@modelprofile.com/authswitch 8.1.0 → 9.0.0

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@modelprofile.com/authswitch',
-    version: '8.1.0',
+    version: '9.0.0',
     description: 'Manage Codex, OpenCode and Claude Code accounts with guided switching and live usage status'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSw4QkFBOEI7SUFDcEMsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLDZGQUE2RjtDQUMzRyxDQUFBIn0=

package/dist_ts/authority-contract.d.ts

@@ -1,6 +1,58 @@
 import type { ITypedRequest } from '@api.global/typedrequest-interfaces';
 import type { IAuthSwitchUsageSnapshot } from './classes.authorityusage.js';
 export type { IAuthSwitchUsageSnapshot } from './classes.authorityusage.js';
+/**
+ * Why the authority declined, as a closed set a client branches on without reading the text.
+ *
+ * A refusal is an answer: the daemon did the check, nothing was left half-done, and the message says what
+ * the owner does instead. Everything else stays a fault whose text the transport replaces, and a caller
+ * must never present a fault as if it said what to do next.
+ */
+export type TAuthSwitchRefusalCode = 'authority_closing' | 'not_found' | 'account_changed' | 'account_busy' | 'login_unavailable'
+/** A runtime capability that is missing, wrong or superseded: deliberately one answer, and one repair. */
+ | 'binding_unauthorized'
+/** The authority holds this login, so the legacy path that used to move it no longer may. */
+ | 'authority_holds_login'
+/** An authority is installed on this host and is not answering, so nothing may assume it holds nothing. */
+ | 'authority_unavailable' | 'native_owner_holds_login' | 'claude_home_unregistered' | 'claude_handoff_pending' | 'claude_receipt_missing' | 'import_refusal';
+/** The marker the importer has published since 8.1.0; it keeps its own value on the wire. */
+export declare const authSwitchImportRefusalMarker = "authswitch_import_refusal";
+export declare const authSwitchRefusalReason = "authswitch_refusal";
+export type TAuthSwitchRefusalReason = typeof authSwitchRefusalReason | typeof authSwitchImportRefusalMarker;
+/** Everything a refusal puts on the wire beside its message: two literals, never a value of its own. */
+export interface IAuthSwitchRefusalData {
+    reason: TAuthSwitchRefusalReason;
+    code: TAuthSwitchRefusalCode;
+}
+/** What the owner is told when the answer is an instruction rather than a fault. */
+export interface IAuthSwitchRefusal {
+    code: TAuthSwitchRefusalCode;
+    /** The instruction, authored by the handler that declined. */
+    instruction: string;
+}
+/**
+ * One refusal, thrown by a handler and turned into a marked answer by the router that owns the wire.
+ *
+ * It accepts nothing but a code of the closed set and the text the owner is to read, and builds the marker
+ * from the code alone, so no handler can attach a value of its own to what a client branches on.
+ */
+export declare class AuthSwitchRefusal extends Error {
+    readonly code: TAuthSwitchRefusalCode;
+    constructor(code: TAuthSwitchRefusalCode, instruction: string);
+    /** Everything this refusal puts on the wire beside its message. */
+    get data(): IAuthSwitchRefusalData;
+}
+/**
+ * The refusal an error answer carries, or null when it is a fault whose text says nothing.
+ *
+ * This is the only reader of `errorData` in the package: the importer's published predicate is expressed
+ * through it, so a caller never has to know which of the two markers a route uses.
+ *
