@modelprofile.com/authswitch 8.0.0 → 8.2.0

package/ts/classes.authoritycli.ts

@@ -1,5 +1,8 @@
 import type { IAuthSwitchDoctorPage, IAuthSwitchOperation, IAuthSwitchPreuseOperation,
   IAuthSwitchSnapshot, IReq_AuthSwitchDoctor, IReq_AuthSwitchStartPreuse } from './authority-contract.js';
+import { isAuthSwitchImportRefusal } from './authority-import-contract.js';
+import type { IAuthSwitchImportInventory, IAuthSwitchImportResult, IAuthSwitchImportStatus,
+  IReq_AuthSwitchImportStatus, TAuthSwitchImportAction } from './authority-import-contract.js';
 import { AuthSwitchClient } from './classes.authorityclient.js';
 import { resolveAuthSwitchAuthorityPaths } from './classes.authorityservice.js';
 import { defaultPreusePrompt, validatePreuseOptions } from './preuse.js';
@@ -9,6 +12,9 @@ import * as plugins from './plugins.js';
 export interface IAuthSwitchAuthorityCliClient {
   snapshotAll(): Promise<IAuthSwitchSnapshot>;
   doctorPage(request: IReq_AuthSwitchDoctor['request']): Promise<IAuthSwitchDoctorPage>;
+  importInventory(): Promise<IAuthSwitchImportInventory>;
+  importStatus(request: IReq_AuthSwitchImportStatus['request']): Promise<IAuthSwitchImportStatus>;
+  submitImport(sourceId: string, sourceDigest: string): Promise<IAuthSwitchImportResult>;
   beginAddOpenAi(operationId: string): Promise<IAuthSwitchOperation>;
   beginReauthOpenAi(operationId: string, accountId: string, loginId: string,
     purpose: 'openai_managed'): Promise<IAuthSwitchOperation>;
@@ -33,6 +39,9 @@ export interface IAuthSwitchAuthorityCliOptions {
 type TAuthorityCliCommand =
   | { kind: 'list'; json: boolean }
   | { kind: 'doctor'; json: boolean }
+  | { kind: 'importInventory'; json: boolean }
+  | { kind: 'importStatus'; json: boolean }
+  | { kind: 'importSubmit'; sourceId: string; sourceDigest: string; json: boolean }
   | { kind: 'add'; json: boolean }
   | { kind: 'reauth'; accountId: string; loginId: string; json: boolean }
   | { kind: 'get'; operationId: string; json: boolean }
@@ -51,9 +60,11 @@ class AuthorityCliFailure extends Error {
   }
 }
 
-const usage = 'Usage: authswitch account list [--json] | authswitch account add openai [--json] | authswitch account reauth <account-id> <login-id> [--json] | authswitch account operation get|cancel|resume <operation-id> [--json] | authswitch account preuse <account-id> <login-id>|--all [--prompt <text>] [--model <id>] [--json] | authswitch account preuse operation get|cancel|resume <operation-id> [--json] | authswitch authority doctor [--json]';
+const usage = 'Usage: authswitch account list [--json] | authswitch account add openai [--json] | authswitch account reauth <account-id> <login-id> [--json] | authswitch account operation get|cancel|resume <operation-id> [--json] | authswitch account preuse <account-id> <login-id>|--all [--prompt <text>] [--model <id>] [--json] | authswitch account preuse operation get|cancel|resume <operation-id> [--json] | authswitch authority doctor [--json] | authswitch authority import inventory [--json] | authswitch authority import status [--json] | authswitch authority import submit <source-id> --digest <source-digest> [--json]';
 const safe = (value: string | number | null): string => plainText(value === null ? 'none' : String(value));
 const isId = (value: string | undefined): value is string => Boolean(value && !value.startsWith('-'));
+const isHash = (value: string | undefined): value is string =>
+  typeof value === 'string' && /^[a-f0-9]{64}$/.test(value);
 
