@modelprofile.com/authswitch 9.0.0 → 9.2.0

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@modelprofile.com/authswitch',
-    version: '9.0.0',
+    version: '9.2.0',
     description: 'Manage Codex, OpenCode and Claude Code accounts with guided switching and live usage status'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSw4QkFBOEI7SUFDcEMsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLDZGQUE2RjtDQUMzRyxDQUFBIn0=

package/dist_ts/authority-contract.d.ts

@@ -14,7 +14,15 @@ export type TAuthSwitchRefusalCode = 'authority_closing' | 'not_found' | 'accoun
 /** The authority holds this login, so the legacy path that used to move it no longer may. */
  | 'authority_holds_login'
 /** An authority is installed on this host and is not answering, so nothing may assume it holds nothing. */
- | 'authority_unavailable' | 'native_owner_holds_login' | 'claude_home_unregistered' | 'claude_handoff_pending' | 'claude_receipt_missing' | 'import_refusal';
+ | 'authority_unavailable' | 'native_owner_holds_login' | 'claude_home_unregistered' | 'claude_handoff_pending' | 'claude_receipt_missing' | 'import_refusal'
+/** The Codex on this host is older than managed Codex runs, or no longer offers a surface it uses. */
+ | 'codex_unsupported'
+/** A value the owner typed breaks a rule the instruction states, such as an account label. */
+ | 'invalid_input'
+/** The account's login has ended and only a new device sign-in brings it back. */
+ | 'login_needs_reauth'
+/** The login is intact, but the provider could not renew its access yet; the same request can succeed later. */
+ | 'access_not_fresh';
 /** The marker the importer has published since 8.1.0; it keeps its own value on the wire. */
 export declare const authSwitchImportRefusalMarker = "authswitch_import_refusal";
 export declare const authSwitchRefusalReason = "authswitch_refusal";
@@ -53,6 +61,14 @@ export declare class AuthSwitchRefusal extends Error {
  * refusal that release could answer with -- which is why it is read rather than treated as a fault.
  */
 export declare const asAuthSwitchRefusal: (error: unknown) => IAuthSwitchRefusal | null;
+/** The longest account label, in UTF-16 code units. */
+export declare const authSwitchAccountLabelMaxLength = 128;
+/**
+ * The account label rule, the one the authority applies to a rename: one to `authSwitchAccountLabelMaxLength`
+ * characters, no space at either end, no control character. A consumer validates with this rather than
+ * restating it; the authority answers a label that breaks it with the `invalid_input` refusal.
+ */
+export declare const isAuthSwitchAccountLabel: (value: unknown) => value is string;
 /** Credential-free account management contract. Safe to import in browser code. */
 export type TAuthSwitchLoginPurpose = 'openai_managed' | 'claude_host_native' | 'claude_container_setup' | 'opencode_native';
 export type TAuthSwitchLoginHealth = 'ready' | 'refreshing' | 'retry_wait' | 'needs_reauth' | 'unverified' | 'pending_handoff' | 'handoff_quarantined' | 'removed';
@@ -100,9 +116,35 @@ export interface IAuthSwitchLogin {
 export interface IAuthSwitchBinding {
     id: string;
     accountId: string;
+    /**
+     * The runtime an OpenAI (ChatGPT) login backs. `flex`, `opencode` and `claude` bindings are held and
+     * released by their caller over the runtime socket; `codex` is the daemon's own managed Codex. A Claude
+     * account never binds: it reaches Claude Code through the native switch.
+     */
     runtime: 'flex' | 'codex' | 'opencode' | 'claude';
     scopeId: string;
     incarnationId: string;
+    /**
+     * The authority revision at which this runtime and scope were last bound. It grows with every bind and never
+     * repeats for them, not even after a release and a new bind, so it names exactly one bind.
+     */
+    revision: number;
+}
+/**
+ * Which account a vendor tool's own home on this host runs on. Credential-free: the home is named by the
+ * hash the authority registered it under, never by its path.
+ *
+ * Only homes the authority itself switches are recorded: Claude Code homes adopted by a verified import.
