@modelprofile.com/authswitch 9.1.0 → 9.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modelprofile.com/authswitch",
-  "version": "9.1.0",
+  "version": "9.2.0",
   "private": false,
   "description": "Manage Codex, OpenCode and Claude Code accounts with guided switching and live usage status",
   "main": "dist_ts/index.js",

package/readme.md

@@ -73,12 +73,13 @@ Browser code can import the credential-free DTOs from
 `@modelprofile.com/authswitch/authority-contract`. The backend-only binding, access and release
 requests are named by `@modelprofile.com/authswitch/authority-runtime-contract`, and the one-time
 import's own DTOs by `@modelprofile.com/authswitch/authority-import-contract`; those capabilities must
-never reach a browser. Two of the three runtime requests are served on the runtime socket -- resolving
-access and releasing a binding -- while `authswitch.authority.bind` is served on the **management** socket
-by design: minting a capability is the act that authorizes a runtime, so only a trusted management caller
-may perform it, and a container that is given the runtime directory can use a binding it was handed but can
-never create one. A backend binds an account to a runtime incarnation by exact account ID, login ID and
-purpose, and keeps the returned capability private. Targeted reauthentication likewise requires the
+never reach a browser. Two of the four runtime requests are served on the runtime socket -- resolving
+access and releasing a binding -- while `authswitch.authority.bind` and its inverse
+`authswitch.authority.unbind` are served on the **management** socket by design: minting a capability is the
+act that authorizes a runtime, so only a trusted management caller may perform it, and a container that is
+given the runtime directory can use and release a binding it was handed but can never create one or
+release one it was not handed. A backend binds an account to a runtime incarnation by exact account ID,
+login ID and purpose, and keeps the returned capability private. Targeted reauthentication likewise requires the
 exact login; an account's presentation default never selects a grant for either action. Completed and
 interrupted operations remain discoverable through `getOperation()` and paged
 `listOperations()`. `watchOperation(id, afterRevision, waitMs = 30000)` is the same read as a long poll,
@@ -91,8 +92,14 @@ callers supply one UUID for the logical start and reuse it after a lost response
 UUID returns the same matching receipt without starting another provider login; using it for a
 different target is rejected. Cancelling a durable `starting` receipt prevents a late provider
 handle from promoting or overwriting it. Aborting a client request only detaches that request and
-does not cancel the daemon-owned login. The runtime-only socket
-resolves that binding to a current access token; its directory can be mounted into a
+does not cancel the daemon-owned login. A client that disconnects before its answer -- a long poll it
+stopped reading, or one the daemon's shutdown settles after the client went away -- ends only its own
+connection: the daemon drops that request's pending work and keeps serving every other client. Each
+request is bounded by its own deadline -- 35 s unless its route states another, 120 s for an import submit,
+the wait plus 5 s for a long poll -- and nothing in the transport ends it sooner: the daemon gives a
+connection 35 s from acceptance to deliver its complete request, however it trickles in, and sets no limit
+once it is admitted.
+The runtime-only socket resolves that binding to a current access token; its directory can be mounted into a
 container without exposing the management socket. A provider that rejects a specific
 access-token generation can request a newer one through `rejectedGrantGeneration`; the
 authority coalesces concurrent rejection callbacks and never replays an uncertain refresh.
@@ -105,20 +112,32 @@ server-side resolution handlers, but handler completion does not prove response
 cannot retract an access token already received or in use; the runtime owner therefore owns that
 drain. Generic release cannot revoke a managed Codex binding, whose daemon-owned stop still closes
 the runtime and clears its durable run before internal revocation. Binding release never transfers
-or changes ownership of the account grant. A holder that crashed and lost its capability recovers
-its binding without a new route: the snapshot (and `getBinding`) publishes each binding's runtime and
-scope, binding that runtime and scope again replaces the capability, and releasing the returned
-capability releases the binding. If binding again is refused because the account needs a new sign-in,
-reauthenticate it first.
+or changes ownership of the account grant.
+
+A holder that lost its capability -- a binding an earlier run of it left behind -- releases it with
+`unbind({ runtime, scopeId, incarnationId, expectedRevision })` (`authswitch.authority.unbind`), naming the
+binding by the identity it bound it under, as the snapshot and `getBinding` publish it. Unbinding needs no
+ready login, so the leftover bindings of an account whose sign-in has ended are released, and the account
+removed, without signing in again. It is authorized exactly as `bind` is: the management socket is the trust
+boundary, and a runtime and scope are the namespace a holder binds under and owns -- AGL, for example, binds
+under its own installation's scopes -- so a holder names only its own. The daemon releases only the binding
+at exactly that runtime and scope, and only while it is still the incarnation and revision the holder read:
+another scope, another runtime, or a successor bound in the meantime is left alone, and the answer is
+`inactive`, as it is for a binding already released. A binding's revision is the authority revision of the
+bind that wrote it, so it never repeats for a runtime and scope, even after a release: a repeated or stale
+unbind never names a successor bound under the same incarnation. Its capability is fenced and released exactly as the
+runtime release would, so admitted access resolutions finish first. Managed Codex bindings are never named
+here. While the login is ready, a holder can instead bind the same runtime and scope again, which replaces
+the capability, and release the returned one.
 