+ * 8.1.0 marked the importer's refusal with the reason alone. A per-user daemon keeps running across an
+ * upgrade until its owner restarts it, so a newer client still meets that payload, and it names the one
+ * refusal that release could answer with -- which is why it is read rather than treated as a fault.
+ */
+export declare const asAuthSwitchRefusal: (error: unknown) => IAuthSwitchRefusal | null;
 /** Credential-free account management contract. Safe to import in browser code. */
 export type TAuthSwitchLoginPurpose = 'openai_managed' | 'claude_host_native' | 'claude_container_setup' | 'opencode_native';
 export type TAuthSwitchLoginHealth = 'ready' | 'refreshing' | 'retry_wait' | 'needs_reauth' | 'unverified' | 'pending_handoff' | 'handoff_quarantined' | 'removed';
@@ -14,6 +66,15 @@ export interface IAuthSwitchAccount {
     revision: number;
     statusObservedAt: string;
 }
+/**
+ * Which tool refreshes a natively owned login, named rather than inferred.
+ *
+ * `owner` says that a native tool holds the login; this says which one, so a consumer presents "Claude Code"
+ * or "Codex" without deriving it from `purpose` -- a derivation that would be wrong the moment two purposes
+ * share a tool, and that belongs to the side that decides ownership in the first place. It is `null` exactly
+ * when no native tool refreshes the login: the authority does, or nothing does.
+ */
+export type TAuthSwitchLoginOwnerTool = 'claude_code' | 'codex' | 'opencode';
 /** One independently owned login. Native ownership does not imply observed health. */
 export interface IAuthSwitchLogin {
     id: string;
@@ -21,6 +82,8 @@ export interface IAuthSwitchLogin {
     providerId: string;
     purpose: TAuthSwitchLoginPurpose;
     owner: 'daemon' | 'claude_native' | 'legacy_native' | 'none';
+    /** The native tool that refreshes this login, or null when the authority or nobody does. */
+    ownerTool: TAuthSwitchLoginOwnerTool | null;
     health: TAuthSwitchLoginHealth;
     problem: 'none' | 'provider_unavailable' | 'exchange_uncertain' | 'provider_rejected' | 'native_owner';
     grantGeneration: number;
@@ -231,6 +294,14 @@ export interface IAuthSwitchPreuseOperation {
     finishedAt: string | null;
     revision: number;
 }
+/**
+ * Why the host could not prove that Claude Code uses its own native login.
+ *
+ * Each value names one condition of that proof, so an owner is told what to change: install the supported
+ * release, sign in to a subscriber plan, remove a credential override or a settings source, let the
+ * profile read succeed, or close the running session.
+ */
+export type TAuthSwitchClaudeProofFailure = 'unsupported_release' | 'override' | 'profile' | 'profile_unreadable' | 'settings' | 'subscription' | 'running_session';
 /** Credential-free native file ownership result. It makes no claim about a running session's active request. */
 export interface IAuthSwitchClaudeNativeHandoff {
     id: string;
@@ -240,6 +311,8 @@ export interface IAuthSwitchClaudeNativeHandoff {
     phase: 'reserved' | 'prepared' | 'committed' | 'aborted' | 'quarantined';
     problem: 'none' | 'native_uncertain' | 'foreign_or_torn' | 'unsupported_effective_auth' | 'database_uncertain';
     runningEffectiveAuth: 'no_scoped_sessions' | 'unsupported_effective_auth' | null;
+    /** Which condition of the native-login proof failed, when `problem` is `unsupported_effective_auth`. */
+    proofFailure?: TAuthSwitchClaudeProofFailure;
     updatedAt: string;
 }
 export interface IReq_AuthSwitchSwitchClaudeNative extends ITypedRequest {

