openmates 0.18.0-alpha.2 → 0.18.0-alpha.4

package/dist/{chunk-XKIFO4JO.js → chunk-EKALVG2T.js}

@@ -1015,6 +1015,10 @@ var OpenMatesHttpClient = class {
   getCookieMap() {
     return Object.fromEntries(this.cookies.entries());
   }
+  replaceCookies(cookies) {
+    this.cookies.clear();
+    for (const [name, value] of Object.entries(cookies)) this.cookies.set(name, value);
+  }
   async get(path2, headers = {}) {
     return this.request("GET", path2, void 0, headers);
   }
@@ -1194,8 +1198,10 @@ import {
   readdirSync,
   readFileSync as readFileSync2,
   rmSync,
+  renameSync,
   writeFileSync
 } from "fs";
+import lockfile from "proper-lockfile";
 import { createHash as createHash4 } from "crypto";
 import { homedir as homedir2 } from "os";
 import { isAbsolute, join, resolve } from "path";
@@ -1483,7 +1489,55 @@ function saveAnonymousId(anonymousId) {
     createdAt: Math.floor(Date.now() / 1e3)
   });
 }
-function saveSession(session) {
+var SESSION_LOCK_STALE_MS = 3e4;
+var SESSION_LOCK_POLL_MS = 50;
+async function withSessionRefreshLock(operation) {
+  const path2 = join(ensureStateDir(), "session.json");
+  const release2 = await lockfile.lock(`${path2}.refresh`, {
+    realpath: false,
+    stale: SESSION_LOCK_STALE_MS,
+    retries: { retries: 600, factor: 1, minTimeout: SESSION_LOCK_POLL_MS, maxTimeout: SESSION_LOCK_POLL_MS }
+  });
+  try {
+    return await operation();
+  } finally {
+    await release2();
+  }
+}
+function saveSession(session, options = {}) {
+  const path2 = join(ensureStateDir(), "session.json");
+  let release2;
+  const waitCell = new Int32Array(new SharedArrayBuffer(4));
+  for (let attempt = 0; ; attempt++) {
+    try {
+      release2 = lockfile.lockSync(`${path2}.write`, { realpath: false, stale: SESSION_LOCK_STALE_MS });
+      break;
+    } catch (error) {
+      if (error.code !== "ELOCKED" || attempt >= 100) throw error;
+      Atomics.wait(waitCell, 0, 0, SESSION_LOCK_POLL_MS);
+    }
+  }
+  try {
+    const current = readJsonFile(path2);
+    if (current && !options.replace) {
+      if (current.sessionId !== session.sessionId || current.hashedEmail !== session.hashedEmail || current.apiUrl !== session.apiUrl) {
+        throw new Error("Login session changed in another process. Retry the command using the current profile.");
+      }
+      if (options.expectedRefreshToken !== void 0) {
+        if (current.cookies.auth_refresh_token !== options.expectedRefreshToken) {
+          throw new Error("Login credentials changed during refresh. Retry with the current profile.");
+        }
+      } else {
+        session.cookies = { ...current.cookies };
+        session.wsToken = current.wsToken;
+      }
+    }
+    writeSession(session);
+  } finally {
+    release2();
+  }
+}
+function writeSession(session) {
   const filePath = join(ensureStateDir(), "session.json");
   const result = storeMasterKey(session.masterKeyExportedB64, resolveKeyStorageId(session.hashedEmail));
   const onDisk = {
@@ -1516,7 +1570,13 @@ function saveSession(session) {
       onDisk.emailEncryptionKeyB64 = session.emailEncryptionKeyB64;
     }
   }
-  writeJsonFile(filePath, onDisk);
+  const temporary = `${filePath}.${process.pid}.tmp`;
+  try {
+    writeJsonFile(temporary, onDisk);
+    renameSync(temporary, filePath);
+  } finally {
+    rmSync(temporary, { force: true });
+  }
   if (result.type !== "plaintext") {
     process.stderr.write("Decrypting data...\n");
   }
@@ -7509,7 +7569,9 @@ var OpenMatesClient = class _OpenMatesClient {
   apiUrl;
   session;
   http;
+  explicitSession;
   constructor(options = {}) {
+    this.explicitSession = options.session !== void 0;
     const diskSession = options.session ?? this.getValidSessionFromDisk();
     this.apiUrl = (options.apiUrl ?? process.env.OPENMATES_API_URL ?? diskSession?.apiUrl ?? loadDefaultServerApiUrl() ?? DEFAULT_API_URL).replace(/\/$/, "");
     this.session = diskSession;
@@ -8570,31 +8632,34 @@ var OpenMatesClient = class _OpenMatesClient {
     };
     await this.hydrateEmailEncryptionKey(session);
     this.session = session;
-    saveSession(session);
+    saveSession(session, { replace: true });
   }
   async whoAmI() {
-    const session = this.requireSession();
-    const response = await this.http.post(
