@modelprofile.com/authswitch 6.3.0 → 6.5.0

package/dist_ts/classes.authorityclient.d.ts

@@ -0,0 +1,47 @@
+import type { IAuthSwitchAccountEvent, IAuthSwitchSnapshot, IReq_AuthSwitchBeginAdd, IReq_AuthSwitchBeginReauth, IReq_AuthSwitchCancelOperation, IReq_AuthSwitchEvents, IReq_AuthSwitchGetOperation, IReq_AuthSwitchRemoveAccount, IReq_AuthSwitchRenameAccount, IReq_AuthSwitchSnapshot } from './authority-contract.js';
+import type { IReq_AuthSwitchBindAccount, IReq_AuthSwitchResolveAccess } from './authority-runtime-contract.js';
+/** A snapshot is usable only while state is current; lastVerifiedAt is the last successful daemon proof. */
+export interface IAuthSwitchSubscriptionStatus {
+    state: 'current' | 'unavailable' | 'closed';
+    reason: 'initial' | 'snapshot' | 'event' | 'heartbeat' | 'disconnect' | 'resync' | 'abort' | 'consumer_error';
+    epoch: string | null;
+    revision: number | null;
+    lastVerifiedAt: string | null;
+}
+export interface IAuthSwitchSubscriptionOptions {
+    onStatus?: (status: IAuthSwitchSubscriptionStatus) => void | Promise<void>;
+    /** Bounded long-poll interval; defaults to 30 seconds. */
+    heartbeatMs?: number;
+}
+/** Node-only client for the per-user daemon. Each request has its own bounded Unix connection. */
+export declare class AuthSwitchClient {
+    readonly socketPath: string;
+    readonly runtimeSocketPath: string;
+    private readonly target;
+    private readonly runtimeTarget;
+    constructor(socketPath: string, runtimeSocketPath: string);
+    private request;
+    snapshot(options?: IReq_AuthSwitchSnapshot['request'], signal?: AbortSignal): Promise<IAuthSwitchSnapshot>;
+    /** Assemble a consistent view from bounded database pages; restart if a writer changes the revision. */
+    snapshotAll(options?: {
+        limit?: number;
+        signal?: AbortSignal;
+    }): Promise<IAuthSwitchSnapshot>;
+    events(epoch: string, afterRevision: number, waitMs?: number, signal?: AbortSignal): Promise<IReq_AuthSwitchEvents['response']>;
+    /** Snapshot callback runs after every known change; onStatus invalidates it on disconnect, resync or abort. */
+    subscribe(onSnapshot: (snapshot: IAuthSwitchSnapshot) => void | Promise<void>, onEvent: (event: IAuthSwitchAccountEvent) => void | Promise<void>, signal: AbortSignal, options?: IAuthSwitchSubscriptionOptions): Promise<void>;
+    beginAddOpenAi(): Promise<IReq_AuthSwitchBeginAdd['response']['operation']>;
+    beginReauthOpenAi(accountId: string): Promise<IReq_AuthSwitchBeginReauth['response']['operation']>;
+    getOperation(operationId: string): Promise<IReq_AuthSwitchGetOperation['response']['operation']>;
+    cancelOperation(operationId: string): Promise<IReq_AuthSwitchCancelOperation['response']['operation']>;
+    renameAccount(accountId: string, expectedRevision: number, label: string): Promise<IReq_AuthSwitchRenameAccount['response']['account']>;
+    removeAccount(accountId: string, expectedRevision: number): Promise<IReq_AuthSwitchRemoveAccount['response']['account']>;
+    bindAccount(input: IReq_AuthSwitchBindAccount['request']): Promise<IReq_AuthSwitchBindAccount['response']>;
+    resolveAccess(input: IReq_AuthSwitchResolveAccess['request']): Promise<IReq_AuthSwitchResolveAccess['response']>;
+}
+/** Container-facing client. It can only resolve a previously issued binding capability. */
+export declare class AuthSwitchRuntimeClient {
+    private readonly target;
+    constructor(runtimeSocketPath: string);
+    resolveAccess(input: IReq_AuthSwitchResolveAccess['request']): Promise<IReq_AuthSwitchResolveAccess['response']>;
+}

package/dist_ts/classes.authorityclient.js

@@ -0,0 +1,261 @@
+import * as plugins from './plugins.js';
+import { AuthSwitchAuthorityFrameReader, authSwitchAuthorityFrameBytes, maxAuthSwitchAuthorityFrameBytes } from './classes.authorityframing.js';
+const post = (path, payload, signal) => {
+    return new Promise((resolve, reject) => {
+        if (signal?.aborted) {
