@modelprofile.com/authswitch 6.3.0 → 6.4.0

package/dist_ts/classes.authoritysecrets.d.ts

@@ -0,0 +1,9 @@
+export interface IAuthSwitchSecretCodec {
+    seal(accountId: string, plaintext: Uint8Array): Promise<string>;
+    unseal(accountId: string, ciphertext: string): Promise<Uint8Array>;
+}
+/** TPM-sealed byte payloads live only as ciphertext in SmartData. */
+export declare class AuthSwitchTpmSecretCodec implements IAuthSwitchSecretCodec {
+    seal(accountId: string, plaintext: Uint8Array): Promise<string>;
+    unseal(accountId: string, ciphertext: string): Promise<Uint8Array>;
+}

package/dist_ts/classes.authoritysecrets.js

@@ -0,0 +1,30 @@
+import * as plugins from './plugins.js';
+const secretName = (accountId) => {
+    if (!/^[a-f0-9]{64}$/.test(accountId))
+        throw new Error('Invalid account identity for secret custody.');
+    return `authswitch.account.${accountId}`;
+};
+/** TPM-sealed byte payloads live only as ciphertext in SmartData. */
+export class AuthSwitchTpmSecretCodec {
+    async seal(accountId, plaintext) {
+        const ciphertext = await plugins.smartsecret.sealSmartSecretTpm2Credential(secretName(accountId), plaintext);
+        try {
+            return Buffer.from(ciphertext).toString('base64url');
+        }
+        finally {
+            ciphertext.fill(0);
+        }
+    }
+    async unseal(accountId, ciphertext) {
+        if (!/^[A-Za-z0-9_-]{1,131072}$/.test(ciphertext))
+            throw new Error('Invalid sealed account credential.');
+        const bytes = Buffer.from(ciphertext, 'base64url');
+        try {
+            return await plugins.smartsecret.unsealSmartSecretTpm2Credential(secretName(accountId), bytes);
+        }
+        finally {
+            bytes.fill(0);
+        }
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5hdXRob3JpdHlzZWNyZXRzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvY2xhc3Nlcy5hdXRob3JpdHlzZWNyZXRzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sY0FBYyxDQUFDO0FBT3hDLE1BQU0sVUFBVSxHQUFHLENBQUMsU0FBaUIsRUFBVSxFQUFFO0lBQy9DLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDO1FBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyw4Q0FBOEMsQ0FBQyxDQUFDO0lBQ3ZHLE9BQU8sc0JBQXNCLFNBQVMsRUFBRSxDQUFDO0FBQzNDLENBQUMsQ0FBQztBQUVGLHFFQUFxRTtBQUNyRSxNQUFNLE9BQU8sd0JBQXdCO0lBQzVCLEtBQUssQ0FBQyxJQUFJLENBQUMsU0FBaUIsRUFBRSxTQUFxQjtRQUN4RCxNQUFNLFVBQVUsR0FBRyxNQUFNLE9BQU8sQ0FBQyxXQUFXLENBQUMsNkJBQTZCLENBQUMsVUFBVSxDQUFDLFNBQVMsQ0FBQyxFQUFFLFNBQVMsQ0FBQyxDQUFDO1FBQzdHLElBQUksQ0FBQztZQUFDLE9BQU8sTUFBTSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLENBQUM7UUFBQyxDQUFDO2dCQUNyRCxDQUFDO1lBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUFDLENBQUM7SUFDakMsQ0FBQztJQUVNLEtBQUssQ0FBQyxNQUFNLENBQUMsU0FBaUIsRUFBRSxVQUFrQjtRQUN2RCxJQUFJLENBQUMsMkJBQTJCLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQztZQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsb0NBQW9DLENBQUMsQ0FBQztRQUN6RyxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxXQUFXLENBQUMsQ0FBQztRQUNuRCxJQUFJLENBQUM7WUFBQyxPQUFPLE1BQU0sT0FBTyxDQUFDLFdBQVcsQ0FBQywrQkFBK0IsQ0FBQyxVQUFVLENBQUMsU0FBUyxDQUFDLEVBQUUsS0FBSyxDQUFDLENBQUM7UUFBQyxDQUFDO2dCQUMvRixDQUFDO1lBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUFDLENBQUM7SUFDNUIsQ0FBQztDQUNGIn0=

package/dist_ts/classes.authorityservice.d.ts

@@ -0,0 +1,28 @@
+import * as plugins from './plugins.js';
+export interface IAuthSwitchAuthorityPaths {
+    runtimeDirectory: string;
+    dataDirectory: string;
+    databaseSocketPath: string;
+    authoritySocketPath: string;
+    runtimeSocketPath: string;
+    runtimeSocketDirectory: string;
+}
+/** Canonical per-user paths. An explicit runtime directory is also usable by a trusted container host. */
+export declare const resolveAuthSwitchAuthorityPaths: (runtimeDirectory?: string | undefined) => IAuthSwitchAuthorityPaths;
+/** Explicit installer and lifecycle operations for a user-scoped systemd service. */
+export declare class AuthSwitchAuthorityService {
+    readonly unit: plugins.smartdaemon.SystemdUnit;
+    readonly unitFile: plugins.smartdaemon.SystemdUnitFile;
+    readonly definition: plugins.smartdaemon.SystemdServiceDefinition;
+    constructor(runtimeDirectory: string, unitDirectory?: string);
+    install(): Promise<Readonly<{
+        changed: boolean;
+        masked: boolean;
+        sha256: string;
+    }>>;
+    inspect(): Promise<plugins.smartdaemon.ISystemdUnitState>;
+    enable(): Promise<plugins.smartdaemon.ISystemdUnitState>;
+    start(): Promise<plugins.smartdaemon.ISystemdUnitState>;
+    stop(): Promise<plugins.smartdaemon.ISystemdUnitState>;
+}
+export declare const runAuthSwitchAuthorityDaemon: (paths?: IAuthSwitchAuthorityPaths) => Promise<void>;

