@modelprofile.com/authswitch 6.3.0 → 6.5.0

package/dist_ts/index.js

@@ -23,9 +23,35 @@ export * from './classes.service.js';
 export * from './classes.watch.js';
 export * from './classes.watchlock.js';
 export * from './watchpolicy.js';
+export * from './classes.authorityclient.js';
+export * from './classes.authoritydaemon.js';
+export * from './classes.authorityservice.js';
 import { AuthSwitchCli } from './classes.cli.js';
+import { AuthSwitchAuthorityService, resolveAuthSwitchAuthorityPaths, runAuthSwitchAuthorityDaemon } from './classes.authorityservice.js';
 export const runCli = async (argvArg = process.argv.slice(2)) => {
+    if (argvArg[0] === 'authority') {
+        const paths = resolveAuthSwitchAuthorityPaths();
+        if (argvArg[1] === 'daemon' && argvArg.length === 2) {
+            await runAuthSwitchAuthorityDaemon(paths);
+            return;
+        }
+        if (argvArg[1] === 'service' && argvArg.length === 3) {
+            const service = new AuthSwitchAuthorityService(paths.runtimeDirectory);
+            const action = argvArg[2];
+            const result = action === 'install' ? await service.install()
+                : action === 'status' ? await service.inspect()
+                    : action === 'enable' ? await service.enable()
+                        : action === 'start' ? await service.start()
+                            : action === 'stop' ? await service.stop()
+                                : null;
+            if (result !== null) {
+                process.stdout.write(JSON.stringify(result) + '\n');
+                return;
+            }
+        }
+        throw new Error('Usage: authswitch authority daemon | service install|status|enable|start|stop');
+    }
     const exitCode = await new AuthSwitchCli().run(argvArg);
     process.exitCode = exitCode;
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLDJCQUEyQixDQUFDO0FBQzFDLGNBQWMsOEJBQThCLENBQUM7QUFDN0MsY0FBYyxnQ0FBZ0MsQ0FBQztBQUMvQyxjQUFjLCtCQUErQixDQUFDO0FBQzlDLGNBQWMsMkJBQTJCLENBQUM7QUFDMUMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLDRCQUE0QixDQUFDO0FBQzNDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLDRCQUE0QixDQUFDO0FBQzNDLGNBQWMsa0JBQWtCLENBQUM7QUFDakMsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLHlCQUF5QixDQUFDO0FBQ3hDLGNBQWMsc0JBQXNCLENBQUM7QUFDckMsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsa0JBQWtCLENBQUM7QUFFakMsT0FBTyxFQUFFLGFBQWEsRUFBRSxNQUFNLGtCQUFrQixDQUFDO0FBRWpELE1BQU0sQ0FBQyxNQUFNLE1BQU0sR0FBRyxLQUFLLEVBQUUsVUFBb0IsT0FBTyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLEVBQWlCLEVBQUU7SUFDdkYsTUFBTSxRQUFRLEdBQUcsTUFBTSxJQUFJLGFBQWEsRUFBRSxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUN4RCxPQUFPLENBQUMsUUFBUSxHQUFHLFFBQVEsQ0FBQztBQUM5QixDQUFDLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLDJCQUEyQixDQUFDO0FBQzFDLGNBQWMsOEJBQThCLENBQUM7QUFDN0MsY0FBYyxnQ0FBZ0MsQ0FBQztBQUMvQyxjQUFjLCtCQUErQixDQUFDO0FBQzlDLGNBQWMsMkJBQTJCLENBQUM7QUFDMUMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLDRCQUE0QixDQUFDO0FBQzNDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLDRCQUE0QixDQUFDO0FBQzNDLGNBQWMsa0JBQWtCLENBQUM7QUFDakMsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLHlCQUF5QixDQUFDO0FBQ3hDLGNBQWMsc0JBQXNCLENBQUM7QUFDckMsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsa0JBQWtCLENBQUM7QUFDakMsY0FBYyw4QkFBOEIsQ0FBQztBQUM3QyxjQUFjLDhCQUE4QixDQUFDO0FBQzdDLGNBQWMsK0JBQStCLENBQUM7QUFFOUMsT0FBTyxFQUFFLGFBQWEsRUFBRSxNQUFNLGtCQUFrQixDQUFDO0FBQ2pELE9BQU8sRUFBRSwwQkFBMEIsRUFBRSwrQkFBK0IsRUFBRSw0QkFBNEIsRUFBRSxNQUFNLCtCQUErQixDQUFDO0FBRTFJLE1BQU0sQ0FBQyxNQUFNLE1BQU0sR0FBRyxLQUFLLEVBQUUsVUFBb0IsT0FBTyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLEVBQWlCLEVBQUU7SUFDdkYsSUFBSSxPQUFPLENBQUMsQ0FBQyxDQUFDLEtBQUssV0FBVyxFQUFFLENBQUM7UUFDL0IsTUFBTSxLQUFLLEdBQUcsK0JBQStCLEVBQUUsQ0FBQztRQUNoRCxJQUFJLE9BQU8sQ0FBQyxDQUFDLENBQUMsS0FBSyxRQUFRLElBQUksT0FBTyxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUNwRCxNQUFNLDRCQUE0QixDQUFDLEtBQUssQ0FBQyxDQUFDO1lBQzFDLE9BQU87UUFDVCxDQUFDO1FBQ0QsSUFBSSxPQUFPLENBQUMsQ0FBQyxDQUFDLEtBQUssU0FBUyxJQUFJLE9BQU8sQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDckQsTUFBTSxPQUFPLEdBQUcsSUFBSSwwQkFBMEIsQ0FBQyxLQUFLLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztZQUN2RSxNQUFNLE1BQU0sR0FBRyxPQUFPLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDMUIsTUFBTSxNQUFNLEdBQUcsTUFBTSxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsTUFBTSxPQUFPLENBQUMsT0FBTyxFQUFFO2dCQUMzRCxDQUFDLENBQUMsTUFBTSxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsTUFBTSxPQUFPLENBQUMsT0FBTyxFQUFFO29CQUMvQyxDQUFDLENBQUMsTUFBTSxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsTUFBTSxPQUFPLENBQUMsTUFBTSxFQUFFO3dCQUM5QyxDQUFDLENBQUMsTUFBTSxLQUFLLE9BQU8sQ0FBQyxDQUFDLENBQUMsTUFBTSxPQUFPLENBQUMsS0FBSyxFQUFFOzRCQUM1QyxDQUFDLENBQUMsTUFBTSxLQUFLLE1BQU0sQ0FBQyxDQUFDLENBQUMsTUFBTSxPQUFPLENBQUMsSUFBSSxFQUFFO2dDQUMxQyxDQUFDLENBQUMsSUFBSSxDQUFDO1lBQ1QsSUFBSSxNQUFNLEtBQUssSUFBSSxFQUFFLENBQUM7Z0JBQ3BCLE9BQU8sQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLEdBQUcsSUFBSSxDQUFDLENBQUM7Z0JBQ3BELE9BQU87WUFDVCxDQUFDO1FBQ0gsQ0FBQztRQUNELE1BQU0sSUFBSSxLQUFLLENBQUMsK0VBQStFLENBQUMsQ0FBQztJQUNuRyxDQUFDO0lBQ0QsTUFBTSxRQUFRLEdBQUcsTUFBTSxJQUFJLGFBQWEsRUFBRSxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUN4RCxPQUFPLENBQUMsUUFBUSxHQUFHLFFBQVEsQ0FBQztBQUM5QixDQUFDLENBQUMifQ==

