@modelprofile.com/authswitch 9.1.0 → 10.0.0

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@modelprofile.com/authswitch',
-    version: '9.1.0',
+    version: '10.0.0',
     description: 'Manage Codex, OpenCode and Claude Code accounts with guided switching and live usage status'
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSw4QkFBOEI7SUFDcEMsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLDZGQUE2RjtDQUMzRyxDQUFBIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSw4QkFBOEI7SUFDcEMsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLDZGQUE2RjtDQUMzRyxDQUFBIn0=

package/dist_ts/authority-contract.d.ts

@@ -124,6 +124,10 @@ export interface IAuthSwitchBinding {
     runtime: 'flex' | 'codex' | 'opencode' | 'claude';
     scopeId: string;
     incarnationId: string;
+    /**
+     * The authority revision at which this runtime and scope were last bound. It grows with every bind and never
+     * repeats for them, not even after a release and a new bind, so it names exactly one bind.
+     */
     revision: number;
 }
 /**
@@ -286,13 +290,11 @@ export interface IAuthSwitchAccountEvent {
     kind: 'account' | 'binding';
     accountId: string;
 }
+/** What a device sign-in shows the person signing in; the authority signs in with a device code only. */
 export type TAuthSwitchLoginPrompt = {
     flow: 'device';
     verificationUrl: string;
     userCode: string;
-} | {
-    flow: 'browser';
-    authUrl: string;
 };
 export interface IAuthSwitchOperation {
     id: string;
@@ -314,7 +316,36 @@ export interface IAuthSwitchOperation {
     finishedAt: string | null;
     revision: number;
 }
-/** Credential-free receipt for one exact, never-replayed quota-consuming request. */
+/**
+ * A limit that kept a preuse prompt from being answered: `usage_limit` is the account's quota, spent until it
+ * resets, `rate_limit` a short throttle. `window` names the window by its length (`weekly`, `five-hour`) and
+ * `resetsAt` is an ISO time; either is null when neither the usage reading nor the provider stated it.
+ */
+export interface IAuthSwitchPreuseLimit {
+    kind: 'usage_limit' | 'rate_limit';
+    window: string | null;
+    resetsAt: string | null;
+}
+/**
+ * Why a sent preuse prompt failed without a limit, never with the provider's text. `http` is an answer with an
+ * HTTP error status; `stream` an error the answer stream reported after it began, with the
+ * machine-readable code the error states and no status, since its answer was a success; `response` an answer that could not be read; `network` a connection
+ * that failed before any answer; `aborted` an abort that was neither a cancellation nor the deadline; `unknown`
+ * anything else. `status` and `providerCode` are null when the failure did not state them.
+ */
+export interface IAuthSwitchPreuseFailure {
+    kind: 'http' | 'stream' | 'response' | 'network' | 'aborted' | 'unknown';
+    status: number | null;
+    providerCode: string | null;
+}
+/**
+ * Credential-free receipt for one exact, never-replayed quota-consuming request.
+ *
+ * `not_sent` with `usage_limit` is an account whose own usage reading showed a reached limit, so nothing was
+ * sent; `refused` is a prompt the provider refused with a limit before it began to answer, so nothing was
+ * consumed. `limit` describes the limit whenever `problem` is `usage_limit` or `rate_limit`, and is null otherwise.
+ * `failure` names the cause of a `request_uncertain` request when it failed with one, and is null otherwise.