 `getBinding(bindingId)` (`authswitch.authority.binding`) reads one binding by the id `bind` returned,
 credential-free, or `null` once the authority holds none by that id, so a backend checks its binding without
 reading the whole snapshot.
 
 Removing an account that still backs a Flex, OpenCode or Claude binding is refused with `account_busy`, naming
-those runtimes: their holder stops them and releases the bindings first, so a removal never strands a
-runtime whose next access would fail. Managed Codex bindings are the daemon's own; removal drains managed
-Codex as before and then takes them with the account.
+those runtimes: their holder stops them and releases the bindings first -- by capability, or by `unbind` when
+it no longer holds one -- so a removal never strands a runtime whose next access would fail. Managed Codex
+bindings are the daemon's own; removal drains managed Codex as before and then takes them with the account.
 
 Every route on either socket answers in one of three ways: a result, a **refusal**, or a fault. A refusal
 is an answer -- the daemon completed its check, nothing was left half-done, and its message says what the

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@modelprofile.com/authswitch',
-  version: '9.1.0',
+  version: '9.2.0',
   description: 'Manage Codex, OpenCode and Claude Code accounts with guided switching and live usage status'
 }

package/ts/authority-contract.ts

@@ -178,6 +178,10 @@ export interface IAuthSwitchBinding {
   runtime: 'flex' | 'codex' | 'opencode' | 'claude';
   scopeId: string;
   incarnationId: string;
+  /**
+   * The authority revision at which this runtime and scope were last bound. It grows with every bind and never
+   * repeats for them, not even after a release and a new bind, so it names exactly one bind.
+   */
   revision: number;
 }
 

package/ts/authority-runtime-contract.ts

@@ -25,6 +25,36 @@ export interface IReq_AuthSwitchBindAccount extends ITypedRequest {
   response: { binding: IAuthSwitchBinding; capability: string };
 }
 
+/**
+ * Backend-only release of a binding by the identity its holder bound it under, served on the MANAGEMENT
+ * socket beside `bind`, of which it is the inverse.
+ *
+ * It is how a holder releases a binding it no longer holds the capability for -- one an earlier run of it
+ * left behind -- and it needs no ready login: an account whose sign-in has ended can have its leftover
+ * bindings released, and then be removed, without signing in again first. It is authorized as `bind` is: a
+ * caller trusted with the management socket names a runtime and scope, the namespace a holder binds under
+ * and owns. It releases only the binding at exactly that runtime and scope, and only while it is still the
+ * incarnation and revision the holder read from the snapshot or `getBinding`; any other binding -- another
+ * scope, another runtime, or a successor bound meanwhile -- is left alone and the answer is `inactive`.
+ * A binding's revision names one bind and never repeats for its runtime and scope, so a successor is told
+ * apart even when it was bound under the same incarnation after the one read was released.
+ * The daemon's own managed Codex bindings are never named here. Like the runtime release, it waits for
+ * the access resolutions already admitted for that binding.
+ */
+export interface IReq_AuthSwitchUnbind extends ITypedRequest {
+  method: 'authswitch.authority.unbind';
+  request: {
+    runtime: Exclude<IAuthSwitchBinding['runtime'], 'codex'>;
+    scopeId: string;
+    incarnationId: string;
+    /** The binding's `revision` as the holder read it. */
+    expectedRevision: number;
+  };
+  response: {
+    state: 'released' | 'inactive';
+  };
+}
+
 /** Backend-only access operation. Refresh grants never cross this interface. */
 export interface IReq_AuthSwitchResolveAccess extends ITypedRequest {
   method: 'authswitch.authority.resolveAccess';