-      "/v1/auth/session",
-      { session_id: session.sessionId },
-      this.getCliRequestHeaders()
-    );
-    if (!response.ok || !response.data.success) {
-      if (response.status === 502 || response.status === 503 || response.status === 504) {
+    return this.withFreshStoredSession(async () => {
+      const session = this.requireSession();
+      const previousRefreshToken = session.cookies.auth_refresh_token;
+      const response = await this.http.post(
+        "/v1/auth/session",
+        { session_id: session.sessionId },
+        this.getCliRequestHeaders()
+      );
+      if (!response.ok || !response.data.success) {
+        if (response.status === 502 || response.status === 503 || response.status === 504) {
+          throw new Error(
+            `Session validation temporarily unavailable (HTTP ${response.status}). The API may be restarting; retry shortly.`
+          );
+        }
         throw new Error(
-          `Session validation temporarily unavailable (HTTP ${response.status}). The API may be restarting; retry shortly.`
+          `Session validation failed (HTTP ${response.status}): ${response.data.message ?? "invalid session"}${response.data.re_auth_reason ? ` (${response.data.re_auth_reason})` : ""}. Please run \`${this.loginRecoveryCommand()}\`.`
         );
       }
-      throw new Error(
-        `Session validation failed (HTTP ${response.status}): ${response.data.message ?? "invalid session"}${response.data.re_auth_reason ? ` (${response.data.re_auth_reason})` : ""}. Please run \`openmates login\`.`
-      );
-    }
-    if (response.data.ws_token) {
-      session.wsToken = response.data.ws_token;
-    }
-    session.cookies = this.http.getCookieMap();
-    saveSession(session);
-    return response.data.user ?? {};
+      if (response.data.ws_token) {
+        session.wsToken = response.data.ws_token;
+      }
+      session.cookies = this.http.getCookieMap();
+      saveSession(session, { expectedRefreshToken: previousRefreshToken });
+      return response.data.user ?? {};
+    });
   }
   async getTopicPreferences() {
     const user = await this.whoAmI();
@@ -8734,7 +8799,7 @@ var OpenMatesClient = class _OpenMatesClient {
       authorizerDeviceName: null,
       autoLogoutMinutes: null
     };
-    saveSession(session);
+    saveSession(session, { replace: true });
     this.session = session;
     return {
       success: true,
@@ -13974,8 +14039,9 @@ Required: ${schema.required.join(", ")}`
     const session = this.requireSession();
     const currentCookies = this.http.getCookieMap();
     if (JSON.stringify(session.cookies) !== JSON.stringify(currentCookies)) {
+      const previousRefreshToken = session.cookies.auth_refresh_token;
       session.cookies = currentCookies;
-      saveSession(session);
+      saveSession(session, { expectedRefreshToken: previousRefreshToken });
     }
     return session;
   }
@@ -14445,9 +14511,30 @@ Required: ${schema.required.join(", ")}`
       session.userEmailSalt
     );
   }
+  async withFreshStoredSession(operation) {
+    return withSessionRefreshLock(async () => {
+      const previous = this.requireSession();
+      const current = loadSession();
+      if (!current && !this.explicitSession) {
+        throw new Error("Login session was removed. Log in to the current profile before retrying.");
+      }
+      if (current && !this.explicitSession) {
+        if (current.hashedEmail !== previous.hashedEmail || current.apiUrl !== previous.apiUrl) {
+          throw new Error("Login account changed in another process. Retry using the current profile.");
+        }
+        this.session = current;
+        this.http.replaceCookies(current.cookies);
+      }
+      return operation();
+    });
+  }
+  loginRecoveryCommand() {
+    const profile = process.env.OPENMATES_PROFILE?.trim();
+    return profile ? `openmates --profile ${profile} login` : "openmates login";
+  }
   requireSession() {
     if (!this.session) {
-      throw new Error("Not logged in. Run `openmates login`.");
+      throw new Error(`Not logged in. Run \`${this.loginRecoveryCommand()}\`.`);
     }
     return this.session;
   }
@@ -14527,24 +14614,30 @@ Required: ${schema.required.join(", ")}`
    * This method fetches a fresh ws_token and captures any rotated cookies.