+            reject(signal.reason);
+            return;
+        }
+        const socket = plugins.net.createConnection(path);
+        let settled = false;
+        const frame = new AuthSwitchAuthorityFrameReader();
+        const finish = (error, response) => {
+            if (settled)
+                return;
+            settled = true;
+            signal?.removeEventListener('abort', abort);
+            socket.destroy();
+            if (error)
+                reject(error);
+            else if (response)
+                resolve(response);
+            else
+                reject(new Error('Authswitch daemon returned no response.'));
+        };
+        const abort = () => finish(signal?.reason ?? new Error('Account request was cancelled.'));
+        signal?.addEventListener('abort', abort, { once: true });
+        socket.setTimeout(35_000, () => finish(new Error('Authswitch daemon request timed out.')));
+        socket.on('connect', () => {
+            const raw = JSON.stringify(payload);
+            if (authSwitchAuthorityFrameBytes(raw) > maxAuthSwitchAuthorityFrameBytes) {
+                finish(new Error('Account request is too large.'));
+                return;
+            }
+            socket.write(raw + '\n');
+        });
+        socket.on('data', chunk => {
+            if (!Buffer.isBuffer(chunk)) {
+                finish(new Error('Account response must be a byte frame.'));
+                return;
+            }
+            let input;
+            try {
+                input = frame.add(chunk);
+            }
+            catch (error) {
+                finish(error);
+                return;
+            }
+            if (input === null)
+                return;
+            try {
+                finish(undefined, JSON.parse(input));
+            }
+            catch {
+                finish(new Error('Account response could not be decoded.'));
+            }
+        });
+        socket.on('error', () => finish(new Error('Authswitch daemon is unavailable.')));
+        socket.on('close', () => finish(new Error('Authswitch daemon connection closed before its response.')));
+    });
+};
+/** Node-only client for the per-user daemon. Each request has its own bounded Unix connection. */
+export class AuthSwitchClient {
+    socketPath;
+    runtimeSocketPath;
+    target;
+    runtimeTarget;
+    constructor(socketPath, runtimeSocketPath) {
+        this.socketPath = socketPath;
+        this.runtimeSocketPath = runtimeSocketPath;
+        this.target = new plugins.typedrequest.TypedTarget({
+            supportsAbortSignal: true,
+            postMethod: (payload, options) => post(this.socketPath, payload, options?.signal),
+        });
+        this.runtimeTarget = new plugins.typedrequest.TypedTarget({
+            supportsAbortSignal: true,
+            postMethod: (payload, options) => post(this.runtimeSocketPath, payload, options?.signal),
+        });
+    }
+    request(method, request, timeoutMs = 35_000, runtime = false, signal) {
+        return new plugins.typedrequest.TypedRequest(runtime ? this.runtimeTarget : this.target, method)
+            .fire(request, { timeoutMs, maxRetries: 0, abortSignal: signal });
+    }
+    async snapshot(options = {}, signal) {
+        return (await this.request('authswitch.authority.snapshot', options, 35_000, false, signal)).snapshot;
+    }
+    /** Assemble a consistent view from bounded database pages; restart if a writer changes the revision. */
+    async snapshotAll(options = {}) {
+        while (true) {
+            if (options.signal?.aborted)
+                throw options.signal.reason ?? new Error('Account snapshot cancelled.');
+            let accountAfter;
+            let bindingAfter;
+            let aggregate;
+            let changed = false;
+            while (true) {
+                const page = await this.snapshot({ accountAfter, bindingAfter, limit: options.limit }, options.signal);
+                if (!aggregate)