package/dist_ts/plugins.d.ts

@@ -3,8 +3,10 @@ import * as os from 'node:os';
 import * as path from 'node:path';
 import * as childProcess from 'node:child_process';
 import * as crypto from 'node:crypto';
+import * as net from 'node:net';
+import { fileURLToPath } from 'node:url';
 import type { DatabaseSync } from 'node:sqlite';
-export { childProcess, crypto, fs, os, path };
+export { childProcess, crypto, fileURLToPath, fs, net, os, path };
 export type { DatabaseSync };
 /** SQLite is needed only when accessing a Codex state database, not when hosting account APIs. */
 export declare const loadSqlite: () => typeof import("node:sqlite");
@@ -16,9 +18,15 @@ export type TProperLockfile = typeof properLockfile;
  */
 export declare const loadProperLockfile: () => Promise<TProperLockfile>;
 import * as smartconsole from '@push.rocks/smartconsole';
-export { smartconsole };
+import * as smartdata from '@push.rocks/smartdata';
+import * as smartdb from '@push.rocks/smartdb';
+import * as smartsecret from '@push.rocks/smartsecret';
+import * as smartdaemon from '@push.rocks/smartdaemon';
+import * as typedrequest from '@api.global/typedrequest';
+export { smartconsole, smartdata, smartdb, smartsecret, smartdaemon, typedrequest };
 import * as flexModels from '@modelprofile.com/flexharness-models';
 import * as flexOpenAi from '@modelprofile.com/flexharness-providers/openai';
 import * as flexAuth from '@modelprofile.com/flexharness-providers/auth';
 import * as flexAccounts from '@modelprofile.com/flexharness-providers/accounts';
-export { flexModels, flexOpenAi, flexAuth, flexAccounts };
+import * as crossharness from '@modelprofile.com/mcp-crossharness';
+export { flexModels, flexOpenAi, flexAuth, flexAccounts, crossharness };