 const parsePreuse = (argv: readonly string[]): TAuthorityCliCommand | null => {
   if (argv[2] === 'operation') {
@@ -109,6 +120,21 @@ const parse = (argv: readonly string[]): TAuthorityCliCommand | null => {
     && (argv.length === 2 || (argv.length === 3 && argv[2] === '--json'))) {
     return { kind: 'doctor', json: argv[2] === '--json' };
   }
+  if (argv[0] === 'authority' && argv[1] === 'import' && argv[2] === 'inventory'
+    && (argv.length === 3 || (argv.length === 4 && argv[3] === '--json'))) {
+    return { kind: 'importInventory', json: argv[3] === '--json' };
+  }
+  if (argv[0] === 'authority' && argv[1] === 'import' && argv[2] === 'status'
+    && (argv.length === 3 || (argv.length === 4 && argv[3] === '--json'))) {
+    return { kind: 'importStatus', json: argv[3] === '--json' };
+  }
+  if (argv[0] === 'authority' && argv[1] === 'import' && argv[2] === 'submit') {
+    // The digest the owner read in the inventory is part of the command: the daemon refuses a source whose
+    // bytes have changed since, so approving one source can never import a different one.
+    if (!isHash(argv[3]) || argv[4] !== '--digest' || !isHash(argv[5])
+      || (argv.length !== 6 && (argv.length !== 7 || argv[6] !== '--json'))) return null;
+    return { kind: 'importSubmit', sourceId: argv[3], sourceDigest: argv[5], json: argv[6] === '--json' };
+  }
   if (argv[0] === 'account' && argv[1] === 'add' && argv[2] === 'openai'
     && (argv.length === 3 || (argv.length === 4 && argv[3] === '--json'))) {
     return { kind: 'add', json: argv[3] === '--json' };
@@ -143,6 +169,18 @@ class ScopedAuthorityCliClient implements IAuthSwitchAuthorityCliClient {
     return this.client.doctorPage(request, this.controller.signal);
   }
 
+  public importInventory(): Promise<IAuthSwitchImportInventory> {
+    return this.client.importInventory(this.controller.signal);
+  }
+
+  public importStatus(request: IReq_AuthSwitchImportStatus['request']): Promise<IAuthSwitchImportStatus> {
+    return this.client.importStatus(request, this.controller.signal);
+  }
+
+  public submitImport(sourceId: string, sourceDigest: string): Promise<IAuthSwitchImportResult> {
+    return this.client.submitImport({ kind: 'local', sourceId, sourceDigest }, this.controller.signal);
+  }
+
   public beginAddOpenAi(operationId: string): Promise<IAuthSwitchOperation> {
     return this.client.beginAddOpenAi(operationId, this.controller.signal);
   }
@@ -201,6 +239,91 @@ const renderList = (snapshot: IAuthSwitchSnapshot): string => {
   return lines.join('\n') + '\n';
 };
 
