@modelprofile.com/authswitch 9.0.0 → 9.2.0

package/readme.md

@@ -37,6 +37,18 @@ that tool -- `ownerTool` is `claude_code`, `codex` or `opencode`, and `null` exa
 native tool holds it, because the authority refreshes it or nothing does. The authority
 names it rather than leaving a consumer to derive it from the purpose, which would be wrong
 as soon as two purposes share a tool or one tool gains a second purpose.
+The snapshot also lists `nativeAssignments`: which account a vendor tool's own home on this host runs on,
+as `{ id, tool, accountId, loginId, state, revision }` with the home named by its hash. Only homes the
+authority itself switches are recorded -- Claude Code homes adopted by a verified import -- and `state` is
+`switching` while a handoff to another account is in flight and `quarantined` until one is resolved. A
+Codex or OpenCode store that its own tool still refreshes appears as its login instead, with
+`owner: 'legacy_native'` and its `ownerTool`, because the authority does not decide what that store holds.
+Every change of an assignment is an account event, so a subscriber sees it like any other change.
+A removed account is left out of the snapshot unless the caller asks with `includeRemoved` (on `snapshot`,
+`snapshotAll` and `subscribe`): it then appears with `removed: true` and its logins with `health: 'removed'`.
+An account label follows one published rule, `isAuthSwitchAccountLabel` (at most
+`authSwitchAccountLabelMaxLength` characters, no space at either end, no control character); a rename that
+breaks it is refused with `invalid_input`.
 
 ```ts
 import { randomUUID } from 'node:crypto';
@@ -50,41 +62,82 @@ const operationId = randomUUID();
 const operation = await client.beginAddOpenAi(operationId);
 // Keep operation.id to discover its final result after navigation or reconnect.
 const receipt = await client.getOperation(operation.id);
+// Or follow it without polling: each answer comes when the operation changes.
+let current = operation;
+while (['starting', 'pending', 'committing'].includes(current.state)) {
+  current = await client.watchOperation(current.id, current.revision);
+}
 ```
 