package/dist_ts/classes.authorityservice.js

@@ -0,0 +1,71 @@
+import * as plugins from './plugins.js';
+import { AuthSwitchAuthorityDaemon } from './classes.authoritydaemon.js';
+/** Canonical per-user paths. An explicit runtime directory is also usable by a trusted container host. */
+export const resolveAuthSwitchAuthorityPaths = (runtimeDirectory = process.env.XDG_RUNTIME_DIR) => {
+    if (!runtimeDirectory || !plugins.path.isAbsolute(runtimeDirectory)) {
+        throw new Error('A private XDG_RUNTIME_DIR is required for authswitch authority.');
+    }
+    const home = plugins.os.userInfo().homedir;
+    const dataHome = process.env.XDG_DATA_HOME || plugins.path.join(home, '.local/share');
+    if (!plugins.path.isAbsolute(dataHome))
+        throw new Error('XDG_DATA_HOME must be an absolute path.');
+    const socketDirectory = plugins.path.join(runtimeDirectory, 'authswitch');
+    const runtimeSocketDirectory = plugins.path.join(socketDirectory, 'runtime');
+    return {
+        runtimeDirectory,
+        dataDirectory: plugins.path.join(dataHome, 'authswitch', 'authority'),
+        databaseSocketPath: plugins.path.join(socketDirectory, 'internal', 'db.sock'),
+        authoritySocketPath: plugins.path.join(socketDirectory, 'management', 'authority.sock'),
+        runtimeSocketPath: plugins.path.join(runtimeSocketDirectory, 'runtime.sock'),
+        runtimeSocketDirectory,
+    };
+};
+/** Explicit installer and lifecycle operations for a user-scoped systemd service. */
+export class AuthSwitchAuthorityService {
+    unit;
+    unitFile;
+    definition;
+    constructor(runtimeDirectory, unitDirectory) {
+        const packageRoot = plugins.path.dirname(plugins.path.dirname(plugins.fileURLToPath(import.meta.url)));
+        const options = { unitName: 'authswitch-authority.service', scope: 'user', runtimeDirectory };
+        this.unit = new plugins.smartdaemon.SystemdUnit(options);
+        this.unitFile = new plugins.smartdaemon.SystemdUnitFile({ ...options, unitDirectory });
+        this.definition = new plugins.smartdaemon.SystemdServiceDefinition({
+            unitName: options.unitName, scope: 'user', description: 'Authswitch account authority', executable: process.execPath,
+            args: [plugins.path.join(packageRoot, 'cli.js'), 'authority', 'daemon'],
+            workingDirectory: packageRoot, restart: 'on-failure', killMode: 'mixed', timeoutStopSeconds: 60,
+        });
+    }
+    async install() {
+        const previous = await this.unitFile.inspect();
+        const result = await this.unitFile.install(this.definition, previous?.sha256 ?? null);
+        return { changed: result.changed, masked: result.masked, sha256: result.record.sha256 };
+    }
+    inspect() { return this.unit.inspect(); }
+    enable() { return this.unit.enable(); }
+    start() { return this.unit.start(); }
+    stop() { return this.unit.stop(); }
+}
+export const runAuthSwitchAuthorityDaemon = async (paths = resolveAuthSwitchAuthorityPaths()) => {
+    const daemon = new AuthSwitchAuthorityDaemon({
+        dataDirectory: paths.dataDirectory,
+        socketPath: paths.databaseSocketPath,
+        authoritySocketPath: paths.authoritySocketPath,
+        runtimeSocketPath: paths.runtimeSocketPath,
+    });
+    await daemon.start();
+    await new Promise((resolve, reject) => {
+        let stopping = false;
+        const stop = () => {
+            if (stopping)
+                return;
+            stopping = true;
+            process.off('SIGINT', stop);
+            process.off('SIGTERM', stop);
+            void daemon.close().then(resolve, reject);
+        };
+        process.on('SIGINT', stop);
+        process.on('SIGTERM', stop);
+    });