package/dist_ts/authority-contract.js

@@ -1,3 +1,56 @@
-export {};
+/** The marker the importer has published since 8.1.0; it keeps its own value on the wire. */
+export const authSwitchImportRefusalMarker = 'authswitch_import_refusal';
+export const authSwitchRefusalReason = 'authswitch_refusal';
+const refusalCodes = new Set([
+    'authority_closing', 'not_found', 'account_changed', 'account_busy',
+    'login_unavailable', 'binding_unauthorized', 'native_owner_holds_login', 'claude_home_unregistered',
+    'claude_handoff_pending', 'claude_receipt_missing', 'import_refusal',
+    'authority_holds_login', 'authority_unavailable',
+]);
+const isRefusalCode = (value) => typeof value === 'string' && refusalCodes.has(value);
+/** The importer keeps the marker it published; every other code shares the authority's own. */
+const reasonOf = (code) => code === 'import_refusal' ? authSwitchImportRefusalMarker : authSwitchRefusalReason;
+/**
+ * One refusal, thrown by a handler and turned into a marked answer by the router that owns the wire.
+ *
+ * It accepts nothing but a code of the closed set and the text the owner is to read, and builds the marker
+ * from the code alone, so no handler can attach a value of its own to what a client branches on.
+ */
+export class AuthSwitchRefusal extends Error {
+    code;
+    constructor(code, instruction) {
+        super(instruction);
+        this.code = code;
+    }
+    /** Everything this refusal puts on the wire beside its message. */
+    get data() { return { reason: reasonOf(this.code), code: this.code }; }
+}
+/**
+ * The refusal an error answer carries, or null when it is a fault whose text says nothing.
+ *
+ * This is the only reader of `errorData` in the package: the importer's published predicate is expressed
+ * through it, so a caller never has to know which of the two markers a route uses.
+ *
+ * 8.1.0 marked the importer's refusal with the reason alone. A per-user daemon keeps running across an
+ * upgrade until its owner restarts it, so a newer client still meets that payload, and it names the one
+ * refusal that release could answer with -- which is why it is read rather than treated as a fault.
+ */
+export const asAuthSwitchRefusal = (error) => {
+    if (error instanceof AuthSwitchRefusal)
+        return { code: error.code, instruction: error.message };
+    if (typeof error !== 'object' || error === null || !('errorData' in error))
+        return null;
+    const data = error.errorData;
+    if (typeof data !== 'object' || data === null || !('reason' in data))
+        return null;
+    const code = 'code' in data ? data.code : undefined;
+    const instruction = 'message' in error && typeof error.message === 'string' ? error.message : '';
+    if (data.reason === authSwitchImportRefusalMarker) {
+        return code === undefined || code === 'import_refusal' ? { code: 'import_refusal', instruction } : null;
+    }
+    if (data.reason !== authSwitchRefusalReason || !isRefusalCode(code))
+        return null;
+    return { code, instruction };