 Browser code can import the credential-free DTOs from
 `@modelprofile.com/authswitch/authority-contract`. The backend-only binding, access and release
 requests are named by `@modelprofile.com/authswitch/authority-runtime-contract`, and the one-time
 import's own DTOs by `@modelprofile.com/authswitch/authority-import-contract`; those capabilities must
-never reach a browser. Two of the three runtime requests are served on the runtime socket -- resolving
-access and releasing a binding -- while `authswitch.authority.bind` is served on the **management** socket
-by design: minting a capability is the act that authorizes a runtime, so only a trusted management caller
-may perform it, and a container that is given the runtime directory can use a binding it was handed but can
-never create one. A backend binds an account to a runtime incarnation by exact account ID, login ID and
-purpose, and keeps the returned capability private. Targeted reauthentication likewise requires the
+never reach a browser. Two of the four runtime requests are served on the runtime socket -- resolving
+access and releasing a binding -- while `authswitch.authority.bind` and its inverse
+`authswitch.authority.unbind` are served on the **management** socket by design: minting a capability is the
+act that authorizes a runtime, so only a trusted management caller may perform it, and a container that is
+given the runtime directory can use and release a binding it was handed but can never create one or
+release one it was not handed. A backend binds an account to a runtime incarnation by exact account ID,
+login ID and purpose, and keeps the returned capability private. Targeted reauthentication likewise requires the
 exact login; an account's presentation default never selects a grant for either action. Completed and
 interrupted operations remain discoverable through `getOperation()` and paged
-`listOperations()`. A completed receipt and its account/grant change commit together, so
+`listOperations()`. `watchOperation(id, afterRevision, waitMs = 30000)` is the same read as a long poll,
+the way `events` waits: it answers as soon as the operation's revision passes `afterRevision` -- a sign-in
+answers `starting` with no prompt, then `pending` with its device prompt, then its outcome -- at once for a
+finished operation, and with the unchanged operation once `waitMs` (at most 30000) runs out. Only a change
+of that operation answers it. A completed receipt and its account/grant change commit together, so
 the receipt resolves a lost response or an event that arrives first. Add and reauthentication
 callers supply one UUID for the logical start and reuse it after a lost response. Replaying that
 UUID returns the same matching receipt without starting another provider login; using it for a
 different target is rejected. Cancelling a durable `starting` receipt prevents a late provider
 handle from promoting or overwriting it. Aborting a client request only detaches that request and
-does not cancel the daemon-owned login. The runtime-only socket
-resolves that binding to a current access token; its directory can be mounted into a
+does not cancel the daemon-owned login. A client that disconnects before its answer -- a long poll it
+stopped reading, or one the daemon's shutdown settles after the client went away -- ends only its own
+connection: the daemon drops that request's pending work and keeps serving every other client. Each
+request is bounded by its own deadline -- 35 s unless its route states another, 120 s for an import submit,
+the wait plus 5 s for a long poll -- and nothing in the transport ends it sooner: the daemon gives a
+connection 35 s from acceptance to deliver its complete request, however it trickles in, and sets no limit
+once it is admitted.
+The runtime-only socket resolves that binding to a current access token; its directory can be mounted into a
 container without exposing the management socket. A provider that rejects a specific
 access-token generation can request a newer one through `rejectedGrantGeneration`; the
 authority coalesces concurrent rejection callbacks and never replays an uncertain refresh.
-After an external Flex or OpenCode runtime has fenced new work and drained its pending access
-resolutions and provider requests, it can release its exact binding capability through the
-runtime socket. Every bind receives a fresh random capability, so a stale release cannot fence
+A ChatGPT login backs a Claude Code runtime too (`runtime: 'claude'`); a Claude account never binds,
+because it reaches Claude Code through the native switch. After an external Flex, OpenCode or Claude
+runtime has fenced new work and drained its pending access resolutions and provider requests, it can
+release its exact binding capability through the runtime socket. Every bind receives a fresh random capability, so a stale release cannot fence
 or delete a successor even if the caller reused an incarnation label. Release waits for admitted
 server-side resolution handlers, but handler completion does not prove response delivery and
 cannot retract an access token already received or in use; the runtime owner therefore owns that
 drain. Generic release cannot revoke a managed Codex binding, whose daemon-owned stop still closes
 the runtime and clears its durable run before internal revocation. Binding release never transfers
-or changes ownership of the account grant. External-binding recovery after an owner crash remains
-a prerequisite for the full account-mutation cutover.
+or changes ownership of the account grant.
+
+A holder that lost its capability -- a binding an earlier run of it left behind -- releases it with
+`unbind({ runtime, scopeId, incarnationId, expectedRevision })` (`authswitch.authority.unbind`), naming the
+binding by the identity it bound it under, as the snapshot and `getBinding` publish it. Unbinding needs no
+ready login, so the leftover bindings of an account whose sign-in has ended are released, and the account
+removed, without signing in again. It is authorized exactly as `bind` is: the management socket is the trust
+boundary, and a runtime and scope are the namespace a holder binds under and owns -- AGL, for example, binds
+under its own installation's scopes -- so a holder names only its own. The daemon releases only the binding
+at exactly that runtime and scope, and only while it is still the incarnation and revision the holder read:
+another scope, another runtime, or a successor bound in the meantime is left alone, and the answer is
+`inactive`, as it is for a binding already released. A binding's revision is the authority revision of the
+bind that wrote it, so it never repeats for a runtime and scope, even after a release: a repeated or stale
+unbind never names a successor bound under the same incarnation. Its capability is fenced and released exactly as the
+runtime release would, so admitted access resolutions finish first. Managed Codex bindings are never named
+here. While the login is ready, a holder can instead bind the same runtime and scope again, which replaces
+the capability, and release the returned one.
+
+`getBinding(bindingId)` (`authswitch.authority.binding`) reads one binding by the id `bind` returned,
+credential-free, or `null` once the authority holds none by that id, so a backend checks its binding without
+reading the whole snapshot.
+
+Removing an account that still backs a Flex, OpenCode or Claude binding is refused with `account_busy`, naming
+those runtimes: their holder stops them and releases the bindings first -- by capability, or by `unbind` when
+it no longer holds one -- so a removal never strands a runtime whose next access would fail. Managed Codex
+bindings are the daemon's own; removal drains managed Codex as before and then takes them with the account.
 