+/**
+ * The legacy-source report.
+ *
+ * The notice comes first and is never abbreviated: an import is a one-way transfer of ownership, and this is
+ * the only place an owner reads what that costs before approving it.
+ */
+const renderInventory = (inventory: IAuthSwitchImportInventory): string => {
+  const lines = [`Legacy account sources — generated ${safe(inventory.generatedAt)}, environment ${safe(inventory.environmentId)}`,
+    'Before you import:'];
+  for (const notice of inventory.notice) lines.push(`  - ${safe(notice)}`);
+  lines.push('');
+  if (inventory.sources.length === 0) lines.push('No legacy credential source was found.');
+  for (const source of inventory.sources) {
+    lines.push(`${safe(source.label ?? source.email ?? source.sourceKind)} [${safe(source.providerId)}]`,
+      `  source ${safe(source.id)}; kind ${safe(source.sourceKind)}; treatment ${safe(source.treatment)}; proof ${safe(source.proof)}`,
+      `  account ${safe(source.accountId)}; plan ${safe(source.plan)}; access token expires ${safe(source.accessExpiresAt)}`,
+      `  enrollments ${source.enrollmentCount === null ? 'unknown' : source.enrollmentCount}; ledger ${safe(source.ledgerStatus)}; digest ${safe(source.sourceDigest)}`);
+    for (const problem of source.problems) lines.push(`  problem: ${safe(problem)}`);
+  }
+  if (inventory.problems.length) {
+    lines.push('', 'Locations that could not be read:');
+    for (const problem of inventory.problems) lines.push(`  - ${safe(problem)}`);
+  }
+  return lines.join('\n') + '\n';
+};
+
+/**
+ * What the owner does next with a source, in words rather than a contract value. An action this version does
+ * not recognise is read as the careful one: never invite a second submission on a guess.
+ */
+const actionText = (action: TAuthSwitchImportAction): string =>
+  action === 'none' ? 'nothing to do'
+    : action === 'resume' ? 'submit this source again to continue where it stopped'
+      : 'sign in to this account again; this source cannot be imported a second time';
+
+/**
+ * Every page of the ledger, as one report.
+ *
+ * The owner acts on this read, so it must not stop at a page boundary and leave a quarantined source
+ * unmentioned. A cursor that does not advance is a broken answer rather than a reason to keep asking.
+ */
+const collectImportStatus = async (client: IAuthSwitchAuthorityCliClient): Promise<IAuthSwitchImportStatus> => {
+  const first = await client.importStatus({ limit: 128 });
+  const entries = [...first.entries];
+  let cursor = first.nextCursor;
+  while (cursor !== null) {
+    const page = await client.importStatus({ after: cursor, limit: 128 });
+    if (page.entries.length === 0 || page.nextCursor === cursor) throw new AuthorityCliFailure('response');
+    entries.push(...page.entries);
+    cursor = page.nextCursor;
+  }
+  return { ...first, entries, nextCursor: null };
+};
+
+const renderImportStatus = (status: IAuthSwitchImportStatus): string => {
+  const lines = [`Import status — generated ${safe(status.generatedAt)}`];
+  if (status.entries.length === 0) {
+    lines.push('No source has been submitted yet. Run `authswitch authority import inventory` to see what this host holds.');
+  }
+  for (const entry of status.entries) {
+    lines.push(`${safe(entry.sourceKind)} ${safe(entry.sourceId)}`,
+      `  state ${safe(entry.status)}; refresher ${safe(entry.owner)}; recorded ${safe(entry.statusObservedAt)}`,
+      `  account ${safe(entry.accountId)}; login ${safe(entry.loginId)}`,
+      `  next: ${actionText(entry.action)}`);
+  }
+  // A source that was never submitted has no ledger row, so it is the inventory's subject, not this read's.
+  lines.push('Sources that were never submitted are listed by `authswitch authority import inventory`.');
+  return lines.join('\n') + '\n';
+};
+
+const renderImportResult = (result: IAuthSwitchImportResult): string => {
+  const settled = result.status === 'complete';
+  const lines = [`${settled ? 'Imported' : 'Import did not settle'}: ${safe(result.sourceKind)} ${safe(result.sourceId)}`,
+    `  treatment ${safe(result.treatment)}; state ${safe(result.status)}`,
+    `  account ${safe(result.accountId)}; login ${safe(result.loginId)}`];
+  for (const problem of result.problems) lines.push(`  problem: ${safe(problem)}`);
+  if (settled && result.treatment === 'import') {
+    lines.push('  The authority now refreshes this login. Its legacy copy holds a token the provider has rotated away.');
+  }
+  if (settled && result.treatment === 'project') {
+    lines.push('  The native tool still refreshes this login. The authority holds no copy of it.');
+  }
+  return lines.join('\n') + '\n';
+};
+
 const terminalOperation = (operation: IAuthSwitchOperation): boolean =>
   operation.state === 'complete' || operation.state === 'failed' || operation.state === 'cancelled'
   || operation.state === 'interrupted' || operation.state === 'outcome_unknown';
@@ -443,6 +566,7 @@ export const runAuthSwitchAuthorityCli = async (argv: readonly string[],
   let preuseHint = false;
   let beginAttempted = false;
   let beginResponded = false;
+  let submitAttempted = false;
   const operationController = new AbortController();
   const closeClient = (reason?: Error): void => {
     if (clientClosed || !client) return;
@@ -579,6 +703,24 @@ export const runAuthSwitchAuthorityCli = async (argv: readonly string[],
       await runDoctor(activeClient, command.json, writeOutput);
       return 0;
     }
+    if (command.kind === 'importInventory') {
+      const inventory = await activeClient.importInventory();
+      await writeOutput(command.json ? JSON.stringify(inventory) + '\n' : renderInventory(inventory));
+      return 0;
+    }
+    if (command.kind === 'importStatus') {
+      const status = await collectImportStatus(activeClient);
+      await writeOutput(command.json ? JSON.stringify(status) + '\n' : renderImportStatus(status));
+      return 0;
+    }
+    if (command.kind === 'importSubmit') {
+      // A lost response leaves the outcome unknown to this process but never to the authority, so the
+      // failure path below points at the status read rather than inviting a second submission.
+      submitAttempted = true;
+      const result = await activeClient.submitImport(command.sourceId, command.sourceDigest);
+      await writeOutput(command.json ? JSON.stringify(result) + '\n' : renderImportResult(result));
+      return result.status === 'complete' ? 0 : 1;
+    }
     if (command.kind === 'preuseGet' || command.kind === 'preuseCancel') {
       const operation = validatePreuseOperation(command.kind === 'preuseGet'
         ? await activeClient.getPreuse(command.operationId)
@@ -692,15 +834,27 @@ export const runAuthSwitchAuthorityCli = async (argv: readonly string[],
     }
     return 0;
   } catch (error) {
-    let message = cancelled ? 'Authswitch authority request was cancelled.\n'
-      : timedOut ? 'Authswitch authority operation timed out.\n'
-        : beginAttempted && !beginResponded
-          ? 'Authswitch authority operation start response was lost.\n'
-          : error instanceof AuthorityCliFailure && error.kind === 'output'
-            ? 'Authswitch authority output failed.\n'
-            : error instanceof AuthorityCliFailure && error.kind === 'response'
-              ? 'Authswitch authority daemon returned an invalid response.\n'
-              : 'Authswitch authority daemon is unavailable.\n';
+    // A marked refusal is the daemon's answer to the command, not a fault: it names what the owner does
+    // instead and nothing was left half-done, so it is shown as written rather than replaced by a generic
+    // line. Any other failure -- including the transport's own sanitised text -- stays a diagnostic.
+    const refusal = error instanceof Error && isAuthSwitchImportRefusal(error) && !cancelled && !timedOut
+      ? safe(error.message) : null;
+    let message = refusal !== null ? `${refusal}\n`
+      : cancelled ? 'Authswitch authority request was cancelled.\n'
+        : timedOut ? 'Authswitch authority operation timed out.\n'
+          : beginAttempted && !beginResponded
+            ? 'Authswitch authority operation start response was lost.\n'
+            : error instanceof AuthorityCliFailure && error.kind === 'output'
+              ? 'Authswitch authority output failed.\n'
+              : error instanceof AuthorityCliFailure && error.kind === 'response'
+                ? 'Authswitch authority daemon returned an invalid response.\n'
+                : 'Authswitch authority daemon is unavailable.\n';
+    if (submitAttempted && refusal === null) {
+      // The authority may have settled this source even though this process never learned the answer; never
+      // submit it again blindly, because a rotating refresh token is sent at most once.
+      message += 'The outcome of this import is unknown to this command. Run `authswitch authority import '
+        + 'status` before doing anything else with this source.\n';
+    }
     if (operationIdForHint !== null) {
       const resume = preuseHint ? preuseResumeCommand(operationIdForHint, command.json)
         : resumeCommand(operationIdForHint, command.json);