    */
   async refreshWsToken() {
-    const session = this.requireSession();
-    let res;
-    try {
-      res = await this.http.post("/v1/auth/session", { session_id: session.sessionId }, this.getCliRequestHeaders());
-    } catch {
-      return null;
-    }
-    if (!res.ok || res.data.success === false) {
-      purgeLocalPrivateData();
-      this.session = null;
-      throw new Error("Session expired or invalid. Please run `openmates login` to re-authenticate.");
-    }
-    if (res.data.ws_token) {
-      session.wsToken = res.data.ws_token;
-    }
-    session.cookies = this.http.getCookieMap();
-    saveSession(session);
-    return typeof res.data.user?.id === "string" ? res.data.user.id : typeof res.data.user?.user_id === "string" ? res.data.user.user_id : null;
+    return this.withFreshStoredSession(async () => {
+      const session = this.requireSession();
+      const previousRefreshToken = session.cookies.auth_refresh_token;
+      let res;
+      try {
+        res = await this.http.post("/v1/auth/session", { session_id: session.sessionId }, this.getCliRequestHeaders());
+      } catch {
+        return null;
+      }
+      if (res.status >= 500) {
+        throw new Error(`Session validation temporarily unavailable (HTTP ${res.status}). Retry shortly.`);
+      }
+      if (!res.ok || res.data.success === false) {
+        purgeLocalPrivateData();
+        this.session = null;
+        throw new Error(`Session expired or invalid. Please run \`${this.loginRecoveryCommand()}\` to re-authenticate.`);
+      }
+      if (res.data.ws_token) {
+        session.wsToken = res.data.ws_token;
+      }
+      session.cookies = this.http.getCookieMap();
+      saveSession(session, { expectedRefreshToken: previousRefreshToken });
+      return typeof res.data.user?.id === "string" ? res.data.user.id : typeof res.data.user?.user_id === "string" ? res.data.user.user_id : null;
+    });
   }
   /**
    * Ensure the local sync cache is up to date. If the cache is fresh,
@@ -20131,12 +20224,12 @@ var ACCOUNT_EXPORT_FORBIDDEN_VALUE_PATTERNS = [
 ];
 async function writeAccountExportArchive(bundle, flags = {}) {
   const { mkdir: mkdir2, writeFile: writeFile2 } = await import("fs/promises");
-  const { join: join11, dirname: dirname10 } = await import("path");
+  const { join: join12, dirname: dirname11 } = await import("path");
   const exportId = safeArchiveSegment(String(bundle.export.export_id ?? `export-${Date.now()}`));
   const archiveFormat = flags.format === "directory" ? "directory" : "zip";
   const password = typeof flags.password === "string" && flags.password.length > 0 ? flags.password : null;
   if (password && archiveFormat !== "zip") throw new Error("Password-protected account export is only supported for zip format.");
-  const outputPath = typeof flags.output === "string" ? flags.output : join11(process.cwd(), archiveFormat === "zip" ? `openmates-account-export-${exportId}${password ? ".zip.enc" : ".zip"}` : `openmates-account-export-${exportId}`);
+  const outputPath = typeof flags.output === "string" ? flags.output : join12(process.cwd(), archiveFormat === "zip" ? `openmates-account-export-${exportId}${password ? ".zip.enc" : ".zip"}` : `openmates-account-export-${exportId}`);
   const zip = archiveFormat === "zip" ? new JSZip3() : null;
   const writtenFiles = [];