+ */
 export interface IAuthSwitchPreuseOperation {
     id: string;
     accountId: string;
@@ -322,13 +353,15 @@ export interface IAuthSwitchPreuseOperation {
     purpose: 'openai_managed';
     requestedModel: string | null;
     model: string | null;
-    state: 'preparing' | 'request_may_have_started' | 'complete' | 'not_sent' | 'outcome_unknown';
+    state: 'preparing' | 'request_may_have_started' | 'complete' | 'not_sent' | 'refused' | 'outcome_unknown';
     result: {
         inputTokens: number | null;
         outputTokens: number | null;
         totalTokens: number | null;
     } | null;
-    problem: 'none' | 'target_unavailable' | 'access_unavailable' | 'catalog_unavailable' | 'account_busy' | 'cancelled' | 'authority_closing' | 'interrupted' | 'request_uncertain';
+    problem: 'none' | 'target_unavailable' | 'access_unavailable' | 'catalog_unavailable' | 'account_busy' | 'cancelled' | 'authority_closing' | 'interrupted' | 'request_uncertain' | 'usage_limit' | 'rate_limit';
+    limit: IAuthSwitchPreuseLimit | null;
+    failure: IAuthSwitchPreuseFailure | null;
     createdAt: string;
     updatedAt: string;
     finishedAt: string | null;
@@ -562,14 +595,31 @@ export interface IReq_AuthSwitchGetBinding extends ITypedRequest {
         binding: IAuthSwitchBinding | null;
     };
 }
+/**
+ * What a removal did about the account's ChatGPT sign-in at OpenAI:
+ * - `not_requested`: the caller did not ask; nothing reached the network.
+ * - `yes`: OpenAI confirmed the revocation.
+ * - `failed`: OpenAI did not confirm it, or not within the 10 seconds a removal's revocations are given in all;
+ *   the sign-in may still be valid there. The account is removed anyway.
+ * - `not_applicable`: the authority held no ChatGPT sign-in of its own for the account.
+ */
+export type TAuthSwitchRevocation = 'not_requested' | 'yes' | 'failed' | 'not_applicable';
+/**
+ * Removes an account. With `revoke: true` the authority also revokes, after the removal committed, the ChatGPT
+ * sign-in it held for the account, and `revoked` says whether OpenAI confirmed it. The revocations take at most 10
+ * seconds in all, so a revoking removal answers within a request's usual 35 seconds. A revocation is irreversible
+ * and reaches everything that still refreshes from that sign-in, which the authority cannot see: see the readme.
+ */
 export interface IReq_AuthSwitchRemoveAccount extends ITypedRequest {
     method: 'authswitch.authority.remove';
     request: {
         accountId: string;
         expectedRevision: number;
+        revoke?: true;
     };
     response: {
         account: IAuthSwitchAccount;
+        revoked: TAuthSwitchRevocation;
     };
 }
