@modelprofile.com/authswitch 9.0.0 → 9.1.0

package/ts/classes.authorityclient.ts

@@ -5,7 +5,8 @@ import type {
   IReq_AuthSwitchBeginReauth, IReq_AuthSwitchCancelOperation,
   IReq_AuthSwitchClaudeNativeHandoff, IReq_AuthSwitchClaudeNativeHandoffs,
   IReq_AuthSwitchSwitchClaudeNative, IReq_AuthSwitchEvents,
-  IReq_AuthSwitchGetOperation, IReq_AuthSwitchListOperations, IReq_AuthSwitchRemoveAccount, IReq_AuthSwitchRenameAccount,
+  IReq_AuthSwitchGetBinding, IReq_AuthSwitchGetOperation, IReq_AuthSwitchListOperations,
+  IReq_AuthSwitchRemoveAccount, IReq_AuthSwitchRenameAccount,
   IReq_AuthSwitchCancelPreuse, IReq_AuthSwitchGetPreuse, IReq_AuthSwitchSnapshot,
   IReq_AuthSwitchStartPreuse, IReq_AuthSwitchUsage,
 } from './authority-contract.js';
@@ -53,10 +54,36 @@ const post = (path: string, payload: ITypedRequest, signal?: AbortSignal): Promi
     });
 };
 
+/**
+ * The daemon answered with an older contract than this client reads: it runs an authswitch release from before
+ * this one and was not restarted after the upgrade. Restarting it onto the installed release is the repair.
+ */
+export class AuthSwitchDaemonOutdatedError extends Error {
+  constructor() {
+    super('The authswitch authority daemon runs an older release than this client. Restart it onto the '
+      + 'installed authswitch: authswitch authority service stop, then authswitch authority service start.');
+    this.name = 'AuthSwitchDaemonOutdatedError';
+  }
+}
+
+/**
+ * A snapshot page carries every member of this release's contract. `schemaVersion` is not bumped for an
+ * additive member, so an older daemon is told apart by the members its answer lacks.
+ */
+const assertCurrentSnapshot = (snapshot: IAuthSwitchSnapshot): IAuthSwitchSnapshot => {
+  const page: Partial<IAuthSwitchSnapshot> = snapshot;
+  if (!Array.isArray(page.nativeAssignments) || page.nextNativeAssignmentCursor === undefined) {
+    throw new AuthSwitchDaemonOutdatedError();
+  }
+  return snapshot;
+};
+
 /** A snapshot is usable only while state is current; lastVerifiedAt is the last successful daemon proof. */
 export interface IAuthSwitchSubscriptionStatus {
   state: 'current' | 'unavailable' | 'closed';
-  reason: 'initial' | 'snapshot' | 'event' | 'heartbeat' | 'disconnect' | 'resync' | 'abort' | 'consumer_error';
+  /** `daemon_outdated`: the daemon runs an older release; see `AuthSwitchDaemonOutdatedError`. */
+  reason: 'initial' | 'snapshot' | 'event' | 'heartbeat' | 'disconnect' | 'resync' | 'abort' | 'consumer_error'
+    | 'daemon_outdated';
   epoch: string | null;
   revision: number | null;
   lastVerifiedAt: string | null;
@@ -66,6 +93,8 @@ export interface IAuthSwitchSubscriptionOptions {
   onStatus?: (status: IAuthSwitchSubscriptionStatus) => void | Promise<void>;
   /** Bounded long-poll interval; defaults to 30 seconds. */
   heartbeatMs?: number;
+  /** Deliver snapshots that also carry removed accounts and logins; see `IReq_AuthSwitchSnapshot`. */
+  includeRemoved?: boolean;
 }
 
 /**
@@ -96,8 +125,10 @@ export class AuthSwitchClient {
       .fire(request, { timeoutMs, maxRetries: 0, abortSignal: signal });
   }
 
+  /** One snapshot page; an older daemon's answer fails with `AuthSwitchDaemonOutdatedError`. */
   public async snapshot(options: IReq_AuthSwitchSnapshot['request'] = {}, signal?: AbortSignal): Promise<IAuthSwitchSnapshot> {
-    return (await this.request<IReq_AuthSwitchSnapshot>('authswitch.authority.snapshot', options, 35_000, false, signal)).snapshot;
+    return assertCurrentSnapshot((await this.request<IReq_AuthSwitchSnapshot>('authswitch.authority.snapshot',
+      options, 35_000, false, signal)).snapshot);
   }
 
   /** One independently stamped diagnostic page; callers may continue with its independent cursors. */
@@ -132,30 +163,39 @@ export class AuthSwitchClient {
   }
 