package/ts/classes.authorityclient.ts

@@ -11,6 +11,8 @@ import type {
 } from './authority-contract.js';
 import type { IReq_AuthSwitchBindAccount, IReq_AuthSwitchReleaseBinding,
   IReq_AuthSwitchResolveAccess } from './authority-runtime-contract.js';
+import type { IReq_AuthSwitchImportInventory, IReq_AuthSwitchImportStatus,
+  IReq_AuthSwitchImportSubmit } from './authority-import-contract.js';
 import { AuthSwitchAuthorityFrameReader, authSwitchAuthorityFrameBytes,
   maxAuthSwitchAuthorityFrameBytes } from './classes.authorityframing.js';
 
@@ -66,7 +68,13 @@ export interface IAuthSwitchSubscriptionOptions {
   heartbeatMs?: number;
 }
 
-/** Node-only client for the per-user daemon. Each request has its own bounded Unix connection. */
+/**
+ * Node-only client for the per-user daemon. Each request has its own bounded Unix connection.
+ *
+ * Every method takes an optional `AbortSignal`. A referenced socket with a 35 second timeout outlives a
+ * consumer's own stop unless that consumer can cancel the read, so the signal is what releases it; it
+ * detaches this request only and never cancels work the daemon already owns.
+ */
 export class AuthSwitchClient {
   private readonly target: plugins.typedrequest.TypedTarget;
   private readonly runtimeTarget: plugins.typedrequest.TypedTarget;
@@ -97,9 +105,30 @@ export class AuthSwitchClient {
     return (await this.request<IReq_AuthSwitchDoctor>('authswitch.authority.doctor', options, 35_000, false, signal)).page;
   }
 
