sidekick-shared 0.26.5 → 0.26.6

package/dist/accountHealth.js

@@ -0,0 +1,286 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getHealthSidecarPath = getHealthSidecarPath;
+exports.readHealthSidecar = readHealthSidecar;
+exports.claudeHealthSidecarFromBlob = claudeHealthSidecarFromBlob;
+exports.writeClaudeHealthSidecar = writeClaudeHealthSidecar;
+exports.codexHealthSidecarFromAuth = codexHealthSidecarFromAuth;
+exports.writeCodexHealthSidecar = writeCodexHealthSidecar;
+exports.getAccountHealth = getAccountHealth;
+exports.listAccountsWithHealth = listAccountsWithHealth;
+exports.describeClaudeCredential = describeClaudeCredential;
+/**
+ * Per-account credential health. Health is derived from a secret-free sidecar
+ * (`health.json`) next to each profile, written whenever sidekick stores a
+ * credential, so reading health never spawns `security` or the provider CLI.
+ */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const claudeProfiles_1 = require("./claudeProfiles");
+const claudeCredentials_1 = require("./claudeCredentials");
+const credentialIO_1 = require("./credentialIO");
+const codexAuth_1 = require("./codexAuth");
+const codexPaths_1 = require("./codexPaths");
+const accountRegistry_1 = require("./accountRegistry");
+const atomic_1 = require("./writers/atomic");
+/** Refresh tokens that expire within this window count as `expiring`. */
+const REFRESH_EXPIRY_WARNING_MS = 3 * 24 * 60 * 60 * 1000;
+function getHealthSidecarPath(provider, accountId) {
+    const dir = provider === 'codex' ? (0, codexPaths_1.getCodexProfileDir)(accountId) : (0, claudeProfiles_1.getClaudeProfileDir)(accountId);
+    return path.join(dir, 'health.json');
+}
+function readHealthSidecar(provider, accountId) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(getHealthSidecarPath(provider, accountId), 'utf8'));
+        return parsed?.version === 1 && typeof parsed.capturedAt === 'number' ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+function writeSidecar(provider, accountId, sidecar) {
+    try {
+        (0, atomic_1.atomicWriteJsonSync)(getHealthSidecarPath(provider, accountId), sidecar);
+    }
+    catch {
+        // Health is advisory; a failed sidecar write must not fail the credential write.
+    }
+}
+/** Build the sidecar for a Claude credential blob. */
+function claudeHealthSidecarFromBlob(blob, source, now = Date.now()) {
+    const credentials = (0, claudeCredentials_1.parseClaudeCredentialBlob)(blob);
+    if (!credentials)
+        return null;
+    const refresh = (0, claudeCredentials_1.resolveClaudeRefreshExpiry)(credentials);
+    return {
+        version: 1,
+        capturedAt: now,
+        accessExpiresAt: credentials.expiresAt,
+        refreshExpiresAt: refresh?.refreshExpiresAt,
+        refreshExpiryEstimated: refresh?.estimated,
+        hasRefreshToken: Boolean(credentials.refreshToken),
+        authMode: 'oauth',
+        source,
+    };
+}
+/** Record the health of a Claude profile from the credential just stored. */
+function writeClaudeHealthSidecar(accountId, blob, source, now = Date.now()) {
+    const sidecar = claudeHealthSidecarFromBlob(blob, source, now);
+    if (sidecar)
+        writeSidecar('claude-code', accountId, sidecar);
+    return sidecar;
+}
+/** Build the sidecar for a raw Codex `auth.json`. */
+function codexHealthSidecarFromAuth(authRaw, source, now = Date.now(), fallbackPath) {
+    const identity = (0, codexAuth_1.readAuthIdentityFromRaw)(authRaw);
+    if (!identity)
+        return null;
+    const lastRefreshAt = (0, codexAuth_1.readLastRefresh)(authRaw, fallbackPath) ?? undefined;
+    return {
+        version: 1,
+        capturedAt: now,
+        accessExpiresAt: (0, codexAuth_1.readAccessTokenExpiry)(authRaw) ?? undefined,
+        lastRefreshAt,
+        hasRefreshToken: identity.authMode === 'chatgpt',
+        authMode: identity.authMode,
+        source,
+    };
+}
+/** Record the health of a Codex profile from the auth file just stored. */
+function writeCodexHealthSidecar(accountId, authRaw, source, now = Date.now()) {
+    const sidecar = codexHealthSidecarFromAuth(authRaw, source, now);
+    if (sidecar)
+        writeSidecar('codex', accountId, sidecar);
+    return sidecar;
+}
+function stateFromClaudeSidecar(sidecar, now) {
+    const accessKnown = sidecar.accessExpiresAt !== undefined;
+    const accessExpired = accessKnown && sidecar.accessExpiresAt <= now;
+    if (sidecar.refreshExpiresAt !== undefined) {
+        if (sidecar.refreshExpiresAt <= now) {
+            return {
+                state: 'expired',
+                reason: sidecar.refreshExpiryEstimated
+                    ? 'Refresh token has most likely expired (estimated from the snapshot age).'