+};
 /** Runtime capability is returned only to trusted backend callers; do not expose this response in a browser API. */
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aG9yaXR5LWNvbnRyYWN0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvYXV0aG9yaXR5LWNvbnRyYWN0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7QUF5V0Esb0hBQW9IIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aG9yaXR5LWNvbnRyYWN0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvYXV0aG9yaXR5LWNvbnRyYWN0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQTZCQSw2RkFBNkY7QUFDN0YsTUFBTSxDQUFDLE1BQU0sNkJBQTZCLEdBQUcsMkJBQTJCLENBQUM7QUFDekUsTUFBTSxDQUFDLE1BQU0sdUJBQXVCLEdBQUcsb0JBQW9CLENBQUM7QUFpQjVELE1BQU0sWUFBWSxHQUF3QixJQUFJLEdBQUcsQ0FBeUI7SUFDeEUsbUJBQW1CLEVBQUUsV0FBVyxFQUFFLGlCQUFpQixFQUFFLGNBQWM7SUFDbkUsbUJBQW1CLEVBQUUsc0JBQXNCLEVBQUUsMEJBQTBCLEVBQUUsMEJBQTBCO0lBQ25HLHdCQUF3QixFQUFFLHdCQUF3QixFQUFFLGdCQUFnQjtJQUNwRSx1QkFBdUIsRUFBRSx1QkFBdUI7Q0FDakQsQ0FBQyxDQUFDO0FBRUgsTUFBTSxhQUFhLEdBQUcsQ0FBQyxLQUFjLEVBQW1DLEVBQUUsQ0FDeEUsT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLFlBQVksQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUM7QUFFdkQsK0ZBQStGO0FBQy9GLE1BQU0sUUFBUSxHQUFHLENBQUMsSUFBNEIsRUFBNEIsRUFBRSxDQUMxRSxJQUFJLEtBQUssZ0JBQWdCLENBQUMsQ0FBQyxDQUFDLDZCQUE2QixDQUFDLENBQUMsQ0FBQyx1QkFBdUIsQ0FBQztBQUV0Rjs7Ozs7R0FLRztBQUNILE1BQU0sT0FBTyxpQkFBa0IsU0FBUSxLQUFLO0lBQzFCLElBQUksQ0FBeUI7SUFFN0MsWUFBWSxJQUE0QixFQUFFLFdBQW1CO1FBQzNELEtBQUssQ0FBQyxXQUFXLENBQUMsQ0FBQztRQUNuQixJQUFJLENBQUMsSUFBSSxHQUFHLElBQUksQ0FBQztJQUNuQixDQUFDO0lBRUQsbUVBQW1FO0lBQ25FLElBQVcsSUFBSSxLQUE2QixPQUFPLEVBQUUsTUFBTSxFQUFFLFFBQVEsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDLENBQUM7Q0FDdkc7QUFFRDs7Ozs7Ozs7O0dBU0c7QUFDSCxNQUFNLENBQUMsTUFBTSxtQkFBbUIsR0FBRyxDQUFDLEtBQWMsRUFBNkIsRUFBRTtJQUMvRSxJQUFJLEtBQUssWUFBWSxpQkFBaUI7UUFBRSxPQUFPLEVBQUUsSUFBSSxFQUFFLEtBQUssQ0FBQyxJQUFJLEVBQUUsV0FBVyxFQUFFLEtBQUssQ0FBQyxPQUFPLEVBQUUsQ0FBQztJQUNoRyxJQUFJLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxLQUFLLEtBQUssSUFBSSxJQUFJLENBQUMsQ0FBQyxXQUFXLElBQUksS0FBSyxDQUFDO1FBQUUsT0FBTyxJQUFJLENBQUM7SUFDeEYsTUFBTSxJQUFJLEdBQVksS0FBSyxDQUFDLFNBQVMsQ0FBQztJQUN0QyxJQUFJLE9BQU8sSUFBSSxLQUFLLFFBQVEsSUFBSSxJQUFJLEtBQUssSUFBSSxJQUFJLENBQUMsQ0FBQyxRQUFRLElBQUksSUFBSSxDQUFDO1FBQUUsT0FBTyxJQUFJLENBQUM7SUFDbEYsTUFBTSxJQUFJLEdBQVksTUFBTSxJQUFJLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO0lBQzdELE1BQU0sV0FBVyxHQUFHLFNBQVMsSUFBSSxLQUFLLElBQUksT0FBTyxLQUFLLENBQUMsT0FBTyxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO0lBQ2pHLElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyw2QkFBNkIsRUFBRSxDQUFDO1FBQ2xELE9BQU8sSUFBSSxLQUFLLFNBQVMsSUFBSSxJQUFJLEtBQUssZ0JBQWdCLENBQUMsQ0FBQyxDQUFDLEVBQUUsSUFBSSxFQUFFLGdCQUFnQixFQUFFLFdBQVcsRUFBRSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUM7SUFDMUcsQ0FBQztJQUNELElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyx1QkFBdUIsSUFBSSxDQUFDLGFBQWEsQ0FBQyxJQUFJLENBQUM7UUFBRSxPQUFPLElBQUksQ0FBQztJQUNqRixPQUFPLEVBQUUsSUFBSSxFQUFFLFdBQVcsRUFBRSxDQUFDO0FBQy9CLENBQUMsQ0FBQztBQWdZRixvSEFBb0gifQ==