   /** Assemble a consistent view from bounded database pages; restart if a writer changes the revision. */
-  public async snapshotAll(options: { limit?: number; signal?: AbortSignal } = {}): Promise<IAuthSwitchSnapshot> {
+  public async snapshotAll(options: { limit?: number; includeRemoved?: boolean; signal?: AbortSignal } = {}): Promise<IAuthSwitchSnapshot> {
     while (true) {
       if (options.signal?.aborted) throw options.signal.reason ?? new Error('Account snapshot cancelled.');
       let accountAfter: string | undefined;
       let loginAfter: string | undefined;
       let bindingAfter: string | undefined;
+      let nativeAssignmentAfter: string | undefined;
       let aggregate: IAuthSwitchSnapshot | undefined;
       let changed = false;
       while (true) {
-        const page = await this.snapshot({ accountAfter, loginAfter, bindingAfter, limit: options.limit }, options.signal);
-        if (!aggregate) aggregate = { ...page, accounts: [...page.accounts], logins: [...page.logins], bindings: [...page.bindings] };
-        else if (aggregate.epoch !== page.epoch || aggregate.revision !== page.revision) {
+        const page = await this.snapshot({ accountAfter, loginAfter, bindingAfter, nativeAssignmentAfter,
+          limit: options.limit, ...(options.includeRemoved ? { includeRemoved: true } : {}) }, options.signal);
+        if (!aggregate) {
+          aggregate = { ...page, accounts: [...page.accounts], logins: [...page.logins], bindings: [...page.bindings],
+            nativeAssignments: [...page.nativeAssignments] };
+        } else if (aggregate.epoch !== page.epoch || aggregate.revision !== page.revision) {
           changed = true;
           break;
         } else {
           aggregate.accounts.push(...page.accounts);
           aggregate.logins.push(...page.logins);
           aggregate.bindings.push(...page.bindings);
+          aggregate.nativeAssignments.push(...page.nativeAssignments);
         }
         accountAfter = page.nextAccountCursor ?? accountAfter ?? page.accounts.at(-1)?.id;
         loginAfter = page.nextLoginCursor ?? loginAfter ?? page.logins.at(-1)?.id;
         bindingAfter = page.nextBindingCursor ?? bindingAfter ?? page.bindings.at(-1)?.id;
-        if (!page.nextAccountCursor && !page.nextLoginCursor && !page.nextBindingCursor) {
-          return { ...aggregate, nextAccountCursor: null, nextLoginCursor: null, nextBindingCursor: null };
+        nativeAssignmentAfter = page.nextNativeAssignmentCursor ?? nativeAssignmentAfter
+          ?? page.nativeAssignments.at(-1)?.id;
+        if (!page.nextAccountCursor && !page.nextLoginCursor && !page.nextBindingCursor
+          && !page.nextNativeAssignmentCursor) {
+          return { ...aggregate, nextAccountCursor: null, nextLoginCursor: null, nextBindingCursor: null,
+            nextNativeAssignmentCursor: null };
         }
       }
       if (!changed) throw new Error('Authority snapshot could not complete.');
@@ -188,9 +228,9 @@ export class AuthSwitchClient {
      * full, and since it holds nothing, a process whose only remaining handle it is can exit inside it --
      * dropping the closing status this loop owes its consumer.
      */
-    const retry = () => new Promise<void>(resolve => {
+    const retry = (delayMs = 250) => new Promise<void>(resolve => {
       if (signal.aborted) { resolve(); return; }
-      const timer = setTimeout(() => { signal.removeEventListener('abort', aborted); resolve(); }, 250);
+      const timer = setTimeout(() => { signal.removeEventListener('abort', aborted); resolve(); }, delayMs);
       timer.unref();
       const aborted = () => { clearTimeout(timer); resolve(); };
       signal.addEventListener('abort', aborted, { once: true });
@@ -208,19 +248,34 @@ export class AuthSwitchClient {
       snapshot = undefined;
       if (available) { available = false; await status('unavailable', reason); }
     };
+    /**
+     * An older daemon answers every attempt the same way until it is restarted, so the consumer is told why once
+     * per outage, and the loop keeps trying at a slower pace: the restart that repairs it needs nothing else.
+     */
+    let outdatedReported = false;
+    const unreadable = async (error: unknown): Promise<boolean> => {
+      if (!(error instanceof AuthSwitchDaemonOutdatedError)) return false;
+      snapshot = undefined;
+      available = false;
+      if (!outdatedReported) { outdatedReported = true; await status('unavailable', 'daemon_outdated'); }
+      await retry(5_000);
+      return true;
+    };
     try {
       if (!signal.aborted) await status('unavailable', 'initial');
       while (!signal.aborted) {
         if (!snapshot) {
           let fresh: IAuthSwitchSnapshot;
-          try { fresh = await this.snapshotAll({ signal }); }
-          catch {
+          try { fresh = await this.snapshotAll({ signal, includeRemoved: options.includeRemoved }); }
+          catch (error) {
             if (signal.aborted) break;
+            if (await unreadable(error)) continue;
             await invalidate('disconnect');
             await retry();
             continue;
           }
           snapshot = fresh;
+          outdatedReported = false;
           await onSnapshot(fresh);
           available = true;
           lastEpoch = fresh.epoch;
@@ -243,9 +298,10 @@ export class AuthSwitchClient {
         }
         if (result.events.length) {
           let fresh: IAuthSwitchSnapshot;
-          try { fresh = await this.snapshotAll({ signal }); }
-          catch {
+          try { fresh = await this.snapshotAll({ signal, includeRemoved: options.includeRemoved }); }
+          catch (error) {
             if (signal.aborted) break;
+            if (await unreadable(error)) continue;
             await invalidate('disconnect');
             await retry();
             continue;
@@ -290,6 +346,16 @@ export class AuthSwitchClient {
     return (await this.request<IReq_AuthSwitchGetOperation>('authswitch.authority.operation',
       { operationId }, 35_000, false, signal)).operation;
   }
+  /**
+   * Waits up to `waitMs` for the sign-in to change past `afterRevision` and answers with it; a finished
+   * sign-in answers at once, and a timed-out wait with the unchanged operation. Follow a sign-in by passing
+   * each answer's `revision` back until its state is final.
+   */
+  public async watchOperation(operationId: string, afterRevision: number, waitMs = 30_000,
+    signal?: AbortSignal): Promise<IReq_AuthSwitchGetOperation['response']['operation']> {
+    return (await this.request<IReq_AuthSwitchGetOperation>('authswitch.authority.operation',
+      { operationId, afterRevision, waitMs }, waitMs + 5_000, false, signal)).operation;
+  }
   public async cancelOperation(operationId: string, signal?: AbortSignal): Promise<IReq_AuthSwitchCancelOperation['response']['operation']> {
     return (await this.request<IReq_AuthSwitchCancelOperation>('authswitch.authority.cancel',
       { operationId }, 35_000, false, signal)).operation;
@@ -334,6 +400,11 @@ export class AuthSwitchClient {
     return this.request<IReq_AuthSwitchClaudeNativeHandoffs>('authswitch.authority.claude.handoffs',
       { after, limit }, 35_000, false, signal);
   }
+  /** The binding `bind` returned, credential-free, or null once this authority holds none by that id. */
+  public async getBinding(bindingId: string, signal?: AbortSignal): Promise<IReq_AuthSwitchGetBinding['response']['binding']> {
+    return (await this.request<IReq_AuthSwitchGetBinding>('authswitch.authority.binding',
+      { bindingId }, 35_000, false, signal)).binding;
+  }
   public bindAccount(input: IReq_AuthSwitchBindAccount['request'],
     signal?: AbortSignal): Promise<IReq_AuthSwitchBindAccount['response']> {
     return this.request<IReq_AuthSwitchBindAccount>('authswitch.authority.bind', input, 35_000, false, signal);