+                    : 'Refresh token expired; sign in again.',
+            };
+        }
+        if (sidecar.refreshExpiresAt - now <= REFRESH_EXPIRY_WARNING_MS) {
+            return { state: 'expiring', reason: 'Refresh token expires within 3 days.' };
+        }
+    }
+    if (sidecar.hasRefreshToken === false && accessExpired) {
+        return { state: 'expired', reason: 'Access token expired and no refresh token is stored.' };
+    }
+    if (accessExpired) {
+        return { state: 'expiring', reason: 'Access token expired; the CLI refreshes it on next use.' };
+    }
+    if (!accessKnown && sidecar.refreshExpiresAt === undefined) {
+        return { state: 'unknown', reason: 'The stored credential carries no expiry.' };
+    }
+    return { state: 'fresh' };
+}
+function stateFromCodexSidecar(sidecar, now) {
+    if (sidecar.authMode === 'api-key') {
+        return { state: 'unknown', reason: 'API-key login; expiry is not observable locally.' };
+    }
+    if (sidecar.accessExpiresAt !== undefined && sidecar.accessExpiresAt > now) {
+        return { state: 'fresh' };
+    }
+    if (sidecar.lastRefreshAt !== undefined &&
+        now - sidecar.lastRefreshAt > codexAuth_1.STALE_AUTH_THRESHOLD_MS) {
+        const days = Math.floor((now - sidecar.lastRefreshAt) / (24 * 60 * 60 * 1000));
+        return {
+            state: 'expiring',
+            reason: `Not refreshed in ${days} days; codex may ask you to log in again.`,
+        };
+    }
+    if (sidecar.accessExpiresAt !== undefined) {
+        return { state: 'expiring', reason: 'Access token expired; codex refreshes it on next use.' };
+    }
+    return { state: 'unknown', reason: 'The stored credential carries no expiry.' };
+}
+function isLiveClaudeAccount(accountId) {
+    return (0, claudeProfiles_1.readLiveClaudeIdentity)()?.uuid === accountId;
+}
+function isLiveCodexAccount(profile) {
+    const live = (0, codexAuth_1.readAuthIdentityFromRaw)((0, codexPaths_1.readFileOrNull)(path.join((0, codexPaths_1.getSystemCodexHome)(), 'auth.json')));
+    if (!live)
+        return false;
+    return (0, codexAuth_1.identitiesMatch)(live, {
+        email: profile.email ?? profile.metadata?.email,
+        workspaceId: profile.metadata?.workspaceId,
+    });
+}
+function probeClaudeStore(accountId, now) {
+    const blob = (0, credentialIO_1.readActiveCredentials)((0, claudeProfiles_1.getClaudeProfileHome)(accountId));
+    return blob ? writeClaudeHealthSidecar(accountId, blob, 'switch', now) : null;
+}
+function probeCodexStore(accountId, now) {
+    const authPath = path.join((0, codexPaths_1.getCodexProfileHome)(accountId), 'auth.json');
+    const raw = (0, codexPaths_1.readFileOrNull)(authPath);
+    const sidecar = codexHealthSidecarFromAuth(raw, 'switch', now, authPath);
+    if (sidecar)
+        writeSidecar('codex', accountId, sidecar);
+    return sidecar;
+}
+function hasStoredClaudeCredential(accountId) {
+    const home = (0, claudeProfiles_1.getClaudeProfileHome)(accountId);
+    return (fs.existsSync(path.join(home, '.credentials.json')) ||
+        fs.existsSync(path.join((0, claudeProfiles_1.getClaudeProfileDir)(accountId), 'health.json')) ||
+        fs.existsSync(path.join((0, accountRegistry_1.getAccountsDir)(), 'credentials', `${accountId}.credentials.json`)) ||
+        (process.platform === 'darwin' && fs.existsSync(path.join(home, '.claude.json'))));
+}
+function hasStoredCodexCredential(accountId) {
+    const home = (0, codexPaths_1.getCodexProfileHome)(accountId);
+    return (fs.existsSync(path.join(home, 'auth.json')) ||
+        fs.existsSync(path.join(home, '.credentials.json')));
+}
+/**
+ * Health of one saved account. `probe: 'cache'` never spawns anything; a
+ * missing sidecar on a profile that has credentials is reported as `unknown`
+ * (never `expired`) until a store probe or the next sync rewrites it.
