@modelprofile.com/authswitch 9.1.0 → 10.0.0

package/ts/authority-runtime-contract.ts

@@ -25,6 +25,36 @@ export interface IReq_AuthSwitchBindAccount extends ITypedRequest {
   response: { binding: IAuthSwitchBinding; capability: string };
 }
 
+/**
+ * Backend-only release of a binding by the identity its holder bound it under, served on the MANAGEMENT
+ * socket beside `bind`, of which it is the inverse.
+ *
+ * It is how a holder releases a binding it no longer holds the capability for -- one an earlier run of it
+ * left behind -- and it needs no ready login: an account whose sign-in has ended can have its leftover
+ * bindings released, and then be removed, without signing in again first. It is authorized as `bind` is: a
+ * caller trusted with the management socket names a runtime and scope, the namespace a holder binds under
+ * and owns. It releases only the binding at exactly that runtime and scope, and only while it is still the
+ * incarnation and revision the holder read from the snapshot or `getBinding`; any other binding -- another
+ * scope, another runtime, or a successor bound meanwhile -- is left alone and the answer is `inactive`.
+ * A binding's revision names one bind and never repeats for its runtime and scope, so a successor is told
+ * apart even when it was bound under the same incarnation after the one read was released.
+ * The daemon's own managed Codex bindings are never named here. Like the runtime release, it waits for
+ * the access resolutions already admitted for that binding.
+ */
+export interface IReq_AuthSwitchUnbind extends ITypedRequest {
+  method: 'authswitch.authority.unbind';
+  request: {
+    runtime: Exclude<IAuthSwitchBinding['runtime'], 'codex'>;
+    scopeId: string;
+    incarnationId: string;
+    /** The binding's `revision` as the holder read it. */
+    expectedRevision: number;
+  };
+  response: {
+    state: 'released' | 'inactive';
+  };
+}
+
 /** Backend-only access operation. Refresh grants never cross this interface. */
 export interface IReq_AuthSwitchResolveAccess extends ITypedRequest {
   method: 'authswitch.authority.resolveAccess';

package/ts/classes.authoritybroker.ts

@@ -1,7 +1,10 @@
 import * as plugins from './plugins.js';
+import { AuthSwitchOpenAiProvider } from './classes.openaiprovider.js';
+import { parseOpenAiTokenClaims } from './openaiauth.js';
+import type { IOpenAiLoginHandle, IOpenAiOAuthCredential } from './interfaces.openai.js';
 import type { IAuthSwitchAccount, IAuthSwitchAccountEvent, IAuthSwitchBinding, IAuthSwitchLogin,
   IAuthSwitchNativeAssignment, IAuthSwitchOperation, IAuthSwitchSnapshot, IReq_AuthSwitchSnapshot,
-  TAuthSwitchLoginOwnerTool } from './authority-contract.js';
+  TAuthSwitchLoginOwnerTool, TAuthSwitchRevocation } from './authority-contract.js';
 import { AuthSwitchRefusal, isAuthSwitchAccountLabel } from './authority-contract.js';
 import { AuthSwitchAuthorityDatabase } from './classes.authoritydatabase.js';
 import type { IStoredAuthorityAccount, IStoredAuthorityBinding, IStoredAuthorityClaudeHome, IStoredAuthorityGrant,
@@ -9,9 +12,9 @@ import type { IStoredAuthorityAccount, IStoredAuthorityBinding, IStoredAuthority
 import type { IAuthSwitchUsageContext } from './classes.authorityusage.js';
 import { AuthSwitchTpmSecretCodec, type IAuthSwitchSecretCodec } from './classes.authoritysecrets.js';
 
-type TOpenAiCredential = plugins.flexAccounts.IOpenAiChatGptOAuthCredential;
-type TOpenAiProvider = Pick<plugins.flexAccounts.ISmartAiProviderAdapter,
-  'beginLogin' | 'refreshCredential' | 'inspectCredential' | 'getAccountRateLimits' | 'dispose'>;
+type TOpenAiCredential = IOpenAiOAuthCredential;
+type TOpenAiProvider = Pick<AuthSwitchOpenAiProvider,
+  'beginLogin' | 'refreshCredential' | 'revokeCredential' | 'inspectCredential' | 'getAccountRateLimits' | 'dispose'>;
 
 export interface IAuthSwitchAuthorityBrokerOptions {
   provider?: TOpenAiProvider;
@@ -46,9 +49,15 @@ const safeScope = (value: unknown, maximum: number): value is string => typeof v
   && value.length > 0 && value.length <= maximum && !/[\u0000-\u001f\u007f]/.test(value);
 const validRevision = (value: unknown): value is number => Number.isSafeInteger(value) && Number(value) >= 0;
 const tokenExpiry = (credential: TOpenAiCredential): string | null => {
-  try { return plugins.flexAuth.parseOpenAiChatGptTokenInfo(credential.accessToken).expiresAt ?? null; }
+  try { return parseOpenAiTokenClaims(credential.accessToken).expiresAt ?? null; }
   catch { return null; }
 };
+/**
+ * How long a removal's revocations may take in all. The daemon answers a removal once they settle, so the budget
+ * keeps a revoking removal inside the 35 seconds `AuthSwitchClient` allows any request, leaving the rest to the
+ * drain and the removal itself; a sign-in OpenAI has not confirmed revoking by then reports `failed`.
+ */
+const revocationBudgetMs = 10_000;
 const openAiGrantId = (accountId: string): string => idHash('authswitch-grant-v1', accountId, 'openai_managed', 'chatgpt');
 