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5hdXRob3JpdHlzZXJ2aWNlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvY2xhc3Nlcy5hdXRob3JpdHlzZXJ2aWNlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sY0FBYyxDQUFDO0FBQ3hDLE9BQU8sRUFBRSx5QkFBeUIsRUFBRSxNQUFNLDhCQUE4QixDQUFDO0FBV3pFLDBHQUEwRztBQUMxRyxNQUFNLENBQUMsTUFBTSwrQkFBK0IsR0FBRyxDQUFDLGdCQUFnQixHQUFHLE9BQU8sQ0FBQyxHQUFHLENBQUMsZUFBZSxFQUE2QixFQUFFO0lBQzNILElBQUksQ0FBQyxnQkFBZ0IsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLGdCQUFnQixDQUFDLEVBQUUsQ0FBQztRQUNwRSxNQUFNLElBQUksS0FBSyxDQUFDLGlFQUFpRSxDQUFDLENBQUM7SUFDckYsQ0FBQztJQUNELE1BQU0sSUFBSSxHQUFHLE9BQU8sQ0FBQyxFQUFFLENBQUMsUUFBUSxFQUFFLENBQUMsT0FBTyxDQUFDO0lBQzNDLE1BQU0sUUFBUSxHQUFHLE9BQU8sQ0FBQyxHQUFHLENBQUMsYUFBYSxJQUFJLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRSxjQUFjLENBQUMsQ0FBQztJQUN0RixJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDO1FBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyx5Q0FBeUMsQ0FBQyxDQUFDO0lBQ25HLE1BQU0sZUFBZSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLGdCQUFnQixFQUFFLFlBQVksQ0FBQyxDQUFDO0lBQzFFLE1BQU0sc0JBQXNCLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsZUFBZSxFQUFFLFNBQVMsQ0FBQyxDQUFDO0lBQzdFLE9BQU87UUFDTCxnQkFBZ0I7UUFDaEIsYUFBYSxFQUFFLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxZQUFZLEVBQUUsV0FBVyxDQUFDO1FBQ3JFLGtCQUFrQixFQUFFLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLGVBQWUsRUFBRSxVQUFVLEVBQUUsU0FBUyxDQUFDO1FBQzdFLG1CQUFtQixFQUFFLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLGVBQWUsRUFBRSxZQUFZLEVBQUUsZ0JBQWdCLENBQUM7UUFDdkYsaUJBQWlCLEVBQUUsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsc0JBQXNCLEVBQUUsY0FBYyxDQUFDO1FBQzVFLHNCQUFzQjtLQUN2QixDQUFDO0FBQ0osQ0FBQyxDQUFDO0FBRUYscUZBQXFGO0FBQ3JGLE1BQU0sT0FBTywwQkFBMEI7SUFDckIsSUFBSSxDQUFrQztJQUN0QyxRQUFRLENBQXNDO0lBQzlDLFVBQVUsQ0FBK0M7SUFFekUsWUFBWSxnQkFBd0IsRUFBRSxhQUFzQjtRQUMxRCxNQUFNLFdBQVcsR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsYUFBYSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ3ZHLE1BQU0sT0FBTyxHQUFHLEVBQUUsUUFBUSxFQUFFLDhCQUE4QixFQUFFLEtBQUssRUFBRSxNQUFlLEVBQUUsZ0JBQWdCLEVBQUUsQ0FBQztRQUN2RyxJQUFJLENBQUMsSUFBSSxHQUFHLElBQUksT0FBTyxDQUFDLFdBQVcsQ0FBQyxXQUFXLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDekQsSUFBSSxDQUFDLFFBQVEsR0FBRyxJQUFJLE9BQU8sQ0FBQyxXQUFXLENBQUMsZUFBZSxDQUFDLEVBQUUsR0FBRyxPQUFPLEVBQUUsYUFBYSxFQUFFLENBQUMsQ0FBQztRQUN2RixJQUFJLENBQUMsVUFBVSxHQUFHLElBQUksT0FBTyxDQUFDLFdBQVcsQ0FBQyx3QkFBd0IsQ0FBQztZQUNqRSxRQUFRLEVBQUUsT0FBTyxDQUFDLFFBQVEsRUFBRSxLQUFLLEVBQUUsTUFBTSxFQUFFLFdBQVcsRUFBRSw4QkFBOEIsRUFBRSxVQUFVLEVBQUUsT0FBTyxDQUFDLFFBQVE7WUFDcEgsSUFBSSxFQUFFLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsV0FBVyxFQUFFLFFBQVEsQ0FBQyxFQUFFLFdBQVcsRUFBRSxRQUFRLENBQUM7WUFDdkUsZ0JBQWdCLEVBQUUsV0FBVyxFQUFFLE9BQU8sRUFBRSxZQUFZLEVBQUUsUUFBUSxFQUFFLE9BQU8sRUFBRSxrQkFBa0IsRUFBRSxFQUFFO1NBQ2hHLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFTSxLQUFLLENBQUMsT0FBTztRQUNsQixNQUFNLFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQyxRQUFRLENBQUMsT0FBTyxFQUFFLENBQUM7UUFDL0MsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLFFBQVEsRUFBRSxNQUFNLElBQUksSUFBSSxDQUFDLENBQUM7UUFDdEYsT0FBTyxFQUFFLE9BQU8sRUFBRSxNQUFNLENBQUMsT0FBTyxFQUFFLE1BQU0sRUFBRSxNQUFNLENBQUMsTUFBTSxFQUFFLE1BQU0sRUFBRSxNQUFNLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxDQUFDO0lBQzFGLENBQUM7SUFFTSxPQUFPLEtBQXFELE9BQU8sSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDLENBQUM7SUFDekYsTUFBTSxLQUFxRCxPQUFPLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQyxDQUFDO0lBQ3ZGLEtBQUssS0FBcUQsT0FBTyxJQUFJLENBQUMsSUFBSSxDQUFDLEtBQUssRUFBRSxDQUFDLENBQUMsQ0FBQztJQUNyRixJQUFJLEtBQXFELE9BQU8sSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDLENBQUM7Q0FDM0Y7QUFFRCxNQUFNLENBQUMsTUFBTSw0QkFBNEIsR0FBRyxLQUFLLEVBQUUsS0FBSyxHQUFHLCtCQUErQixFQUFFLEVBQWlCLEVBQUU7SUFDN0csTUFBTSxNQUFNLEdBQUcsSUFBSSx5QkFBeUIsQ0FBQztRQUMzQyxhQUFhLEVBQUUsS0FBSyxDQUFDLGFBQWE7UUFDbEMsVUFBVSxFQUFFLEtBQUssQ0FBQyxrQkFBa0I7UUFDcEMsbUJBQW1CLEVBQUUsS0FBSyxDQUFDLG1CQUFtQjtRQUM5QyxpQkFBaUIsRUFBRSxLQUFLLENBQUMsaUJBQWlCO0tBQzNDLENBQUMsQ0FBQztJQUNILE1BQU0sTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDO0lBQ3JCLE1BQU0sSUFBSSxPQUFPLENBQU8sQ0FBQyxPQUFPLEVBQUUsTUFBTSxFQUFFLEVBQUU7UUFDMUMsSUFBSSxRQUFRLEdBQUcsS0FBSyxDQUFDO1FBQ3JCLE1BQU0sSUFBSSxHQUFHLEdBQUcsRUFBRTtZQUNoQixJQUFJLFFBQVE7Z0JBQUUsT0FBTztZQUNyQixRQUFRLEdBQUcsSUFBSSxDQUFDO1lBQ2hCLE9BQU8sQ0FBQyxHQUFHLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxDQUFDO1lBQzVCLE9BQU8sQ0FBQyxHQUFHLENBQUMsU0FBUyxFQUFFLElBQUksQ0FBQyxDQUFDO1lBQzdCLEtBQUssTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsTUFBTSxDQUFDLENBQUM7UUFDNUMsQ0FBQyxDQUFDO1FBQ0YsT0FBTyxDQUFDLEVBQUUsQ0FBQyxRQUFRLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDM0IsT0FBTyxDQUFDLEVBQUUsQ0FBQyxTQUFTLEVBQUUsSUFBSSxDQUFDLENBQUM7SUFDOUIsQ0FBQyxDQUFDLENBQUM7QUFDTCxDQUFDLENBQUMifQ==