+ */
+function getAccountHealth(provider, accountId, options = {}) {
+    const now = options.now ?? Date.now();
+    const probe = options.probe ?? 'cache';
+    const profile = (0, accountRegistry_1.listSavedAccountProfiles)(provider).find((p) => p.id === accountId);
+    const isLive = provider === 'codex'
+        ? profile !== undefined && isLiveCodexAccount(profile)
+        : isLiveClaudeAccount(accountId);
+    let sidecar = null;
+    if (probe === 'store') {
+        sidecar =
+            provider === 'codex' ? probeCodexStore(accountId, now) : probeClaudeStore(accountId, now);
+    }
+    sidecar ??= readHealthSidecar(provider, accountId);
+    if (!sidecar && provider === 'codex') {
+        // Codex sidecars are cheap to derive from the plaintext file.
+        sidecar = probeCodexStore(accountId, now);
+    }
+    if (!sidecar && probe === 'auto' && hasStoredClaudeCredential(accountId)) {
+        // First look at a profile that predates the health model: read its store
+        // once and record the sidecar so later reads are cache hits.
+        sidecar = probeClaudeStore(accountId, now);
+    }
+    const base = { providerId: provider, accountId, checkedAt: now, isLive };
+    if (!sidecar) {
+        const stored = provider === 'codex'
+            ? hasStoredCodexCredential(accountId)
+            : hasStoredClaudeCredential(accountId);
+        return stored
+            ? { ...base, state: 'unknown', reason: 'Credential health has not been recorded yet.' }
+            : { ...base, state: 'missing', reason: 'No stored credentials; sign in again.' };
+    }
+    const verdict = provider === 'codex'
+        ? stateFromCodexSidecar(sidecar, now)
+        : stateFromClaudeSidecar(sidecar, now);
+    return {
+        ...base,
+        ...verdict,
+        accessExpiresAt: sidecar.accessExpiresAt,
+        refreshExpiresAt: sidecar.refreshExpiresAt,
+        refreshExpiryEstimated: sidecar.refreshExpiryEstimated,
+        lastRefreshAt: sidecar.lastRefreshAt,
+    };
+}
+/** Saved accounts with their health, in registry order, grouped by provider. */
+function listAccountsWithHealth(provider, options = {}) {
+    const resolved = { probe: 'auto', ...options };
+    const providers = provider ? [provider] : ['claude-code', 'codex'];
+    const views = [];
+    for (const providerId of providers) {
+        const active = (0, accountRegistry_1.getActiveSavedAccount)(providerId);
+        for (const profile of (0, accountRegistry_1.listSavedAccountProfiles)(providerId)) {
+            views.push({
+                id: profile.id,
+                providerId,
+                label: profile.label,
+                email: profile.email ?? profile.metadata?.email,
+                planType: profile.metadata?.planType,
+                isActive: active?.id === profile.id,
+                health: getAccountHealth(providerId, profile.id, resolved),
+                source: profile.metadata?.origin === 'live-sync' ? 'learned' : 'registered',
+                addedAt: profile.addedAt,
+            });
+        }
+    }
+    return views;
+}
+/** Sidecar helper shared by the credential chokepoints: extracts the Claude credential shape. */
+function describeClaudeCredential(blob) {
+    return (0, claudeCredentials_1.parseClaudeCredentialBlob)(blob);
+}

package/dist/accountLaunch.d.ts

@@ -0,0 +1,30 @@
+import type { AccountProviderId } from './accountRegistry';
+import { type AccountHealth } from './accountHealth';
+export interface AccountLaunchEnv {
+    provider: AccountProviderId;
+    accountId: string;
+    label?: string;
+    email?: string;
+    /** The isolated home the CLI will use. */
+    home: string;
+    /** Variables to set on the child. */
+    env: Record<string, string>;
+    /** Variables the host must remove from the child's environment. */
+    envUnset: string[];
+    command: 'claude' | 'codex';
+    health: AccountHealth;
+    warnings: string[];
+    /** Set when the account cannot be launched (expired or missing credentials). */
+    error?: string;
+}
+export interface AccountLaunchOptions {
+    /**
+     * Copy the live `settings.json` / `config.toml` into the profile home once
+     * so the isolated session behaves like the live one (default true). Never
+     * touches credentials or `oauthAccount`.