 /**
@@ -144,7 +153,7 @@ const publicClaudeAssignment = (home: IStoredAuthorityClaudeHome): IAuthSwitchNa
 
 interface IManagedOperation {
   id: string;
-  handle: plugins.flexAccounts.ISmartAiProviderLoginHandle;
+  handle: IOpenAiLoginHandle;
   task: Promise<void>;
 }
 
@@ -172,7 +181,7 @@ export class AuthSwitchAuthorityBroker {
   private closing?: Promise<void>;
 
   constructor(private readonly database: AuthSwitchAuthorityDatabase, options: IAuthSwitchAuthorityBrokerOptions = {}) {
-    this.provider = options.provider ?? new plugins.flexAccounts.OpenAiProviderAdapter();
+    this.provider = options.provider ?? new AuthSwitchOpenAiProvider();
     this.secrets = options.secrets ?? new AuthSwitchTpmSecretCodec();
     this.now = options.now ?? Date.now;
     this.proactive = options.proactive ?? true;
@@ -344,7 +353,7 @@ export class AuthSwitchAuthorityBroker {
   }
 
   private identity(credential: TOpenAiCredential): { id: string; subject: string; workspaceId: string; email: string | null; plan: string | null } {
-    const token = plugins.flexAuth.parseOpenAiChatGptTokenInfo(credential.idToken);
+    const token = parseOpenAiTokenClaims(credential.idToken);
     const subject = token.chatgptUserId;
     const workspaceId = token.chatgptAccountId;
     if (!subject || !workspaceId) throw new Error('OpenAI login omitted a stable user or account identity.');
@@ -453,7 +462,7 @@ export class AuthSwitchAuthorityBroker {
       if (terminal.state === 'cancelled') return publicOperation(terminal);
       throw error;
     }
-    let handle: plugins.flexAccounts.ISmartAiProviderLoginHandle;
+    let handle: IOpenAiLoginHandle;
     try {
       handle = await this.provider.beginLogin({ flow: 'device' });
     } catch {
@@ -660,13 +669,43 @@ export class AuthSwitchAuthorityBroker {
     return publicAccount(updated.account);
   }
 
-  public async removeAccount(accountId: string, expectedRevision: number): Promise<IAuthSwitchAccount> {
+  /**
+   * Removes an account. Only `revoke: true` reaches the network: it revokes the ChatGPT sign-in the removal
+   * discarded, after the removal committed.
+   */
+  public async removeAccount(accountId: string, expectedRevision: number,
+    options: { revoke: boolean }): Promise<{ account: IAuthSwitchAccount; revoked: TAuthSwitchRevocation }> {
     if (!isId(accountId) || !validRevision(expectedRevision)) throw new Error('Invalid account change.');
     const updateId = plugins.crypto.randomUUID();
-    const account = await this.database.removeAccountAndGrants(updateId, accountId,
+    const { account, retired } = await this.database.removeAccountAndGrants(updateId, accountId,
       expectedRevision, new Date(this.now()).toISOString());
     this.publish();
-    return publicAccount(account);
+    const revoked = options.revoke ? await this.revokeRetired(account, retired) : 'not_requested';
+    return { account: publicAccount(account), revoked };
+  }
+
+  /**
+   * Revokes the ChatGPT sign-ins a removal discarded, as Codex revokes its own when it logs out, so that sign-in
+   * stops working at the service too. Like Codex's, it is best effort: the account is already removed, and the
+   * log says when the service did not confirm the revocation. All of them share `revocationBudgetMs`: each is
+   * given what remains of it, and one the budget no longer reaches is not sent and counts as not confirmed.
+   */
+  private async revokeRetired(account: IStoredAuthorityAccount,
+    retired: IStoredAuthorityGrant[]): Promise<Exclude<TAuthSwitchRevocation, 'not_requested'>> {
+    if (retired.length === 0) return 'not_applicable';
+    const deadline = this.now() + revocationBudgetMs;
+    let revoked: 'yes' | 'failed' = 'yes';
+    for (const grant of retired) {
+      const remainingMs = Math.floor(deadline - this.now());
+      const confirmed = remainingMs > 0 && await this.unsealCredential(account, grant)
+        .then(credential => this.provider.revokeCredential(credential, { timeoutMs: remainingMs }))
+        .then(() => true, () => false);
+      if (!confirmed) {
+        revoked = 'failed';
+        process.stderr.write('Authswitch removed an account, but OpenAI did not confirm revoking its sign-in.\n');
+      }
+    }
+    return revoked;
   }
 