package/dist_ts/authority-import-contract.d.ts

@@ -142,10 +142,14 @@ export type TAuthSwitchImportAction = 'none' | 'resume' | 'device_login';
 /**
  * Marks an error answer whose text is an instruction for the owner, not a report of a fault.
  *
- * The daemon sets it on the refusals the importer authors and on nothing else. Every other failure answers
- * with the transport's own sanitised text, which a caller must never present as if it said what to do next --
- * for a submit in particular, an unmarked failure means the outcome is unknown and the source must be read
- * with `authswitch.authority.import.status` rather than submitted again.
+ * The daemon sets it on the refusals the importer authors and on nothing else: a refusal any other route
+ * authors carries the authority's own marker, and a failure neither of them decided answers with the
+ * transport's sanitised text, which a caller must never present as if it said what to do next. For a
+ * submit in particular, an unmarked failure means the outcome is unknown and the source must be read with
+ * `authswitch.authority.import.status` rather than submitted again.
+ *
+ * It is one code of the authority's refusal contract (`./authority-contract`), which every route now uses;
+ * this marker keeps its own value on the wire so a consumer written against 8.1.0 keeps working.
  */
 export declare const authSwitchImportRefusalReason = "authswitch_import_refusal";
 /** True when the daemon answered with an importer refusal, so `error.message` is the instruction to show. */

package/dist_ts/authority-import-contract.js

@@ -1,18 +1,17 @@
+import { asAuthSwitchRefusal, authSwitchImportRefusalMarker } from './authority-contract.js';
 /**
  * Marks an error answer whose text is an instruction for the owner, not a report of a fault.
  *
- * The daemon sets it on the refusals the importer authors and on nothing else. Every other failure answers
- * with the transport's own sanitised text, which a caller must never present as if it said what to do next --
- * for a submit in particular, an unmarked failure means the outcome is unknown and the source must be read
- * with `authswitch.authority.import.status` rather than submitted again.
+ * The daemon sets it on the refusals the importer authors and on nothing else: a refusal any other route
+ * authors carries the authority's own marker, and a failure neither of them decided answers with the
+ * transport's sanitised text, which a caller must never present as if it said what to do next. For a
+ * submit in particular, an unmarked failure means the outcome is unknown and the source must be read with
+ * `authswitch.authority.import.status` rather than submitted again.
+ *
+ * It is one code of the authority's refusal contract (`./authority-contract`), which every route now uses;
+ * this marker keeps its own value on the wire so a consumer written against 8.1.0 keeps working.
  */
-export const authSwitchImportRefusalReason = 'authswitch_import_refusal';
+export const authSwitchImportRefusalReason = authSwitchImportRefusalMarker;
 /** True when the daemon answered with an importer refusal, so `error.message` is the instruction to show. */
-export const isAuthSwitchImportRefusal = (error) => {
-    if (typeof error !== 'object' || error === null || !('errorData' in error))
-        return false;
-    const data = error.errorData;
-    return typeof data === 'object' && data !== null && 'reason' in data
-        && data.reason === authSwitchImportRefusalReason;
-};
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aG9yaXR5LWltcG9ydC1jb250cmFjdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL2F1dGhvcml0eS1pbXBvcnQtY29udHJhY3QudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBbUpBOzs7Ozs7O0dBT0c7QUFDSCxNQUFNLENBQUMsTUFBTSw2QkFBNkIsR0FBRywyQkFBMkIsQ0FBQztBQUV6RSw2R0FBNkc7QUFDN0csTUFBTSxDQUFDLE1BQU0seUJBQXlCLEdBQUcsQ0FBQyxLQUFjLEVBQVcsRUFBRTtJQUNuRSxJQUFJLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxLQUFLLEtBQUssSUFBSSxJQUFJLENBQUMsQ0FBQyxXQUFXLElBQUksS0FBSyxDQUFDO1FBQUUsT0FBTyxLQUFLLENBQUM7SUFDekYsTUFBTSxJQUFJLEdBQUcsS0FBSyxDQUFDLFNBQVMsQ0FBQztJQUM3QixPQUFPLE9BQU8sSUFBSSxLQUFLLFFBQVEsSUFBSSxJQUFJLEtBQUssSUFBSSxJQUFJLFFBQVEsSUFBSSxJQUFJO1dBQy9ELElBQUksQ0FBQyxNQUFNLEtBQUssNkJBQTZCLENBQUM7QUFDckQsQ0FBQyxDQUFDIn0=
+export const isAuthSwitchImportRefusal = (error) => asAuthSwitchRefusal(error)?.code === 'import_refusal';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aG9yaXR5LWltcG9ydC1jb250cmFjdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL2F1dGhvcml0eS1pbXBvcnQtY29udHJhY3QudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQ0EsT0FBTyxFQUFFLG1CQUFtQixFQUFFLDZCQUE2QixFQUFFLE1BQU0seUJBQXlCLENBQUM7QUFtSjdGOzs7Ozs7Ozs7OztHQVdHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sNkJBQTZCLEdBQUcsNkJBQTZCLENBQUM7QUFFM0UsNkdBQTZHO0FBQzdHLE1BQU0sQ0FBQyxNQUFNLHlCQUF5QixHQUFHLENBQUMsS0FBYyxFQUFXLEVBQUUsQ0FDbkUsbUJBQW1CLENBQUMsS0FBSyxDQUFDLEVBQUUsSUFBSSxLQUFLLGdCQUFnQixDQUFDIn0=

