0FBOEMsQ0FBQyxDQUFDO0lBQ3ZHLE9BQU8sc0JBQXNCLFNBQVMsRUFBRSxDQUFDO0FBQzNDLENBQUMsQ0FBQztBQUVGLHFFQUFxRTtBQUNyRSxNQUFNLE9BQU8sd0JBQXdCO0lBQzVCLEtBQUssQ0FBQyxJQUFJLENBQUMsU0FBaUIsRUFBRSxTQUFxQjtRQUN4RCxNQUFNLFVBQVUsR0FBRyxNQUFNLE9BQU8sQ0FBQyxXQUFXLENBQUMsNkJBQTZCLENBQUMsVUFBVSxDQUFDLFNBQVMsQ0FBQyxFQUFFLFNBQVMsQ0FBQyxDQUFDO1FBQzdHLElBQUksQ0FBQztZQUFDLE9BQU8sTUFBTSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLENBQUM7UUFBQyxDQUFDO2dCQUNyRCxDQUFDO1lBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUFDLENBQUM7SUFDakMsQ0FBQztJQUVNLEtBQUssQ0FBQyxNQUFNLENBQUMsU0FBaUIsRUFBRSxVQUFrQjtRQUN2RCxJQUFJLENBQUMsMkJBQTJCLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQztZQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsb0NBQW9DLENBQUMsQ0FBQztRQUN6RyxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxXQUFXLENBQUMsQ0FBQztRQUNuRCxJQUFJLENBQUM7WUFBQyxPQUFPLE1BQU0sT0FBTyxDQUFDLFdBQVcsQ0FBQywrQkFBK0IsQ0FBQyxVQUFVLENBQUMsU0FBUyxDQUFDLEVBQUUsS0FBSyxDQUFDLENBQUM7UUFBQyxDQUFDO2dCQUMvRixDQUFDO1lBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUFDLENBQUM7SUFDNUIsQ0FBQztDQUNGIn0=

package/dist_ts/classes.authorityservice.d.ts

@@ -0,0 +1,28 @@
+import * as plugins from './plugins.js';
+export interface IAuthSwitchAuthorityPaths {
+    runtimeDirectory: string;
+    dataDirectory: string;
+    databaseSocketPath: string;
+    authoritySocketPath: string;
+    runtimeSocketPath: string;
+    runtimeSocketDirectory: string;
+}
+/** Canonical per-user paths. An explicit runtime directory is also usable by a trusted container host. */
+export declare const resolveAuthSwitchAuthorityPaths: (runtimeDirectory?: string | undefined) => IAuthSwitchAuthorityPaths;
+/** Explicit installer and lifecycle operations for a user-scoped systemd service. */
+export declare class AuthSwitchAuthorityService {
+    readonly unit: plugins.smartdaemon.SystemdUnit;
+    readonly unitFile: plugins.smartdaemon.SystemdUnitFile;
+    readonly definition: plugins.smartdaemon.SystemdServiceDefinition;
+    constructor(runtimeDirectory: string, unitDirectory?: string);
+    install(): Promise<Readonly<{
+        changed: boolean;
+        masked: boolean;
+        sha256: string;
+    }>>;
+    inspect(): Promise<plugins.smartdaemon.ISystemdUnitState>;
+    enable(): Promise<plugins.smartdaemon.ISystemdUnitState>;
+    start(): Promise<plugins.smartdaemon.ISystemdUnitState>;
+    stop(): Promise<plugins.smartdaemon.ISystemdUnitState>;
+}
+export declare const runAuthSwitchAuthorityDaemon: (paths?: IAuthSwitchAuthorityPaths) => Promise<void>;

package/dist_ts/classes.authorityservice.js

@@ -0,0 +1,71 @@
+import * as plugins from './plugins.js';
+import { AuthSwitchAuthorityDaemon } from './classes.authoritydaemon.js';
+/** Canonical per-user paths. An explicit runtime directory is also usable by a trusted container host. */