   async function writeArchiveText(relativePath, content) {
@@ -20147,8 +20240,8 @@ async function writeAccountExportArchive(bundle, flags = {}) {
       return;
     }
     const stagingDir = outputPath;
-    const fullPath = join11(stagingDir, relativePath);
-    await mkdir2(dirname10(fullPath), { recursive: true });
+    const fullPath = join12(stagingDir, relativePath);
+    await mkdir2(dirname11(fullPath), { recursive: true });
     await writeFile2(fullPath, content, "utf-8");
     writtenFiles.push(relativePath);
   }
@@ -20165,7 +20258,7 @@ async function writeAccountExportArchive(bundle, flags = {}) {
   }
   await writeAccountExportChatFiles(domainPayloads.chats ?? [], writeArchiveText);
   if (archiveFormat === "directory") return { output: outputPath, format: "directory", files: writtenFiles.length };
-  await mkdir2(dirname10(outputPath), { recursive: true });
+  await mkdir2(dirname11(outputPath), { recursive: true });
   const zipBuffer = await zip.generateAsync({ type: "nodebuffer", compression: "DEFLATE" });
   await writeFile2(outputPath, password ? encryptZipBuffer(zipBuffer, password) : zipBuffer);
   return { output: outputPath, format: "zip", files: writtenFiles.length, ...password ? { encrypted: true } : {} };
@@ -24298,9 +24391,9 @@ var OpenMatesBenchmark = class {
 // src/cli.ts
 import { createInterface as createInterface5 } from "readline/promises";
 import { stdin as stdin3, stdout as stdout2 } from "process";
-import { existsSync as existsSync13, readFileSync as readFileSync12, realpathSync as realpathSync2, writeFileSync as writeFileSync9 } from "fs";
-import { fileURLToPath as fileURLToPath2 } from "url";
-import { basename as basename3, dirname as dirname9 } from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync12, realpathSync as realpathSync2, writeFileSync as writeFileSync10 } from "fs";
+import { fileURLToPath as fileURLToPath3 } from "url";
+import { basename as basename4, dirname as dirname10 } from "path";
 import { createHash as createHash14, randomBytes as randomBytes9, randomUUID as randomUUID15 } from "crypto";
 import { arch as arch2, platform as platform3 } from "os";
 import { parse as parseYaml } from "yaml";
@@ -27194,7 +27287,7 @@ function shouldAutoInstallRuntimeMonitoringServices(env) {
 
 // src/serverBackupArchive.ts
 import { execFileSync as execFileSync3 } from "child_process";
-import { chmodSync as chmodSync3, lstatSync, readdirSync as readdirSync3, renameSync, rmSync as rmSync4 } from "fs";
+import { chmodSync as chmodSync3, lstatSync, readdirSync as readdirSync3, renameSync as renameSync2, rmSync as rmSync4 } from "fs";
 import { randomUUID as randomUUID8 } from "crypto";
 function assertRegularBackupTree(path2) {
   const stat2 = lstatSync(path2);
@@ -27213,7 +27306,7 @@ function publishServerBackupArchive(sourceDir, archivePath, options = {}) {
   try {
     execFileSync3(options.tarCommand ?? "tar", ["-czf", temporaryArchivePath, "-C", sourceDir, "."], { stdio: "pipe" });
     chmodSync3(temporaryArchivePath, 384);
-    renameSync(temporaryArchivePath, archivePath);
+    renameSync2(temporaryArchivePath, archivePath);
     chmodSync3(archivePath, 384);
   } finally {
     process.umask(previousUmask);
@@ -27815,7 +27908,7 @@ function signRuntimeWebhookPayload(payload, secret, timestamp, eventId) {
 
 // src/serverUpdateState.ts
 import { randomBytes as randomBytes7 } from "crypto";