package/dist_ts/plugins.js

@@ -4,8 +4,10 @@ import * as os from 'node:os';
 import * as path from 'node:path';
 import * as childProcess from 'node:child_process';
 import * as crypto from 'node:crypto';
+import * as net from 'node:net';
 import { createRequire } from 'node:module';
-export { childProcess, crypto, fs, os, path };
+import { fileURLToPath } from 'node:url';
+export { childProcess, crypto, fileURLToPath, fs, net, os, path };
 const nativeRequire = createRequire(import.meta.url);
 /** SQLite is needed only when accessing a Codex state database, not when hosting account APIs. */
 export const loadSqlite = () => nativeRequire('node:sqlite');
@@ -16,11 +18,17 @@ export const loadSqlite = () => nativeRequire('node:sqlite');
 export const loadProperLockfile = () => import('proper-lockfile');
 // @push.rocks modules
 import * as smartconsole from '@push.rocks/smartconsole';
-export { smartconsole };
+import * as smartdata from '@push.rocks/smartdata';
+import * as smartdb from '@push.rocks/smartdb';
+import * as smartsecret from '@push.rocks/smartsecret';
+import * as smartdaemon from '@push.rocks/smartdaemon';
+import * as typedrequest from '@api.global/typedrequest';
+export { smartconsole, smartdata, smartdb, smartsecret, smartdaemon, typedrequest };
 // @modelprofile.com modules
 import * as flexModels from '@modelprofile.com/flexharness-models';
 import * as flexOpenAi from '@modelprofile.com/flexharness-providers/openai';
 import * as flexAuth from '@modelprofile.com/flexharness-providers/auth';
 import * as flexAccounts from '@modelprofile.com/flexharness-providers/accounts';
-export { flexModels, flexOpenAi, flexAuth, flexAccounts };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3BsdWdpbnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsc0JBQXNCO0FBQ3RCLE9BQU8sS0FBSyxFQUFFLE1BQU0sU0FBUyxDQUFDO0FBQzlCLE9BQU8sS0FBSyxFQUFFLE1BQU0sU0FBUyxDQUFDO0FBQzlCLE9BQU8sS0FBSyxJQUFJLE1BQU0sV0FBVyxDQUFDO0FBQ2xDLE9BQU8sS0FBSyxZQUFZLE1BQU0sb0JBQW9CLENBQUM7QUFDbkQsT0FBTyxLQUFLLE1BQU0sTUFBTSxhQUFhLENBQUM7QUFDdEMsT0FBTyxFQUFFLGFBQWEsRUFBRSxNQUFNLGFBQWEsQ0FBQztBQUc1QyxPQUFPLEVBQUUsWUFBWSxFQUFFLE1BQU0sRUFBRSxFQUFFLEVBQUUsRUFBRSxFQUFFLElBQUksRUFBRSxDQUFDO0FBRTlDLE1BQU0sYUFBYSxHQUFHLGFBQWEsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDO0FBQ3JELGtHQUFrRztBQUNsRyxNQUFNLENBQUMsTUFBTSxVQUFVLEdBQUcsR0FBaUMsRUFBRSxDQUFDLGFBQWEsQ0FBQyxhQUFhLENBQUMsQ0FBQztBQUszRjs7O0dBR0c7QUFDSCxNQUFNLENBQUMsTUFBTSxrQkFBa0IsR0FBRyxHQUE2QixFQUFFLENBQUMsTUFBTSxDQUFDLGlCQUFpQixDQUFDLENBQUM7QUFFNUYsc0JBQXNCO0FBQ3RCLE9BQU8sS0FBSyxZQUFZLE1BQU0sMEJBQTBCLENBQUM7QUFDekQsT0FBTyxFQUFFLFlBQVksRUFBRSxDQUFDO0FBRXhCLDRCQUE0QjtBQUM1QixPQUFPLEtBQUssVUFBVSxNQUFNLHNDQUFzQyxDQUFDO0FBQ25FLE9BQU8sS0FBSyxVQUFVLE1BQU0sZ0RBQWdELENBQUM7QUFDN0UsT0FBTyxLQUFLLFFBQVEsTUFBTSw4Q0FBOEMsQ0FBQztBQUN6RSxPQUFPLEtBQUssWUFBWSxNQUFNLGtEQUFrRCxDQUFDO0FBQ2pGLE9BQU8sRUFBRSxVQUFVLEVBQUUsVUFBVSxFQUFFLFFBQVEsRUFBRSxZQUFZLEVBQUUsQ0FBQyJ9
+import * as crossharness from '@modelprofile.com/mcp-crossharness';
+export { flexModels, flexOpenAi, flexAuth, flexAccounts, crossharness };
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3BsdWdpbnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsc0JBQXNCO0FBQ3RCLE9BQU8sS0FBSyxFQUFFLE1BQU0sU0FBUyxDQUFDO0FBQzlCLE9BQU8sS0FBSyxFQUFFLE1BQU0sU0FBUyxDQUFDO0FBQzlCLE9BQU8sS0FBSyxJQUFJLE1BQU0sV0FBVyxDQUFDO0FBQ2xDLE9BQU8sS0FBSyxZQUFZLE1BQU0sb0JBQW9CLENBQUM7QUFDbkQsT0FBTyxLQUFLLE1BQU0sTUFBTSxhQUFhLENBQUM7QUFDdEMsT0FBTyxLQUFLLEdBQUcsTUFBTSxVQUFVLENBQUM7QUFDaEMsT0FBTyxFQUFFLGFBQWEsRUFBRSxNQUFNLGFBQWEsQ0FBQztBQUM1QyxPQUFPLEVBQUUsYUFBYSxFQUFFLE1BQU0sVUFBVSxDQUFDO0FBR3pDLE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSxFQUFFLGFBQWEsRUFBRSxFQUFFLEVBQUUsR0FBRyxFQUFFLEVBQUUsRUFBRSxJQUFJLEVBQUUsQ0FBQztBQUVsRSxNQUFNLGFBQWEsR0FBRyxhQUFhLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQztBQUNyRCxrR0FBa0c7QUFDbEcsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHLEdBQWlDLEVBQUUsQ0FBQyxhQUFhLENBQUMsYUFBYSxDQUFDLENBQUM7QUFLM0Y7OztHQUdHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sa0JBQWtCLEdBQUcsR0FBNkIsRUFBRSxDQUFDLE1BQU0sQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO0FBRTVGLHNCQUFzQjtBQUN0QixPQUFPLEtBQUssWUFBWSxNQUFNLDBCQUEwQixDQUFDO0FBQ3pELE9BQU8sS0FBSyxTQUFTLE1BQU0sdUJBQXVCLENBQUM7QUFDbkQsT0FBTyxLQUFLLE9BQU8sTUFBTSxxQkFBcUIsQ0FBQztBQUMvQyxPQUFPLEtBQUssV0FBVyxNQUFNLHlCQUF5QixDQUFDO0FBQ3ZELE9BQU8sS0FBSyxXQUFXLE1BQU0seUJBQXlCLENBQUM7QUFDdkQsT0FBTyxLQUFLLFlBQVksTUFBTSwwQkFBMEIsQ0FBQztBQUN6RCxPQUFPLEVBQUUsWUFBWSxFQUFFLFNBQVMsRUFBRSxPQUFPLEVBQUUsV0FBVyxFQUFFLFdBQVcsRUFBRSxZQUFZLEVBQUUsQ0FBQztBQUVwRiw0QkFBNEI7QUFDNUIsT0FBTyxLQUFLLFVBQVUsTUFBTSxzQ0FBc0MsQ0FBQztBQUNuRSxPQUFPLEtBQUssVUFBVSxNQUFNLGdEQUFnRCxDQUFDO0FBQzdFLE9BQU8sS0FBSyxRQUFRLE1BQU0sOENBQThDLENBQUM7QUFDekUsT0FBTyxLQUFLLFlBQVksTUFBTSxrREFBa0QsQ0FBQztBQUNqRixPQUFPLEtBQUssWUFBWSxNQUFNLG9DQUFvQyxDQUFDO0FBQ25FLE9BQU8sRUFBRSxVQUFVLEVBQUUsVUFBVSxFQUFFLFFBQVEsRUFBRSxZQUFZLEVBQUUsWUFBWSxFQUFFLENBQUMifQ==