+export const resolveAuthSwitchAuthorityPaths = (runtimeDirectory = process.env.XDG_RUNTIME_DIR) => {
+    if (!runtimeDirectory || !plugins.path.isAbsolute(runtimeDirectory)) {
+        throw new Error('A private XDG_RUNTIME_DIR is required for authswitch authority.');
+    }
+    const home = plugins.os.userInfo().homedir;
+    const dataHome = process.env.XDG_DATA_HOME || plugins.path.join(home, '.local/share');
+    if (!plugins.path.isAbsolute(dataHome))
+        throw new Error('XDG_DATA_HOME must be an absolute path.');
+    const socketDirectory = plugins.path.join(runtimeDirectory, 'authswitch');
+    const runtimeSocketDirectory = plugins.path.join(socketDirectory, 'runtime');
+    return {
+        runtimeDirectory,
+        dataDirectory: plugins.path.join(dataHome, 'authswitch', 'authority'),
+        databaseSocketPath: plugins.path.join(socketDirectory, 'internal', 'db.sock'),
+        authoritySocketPath: plugins.path.join(socketDirectory, 'management', 'authority.sock'),
+        runtimeSocketPath: plugins.path.join(runtimeSocketDirectory, 'runtime.sock'),
+        runtimeSocketDirectory,
+    };
+};
+/** Explicit installer and lifecycle operations for a user-scoped systemd service. */
+export class AuthSwitchAuthorityService {
+    unit;
+    unitFile;
+    definition;
+    constructor(runtimeDirectory, unitDirectory) {
+        const packageRoot = plugins.path.dirname(plugins.path.dirname(plugins.fileURLToPath(import.meta.url)));
+        const options = { unitName: 'authswitch-authority.service', scope: 'user', runtimeDirectory };
+        this.unit = new plugins.smartdaemon.SystemdUnit(options);
+        this.unitFile = new plugins.smartdaemon.SystemdUnitFile({ ...options, unitDirectory });
+        this.definition = new plugins.smartdaemon.SystemdServiceDefinition({
+            unitName: options.unitName, scope: 'user', description: 'Authswitch account authority', executable: process.execPath,
+            args: [plugins.path.join(packageRoot, 'cli.js'), 'authority', 'daemon'],
+            workingDirectory: packageRoot, restart: 'on-failure', killMode: 'mixed', timeoutStopSeconds: 60,
+        });
+    }
+    async install() {
+        const previous = await this.unitFile.inspect();
+        const result = await this.unitFile.install(this.definition, previous?.sha256 ?? null);
+        return { changed: result.changed, masked: result.masked, sha256: result.record.sha256 };
+    }
+    inspect() { return this.unit.inspect(); }
+    enable() { return this.unit.enable(); }
+    start() { return this.unit.start(); }
+    stop() { return this.unit.stop(); }
+}
+export const runAuthSwitchAuthorityDaemon = async (paths = resolveAuthSwitchAuthorityPaths()) => {
+    const daemon = new AuthSwitchAuthorityDaemon({
+        dataDirectory: paths.dataDirectory,
+        socketPath: paths.databaseSocketPath,