-import { chmodSync as chmodSync4, closeSync, existsSync as existsSync8, mkdirSync as mkdirSync5, openSync, readFileSync as readFileSync6, renameSync as renameSync2, rmSync as rmSync5, writeFileSync as writeFileSync4 } from "fs";
+import { chmodSync as chmodSync4, closeSync, existsSync as existsSync8, mkdirSync as mkdirSync5, openSync, readFileSync as readFileSync6, renameSync as renameSync3, rmSync as rmSync5, writeFileSync as writeFileSync4 } from "fs";
 import { dirname as dirname5, join as join6 } from "path";
 function serverUpdateStatusFile(installPath, role) {
   return join6(installPath, ".openmates", `${role}-update-status.json`);
@@ -27839,7 +27932,7 @@ function writeServerUpdateStatus(installPath, role, status) {
   const temporaryPath = `${filePath}.${process.pid}.${randomBytes7(4).toString("hex")}.tmp`;
   writeFileSync4(temporaryPath, `${JSON.stringify({ role, updated_at: (/* @__PURE__ */ new Date()).toISOString(), ...status }, null, 2)}
 `, { mode: 384 });
-  renameSync2(temporaryPath, filePath);
+  renameSync3(temporaryPath, filePath);
   chmodSync4(filePath, 384);
 }
 function acquireServerUpdateLock(installPath) {
@@ -48948,9 +49041,9 @@ function basenameFromUrl(url) {
   return withoutQuery.split("/").pop()?.replace(/[^a-zA-Z0-9._-]/g, "_") ?? "";
 }
 function extensionFromUrl(url) {
-  const basename4 = basenameFromUrl(url);
-  const dotIndex = basename4.lastIndexOf(".");
-  return dotIndex > 0 ? basename4.slice(dotIndex + 1).toLowerCase() : "";
+  const basename5 = basenameFromUrl(url);
+  const dotIndex = basename5.lastIndexOf(".");
+  return dotIndex > 0 ? basename5.slice(dotIndex + 1).toLowerCase() : "";
 }
 function extensionFromLanguage(language) {
   const normalized = language.toLowerCase();
@@ -74429,9 +74522,64 @@ function remoteErrorMessage(code) {
 
 // src/selfUpdate.ts
 import { spawnSync as spawnSync3 } from "child_process";
-import { readFileSync as readFileSync10 } from "fs";
+import { readFileSync as readFileSync10, mkdirSync as mkdirSync8, writeFileSync as writeFileSync8, renameSync as renameSync4 } from "fs";
+import { homedir as homedir8 } from "os";
+import { dirname as dirname8, basename as basename3, join as join10 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
 var PACKAGE_NAME = "openmates";
-var DEFAULT_TARGET = "latest";
+function channelFile() {
+  return join10(homedir8(), ".openmates", "updates.json");
+}
+function parseChannel(value) {
+  if (value === "dev") return "dev";
+  if (value === "stable" || value === "main") return "stable";
+  throw new Error("--channel must be dev, stable, or main (alias for stable)");
+}
+function savedChannel() {
+  try {
+    return parseChannel(JSON.parse(readFileSync10(channelFile(), "utf8")).channel);
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return getCliPackageVersion().includes("-") ? "dev" : "stable";
+    }
+    throw error;
+  }
+}
+function persistSelfUpdateChannel(plan) {
+  if (plan.dryRun || !plan.persistChannel) return;
+  const path2 = channelFile();
+  mkdirSync8(dirname8(path2), { recursive: true, mode: 448 });
+  const temporary = `${path2}.${process.pid}.tmp`;
+  writeFileSync8(temporary, JSON.stringify({ channel: plan.channel }) + "\n", { mode: 384 });
+  renameSync4(temporary, path2);
+}
+function installedNpmPrefix(moduleUrl = import.meta.url, platform4 = process.platform) {