+                    aggregate = { ...page, accounts: [...page.accounts], bindings: [...page.bindings] };
+                else if (aggregate.epoch !== page.epoch || aggregate.revision !== page.revision) {
+                    changed = true;
+                    break;
+                }
+                else {
+                    aggregate.accounts.push(...page.accounts);
+                    aggregate.bindings.push(...page.bindings);
+                }
+                accountAfter = page.nextAccountCursor ?? accountAfter ?? page.accounts.at(-1)?.id;
+                bindingAfter = page.nextBindingCursor ?? bindingAfter ?? page.bindings.at(-1)?.id;
+                if (!page.nextAccountCursor && !page.nextBindingCursor) {
+                    return { ...aggregate, nextAccountCursor: null, nextBindingCursor: null };
+                }
+            }
+            if (!changed)
+                throw new Error('Authority snapshot could not complete.');
+        }
+    }
+    events(epoch, afterRevision, waitMs = 30_000, signal) {
+        return this.request('authswitch.authority.events', { epoch, afterRevision, waitMs }, waitMs + 5_000, false, signal);
+    }
+    /** Snapshot callback runs after every known change; onStatus invalidates it on disconnect, resync or abort. */
+    async subscribe(onSnapshot, onEvent, signal, options = {}) {
+        const heartbeatMs = options.heartbeatMs ?? 30_000;
+        if (!Number.isSafeInteger(heartbeatMs) || heartbeatMs < 50 || heartbeatMs > 30_000) {
+            throw new Error('Authswitch subscription heartbeat must be 50–30000 ms.');
+        }
+        const retry = () => new Promise(resolve => {
+            const timer = setTimeout(() => { signal.removeEventListener('abort', aborted); resolve(); }, 250);
+            const aborted = () => { clearTimeout(timer); resolve(); };
+            signal.addEventListener('abort', aborted, { once: true });
+        });
+        let snapshot;
+        let available = false;
+        let lastVerifiedAt = null;
+        let lastEpoch = null;
+        let lastRevision = null;
+        const status = async (state, reason) => {
+            await options.onStatus?.({ state, reason, epoch: lastEpoch, revision: lastRevision, lastVerifiedAt });
+        };
+        const invalidate = async (reason) => {
+            snapshot = undefined;
+            if (available) {
+                available = false;
+                await status('unavailable', reason);
+            }
+        };
+        try {
+            if (!signal.aborted)
+                await status('unavailable', 'initial');
+            while (!signal.aborted) {
+                if (!snapshot) {
+                    let fresh;
+                    try {
+                        fresh = await this.snapshotAll({ signal });
+                    }
+                    catch {
+                        if (signal.aborted)
+                            break;
+                        await invalidate('disconnect');
+                        await retry();
+                        continue;
+                    }
+                    snapshot = fresh;
+                    await onSnapshot(fresh);
+                    available = true;
+                    lastEpoch = fresh.epoch;
+                    lastRevision = fresh.revision;
+                    lastVerifiedAt = new Date().toISOString();
+                    await status('current', 'snapshot');
+                }
+                let result;
+                try {
+                    result = await this.events(snapshot.epoch, snapshot.revision, heartbeatMs, signal);
+                }
+                catch {
+                    if (signal.aborted)
+                        break;
+                    await invalidate('disconnect');
+                    await retry();
+                    continue;
+                }
+                if (result.resyncRequired || result.epoch !== snapshot.epoch
+                    || (result.events.length === 0 && result.revision !== snapshot.revision)) {