 Every route on either socket answers in one of three ways: a result, a **refusal**, or a fault. A refusal
 is an answer -- the daemon completed its check, nothing was left half-done, and its message says what the
@@ -99,7 +152,8 @@ that marker: it answers `{ code, instruction }` for a refusal and `null` for a f
 closed `TAuthSwitchRefusalCode` set, which is what a client branches on without reading the text:
 `authority_closing`, `not_found`, `account_changed`, `account_busy`, `login_unavailable`,
 `binding_unauthorized`, `native_owner_holds_login`, `claude_home_unregistered`, `claude_handoff_pending`,
-`claude_receipt_missing` and `import_refusal`, plus the two the legacy commands answer with on this side of
+`claude_receipt_missing`, `import_refusal`, `codex_unsupported`, `invalid_input`, `login_needs_reauth` and
+`access_not_fresh`, plus the two the legacy commands answer with on this side of
 the socket, `authority_holds_login` and `authority_unavailable` (see "The legacy fence" below). The
 instruction is authored for the owner and contains no path, credential or digest; only an importer refusal
 may name the process the owner has to stop. The set is producer-owned: a consumer branches on the codes it
@@ -112,10 +166,12 @@ credential was being resolved. Those are one answer on purpose: an absent bindin
 compared against the same zero hash, so nothing distinguishes them, and the repair is the same either way --
 bind again. A binding whose account has since been reauthorized reads `login_unavailable` instead, because
 binding again cannot help until that account holds a login again. A device sign-in or preuse operation this
-authority does not hold reads `not_found`, from whichever route met it. Two things stay unmarked faults on
-purpose. What the shared managed-access loop refuses is one: it serves a bound runtime and the
-credential-free usage reader alike, and those two repair differently. Binding an *account* this authority
-does not hold at all is the other: the storage layer throws `Account is not available for this runtime.`,
+authority does not hold reads `not_found`, from whichever route met it. What the access loop decides about
+the login itself is marked as well: `login_needs_reauth` when only a new device sign-in brings the login back
+(after which a bound runtime binds again), and `access_not_fresh` when the login is intact but the provider
+could not renew its access yet, so the same request can succeed later. A changed identity or a view that
+keeps moving during resolution stays an unmarked fault, because nobody decided it. Binding an *account* this
+authority does not hold at all stays one too: the storage layer throws `Account is not available for this runtime.`,
 which a socket caller reads as `Internal server error`, because naming it is a decision about which layer
 authors owner instructions rather than a wording fix.
 
@@ -128,6 +184,15 @@ and the ledger row it wrote says where that source stands -- while an unmarked f
 unknown, and that source must then be read with `authswitch.authority.import.status` rather than
 submitted again.
 
+A daemon that is shutting down admits no new request -- every route answers `authority_closing` -- and
+settles the requests it already admitted before it closes its store: a waiting `events` or
+`watchOperation` read answers normally from the open store instead of failing.
+
+A client reading a daemon that runs an older release -- one not restarted after an upgrade -- fails with
+`AuthSwitchDaemonOutdatedError`, which names the restart (`authswitch authority service stop`, then
+`start`), and a subscription reports `unavailable` with the reason `daemon_outdated` once and retries every
+five seconds until the daemon is restarted.
+
 `AuthSwitchClient.subscribe(onSnapshot, onEvent, signal, { onStatus })` reports `current`
 after a fresh snapshot or verified heartbeat, `unavailable` on disconnect or resync, and
 `closed` on abort. Keep cached account actions disabled while status is not `current`.
@@ -293,7 +358,9 @@ that refusal nor "already imported" ever clears: no route forgets a row or re-po
 
 `import status` reads the migration ledger, the grants and the handoffs -- never the host -- and reports, per
 source, where it stands, which owner refreshes its login now, and what to do next: nothing, submit the same
-source again, or sign in to that account again. Submitting a source again is how an interrupted run resumes,
+source again, or sign in to that account again. Each entry also carries the source's `sourcePathHash`, so a
+backend that submitted an external source finds its own record by `sourceKind` and that hash -- also after a
+submit whose outcome it never learned -- without deriving the ledger row id. Submitting a source again is how an interrupted run resumes,
 and the answer comes from the same durable record the daemon decides on: a source whose sign-in was in
 flight when the run died is reported as needing a device sign-in, not as resumable, because a rotating
 refresh token is never sent a second time. Sources that were never submitted have no ledger row and appear
@@ -339,7 +406,7 @@ generated prose and credentials are absent from persistence and management respo
 removal and targeted reauthentication refuse while that account has an active preuse request.
 
 A trusted in-process daemon host can call `AuthSwitchAuthorityDaemon.startManagedCodex()`
-for a bound account and workspace. It owns a private Codex 0.157.0 app-server, passes only
+for a bound account and workspace. It owns a private Codex app-server, passes only
 the authority's current access token through Codex's external-token login, answers its
 unauthorized callback through the authority, and revokes the binding on stop. The returned
 runtime exposes an interactive `codex --remote unix://…` launch descriptor and native
@@ -363,13 +430,23 @@ directory other users cannot rewrite, and the socket behind it is the user's own
 directory of the user's; anything else fails the start with that package's error. Codex keeps a
 zero-byte startup lock in that directory for each socket path it has served; the file is
 Codex's own and authswitch does not remove it.
-Managed Codex runs only the verified Codex release: a `codex` that reports any other
-version is refused before it starts, so an automatic Codex update stops new managed
-sessions until authswitch has verified that release.
+Managed Codex runs Codex 0.156.0 or newer -- the floor `@modelprofile.com/mcp-crossharness`'s
+`requireCodexVersion` checks, the first release that publishes the socket alias -- and checks the
+contract at every start instead of pinning one release. Before anything is recorded or started, the
+`codex` it will run must report a readable version at or above the floor, and its own protocol
+description (`codex app-server generate-json-schema`) must still offer every surface managed Codex uses:
+the requests `account/login/start`, `thread/start`, `thread/resume` and `turn/start`; the external
+ChatGPT token login with the fields it sends; the `account/chatgptAuthTokens/refresh` callback with the
+`unauthorized` reason and the reply it gives; and the thread and turn parameters it sends. After
+connecting, the app-server must report exactly the version that was checked, because Codex can replace
+itself between the check and the start. Each failure is the `codex_unsupported` refusal naming the
+version or the missing surface, so a Codex update that drops something managed Codex relies on stops new
+managed sessions by name instead of failing one later. A prerelease above the floor runs; a prerelease of
+0.156.0 itself is below it.
 Managed-Codex process ownership observation is qualified on Linux and reads exact argument
 boundaries from `/proc`; on other hosts doctor reports the process observation as unknown,
 and authority actions that require survivor proof refuse instead of guessing.
-Codex 0.157.0 does not persist an unused thread created by `thread/start`; resume applies
+Codex (verified through 0.157) does not persist an unused thread created by `thread/start`; resume applies
 after Codex has committed a rollout. The existing CLI has not yet been moved to this path.
 
 This SDK is additive at this stage. The commands documented below still use the existing

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@modelprofile.com/authswitch',
-  version: '9.0.0',
+  version: '9.2.0',
   description: 'Manage Codex, OpenCode and Claude Code accounts with guided switching and live usage status'
 }

package/ts/authority-contract.ts

@@ -25,7 +25,15 @@ export type TAuthSwitchRefusalCode =
   | 'claude_home_unregistered'
   | 'claude_handoff_pending'
   | 'claude_receipt_missing'
-  | 'import_refusal';
+  | 'import_refusal'
+  /** The Codex on this host is older than managed Codex runs, or no longer offers a surface it uses. */
+  | 'codex_unsupported'
+  /** A value the owner typed breaks a rule the instruction states, such as an account label. */
+  | 'invalid_input'
+  /** The account's login has ended and only a new device sign-in brings it back. */
+  | 'login_needs_reauth'
+  /** The login is intact, but the provider could not renew its access yet; the same request can succeed later. */
+  | 'access_not_fresh';
 
 /** The marker the importer has published since 8.1.0; it keeps its own value on the wire. */
 export const authSwitchImportRefusalMarker = 'authswitch_import_refusal';
@@ -50,7 +58,8 @@ const refusalCodes: ReadonlySet<string> = new Set<TAuthSwitchRefusalCode>([
   'authority_closing', 'not_found', 'account_changed', 'account_busy',
   'login_unavailable', 'binding_unauthorized', 'native_owner_holds_login', 'claude_home_unregistered',
   'claude_handoff_pending', 'claude_receipt_missing', 'import_refusal',
-  'authority_holds_login', 'authority_unavailable',
+  'authority_holds_login', 'authority_unavailable', 'codex_unsupported', 'invalid_input',
+  'login_needs_reauth', 'access_not_fresh',
 ]);
 
 const isRefusalCode = (value: unknown): value is TAuthSwitchRefusalCode =>
@@ -102,6 +111,18 @@ export const asAuthSwitchRefusal = (error: unknown): IAuthSwitchRefusal | null =
   return { code, instruction };
 };
 