   public async bindAccount(input: { accountId: string; loginId: string; purpose: 'openai_managed';
@@ -678,7 +717,7 @@ export class AuthSwitchAuthorityBroker {
     const capability = plugins.crypto.randomBytes(32).toString('base64url');
     const capabilityHash = idHash(capability);
     const updateId = plugins.crypto.randomUUID();
-    const updated = await this.database.changeBinding(updateId, id, input.accountId, input.loginId, (existing, account, grant) => {
+    const updated = await this.database.changeBinding(updateId, id, input.accountId, input.loginId, (_existing, account, grant, revision) => {
       // A ChatGPT login backs every runtime, Claude Code included; a Claude account reaches Claude Code
       // through its native switch instead, so it never binds (its provider is not OpenAI).
       if (account.removed || grant?.state !== 'ready' || grant.id !== account.primaryGrantId
@@ -687,7 +726,7 @@ export class AuthSwitchAuthorityBroker {
         throw new AuthSwitchRefusal('login_unavailable', loginNotBindable);
       }
       return { id, accountId: input.accountId, grantId: grant.id, runtime: input.runtime, scopeId: input.scopeId,
-        incarnationId: input.incarnationId, revision: (existing?.revision ?? 0) + 1,
+        incarnationId: input.incarnationId, revision,
         grantAuthorizationGeneration: grant.authorizationGeneration, capabilityHash, updateId };
     });
     this.publish();
@@ -709,13 +748,37 @@ export class AuthSwitchAuthorityBroker {
   }
 
   public async releaseExternalBinding(bindingId: string, capability: string): Promise<'released' | 'inactive'> {
-    if (!isId(bindingId) || !/^[A-Za-z0-9_-]{43}$/.test(capability)) throw new Error('Invalid runtime binding release.');
+    if (!/^[A-Za-z0-9_-]{43}$/.test(capability)) throw new Error('Invalid runtime binding release.');
+    return this.releaseExternalCapability(bindingId, authSwitchBindingCapabilityHash(capability));
+  }
+
+  /** Releases a caller-held binding while it still carries exactly this capability, named by its hash. */
+  public async releaseExternalCapability(bindingId: string, capabilityHash: string): Promise<'released' | 'inactive'> {
+    if (!isId(bindingId) || !isId(capabilityHash)) throw new Error('Invalid runtime binding release.');
     const released = await this.database.releaseExternalBinding(plugins.crypto.randomUUID(), bindingId,
-      authSwitchBindingCapabilityHash(capability));
+      capabilityHash);
     if (released) this.publish();
     return released ? 'released' : 'inactive';
   }
 
+  /**
+   * The caller-held binding a holder names by the identity it bound under, while it is still exactly the
+   * incarnation and revision the holder read, or `null`. Its capability hash is what a release then fences
+   * and compares, so a successor bound after this read is never released in its place.
+   */
+  public async findHeldBinding(input: { runtime: Exclude<IAuthSwitchBinding['runtime'], 'codex'>; scopeId: string;
+    incarnationId: string; expectedRevision: number }): Promise<{ bindingId: string; capabilityHash: string } | null> {
+    if (!['flex', 'opencode', 'claude'].includes(input.runtime) || !safeScope(input.scopeId, 512)
+      || !safeScope(input.incarnationId, 256) || !validRevision(input.expectedRevision)) {
+      throw new Error('Invalid runtime binding release.');
+    }
+    const bindingId = idHash('authswitch-binding-v1', input.runtime, input.scopeId);
+    const binding = await this.database.readBinding(bindingId);
+    if (!binding || binding.runtime !== input.runtime || binding.scopeId !== input.scopeId
+      || binding.incarnationId !== input.incarnationId || binding.revision !== input.expectedRevision) return null;
+    return { bindingId, capabilityHash: binding.capabilityHash };
+  }
+
   public async resolveAccess(bindingId: string, capability: string, minValidityMs: number,
     rejectedGrantGeneration?: number): Promise<IAuthSwitchResolvedAccess> {
     if (!isId(bindingId) || !/^[A-Za-z0-9_-]{43}$/.test(capability)
@@ -811,7 +874,7 @@ export class AuthSwitchAuthorityBroker {
       }
       if (!grant.accessExpiresAt) throw new AuthSwitchRefusal('access_not_fresh', accessNotFresh);
       const credential = await this.unsealCredential(account, grant);
-      const info = plugins.flexAuth.parseOpenAiChatGptTokenInfo(credential.accessToken);
+      const info = parseOpenAiTokenClaims(credential.accessToken);
       if (info.chatgptAccountId !== account.workspaceId || info.chatgptUserId !== account.subject) {
         throw new Error('Account access identity changed.');
       }

package/ts/classes.authoritycli.ts

@@ -1,11 +1,12 @@
 import type { IAuthSwitchDoctorPage, IAuthSwitchOperation, IAuthSwitchPreuseOperation,
-  IAuthSwitchSnapshot, IReq_AuthSwitchDoctor, IReq_AuthSwitchStartPreuse } from './authority-contract.js';
+  IAuthSwitchSnapshot, IReq_AuthSwitchDoctor, IReq_AuthSwitchRemoveAccount,
+  IReq_AuthSwitchStartPreuse } from './authority-contract.js';
 import { isAuthSwitchImportRefusal } from './authority-import-contract.js';
 import type { IAuthSwitchImportInventory, IAuthSwitchImportResult, IAuthSwitchImportStatus,
   IReq_AuthSwitchImportStatus, TAuthSwitchImportAction } from './authority-import-contract.js';
 import { AuthSwitchClient } from './classes.authorityclient.js';
 import { resolveAuthSwitchAuthorityPaths } from './classes.authorityservice.js';
-import { defaultPreusePrompt, validatePreuseOptions } from './preuse.js';
+import { defaultPreusePrompt, describePreuseFailure, describePreuseLimit, validatePreuseOptions } from './preuse.js';
 import { plainText } from './formatting.js';
 import * as plugins from './plugins.js';
 