+ * A Codex or OpenCode store that a native tool still refreshes appears as its login instead, with
+ * `owner: 'legacy_native'` and its `ownerTool`, because the authority does not decide what that store holds.
+ */
+export interface IAuthSwitchNativeAssignment {
+    id: string;
+    tool: TAuthSwitchLoginOwnerTool;
+    accountId: string;
+    loginId: string;
+    /** `switching` while a handoff to another account is in flight; `quarantined` until it is resolved. */
+    state: 'ready' | 'switching' | 'quarantined';
     revision: number;
 }
 export interface IAuthSwitchSnapshot {
@@ -113,9 +155,11 @@ export interface IAuthSwitchSnapshot {
     accounts: IAuthSwitchAccount[];
     logins: IAuthSwitchLogin[];
     bindings: IAuthSwitchBinding[];
+    nativeAssignments: IAuthSwitchNativeAssignment[];
     nextAccountCursor: string | null;
     nextLoginCursor: string | null;
     nextBindingCursor: string | null;
+    nextNativeAssignmentCursor: string | null;
 }
 /** Persisted account evidence. No provider request is made while collecting diagnostics. */
 export interface IAuthSwitchDoctorAccountEvidence {
@@ -352,7 +396,13 @@ export interface IReq_AuthSwitchSnapshot extends ITypedRequest {
         accountAfter?: string;
         loginAfter?: string;
         bindingAfter?: string;
+        nativeAssignmentAfter?: string;
         limit?: number;
+        /**
+         * Also publish removed accounts (`removed: true`) and their removed logins (`health: 'removed'`), so a
+         * consumer can show them apart. Absent or false keeps the snapshot to what is live.
+         */
+        includeRemoved?: boolean;
     };
     response: {
         snapshot: IAuthSwitchSnapshot;
@@ -435,10 +485,17 @@ export interface IReq_AuthSwitchListOperations extends ITypedRequest {
         nextCursor: string | null;
     };
 }
+/**
+ * One device sign-in. `afterRevision` and `waitMs` come together or not at all: with them the read is a long
+ * poll that answers once the operation's revision passes `afterRevision`, at once for a finished sign-in, or
+ * with the unchanged operation after `waitMs` (at most 30000).
+ */
 export interface IReq_AuthSwitchGetOperation extends ITypedRequest {
     method: 'authswitch.authority.operation';
     request: {
         operationId: string;
+        afterRevision?: number;
+        waitMs?: number;
     };
     response: {
         operation: IAuthSwitchOperation;
@@ -496,6 +553,19 @@ export interface IReq_AuthSwitchRenameAccount extends ITypedRequest {
         account: IAuthSwitchAccount;
     };
 }
+/**
+ * One binding by the id `bind` returned, credential-free, or `null` when this authority holds no binding by
+ * that id. A backend checks that its binding still stands without reading the whole snapshot.
+ */
+export interface IReq_AuthSwitchGetBinding extends ITypedRequest {
+    method: 'authswitch.authority.binding';
+    request: {
+        bindingId: string;
+    };
+    response: {
+        binding: IAuthSwitchBinding | null;
+    };
+}
 export interface IReq_AuthSwitchRemoveAccount extends ITypedRequest {
     method: 'authswitch.authority.remove';
     request: {

package/dist_ts/authority-contract.js

@@ -5,7 +5,8 @@ const refusalCodes = new Set([
     'authority_closing', 'not_found', 'account_changed', 'account_busy',
     'login_unavailable', 'binding_unauthorized', 'native_owner_holds_login', 'claude_home_unregistered',
     'claude_handoff_pending', 'claude_receipt_missing', 'import_refusal',
-    'authority_holds_login', 'authority_unavailable',
+    'authority_holds_login', 'authority_unavailable', 'codex_unsupported', 'invalid_input',
+    'login_needs_reauth', 'access_not_fresh',
 ]);
 const isRefusalCode = (value) => typeof value === 'string' && refusalCodes.has(value);
 /** The importer keeps the marker it published; every other code shares the authority's own. */
@@ -52,5 +53,15 @@ export const asAuthSwitchRefusal = (error) => {
         return null;
     return { code, instruction };
 };
+/** The longest account label, in UTF-16 code units. */
+export const authSwitchAccountLabelMaxLength = 128;
+/**
+ * The account label rule, the one the authority applies to a rename: one to `authSwitchAccountLabelMaxLength`
+ * characters, no space at either end, no control character. A consumer validates with this rather than
+ * restating it; the authority answers a label that breaks it with the `invalid_input` refusal.