package/ts/classes.authoritydaemon.ts

@@ -4,7 +4,8 @@ import type {
   IAuthSwitchDoctorPage, IReq_AuthSwitchDoctor,
   IReq_AuthSwitchBeginAdd, IReq_AuthSwitchBeginReauth, IReq_AuthSwitchCancelOperation,
   IReq_AuthSwitchClaudeNativeHandoff, IReq_AuthSwitchClaudeNativeHandoffs, IReq_AuthSwitchSwitchClaudeNative,
-  IReq_AuthSwitchEvents, IReq_AuthSwitchGetOperation, IReq_AuthSwitchListOperations, IReq_AuthSwitchRemoveAccount,
+  IReq_AuthSwitchEvents, IReq_AuthSwitchGetBinding, IReq_AuthSwitchGetOperation, IReq_AuthSwitchListOperations,
+  IReq_AuthSwitchRemoveAccount,
   IReq_AuthSwitchRenameAccount, IReq_AuthSwitchSnapshot,
   IReq_AuthSwitchCancelPreuse, IReq_AuthSwitchGetPreuse, IReq_AuthSwitchStartPreuse, IReq_AuthSwitchUsage,
 } from './authority-contract.js';
@@ -136,6 +137,8 @@ export class AuthSwitchAuthorityDaemon {
   private readonly runtimeBindingReleaseFences = new Set<string>();
   private readonly runtimeBindingReleases = new Map<string, Promise<IReq_AuthSwitchReleaseBinding['response']>>();
   private closing = false;
+  /** Every admitted request until its answer is written; shutdown settles these before it closes the store. */
+  private readonly inFlight = new Set<Promise<void>>();
 