@@ -23,6 +24,8 @@ export interface IAuthSwitchAuthorityCliClient {
   startPreuse(input: IReq_AuthSwitchStartPreuse['request']): Promise<IAuthSwitchPreuseOperation>;
   getPreuse(operationId: string): Promise<IAuthSwitchPreuseOperation>;
   cancelPreuse(operationId: string): Promise<IAuthSwitchPreuseOperation>;
+  removeAccount(accountId: string, expectedRevision: number,
+    options: { revoke: boolean }): Promise<IReq_AuthSwitchRemoveAccount['response']>;
   close(reason?: Error): void;
 }
 
@@ -44,6 +47,7 @@ type TAuthorityCliCommand =
   | { kind: 'importSubmit'; sourceId: string; sourceDigest: string; json: boolean }
   | { kind: 'add'; json: boolean }
   | { kind: 'reauth'; accountId: string; loginId: string; json: boolean }
+  | { kind: 'remove'; accountId: string; revoke: boolean; json: boolean }
   | { kind: 'get'; operationId: string; json: boolean }
   | { kind: 'cancel'; operationId: string; json: boolean }
   | { kind: 'resume'; operationId: string; json: boolean }
@@ -60,7 +64,7 @@ class AuthorityCliFailure extends Error {
   }
 }
 
-const usage = 'Usage: authswitch account list [--json] | authswitch account add openai [--json] | authswitch account reauth <account-id> <login-id> [--json] | authswitch account operation get|cancel|resume <operation-id> [--json] | authswitch account preuse <account-id> <login-id>|--all [--prompt <text>] [--model <id>] [--json] | authswitch account preuse operation get|cancel|resume <operation-id> [--json] | authswitch authority doctor [--json] | authswitch authority import inventory [--json] | authswitch authority import status [--json] | authswitch authority import submit <source-id> --digest <source-digest> [--json]';
+const usage = 'Usage: authswitch account list [--json] | authswitch account add openai [--json] | authswitch account reauth <account-id> <login-id> [--json] | authswitch account remove <account-id> [--revoke] [--json] | authswitch account operation get|cancel|resume <operation-id> [--json] | authswitch account preuse <account-id> <login-id>|--all [--prompt <text>] [--model <id>] [--json] | authswitch account preuse operation get|cancel|resume <operation-id> [--json] | authswitch authority doctor [--json] | authswitch authority import inventory [--json] | authswitch authority import status [--json] | authswitch authority import submit <source-id> --digest <source-digest> [--json]';
 const safe = (value: string | number | null): string => plainText(value === null ? 'none' : String(value));
 const isId = (value: string | undefined): value is string => Boolean(value && !value.startsWith('-'));
 const isHash = (value: string | undefined): value is string =>
@@ -143,6 +147,14 @@ const parse = (argv: readonly string[]): TAuthorityCliCommand | null => {
     && (argv.length === 4 || (argv.length === 5 && argv[4] === '--json'))) {
     return { kind: 'reauth', accountId: argv[2], loginId: argv[3], json: argv[4] === '--json' };
   }
+  if (argv[0] === 'account' && argv[1] === 'remove' && isId(argv[2])) {
+    const options = argv.slice(3);
+    const revoke = options.includes('--revoke');
+    const json = options.includes('--json');
+    if (options.length !== Number(revoke) + Number(json)
+      || options.some(option => option !== '--revoke' && option !== '--json')) return null;
+    return { kind: 'remove', accountId: argv[2], revoke, json };
+  }
   if (argv[0] === 'account' && argv[1] === 'operation'
     && (argv[2] === 'get' || argv[2] === 'cancel' || argv[2] === 'resume') && isId(argv[3])
     && (argv.length === 4 || (argv.length === 5 && argv[4] === '--json'))) {
@@ -210,11 +222,27 @@ class ScopedAuthorityCliClient implements IAuthSwitchAuthorityCliClient {
     return this.client.cancelPreuse(operationId, this.controller.signal);
   }
 
+  public removeAccount(accountId: string, expectedRevision: number,
+    options: { revoke: boolean }): Promise<IReq_AuthSwitchRemoveAccount['response']> {
+    return this.client.removeAccount(accountId, expectedRevision, { ...options, signal: this.controller.signal });
+  }
+
   public close(reason = new Error('Authswitch authority CLI closed.')): void {
     if (!this.controller.signal.aborted) this.controller.abort(reason);
   }
 }
 