package/ts/classes.authoritybroker.ts

@@ -678,7 +678,7 @@ export class AuthSwitchAuthorityBroker {
     const capability = plugins.crypto.randomBytes(32).toString('base64url');
     const capabilityHash = idHash(capability);
     const updateId = plugins.crypto.randomUUID();
-    const updated = await this.database.changeBinding(updateId, id, input.accountId, input.loginId, (existing, account, grant) => {
+    const updated = await this.database.changeBinding(updateId, id, input.accountId, input.loginId, (_existing, account, grant, revision) => {
       // A ChatGPT login backs every runtime, Claude Code included; a Claude account reaches Claude Code
       // through its native switch instead, so it never binds (its provider is not OpenAI).
       if (account.removed || grant?.state !== 'ready' || grant.id !== account.primaryGrantId
@@ -687,7 +687,7 @@ export class AuthSwitchAuthorityBroker {
         throw new AuthSwitchRefusal('login_unavailable', loginNotBindable);
       }
       return { id, accountId: input.accountId, grantId: grant.id, runtime: input.runtime, scopeId: input.scopeId,
-        incarnationId: input.incarnationId, revision: (existing?.revision ?? 0) + 1,
+        incarnationId: input.incarnationId, revision,
         grantAuthorizationGeneration: grant.authorizationGeneration, capabilityHash, updateId };
     });
     this.publish();
@@ -709,13 +709,37 @@ export class AuthSwitchAuthorityBroker {
   }
 
   public async releaseExternalBinding(bindingId: string, capability: string): Promise<'released' | 'inactive'> {
-    if (!isId(bindingId) || !/^[A-Za-z0-9_-]{43}$/.test(capability)) throw new Error('Invalid runtime binding release.');
+    if (!/^[A-Za-z0-9_-]{43}$/.test(capability)) throw new Error('Invalid runtime binding release.');
+    return this.releaseExternalCapability(bindingId, authSwitchBindingCapabilityHash(capability));
+  }
+
+  /** Releases a caller-held binding while it still carries exactly this capability, named by its hash. */
+  public async releaseExternalCapability(bindingId: string, capabilityHash: string): Promise<'released' | 'inactive'> {
+    if (!isId(bindingId) || !isId(capabilityHash)) throw new Error('Invalid runtime binding release.');
     const released = await this.database.releaseExternalBinding(plugins.crypto.randomUUID(), bindingId,
-      authSwitchBindingCapabilityHash(capability));
+      capabilityHash);
     if (released) this.publish();
     return released ? 'released' : 'inactive';
   }
 
+  /**
+   * The caller-held binding a holder names by the identity it bound under, while it is still exactly the
+   * incarnation and revision the holder read, or `null`. Its capability hash is what a release then fences
+   * and compares, so a successor bound after this read is never released in its place.
+   */
+  public async findHeldBinding(input: { runtime: Exclude<IAuthSwitchBinding['runtime'], 'codex'>; scopeId: string;
+    incarnationId: string; expectedRevision: number }): Promise<{ bindingId: string; capabilityHash: string } | null> {
+    if (!['flex', 'opencode', 'claude'].includes(input.runtime) || !safeScope(input.scopeId, 512)
+      || !safeScope(input.incarnationId, 256) || !validRevision(input.expectedRevision)) {
+      throw new Error('Invalid runtime binding release.');
+    }
+    const bindingId = idHash('authswitch-binding-v1', input.runtime, input.scopeId);
+    const binding = await this.database.readBinding(bindingId);
+    if (!binding || binding.runtime !== input.runtime || binding.scopeId !== input.scopeId
+      || binding.incarnationId !== input.incarnationId || binding.revision !== input.expectedRevision) return null;
+    return { bindingId, capabilityHash: binding.capabilityHash };
+  }
+
   public async resolveAccess(bindingId: string, capability: string, minValidityMs: number,
     rejectedGrantGeneration?: number): Promise<IAuthSwitchResolvedAccess> {
     if (!isId(bindingId) || !/^[A-Za-z0-9_-]{43}$/.test(capability)