   constructor(private readonly options: IAuthSwitchAuthorityDaemonOptions) {
     // First, before anything is constructed: a daemon that was going to read the wrong host's credentials
@@ -279,8 +282,12 @@ export class AuthSwitchAuthorityDaemon {
   private handler<T extends ITypedRequest>(method: T['method'],
     run: plugins.typedrequest.THandlerFunction<T>): plugins.typedrequest.TypedHandler<T> {
     return new plugins.typedrequest.TypedHandler<T>(method, async (request, tools) => {
-      try { return await run(request, tools); }
-      catch (error) {
+      try {
+        // The one admission check: once shutdown begins no route starts work, and the requests already
+        // admitted are settled before the store closes.
+        if (this.closing) throw new AuthSwitchRefusal('authority_closing', 'Authswitch authority is closing.');
+        return await run(request, tools);
+      } catch (error) {
         if (error instanceof AuthSwitchRefusal) {
           throw new plugins.typedrequest.TypedResponseError(error.message, error.data);
         }
@@ -297,7 +304,6 @@ export class AuthSwitchAuthorityDaemon {
           || Object.keys(request).some(key => !['accountId', 'loginId', 'force'].includes(key))
           || typeof request.accountId !== 'string' || typeof request.loginId !== 'string'
           || (request.force !== undefined && typeof request.force !== 'boolean')) invalid();
-        if (this.closing) throw new AuthSwitchRefusal('authority_closing', 'Authswitch authority is closing.');
         return { usage: await this.usage.get(request.accountId, request.loginId, request.force ?? false) };
       }));
     this.managementRouter.addTypedHandler(this.handler<IReq_AuthSwitchSwitchClaudeNative>(
@@ -305,7 +311,6 @@ export class AuthSwitchAuthorityDaemon {
         if (!hasKeys(request, ['accountId', 'loginId', 'purpose'])
           || typeof request.accountId !== 'string' || typeof request.loginId !== 'string'
           || request.purpose !== 'claude_host_native') invalid();
-        if (this.closing) throw new AuthSwitchRefusal('authority_closing', 'Authswitch authority is closing.');
         if (!this.claudeNative) throw new AuthSwitchRefusal('claude_home_unregistered', 'Claude native handoff is unavailable.');
         return { handoff: await this.claudeNative.switchTo(request.accountId, request.loginId) };
       }));
@@ -326,7 +331,9 @@ export class AuthSwitchAuthorityDaemon {
       'authswitch.authority.snapshot', async request => {
         if (request === null || typeof request !== 'object' || Array.isArray(request)) invalid();
         const keys = Object.keys(request);
-        if (keys.some(key => !['accountAfter', 'loginAfter', 'bindingAfter', 'limit'].includes(key))) invalid();
+        if (keys.some(key => !['accountAfter', 'loginAfter', 'bindingAfter', 'nativeAssignmentAfter', 'limit',
+          'includeRemoved'].includes(key))
+          || (request.includeRemoved !== undefined && typeof request.includeRemoved !== 'boolean')) invalid();
         return { snapshot: await this.broker.snapshot(request) };
       }));
     this.managementRouter.addTypedHandler(this.handler<IReq_AuthSwitchDoctor>(
@@ -346,7 +353,6 @@ export class AuthSwitchAuthorityDaemon {
         // believing a source does not exist.
         if (request === null || typeof request !== 'object' || Array.isArray(request)
           || Object.keys(request).length !== 0) invalid();
-        if (this.closing) throw new AuthSwitchRefusal('authority_closing', 'Authswitch authority is closing.');
         if (!this.legacyImport) throw new AuthSwitchRefusal('import_refusal', legacyImportAbsent);
         return { inventory: await this.legacyImport.inventory() };
       }));
@@ -357,7 +363,6 @@ export class AuthSwitchAuthorityDaemon {
           || (request.after !== undefined && !validHash(request.after))
           || (request.limit !== undefined && (!Number.isSafeInteger(request.limit)
             || request.limit < 1 || request.limit > 128))) invalid();
-        if (this.closing) throw new AuthSwitchRefusal('authority_closing', 'Authswitch authority is closing.');
         if (!this.legacyImport) throw new AuthSwitchRefusal('import_refusal', legacyImportAbsent);
         return { status: await this.legacyImport.status(request) };
       }));
@@ -370,7 +375,6 @@ export class AuthSwitchAuthorityDaemon {
       'authswitch.authority.add', async request => {
         if (!hasKeys(request, ['operationId', 'providerId', 'flow']) || typeof request.operationId !== 'string'
           || request.providerId !== 'openai' || request.flow !== 'device') invalid();
-        if (this.closing) throw new AuthSwitchRefusal('authority_closing', 'Authswitch authority is closing.');
         return { operation: await this.broker.beginAddOpenAi(request.operationId) };
       }));
     this.managementRouter.addTypedHandler(this.handler<IReq_AuthSwitchBeginReauth>(
@@ -379,13 +383,16 @@ export class AuthSwitchAuthorityDaemon {
           || typeof request.operationId !== 'string'
           || typeof request.accountId !== 'string' || typeof request.loginId !== 'string'
           || request.purpose !== 'openai_managed') invalid();
-        if (this.closing) throw new AuthSwitchRefusal('authority_closing', 'Authswitch authority is closing.');
         return { operation: await this.beginReauthOpenAi(request) };