+const revocationLines: Record<IReq_AuthSwitchRemoveAccount['response']['revoked'], string> = {
+  not_requested: 'Its ChatGPT sign-in was not revoked at OpenAI (no --revoke).',
+  yes: 'OpenAI confirmed revoking its ChatGPT sign-in.',
+  failed: 'OpenAI did not confirm revoking its ChatGPT sign-in; it may still be valid there.',
+  not_applicable: 'The authority held no ChatGPT sign-in of its own for it, so nothing was revoked.',
+};
+
+const renderRemoval = (removal: IReq_AuthSwitchRemoveAccount['response']): string =>
+  `Removed account ${safe(removal.account.email ?? removal.account.label)} (${safe(removal.account.id)}).\n`
+  + `${revocationLines[removal.revoked]}\n`;
+
 const renderList = (snapshot: IAuthSwitchSnapshot): string => {
   const lines = [`Authority accounts — generated ${safe(snapshot.generatedAt)}, revision ${snapshot.revision}`];
   if (snapshot.accounts.length === 0) lines.push('No authority accounts are registered.');
@@ -332,7 +360,8 @@ const resumeCommand = (operationId: string, json: boolean): string =>
   `authswitch account operation resume ${safe(operationId)}${json ? ' --json' : ''}`;
 
 const terminalPreuseOperation = (operation: IAuthSwitchPreuseOperation): boolean =>
-  operation.state === 'complete' || operation.state === 'not_sent' || operation.state === 'outcome_unknown';
+  operation.state === 'complete' || operation.state === 'not_sent' || operation.state === 'refused'
+  || operation.state === 'outcome_unknown';
 
 const preuseResumeCommand = (operationId: string, json: boolean): string =>
   `authswitch account preuse operation resume ${safe(operationId)}${json ? ' --json' : ''}`;
@@ -346,9 +375,9 @@ const renderOperation = (operation: IAuthSwitchOperation, json: boolean): string
   if (operation.targetAccountId || operation.targetLoginId) {
     lines.push(`  target account=${safe(operation.targetAccountId)}; login=${safe(operation.targetLoginId)}`);
   }
-  if (operation.prompt?.flow === 'device') {
+  if (operation.prompt) {
     lines.push(`  Open ${safe(operation.prompt.verificationUrl)}`, `  Code: ${safe(operation.prompt.userCode)}`);
-  } else if (operation.prompt?.flow === 'browser') lines.push(`  Open ${safe(operation.prompt.authUrl)}`);
+  }
   if (operation.result) {
     lines.push(`  completed account=${safe(operation.result.accountId)}; login=${safe(operation.result.loginId)}; account revision=${operation.result.accountRevision}; login generation=${operation.result.loginGeneration}`);
   }
@@ -368,6 +397,8 @@ const renderPreuseOperation = (operation: IAuthSwitchPreuseOperation, json: bool
   if (operation.result) {
     lines.push(`  tokens input=${safe(operation.result.inputTokens)}; output=${safe(operation.result.outputTokens)}; total=${safe(operation.result.totalTokens)}`);
   }
+  if (operation.limit) lines.push(`  ${safe(describePreuseLimit(operation.limit, Date.now()))}`);
+  if (operation.failure) lines.push(`  Cause: ${safe(describePreuseFailure(operation.failure))}`);
   if (!terminalPreuseOperation(operation)) {
     lines.push(`  Resume: ${preuseResumeCommand(operation.id, false)}`);
   }
@@ -721,6 +752,17 @@ export const runAuthSwitchAuthorityCli = async (argv: readonly string[],
       await writeOutput(command.json ? JSON.stringify(result) + '\n' : renderImportResult(result));
       return result.status === 'complete' ? 0 : 1;
     }
+    if (command.kind === 'remove') {
+      const account = (await activeClient.snapshotAll()).accounts.find(item => item.id === command.accountId);
+      if (!account) {
+        await writeDiagnostic('No authority account has this id. Run `authswitch account list` for the ids.\n');
+        return 1;
+      }
+      const removed = await activeClient.removeAccount(account.id, account.revision, { revoke: command.revoke });
+      if (removed.account.id !== account.id || !removed.account.removed) throw new AuthorityCliFailure('response');
+      await writeOutput(command.json ? JSON.stringify(removed) + '\n' : renderRemoval(removed));
+      return removed.revoked === 'failed' ? 1 : 0;
+    }
     if (command.kind === 'preuseGet' || command.kind === 'preuseCancel') {
       const operation = validatePreuseOperation(command.kind === 'preuseGet'
         ? await activeClient.getPreuse(command.operationId)

package/ts/classes.authorityclient.ts

@@ -11,30 +11,37 @@ import type {
   IReq_AuthSwitchStartPreuse, IReq_AuthSwitchUsage,
 } from './authority-contract.js';
 import type { IReq_AuthSwitchBindAccount, IReq_AuthSwitchReleaseBinding,
-  IReq_AuthSwitchResolveAccess } from './authority-runtime-contract.js';
+  IReq_AuthSwitchResolveAccess, IReq_AuthSwitchUnbind } from './authority-runtime-contract.js';
 import type { IReq_AuthSwitchImportInventory, IReq_AuthSwitchImportStatus,
   IReq_AuthSwitchImportSubmit } from './authority-import-contract.js';
 import { AuthSwitchAuthorityFrameReader, authSwitchAuthorityFrameBytes,
   maxAuthSwitchAuthorityFrameBytes } from './classes.authorityframing.js';
 