package/ts/classes.authorityclient.ts

@@ -11,30 +11,37 @@ import type {
   IReq_AuthSwitchStartPreuse, IReq_AuthSwitchUsage,
 } from './authority-contract.js';
 import type { IReq_AuthSwitchBindAccount, IReq_AuthSwitchReleaseBinding,
-  IReq_AuthSwitchResolveAccess } from './authority-runtime-contract.js';
+  IReq_AuthSwitchResolveAccess, IReq_AuthSwitchUnbind } from './authority-runtime-contract.js';
 import type { IReq_AuthSwitchImportInventory, IReq_AuthSwitchImportStatus,
   IReq_AuthSwitchImportSubmit } from './authority-import-contract.js';
 import { AuthSwitchAuthorityFrameReader, authSwitchAuthorityFrameBytes,
   maxAuthSwitchAuthorityFrameBytes } from './classes.authorityframing.js';
 
+/**
+ * One request on one connection, bounded by its own deadline alone.
+ *
+ * `TypedRequest.fire` turns each request's `timeoutMs` into the abort of `signal`, so the transport arms no
+ * timer of its own: an idle limit here would end a request that was allowed longer -- an import submit is
+ * allowed 120 s -- before its deadline. Every authority request carries one; a request without it is refused.
+ */
 const post = (path: string, payload: ITypedRequest, signal?: AbortSignal): Promise<ITypedRequest> => {
     return new Promise((resolve, reject) => {
-      if (signal?.aborted) { reject(signal.reason); return; }
+      if (!signal) { reject(new Error('Authswitch daemon requests need a deadline.')); return; }
+      if (signal.aborted) { reject(signal.reason); return; }
       const socket = plugins.net.createConnection(path);
       let settled = false;
       const frame = new AuthSwitchAuthorityFrameReader();
       const finish = (error?: unknown, response?: ITypedRequest): void => {
         if (settled) return;
         settled = true;
-        signal?.removeEventListener('abort', abort);
+        signal.removeEventListener('abort', abort);
         socket.destroy();
         if (error) reject(error);
         else if (response) resolve(response);
         else reject(new Error('Authswitch daemon returned no response.'));
       };
-      const abort = () => finish(signal?.reason ?? new Error('Account request was cancelled.'));
-      signal?.addEventListener('abort', abort, { once: true });
-      socket.setTimeout(35_000, () => finish(new Error('Authswitch daemon request timed out.')));
+      const abort = () => finish(signal.reason ?? new Error('Account request was cancelled.'));
+      signal.addEventListener('abort', abort, { once: true });
       socket.on('connect', () => {
         const raw = JSON.stringify(payload);
         if (authSwitchAuthorityFrameBytes(raw) > maxAuthSwitchAuthorityFrameBytes) { finish(new Error('Account request is too large.')); return; }
@@ -409,6 +416,14 @@ export class AuthSwitchClient {
     signal?: AbortSignal): Promise<IReq_AuthSwitchBindAccount['response']> {
     return this.request<IReq_AuthSwitchBindAccount>('authswitch.authority.bind', input, 35_000, false, signal);
   }
+  /**
+   * Releases the holder's own binding by the runtime, scope, incarnation and revision it was bound under,
+   * without its capability and without a ready login; `inactive` when no binding matches all four.
+   */
+  public unbind(input: IReq_AuthSwitchUnbind['request'],
+    signal?: AbortSignal): Promise<IReq_AuthSwitchUnbind['response']> {
+    return this.request<IReq_AuthSwitchUnbind>('authswitch.authority.unbind', input, 35_000, false, signal);
+  }
   public resolveAccess(input: IReq_AuthSwitchResolveAccess['request'],
     signal?: AbortSignal): Promise<IReq_AuthSwitchResolveAccess['response']> {
     return this.request<IReq_AuthSwitchResolveAccess>('authswitch.authority.resolveAccess',

package/ts/classes.authoritydaemon.ts

@@ -10,7 +10,7 @@ import type {
   IReq_AuthSwitchCancelPreuse, IReq_AuthSwitchGetPreuse, IReq_AuthSwitchStartPreuse, IReq_AuthSwitchUsage,
 } from './authority-contract.js';
 import type { IReq_AuthSwitchBindAccount, IReq_AuthSwitchReleaseBinding,
-  IReq_AuthSwitchResolveAccess } from './authority-runtime-contract.js';
+  IReq_AuthSwitchResolveAccess, IReq_AuthSwitchUnbind } from './authority-runtime-contract.js';
 import { AuthSwitchRefusal } from './authority-contract.js';
 import type { IReq_AuthSwitchImportInventory, IReq_AuthSwitchImportStatus, IReq_AuthSwitchImportSubmit,
   TAuthSwitchImportSubmission } from './authority-import-contract.js';
@@ -40,6 +40,11 @@ export interface IAuthSwitchAuthorityDaemonOptions extends IAuthSwitchAuthorityD
   claudeNative?: IClaudeNativeAuthorityOptions;
   /** Where the one-time import reads the legacy stores, or `'none'`. Never derived from this host here. */
   legacyImport: TAuthSwitchAuthorityLegacyImport;
+  /**
+   * How long an accepted connection has to deliver its complete request, counted from its acceptance and
+   * never extended by the bytes it sends: 35 s unless stated.
+   */
+  requestDeliveryMs?: number;
 }
 
 /**
@@ -139,12 +144,17 @@ export class AuthSwitchAuthorityDaemon {
   private closing = false;
   /** Every admitted request until its answer is written; shutdown settles these before it closes the store. */
   private readonly inFlight = new Set<Promise<void>>();
+  private readonly requestDeliveryMs: number;
 
   constructor(private readonly options: IAuthSwitchAuthorityDaemonOptions) {
     // First, before anything is constructed: a daemon that was going to read the wrong host's credentials
     // must not come into existence at all. The type states it and this states it again, because a caller
     // without types is exactly the caller that would have defaulted here.
     assertStatedLegacyImport(options.legacyImport);
+    this.requestDeliveryMs = options.requestDeliveryMs ?? 35_000;
+    if (!Number.isSafeInteger(this.requestDeliveryMs) || this.requestDeliveryMs <= 0) {
+      throw new Error('Authswitch authority requestDeliveryMs must be a positive whole number of milliseconds.');
+    }
     this.database = new AuthSwitchAuthorityDatabase(options);
     const provider = options.broker?.provider ?? new plugins.flexAccounts.OpenAiProviderAdapter();
     this.broker = new AuthSwitchAuthorityBroker(this.database, { ...options.broker, provider });
@@ -185,8 +195,9 @@ export class AuthSwitchAuthorityDaemon {
     this.register();
   }
 
-  private runtimeBindingKey(bindingId: string, capability: string): string {
-    return `${bindingId}:${authSwitchBindingCapabilityHash(capability)}`;
+  /** One exact capability of one binding: what a release fences and what an access resolution holds open. */
+  private runtimeBindingKey(bindingId: string, capabilityHash: string): string {
+    return `${bindingId}:${capabilityHash}`;
   }
 
   private beginRuntimeBindingAccess(key: string): () => void {
@@ -213,8 +224,8 @@ export class AuthSwitchAuthorityDaemon {
   }
 