       }));
     this.managementRouter.addTypedHandler(this.handler<IReq_AuthSwitchGetOperation>(
-      'authswitch.authority.operation', async request => {
-        if (!hasKeys(request, ['operationId']) || typeof request.operationId !== 'string') invalid();
-        return { operation: await this.broker.getOperation(request.operationId) };
+      'authswitch.authority.operation', async (request, tools) => {
+        const waits = hasKeys(request, ['operationId', 'afterRevision', 'waitMs']);
+        if ((!waits && !hasKeys(request, ['operationId'])) || typeof request.operationId !== 'string'
+          || (waits && (!Number.isSafeInteger(request.afterRevision) || request.afterRevision! < 0
+            || !Number.isSafeInteger(request.waitMs) || request.waitMs! < 0 || request.waitMs! > 30_000))) invalid();
+        return { operation: await this.broker.getOperation(request.operationId, waits
+          ? { afterRevision: request.afterRevision!, waitMs: request.waitMs! } : undefined, tools?.abortSignal) };
       }));
     this.managementRouter.addTypedHandler(this.handler<IReq_AuthSwitchListOperations>(
       'authswitch.authority.operations', async request => {
@@ -407,7 +414,6 @@ export class AuthSwitchAuthorityDaemon {
           || typeof request.loginId !== 'string' || request.purpose !== 'openai_managed'
           || typeof request.prompt !== 'string'
           || (request.model !== undefined && typeof request.model !== 'string')) invalid();
-        if (this.closing) throw new AuthSwitchRefusal('authority_closing', 'Authswitch authority is closing.');
         const reservation: IPreuseAccountReservation = { operationId: request.operationId };
         let ownsReservation = false;
         const release = (): void => {
@@ -450,6 +456,11 @@ export class AuthSwitchAuthorityDaemon {
           || typeof request.expectedRevision !== 'number' || typeof request.label !== 'string') invalid();
         return { account: await this.broker.renameAccount(request.accountId, request.expectedRevision, request.label) };
       }));
+    this.managementRouter.addTypedHandler(this.handler<IReq_AuthSwitchGetBinding>(
+      'authswitch.authority.binding', async request => {
+        if (!hasKeys(request, ['bindingId']) || !validBindingId(request.bindingId)) invalid();
+        return { binding: await this.broker.getBinding(request.bindingId) };
+      }));
     this.managementRouter.addTypedHandler(this.handler<IReq_AuthSwitchRemoveAccount>(
       'authswitch.authority.remove', async request => {
         if (!hasKeys(request, ['accountId', 'expectedRevision']) || typeof request.accountId !== 'string'
@@ -480,7 +491,6 @@ export class AuthSwitchAuthorityDaemon {
           || !validBindingId(request.bindingId) || !validBindingCapability(request.capability)
           || typeof request.minValidityMs !== 'number'
           || (request.rejectedGrantGeneration !== undefined && typeof request.rejectedGrantGeneration !== 'number')) invalid();
-        if (this.closing) throw new AuthSwitchRefusal('authority_closing', 'Authswitch authority is closing.');
         const finish = this.beginRuntimeBindingAccess(this.runtimeBindingKey(request.bindingId, request.capability));
         try {
           return await this.broker.resolveAccess(request.bindingId, request.capability, request.minValidityMs,
@@ -491,7 +501,6 @@ export class AuthSwitchAuthorityDaemon {
       'authswitch.authority.release', async request => {
         if (!hasKeys(request, ['bindingId', 'capability'])
           || !validBindingId(request.bindingId) || !validBindingCapability(request.capability)) invalid();
-        if (this.closing) throw new AuthSwitchRefusal('authority_closing', 'Authswitch authority is closing.');
         return this.releaseRuntimeBinding(request.bindingId, request.capability);
       }));
     this.runtimeRouter.addTypedHandler(this.handler<IReq_AuthSwitchImportSubmit>(
@@ -500,14 +509,17 @@ export class AuthSwitchAuthorityDaemon {
         if (!hasKeys(request, ['submission', 'callerQuiescent', 'acknowledgeRunOrder'])
           || request.callerQuiescent !== true || request.acknowledgeRunOrder !== true
           || !validImportSubmission(request.submission)) invalid();
-        if (this.closing) throw new AuthSwitchRefusal('authority_closing', 'Authswitch authority is closing.');
         if (!this.legacyImport) throw new AuthSwitchRefusal('import_refusal', legacyImportAbsent);
         // An importer refusal is an `AuthSwitchRefusal` like every other, so the one conversion in
         // `handler()` marks it. What stays special is its meaning: an UNMARKED failure of this route
         // leaves the import outcome unknown, and the source must be read with `import.status` rather
         // than submitted again.
-        return { result: await this.legacyImport.submit({ submission: request.submission,
-          callerQuiescent: true, acknowledgeRunOrder: true }) };
+        // An import writes accounts, logins and native homes, also on a path that fails after a commit, so
+        // every outcome wakes the event readers; they read the committed revision themselves.
+        try {
+          return { result: await this.legacyImport.submit({ submission: request.submission,
+            callerQuiescent: true, acknowledgeRunOrder: true }) };
+        } finally { this.broker.notifyChanged(); }
       }));
   }
 