+ */
+export const isAuthSwitchAccountLabel = (value) => typeof value === 'string'
+    && value.trim() === value && value.length > 0 && value.length <= authSwitchAccountLabelMaxLength
+    && !/[\u0000-\u001f\u007f]/.test(value);
 /** Runtime capability is returned only to trusted backend callers; do not expose this response in a browser API. */
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aG9yaXR5LWNvbnRyYWN0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvYXV0aG9yaXR5LWNvbnRyYWN0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQTZCQSw2RkFBNkY7QUFDN0YsTUFBTSxDQUFDLE1BQU0sNkJBQTZCLEdBQUcsMkJBQTJCLENBQUM7QUFDekUsTUFBTSxDQUFDLE1BQU0sdUJBQXVCLEdBQUcsb0JBQW9CLENBQUM7QUFpQjVELE1BQU0sWUFBWSxHQUF3QixJQUFJLEdBQUcsQ0FBeUI7SUFDeEUsbUJBQW1CLEVBQUUsV0FBVyxFQUFFLGlCQUFpQixFQUFFLGNBQWM7SUFDbkUsbUJBQW1CLEVBQUUsc0JBQXNCLEVBQUUsMEJBQTBCLEVBQUUsMEJBQTBCO0lBQ25HLHdCQUF3QixFQUFFLHdCQUF3QixFQUFFLGdCQUFnQjtJQUNwRSx1QkFBdUIsRUFBRSx1QkFBdUI7Q0FDakQsQ0FBQyxDQUFDO0FBRUgsTUFBTSxhQUFhLEdBQUcsQ0FBQyxLQUFjLEVBQW1DLEVBQUUsQ0FDeEUsT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLFlBQVksQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUM7QUFFdkQsK0ZBQStGO0FBQy9GLE1BQU0sUUFBUSxHQUFHLENBQUMsSUFBNEIsRUFBNEIsRUFBRSxDQUMxRSxJQUFJLEtBQUssZ0JBQWdCLENBQUMsQ0FBQyxDQUFDLDZCQUE2QixDQUFDLENBQUMsQ0FBQyx1QkFBdUIsQ0FBQztBQUV0Rjs7Ozs7R0FLRztBQUNILE1BQU0sT0FBTyxpQkFBa0IsU0FBUSxLQUFLO0lBQzFCLElBQUksQ0FBeUI7SUFFN0MsWUFBWSxJQUE0QixFQUFFLFdBQW1CO1FBQzNELEtBQUssQ0FBQyxXQUFXLENBQUMsQ0FBQztRQUNuQixJQUFJLENBQUMsSUFBSSxHQUFHLElBQUksQ0FBQztJQUNuQixDQUFDO0lBRUQsbUVBQW1FO0lBQ25FLElBQVcsSUFBSSxLQUE2QixPQUFPLEVBQUUsTUFBTSxFQUFFLFFBQVEsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDLENBQUM7Q0FDdkc7QUFFRDs7Ozs7Ozs7O0dBU0c7QUFDSCxNQUFNLENBQUMsTUFBTSxtQkFBbUIsR0FBRyxDQUFDLEtBQWMsRUFBNkIsRUFBRTtJQUMvRSxJQUFJLEtBQUssWUFBWSxpQkFBaUI7UUFBRSxPQUFPLEVBQUUsSUFBSSxFQUFFLEtBQUssQ0FBQyxJQUFJLEVBQUUsV0FBVyxFQUFFLEtBQUssQ0FBQyxPQUFPLEVBQUUsQ0FBQztJQUNoRyxJQUFJLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxLQUFLLEtBQUssSUFBSSxJQUFJLENBQUMsQ0FBQyxXQUFXLElBQUksS0FBSyxDQUFDO1FBQUUsT0FBTyxJQUFJLENBQUM7SUFDeEYsTUFBTSxJQUFJLEdBQVksS0FBSyxDQUFDLFNBQVMsQ0FBQztJQUN0QyxJQUFJLE9BQU8sSUFBSSxLQUFLLFFBQVEsSUFBSSxJQUFJLEtBQUssSUFBSSxJQUFJLENBQUMsQ0FBQyxRQUFRLElBQUksSUFBSSxDQUFDO1FBQUUsT0FBTyxJQUFJLENBQUM7SUFDbEYsTUFBTSxJQUFJLEdBQVksTUFBTSxJQUFJLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO0lBQzdELE1BQU0sV0FBVyxHQUFHLFNBQVMsSUFBSSxLQUFLLElBQUksT0FBTyxLQUFLLENBQUMsT0FBTyxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO0lBQ2pHLElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyw2QkFBNkIsRUFBRSxDQUFDO1FBQ2xELE9BQU8sSUFBSSxLQUFLLFNBQVMsSUFBSSxJQUFJLEtBQUssZ0JBQWdCLENBQUMsQ0FBQyxDQUFDLEVBQUUsSUFBSSxFQUFFLGdCQUFnQixFQUFFLFdBQVcsRUFBRSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUM7SUFDMUcsQ0FBQztJQUNELElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyx1QkFBdUIsSUFBSSxDQUFDLGFBQWEsQ0FBQyxJQUFJLENBQUM7UUFBRSxPQUFPLElBQUksQ0FBQztJQUNqRixPQUFPLEVBQUUsSUFBSSxFQUFFLFdBQVcsRUFBRSxDQUFDO0FBQy9CLENBQUMsQ0FBQztBQWdZRixvSEFBb0gifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aG9yaXR5LWNvbnRyYWN0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvYXV0aG9yaXR5LWNvbnRyYWN0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQXFDQSw2RkFBNkY7QUFDN0YsTUFBTSxDQUFDLE1BQU0sNkJBQTZCLEdBQUcsMkJBQTJCLENBQUM7QUFDekUsTUFBTSxDQUFDLE1BQU0sdUJBQXVCLEdBQUcsb0JBQW9CLENBQUM7QUFpQjVELE1BQU0sWUFBWSxHQUF3QixJQUFJLEdBQUcsQ0FBeUI7SUFDeEUsbUJBQW1CLEVBQUUsV0FBVyxFQUFFLGlCQUFpQixFQUFFLGNBQWM7SUFDbkUsbUJBQW1CLEVBQUUsc0JBQXNCLEVBQUUsMEJBQTBCLEVBQUUsMEJBQTBCO0lBQ25HLHdCQUF3QixFQUFFLHdCQUF3QixFQUFFLGdCQUFnQjtJQUNwRSx1QkFBdUIsRUFBRSx1QkFBdUIsRUFBRSxtQkFBbUIsRUFBRSxlQUFlO0lBQ3RGLG9CQUFvQixFQUFFLGtCQUFrQjtDQUN6QyxDQUFDLENBQUM7QUFFSCxNQUFNLGFBQWEsR0FBRyxDQUFDLEtBQWMsRUFBbUMsRUFBRSxDQUN4RSxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksWUFBWSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsQ0FBQztBQUV2RCwrRkFBK0Y7QUFDL0YsTUFBTSxRQUFRLEdBQUcsQ0FBQyxJQUE0QixFQUE0QixFQUFFLENBQzFFLElBQUksS0FBSyxnQkFBZ0IsQ0FBQyxDQUFDLENBQUMsNkJBQTZCLENBQUMsQ0FBQyxDQUFDLHVCQUF1QixDQUFDO0FBRXRGOzs7OztHQUtHO0FBQ0gsTUFBTSxPQUFPLGlCQUFrQixTQUFRLEtBQUs7SUFDMUIsSUFBSSxDQUF5QjtJQUU3QyxZQUFZLElBQTRCLEVBQUUsV0FBbUI7UUFDM0QsS0FBSyxDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQ25CLElBQUksQ0FBQyxJQUFJLEdBQUcsSUFBSSxDQUFDO0lBQ25CLENBQUM7SUFFRCxtRUFBbUU7SUFDbkUsSUFBVyxJQUFJLEtBQTZCLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQztDQUN2RztBQUVEOzs7Ozs7Ozs7R0FTRztBQUNILE1BQU0sQ0FBQyxNQUFNLG1CQUFtQixHQUFHLENBQUMsS0FBYyxFQUE2QixFQUFFO0lBQy9FLElBQUksS0FBSyxZQUFZLGlCQUFpQjtRQUFFLE9BQU8sRUFBRSxJQUFJLEVBQUUsS0FBSyxDQUFDLElBQUksRUFBRSxXQUFXLEVBQUUsS0FBSyxDQUFDLE9BQU8sRUFBRSxDQUFDO0lBQ2hHLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLEtBQUssS0FBSyxJQUFJLElBQUksQ0FBQyxDQUFDLFdBQVcsSUFBSSxLQUFLLENBQUM7UUFBRSxPQUFPLElBQUksQ0FBQztJQUN4RixNQUFNLElBQUksR0FBWSxLQUFLLENBQUMsU0FBUyxDQUFDO0lBQ3RDLElBQUksT0FBTyxJQUFJLEtBQUssUUFBUSxJQUFJLElBQUksS0FBSyxJQUFJLElBQUksQ0FBQyxDQUFDLFFBQVEsSUFBSSxJQUFJLENBQUM7UUFBRSxPQUFPLElBQUksQ0FBQztJQUNsRixNQUFNLElBQUksR0FBWSxNQUFNLElBQUksSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7SUFDN0QsTUFBTSxXQUFXLEdBQUcsU0FBUyxJQUFJLEtBQUssSUFBSSxPQUFPLEtBQUssQ0FBQyxPQUFPLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7SUFDakcsSUFBSSxJQUFJLENBQUMsTUFBTSxLQUFLLDZCQUE2QixFQUFFLENBQUM7UUFDbEQsT0FBTyxJQUFJLEtBQUssU0FBUyxJQUFJLElBQUksS0FBSyxnQkFBZ0IsQ0FBQyxDQUFDLENBQUMsRUFBRSxJQUFJLEVBQUUsZ0JBQWdCLEVBQUUsV0FBVyxFQUFFLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQztJQUMxRyxDQUFDO0lBQ0QsSUFBSSxJQUFJLENBQUMsTUFBTSxLQUFLLHVCQUF1QixJQUFJLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQztRQUFFLE9BQU8sSUFBSSxDQUFDO0lBQ2pGLE9BQU8sRUFBRSxJQUFJLEVBQUUsV0FBVyxFQUFFLENBQUM7QUFDL0IsQ0FBQyxDQUFDO0FBRUYsdURBQXVEO0FBQ3ZELE1BQU0sQ0FBQyxNQUFNLCtCQUErQixHQUFHLEdBQUcsQ0FBQztBQUVuRDs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sd0JBQXdCLEdBQUcsQ0FBQyxLQUFjLEVBQW1CLEVBQUUsQ0FBQyxPQUFPLEtBQUssS0FBSyxRQUFRO09BQ2pHLEtBQUssQ0FBQyxJQUFJLEVBQUUsS0FBSyxLQUFLLElBQUksS0FBSyxDQUFDLE1BQU0sR0FBRyxDQUFDLElBQUksS0FBSyxDQUFDLE1BQU0sSUFBSSwrQkFBK0I7T0FDN0YsQ0FBQyx1QkFBdUIsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUM7QUFrYjFDLG9IQUFvSCJ9

package/dist_ts/authority-import-contract.d.ts

@@ -163,6 +163,12 @@ export declare const isAuthSwitchImportRefusal: (error: unknown) => boolean;
 export interface IAuthSwitchImportStatusEntry {
     sourceId: string;
     sourceKind: TAuthSwitchImportSourceKind;
+    /**
+     * The source location as a hash, exactly as it was submitted or inventoried. A backend that submits an
+     * external source finds its own record here by `sourceKind` and this hash, including after a submit whose
+     * outcome it never learned.