   private releaseRuntimeBinding(bindingId: string,
-    capability: string): Promise<IReq_AuthSwitchReleaseBinding['response']> {
-    const key = this.runtimeBindingKey(bindingId, capability);
+    capabilityHash: string): Promise<IReq_AuthSwitchReleaseBinding['response']> {
+    const key = this.runtimeBindingKey(bindingId, capabilityHash);
     const existing = this.runtimeBindingReleases.get(key);
     if (existing) return existing;
     // Capabilities are freshly random for every bind, including a successor that reuses the
@@ -222,7 +233,7 @@ export class AuthSwitchAuthorityDaemon {
     this.runtimeBindingReleaseFences.add(key);
     const task = (async (): Promise<IReq_AuthSwitchReleaseBinding['response']> => {
       await this.waitForRuntimeBindingAccess(key);
-      const state = await this.broker.releaseExternalBinding(bindingId, capability);
+      const state = await this.broker.releaseExternalCapability(bindingId, capabilityHash);
       this.runtimeBindingReleaseFences.delete(key);
       return { state };
     })();
@@ -482,6 +493,17 @@ export class AuthSwitchAuthorityDaemon {
           || typeof request.incarnationId !== 'string') invalid();
         return this.broker.bindAccount(request);
       }));
+    this.managementRouter.addTypedHandler(this.handler<IReq_AuthSwitchUnbind>(
+      'authswitch.authority.unbind', async request => {
+        if (!hasKeys(request, ['runtime', 'scopeId', 'incarnationId', 'expectedRevision'])
+          || !['flex', 'opencode', 'claude'].includes(request.runtime) || typeof request.scopeId !== 'string'
+          || typeof request.incarnationId !== 'string' || typeof request.expectedRevision !== 'number') invalid();
+        // The holder's own binding, found by the identity it bound under whatever its login's state; from
+        // here it is released exactly as its capability would release it.
+        const held = await this.broker.findHeldBinding(request);
+        if (!held) return { state: 'inactive' };
+        return this.releaseRuntimeBinding(held.bindingId, held.capabilityHash);
+      }));
     this.runtimeRouter.addTypedHandler(this.handler<IReq_AuthSwitchResolveAccess>(
       'authswitch.authority.resolveAccess', async request => {
         if ((typeof request !== 'object' || request === null || Array.isArray(request))
@@ -491,7 +513,8 @@ export class AuthSwitchAuthorityDaemon {
           || !validBindingId(request.bindingId) || !validBindingCapability(request.capability)
           || typeof request.minValidityMs !== 'number'
           || (request.rejectedGrantGeneration !== undefined && typeof request.rejectedGrantGeneration !== 'number')) invalid();
-        const finish = this.beginRuntimeBindingAccess(this.runtimeBindingKey(request.bindingId, request.capability));
+        const finish = this.beginRuntimeBindingAccess(this.runtimeBindingKey(request.bindingId,
+          authSwitchBindingCapabilityHash(request.capability)));
         try {
           return await this.broker.resolveAccess(request.bindingId, request.capability, request.minValidityMs,
             request.rejectedGrantGeneration);
@@ -501,7 +524,7 @@ export class AuthSwitchAuthorityDaemon {
       'authswitch.authority.release', async request => {
         if (!hasKeys(request, ['bindingId', 'capability'])
           || !validBindingId(request.bindingId) || !validBindingCapability(request.capability)) invalid();
-        return this.releaseRuntimeBinding(request.bindingId, request.capability);
+        return this.releaseRuntimeBinding(request.bindingId, authSwitchBindingCapabilityHash(request.capability));
       }));
     this.runtimeRouter.addTypedHandler(this.handler<IReq_AuthSwitchImportSubmit>(
       'authswitch.authority.import.submit', async request => {
@@ -890,13 +913,24 @@ export class AuthSwitchAuthorityDaemon {
     await plugins.fs.promises.unlink(path);
   }
 
+  /**
+   * Serves one request on one connection. A connection's failure is its own: a client that went away before
+   * its answer -- EPIPE or a reset on the write, a read error -- only destroys that socket, and the close
+   * that follows aborts the request it had admitted. Nothing one client does can end the daemon.
+   *
+   * A connection has one deadline to deliver its complete request, `requestDeliveryMs` from acceptance, which
+   * no byte it sends extends: a client dripping a request slowly holds its connection no longer than one that
+   * sends nothing. Once admitted, the request runs until it answers or its client goes away: the client's own
+   * deadline governs, which may be longer than the delivery deadline.
+   */
   private accept(socket: plugins.net.Socket, router: plugins.typedrequest.TypedRouter): void {
     this.sockets.add(socket);
     const abort = new AbortController();
-    socket.on('close', () => { this.sockets.delete(socket); abort.abort(); });
+    const delivery = setTimeout(() => socket.destroy(), this.requestDeliveryMs);
+    socket.on('error', () => socket.destroy());
+    socket.on('close', () => { clearTimeout(delivery); this.sockets.delete(socket); abort.abort(); });
     const frame = new AuthSwitchAuthorityFrameReader();
     let handled = false;
-    socket.setTimeout(35_000, () => socket.destroy());
     socket.on('data', chunk => {
       if (handled) { socket.destroy(); return; }
       if (!Buffer.isBuffer(chunk)) { socket.destroy(); return; }
@@ -905,12 +939,15 @@ export class AuthSwitchAuthorityDaemon {
       catch { socket.destroy(); return; }
       if (input === null) return;
       handled = true;
+      clearTimeout(delivery);
       let request: ITypedRequest;
       try { request = JSON.parse(input) as ITypedRequest; }
       catch { socket.destroy(); return; }
       const answered: Promise<void> = router.routeAndAddResponse(request, { trustedLocalData: { authoritySocket: socket },
         trustedAbortSignal: abort.signal })
         .then(async response => {
+          // A client that is already gone is owed no answer.
+          if (!socket.writable) return;
           const raw = JSON.stringify(response);
           if (authSwitchAuthorityFrameBytes(raw) > maxAuthSwitchAuthorityFrameBytes) { socket.destroy(); return; }
           await new Promise<void>(resolve => socket.end(raw + '\n', () => resolve()));