@@ -896,16 +908,23 @@ export class AuthSwitchAuthorityDaemon {
       let request: ITypedRequest;
       try { request = JSON.parse(input) as ITypedRequest; }
       catch { socket.destroy(); return; }
-      void router.routeAndAddResponse(request, { trustedLocalData: { authoritySocket: socket },
+      const answered: Promise<void> = router.routeAndAddResponse(request, { trustedLocalData: { authoritySocket: socket },
         trustedAbortSignal: abort.signal })
-        .then(response => {
+        .then(async response => {
           const raw = JSON.stringify(response);
           if (authSwitchAuthorityFrameBytes(raw) > maxAuthSwitchAuthorityFrameBytes) { socket.destroy(); return; }
-          socket.end(raw + '\n');
-        }).catch(() => socket.destroy());
+          await new Promise<void>(resolve => socket.end(raw + '\n', () => resolve()));
+        }).catch(() => { socket.destroy(); })
+        .finally(() => { this.inFlight.delete(answered); });
+      this.inFlight.add(answered);
     });
   }
 
+  /**
+   * Stops admitting work -- the sockets keep listening so every new request is answered `authority_closing`
+   * -- settles everything already admitted, a waiting `events` or operation read being woken by the broker and
+   * answering from the still-open store, and only then closes the sockets and the store.
+   */
   public async close(): Promise<void> {
     this.closing = true;
     const errors: unknown[] = [];
@@ -923,6 +942,8 @@ export class AuthSwitchAuthorityDaemon {
     try { await this.usage.close(); } catch (error) { errors.push(error); }
     try { await this.broker.close(); } catch (error) { errors.push(error); }
     if (this.claudeNative) try { await this.claudeNative.close(); } catch (error) { errors.push(error); }
+    // A request that arrives meanwhile is refused at admission and joins this set; none of those reads the store.
+    while (this.inFlight.size) await Promise.allSettled([...this.inFlight]);
     const management = this.managementServer;
     const runtime = this.runtimeServer;
     this.managementServer = undefined;

package/ts/classes.authoritydatabase.ts

@@ -56,6 +56,11 @@ const sameUsageSource = (left: IAuthSwitchUsageContext, right: IAuthSwitchUsageC
       && left.nativeSource.credentialDigest === right.nativeSource.credentialDigest
       && left.nativeSource.configDigest === right.nativeSource.configDigest
       && left.nativeSource.accessTokenDigest === right.nativeSource.accessTokenDigest);
+/**
+ * Runtime bindings whose holder releases them over the runtime socket. Managed Codex bindings are the daemon's:
+ * the daemon closes that runtime and clears its durable run before it revokes the binding itself.
+ */
+const callerReleasedRuntimes: readonly IStoredAuthorityBinding['runtime'][] = ['flex', 'opencode', 'claude'];
 const storedOperation = (stored: Parameters<typeof AuthSwitchAuthorityOperationModel.exact.toPersisted>[0]): IStoredAuthorityOperation => {
   const operation = AuthSwitchAuthorityOperationModel.exact.toPersisted(stored);
   assertStoredAuthorityOperation(operation);
@@ -67,6 +72,7 @@ export class AuthSwitchAuthorityDatabase {
   private engine?: plugins.nosqldbEngine.LocalNoSqlDb;
   private database?: plugins.nosqldb.SmartdataDb;
   private started = false;
+  private readonly deviceOperationObservers = new Set<(operationId: string) => void>();
 
   constructor(private readonly options: IAuthSwitchAuthorityDatabaseOptions) {}
 
@@ -284,6 +290,20 @@ export class AuthSwitchAuthorityDatabase {
     return stored ? AuthSwitchAuthorityMigrationLedgerModel.exact.toPersisted(stored) : null;
   }
 
+  /**
+   * Calls `observer` with the id of every device sign-in this database writes, after the write committed or
+   * was proven. The writers below are the only ones, so an observer misses no change; it runs synchronously
+   * and must only wake a reader. Returns the unsubscribe.
+   */
+  public observeDeviceOperations(observer: (operationId: string) => void): () => void {
+    this.deviceOperationObservers.add(observer);
+    return () => { this.deviceOperationObservers.delete(observer); };
+  }
+
+  private deviceOperationChanged(operationId: string): void {
+    for (const observer of this.deviceOperationObservers) observer(operationId);
+  }
+
   public async readOperation(id: string): Promise<IStoredAuthorityOperation | null> {
     this.db();
     const stored = await AuthSwitchAuthorityOperationModel.exact.findStoredOne({ id });
@@ -339,7 +359,7 @@ export class AuthSwitchAuthorityDatabase {
       && current.accountId === intent.accountId && current.grantId === intent.grantId
       && current.purpose === intent.purpose;
     try {
-      return await this.transaction(async session => {
+      const admitted = await this.transaction(async session => {
         const existingStored = await AuthSwitchAuthorityOperationModel.exact.findStoredOne(
           { id: intent.id }, { session });
         if (existingStored) {
@@ -369,11 +389,15 @@ export class AuthSwitchAuthorityDatabase {
         if (result.status !== 'inserted') throw new Error('Account operation ID already exists.');
         return { operation, created: true };
       });
+      if (admitted.created) this.deviceOperationChanged(intent.id);
+      return admitted;
     } catch (error) {
       if (!(error instanceof plugins.nosqldb.SmartdataExactPersistenceError) || error.code !== 'ambiguous_write') throw error;
       const stored = await this.readOperation(intent.id);
       if (stored && sameRequest(stored)) {
-        return { operation: stored, created: stored.updateId === intent.updateId };
+        const created = stored.updateId === intent.updateId;
+        if (created) this.deviceOperationChanged(intent.id);
+        return { operation: stored, created };
       }
       throw new Error('Account operation creation outcome is unknown; no provider login was started.');
     }
@@ -435,11 +459,15 @@ export class AuthSwitchAuthorityDatabase {
         current: stored, change: model => Object.assign(model, draft),
       });
       if (result.status !== 'transitioned') throw new Error('Account operation changed concurrently.');
+      this.deviceOperationChanged(operationId);
       return draft;
     } catch (error) {
       if (!(error instanceof plugins.nosqldb.SmartdataExactPersistenceError) || error.code !== 'ambiguous_write') throw error;
       const stored = await this.readOperation(operationId);
-      if (stored?.kind !== 'preuse_openai' && stored?.updateId === updateId) return stored;
+      if (stored?.kind !== 'preuse_openai' && stored?.updateId === updateId) {
+        this.deviceOperationChanged(operationId);
+        return stored;
+      }
       throw new Error('Account operation transition outcome is unknown.');
     }
   }
@@ -742,10 +770,16 @@ export class AuthSwitchAuthorityDatabase {
     }
   }
 