package/dist_ts/authority-paths.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Where this user's authority lives: its sockets, its store and the service unit that runs it.
+ *
+ * These rules sit in a leaf module because two sides read them. `AuthSwitchAuthorityService` installs and
+ * runs the daemon there, and the legacy fence (`./classes.legacyfence`) asks the same socket and looks for
+ * the same unit -- without importing the daemon, whose module graph reaches back to the legacy operations
+ * the fence guards.
+ */
+export interface IAuthSwitchAuthorityPaths {
+    runtimeDirectory: string;
+    dataDirectory: string;
+    databaseSocketPath: string;
+    authoritySocketPath: string;
+    runtimeSocketPath: string;
+    runtimeSocketDirectory: string;
+}
+/** The authority's sockets. */
+export type TAuthSwitchAuthoritySocketPaths = Omit<IAuthSwitchAuthorityPaths, 'dataDirectory'>;
+/**
+ * The sockets under one runtime directory, derived from it alone.
+ *
+ * The legacy fence asks the socket a caller states and must not depend on anything this process holds --
+ * its home or its `XDG_DATA_HOME`, which only the store's directory needs.
+ */
+export declare const authSwitchAuthoritySocketPaths: (runtimeDirectory: string | undefined) => TAuthSwitchAuthoritySocketPaths;
+/** Canonical per-user paths. An explicit runtime directory is also usable by a trusted container host. */
+export declare const resolveAuthSwitchAuthorityPaths: (runtimeDirectory?: string | undefined) => IAuthSwitchAuthorityPaths;
+/** The user service `authswitch authority service install` writes. */
+export declare const authSwitchAuthorityUnitName = "authswitch-authority.service";
+/**
+ * The directory that unit is installed into, from a stated environment and home directory.
+ *
+ * It is the rule smartdaemon applies to a user unit when it is given no directory --
+ * `$XDG_DATA_HOME/systemd/user`, default `~/.local/share/systemd/user` -- stated here so the installer passes
+ * it explicitly and the fence derives it from the locations its caller states rather than from this process.
+ */
+export declare const authSwitchAuthorityUnitDirectory: (env: NodeJS.ProcessEnv, homeDirectory: string) => string;