 /** Runtime capability is returned only to trusted backend callers; do not expose this response in a browser API. */

package/dist_ts/authority-contract.js

@@ -64,4 +64,4 @@ export const isAuthSwitchAccountLabel = (value) => typeof value === 'string'
     && value.trim() === value && value.length > 0 && value.length <= authSwitchAccountLabelMaxLength
     && !/[\u0000-\u001f\u007f]/.test(value);
 /** Runtime capability is returned only to trusted backend callers; do not expose this response in a browser API. */
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aG9yaXR5LWNvbnRyYWN0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvYXV0aG9yaXR5LWNvbnRyYWN0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQXFDQSw2RkFBNkY7QUFDN0YsTUFBTSxDQUFDLE1BQU0sNkJBQTZCLEdBQUcsMkJBQTJCLENBQUM7QUFDekUsTUFBTSxDQUFDLE1BQU0sdUJBQXVCLEdBQUcsb0JBQW9CLENBQUM7QUFpQjVELE1BQU0sWUFBWSxHQUF3QixJQUFJLEdBQUcsQ0FBeUI7SUFDeEUsbUJBQW1CLEVBQUUsV0FBVyxFQUFFLGlCQUFpQixFQUFFLGNBQWM7SUFDbkUsbUJBQW1CLEVBQUUsc0JBQXNCLEVBQUUsMEJBQTBCLEVBQUUsMEJBQTBCO0lBQ25HLHdCQUF3QixFQUFFLHdCQUF3QixFQUFFLGdCQUFnQjtJQUNwRSx1QkFBdUIsRUFBRSx1QkFBdUIsRUFBRSxtQkFBbUIsRUFBRSxlQUFlO0lBQ3RGLG9CQUFvQixFQUFFLGtCQUFrQjtDQUN6QyxDQUFDLENBQUM7QUFFSCxNQUFNLGFBQWEsR0FBRyxDQUFDLEtBQWMsRUFBbUMsRUFBRSxDQUN4RSxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksWUFBWSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsQ0FBQztBQUV2RCwrRkFBK0Y7QUFDL0YsTUFBTSxRQUFRLEdBQUcsQ0FBQyxJQUE0QixFQUE0QixFQUFFLENBQzFFLElBQUksS0FBSyxnQkFBZ0IsQ0FBQyxDQUFDLENBQUMsNkJBQTZCLENBQUMsQ0FBQyxDQUFDLHVCQUF1QixDQUFDO0FBRXRGOzs7OztHQUtHO0FBQ0gsTUFBTSxPQUFPLGlCQUFrQixTQUFRLEtBQUs7SUFDMUIsSUFBSSxDQUF5QjtJQUU3QyxZQUFZLElBQTRCLEVBQUUsV0FBbUI7UUFDM0QsS0FBSyxDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQ25CLElBQUksQ0FBQyxJQUFJLEdBQUcsSUFBSSxDQUFDO0lBQ25CLENBQUM7SUFFRCxtRUFBbUU7SUFDbkUsSUFBVyxJQUFJLEtBQTZCLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQztDQUN2RztBQUVEOzs7Ozs7Ozs7R0FTRztBQUNILE1BQU0sQ0FBQyxNQUFNLG1CQUFtQixHQUFHLENBQUMsS0FBYyxFQUE2QixFQUFFO0lBQy9FLElBQUksS0FBSyxZQUFZLGlCQUFpQjtRQUFFLE9BQU8sRUFBRSxJQUFJLEVBQUUsS0FBSyxDQUFDLElBQUksRUFBRSxXQUFXLEVBQUUsS0FBSyxDQUFDLE9BQU8sRUFBRSxDQUFDO0lBQ2hHLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLEtBQUssS0FBSyxJQUFJLElBQUksQ0FBQyxDQUFDLFdBQVcsSUFBSSxLQUFLLENBQUM7UUFBRSxPQUFPLElBQUksQ0FBQztJQUN4RixNQUFNLElBQUksR0FBWSxLQUFLLENBQUMsU0FBUyxDQUFDO0lBQ3RDLElBQUksT0FBTyxJQUFJLEtBQUssUUFBUSxJQUFJLElBQUksS0FBSyxJQUFJLElBQUksQ0FBQyxDQUFDLFFBQVEsSUFBSSxJQUFJLENBQUM7UUFBRSxPQUFPLElBQUksQ0FBQztJQUNsRixNQUFNLElBQUksR0FBWSxNQUFNLElBQUksSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7SUFDN0QsTUFBTSxXQUFXLEdBQUcsU0FBUyxJQUFJLEtBQUssSUFBSSxPQUFPLEtBQUssQ0FBQyxPQUFPLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7SUFDakcsSUFBSSxJQUFJLENBQUMsTUFBTSxLQUFLLDZCQUE2QixFQUFFLENBQUM7UUFDbEQsT0FBTyxJQUFJLEtBQUssU0FBUyxJQUFJLElBQUksS0FBSyxnQkFBZ0IsQ0FBQyxDQUFDLENBQUMsRUFBRSxJQUFJLEVBQUUsZ0JBQWdCLEVBQUUsV0FBVyxFQUFFLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQztJQUMxRyxDQUFDO0lBQ0QsSUFBSSxJQUFJLENBQUMsTUFBTSxLQUFLLHVCQUF1QixJQUFJLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQztRQUFFLE9BQU8sSUFBSSxDQUFDO0lBQ2pGLE9BQU8sRUFBRSxJQUFJLEVBQUUsV0FBVyxFQUFFLENBQUM7QUFDL0IsQ0FBQyxDQUFDO0FBRUYsdURBQXVEO0FBQ3ZELE1BQU0sQ0FBQyxNQUFNLCtCQUErQixHQUFHLEdBQUcsQ0FBQztBQUVuRDs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sd0JBQXdCLEdBQUcsQ0FBQyxLQUFjLEVBQW1CLEVBQUUsQ0FBQyxPQUFPLEtBQUssS0FBSyxRQUFRO09BQ2pHLEtBQUssQ0FBQyxJQUFJLEVBQUUsS0FBSyxLQUFLLElBQUksS0FBSyxDQUFDLE1BQU0sR0FBRyxDQUFDLElBQUksS0FBSyxDQUFDLE1BQU0sSUFBSSwrQkFBK0I7T0FDN0YsQ0FBQyx1QkFBdUIsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUM7QUE4YTFDLG9IQUFvSCJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aG9yaXR5LWNvbnRyYWN0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvYXV0aG9yaXR5LWNvbnRyYWN0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQXFDQSw2RkFBNkY7QUFDN0YsTUFBTSxDQUFDLE1BQU0sNkJBQTZCLEdBQUcsMkJBQTJCLENBQUM7QUFDekUsTUFBTSxDQUFDLE1BQU0sdUJBQXVCLEdBQUcsb0JBQW9CLENBQUM7QUFpQjVELE1BQU0sWUFBWSxHQUF3QixJQUFJLEdBQUcsQ0FBeUI7SUFDeEUsbUJBQW1CLEVBQUUsV0FBVyxFQUFFLGlCQUFpQixFQUFFLGNBQWM7SUFDbkUsbUJBQW1CLEVBQUUsc0JBQXNCLEVBQUUsMEJBQTBCLEVBQUUsMEJBQTBCO0lBQ25HLHdCQUF3QixFQUFFLHdCQUF3QixFQUFFLGdCQUFnQjtJQUNwRSx1QkFBdUIsRUFBRSx1QkFBdUIsRUFBRSxtQkFBbUIsRUFBRSxlQUFlO0lBQ3RGLG9CQUFvQixFQUFFLGtCQUFrQjtDQUN6QyxDQUFDLENBQUM7QUFFSCxNQUFNLGFBQWEsR0FBRyxDQUFDLEtBQWMsRUFBbUMsRUFBRSxDQUN4RSxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksWUFBWSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsQ0FBQztBQUV2RCwrRkFBK0Y7QUFDL0YsTUFBTSxRQUFRLEdBQUcsQ0FBQyxJQUE0QixFQUE0QixFQUFFLENBQzFFLElBQUksS0FBSyxnQkFBZ0IsQ0FBQyxDQUFDLENBQUMsNkJBQTZCLENBQUMsQ0FBQyxDQUFDLHVCQUF1QixDQUFDO0FBRXRGOzs7OztHQUtHO0FBQ0gsTUFBTSxPQUFPLGlCQUFrQixTQUFRLEtBQUs7SUFDMUIsSUFBSSxDQUF5QjtJQUU3QyxZQUFZLElBQTRCLEVBQUUsV0FBbUI7UUFDM0QsS0FBSyxDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQ25CLElBQUksQ0FBQyxJQUFJLEdBQUcsSUFBSSxDQUFDO0lBQ25CLENBQUM7SUFFRCxtRUFBbUU7SUFDbkUsSUFBVyxJQUFJLEtBQTZCLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQztDQUN2RztBQUVEOzs7Ozs7Ozs7R0FTRztBQUNILE1BQU0sQ0FBQyxNQUFNLG1CQUFtQixHQUFHLENBQUMsS0FBYyxFQUE2QixFQUFFO0lBQy9FLElBQUksS0FBSyxZQUFZLGlCQUFpQjtRQUFFLE9BQU8sRUFBRSxJQUFJLEVBQUUsS0FBSyxDQUFDLElBQUksRUFBRSxXQUFXLEVBQUUsS0FBSyxDQUFDLE9BQU8sRUFBRSxDQUFDO0lBQ2hHLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLEtBQUssS0FBSyxJQUFJLElBQUksQ0FBQyxDQUFDLFdBQVcsSUFBSSxLQUFLLENBQUM7UUFBRSxPQUFPLElBQUksQ0FBQztJQUN4RixNQUFNLElBQUksR0FBWSxLQUFLLENBQUMsU0FBUyxDQUFDO0lBQ3RDLElBQUksT0FBTyxJQUFJLEtBQUssUUFBUSxJQUFJLElBQUksS0FBSyxJQUFJLElBQUksQ0FBQyxDQUFDLFFBQVEsSUFBSSxJQUFJLENBQUM7UUFBRSxPQUFPLElBQUksQ0FBQztJQUNsRixNQUFNLElBQUksR0FBWSxNQUFNLElBQUksSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7SUFDN0QsTUFBTSxXQUFXLEdBQUcsU0FBUyxJQUFJLEtBQUssSUFBSSxPQUFPLEtBQUssQ0FBQyxPQUFPLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7SUFDakcsSUFBSSxJQUFJLENBQUMsTUFBTSxLQUFLLDZCQUE2QixFQUFFLENBQUM7UUFDbEQsT0FBTyxJQUFJLEtBQUssU0FBUyxJQUFJLElBQUksS0FBSyxnQkFBZ0IsQ0FBQyxDQUFDLENBQUMsRUFBRSxJQUFJLEVBQUUsZ0JBQWdCLEVBQUUsV0FBVyxFQUFFLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQztJQUMxRyxDQUFDO0lBQ0QsSUFBSSxJQUFJLENBQUMsTUFBTSxLQUFLLHVCQUF1QixJQUFJLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQztRQUFFLE9BQU8sSUFBSSxDQUFDO0lBQ2pGLE9BQU8sRUFBRSxJQUFJLEVBQUUsV0FBVyxFQUFFLENBQUM7QUFDL0IsQ0FBQyxDQUFDO0FBRUYsdURBQXVEO0FBQ3ZELE1BQU0sQ0FBQyxNQUFNLCtCQUErQixHQUFHLEdBQUcsQ0FBQztBQUVuRDs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sd0JBQXdCLEdBQUcsQ0FBQyxLQUFjLEVBQW1CLEVBQUUsQ0FBQyxPQUFPLEtBQUssS0FBSyxRQUFRO09BQ2pHLEtBQUssQ0FBQyxJQUFJLEVBQUUsS0FBSyxLQUFLLElBQUksS0FBSyxDQUFDLE1BQU0sR0FBRyxDQUFDLElBQUksS0FBSyxDQUFDLE1BQU0sSUFBSSwrQkFBK0I7T0FDN0YsQ0FBQyx1QkFBdUIsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUM7QUFrZTFDLG9IQUFvSCJ9

package/dist_ts/authority-runtime-contract.d.ts

@@ -26,6 +26,35 @@ export interface IReq_AuthSwitchBindAccount extends ITypedRequest {
         capability: string;
     };
 }
+/**
+ * Backend-only release of a binding by the identity its holder bound it under, served on the MANAGEMENT
+ * socket beside `bind`, of which it is the inverse.
+ *
+ * It is how a holder releases a binding it no longer holds the capability for -- one an earlier run of it
+ * left behind -- and it needs no ready login: an account whose sign-in has ended can have its leftover
+ * bindings released, and then be removed, without signing in again first. It is authorized as `bind` is: a
+ * caller trusted with the management socket names a runtime and scope, the namespace a holder binds under
+ * and owns. It releases only the binding at exactly that runtime and scope, and only while it is still the
+ * incarnation and revision the holder read from the snapshot or `getBinding`; any other binding -- another
+ * scope, another runtime, or a successor bound meanwhile -- is left alone and the answer is `inactive`.
+ * A binding's revision names one bind and never repeats for its runtime and scope, so a successor is told
+ * apart even when it was bound under the same incarnation after the one read was released.
+ * The daemon's own managed Codex bindings are never named here. Like the runtime release, it waits for
+ * the access resolutions already admitted for that binding.