package/dist_ts/index.d.ts

@@ -23,4 +23,6 @@ export * from './classes.service.js';
 export * from './classes.watch.js';
 export * from './classes.watchlock.js';
 export * from './watchpolicy.js';
+export * from './classes.authorityclient.js';
+export * from './classes.authorityservice.js';
 export declare const runCli: (argvArg?: string[]) => Promise<void>;

package/dist_ts/index.js

@@ -23,9 +23,34 @@ export * from './classes.service.js';
 export * from './classes.watch.js';
 export * from './classes.watchlock.js';
 export * from './watchpolicy.js';
+export * from './classes.authorityclient.js';
+export * from './classes.authorityservice.js';
 import { AuthSwitchCli } from './classes.cli.js';
+import { AuthSwitchAuthorityService, resolveAuthSwitchAuthorityPaths, runAuthSwitchAuthorityDaemon } from './classes.authorityservice.js';
 export const runCli = async (argvArg = process.argv.slice(2)) => {
+    if (argvArg[0] === 'authority') {
+        const paths = resolveAuthSwitchAuthorityPaths();
+        if (argvArg[1] === 'daemon' && argvArg.length === 2) {
+            await runAuthSwitchAuthorityDaemon(paths);
+            return;
+        }
+        if (argvArg[1] === 'service' && argvArg.length === 3) {
+            const service = new AuthSwitchAuthorityService(paths.runtimeDirectory);
+            const action = argvArg[2];
+            const result = action === 'install' ? await service.install()
+                : action === 'status' ? await service.inspect()
+                    : action === 'enable' ? await service.enable()
+                        : action === 'start' ? await service.start()
+                            : action === 'stop' ? await service.stop()
+                                : null;
+            if (result !== null) {
+                process.stdout.write(JSON.stringify(result) + '\n');
+                return;
+            }
+        }
+        throw new Error('Usage: authswitch authority daemon | service install|status|enable|start|stop');
+    }
     const exitCode = await new AuthSwitchCli().run(argvArg);
     process.exitCode = exitCode;
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLDJCQUEyQixDQUFDO0FBQzFDLGNBQWMsOEJBQThCLENBQUM7QUFDN0MsY0FBYyxnQ0FBZ0MsQ0FBQztBQUMvQyxjQUFjLCtCQUErQixDQUFDO0FBQzlDLGNBQWMsMkJBQTJCLENBQUM7QUFDMUMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLDRCQUE0QixDQUFDO0FBQzNDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLDRCQUE0QixDQUFDO0FBQzNDLGNBQWMsa0JBQWtCLENBQUM7QUFDakMsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLHlCQUF5QixDQUFDO0FBQ3hDLGNBQWMsc0JBQXNCLENBQUM7QUFDckMsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsa0JBQWtCLENBQUM7QUFFakMsT0FBTyxFQUFFLGFBQWEsRUFBRSxNQUFNLGtCQUFrQixDQUFDO0FBRWpELE1BQU0sQ0FBQyxNQUFNLE1BQU0sR0FBRyxLQUFLLEVBQUUsVUFBb0IsT0FBTyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLEVBQWlCLEVBQUU7SUFDdkYsTUFBTSxRQUFRLEdBQUcsTUFBTSxJQUFJLGFBQWEsRUFBRSxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUN4RCxPQUFPLENBQUMsUUFBUSxHQUFHLFFBQVEsQ0FBQztBQUM5QixDQUFDLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLDJCQUEyQixDQUFDO0FBQzFDLGNBQWMsOEJBQThCLENBQUM7QUFDN0MsY0FBYyxnQ0FBZ0MsQ0FBQztBQUMvQyxjQUFjLCtCQUErQixDQUFDO0FBQzlDLGNBQWMsMkJBQTJCLENBQUM7QUFDMUMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLDRCQUE0QixDQUFDO0FBQzNDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLDRCQUE0QixDQUFDO0FBQzNDLGNBQWMsa0JBQWtCLENBQUM7QUFDakMsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLHlCQUF5QixDQUFDO0FBQ3hDLGNBQWMsc0JBQXNCLENBQUM7QUFDckMsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsa0JBQWtCLENBQUM7QUFDakMsY0FBYyw4QkFBOEIsQ0FBQztBQUM3QyxjQUFjLCtCQUErQixDQUFDO0FBRTlDLE9BQU8sRUFBRSxhQUFhLEVBQUUsTUFBTSxrQkFBa0IsQ0FBQztBQUNqRCxPQUFPLEVBQUUsMEJBQTBCLEVBQUUsK0JBQStCLEVBQUUsNEJBQTRCLEVBQUUsTUFBTSwrQkFBK0IsQ0FBQztBQUUxSSxNQUFNLENBQUMsTUFBTSxNQUFNLEdBQUcsS0FBSyxFQUFFLFVBQW9CLE9BQU8sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxFQUFpQixFQUFFO0lBQ3ZGLElBQUksT0FBTyxDQUFDLENBQUMsQ0FBQyxLQUFLLFdBQVcsRUFBRSxDQUFDO1FBQy9CLE1BQU0sS0FBSyxHQUFHLCtCQUErQixFQUFFLENBQUM7UUFDaEQsSUFBSSxPQUFPLENBQUMsQ0FBQyxDQUFDLEtBQUssUUFBUSxJQUFJLE9BQU8sQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDcEQsTUFBTSw0QkFBNEIsQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUMxQyxPQUFPO1FBQ1QsQ0FBQztRQUNELElBQUksT0FBTyxDQUFDLENBQUMsQ0FBQyxLQUFLLFNBQVMsSUFBSSxPQUFPLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ3JELE1BQU0sT0FBTyxHQUFHLElBQUksMEJBQTBCLENBQUMsS0FBSyxDQUFDLGdCQUFnQixDQUFDLENBQUM7WUFDdkUsTUFBTSxNQUFNLEdBQUcsT0FBTyxDQUFDLENBQUMsQ0FBQyxDQUFDO1lBQzFCLE1BQU0sTUFBTSxHQUFHLE1BQU0sS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLE1BQU0sT0FBTyxDQUFDLE9BQU8sRUFBRTtnQkFDM0QsQ0FBQyxDQUFDLE1BQU0sS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLE1BQU0sT0FBTyxDQUFDLE9BQU8sRUFBRTtvQkFDL0MsQ0FBQyxDQUFDLE1BQU0sS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLE1BQU0sT0FBTyxDQUFDLE1BQU0sRUFBRTt3QkFDOUMsQ0FBQyxDQUFDLE1BQU0sS0FBSyxPQUFPLENBQUMsQ0FBQyxDQUFDLE1BQU0sT0FBTyxDQUFDLEtBQUssRUFBRTs0QkFDNUMsQ0FBQyxDQUFDLE1BQU0sS0FBSyxNQUFNLENBQUMsQ0FBQyxDQUFDLE1BQU0sT0FBTyxDQUFDLElBQUksRUFBRTtnQ0FDMUMsQ0FBQyxDQUFDLElBQUksQ0FBQztZQUNULElBQUksTUFBTSxLQUFLLElBQUksRUFBRSxDQUFDO2dCQUNwQixPQUFPLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxHQUFHLElBQUksQ0FBQyxDQUFDO2dCQUNwRCxPQUFPO1lBQ1QsQ0FBQztRQUNILENBQUM7UUFDRCxNQUFNLElBQUksS0FBSyxDQUFDLCtFQUErRSxDQUFDLENBQUM7SUFDbkcsQ0FBQztJQUNELE1BQU0sUUFBUSxHQUFHLE1BQU0sSUFBSSxhQUFhLEVBQUUsQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDLENBQUM7SUFDeEQsT0FBTyxDQUFDLFFBQVEsR0FBRyxRQUFRLENBQUM7QUFDOUIsQ0FBQyxDQUFDIn0=

package/dist_ts/plugins.d.ts

@@ -3,8 +3,10 @@ import * as os from 'node:os';
 import * as path from 'node:path';
 import * as childProcess from 'node:child_process';
 import * as crypto from 'node:crypto';
+import * as net from 'node:net';
+import { fileURLToPath } from 'node:url';
 import type { DatabaseSync } from 'node:sqlite';
-export { childProcess, crypto, fs, os, path };
+export { childProcess, crypto, fileURLToPath, fs, net, os, path };
 export type { DatabaseSync };
 /** SQLite is needed only when accessing a Codex state database, not when hosting account APIs. */
 export declare const loadSqlite: () => typeof import("node:sqlite");
@@ -16,7 +18,12 @@ export type TProperLockfile = typeof properLockfile;
  */
 export declare const loadProperLockfile: () => Promise<TProperLockfile>;
 import * as smartconsole from '@push.rocks/smartconsole';
-export { smartconsole };
+import * as smartdata from '@push.rocks/smartdata';
+import * as smartdb from '@push.rocks/smartdb';
+import * as smartsecret from '@push.rocks/smartsecret';
+import * as smartdaemon from '@push.rocks/smartdaemon';
+import * as typedrequest from '@api.global/typedrequest';
+export { smartconsole, smartdata, smartdb, smartsecret, smartdaemon, typedrequest };
 import * as flexModels from '@modelprofile.com/flexharness-models';
 import * as flexOpenAi from '@modelprofile.com/flexharness-providers/openai';
 import * as flexAuth from '@modelprofile.com/flexharness-providers/auth';