+  const packageRoot = dirname8(dirname8(fileURLToPath2(moduleUrl)));
+  const modules = dirname8(packageRoot);
+  if (basename3(packageRoot) !== PACKAGE_NAME || basename3(modules) !== "node_modules") return null;
+  if (platform4 === "win32") return dirname8(modules);
+  return basename3(dirname8(modules)) === "lib" ? dirname8(dirname8(modules)) : null;
+}
+function compareVersions(left, right) {
+  const parse = (value) => {
+    const match = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(value);
+    if (!match) throw new Error(`Cannot compare CLI version '${value}'`);
+    return { core: match.slice(1, 4).map(BigInt), pre: match[4]?.split(".") };
+  };
+  const a = parse(left), b = parse(right);
+  for (let i = 0; i < 3; i++) if (a.core[i] !== b.core[i]) return a.core[i] > b.core[i] ? 1 : -1;
+  if (!a.pre || !b.pre) return a.pre ? -1 : b.pre ? 1 : 0;
+  for (let i = 0; i < Math.max(a.pre.length, b.pre.length); i++) {
+    const x = a.pre[i], y = b.pre[i];
+    if (x === y) continue;
+    if (x === void 0 || y === void 0) return x === void 0 ? -1 : 1;
+    const nx = /^\d+$/.test(x), ny = /^\d+$/.test(y);
+    if (nx && ny) return BigInt(x) > BigInt(y) ? 1 : BigInt(x) < BigInt(y) ? -1 : 0;
+    if (nx !== ny) return nx ? -1 : 1;
+    return x > y ? 1 : -1;
+  }
+  return 0;
+}
 var SAFE_TARGET_RE = /^[a-zA-Z0-9._@+~:-]+$/;
 function getCliPackageVersion() {
   try {
@@ -74443,10 +74591,14 @@ function getCliPackageVersion() {
 }
 function buildSelfUpdatePlan(flags) {
   const packageManager = parsePackageManager(flags["package-manager"]);
-  const target = parseTarget(flags.version);
+  const channel = flags.channel === void 0 ? savedChannel() : parseChannel(flags.channel);
+  const target = parseTarget(flags.version ?? (channel === "dev" ? "alpha" : "latest"));
   const packageSpec = `${PACKAGE_NAME}@${target}`;
   const { command, args } = commandForPackageManager(packageManager, packageSpec);
   return {
+    channel,
+    persistChannel: flags.channel !== void 0,
+    allowDowngrade: flags["allow-downgrade"] === true,
     packageManager,
     command,
     args,
@@ -74469,7 +74621,7 @@ function checkSelfUpdateStatus(plan) {
   return {
     currentVersion: plan.currentVersion,
     latestVersion: latest.version,
-    updateAvailable: plan.currentVersion !== latest.version,
+    updateAvailable: compareVersions(latest.version, plan.currentVersion) > 0 || plan.allowDowngrade && compareVersions(latest.version, plan.currentVersion) !== 0,
     checkError: null
   };
 }
@@ -74499,7 +74651,8 @@ function resolveTargetVersion(target) {
   }
   const result = spawnSync3(commandName("npm"), ["view", `${PACKAGE_NAME}@${target}`, "version"], {
     encoding: "utf-8",
-    stdio: ["ignore", "pipe", "pipe"]
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout: 3e4
   });
   if (result.error) return { version: null, error: result.error.message };
   if (result.status !== 0) {
@@ -74515,7 +74668,7 @@ function parsePackageManager(value) {
   throw new Error("--package-manager must be one of npm, pnpm, yarn, or bun");
 }
 function parseTarget(value) {
-  if (value === void 0) return DEFAULT_TARGET;
+  if (value === void 0) return "latest";
   if (typeof value !== "string" || value.length === 0) {
     throw new Error("--version requires a version or npm dist-tag");
   }
@@ -74535,15 +74688,16 @@ function commandForPackageManager(packageManager, packageSpec) {