+/** The longest account label, in UTF-16 code units. */
+export const authSwitchAccountLabelMaxLength = 128;
+
+/**
+ * The account label rule, the one the authority applies to a rename: one to `authSwitchAccountLabelMaxLength`
+ * characters, no space at either end, no control character. A consumer validates with this rather than
+ * restating it; the authority answers a label that breaks it with the `invalid_input` refusal.
+ */
+export const isAuthSwitchAccountLabel = (value: unknown): value is string => typeof value === 'string'
+  && value.trim() === value && value.length > 0 && value.length <= authSwitchAccountLabelMaxLength
+  && !/[\u0000-\u001f\u007f]/.test(value);
+
 /** Credential-free account management contract. Safe to import in browser code. */
 export type TAuthSwitchLoginPurpose = 'openai_managed' | 'claude_host_native' | 'claude_container_setup' | 'opencode_native';
 export type TAuthSwitchLoginHealth = 'ready' | 'refreshing' | 'retry_wait' | 'needs_reauth' | 'unverified' | 'pending_handoff' | 'handoff_quarantined' | 'removed';
@@ -149,9 +170,36 @@ export interface IAuthSwitchLogin {
 export interface IAuthSwitchBinding {
   id: string;
   accountId: string;
+  /**
+   * The runtime an OpenAI (ChatGPT) login backs. `flex`, `opencode` and `claude` bindings are held and
+   * released by their caller over the runtime socket; `codex` is the daemon's own managed Codex. A Claude
+   * account never binds: it reaches Claude Code through the native switch.
+   */
   runtime: 'flex' | 'codex' | 'opencode' | 'claude';
   scopeId: string;
   incarnationId: string;
+  /**
+   * The authority revision at which this runtime and scope were last bound. It grows with every bind and never
+   * repeats for them, not even after a release and a new bind, so it names exactly one bind.
+   */
+  revision: number;
+}
+
+/**
+ * Which account a vendor tool's own home on this host runs on. Credential-free: the home is named by the
+ * hash the authority registered it under, never by its path.
+ *
+ * Only homes the authority itself switches are recorded: Claude Code homes adopted by a verified import.
+ * A Codex or OpenCode store that a native tool still refreshes appears as its login instead, with
+ * `owner: 'legacy_native'` and its `ownerTool`, because the authority does not decide what that store holds.
+ */
+export interface IAuthSwitchNativeAssignment {
+  id: string;
+  tool: TAuthSwitchLoginOwnerTool;
+  accountId: string;
+  loginId: string;
+  /** `switching` while a handoff to another account is in flight; `quarantined` until it is resolved. */
+  state: 'ready' | 'switching' | 'quarantined';
   revision: number;
 }
 
@@ -163,9 +211,11 @@ export interface IAuthSwitchSnapshot {
   accounts: IAuthSwitchAccount[];
   logins: IAuthSwitchLogin[];
   bindings: IAuthSwitchBinding[];
+  nativeAssignments: IAuthSwitchNativeAssignment[];
   nextAccountCursor: string | null;
   nextLoginCursor: string | null;
   nextBindingCursor: string | null;
+  nextNativeAssignmentCursor: string | null;
 }
 
 /** Persisted account evidence. No provider request is made while collecting diagnostics. */
@@ -391,7 +441,13 @@ export interface IReq_AuthSwitchClaudeNativeHandoffs extends ITypedRequest {
 
 export interface IReq_AuthSwitchSnapshot extends ITypedRequest {
   method: 'authswitch.authority.snapshot';
-  request: { accountAfter?: string; loginAfter?: string; bindingAfter?: string; limit?: number };
+  request: { accountAfter?: string; loginAfter?: string; bindingAfter?: string; nativeAssignmentAfter?: string;
+    limit?: number;
+    /**
+     * Also publish removed accounts (`removed: true`) and their removed logins (`health: 'removed'`), so a
+     * consumer can show them apart. Absent or false keeps the snapshot to what is live.
+     */
+    includeRemoved?: boolean };
   response: { snapshot: IAuthSwitchSnapshot };
 }
 