+        authoritySocketPath: paths.authoritySocketPath,
+        runtimeSocketPath: paths.runtimeSocketPath,
+    });
+    await daemon.start();
+    await new Promise((resolve, reject) => {
+        let stopping = false;
+        const stop = () => {
+            if (stopping)
+                return;
+            stopping = true;
+            process.off('SIGINT', stop);
+            process.off('SIGTERM', stop);
+            void daemon.close().then(resolve, reject);
+        };
+        process.on('SIGINT', stop);
+        process.on('SIGTERM', stop);
+    });
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5hdXRob3JpdHlzZXJ2aWNlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvY2xhc3Nlcy5hdXRob3JpdHlzZXJ2aWNlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sY0FBYyxDQUFDO0FBQ3hDLE9BQU8sRUFBRSx5QkFBeUIsRUFBRSxNQUFNLDhCQUE4QixDQUFDO0FBV3pFLDBHQUEwRztBQUMxRyxNQUFNLENBQUMsTUFBTSwrQkFBK0IsR0FBRyxDQUFDLGdCQUFnQixHQUFHLE9BQU8sQ0FBQyxHQUFHLENBQUMsZUFBZSxFQUE2QixFQUFFO0lBQzNILElBQUksQ0FBQyxnQkFBZ0IsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLGdCQUFnQixDQUFDLEVBQUUsQ0FBQztRQUNwRSxNQUFNLElBQUksS0FBSyxDQUFDLGlFQUFpRSxDQUFDLENBQUM7SUFDckYsQ0FBQztJQUNELE1BQU0sSUFBSSxHQUFHLE9BQU8sQ0FBQyxFQUFFLENBQUMsUUFBUSxFQUFFLENBQUMsT0FBTyxDQUFDO0lBQzNDLE1BQU0sUUFBUSxHQUFHLE9BQU8sQ0FBQyxHQUFHLENBQUMsYUFBYSxJQUFJLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRSxjQUFjLENBQUMsQ0FBQztJQUN0RixJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDO1FBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyx5Q0FBeUMsQ0FBQyxDQUFDO0lBQ25HLE1BQU0sZUFBZSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLGdCQUFnQixFQUFFLFlBQVksQ0FBQyxDQUFDO0lBQzFFLE1BQU0sc0JBQXNCLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsZUFBZSxFQUFFLFNBQVMsQ0FBQyxDQUFDO0lBQzdFLE9BQU87UUFDTCxnQkFBZ0I7UUFDaEIsYUFBYSxFQUFFLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxZQUFZLEVBQUUsV0FBVyxDQUFDO1FBQ3JFLGtCQUFrQixFQUFFLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLGVBQWUsRUFBRSxVQUFVLEVBQUUsU0FBUyxDQUFDO1FBQzdFLG1CQUFtQixFQUFFLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLGVBQWUsRUFBRSxZQUFZLEVBQUUsZ0JBQWdCLENBQUM7UUFDdkYsaUJBQWlCLEVBQUUsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsc0JBQXNCLEVBQUUsY0FBYyxDQUFDO1FBQzVFLHNCQUFzQjtLQUN2QixDQUFDO0FBQ0osQ0FBQyxDQUFDO0FBRUYscUZBQXFGO0FBQ3JGLE1BQU0sT0FBTywwQkFBMEI7SUFDckIsSUFBSSxDQUFrQztJQUN0QyxRQUFRLENBQXNDO0lBQzlDLFVBQVUsQ0FBK0M7SUFFekUsWUFBWSxnQkFBd0IsRUFBRSxhQUFzQjtRQUMxRCxNQUFNLFdBQVcsR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsYUFBYSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ3ZHLE1BQU0sT0FBTyxHQUFHLEVBQUUsUUFBUSxFQUFFLDhCQUE4QixFQUFFLEtBQUssRUFBRSxNQUFlLEVBQUUsZ0JBQWdCLEVBQUUsQ0FBQztRQUN2RyxJQUFJLENBQUMsSUFBSSxHQUFHLElBQUksT0FBTyxDQUFDLFdBQVcsQ0FBQyxXQUFXLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDekQsSUFBSSxDQUFDLFFBQVEsR0FBRyxJQUFJLE9BQU8sQ0FBQyxXQUFXLENBQUMsZUFBZSxDQUFDLEVBQUUsR0FBRyxPQUFPLEVBQUUsYUFBYSxFQUFFLENBQUMsQ0FBQztRQUN2RixJQUFJLENBQUMsVUFBVSxHQUFHLElBQUksT0FBTyxDQUFDLFdBQVcsQ0FBQyx3QkFBd0IsQ0FBQztZQUNqRSxRQUFRLEVBQUUsT0FBTyxDQUFDLFFBQVEsRUFBRSxLQUFLLEVBQUUsTUFBTSxFQUFFLFdBQVcsRUFBRSw4QkFBOEIsRUFBRSxVQUFVLEVBQUUsT0FBTyxDQUFDLFFBQVE7WUFDcEgsSUFBSSxFQUFFLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsV0FBVyxFQUFFLFFBQVEsQ0FBQyxFQUFFLFdBQVcsRUFBRSxRQUFRLENBQUM7WUFDdkUsZ0JBQWdCLEVBQUUsV0FBVyxFQUFFLE9BQU8sRUFBRSxZQUFZLEVBQUUsUUFBUSxFQUFFLE9BQU8sRUFBRSxrQkFBa0IsRUFBRSxFQUFFO1NBQ2hHLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFTSxLQUFLLENBQUMsT0FBTztRQUNsQixNQUFNLFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQyxRQUFRLENBQUMsT0FBTyxFQUFFLENBQUM7UUFDL0MsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLFFBQVEsRUFBRSxNQUFNLElBQUksSUFBSSxDQUFDLENBQUM7UUFDdEYsT0FBTyxFQUFFLE9BQU8sRUFBRSxNQUFNLENBQUMsT0FBTyxFQUFFLE1BQU0sRUFBRSxNQUFNLENBQUMsTUFBTSxFQUFFLE1BQU0sRUFBRSxNQUFNLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxDQUFDO0lBQzFGLENBQUM7SUFFTSxPQUFPLEtBQXFELE9BQU8sSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDLENBQUM7SUFDekYsTUFBTSxLQUFxRCxPQUFPLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQyxDQUFDO0lBQ3ZGLEtBQUssS0FBcUQsT0FBTyxJQUFJLENBQUMsSUFBSSxDQUFDLEtBQUssRUFBRSxDQUFDLENBQUMsQ0FBQztJQUNyRixJQUFJLEtBQXFELE9BQU8sSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDLENBQUM7Q0FDM0Y7QUFFRCxNQUFNLENBQUMsTUFBTSw0QkFBNEIsR0FBRyxLQUFLLEVBQUUsS0FBSyxHQUFHLCtCQUErQixFQUFFLEVBQWlCLEVBQUU7SUFDN0csTUFBTSxNQUFNLEdBQUcsSUFBSSx5QkFBeUIsQ0FBQztRQUMzQyxhQUFhLEVBQUUsS0FBSyxDQUFDLGFBQWE7UUFDbEMsVUFBVSxFQUFFLEtBQUssQ0FBQyxrQkFBa0I7UUFDcEMsbUJBQW1CLEVBQUUsS0FBSyxDQUFDLG1CQUFtQjtRQUM5QyxpQkFBaUIsRUFBRSxLQUFLLENBQUMsaUJBQWlCO0tBQzNDLENBQUMsQ0FBQztJQUNILE1BQU0sTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDO0lBQ3JCLE1BQU0sSUFBSSxPQUFPLENBQU8sQ0FBQyxPQUFPLEVBQUUsTUFBTSxFQUFFLEVBQUU7UUFDMUMsSUFBSSxRQUFRLEdBQUcsS0FBSyxDQUFDO1FBQ3JCLE1BQU0sSUFBSSxHQUFHLEdBQUcsRUFBRTtZQUNoQixJQUFJLFFBQVE7Z0JBQUUsT0FBTztZQUNyQixRQUFRLEdBQUcsSUFBSSxDQUFDO1lBQ2hCLE9BQU8sQ0FBQyxHQUFHLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxDQUFDO1lBQzVCLE9BQU8sQ0FBQyxHQUFHLENBQUMsU0FBUyxFQUFFLElBQUksQ0FBQyxDQUFDO1lBQzdCLEtBQUssTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsTUFBTSxDQUFDLENBQUM7UUFDNUMsQ0FBQyxDQUFDO1FBQ0YsT0FBTyxDQUFDLEVBQUUsQ0FBQyxRQUFRLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDM0IsT0FBTyxDQUFDLEVBQUUsQ0FBQyxTQUFTLEVBQUUsSUFBSSxDQUFDLENBQUM7SUFDOUIsQ0FBQyxDQUFDLENBQUM7QUFDTCxDQUFDLENBQUMifQ==

package/dist_ts/classes.cli.d.ts

@@ -28,7 +28,55 @@ export declare class AuthSwitchCli {
      */
     private settleRunningInstances;
     private commandLogin;
+    /**
+     * Send the preuse prompt through one named account, through an account chosen here, or through every
+     * account of the harness.