+ */
+export interface IReq_AuthSwitchUnbind extends ITypedRequest {
+    method: 'authswitch.authority.unbind';
+    request: {
+        runtime: Exclude<IAuthSwitchBinding['runtime'], 'codex'>;
+        scopeId: string;
+        incarnationId: string;
+        /** The binding's `revision` as the holder read it. */
+        expectedRevision: number;
+    };
+    response: {
+        state: 'released' | 'inactive';
+    };
+}
 /** Backend-only access operation. Refresh grants never cross this interface. */
 export interface IReq_AuthSwitchResolveAccess extends ITypedRequest {
     method: 'authswitch.authority.resolveAccess';

package/dist_ts/classes.authoritybroker.d.ts

@@ -1,9 +1,9 @@
-import * as plugins from './plugins.js';
-import type { IAuthSwitchAccount, IAuthSwitchAccountEvent, IAuthSwitchBinding, IAuthSwitchOperation, IAuthSwitchSnapshot, IReq_AuthSwitchSnapshot } from './authority-contract.js';
+import { AuthSwitchOpenAiProvider } from './classes.openaiprovider.js';
+import type { IAuthSwitchAccount, IAuthSwitchAccountEvent, IAuthSwitchBinding, IAuthSwitchOperation, IAuthSwitchSnapshot, IReq_AuthSwitchSnapshot, TAuthSwitchRevocation } from './authority-contract.js';
 import { AuthSwitchAuthorityDatabase } from './classes.authoritydatabase.js';
 import type { IAuthSwitchUsageContext } from './classes.authorityusage.js';
 import { type IAuthSwitchSecretCodec } from './classes.authoritysecrets.js';
-type TOpenAiProvider = Pick<plugins.flexAccounts.ISmartAiProviderAdapter, 'beginLogin' | 'refreshCredential' | 'inspectCredential' | 'getAccountRateLimits' | 'dispose'>;
+type TOpenAiProvider = Pick<AuthSwitchOpenAiProvider, 'beginLogin' | 'refreshCredential' | 'revokeCredential' | 'inspectCredential' | 'getAccountRateLimits' | 'dispose'>;
 export interface IAuthSwitchAuthorityBrokerOptions {
     provider?: TOpenAiProvider;
     secrets?: IAuthSwitchSecretCodec;
@@ -77,7 +77,23 @@ export declare class AuthSwitchAuthorityBroker {
     waitOperation(operationId: string): Promise<void>;
     cancelOperation(operationId: string): Promise<IAuthSwitchOperation>;
     renameAccount(accountId: string, expectedRevision: number, label: string): Promise<IAuthSwitchAccount>;
-    removeAccount(accountId: string, expectedRevision: number): Promise<IAuthSwitchAccount>;
+    /**
+     * Removes an account. Only `revoke: true` reaches the network: it revokes the ChatGPT sign-in the removal
+     * discarded, after the removal committed.
+     */
+    removeAccount(accountId: string, expectedRevision: number, options: {
+        revoke: boolean;
+    }): Promise<{
+        account: IAuthSwitchAccount;
+        revoked: TAuthSwitchRevocation;
+    }>;
+    /**
+     * Revokes the ChatGPT sign-ins a removal discarded, as Codex revokes its own when it logs out, so that sign-in
+     * stops working at the service too. Like Codex's, it is best effort: the account is already removed, and the
+     * log says when the service did not confirm the revocation. All of them share `revocationBudgetMs`: each is
+     * given what remains of it, and one the budget no longer reaches is not sent and counts as not confirmed.
+     */
+    private revokeRetired;
     bindAccount(input: {
         accountId: string;
         loginId: string;
@@ -92,6 +108,22 @@ export declare class AuthSwitchAuthorityBroker {
     getBinding(bindingId: string): Promise<IAuthSwitchBinding | null>;
     revokeBinding(bindingId: string, capability: string): Promise<boolean>;
     releaseExternalBinding(bindingId: string, capability: string): Promise<'released' | 'inactive'>;
+    /** Releases a caller-held binding while it still carries exactly this capability, named by its hash. */
+    releaseExternalCapability(bindingId: string, capabilityHash: string): Promise<'released' | 'inactive'>;
+    /**
+     * The caller-held binding a holder names by the identity it bound under, while it is still exactly the
+     * incarnation and revision the holder read, or `null`. Its capability hash is what a release then fences
+     * and compares, so a successor bound after this read is never released in its place.
+     */
+    findHeldBinding(input: {
+        runtime: Exclude<IAuthSwitchBinding['runtime'], 'codex'>;
+        scopeId: string;
+        incarnationId: string;
+        expectedRevision: number;
+    }): Promise<{
+        bindingId: string;
+        capabilityHash: string;
+    } | null>;
     resolveAccess(bindingId: string, capability: string, minValidityMs: number, rejectedGrantGeneration?: number): Promise<IAuthSwitchResolvedAccess>;
     /** Backend-only access for usage; it never creates or bypasses a runtime binding. */
     resolveUsageAccess(context: IAuthSwitchUsageContext, rejectedGrantGeneration: number | undefined, minValidityMs: number): Promise<IAuthSwitchResolvedAccess>;