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modelprofile.com/authswitch",
-  "version": "6.3.0",
+  "version": "6.5.0",
   "private": false,
   "description": "Manage Codex, OpenCode and Claude Code accounts with guided switching and live usage status",
   "main": "dist_ts/index.js",
@@ -13,6 +13,18 @@
     "./mutation": {
       "types": "./dist_ts/mutation.d.ts",
       "import": "./dist_ts/mutation.js"
+    },
+    "./authority-contract": {
+      "types": "./dist_ts/authority-contract.d.ts",
+      "import": "./dist_ts/authority-contract.js"
+    },
+    "./authority-client": {
+      "types": "./dist_ts/classes.authorityclient.d.ts",
+      "import": "./dist_ts/classes.authorityclient.js"
+    },
+    "./authority-daemon": {
+      "types": "./dist_ts/classes.authoritydaemon.d.ts",
+      "import": "./dist_ts/classes.authoritydaemon.js"
     }
   },
   "type": "module",
@@ -37,12 +49,21 @@
     "@git.zone/tsrun": "^2.0.6",
     "@git.zone/tstest": "^6.1.1",
     "@types/node": "26.5.1",
-    "esbuild": "^0.28.2"
+    "@types/ws": "8.18.1",
+    "esbuild": "^0.28.2",
+    "ws": "8.21.2"
   },
   "dependencies": {
-    "@modelprofile.com/flexharness-models": "^7.0.1",
-    "@modelprofile.com/flexharness-providers": "^7.0.1",
+    "@api.global/typedrequest": "8.1.0",
+    "@api.global/typedrequest-interfaces": "7.1.0",
+    "@modelprofile.com/flexharness-models": "^8.0.0",
+    "@modelprofile.com/flexharness-providers": "^8.0.0",
+    "@modelprofile.com/mcp-crossharness": "5.4.0",
     "@push.rocks/smartconsole": "^1.3.0",
+    "@push.rocks/smartdaemon": "2.7.0",
+    "@push.rocks/smartdata": "11.14.2",
+    "@push.rocks/smartdb": "7.0.1",
+    "@push.rocks/smartsecret": "1.8.0",
     "@types/proper-lockfile": "^4.1.4",
     "proper-lockfile": "^4.1.2"
   },

package/readme.md

@@ -24,6 +24,65 @@ pnpm install -g @modelprofile.com/authswitch
 
 Node.js 24 or newer is required.
 