package/dist_ts/plugins.js

@@ -4,8 +4,10 @@ import * as os from 'node:os';
 import * as path from 'node:path';
 import * as childProcess from 'node:child_process';
 import * as crypto from 'node:crypto';
+import * as net from 'node:net';
 import { createRequire } from 'node:module';
-export { childProcess, crypto, fs, os, path };
+import { fileURLToPath } from 'node:url';
+export { childProcess, crypto, fileURLToPath, fs, net, os, path };
 const nativeRequire = createRequire(import.meta.url);
 /** SQLite is needed only when accessing a Codex state database, not when hosting account APIs. */
 export const loadSqlite = () => nativeRequire('node:sqlite');
@@ -16,11 +18,16 @@ export const loadSqlite = () => nativeRequire('node:sqlite');
 export const loadProperLockfile = () => import('proper-lockfile');
 // @push.rocks modules
 import * as smartconsole from '@push.rocks/smartconsole';
-export { smartconsole };
+import * as smartdata from '@push.rocks/smartdata';
+import * as smartdb from '@push.rocks/smartdb';
+import * as smartsecret from '@push.rocks/smartsecret';
+import * as smartdaemon from '@push.rocks/smartdaemon';
+import * as typedrequest from '@api.global/typedrequest';
+export { smartconsole, smartdata, smartdb, smartsecret, smartdaemon, typedrequest };
 // @modelprofile.com modules
 import * as flexModels from '@modelprofile.com/flexharness-models';
 import * as flexOpenAi from '@modelprofile.com/flexharness-providers/openai';
 import * as flexAuth from '@modelprofile.com/flexharness-providers/auth';
 import * as flexAccounts from '@modelprofile.com/flexharness-providers/accounts';
 export { flexModels, flexOpenAi, flexAuth, flexAccounts };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3BsdWdpbnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsc0JBQXNCO0FBQ3RCLE9BQU8sS0FBSyxFQUFFLE1BQU0sU0FBUyxDQUFDO0FBQzlCLE9BQU8sS0FBSyxFQUFFLE1BQU0sU0FBUyxDQUFDO0FBQzlCLE9BQU8sS0FBSyxJQUFJLE1BQU0sV0FBVyxDQUFDO0FBQ2xDLE9BQU8sS0FBSyxZQUFZLE1BQU0sb0JBQW9CLENBQUM7QUFDbkQsT0FBTyxLQUFLLE1BQU0sTUFBTSxhQUFhLENBQUM7QUFDdEMsT0FBTyxFQUFFLGFBQWEsRUFBRSxNQUFNLGFBQWEsQ0FBQztBQUc1QyxPQUFPLEVBQUUsWUFBWSxFQUFFLE1BQU0sRUFBRSxFQUFFLEVBQUUsRUFBRSxFQUFFLElBQUksRUFBRSxDQUFDO0FBRTlDLE1BQU0sYUFBYSxHQUFHLGFBQWEsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDO0FBQ3JELGtHQUFrRztBQUNsRyxNQUFNLENBQUMsTUFBTSxVQUFVLEdBQUcsR0FBaUMsRUFBRSxDQUFDLGFBQWEsQ0FBQyxhQUFhLENBQUMsQ0FBQztBQUszRjs7O0dBR0c7QUFDSCxNQUFNLENBQUMsTUFBTSxrQkFBa0IsR0FBRyxHQUE2QixFQUFFLENBQUMsTUFBTSxDQUFDLGlCQUFpQixDQUFDLENBQUM7QUFFNUYsc0JBQXNCO0FBQ3RCLE9BQU8sS0FBSyxZQUFZLE1BQU0sMEJBQTBCLENBQUM7QUFDekQsT0FBTyxFQUFFLFlBQVksRUFBRSxDQUFDO0FBRXhCLDRCQUE0QjtBQUM1QixPQUFPLEtBQUssVUFBVSxNQUFNLHNDQUFzQyxDQUFDO0FBQ25FLE9BQU8sS0FBSyxVQUFVLE1BQU0sZ0RBQWdELENBQUM7QUFDN0UsT0FBTyxLQUFLLFFBQVEsTUFBTSw4Q0FBOEMsQ0FBQztBQUN6RSxPQUFPLEtBQUssWUFBWSxNQUFNLGtEQUFrRCxDQUFDO0FBQ2pGLE9BQU8sRUFBRSxVQUFVLEVBQUUsVUFBVSxFQUFFLFFBQVEsRUFBRSxZQUFZLEVBQUUsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3BsdWdpbnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsc0JBQXNCO0FBQ3RCLE9BQU8sS0FBSyxFQUFFLE1BQU0sU0FBUyxDQUFDO0FBQzlCLE9BQU8sS0FBSyxFQUFFLE1BQU0sU0FBUyxDQUFDO0FBQzlCLE9BQU8sS0FBSyxJQUFJLE1BQU0sV0FBVyxDQUFDO0FBQ2xDLE9BQU8sS0FBSyxZQUFZLE1BQU0sb0JBQW9CLENBQUM7QUFDbkQsT0FBTyxLQUFLLE1BQU0sTUFBTSxhQUFhLENBQUM7QUFDdEMsT0FBTyxLQUFLLEdBQUcsTUFBTSxVQUFVLENBQUM7QUFDaEMsT0FBTyxFQUFFLGFBQWEsRUFBRSxNQUFNLGFBQWEsQ0FBQztBQUM1QyxPQUFPLEVBQUUsYUFBYSxFQUFFLE1BQU0sVUFBVSxDQUFDO0FBR3pDLE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSxFQUFFLGFBQWEsRUFBRSxFQUFFLEVBQUUsR0FBRyxFQUFFLEVBQUUsRUFBRSxJQUFJLEVBQUUsQ0FBQztBQUVsRSxNQUFNLGFBQWEsR0FBRyxhQUFhLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQztBQUNyRCxrR0FBa0c7QUFDbEcsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHLEdBQWlDLEVBQUUsQ0FBQyxhQUFhLENBQUMsYUFBYSxDQUFDLENBQUM7QUFLM0Y7OztHQUdHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sa0JBQWtCLEdBQUcsR0FBNkIsRUFBRSxDQUFDLE1BQU0sQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO0FBRTVGLHNCQUFzQjtBQUN0QixPQUFPLEtBQUssWUFBWSxNQUFNLDBCQUEwQixDQUFDO0FBQ3pELE9BQU8sS0FBSyxTQUFTLE1BQU0sdUJBQXVCLENBQUM7QUFDbkQsT0FBTyxLQUFLLE9BQU8sTUFBTSxxQkFBcUIsQ0FBQztBQUMvQyxPQUFPLEtBQUssV0FBVyxNQUFNLHlCQUF5QixDQUFDO0FBQ3ZELE9BQU8sS0FBSyxXQUFXLE1BQU0seUJBQXlCLENBQUM7QUFDdkQsT0FBTyxLQUFLLFlBQVksTUFBTSwwQkFBMEIsQ0FBQztBQUN6RCxPQUFPLEVBQUUsWUFBWSxFQUFFLFNBQVMsRUFBRSxPQUFPLEVBQUUsV0FBVyxFQUFFLFdBQVcsRUFBRSxZQUFZLEVBQUUsQ0FBQztBQUVwRiw0QkFBNEI7QUFDNUIsT0FBTyxLQUFLLFVBQVUsTUFBTSxzQ0FBc0MsQ0FBQztBQUNuRSxPQUFPLEtBQUssVUFBVSxNQUFNLGdEQUFnRCxDQUFDO0FBQzdFLE9BQU8sS0FBSyxRQUFRLE1BQU0sOENBQThDLENBQUM7QUFDekUsT0FBTyxLQUFLLFlBQVksTUFBTSxrREFBa0QsQ0FBQztBQUNqRixPQUFPLEVBQUUsVUFBVSxFQUFFLFVBQVUsRUFBRSxRQUFRLEVBQUUsWUFBWSxFQUFFLENBQUMifQ==