package/dist_ts/authority-paths.js

@@ -0,0 +1,46 @@
+import * as plugins from './plugins.js';
+/**
+ * The sockets under one runtime directory, derived from it alone.
+ *
+ * The legacy fence asks the socket a caller states and must not depend on anything this process holds --
+ * its home or its `XDG_DATA_HOME`, which only the store's directory needs.
+ */
+export const authSwitchAuthoritySocketPaths = (runtimeDirectory) => {
+    if (!runtimeDirectory || !plugins.path.isAbsolute(runtimeDirectory)) {
+        throw new Error('A private XDG_RUNTIME_DIR is required for authswitch authority.');
+    }
+    const socketDirectory = plugins.path.join(runtimeDirectory, 'authswitch');
+    const runtimeSocketDirectory = plugins.path.join(socketDirectory, 'runtime');
+    return {
+        runtimeDirectory,
+        databaseSocketPath: plugins.path.join(socketDirectory, 'internal', 'db.sock'),
+        authoritySocketPath: plugins.path.join(socketDirectory, 'management', 'authority.sock'),
+        runtimeSocketPath: plugins.path.join(runtimeSocketDirectory, 'runtime.sock'),
+        runtimeSocketDirectory,
+    };
+};
+/** Canonical per-user paths. An explicit runtime directory is also usable by a trusted container host. */
+export const resolveAuthSwitchAuthorityPaths = (runtimeDirectory = process.env.XDG_RUNTIME_DIR) => {
+    const sockets = authSwitchAuthoritySocketPaths(runtimeDirectory);
+    const home = plugins.os.userInfo().homedir;
+    const dataHome = process.env.XDG_DATA_HOME || plugins.path.join(home, '.local/share');
+    if (!plugins.path.isAbsolute(dataHome))
+        throw new Error('XDG_DATA_HOME must be an absolute path.');
+    return { ...sockets, dataDirectory: plugins.path.join(dataHome, 'authswitch', 'authority') };
+};
+/** The user service `authswitch authority service install` writes. */
+export const authSwitchAuthorityUnitName = 'authswitch-authority.service';
+/**
+ * The directory that unit is installed into, from a stated environment and home directory.
+ *
+ * It is the rule smartdaemon applies to a user unit when it is given no directory --
+ * `$XDG_DATA_HOME/systemd/user`, default `~/.local/share/systemd/user` -- stated here so the installer passes
+ * it explicitly and the fence derives it from the locations its caller states rather than from this process.
+ */
+export const authSwitchAuthorityUnitDirectory = (env, homeDirectory) => {
+    const dataHome = env.XDG_DATA_HOME || plugins.path.join(homeDirectory, '.local/share');
+    if (!plugins.path.isAbsolute(dataHome))
+        throw new Error('XDG_DATA_HOME must be an absolute path.');
+    return plugins.path.join(dataHome, 'systemd/user');
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aG9yaXR5LXBhdGhzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvYXV0aG9yaXR5LXBhdGhzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sY0FBYyxDQUFDO0FBdUJ4Qzs7Ozs7R0FLRztBQUNILE1BQU0sQ0FBQyxNQUFNLDhCQUE4QixHQUFHLENBQzVDLGdCQUFvQyxFQUFtQyxFQUFFO0lBQ3pFLElBQUksQ0FBQyxnQkFBZ0IsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLGdCQUFnQixDQUFDLEVBQUUsQ0FBQztRQUNwRSxNQUFNLElBQUksS0FBSyxDQUFDLGlFQUFpRSxDQUFDLENBQUM7SUFDckYsQ0FBQztJQUNELE1BQU0sZUFBZSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLGdCQUFnQixFQUFFLFlBQVksQ0FBQyxDQUFDO0lBQzFFLE1BQU0sc0JBQXNCLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsZUFBZSxFQUFFLFNBQVMsQ0FBQyxDQUFDO0lBQzdFLE9BQU87UUFDTCxnQkFBZ0I7UUFDaEIsa0JBQWtCLEVBQUUsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsZUFBZSxFQUFFLFVBQVUsRUFBRSxTQUFTLENBQUM7UUFDN0UsbUJBQW1CLEVBQUUsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsZUFBZSxFQUFFLFlBQVksRUFBRSxnQkFBZ0IsQ0FBQztRQUN2RixpQkFBaUIsRUFBRSxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxzQkFBc0IsRUFBRSxjQUFjLENBQUM7UUFDNUUsc0JBQXNCO0tBQ3ZCLENBQUM7QUFDSixDQUFDLENBQUM7QUFFRiwwR0FBMEc7QUFDMUcsTUFBTSxDQUFDLE1BQU0sK0JBQStCLEdBQUcsQ0FBQyxnQkFBZ0IsR0FBRyxPQUFPLENBQUMsR0FBRyxDQUFDLGVBQWUsRUFBNkIsRUFBRTtJQUMzSCxNQUFNLE9BQU8sR0FBRyw4QkFBOEIsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO0lBQ2pFLE1BQU0sSUFBSSxHQUFHLE9BQU8sQ0FBQyxFQUFFLENBQUMsUUFBUSxFQUFFLENBQUMsT0FBTyxDQUFDO0lBQzNDLE1BQU0sUUFBUSxHQUFHLE9BQU8sQ0FBQyxHQUFHLENBQUMsYUFBYSxJQUFJLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRSxjQUFjLENBQUMsQ0FBQztJQUN0RixJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDO1FBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyx5Q0FBeUMsQ0FBQyxDQUFDO0lBQ25HLE9BQU8sRUFBRSxHQUFHLE9BQU8sRUFBRSxhQUFhLEVBQUUsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLFlBQVksRUFBRSxXQUFXLENBQUMsRUFBRSxDQUFDO0FBQy9GLENBQUMsQ0FBQztBQUVGLHNFQUFzRTtBQUN0RSxNQUFNLENBQUMsTUFBTSwyQkFBMkIsR0FBRyw4QkFBOEIsQ0FBQztBQUUxRTs7Ozs7O0dBTUc7QUFDSCxNQUFNLENBQUMsTUFBTSxnQ0FBZ0MsR0FBRyxDQUFDLEdBQXNCLEVBQUUsYUFBcUIsRUFBVSxFQUFFO0lBQ3hHLE1BQU0sUUFBUSxHQUFHLEdBQUcsQ0FBQyxhQUFhLElBQUksT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsYUFBYSxFQUFFLGNBQWMsQ0FBQyxDQUFDO0lBQ3ZGLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUM7UUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLHlDQUF5QyxDQUFDLENBQUM7SUFDbkcsT0FBTyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsY0FBYyxDQUFDLENBQUM7QUFDckQsQ0FBQyxDQUFDIn0=