+/**
+ * One request on one connection, bounded by its own deadline alone.
+ *
+ * `TypedRequest.fire` turns each request's `timeoutMs` into the abort of `signal`, so the transport arms no
+ * timer of its own: an idle limit here would end a request that was allowed longer -- an import submit is
+ * allowed 120 s -- before its deadline. Every authority request carries one; a request without it is refused.
+ */
 const post = (path: string, payload: ITypedRequest, signal?: AbortSignal): Promise<ITypedRequest> => {
     return new Promise((resolve, reject) => {
-      if (signal?.aborted) { reject(signal.reason); return; }
+      if (!signal) { reject(new Error('Authswitch daemon requests need a deadline.')); return; }
+      if (signal.aborted) { reject(signal.reason); return; }
       const socket = plugins.net.createConnection(path);
       let settled = false;
       const frame = new AuthSwitchAuthorityFrameReader();
       const finish = (error?: unknown, response?: ITypedRequest): void => {
         if (settled) return;
         settled = true;
-        signal?.removeEventListener('abort', abort);
+        signal.removeEventListener('abort', abort);
         socket.destroy();
         if (error) reject(error);
         else if (response) resolve(response);
         else reject(new Error('Authswitch daemon returned no response.'));
       };
-      const abort = () => finish(signal?.reason ?? new Error('Account request was cancelled.'));
-      signal?.addEventListener('abort', abort, { once: true });
-      socket.setTimeout(35_000, () => finish(new Error('Authswitch daemon request timed out.')));
+      const abort = () => finish(signal.reason ?? new Error('Account request was cancelled.'));
+      signal.addEventListener('abort', abort, { once: true });
       socket.on('connect', () => {
         const raw = JSON.stringify(payload);
         if (authSwitchAuthorityFrameBytes(raw) > maxAuthSwitchAuthorityFrameBytes) { finish(new Error('Account request is too large.')); return; }
@@ -380,10 +387,18 @@ export class AuthSwitchClient {
     return (await this.request<IReq_AuthSwitchRenameAccount>('authswitch.authority.rename',
       { accountId, expectedRevision, label }, 35_000, false, signal)).account;
   }
+  /**
+   * Removes an account; `revoke: true` also revokes its ChatGPT sign-in at OpenAI (see
+   * `IReq_AuthSwitchRemoveAccount`). An older daemon refuses `revoke` as an invalid request before it changes
+   * anything, and answers a plain removal without `revoked`, which then is `not_requested`: it never revokes.
+   */
   public async removeAccount(accountId: string, expectedRevision: number,
-    signal?: AbortSignal): Promise<IReq_AuthSwitchRemoveAccount['response']['account']> {
-    return (await this.request<IReq_AuthSwitchRemoveAccount>('authswitch.authority.remove',
-      { accountId, expectedRevision }, 35_000, false, signal)).account;
+    options: { revoke?: boolean; signal?: AbortSignal } = {}): Promise<IReq_AuthSwitchRemoveAccount['response']> {
+    const response: Partial<IReq_AuthSwitchRemoveAccount['response']> =
+      await this.request<IReq_AuthSwitchRemoveAccount>('authswitch.authority.remove',
+        { accountId, expectedRevision, ...(options.revoke ? { revoke: true as const } : {}) }, 35_000, false,
+        options.signal);
+    return { account: response.account!, revoked: response.revoked ?? 'not_requested' };
   }
   public async switchClaudeNative(accountId: string, loginId: string,
     signal?: AbortSignal): Promise<IReq_AuthSwitchSwitchClaudeNative['response']['handoff']> {
@@ -409,6 +424,14 @@ export class AuthSwitchClient {
     signal?: AbortSignal): Promise<IReq_AuthSwitchBindAccount['response']> {
     return this.request<IReq_AuthSwitchBindAccount>('authswitch.authority.bind', input, 35_000, false, signal);
   }
+  /**
+   * Releases the holder's own binding by the runtime, scope, incarnation and revision it was bound under,
+   * without its capability and without a ready login; `inactive` when no binding matches all four.
+   */
+  public unbind(input: IReq_AuthSwitchUnbind['request'],
+    signal?: AbortSignal): Promise<IReq_AuthSwitchUnbind['response']> {
+    return this.request<IReq_AuthSwitchUnbind>('authswitch.authority.unbind', input, 35_000, false, signal);
+  }
   public resolveAccess(input: IReq_AuthSwitchResolveAccess['request'],
     signal?: AbortSignal): Promise<IReq_AuthSwitchResolveAccess['response']> {
     return this.request<IReq_AuthSwitchResolveAccess>('authswitch.authority.resolveAccess',

package/ts/classes.authoritydaemon.ts

@@ -1,5 +1,6 @@
 import type { ITypedRequest } from '@api.global/typedrequest-interfaces';
 import * as plugins from './plugins.js';
+import { AuthSwitchOpenAiProvider } from './classes.openaiprovider.js';
 import type {
   IAuthSwitchDoctorPage, IReq_AuthSwitchDoctor,
   IReq_AuthSwitchBeginAdd, IReq_AuthSwitchBeginReauth, IReq_AuthSwitchCancelOperation,
@@ -10,7 +11,7 @@ import type {
   IReq_AuthSwitchCancelPreuse, IReq_AuthSwitchGetPreuse, IReq_AuthSwitchStartPreuse, IReq_AuthSwitchUsage,
 } from './authority-contract.js';
 import type { IReq_AuthSwitchBindAccount, IReq_AuthSwitchReleaseBinding,
-  IReq_AuthSwitchResolveAccess } from './authority-runtime-contract.js';
+  IReq_AuthSwitchResolveAccess, IReq_AuthSwitchUnbind } from './authority-runtime-contract.js';
 import { AuthSwitchRefusal } from './authority-contract.js';
 import type { IReq_AuthSwitchImportInventory, IReq_AuthSwitchImportStatus, IReq_AuthSwitchImportSubmit,
   TAuthSwitchImportSubmission } from './authority-import-contract.js';
@@ -40,6 +41,11 @@ export interface IAuthSwitchAuthorityDaemonOptions extends IAuthSwitchAuthorityD
   claudeNative?: IClaudeNativeAuthorityOptions;
   /** Where the one-time import reads the legacy stores, or `'none'`. Never derived from this host here. */
   legacyImport: TAuthSwitchAuthorityLegacyImport;
+  /**
+   * How long an accepted connection has to deliver its complete request, counted from its acceptance and
+   * never extended by the bytes it sends: 35 s unless stated.
+   */
+  requestDeliveryMs?: number;
 }
 