+     */
+    sourcePathHash: string;
     status: TAuthSwitchImportLedgerStatus;
     accountId: string | null;
     loginId: string | null;

package/dist_ts/authority-runtime-contract.d.ts

@@ -26,6 +26,35 @@ export interface IReq_AuthSwitchBindAccount extends ITypedRequest {
         capability: string;
     };
 }
+/**
+ * Backend-only release of a binding by the identity its holder bound it under, served on the MANAGEMENT
+ * socket beside `bind`, of which it is the inverse.
+ *
+ * It is how a holder releases a binding it no longer holds the capability for -- one an earlier run of it
+ * left behind -- and it needs no ready login: an account whose sign-in has ended can have its leftover
+ * bindings released, and then be removed, without signing in again first. It is authorized as `bind` is: a
+ * caller trusted with the management socket names a runtime and scope, the namespace a holder binds under
+ * and owns. It releases only the binding at exactly that runtime and scope, and only while it is still the
+ * incarnation and revision the holder read from the snapshot or `getBinding`; any other binding -- another
+ * scope, another runtime, or a successor bound meanwhile -- is left alone and the answer is `inactive`.
+ * A binding's revision names one bind and never repeats for its runtime and scope, so a successor is told
+ * apart even when it was bound under the same incarnation after the one read was released.
+ * The daemon's own managed Codex bindings are never named here. Like the runtime release, it waits for
+ * the access resolutions already admitted for that binding.
+ */
+export interface IReq_AuthSwitchUnbind extends ITypedRequest {
+    method: 'authswitch.authority.unbind';
+    request: {
+        runtime: Exclude<IAuthSwitchBinding['runtime'], 'codex'>;
+        scopeId: string;
+        incarnationId: string;
+        /** The binding's `revision` as the holder read it. */
+        expectedRevision: number;
+    };
+    response: {
+        state: 'released' | 'inactive';
+    };
+}
 /** Backend-only access operation. Refresh grants never cross this interface. */
 export interface IReq_AuthSwitchResolveAccess extends ITypedRequest {
     method: 'authswitch.authority.resolveAccess';

package/dist_ts/classes.authoritybroker.d.ts

@@ -1,5 +1,5 @@
 import * as plugins from './plugins.js';
-import type { IAuthSwitchAccount, IAuthSwitchAccountEvent, IAuthSwitchBinding, IAuthSwitchOperation, IAuthSwitchSnapshot } from './authority-contract.js';
+import type { IAuthSwitchAccount, IAuthSwitchAccountEvent, IAuthSwitchBinding, IAuthSwitchOperation, IAuthSwitchSnapshot, IReq_AuthSwitchSnapshot } from './authority-contract.js';
 import { AuthSwitchAuthorityDatabase } from './classes.authoritydatabase.js';
 import type { IAuthSwitchUsageContext } from './classes.authorityusage.js';
 import { type IAuthSwitchSecretCodec } from './classes.authoritysecrets.js';
@@ -29,6 +29,8 @@ export declare class AuthSwitchAuthorityBroker {
     private readonly operations;
     private readonly refreshes;
     private readonly listeners;
+    /** Operation long polls; woken by their operation's own changes, and all of them on close. */
+    private readonly operationWaiters;
     private claudeRefresh?;
     private maintenance?;
     private timer?;
@@ -42,12 +44,7 @@ export declare class AuthSwitchAuthorityBroker {
     refreshDueAccounts(): Promise<void>;
     private isDue;
     private publish;
-    snapshot(options?: {
-        accountAfter?: string;
-        loginAfter?: string;
-        bindingAfter?: string;
-        limit?: number;
-    }): Promise<IAuthSwitchSnapshot>;
+    snapshot(options?: IReq_AuthSwitchSnapshot['request']): Promise<IAuthSwitchSnapshot>;
     events(epoch: string, afterRevision: number, waitMs: number, signal?: AbortSignal): Promise<{
         epoch: string;
         revision: number;
@@ -62,7 +59,16 @@ export declare class AuthSwitchAuthorityBroker {
     beginAddOpenAi(operationId: string): Promise<IAuthSwitchOperation>;
     beginReauthOpenAi(operationId: string, accountId: string, loginId: string, purpose: 'openai_managed', beforeNew?: () => Promise<void>): Promise<IAuthSwitchOperation>;
     private beginLogin;
-    getOperation(operationId: string): Promise<IAuthSwitchOperation>;
+    /**
+     * One device sign-in. With `wait`, the read is a long poll, the way `events` waits: it answers at once when
+     * the operation's revision is past `afterRevision` or the sign-in has finished, and otherwise when the
+     * operation next changes or `waitMs` runs out, whichever is first -- so a caller follows the prompt and
+     * the outcome without polling. A timed-out wait answers with the unchanged operation.