+     *
+     * `--all` walks the harness's own account list, one request at a time, and ends with a table of what
+     * each account did; a single named account keeps its own contract, in which anything but a completed
+     * prompt is a failure. Neither form switches, refreshes or writes a login.
+     */
     private commandPreuse;
+    /**
+     * The account picker `preuse` shows without an account reference: one account, all of them, or Back.
+     *
+     * Choosing one account here is that account's consent, exactly as naming it on the command line is, and
+     * it keeps that command's contract. Choosing all of them spends quota on accounts the chooser did not
+     * name, so that answer is confirmed once and then runs as `--all` does, table and exit status included.
+     */
+    private preuseFromPicker;
+    /**
+     * The choices an interactive preuse offers: every account, one of them, or Back.
+     *
+     * The guide and the bare `preuse` command offer the same list with the same wording. An account id is an
+     * opaque string, so every choice says which kind of answer it carries instead of relying on a sentinel an
+     * id could collide with. A single account is offered alone: "all" of one account is that same account.
+     */
+    private preuseChoices;
+    /** The accounts an answer names; empty when the chosen account is no longer there. */
+    private preuseSelection;
+    /** One confirmation, naming what the prompt goes to and that it consumes quota. */
+    private confirmPreuse;
+    /**
+     * One preuse run and its report, for the command line and for the guide.
+     *
+     * Ctrl+C aborts the run: the account in flight is reported as interrupted and no further account is
+     * started, because a prompt that may already have been sent is never repeated. The exit status is 130
+     * for an interrupted run, 1 when an account failed -- and, for a single named account, when it was
+     * refused -- and 0 otherwise. Usage errors return 2 before anything reaches this.
+     */
+    private runPreuse;
+    /** One line per event; a run over several accounts numbers each account as it starts. */
+    private writePreuseEvent;
+    /**
+     * The reset schedule one completed prompt reported.
+     *
+     * Once inference completes, a schedule that could not be read or displayed is reported as exactly that:
+     * a completed prompt is never repeated over a lookup or presentation failure.
+     */
+    private writePreuseSchedule;
+    /** What every account of a run did, in one table. The rows repeat readings the run already took. */
+    private writePreuseSummary;
     /**
      * Watch usage and switch automatically; see `AuthSwitchWatch`. SIGINT and SIGTERM end it cleanly with status 0.
      * `--once` runs one check and exits 1 when a switch it attempted did not complete.
@@ -39,6 +87,14 @@ export declare class AuthSwitchCli {
     /** Offer a verified save before presenting the switch picker; declining never switches. */
     private offerToSave;
     private runHarnessGuide;
+    /**
+     * Preuse from the guide: one account or all of them, confirmed once before anything is sent.
+     *
+     * The prompt consumes quota, so the confirmation names what it will be sent to, and Back or a declined
+     * confirmation returns to the menu having sent nothing. A refusal an adapter states is not a guide
+     * failure, so the guide stays open; a failed prompt ends it, as every other failed action does.
+     */
+    private guidePreuse;
     private printCurrent;
     private selectActive;
     private reportOutcome;