+     */
+    materialize?: boolean;
+    /** Launch even when the stored credential is reported expired. */
+    force?: boolean;
+}
+export declare function getAccountLaunchEnv(provider: AccountProviderId, accountId: string, options?: AccountLaunchOptions): AccountLaunchEnv;

package/dist/accountLaunch.js

@@ -0,0 +1,124 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getAccountLaunchEnv = getAccountLaunchEnv;
+/**
+ * Environment for running a provider CLI against a saved profile without
+ * touching the live home: two accounts can run side by side, each with its
+ * own refresh-token chain.
+ */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const accountRegistry_1 = require("./accountRegistry");
+const accountHealth_1 = require("./accountHealth");
+const claudeProfiles_1 = require("./claudeProfiles");
+const codexPaths_1 = require("./codexPaths");
+const atomic_1 = require("./writers/atomic");
+function materializeClaudeHome(home) {
+    fs.mkdirSync(home, { recursive: true, mode: 0o700 });
+    const liveHome = (0, claudeProfiles_1.getLiveClaudeHome)();
+    const settingsTarget = path.join(home, 'settings.json');
+    if (!fs.existsSync(settingsTarget)) {
+        const settings = (0, codexPaths_1.readFileOrNull)(path.join(liveHome, 'settings.json'));
+        if (settings)
+            (0, atomic_1.atomicWriteFileSync)(settingsTarget, settings);
+    }
+    const configPath = path.join(home, '.claude.json');
+    let config = {};
+    try {
+        config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+    }
+    catch {
+        /* fresh */
+    }
+    if (config.hasCompletedOnboarding !== true) {
+        (0, atomic_1.atomicWriteJsonSync)(configPath, { ...config, hasCompletedOnboarding: true });
+    }
+}
+function materializeCodexHome(home) {
+    fs.mkdirSync(home, { recursive: true, mode: 0o700 });
+    const configTarget = path.join(home, 'config.toml');
+    if (!fs.existsSync(configTarget)) {
+        const source = (0, codexPaths_1.readFileOrNull)(path.join((0, codexPaths_1.getSystemCodexHome)(), 'config.toml')) ?? '';
+        (0, atomic_1.atomicWriteFileSync)(configTarget, (0, codexPaths_1.forceFileCredentialStore)(source));
+    }
+}
+function getAccountLaunchEnv(provider, accountId, options = {}) {
+    const profile = (0, accountRegistry_1.listSavedAccountProfiles)(provider).find((p) => p.id === accountId);
+    const command = provider === 'codex' ? 'codex' : 'claude';
+    const home = provider === 'codex'
+        ? (0, codexPaths_1.getCodexProfileHome)(accountId)
+        : (0, claudeProfiles_1.getClaudeProfileHome)(profile?.providerAccountId ?? accountId);
+    const health = (0, accountHealth_1.getAccountHealth)(provider, accountId);
+    const warnings = [];
+    const base = {
+        provider,
+        accountId,
+        label: profile?.label,
+        email: profile?.email ?? profile?.metadata?.email,
+        home,
+        env: provider === 'codex' ? { CODEX_HOME: home } : { CLAUDE_CONFIG_DIR: home },
+        envUnset: provider === 'codex' ? [] : [claudeProfiles_1.CLAUDE_SECURESTORAGE_CONFIG_DIR_ENV],
+        command,
+        health,
+        warnings,
+    };
+    if (!profile) {
+        return { ...base, error: `${provider} account ${accountId} not found.` };
+    }
+    if ((health.state === 'expired' || health.state === 'missing') && !options.force) {
+        return {
+            ...base,
+            error: `Stored credentials for "${profile.label ?? profile.email ?? accountId}" have ${health.state === 'missing' ? 'not been saved' : 'expired'}; sign in again before launching.`,
+        };
+    }
+    if (health.isLive) {
+        warnings.push('This account is also the live login. Two sessions refreshing the same login can invalidate each other; prefer switching instead.');
+    }
+    if (health.state === 'expiring' && health.reason)
+        warnings.push(health.reason);
+    if (options.materialize !== false) {
+        try {
+            if (provider === 'codex')
+                materializeCodexHome(home);
+            else
+                materializeClaudeHome(home);
+        }
+        catch (err) {
+            warnings.push(`Could not prepare the isolated home: ${err}`);
+        }
+    }
+    return base;
+}

package/dist/accountManager.d.ts

@@ -1,5 +1,6 @@
 import { type AccountProviderId, type SavedAccountProfile } from './accountRegistry';