 /**
@@ -139,14 +145,19 @@ export class AuthSwitchAuthorityDaemon {
   private closing = false;
   /** Every admitted request until its answer is written; shutdown settles these before it closes the store. */
   private readonly inFlight = new Set<Promise<void>>();
+  private readonly requestDeliveryMs: number;
 
   constructor(private readonly options: IAuthSwitchAuthorityDaemonOptions) {
     // First, before anything is constructed: a daemon that was going to read the wrong host's credentials
     // must not come into existence at all. The type states it and this states it again, because a caller
     // without types is exactly the caller that would have defaulted here.
     assertStatedLegacyImport(options.legacyImport);
+    this.requestDeliveryMs = options.requestDeliveryMs ?? 35_000;
+    if (!Number.isSafeInteger(this.requestDeliveryMs) || this.requestDeliveryMs <= 0) {
+      throw new Error('Authswitch authority requestDeliveryMs must be a positive whole number of milliseconds.');
+    }
     this.database = new AuthSwitchAuthorityDatabase(options);
-    const provider = options.broker?.provider ?? new plugins.flexAccounts.OpenAiProviderAdapter();
+    const provider = options.broker?.provider ?? new AuthSwitchOpenAiProvider();
     this.broker = new AuthSwitchAuthorityBroker(this.database, { ...options.broker, provider });
     this.usage = new AuthSwitchAuthorityUsage({
       ...options.usage,
@@ -185,8 +196,9 @@ export class AuthSwitchAuthorityDaemon {
     this.register();
   }
 
-  private runtimeBindingKey(bindingId: string, capability: string): string {
-    return `${bindingId}:${authSwitchBindingCapabilityHash(capability)}`;
+  /** One exact capability of one binding: what a release fences and what an access resolution holds open. */
+  private runtimeBindingKey(bindingId: string, capabilityHash: string): string {
+    return `${bindingId}:${capabilityHash}`;
   }
 
   private beginRuntimeBindingAccess(key: string): () => void {
@@ -213,8 +225,8 @@ export class AuthSwitchAuthorityDaemon {
   }
 