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modelprofile.com/authswitch",
-  "version": "6.3.0",
+  "version": "6.4.0",
   "private": false,
   "description": "Manage Codex, OpenCode and Claude Code accounts with guided switching and live usage status",
   "main": "dist_ts/index.js",
@@ -13,6 +13,14 @@
     "./mutation": {
       "types": "./dist_ts/mutation.d.ts",
       "import": "./dist_ts/mutation.js"
+    },
+    "./authority-contract": {
+      "types": "./dist_ts/authority-contract.d.ts",
+      "import": "./dist_ts/authority-contract.js"
+    },
+    "./authority-client": {
+      "types": "./dist_ts/classes.authorityclient.d.ts",
+      "import": "./dist_ts/classes.authorityclient.js"
     }
   },
   "type": "module",
@@ -40,9 +48,15 @@
     "esbuild": "^0.28.2"
   },
   "dependencies": {
-    "@modelprofile.com/flexharness-models": "^7.0.1",
-    "@modelprofile.com/flexharness-providers": "^7.0.1",
+    "@api.global/typedrequest": "8.1.0",
+    "@api.global/typedrequest-interfaces": "7.1.0",
+    "@modelprofile.com/flexharness-models": "^8.0.0",
+    "@modelprofile.com/flexharness-providers": "^8.0.0",
     "@push.rocks/smartconsole": "^1.3.0",
+    "@push.rocks/smartdaemon": "2.7.0",
+    "@push.rocks/smartdata": "11.14.2",
+    "@push.rocks/smartdb": "7.0.1",
+    "@push.rocks/smartsecret": "1.8.0",
     "@types/proper-lockfile": "^4.1.4",
     "proper-lockfile": "^4.1.2"
   },

package/readme.md

@@ -24,6 +24,40 @@ pnpm install -g @modelprofile.com/authswitch
 
 Node.js 24 or newer is required.
 
+## Authority SDK (new account registry)
+
+The package also exports a typed client for a per-user authswitch authority daemon. Its
+SmartData registry stores account identity separately from sealed refresh grants, runtime
+bindings, Codex enrollment records, and native-handoff and migration journals. A daemon
+owns OpenAI device login, targeted reauthentication, and proactive refresh for grants
+added through this API. Management snapshots and events contain no credentials.
+
+```ts
+import { AuthSwitchClient } from '@modelprofile.com/authswitch/authority-client';
+import { resolveAuthSwitchAuthorityPaths } from '@modelprofile.com/authswitch';
+
+const paths = resolveAuthSwitchAuthorityPaths();
+const client = new AuthSwitchClient(paths.authoritySocketPath, paths.runtimeSocketPath);
+const snapshot = await client.snapshotAll();
+const operation = await client.beginAddOpenAi();
+```
+
+Browser code can import the credential-free DTOs from
+`@modelprofile.com/authswitch/authority-contract`. A backend binds an account to a
+runtime incarnation and keeps the returned capability private. The runtime-only socket
+resolves that binding to a current access token; its directory can be mounted into a
+container without exposing the management socket. Reconnect and reload a snapshot after
+an event gap or daemon restart.
+
+This SDK is additive at this stage. The commands documented below still use the existing
+credential stores. The authority daemon does not import those stores automatically,
+replace their active native sessions, or take over their refresh grants. An active
+Codex/OpenCode native grant remains pending until its owner is idle and an explicit
+handoff verifies the latest native source. Claude Code's own native credential files
+remain vendor-owned; a container setup-token grant is a separate grant under the same
+account. The one-time migration and deletion of authswitch's old stores are separate
+cutover steps.
+
 ## Usage
 
 Run `authswitch`, `authswitch -i`, or `authswitch --interactive` for an interactive guide. Use the arrow keys and