package/ts/classes.authoritydatabase.ts

@@ -1267,8 +1267,7 @@ export class AuthSwitchAuthorityDatabase {
           const listed = names.length === 1 ? names[0] : `${names.slice(0, -1).join(', ')} and ${names.at(-1)}`;
           throw new AuthSwitchRefusal('account_busy', `This account still backs ${listed} runtime bindings. `
             + 'Stop those runtimes and release their bindings before removing the account. A holder that lost '
-            + 'its capability binds the same runtime and scope again and releases the capability that returns; '
-            + 'if binding again is refused, reauthenticate the account first.');
+            + 'its capability unbinds its own runtime and scope instead, which needs no sign-in.');
         }
         await scan(async (grant, stored) => {
           if (grant.state === 'removed') return;
@@ -1349,9 +1348,16 @@ export class AuthSwitchAuthorityDatabase {
     }
   }
 
+  /**
+   * Binds a runtime and scope, or rebinds them. The binding's revision is the authority revision of the event
+   * that writes it, handed to `change` as `revision`: the authority revision never repeats, so no two binds of
+   * a runtime and scope ever share one -- not even across a release, which deletes the record, followed by a
+   * bind that inserts it again -- and a holder that names a binding by the revision it read never names its
+   * successor. Records written before carry smaller revisions, which a later bind therefore still exceeds.
+   */
   public async changeBinding(updateId: string, bindingId: string, accountId: string, grantId: string,
     change: (draft: IStoredAuthorityBinding | null, account: IStoredAuthorityAccount,
-      grant: IStoredAuthorityGrant | null) => IStoredAuthorityBinding): Promise<{
+      grant: IStoredAuthorityGrant | null, revision: number) => IStoredAuthorityBinding): Promise<{
       meta: IStoredAuthorityMeta; binding: IStoredAuthorityBinding;
     }> {
     try {
@@ -1363,8 +1369,11 @@ export class AuthSwitchAuthorityDatabase {
         const grantStored = await AuthSwitchAuthorityGrantModel.exact.findStoredOne({ id: grantId }, { session });
         const grant = grantStored ? AuthSwitchAuthorityGrantModel.exact.toPersisted(grantStored) : null;
         const current = await AuthSwitchAuthorityBindingModel.exact.findStoredOne({ id: bindingId }, { session });
-        const draft = change(current ? structuredClone(AuthSwitchAuthorityBindingModel.exact.toPersisted(current)) : null, account, grant);
-        if (draft.id !== bindingId || draft.accountId !== accountId || draft.updateId !== updateId) throw new Error('Binding change has an invalid identity.');
+        const revision = metaStored.revision + 1;
+        const draft = change(current ? structuredClone(AuthSwitchAuthorityBindingModel.exact.toPersisted(current)) : null,
+          account, grant, revision);
+        if (draft.id !== bindingId || draft.accountId !== accountId || draft.updateId !== updateId
+          || draft.revision !== revision) throw new Error('Binding change has an invalid identity.');
         if (draft.grantId !== grantId || grant?.accountId !== accountId) {
           throw new Error('Binding login does not belong to the account.');
         }