-  public async getUsage(accountId: string, loginId: string, force = false): Promise<IReq_AuthSwitchUsage['response']['usage']> {
+  /** The credential-free legacy-source report of the one-time import. It changes nothing. */
+  public async importInventory(signal?: AbortSignal): Promise<IReq_AuthSwitchImportInventory['response']['inventory']> {
+    return (await this.request<IReq_AuthSwitchImportInventory>('authswitch.authority.import.inventory',
+      {}, 35_000, false, signal)).inventory;
+  }
+
+  /** Where every source the authority knows about stands. Durable records only; no store is opened. */
+  public async importStatus(request: IReq_AuthSwitchImportStatus['request'] = {},
+    signal?: AbortSignal): Promise<IReq_AuthSwitchImportStatus['response']['status']> {
+    return (await this.request<IReq_AuthSwitchImportStatus>('authswitch.authority.import.status',
+      request, 35_000, false, signal)).status;
+  }
+
+  /** Backend-only. One source, one ownership decision; both acknowledgements are required. */
+  public async submitImport(submission: IReq_AuthSwitchImportSubmit['request']['submission'],
+    signal?: AbortSignal): Promise<IReq_AuthSwitchImportSubmit['response']['result']> {
+    return (await this.request<IReq_AuthSwitchImportSubmit>('authswitch.authority.import.submit',
+      { submission, callerQuiescent: true, acknowledgeRunOrder: true }, 120_000, true, signal)).result;
+  }
+
+  public async getUsage(accountId: string, loginId: string, force = false,
+    signal?: AbortSignal): Promise<IReq_AuthSwitchUsage['response']['usage']> {
     return (await this.request<IReq_AuthSwitchUsage>('authswitch.authority.usage',
-      { accountId, loginId, force })).usage;
+      { accountId, loginId, force }, 35_000, false, signal)).usage;
   }
 