+                    await invalidate('resync');
+                    continue;
+                }
+                if (result.events.length) {
+                    let fresh;
+                    try {
+                        fresh = await this.snapshotAll({ signal });
+                    }
+                    catch {
+                        if (signal.aborted)
+                            break;
+                        await invalidate('disconnect');
+                        await retry();
+                        continue;
+                    }
+                    if (fresh.epoch !== result.epoch || fresh.revision < result.revision) {
+                        await invalidate('resync');
+                        continue;
+                    }
+                    snapshot = fresh;
+                    await onSnapshot(fresh);
+                    for (const event of result.events)
+                        await onEvent(event);
+                    lastEpoch = fresh.epoch;
+                    lastRevision = fresh.revision;
+                    lastVerifiedAt = new Date().toISOString();
+                    await status('current', 'event');
+                }
+                else {
+                    lastVerifiedAt = new Date().toISOString();
+                    await status('current', 'heartbeat');
+                }
+            }
+        }
+        finally {
+            available = false;
+            await status('closed', signal.aborted ? 'abort' : 'consumer_error');
+        }
+    }
+    async beginAddOpenAi() {
+        return (await this.request('authswitch.authority.add', { providerId: 'openai', flow: 'device' })).operation;
+    }
+    async beginReauthOpenAi(accountId) {
+        return (await this.request('authswitch.authority.reauth', { accountId, flow: 'device' })).operation;
+    }
+    async getOperation(operationId) {
+        return (await this.request('authswitch.authority.operation', { operationId })).operation;
+    }
+    async cancelOperation(operationId) {
+        return (await this.request('authswitch.authority.cancel', { operationId })).operation;
+    }
+    async renameAccount(accountId, expectedRevision, label) {
+        return (await this.request('authswitch.authority.rename', { accountId, expectedRevision, label })).account;
+    }
+    async removeAccount(accountId, expectedRevision) {
+        return (await this.request('authswitch.authority.remove', { accountId, expectedRevision })).account;
+    }
+    bindAccount(input) {
+        return this.request('authswitch.authority.bind', input);
+    }
+    resolveAccess(input) {
+        return this.request('authswitch.authority.resolveAccess', input, 35_000, true);
+    }
+}
+/** Container-facing client. It can only resolve a previously issued binding capability. */
+export class AuthSwitchRuntimeClient {
+    target;
+    constructor(runtimeSocketPath) {
+        this.target = new plugins.typedrequest.TypedTarget({
+            supportsAbortSignal: true,
+            postMethod: (payload, options) => post(runtimeSocketPath, payload, options?.signal),
+        });
+    }
+    resolveAccess(input) {
+        return new plugins.typedrequest.TypedRequest(this.target, 'authswitch.authority.resolveAccess').fire(input, { timeoutMs: 35_000, maxRetries: 0 });
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5hdXRob3JpdHljbGllbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9jbGFzc2VzLmF1dGhvcml0eWNsaWVudC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFDQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQVF4QyxPQUFPLEVBQUUsOEJBQThCLEVBQUUsNkJBQTZCLEVBQ3BFLGdDQUFnQyxFQUFFLE1BQU0sK0JBQStCLENBQUM7QUFFMUUsTUFBTSxJQUFJLEdBQUcsQ0FBQyxJQUFZLEVBQUUsT0FBc0IsRUFBRSxNQUFvQixFQUEwQixFQUFFO0lBQ2hHLE9BQU8sSUFBSSxPQUFPLENBQUMsQ0FBQyxPQUFPLEVBQUUsTUFBTSxFQUFFLEVBQUU7UUFDckMsSUFBSSxNQUFNLEVBQUUsT0FBTyxFQUFFLENBQUM7WUFBQyxNQUFNLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1lBQUMsT0FBTztRQUFDLENBQUM7UUFDdkQsTUFBTSxNQUFNLEdBQUcsT0FBTyxDQUFDLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUNsRCxJQUFJLE9BQU8sR0FBRyxLQUFLLENBQUM7UUFDcEIsTUFBTSxLQUFLLEdBQUcsSUFBSSw4QkFBOEIsRUFBRSxDQUFDO1FBQ25ELE1BQU0sTUFBTSxHQUFHLENBQUMsS0FBZSxFQUFFLFFBQXdCLEVBQVEsRUFBRTtZQUNqRSxJQUFJLE9BQU87Z0JBQUUsT0FBTztZQUNwQixPQUFPLEdBQUcsSUFBSSxDQUFDO1lBQ2YsTUFBTSxFQUFFLG1CQUFtQixDQUFDLE9BQU8sRUFBRSxLQUFLLENBQUMsQ0FBQztZQUM1QyxNQUFNLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDakIsSUFBSSxLQUFLO2dCQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztpQkFDcEIsSUFBSSxRQUFRO2dCQUFFLE9BQU8sQ0FBQyxRQUFRLENBQUMsQ0FBQzs7Z0JBQ2hDLE1BQU0sQ0FBQyxJQUFJLEtBQUssQ0FBQyx5Q0FBeUMsQ0FBQyxDQUFDLENBQUM7UUFDcEUsQ0FBQyxDQUFDO1FBQ0YsTUFBTSxLQUFLLEdBQUcsR0FBRyxFQUFFLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxNQUFNLElBQUksSUFBSSxLQUFLLENBQUMsZ0NBQWdDLENBQUMsQ0FBQyxDQUFDO1FBQzFGLE1BQU0sRUFBRSxnQkFBZ0IsQ0FBQyxPQUFPLEVBQUUsS0FBSyxFQUFFLEVBQUUsSUFBSSxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7UUFDekQsTUFBTSxDQUFDLFVBQVUsQ0FBQyxNQUFNLEVBQUUsR0FBRyxFQUFFLENBQUMsTUFBTSxDQUFDLElBQUksS0FBSyxDQUFDLHNDQUFzQyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQzNGLE1BQU0sQ0FBQyxFQUFFLENBQUMsU0FBUyxFQUFFLEdBQUcsRUFBRTtZQUN4QixNQUFNLEdBQUcsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1lBQ3BDLElBQUksNkJBQTZCLENBQUMsR0FBRyxDQUFDLEdBQUcsZ0NBQWdDLEVBQUUsQ0FBQztnQkFBQyxNQUFNLENBQUMsSUFBSSxLQUFLLENBQUMsK0JBQStCLENBQUMsQ0FBQyxDQUFDO2dCQUFDLE9BQU87WUFBQyxDQUFDO1lBQzFJLE1BQU0sQ0FBQyxLQUFLLENBQUMsR0FBRyxHQUFHLElBQUksQ0FBQyxDQUFDO1FBQzNCLENBQUMsQ0FBQyxDQUFDO1FBQ0gsTUFBTSxDQUFDLEVBQUUsQ0FBQyxNQUFNLEVBQUUsS0FBSyxDQUFDLEVBQUU7WUFDeEIsSUFBSSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztnQkFBQyxNQUFNLENBQUMsSUFBSSxLQUFLLENBQUMsd0NBQXdDLENBQUMsQ0FBQyxDQUFDO2dCQUFDLE9BQU87WUFBQyxDQUFDO1lBQ3JHLElBQUksS0FBb0IsQ0FBQztZQUN6QixJQUFJLENBQUM7Z0JBQUMsS0FBSyxHQUFHLEtBQUssQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUM7WUFBQyxDQUFDO1lBQ2pDLE9BQU8sS0FBSyxFQUFFLENBQUM7Z0JBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO2dCQUFDLE9BQU87WUFBQyxDQUFDO1lBQ3hDLElBQUksS0FBSyxLQUFLLElBQUk7Z0JBQUUsT0FBTztZQUMzQixJQUFJLENBQUM7Z0JBQUMsTUFBTSxDQUFDLFNBQVMsRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBa0IsQ0FBQyxDQUFDO1lBQUMsQ0FBQztZQUM5RCxNQUFNLENBQUM7Z0JBQUMsTUFBTSxDQUFDLElBQUksS0FBSyxDQUFDLHdDQUF3QyxDQUFDLENBQUMsQ0FBQztZQUFDLENBQUM7UUFDeEUsQ0FBQyxDQUFDLENBQUM7UUFDSCxNQUFNLENBQUMsRUFBRSxDQUFDLE9BQU8sRUFBRSxHQUFHLEVBQUUsQ0FBQyxNQUFNLENBQUMsSUFBSSxLQUFLLENBQUMsbUNBQW1DLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDakYsTUFBTSxDQUFDLEVBQUUsQ0FBQyxPQUFPLEVBQUUsR0FBRyxFQUFFLENBQUMsTUFBTSxDQUFDLElBQUksS0FBSyxDQUFDLDBEQUEwRCxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQzFHLENBQUMsQ0FBQyxDQUFDO0FBQ1AsQ0FBQyxDQUFDO0FBaUJGLGtHQUFrRztBQUNsRyxNQUFNLE9BQU8sZ0JBQWdCO0lBSUM7SUFBb0M7SUFIL0MsTUFBTSxDQUFtQztJQUN6QyxhQUFhLENBQW1DO0lBRWpFLFlBQTRCLFVBQWtCLEVBQWtCLGlCQUF5QjtRQUE3RCxlQUFVLEdBQVYsVUFBVSxDQUFRO1FBQWtCLHNCQUFpQixHQUFqQixpQkFBaUIsQ0FBUTtRQUN2RixJQUFJLENBQUMsTUFBTSxHQUFHLElBQUksT0FBTyxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUM7WUFDakQsbUJBQW1CLEVBQUUsSUFBSTtZQUN6QixVQUFVLEVBQUUsQ0FBQyxPQUFPLEVBQUUsT0FBTyxFQUFFLEVBQUUsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxPQUFPLEVBQUUsT0FBTyxFQUFFLE1BQU0sQ0FBQztTQUNsRixDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsYUFBYSxHQUFHLElBQUksT0FBTyxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUM7WUFDeEQsbUJBQW1CLEVBQUUsSUFBSTtZQUN6QixVQUFVLEVBQUUsQ0FBQyxPQUFPLEVBQUUsT0FBTyxFQUFFLEVBQUUsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLGlCQUFpQixFQUFFLE9BQU8sRUFBRSxPQUFPLEVBQUUsTUFBTSxDQUFDO1NBQ3pGLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFTyxPQUFPLENBQTBCLE1BQW1CLEVBQUUsT0FBcUIsRUFBRSxTQUFTLEdBQUcsTUFBTSxFQUNyRyxPQUFPLEdBQUcsS0FBSyxFQUFFLE1BQW9CO1FBQ3JDLE9BQU8sSUFBSSxPQUFPLENBQUMsWUFBWSxDQUFDLFlBQVksQ0FBSSxPQUFPLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsTUFBTSxDQUFDO2FBQ2hHLElBQUksQ0FBQyxPQUFPLEVBQUUsRUFBRSxTQUFTLEVBQUUsVUFBVSxFQUFFLENBQUMsRUFBRSxXQUFXLEVBQUUsTUFBTSxFQUFFLENBQUMsQ0FBQztJQUN0RSxDQUFDO0lBRU0sS0FBSyxDQUFDLFFBQVEsQ0FBQyxVQUE4QyxFQUFFLEVBQUUsTUFBb0I7UUFDMUYsT0FBTyxDQUFDLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBMEIsK0JBQStCLEVBQUUsT0FBTyxFQUFFLE1BQU0sRUFBRSxLQUFLLEVBQUUsTUFBTSxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUM7SUFDakksQ0FBQztJQUVELHdHQUF3RztJQUNqRyxLQUFLLENBQUMsV0FBVyxDQUFDLFVBQW9ELEVBQUU7UUFDN0UsT0FBTyxJQUFJLEVBQUUsQ0FBQztZQUNaLElBQUksT0FBTyxDQUFDLE1BQU0sRUFBRSxPQUFPO2dCQUFFLE1BQU0sT0FBTyxDQUFDLE1BQU0sQ0FBQyxNQUFNLElBQUksSUFBSSxLQUFLLENBQUMsNkJBQTZCLENBQUMsQ0FBQztZQUNyRyxJQUFJLFlBQWdDLENBQUM7WUFDckMsSUFBSSxZQUFnQyxDQUFDO1lBQ3JDLElBQUksU0FBMEMsQ0FBQztZQUMvQyxJQUFJLE9BQU8sR0FBRyxLQUFLLENBQUM7WUFDcEIsT0FBTyxJQUFJLEVBQUUsQ0FBQztnQkFDWixNQUFNLElBQUksR0FBRyxNQUFNLElBQUksQ0FBQyxRQUFRLENBQUMsRUFBRSxZQUFZLEVBQUUsWUFBWSxFQUFFLEtBQUssRUFBRSxPQUFPLENBQUMsS0FBSyxFQUFFLEVBQUUsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDO2dCQUN2RyxJQUFJLENBQUMsU0FBUztvQkFBRSxTQUFTLEdBQUcsRUFBRSxHQUFHLElBQUksRUFBRSxRQUFRLEVBQUUsQ0FBQyxHQUFHLElBQUksQ0FBQyxRQUFRLENBQUMsRUFBRSxRQUFRLEVBQUUsQ0FBQyxHQUFHLElBQUksQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO3FCQUMvRixJQUFJLFNBQVMsQ0FBQyxLQUFLLEtBQUssSUFBSSxDQUFDLEtBQUssSUFBSSxTQUFTLENBQUMsUUFBUSxLQUFLLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztvQkFDaEYsT0FBTyxHQUFHLElBQUksQ0FBQztvQkFDZixNQUFNO2dCQUNSLENBQUM7cUJBQU0sQ0FBQztvQkFDTixTQUFTLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxHQUFHLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQztvQkFDMUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsR0FBRyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7Z0JBQzVDLENBQUM7Z0JBQ0QsWUFBWSxHQUFHLElBQUksQ0FBQyxpQkFBaUIsSUFBSSxZQUFZLElBQUksSUFBSSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUM7Z0JBQ2xGLFlBQVksR0FBRyxJQUFJLENBQUMsaUJBQWlCLElBQUksWUFBWSxJQUFJLElBQUksQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDO2dCQUNsRixJQUFJLENBQUMsSUFBSSxDQUFDLGlCQUFpQixJQUFJLENBQUMsSUFBSSxDQUFDLGlCQUFpQixFQUFFLENBQUM7b0JBQ3ZELE9BQU8sRUFBRSxHQUFHLFNBQVMsRUFBRSxpQkFBaUIsRUFBRSxJQUFJLEVBQUUsaUJBQWlCLEVBQUUsSUFBSSxFQUFFLENBQUM7Z0JBQzVFLENBQUM7WUFDSCxDQUFDO1lBQ0QsSUFBSSxDQUFDLE9BQU87Z0JBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyx3Q0FBd0MsQ0FBQyxDQUFDO1FBQzFFLENBQUM7SUFDSCxDQUFDO0lBRU0sTUFBTSxDQUFDLEtBQWEsRUFBRSxhQUFxQixFQUFFLE1BQU0sR0FBRyxNQUFNLEVBQUUsTUFBb0I7UUFDdkYsT0FBTyxJQUFJLENBQUMsT0FBTyxDQUF3Qiw2QkFBNkIsRUFBRSxFQUFFLEtBQUssRUFBRSxhQUFhLEVBQUUsTUFBTSxFQUFFLEVBQUUsTUFBTSxHQUFHLEtBQUssRUFBRSxLQUFLLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDN0ksQ0FBQztJQUVELCtHQUErRztJQUN4RyxLQUFLLENBQUMsU0FBUyxDQUFDLFVBQW1FLEVBQ3hGLE9BQWlFLEVBQUUsTUFBbUIsRUFDdEYsVUFBMEMsRUFBRTtRQUM1QyxNQUFNLFdBQVcsR0FBRyxPQUFPLENBQUMsV0FBVyxJQUFJLE1BQU0sQ0FBQztRQUNsRCxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxXQUFXLENBQUMsSUFBSSxXQUFXLEdBQUcsRUFBRSxJQUFJLFdBQVcsR0FBRyxNQUFNLEVBQUUsQ0FBQztZQUNuRixNQUFNLElBQUksS0FBSyxDQUFDLHdEQUF3RCxDQUFDLENBQUM7UUFDNUUsQ0FBQztRQUNELE1BQU0sS0FBSyxHQUFHLEdBQUcsRUFBRSxDQUFDLElBQUksT0FBTyxDQUFPLE9BQU8sQ0FBQyxFQUFFO1lBQzlDLE1BQU0sS0FBSyxHQUFHLFVBQVUsQ0FBQyxHQUFHLEVBQUUsR0FBRyxNQUFNLENBQUMsbUJBQW1CLENBQUMsT0FBTyxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsR0FBRyxDQUFDLENBQUM7WUFDbEcsTUFBTSxPQUFPLEdBQUcsR0FBRyxFQUFFLEdBQUcsWUFBWSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDMUQsTUFBTSxDQUFDLGdCQUFnQixDQUFDLE9BQU8sRUFBRSxPQUFPLEVBQUUsRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztRQUM1RCxDQUFDLENBQUMsQ0FBQztRQUNILElBQUksUUFBeUMsQ0FBQztRQUM5QyxJQUFJLFNBQVMsR0FBRyxLQUFLLENBQUM7UUFDdEIsSUFBSSxjQUFjLEdBQWtCLElBQUksQ0FBQztRQUN6QyxJQUFJLFNBQVMsR0FBa0IsSUFBSSxDQUFDO1FBQ3BDLElBQUksWUFBWSxHQUFrQixJQUFJLENBQUM7UUFDdkMsTUFBTSxNQUFNLEdBQUcsS0FBSyxFQUFFLEtBQTZDLEVBQ2pFLE1BQStDLEVBQWlCLEVBQUU7WUFDbEUsTUFBTSxPQUFPLENBQUMsUUFBUSxFQUFFLENBQUMsRUFBRSxLQUFLLEVBQUUsTUFBTSxFQUFFLEtBQUssRUFBRSxTQUFTLEVBQUUsUUFBUSxFQUFFLFlBQVksRUFBRSxjQUFjLEVBQUUsQ0FBQyxDQUFDO1FBQ3hHLENBQUMsQ0FBQztRQUNGLE1BQU0sVUFBVSxHQUFHLEtBQUssRUFBRSxNQUErQixFQUFpQixFQUFFO1lBQzFFLFFBQVEsR0FBRyxTQUFTLENBQUM7WUFDckIsSUFBSSxTQUFTLEVBQUUsQ0FBQztnQkFBQyxTQUFTLEdBQUcsS0FBSyxDQUFDO2dCQUFDLE1BQU0sTUFBTSxDQUFDLGFBQWEsRUFBRSxNQUFNLENBQUMsQ0FBQztZQUFDLENBQUM7UUFDNUUsQ0FBQyxDQUFDO1FBQ0YsSUFBSSxDQUFDO1lBQ0gsSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPO2dCQUFFLE1BQU0sTUFBTSxDQUFDLGFBQWEsRUFBRSxTQUFTLENBQUMsQ0FBQztZQUM1RCxPQUFPLENBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSxDQUFDO2dCQUN2QixJQUFJLENBQUMsUUFBUSxFQUFFLENBQUM7b0JBQ2QsSUFBSSxLQUEwQixDQUFDO29CQUMvQixJQUFJLENBQUM7d0JBQUMsS0FBSyxHQUFHLE1BQU0sSUFBSSxDQUFDLFdBQVcsQ0FBQyxFQUFFLE1BQU0sRUFBRSxDQUFDLENBQUM7b0JBQUMsQ0FBQztvQkFDbkQsTUFBTSxDQUFDO3dCQUNMLElBQUksTUFBTSxDQUFDLE9BQU87NEJBQUUsTUFBTTt3QkFDMUIsTUFBTSxVQUFVLENBQUMsWUFBWSxDQUFDLENBQUM7d0JBQy9CLE1BQU0sS0FBSyxFQUFFLENBQUM7d0JBQ2QsU0FBUztvQkFDWCxDQUFDO29CQUNELFFBQVEsR0FBRyxLQUFLLENBQUM7b0JBQ2pCLE1BQU0sVUFBVSxDQUFDLEtBQUssQ0FBQyxDQUFDO29CQUN4QixTQUFTLEdBQUcsSUFBSSxDQUFDO29CQUNqQixTQUFTLEdBQUcsS0FBSyxDQUFDLEtBQUssQ0FBQztvQkFDeEIsWUFBWSxHQUFHLEtBQUssQ0FBQyxRQUFRLENBQUM7b0JBQzlCLGNBQWMsR0FBRyxJQUFJLElBQUksRUFBRSxDQUFDLFdBQVcsRUFBRSxDQUFDO29CQUMxQyxNQUFNLE1BQU0sQ0FBQyxTQUFTLEVBQUUsVUFBVSxDQUFDLENBQUM7Z0JBQ3RDLENBQUM7Z0JBQ0QsSUFBSSxNQUF5QyxDQUFDO2dCQUM5QyxJQUFJLENBQUM7b0JBQUMsTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsS0FBSyxFQUFFLFFBQVEsQ0FBQyxRQUFRLEVBQUUsV0FBVyxFQUFFLE1BQU0sQ0FBQyxDQUFDO2dCQUFDLENBQUM7Z0JBQzNGLE1BQU0sQ0FBQztvQkFDTCxJQUFJLE1BQU0sQ0FBQyxPQUFPO3dCQUFFLE1BQU07b0JBQzFCLE1BQU0sVUFBVSxDQUFDLFlBQVksQ0FBQyxDQUFDO29CQUMvQixNQUFNLEtBQUssRUFBRSxDQUFDO29CQUNkLFNBQVM7Z0JBQ1gsQ0FBQztnQkFDRCxJQUFJLE1BQU0sQ0FBQyxjQUFjLElBQUksTUFBTSxDQUFDLEtBQUssS0FBSyxRQUFRLENBQUMsS0FBSzt1QkFDdkQsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLE1BQU0sS0FBSyxDQUFDLElBQUksTUFBTSxDQUFDLFFBQVEsS0FBSyxRQUFRLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztvQkFDM0UsTUFBTSxVQUFVLENBQUMsUUFBUSxDQUFDLENBQUM7b0JBQzNCLFNBQVM7Z0JBQ1gsQ0FBQztnQkFDRCxJQUFJLE1BQU0sQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFLENBQUM7b0JBQ3pCLElBQUksS0FBMEIsQ0FBQztvQkFDL0IsSUFBSSxDQUFDO3dCQUFDLEtBQUssR0FBRyxNQUFNLElBQUksQ0FBQyxXQUFXLENBQUMsRUFBRSxNQUFNLEVBQUUsQ0FBQyxDQUFDO29CQUFDLENBQUM7b0JBQ25ELE1BQU0sQ0FBQzt3QkFDTCxJQUFJLE1BQU0sQ0FBQyxPQUFPOzRCQUFFLE1BQU07d0JBQzFCLE1BQU0sVUFBVSxDQUFDLFlBQVksQ0FBQyxDQUFDO3dCQUMvQixNQUFNLEtBQUssRUFBRSxDQUFDO3dCQUNkLFNBQVM7b0JBQ1gsQ0FBQztvQkFDRCxJQUFJLEtBQUssQ0FBQyxLQUFLLEtBQUssTUFBTSxDQUFDLEtBQUssSUFBSSxLQUFLLENBQUMsUUFBUSxHQUFHLE1BQU0sQ0FBQyxRQUFRLEVBQUUsQ0FBQzt3QkFDckUsTUFBTSxVQUFVLENBQUMsUUFBUSxDQUFDLENBQUM7d0JBQzNCLFNBQVM7b0JBQ1gsQ0FBQztvQkFDRCxRQUFRLEdBQUcsS0FBSyxDQUFDO29CQUNqQixNQUFNLFVBQVUsQ0FBQyxLQUFLLENBQUMsQ0FBQztvQkFDeEIsS0FBSyxNQUFNLEtBQUssSUFBSSxNQUFNLENBQUMsTUFBTTt3QkFBRSxNQUFNLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQztvQkFDeEQsU0FBUyxHQUFHLEtBQUssQ0FBQyxLQUFLLENBQUM7b0JBQ3hCLFlBQVksR0FBRyxLQUFLLENBQUMsUUFBUSxDQUFDO29CQUM5QixjQUFjLEdBQUcsSUFBSSxJQUFJLEVBQUUsQ0FBQyxXQUFXLEVBQUUsQ0FBQztvQkFDMUMsTUFBTSxNQUFNLENBQUMsU0FBUyxFQUFFLE9BQU8sQ0FBQyxDQUFDO2dCQUNuQyxDQUFDO3FCQUFNLENBQUM7b0JBQ04sY0FBYyxHQUFHLElBQUksSUFBSSxFQUFFLENBQUMsV0FBVyxFQUFFLENBQUM7b0JBQzFDLE1BQU0sTUFBTSxDQUFDLFNBQVMsRUFBRSxXQUFXLENBQUMsQ0FBQztnQkFDdkMsQ0FBQztZQUNILENBQUM7UUFDSCxDQUFDO2dCQUFTLENBQUM7WUFDVCxTQUFTLEdBQUcsS0FBSyxDQUFDO1lBQ2xCLE1BQU0sTUFBTSxDQUFDLFFBQVEsRUFBRSxNQUFNLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLGdCQUFnQixDQUFDLENBQUM7UUFDdEUsQ0FBQztJQUNILENBQUM7SUFFTSxLQUFLLENBQUMsY0FBYztRQUN6QixPQUFPLENBQUMsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUEwQiwwQkFBMEIsRUFBRSxFQUFFLFVBQVUsRUFBRSxRQUFRLEVBQUUsSUFBSSxFQUFFLFFBQVEsRUFBRSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7SUFDdkksQ0FBQztJQUNNLEtBQUssQ0FBQyxpQkFBaUIsQ0FBQyxTQUFpQjtRQUM5QyxPQUFPLENBQUMsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUE2Qiw2QkFBNkIsRUFBRSxFQUFFLFNBQVMsRUFBRSxJQUFJLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQztJQUNsSSxDQUFDO0lBQ00sS0FBSyxDQUFDLFlBQVksQ0FBQyxXQUFtQjtRQUMzQyxPQUFPLENBQUMsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUE4QixnQ0FBZ0MsRUFBRSxFQUFFLFdBQVcsRUFBRSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7SUFDeEgsQ0FBQztJQUNNLEtBQUssQ0FBQyxlQUFlLENBQUMsV0FBbUI7UUFDOUMsT0FBTyxDQUFDLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBaUMsNkJBQTZCLEVBQUUsRUFBRSxXQUFXLEVBQUUsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO0lBQ3hILENBQUM7SUFDTSxLQUFLLENBQUMsYUFBYSxDQUFDLFNBQWlCLEVBQUUsZ0JBQXdCLEVBQUUsS0FBYTtRQUNuRixPQUFPLENBQUMsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUErQiw2QkFBNkIsRUFBRSxFQUFFLFNBQVMsRUFBRSxnQkFBZ0IsRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDO0lBQzNJLENBQUM7SUFDTSxLQUFLLENBQUMsYUFBYSxDQUFDLFNBQWlCLEVBQUUsZ0JBQXdCO1FBQ3BFLE9BQU8sQ0FBQyxNQUFNLElBQUksQ0FBQyxPQUFPLENBQStCLDZCQUE2QixFQUFFLEVBQUUsU0FBUyxFQUFFLGdCQUFnQixFQUFFLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQztJQUNwSSxDQUFDO0lBQ00sV0FBVyxDQUFDLEtBQTRDO1FBQzdELE9BQU8sSUFBSSxDQUFDLE9BQU8sQ0FBNkIsMkJBQTJCLEVBQUUsS0FBSyxDQUFDLENBQUM7SUFDdEYsQ0FBQztJQUNNLGFBQWEsQ0FBQyxLQUE4QztRQUNqRSxPQUFPLElBQUksQ0FBQyxPQUFPLENBQStCLG9DQUFvQyxFQUFFLEtBQUssRUFBRSxNQUFNLEVBQUUsSUFBSSxDQUFDLENBQUM7SUFDL0csQ0FBQztDQUNGO0FBRUQsMkZBQTJGO0FBQzNGLE1BQU0sT0FBTyx1QkFBdUI7SUFDakIsTUFBTSxDQUFtQztJQUMxRCxZQUFZLGlCQUF5QjtRQUNuQyxJQUFJLENBQUMsTUFBTSxHQUFHLElBQUksT0FBTyxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUM7WUFDakQsbUJBQW1CLEVBQUUsSUFBSTtZQUN6QixVQUFVLEVBQUUsQ0FBQyxPQUFPLEVBQUUsT0FBTyxFQUFFLEVBQUUsQ0FBQyxJQUFJLENBQUMsaUJBQWlCLEVBQUUsT0FBTyxFQUFFLE9BQU8sRUFBRSxNQUFNLENBQUM7U0FDcEYsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUNNLGFBQWEsQ0FBQyxLQUE4QztRQUNqRSxPQUFPLElBQUksT0FBTyxDQUFDLFlBQVksQ0FBQyxZQUFZLENBQStCLElBQUksQ0FBQyxNQUFNLEVBQ3BGLG9DQUFvQyxDQUFDLENBQUMsSUFBSSxDQUFDLEtBQUssRUFBRSxFQUFFLFNBQVMsRUFBRSxNQUFNLEVBQUUsVUFBVSxFQUFFLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDNUYsQ0FBQztDQUNGIn0=

package/dist_ts/classes.authoritydaemon.d.ts

@@ -0,0 +1,46 @@
+import { AuthSwitchAuthorityBroker, type IAuthSwitchAuthorityBrokerOptions } from './classes.authoritybroker.js';
+import { AuthSwitchAuthorityDatabase, type IAuthSwitchAuthorityDatabaseOptions } from './classes.authoritydatabase.js';
+import { AuthSwitchManagedCodex, type IAuthSwitchManagedCodexOptions } from './classes.codexmanaged.js';
+export interface IAuthSwitchAuthorityDaemonOptions extends IAuthSwitchAuthorityDatabaseOptions {
+    authoritySocketPath: string;
+    runtimeSocketPath: string;
+    broker?: IAuthSwitchAuthorityBrokerOptions;
+}
+/** TypedRequest handlers over a private one-request-per-connection Unix socket. */
+export declare class AuthSwitchAuthorityDaemon {
+    private readonly options;
+    readonly database: AuthSwitchAuthorityDatabase;
+    readonly broker: AuthSwitchAuthorityBroker;
+    private readonly managementRouter;
+    private readonly runtimeRouter;
+    private managementServer?;
+    private runtimeServer?;
+    private readonly sockets;
+    private readonly managedCodex;
+    private readonly managedCodexHomes;
+    private readonly managedCodexAccountIds;
+    private readonly drainingAccounts;
+    private readonly managedCodexStops;
+    private readonly managedCodexFailures;
+    private closing;
+    constructor(options: IAuthSwitchAuthorityDaemonOptions);
+    private register;
+    start(): Promise<void>;
+    /** Trusted in-process SDK admission; management RPC exposure belongs to the later CLI cutover. */
+    private drainManagedCodexAccount;
+    startManagedCodex(input: {
+        accountId: string;
+        scopeId: string;
+        workspaceDirectory: string;
+        codexHomeDirectory: string;
+        executable?: string;
+        onNotification?: IAuthSwitchManagedCodexOptions['onNotification'];
+        onServerRequest?: IAuthSwitchManagedCodexOptions['onServerRequest'];
+    }): Promise<AuthSwitchManagedCodex>;
+    stopManagedCodex(scopeId: string): Promise<void>;
+    private listen;
+    /** A killed daemon leaves a pathname behind; only remove an unchanged, owned, refused Unix socket. */
+    private clearStaleSocket;
+    private accept;
+    close(): Promise<void>;
+}