+## Authority SDK (new account registry)
+
+The package also exports a typed client for a per-user authswitch authority daemon. Its
+SmartData registry stores account identity separately from sealed refresh grants, runtime
+bindings, Codex enrollment records, and native-handoff and migration journals. A daemon
+owns OpenAI device login, targeted reauthentication, and proactive refresh for grants
+added through this API. Management snapshots and events contain no credentials.
+
+```ts
+import { AuthSwitchClient } from '@modelprofile.com/authswitch/authority-client';
+import { resolveAuthSwitchAuthorityPaths } from '@modelprofile.com/authswitch';
+
+const paths = resolveAuthSwitchAuthorityPaths();
+const client = new AuthSwitchClient(paths.authoritySocketPath, paths.runtimeSocketPath);
+const snapshot = await client.snapshotAll();
+const operation = await client.beginAddOpenAi();
+```
+
+Browser code can import the credential-free DTOs from
+`@modelprofile.com/authswitch/authority-contract`. A backend binds an account to a
+runtime incarnation and keeps the returned capability private. The runtime-only socket
+resolves that binding to a current access token; its directory can be mounted into a
+container without exposing the management socket. A provider that rejects a specific
+access-token generation can request a newer one through `rejectedGrantGeneration`; the
+authority coalesces concurrent rejection callbacks and never replays an uncertain refresh.
+
+`AuthSwitchClient.subscribe(onSnapshot, onEvent, signal, { onStatus })` reports `current`
+after a fresh snapshot or verified heartbeat, `unavailable` on disconnect or resync, and
+`closed` on abort. Keep cached account actions disabled while status is not `current`.
+Every change-event batch supplies a fresh snapshot before `onEvent`, so a consumer does
+not need to reconstruct account state from events. `lastVerifiedAt` records the last
+successful daemon response, including an empty heartbeat.
+
+A trusted in-process daemon host can call `AuthSwitchAuthorityDaemon.startManagedCodex()`
+for a bound account and workspace. It owns a private Codex 0.155.1 app-server, passes only
+the authority's current access token through Codex's external-token login, answers its
+unauthorized callback through the authority, and revokes the binding on stop. The returned
+runtime exposes an interactive `codex --remote unix://…` launch descriptor and native
+`thread/start`, `thread/resume` and `turn/start` methods for noninteractive consumers.
+Callers supply a private, durable `codexHomeDirectory` for Codex's own configuration and
+conversation state. SmartData binds that home immutably to one account and scope, and the
+daemon records its active process/socket identity before launching it. Admission refuses
+an existing nonempty native home or a surviving app-server owner; a fresh empty home is
+created on first use. Account removal drains its managed Codex processes before the
+grant is removed, and targeted reauthentication holds new admissions until the device
+operation settles. Only the private socket directory is removed on close. Codex's
+credential store remains ephemeral and does not read or write `auth.json` in that home.
+Codex 0.155.1 does not persist an unused thread created by `thread/start`; resume applies
+after Codex has committed a rollout. The existing CLI has not yet been moved to this path.
+
+This SDK is additive at this stage. The commands documented below still use the existing
+credential stores. The authority daemon does not import those stores automatically,
+replace their active native sessions, or take over their refresh grants. An active
+Codex/OpenCode native grant remains pending until its owner is idle and an explicit
+handoff verifies the latest native source. Claude Code's own native credential files
+remain vendor-owned; a container setup-token grant is a separate grant under the same
+account. The one-time migration and deletion of authswitch's old stores are separate
+cutover steps.
+
 ## Usage
 
 Run `authswitch`, `authswitch -i`, or `authswitch --interactive` for an interactive guide. Use the arrow keys and

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@modelprofile.com/authswitch',
-  version: '6.3.0',
+  version: '6.5.0',
   description: 'Manage Codex, OpenCode and Claude Code accounts with guided switching and live usage status'
 }