 import { type AccountEntry, type AccountManagerResult } from './accounts';
+import { type LastSwitchRecord, type SwitchAccountOptions, type SwitchAccountResult } from './accountSwitch';
 export interface BeginAccountLoginSuccess {
     success: true;
     loginId: string;
@@ -7,7 +8,11 @@ export interface BeginAccountLoginSuccess {
     command?: string;
     args?: string[];
     env?: Record<string, string>;
+    /** Variables the host must remove from the child's environment. */
+    envUnset?: string[];
     configDir?: string;
+    /** Set when the login re-authenticates an existing saved profile. */
+    existingAccountId?: string;
 }
 export interface BeginAccountLoginFailure {
     success: false;
@@ -27,24 +32,37 @@ export interface AccountLoginCommand {
     command: string;
     args: string[];
 }
-export interface SpawnAccountLoginOptions extends FinalizeAccountLoginOptions {
+export interface BeginAccountLoginOptions {
+    loginCommand?: AccountLoginCommand;
+    /** Sign in again to this saved profile instead of creating a new one. */
+    existingAccountId?: string;
+}
+export interface SpawnAccountLoginOptions extends FinalizeAccountLoginOptions, BeginAccountLoginOptions {
     onStatus?: (status: AccountLoginStatus) => void;
     signal?: AbortSignal;
+    /**
+     * Inactivity budget: the login fails when the isolated home has not changed
+     * for this long. Default 180 s.
+     */
     timeoutMs?: number;
+    /** Hard ceiling while the child is alive. Default 900 s. */
+    maxTimeoutMs?: number;
     stdio?: 'inherit' | 'pipe';
-    loginCommand?: AccountLoginCommand;
 }
 export interface ListAllAccountsResult {
     claude: AccountEntry[];
     codex: SavedAccountProfile[];
     activeByProvider: Record<AccountProviderId, string | null>;
 }
+/**
+ * `claude auth login` signs in without the interactive first-run flow the bare
+ * `claude /login` form triggers in a fresh config directory. Override with
+ * `SIDEKICK_CLAUDE_LOGIN_ARGS` (space separated) for older CLIs.
+ */
 export declare function resolveClaudeLoginCommand(opts?: {
     loginCommand?: AccountLoginCommand;
 }): AccountLoginCommand;
-export declare function beginAccountLogin(provider: AccountProviderId, label: string, opts?: {
-    loginCommand?: AccountLoginCommand;
-}): BeginAccountLoginResult;
+export declare function beginAccountLogin(provider: AccountProviderId, label: string, opts?: BeginAccountLoginOptions): BeginAccountLoginResult;
 export declare function getAccountLoginStatus(provider: AccountProviderId, loginId: string): AccountLoginStatus;
 /**
  * {@link getAccountLoginStatus} without blocking the event loop on the codex
@@ -56,10 +74,17 @@ export declare function finalizeAccountLogin(provider: AccountProviderId, loginI
 /** {@link finalizeAccountLogin} without blocking the event loop on CLI probes. */
 export declare function finalizeAccountLoginAsync(provider: AccountProviderId, loginId: string, opts?: FinalizeAccountLoginOptions): Promise<AccountManagerResult>;
 export declare function spawnAccountLogin(provider: AccountProviderId, label: string, opts?: SpawnAccountLoginOptions): Promise<AccountManagerResult>;
-export declare function switchAccount(provider: AccountProviderId, id: string): AccountManagerResult;
+export declare function switchAccount(provider: AccountProviderId, id: string, options?: SwitchAccountOptions): SwitchAccountResult;
 /**
- * {@link switchAccount} without blocking the event loop on codex CLI probes.
+ * {@link switchAccount} without blocking the event loop on CLI/process probes.
  * The Claude path still performs bounded synchronous keychain reads on macOS.
  */
-export declare function switchAccountAsync(provider: AccountProviderId, id: string): Promise<AccountManagerResult>;
+export declare function switchAccountAsync(provider: AccountProviderId, id: string, options?: SwitchAccountOptions): Promise<SwitchAccountResult>;
+export declare function getLastSwitch(provider: AccountProviderId): LastSwitchRecord | null;
+/**
+ * Switch back to the account that was live before the last recorded switch.
+ * With `token`, the record must match (a stale Undo button never reverts a
+ * newer switch).
+ */
+export declare function undoLastSwitch(provider: AccountProviderId, token?: string): Promise<SwitchAccountResult>;
 export declare function listAllAccounts(): ListAllAccountsResult;