-  public async page(accountAfter: string | null, grantAfter: string | null, bindingAfter: string | null, limit: number): Promise<{
+  /**
+   * One repeatable-read page of the published authority state. Native homes are part of it: every write that
+   * changes which account a home runs on appends an account event, so the metadata revision covers them.
+   */
+  public async page(accountAfter: string | null, grantAfter: string | null, bindingAfter: string | null,
+    claudeHomeAfter: string | null, limit: number): Promise<{
     meta: IStoredAuthorityMeta; accounts: IStoredAuthorityAccount[]; grants: IStoredAuthorityGrant[];
-    bindings: IStoredAuthorityBinding[];
+    bindings: IStoredAuthorityBinding[]; claudeHomes: IStoredAuthorityClaudeHome[];
     nextAccountCursor: string | null; nextGrantCursor: string | null; nextBindingCursor: string | null;
+    nextClaudeHomeCursor: string | null;
   }> {
     if (!Number.isSafeInteger(limit) || limit < 1 || limit > 256) throw new Error('Invalid authority page size.');
     return this.transaction(async session => {
@@ -763,15 +797,21 @@ export class AuthSwitchAuthorityDatabase {
         filter: bindingAfter ? { id: { $gt: bindingAfter } } : {},
         sort: { id: 1 }, limit: limit + 1, session,
       });
+      const claudeHomes = await AuthSwitchAuthorityClaudeHomeModel.exact.findStored({
+        filter: claudeHomeAfter ? { id: { $gt: claudeHomeAfter } } : {},
+        sort: { id: 1 }, limit: limit + 1, session,
+      });
       const accountPage = accounts.slice(0, limit).map(item => AuthSwitchAuthorityAccountModel.exact.toPersisted(item));
       const grantPage = grants.slice(0, limit).map(item => AuthSwitchAuthorityGrantModel.exact.toPersisted(item));
       const bindingPage = bindings.slice(0, limit).map(item => AuthSwitchAuthorityBindingModel.exact.toPersisted(item));
+      const claudeHomePage = claudeHomes.slice(0, limit).map(item => AuthSwitchAuthorityClaudeHomeModel.exact.toPersisted(item));
       return {
         meta: AuthSwitchAuthorityMetaModel.exact.toPersisted(meta),
-        accounts: accountPage, grants: grantPage, bindings: bindingPage,
+        accounts: accountPage, grants: grantPage, bindings: bindingPage, claudeHomes: claudeHomePage,
         nextAccountCursor: accounts.length > limit ? accountPage.at(-1)!.id : null,
         nextGrantCursor: grants.length > limit ? grantPage.at(-1)!.id : null,
         nextBindingCursor: bindings.length > limit ? bindingPage.at(-1)!.id : null,
+        nextClaudeHomeCursor: claudeHomes.length > limit ? claudeHomePage.at(-1)!.id : null,
       };
     });
   }
@@ -1013,7 +1053,7 @@ export class AuthSwitchAuthorityDatabase {
       account: IStoredAuthorityAccount; grant: IStoredAuthorityGrant;
     }): Promise<{ account: IStoredAuthorityAccount; grant: IStoredAuthorityGrant; operation: IStoredAuthorityDeviceOperation }> {
     try {
-      return await this.transaction(async session => {
+      const committed = await this.transaction(async session => {
         const metaStored = await AuthSwitchAuthorityMetaModel.exact.findStoredOne({ id: 'authswitch-authority' }, { session });
         const operationStored = await AuthSwitchAuthorityOperationModel.exact.findStoredOne({ id: operationId }, { session });
         if (!metaStored || !operationStored) throw new Error('Device operation is unavailable.');
@@ -1061,6 +1101,8 @@ export class AuthSwitchAuthorityDatabase {
           updateId, 'account', accountId);
         return { ...draft, operation: completed };
       });
+      this.deviceOperationChanged(operationId);
+      return committed;
     } catch (error) {
       if (!(error instanceof plugins.nosqldb.SmartdataExactPersistenceError) || error.code !== 'ambiguous_write') throw error;
       const [event, operation, pair] = await Promise.all([
@@ -1070,6 +1112,7 @@ export class AuthSwitchAuthorityDatabase {
       if (event && operation?.kind !== 'preuse_openai' && operation?.state === 'complete' && operation.updateId === updateId
         && pair.account?.updateId === updateId && pair.grant?.updateId === updateId
         && operation.result?.accountId === accountId && operation.result.grantId === grantId) {
+        this.deviceOperationChanged(operationId);
         return { account: pair.account, grant: pair.grant, operation };
       }
       throw new Error('Device login commit outcome is unknown; inspect the durable operation before retrying.');
@@ -1163,7 +1206,11 @@ export class AuthSwitchAuthorityDatabase {
     }
   }
 