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@modelprofile.com/authswitch',
-  version: '6.3.0',
+  version: '6.4.0',
   description: 'Manage Codex, OpenCode and Claude Code accounts with guided switching and live usage status'
 }

package/ts/authority-contract.ts

@@ -0,0 +1,109 @@
+import type { ITypedRequest } from '@api.global/typedrequest-interfaces';
+
+/** Credential-free account management contract. Safe to import in browser code. */
+export type TAuthSwitchAccountHealth = 'ready' | 'refreshing' | 'retry_wait' | 'needs_reauth' | 'native' | 'legacy_native_pending' | 'removed';
+
+export interface IAuthSwitchAccount {
+  id: string;
+  providerId: string;
+  label: string;
+  email: string | null;
+  plan: string | null;
+  health: TAuthSwitchAccountHealth;
+  owner: 'daemon' | 'claude_native' | 'legacy_native' | 'none';
+  grantGeneration: number;
+  revision: number;
+  accessExpiresAt: string | null;
+  retryAt: string | null;
+  problem: 'none' | 'provider_unavailable' | 'exchange_uncertain' | 'provider_rejected' | 'native_owner';
+  statusObservedAt: string;
+}
+
+export interface IAuthSwitchBinding {
+  id: string;
+  accountId: string;
+  runtime: 'flex' | 'codex' | 'opencode' | 'claude';
+  scopeId: string;
+  incarnationId: string;
+  revision: number;
+}
+
+export interface IAuthSwitchSnapshot {
+  schemaVersion: 1;
+  epoch: string;
+  revision: number;
+  generatedAt: string;
+  accounts: IAuthSwitchAccount[];
+  bindings: IAuthSwitchBinding[];
+  nextAccountCursor: string | null;
+  nextBindingCursor: string | null;
+}
+
+export interface IAuthSwitchAccountEvent {
+  epoch: string;
+  revision: number;
+  kind: 'account' | 'binding';
+  accountId: string;
+}
+
+export type TAuthSwitchLoginPrompt =
+  | { flow: 'device'; verificationUrl: string; userCode: string }
+  | { flow: 'browser'; authUrl: string };
+
+export interface IAuthSwitchOperation {
+  id: string;
+  state: 'pending' | 'complete' | 'failed' | 'cancelled';
+  prompt: TAuthSwitchLoginPrompt | null;
+  account: IAuthSwitchAccount | null;
+  error: string | null;
+}
+
+export interface IReq_AuthSwitchSnapshot extends ITypedRequest {
+  method: 'authswitch.authority.snapshot';
+  request: { accountAfter?: string; bindingAfter?: string; limit?: number };
+  response: { snapshot: IAuthSwitchSnapshot };
+}
+
+export interface IReq_AuthSwitchEvents extends ITypedRequest {
+  method: 'authswitch.authority.events';
+  request: { epoch: string; afterRevision: number; waitMs: number };
+  response: { epoch: string; revision: number; resyncRequired: boolean; events: IAuthSwitchAccountEvent[] };
+}
+
+export interface IReq_AuthSwitchBeginAdd extends ITypedRequest {
+  method: 'authswitch.authority.add';
+  request: { providerId: 'openai'; flow: 'device' };
+  response: { operation: IAuthSwitchOperation };
+}
+
+export interface IReq_AuthSwitchBeginReauth extends ITypedRequest {
+  method: 'authswitch.authority.reauth';
+  request: { accountId: string; flow: 'device' };
+  response: { operation: IAuthSwitchOperation };
+}
+
+export interface IReq_AuthSwitchGetOperation extends ITypedRequest {
+  method: 'authswitch.authority.operation';
+  request: { operationId: string };
+  response: { operation: IAuthSwitchOperation };
+}
+
+export interface IReq_AuthSwitchCancelOperation extends ITypedRequest {
+  method: 'authswitch.authority.cancel';
+  request: { operationId: string };
+  response: { operation: IAuthSwitchOperation };
+}
+
+export interface IReq_AuthSwitchRenameAccount extends ITypedRequest {
+  method: 'authswitch.authority.rename';
+  request: { accountId: string; expectedRevision: number; label: string };
+  response: { account: IAuthSwitchAccount };
+}
+
+export interface IReq_AuthSwitchRemoveAccount extends ITypedRequest {
+  method: 'authswitch.authority.remove';
+  request: { accountId: string; expectedRevision: number };
+  response: { account: IAuthSwitchAccount };
+}
+
+/** Runtime capability is returned only to trusted backend callers; do not expose this response in a browser API. */

package/ts/authority-runtime-contract.ts

@@ -0,0 +1,27 @@
+import type { ITypedRequest } from '@api.global/typedrequest-interfaces';
+import type { IAuthSwitchBinding } from './authority-contract.js';
+
+/** Backend-only binding operation. The capability must never enter a browser-facing response. */
+export interface IReq_AuthSwitchBindAccount extends ITypedRequest {
+  method: 'authswitch.authority.bind';
+  request: {
+    accountId: string;
+    runtime: IAuthSwitchBinding['runtime'];
+    scopeId: string;
+    incarnationId: string;
+  };
+  response: { binding: IAuthSwitchBinding; capability: string };
+}
+
+/** Backend-only access operation. Refresh grants never cross this interface. */
+export interface IReq_AuthSwitchResolveAccess extends ITypedRequest {
+  method: 'authswitch.authority.resolveAccess';
+  request: { bindingId: string; capability: string; minValidityMs: number };
+  response: {
+    accessToken: string;
+    accountId: string;
+    isFedrampAccount: boolean;
+    expiresAt: string;
+    grantGeneration: number;
+  };
+}