@@ -441,9 +497,14 @@ export interface IReq_AuthSwitchListOperations extends ITypedRequest {
   response: { operations: IAuthSwitchOperation[]; nextCursor: string | null };
 }
 
+/**
+ * One device sign-in. `afterRevision` and `waitMs` come together or not at all: with them the read is a long
+ * poll that answers once the operation's revision passes `afterRevision`, at once for a finished sign-in, or
+ * with the unchanged operation after `waitMs` (at most 30000).
+ */
 export interface IReq_AuthSwitchGetOperation extends ITypedRequest {
   method: 'authswitch.authority.operation';
-  request: { operationId: string };
+  request: { operationId: string; afterRevision?: number; waitMs?: number };
   response: { operation: IAuthSwitchOperation };
 }
 
@@ -478,6 +539,16 @@ export interface IReq_AuthSwitchRenameAccount extends ITypedRequest {
   response: { account: IAuthSwitchAccount };
 }
 
+/**
+ * One binding by the id `bind` returned, credential-free, or `null` when this authority holds no binding by
+ * that id. A backend checks that its binding still stands without reading the whole snapshot.
+ */
+export interface IReq_AuthSwitchGetBinding extends ITypedRequest {
+  method: 'authswitch.authority.binding';
+  request: { bindingId: string };
+  response: { binding: IAuthSwitchBinding | null };
+}
+
 export interface IReq_AuthSwitchRemoveAccount extends ITypedRequest {
   method: 'authswitch.authority.remove';
   request: { accountId: string; expectedRevision: number };

package/ts/authority-import-contract.ts

@@ -173,6 +173,12 @@ export const isAuthSwitchImportRefusal = (error: unknown): boolean =>
 export interface IAuthSwitchImportStatusEntry {
   sourceId: string;
   sourceKind: TAuthSwitchImportSourceKind;
+  /**
+   * The source location as a hash, exactly as it was submitted or inventoried. A backend that submits an
+   * external source finds its own record here by `sourceKind` and this hash, including after a submit whose
+   * outcome it never learned.
+   */
+  sourcePathHash: string;
   status: TAuthSwitchImportLedgerStatus;
   accountId: string | null;
   loginId: string | null;

package/ts/authority-runtime-contract.ts

@@ -25,6 +25,36 @@ export interface IReq_AuthSwitchBindAccount extends ITypedRequest {
   response: { binding: IAuthSwitchBinding; capability: string };
 }
 
+/**
+ * Backend-only release of a binding by the identity its holder bound it under, served on the MANAGEMENT
+ * socket beside `bind`, of which it is the inverse.
+ *
+ * It is how a holder releases a binding it no longer holds the capability for -- one an earlier run of it
+ * left behind -- and it needs no ready login: an account whose sign-in has ended can have its leftover
+ * bindings released, and then be removed, without signing in again first. It is authorized as `bind` is: a
+ * caller trusted with the management socket names a runtime and scope, the namespace a holder binds under
+ * and owns. It releases only the binding at exactly that runtime and scope, and only while it is still the
+ * incarnation and revision the holder read from the snapshot or `getBinding`; any other binding -- another
+ * scope, another runtime, or a successor bound meanwhile -- is left alone and the answer is `inactive`.
+ * A binding's revision names one bind and never repeats for its runtime and scope, so a successor is told
+ * apart even when it was bound under the same incarnation after the one read was released.
+ * The daemon's own managed Codex bindings are never named here. Like the runtime release, it waits for
+ * the access resolutions already admitted for that binding.
+ */
+export interface IReq_AuthSwitchUnbind extends ITypedRequest {
+  method: 'authswitch.authority.unbind';
+  request: {
+    runtime: Exclude<IAuthSwitchBinding['runtime'], 'codex'>;
+    scopeId: string;
+    incarnationId: string;
+    /** The binding's `revision` as the holder read it. */
+    expectedRevision: number;
+  };
+  response: {
+    state: 'released' | 'inactive';
+  };
+}
+
 /** Backend-only access operation. Refresh grants never cross this interface. */
 export interface IReq_AuthSwitchResolveAccess extends ITypedRequest {
   method: 'authswitch.authority.resolveAccess';