package/dist_ts/authority-runtime-contract.d.ts

@@ -1,6 +1,16 @@
 import type { ITypedRequest } from '@api.global/typedrequest-interfaces';
 import type { IAuthSwitchBinding } from './authority-contract.js';
-/** Backend-only binding operation. The capability must never enter a browser-facing response. */
+/**
+ * Backend-only binding operation, served on the MANAGEMENT socket. Not a misplacement -- the rule.
+ *
+ * The other two requests in this file are answered on the runtime socket, whose directory a container may
+ * be given. This one is not, because it mints the capability those two spend: minting is the act that
+ * authorizes a runtime, so it belongs to a caller already trusted with account management. A container
+ * holding the runtime directory can therefore use the binding it was handed, and can never create one --
+ * not for itself, and not for another account.
+ *
+ * The capability must never enter a browser-facing response.
+ */
 export interface IReq_AuthSwitchBindAccount extends ITypedRequest {
     method: 'authswitch.authority.bind';
     request: {

package/dist_ts/classes.authoritybroker.d.ts

@@ -88,6 +88,15 @@ export declare class AuthSwitchAuthorityBroker {
     resolveAccess(bindingId: string, capability: string, minValidityMs: number, rejectedGrantGeneration?: number): Promise<IAuthSwitchResolvedAccess>;
     /** Backend-only access for usage; it never creates or bypasses a runtime binding. */
     resolveUsageAccess(context: IAuthSwitchUsageContext, rejectedGrantGeneration: number | undefined, minValidityMs: number): Promise<IAuthSwitchResolvedAccess>;
+    /**
+     * The shared managed-access loop, whose refusals are deliberately still unmarked faults.
+     *
+     * Its two callers repair differently: a runtime holding a binding binds again, while the usage reader has
+     * no binding at all and collapses everything into one usage problem. Naming a code here would either say
+     * "binding" to a caller that has none, or invent a second meaning for one that does, so the decision waits
+     * for the slice that gives the usage answer its own vocabulary. What a bound runtime can act on is decided
+     * before this point, in the view `resolveAccess` supplies.
+     */
     private resolveManagedAccess;
     private refreshAccount;
     private performRefresh;