package/ts/authority-contract.ts

@@ -0,0 +1,109 @@
+import type { ITypedRequest } from '@api.global/typedrequest-interfaces';
+
+/** Credential-free account management contract. Safe to import in browser code. */
+export type TAuthSwitchAccountHealth = 'ready' | 'refreshing' | 'retry_wait' | 'needs_reauth' | 'native' | 'legacy_native_pending' | 'removed';
+
+export interface IAuthSwitchAccount {
+  id: string;
+  providerId: string;
+  label: string;
+  email: string | null;
+  plan: string | null;
+  health: TAuthSwitchAccountHealth;
+  owner: 'daemon' | 'claude_native' | 'legacy_native' | 'none';
+  grantGeneration: number;
+  revision: number;
+  accessExpiresAt: string | null;
+  retryAt: string | null;
+  problem: 'none' | 'provider_unavailable' | 'exchange_uncertain' | 'provider_rejected' | 'native_owner';
+  statusObservedAt: string;
+}
+
+export interface IAuthSwitchBinding {
+  id: string;
+  accountId: string;
+  runtime: 'flex' | 'codex' | 'opencode' | 'claude';
+  scopeId: string;
+  incarnationId: string;
+  revision: number;
+}
+
+export interface IAuthSwitchSnapshot {
+  schemaVersion: 1;
+  epoch: string;
+  revision: number;
+  generatedAt: string;
+  accounts: IAuthSwitchAccount[];
+  bindings: IAuthSwitchBinding[];
+  nextAccountCursor: string | null;
+  nextBindingCursor: string | null;
+}
+
+export interface IAuthSwitchAccountEvent {
+  epoch: string;
+  revision: number;
+  kind: 'account' | 'binding';
+  accountId: string;
+}
+
+export type TAuthSwitchLoginPrompt =
+  | { flow: 'device'; verificationUrl: string; userCode: string }
+  | { flow: 'browser'; authUrl: string };
+
+export interface IAuthSwitchOperation {
+  id: string;
+  state: 'pending' | 'complete' | 'failed' | 'cancelled';
+  prompt: TAuthSwitchLoginPrompt | null;
+  account: IAuthSwitchAccount | null;
+  error: string | null;
+}
+
+export interface IReq_AuthSwitchSnapshot extends ITypedRequest {
+  method: 'authswitch.authority.snapshot';
+  request: { accountAfter?: string; bindingAfter?: string; limit?: number };
+  response: { snapshot: IAuthSwitchSnapshot };
+}
+
+export interface IReq_AuthSwitchEvents extends ITypedRequest {
+  method: 'authswitch.authority.events';
+  request: { epoch: string; afterRevision: number; waitMs: number };
+  response: { epoch: string; revision: number; resyncRequired: boolean; events: IAuthSwitchAccountEvent[] };
+}
+
+export interface IReq_AuthSwitchBeginAdd extends ITypedRequest {
+  method: 'authswitch.authority.add';
+  request: { providerId: 'openai'; flow: 'device' };
+  response: { operation: IAuthSwitchOperation };
+}
+
+export interface IReq_AuthSwitchBeginReauth extends ITypedRequest {
+  method: 'authswitch.authority.reauth';
+  request: { accountId: string; flow: 'device' };
+  response: { operation: IAuthSwitchOperation };
+}
+
+export interface IReq_AuthSwitchGetOperation extends ITypedRequest {
+  method: 'authswitch.authority.operation';
+  request: { operationId: string };
+  response: { operation: IAuthSwitchOperation };
+}
+
+export interface IReq_AuthSwitchCancelOperation extends ITypedRequest {
+  method: 'authswitch.authority.cancel';
+  request: { operationId: string };
+  response: { operation: IAuthSwitchOperation };
+}
+
+export interface IReq_AuthSwitchRenameAccount extends ITypedRequest {
+  method: 'authswitch.authority.rename';
+  request: { accountId: string; expectedRevision: number; label: string };
+  response: { account: IAuthSwitchAccount };
+}
+
+export interface IReq_AuthSwitchRemoveAccount extends ITypedRequest {
+  method: 'authswitch.authority.remove';
+  request: { accountId: string; expectedRevision: number };
+  response: { account: IAuthSwitchAccount };
+}
+
+/** Runtime capability is returned only to trusted backend callers; do not expose this response in a browser API. */

package/ts/authority-runtime-contract.ts

@@ -0,0 +1,33 @@
+import type { ITypedRequest } from '@api.global/typedrequest-interfaces';
+import type { IAuthSwitchBinding } from './authority-contract.js';
+
+/** Backend-only binding operation. The capability must never enter a browser-facing response. */
+export interface IReq_AuthSwitchBindAccount extends ITypedRequest {
+  method: 'authswitch.authority.bind';
+  request: {
+    accountId: string;
+    runtime: IAuthSwitchBinding['runtime'];
+    scopeId: string;
+    incarnationId: string;
+  };
+  response: { binding: IAuthSwitchBinding; capability: string };
+}
+
+/** Backend-only access operation. Refresh grants never cross this interface. */
+export interface IReq_AuthSwitchResolveAccess extends ITypedRequest {
+  method: 'authswitch.authority.resolveAccess';
+  request: {
+    bindingId: string;
+    capability: string;
+    minValidityMs: number;
+    /** The provider rejected this exact access-token generation. */
+    rejectedGrantGeneration?: number;
+  };
+  response: {
+    accessToken: string;
+    accountId: string;
+    isFedrampAccount: boolean;
+    expiresAt: string;
+    grantGeneration: number;
+  };
+}