   /** Assemble a consistent view from bounded database pages; restart if a writer changes the revision. */
@@ -236,8 +265,10 @@ export class AuthSwitchClient {
     return (await this.request<IReq_AuthSwitchBeginReauth>('authswitch.authority.reauth',
       { operationId, accountId, loginId, purpose, flow: 'device' }, 35_000, false, signal)).operation;
   }
-  public listOperations(after?: string, limit?: number): Promise<IReq_AuthSwitchListOperations['response']> {
-    return this.request<IReq_AuthSwitchListOperations>('authswitch.authority.operations', { after, limit });
+  public listOperations(after?: string, limit?: number,
+    signal?: AbortSignal): Promise<IReq_AuthSwitchListOperations['response']> {
+    return this.request<IReq_AuthSwitchListOperations>('authswitch.authority.operations',
+      { after, limit }, 35_000, false, signal);
   }
   public async getOperation(operationId: string, signal?: AbortSignal): Promise<IReq_AuthSwitchGetOperation['response']['operation']> {
     return (await this.request<IReq_AuthSwitchGetOperation>('authswitch.authority.operation',
@@ -262,27 +293,39 @@ export class AuthSwitchClient {
     return (await this.request<IReq_AuthSwitchCancelPreuse>(
       'authswitch.authority.preuse.cancel', { operationId }, 35_000, false, signal)).operation;
   }
-  public async renameAccount(accountId: string, expectedRevision: number, label: string): Promise<IReq_AuthSwitchRenameAccount['response']['account']> {
-    return (await this.request<IReq_AuthSwitchRenameAccount>('authswitch.authority.rename', { accountId, expectedRevision, label })).account;
+  public async renameAccount(accountId: string, expectedRevision: number, label: string,
+    signal?: AbortSignal): Promise<IReq_AuthSwitchRenameAccount['response']['account']> {
+    return (await this.request<IReq_AuthSwitchRenameAccount>('authswitch.authority.rename',
+      { accountId, expectedRevision, label }, 35_000, false, signal)).account;
   }
-  public async removeAccount(accountId: string, expectedRevision: number): Promise<IReq_AuthSwitchRemoveAccount['response']['account']> {
-    return (await this.request<IReq_AuthSwitchRemoveAccount>('authswitch.authority.remove', { accountId, expectedRevision })).account;
+  public async removeAccount(accountId: string, expectedRevision: number,
+    signal?: AbortSignal): Promise<IReq_AuthSwitchRemoveAccount['response']['account']> {
+    return (await this.request<IReq_AuthSwitchRemoveAccount>('authswitch.authority.remove',
+      { accountId, expectedRevision }, 35_000, false, signal)).account;
   }
-  public async switchClaudeNative(accountId: string, loginId: string): Promise<IReq_AuthSwitchSwitchClaudeNative['response']['handoff']> {
+  public async switchClaudeNative(accountId: string, loginId: string,
+    signal?: AbortSignal): Promise<IReq_AuthSwitchSwitchClaudeNative['response']['handoff']> {
     return (await this.request<IReq_AuthSwitchSwitchClaudeNative>('authswitch.authority.claude.switch',
-      { accountId, loginId, purpose: 'claude_host_native' })).handoff;
+      { accountId, loginId, purpose: 'claude_host_native' }, 35_000, false, signal)).handoff;
   }
-  public async getClaudeNativeHandoff(operationId: string): Promise<IReq_AuthSwitchClaudeNativeHandoff['response']['handoff']> {
-    return (await this.request<IReq_AuthSwitchClaudeNativeHandoff>('authswitch.authority.claude.handoff', { operationId })).handoff;
+  public async getClaudeNativeHandoff(operationId: string,
+    signal?: AbortSignal): Promise<IReq_AuthSwitchClaudeNativeHandoff['response']['handoff']> {
+    return (await this.request<IReq_AuthSwitchClaudeNativeHandoff>('authswitch.authority.claude.handoff',
+      { operationId }, 35_000, false, signal)).handoff;
   }
-  public listClaudeNativeHandoffs(after?: string, limit?: number): Promise<IReq_AuthSwitchClaudeNativeHandoffs['response']> {
-    return this.request<IReq_AuthSwitchClaudeNativeHandoffs>('authswitch.authority.claude.handoffs', { after, limit });
+  public listClaudeNativeHandoffs(after?: string, limit?: number,
+    signal?: AbortSignal): Promise<IReq_AuthSwitchClaudeNativeHandoffs['response']> {
+    return this.request<IReq_AuthSwitchClaudeNativeHandoffs>('authswitch.authority.claude.handoffs',
+      { after, limit }, 35_000, false, signal);
   }
-  public bindAccount(input: IReq_AuthSwitchBindAccount['request']): Promise<IReq_AuthSwitchBindAccount['response']> {
-    return this.request<IReq_AuthSwitchBindAccount>('authswitch.authority.bind', input);
+  public bindAccount(input: IReq_AuthSwitchBindAccount['request'],
+    signal?: AbortSignal): Promise<IReq_AuthSwitchBindAccount['response']> {
+    return this.request<IReq_AuthSwitchBindAccount>('authswitch.authority.bind', input, 35_000, false, signal);
   }
-  public resolveAccess(input: IReq_AuthSwitchResolveAccess['request']): Promise<IReq_AuthSwitchResolveAccess['response']> {
-    return this.request<IReq_AuthSwitchResolveAccess>('authswitch.authority.resolveAccess', input, 35_000, true);
+  public resolveAccess(input: IReq_AuthSwitchResolveAccess['request'],
+    signal?: AbortSignal): Promise<IReq_AuthSwitchResolveAccess['response']> {
+    return this.request<IReq_AuthSwitchResolveAccess>('authswitch.authority.resolveAccess',
+      input, 35_000, true, signal);
   }
   public releaseBinding(input: IReq_AuthSwitchReleaseBinding['request'], signal?: AbortSignal): Promise<IReq_AuthSwitchReleaseBinding['response']> {
     return this.request<IReq_AuthSwitchReleaseBinding>('authswitch.authority.release', input, 35_000, true, signal);
@@ -298,9 +341,10 @@ export class AuthSwitchRuntimeClient {
       postMethod: (payload, options) => post(runtimeSocketPath, payload, options?.signal),
     });
   }
-  public resolveAccess(input: IReq_AuthSwitchResolveAccess['request']): Promise<IReq_AuthSwitchResolveAccess['response']> {
+  public resolveAccess(input: IReq_AuthSwitchResolveAccess['request'],
+    signal?: AbortSignal): Promise<IReq_AuthSwitchResolveAccess['response']> {
     return new plugins.typedrequest.TypedRequest<IReq_AuthSwitchResolveAccess>(this.target,
-      'authswitch.authority.resolveAccess').fire(input, { timeoutMs: 35_000, maxRetries: 0 });
+      'authswitch.authority.resolveAccess').fire(input, { timeoutMs: 35_000, maxRetries: 0, abortSignal: signal });
   }
   public releaseBinding(input: IReq_AuthSwitchReleaseBinding['request'], signal?: AbortSignal): Promise<IReq_AuthSwitchReleaseBinding['response']> {
     return new plugins.typedrequest.TypedRequest<IReq_AuthSwitchReleaseBinding>(this.target,