+     */
+    getOperation(operationId: string, wait?: {
+        afterRevision: number;
+        waitMs: number;
+    }, signal?: AbortSignal): Promise<IAuthSwitchOperation>;
     listOperations(after: string | null, limit?: number): Promise<{
         operations: IAuthSwitchOperation[];
         nextCursor: string | null;
@@ -83,19 +89,35 @@ export declare class AuthSwitchAuthorityBroker {
         binding: IAuthSwitchBinding;
         capability: string;
     }>;
+    getBinding(bindingId: string): Promise<IAuthSwitchBinding | null>;
     revokeBinding(bindingId: string, capability: string): Promise<boolean>;
     releaseExternalBinding(bindingId: string, capability: string): Promise<'released' | 'inactive'>;
+    /** Releases a caller-held binding while it still carries exactly this capability, named by its hash. */
+    releaseExternalCapability(bindingId: string, capabilityHash: string): Promise<'released' | 'inactive'>;
+    /**
+     * The caller-held binding a holder names by the identity it bound under, while it is still exactly the
+     * incarnation and revision the holder read, or `null`. Its capability hash is what a release then fences
+     * and compares, so a successor bound after this read is never released in its place.
+     */
+    findHeldBinding(input: {
+        runtime: Exclude<IAuthSwitchBinding['runtime'], 'codex'>;
+        scopeId: string;
+        incarnationId: string;
+        expectedRevision: number;
+    }): Promise<{
+        bindingId: string;
+        capabilityHash: string;
+    } | null>;
     resolveAccess(bindingId: string, capability: string, minValidityMs: number, rejectedGrantGeneration?: number): Promise<IAuthSwitchResolvedAccess>;
     /** Backend-only access for usage; it never creates or bypasses a runtime binding. */
     resolveUsageAccess(context: IAuthSwitchUsageContext, rejectedGrantGeneration: number | undefined, minValidityMs: number): Promise<IAuthSwitchResolvedAccess>;
     /**
-     * The shared managed-access loop, whose refusals are deliberately still unmarked faults.
-     *
-     * Its two callers repair differently: a runtime holding a binding binds again, while the usage reader has
-     * no binding at all and collapses everything into one usage problem. Naming a code here would either say
-     * "binding" to a caller that has none, or invent a second meaning for one that does, so the decision waits
-     * for the slice that gives the usage answer its own vocabulary. What a bound runtime can act on is decided
-     * before this point, in the view `resolveAccess` supplies.
+     * The shared managed-access loop. What it decides about the login itself is a marked refusal both callers
+     * read the same way: `login_needs_reauth` when only a new sign-in brings the login back, `access_not_fresh`
+     * when the login is intact and the provider could not renew it yet. The usage reader still folds either
+     * into its own problem; a bound runtime shows the instruction. What only concerns a binding is decided
+     * before this point, in the view `resolveAccess` supplies, and a changed identity or a view that keeps
+     * moving stays an unmarked fault, because nobody decided it.
      */
     private resolveManagedAccess;
     private refreshAccount;