   private releaseRuntimeBinding(bindingId: string,
-    capability: string): Promise<IReq_AuthSwitchReleaseBinding['response']> {
-    const key = this.runtimeBindingKey(bindingId, capability);
+    capabilityHash: string): Promise<IReq_AuthSwitchReleaseBinding['response']> {
+    const key = this.runtimeBindingKey(bindingId, capabilityHash);
     const existing = this.runtimeBindingReleases.get(key);
     if (existing) return existing;
     // Capabilities are freshly random for every bind, including a successor that reuses the
@@ -222,7 +234,7 @@ export class AuthSwitchAuthorityDaemon {
     this.runtimeBindingReleaseFences.add(key);
     const task = (async (): Promise<IReq_AuthSwitchReleaseBinding['response']> => {
       await this.waitForRuntimeBindingAccess(key);
-      const state = await this.broker.releaseExternalBinding(bindingId, capability);
+      const state = await this.broker.releaseExternalCapability(bindingId, capabilityHash);
       this.runtimeBindingReleaseFences.delete(key);
       return { state };
     })();
@@ -463,15 +475,17 @@ export class AuthSwitchAuthorityDaemon {
       }));
     this.managementRouter.addTypedHandler(this.handler<IReq_AuthSwitchRemoveAccount>(
       'authswitch.authority.remove', async request => {
-        if (!hasKeys(request, ['accountId', 'expectedRevision']) || typeof request.accountId !== 'string'
-          || typeof request.expectedRevision !== 'number') invalid();
+        const revoke = Object.hasOwn(request, 'revoke');
+        if (!hasKeys(request, revoke ? ['accountId', 'expectedRevision', 'revoke'] : ['accountId', 'expectedRevision'])
+          || typeof request.accountId !== 'string' || typeof request.expectedRevision !== 'number'
+          || (revoke && request.revoke !== true)) invalid();
         if (this.drainingAccounts.has(request.accountId) || this.preuseAccounts.has(request.accountId)) {
           throw new AuthSwitchRefusal('account_busy', 'Account runtime drain is already in progress.');
         }
         this.drainingAccounts.add(request.accountId);
         try {
           await this.drainManagedCodexAccount(request.accountId);
-          return { account: await this.broker.removeAccount(request.accountId, request.expectedRevision) };
+          return await this.broker.removeAccount(request.accountId, request.expectedRevision, { revoke });
         } finally { this.drainingAccounts.delete(request.accountId); }
       }));
     this.managementRouter.addTypedHandler(this.handler<IReq_AuthSwitchBindAccount>(
@@ -482,6 +496,17 @@ export class AuthSwitchAuthorityDaemon {
           || typeof request.incarnationId !== 'string') invalid();
         return this.broker.bindAccount(request);
       }));
+    this.managementRouter.addTypedHandler(this.handler<IReq_AuthSwitchUnbind>(
+      'authswitch.authority.unbind', async request => {
+        if (!hasKeys(request, ['runtime', 'scopeId', 'incarnationId', 'expectedRevision'])
+          || !['flex', 'opencode', 'claude'].includes(request.runtime) || typeof request.scopeId !== 'string'
+          || typeof request.incarnationId !== 'string' || typeof request.expectedRevision !== 'number') invalid();
+        // The holder's own binding, found by the identity it bound under whatever its login's state; from
+        // here it is released exactly as its capability would release it.
+        const held = await this.broker.findHeldBinding(request);
+        if (!held) return { state: 'inactive' };
+        return this.releaseRuntimeBinding(held.bindingId, held.capabilityHash);
+      }));
     this.runtimeRouter.addTypedHandler(this.handler<IReq_AuthSwitchResolveAccess>(
       'authswitch.authority.resolveAccess', async request => {
         if ((typeof request !== 'object' || request === null || Array.isArray(request))
@@ -491,7 +516,8 @@ export class AuthSwitchAuthorityDaemon {
           || !validBindingId(request.bindingId) || !validBindingCapability(request.capability)
           || typeof request.minValidityMs !== 'number'
           || (request.rejectedGrantGeneration !== undefined && typeof request.rejectedGrantGeneration !== 'number')) invalid();
-        const finish = this.beginRuntimeBindingAccess(this.runtimeBindingKey(request.bindingId, request.capability));
+        const finish = this.beginRuntimeBindingAccess(this.runtimeBindingKey(request.bindingId,
+          authSwitchBindingCapabilityHash(request.capability)));
         try {
           return await this.broker.resolveAccess(request.bindingId, request.capability, request.minValidityMs,
             request.rejectedGrantGeneration);
@@ -501,7 +527,7 @@ export class AuthSwitchAuthorityDaemon {
       'authswitch.authority.release', async request => {
         if (!hasKeys(request, ['bindingId', 'capability'])
           || !validBindingId(request.bindingId) || !validBindingCapability(request.capability)) invalid();
-        return this.releaseRuntimeBinding(request.bindingId, request.capability);
+        return this.releaseRuntimeBinding(request.bindingId, authSwitchBindingCapabilityHash(request.capability));
       }));
     this.runtimeRouter.addTypedHandler(this.handler<IReq_AuthSwitchImportSubmit>(
       'authswitch.authority.import.submit', async request => {
@@ -890,13 +916,24 @@ export class AuthSwitchAuthorityDaemon {
     await plugins.fs.promises.unlink(path);
   }
 
+  /**
+   * Serves one request on one connection. A connection's failure is its own: a client that went away before
+   * its answer -- EPIPE or a reset on the write, a read error -- only destroys that socket, and the close
+   * that follows aborts the request it had admitted. Nothing one client does can end the daemon.
+   *
+   * A connection has one deadline to deliver its complete request, `requestDeliveryMs` from acceptance, which
+   * no byte it sends extends: a client dripping a request slowly holds its connection no longer than one that
+   * sends nothing. Once admitted, the request runs until it answers or its client goes away: the client's own
+   * deadline governs, which may be longer than the delivery deadline.
+   */
   private accept(socket: plugins.net.Socket, router: plugins.typedrequest.TypedRouter): void {
     this.sockets.add(socket);
     const abort = new AbortController();
-    socket.on('close', () => { this.sockets.delete(socket); abort.abort(); });
+    const delivery = setTimeout(() => socket.destroy(), this.requestDeliveryMs);
+    socket.on('error', () => socket.destroy());
+    socket.on('close', () => { clearTimeout(delivery); this.sockets.delete(socket); abort.abort(); });
     const frame = new AuthSwitchAuthorityFrameReader();
     let handled = false;
-    socket.setTimeout(35_000, () => socket.destroy());
     socket.on('data', chunk => {
       if (handled) { socket.destroy(); return; }
       if (!Buffer.isBuffer(chunk)) { socket.destroy(); return; }
@@ -905,12 +942,15 @@ export class AuthSwitchAuthorityDaemon {
       catch { socket.destroy(); return; }
       if (input === null) return;
       handled = true;
+      clearTimeout(delivery);
       let request: ITypedRequest;
       try { request = JSON.parse(input) as ITypedRequest; }
       catch { socket.destroy(); return; }
       const answered: Promise<void> = router.routeAndAddResponse(request, { trustedLocalData: { authoritySocket: socket },
         trustedAbortSignal: abort.signal })
         .then(async response => {
+          // A client that is already gone is owed no answer.
+          if (!socket.writable) return;
           const raw = JSON.stringify(response);
           if (authSwitchAuthorityFrameBytes(raw) > maxAuthSwitchAuthorityFrameBytes) { socket.destroy(); return; }
           await new Promise<void>(resolve => socket.end(raw + '\n', () => resolve()));