-  /** Remove all managed grants in one transaction; native owners must be stopped and handed off first. */
+  /**
+   * Remove all managed grants in one transaction. Native owners must be stopped and handed off first, and a
+   * runtime binding its holder releases must be released first; the daemon's own managed Codex bindings go
+   * with the account.
+   */
   public async removeAccountAndGrants(updateId: string, accountId: string,
     expectedRevision: number, statusObservedAt: string): Promise<IStoredAuthorityAccount> {
     try {
@@ -1199,6 +1246,30 @@ export class AuthSwitchAuthorityDatabase {
             throw new AuthSwitchRefusal('claude_handoff_pending', 'Resolve the Claude native handoff before removing this account.');
           }
         });
+        // A runtime the caller holds is released by the caller, which stops that runtime first; removing the
+        // account under it would strand a runtime whose next access fails. Managed Codex bindings are the
+        // daemon's own, and the daemon has proven their runs gone before it asks for this removal.
+        const heldRuntimes = new Set<string>();
+        let heldAfter: string | null = null;
+        while (true) {
+          const bindings = await AuthSwitchAuthorityBindingModel.exact.findStored({
+            filter: heldAfter ? { accountId, id: { $gt: heldAfter } } : { accountId },
+            sort: { id: 1 }, limit: 128, session,
+          });
+          for (const binding of bindings) {
+            if (callerReleasedRuntimes.includes(binding.runtime)) heldRuntimes.add(binding.runtime);
+          }
+          if (bindings.length < 128) break;
+          heldAfter = bindings.at(-1)!.id;
+        }
+        if (heldRuntimes.size) {
+          const names = [...heldRuntimes].sort();
+          const listed = names.length === 1 ? names[0] : `${names.slice(0, -1).join(', ')} and ${names.at(-1)}`;
+          throw new AuthSwitchRefusal('account_busy', `This account still backs ${listed} runtime bindings. `
+            + 'Stop those runtimes and release their bindings before removing the account. A holder that lost '
+            + 'its capability binds the same runtime and scope again and releases the capability that returns; '
+            + 'if binding again is refused, reauthenticate the account first.');
+        }
         await scan(async (grant, stored) => {
           if (grant.state === 'removed') return;
           const draft: IStoredAuthorityGrant = {
@@ -1331,7 +1402,7 @@ export class AuthSwitchAuthorityDatabase {
         if (!metaStored) throw new Error('Authswitch authority metadata is missing.');
         const current = await AuthSwitchAuthorityBindingModel.exact.findStoredOne({ id: bindingId }, { session });
         if (!current || current.capabilityHash !== capabilityHash
-          || (externalOnly && !['flex', 'opencode'].includes(current.runtime))) return false;
+          || (externalOnly && !callerReleasedRuntimes.includes(current.runtime))) return false;
         const result = await AuthSwitchAuthorityBindingModel.exact.delete({ current }, { session });
         if (result.status !== 'deleted') throw new Error('Runtime binding changed during revocation.');
         await this.appendEvent(session, AuthSwitchAuthorityMetaModel.exact.toPersisted(metaStored),
@@ -1354,7 +1425,7 @@ export class AuthSwitchAuthorityDatabase {
     return this.revokeBindingExact(updateId, bindingId, capabilityHash, false);
   }
 
-  /** External callers can release only Flex/OpenCode bindings; managed Codex cleanup stays daemon-owned. */
+  /** External callers release only Flex, OpenCode and Claude bindings; managed Codex cleanup stays daemon-owned. */
   public releaseExternalBinding(updateId: string, bindingId: string, capabilityHash: string): Promise<boolean> {
     return this.revokeBindingExact(updateId, bindingId, capabilityHash, true);
   }
@@ -1579,15 +1650,21 @@ export class AuthSwitchAuthorityDatabase {
           activeGrantId: grantId, pendingOperationId: null, status: 'ready', revision: 1,
           createdAt: input.now, updateId };
         assertStoredAuthorityClaudeHome(home);
+        const metaStored = await AuthSwitchAuthorityMetaModel.exact.findStoredOne({ id: 'authswitch-authority' }, { session });
+        if (!metaStored) throw new Error('Authswitch authority metadata is missing.');
         const inserted = await AuthSwitchAuthorityClaudeHomeModel.exact.insert(home, { session });
         if (inserted.status !== 'inserted') throw new Error('Claude native home changed concurrently.');
+        // The snapshot publishes which account this home runs on, so registering it is an account change.
+        await this.appendEvent(session, AuthSwitchAuthorityMetaModel.exact.toPersisted(metaStored),
+          updateId, 'account', accountId);
         return home;
       });
     } catch (error) {
       if (!(error instanceof plugins.nosqldb.SmartdataExactPersistenceError)
         || !['ambiguous_write', 'unique_conflict'].includes(error.code)) throw error;
       const home = await this.readClaudeHome(homeId);
-      if (home?.updateId === updateId && home.activeAccountId === accountId && home.activeGrantId === grantId) return home;
+      if (home?.updateId === updateId && home.activeAccountId === accountId && home.activeGrantId === grantId
+        && await AuthSwitchAuthorityEventModel.exact.findStoredOne({ id: updateId })) return home;
       // One grant, one home: the unique index refused a second home for a login another one already holds.
       if (error.code === 'unique_conflict') {
         throw new AuthSwitchRefusal('import_refusal',

package/ts/classes.authorityimport.ts

@@ -347,7 +347,7 @@ export class AuthSwitchAuthorityImport {
       const grant = row.grantId === null ? null : await this.database.readGrant(row.grantId);
       const handoff = await this.database.readHandoff(importHandoffId(row.id));
       entries.push({
-        sourceId: row.id, sourceKind: row.sourceKind, status: row.status,
+        sourceId: row.id, sourceKind: row.sourceKind, sourcePathHash: row.sourcePathHash, status: row.status,
         accountId: row.accountId, loginId: row.grantId, owner: grant?.owner ?? null,
         action: importAction(row.status, handoff), statusObservedAt: row.statusObservedAt,
       });