   if (packageManager === "pnpm") return { command: commandName("pnpm"), args: ["add", "-g", packageSpec] };
   if (packageManager === "yarn") return { command: commandName("yarn"), args: ["global", "add", packageSpec] };
   if (packageManager === "bun") return { command: commandName("bun"), args: ["install", "-g", packageSpec] };
-  return { command: commandName("npm"), args: ["install", "-g", packageSpec] };
+  const prefix = installedNpmPrefix();
+  return { command: commandName("npm"), args: ["install", "-g", packageSpec, ...prefix ? ["--prefix", prefix] : []] };
 }
 function commandName(name) {
   return process.platform === "win32" ? `${name}.cmd` : name;
 }
 
 // src/workRecovery.ts
-import { mkdirSync as mkdirSync8, renameSync as renameSync3, writeFileSync as writeFileSync8 } from "fs";
-import { dirname as dirname8 } from "path";
+import { mkdirSync as mkdirSync9, renameSync as renameSync5, writeFileSync as writeFileSync9 } from "fs";
+import { dirname as dirname9 } from "path";
 import { stringify } from "yaml";
 async function projectPlanAssumption(plan, masterKey, assumption) {
   const key = await planKeyFromRecord(plan.encrypted, masterKey);
@@ -74722,18 +74876,18 @@ function collectMismatchPaths(left, right, path2, mismatches) {
 }
 function writeWorkRecoveryAtomically(path2, document) {
   validateWorkRecoveryDocument(document);
-  mkdirSync8(dirname8(path2), { recursive: true, mode: 448 });
+  mkdirSync9(dirname9(path2), { recursive: true, mode: 448 });
   const temporaryPath = `${path2}.tmp`;
-  writeFileSync8(temporaryPath, stringify(document, { sortMapEntries: true, lineWidth: 0 }), { encoding: "utf8", mode: 384 });
-  renameSync3(temporaryPath, path2);
+  writeFileSync9(temporaryPath, stringify(document, { sortMapEntries: true, lineWidth: 0 }), { encoding: "utf8", mode: 384 });
+  renameSync5(temporaryPath, path2);
 }
 
 // src/revolutBusinessCertificate.ts
 import { execFileSync as execFileSync5 } from "child_process";
 import { createSign, randomUUID as randomUUID14 } from "crypto";
-import { chmodSync as chmodSync7, existsSync as existsSync12, mkdirSync as mkdirSync9, readFileSync as readFileSync11 } from "fs";
-import { homedir as homedir8 } from "os";
-import { join as join10, resolve as resolve10 } from "path";
+import { chmodSync as chmodSync7, existsSync as existsSync12, mkdirSync as mkdirSync10, readFileSync as readFileSync11 } from "fs";
+import { homedir as homedir9 } from "os";
+import { join as join11, resolve as resolve10 } from "path";
 var REVOLUT_BUSINESS_CERTIFICATE_DOCS_URL = "https://developer.revolut.com/docs/guides/manage-accounts/get-started/make-your-first-api-request#generate-a-private-and-a-public-certificate";
 var REVOLUT_BUSINESS_DEFAULT_SANDBOX_REDIRECT_URI = "https://app.dev.openmates.org/oauth/revolut-business/callback";
 var REVOLUT_BUSINESS_DEFAULT_PRODUCTION_REDIRECT_URI = "https://openmates.org/oauth/revolut-business/callback";
@@ -74743,7 +74897,7 @@ var REVOLUT_BUSINESS_AUDIENCE = "https://revolut.com";
 var CERTIFICATE_DAYS = "1825";
 var RSA_BITS = "2048";
 function defaultRevolutBusinessCertificateDir(environment) {
-  return join10(homedir8(), ".openmates", "revolut-business", environment);
+  return join11(homedir9(), ".openmates", "revolut-business", environment);
 }
 function defaultRevolutBusinessRedirectUri(environment) {
   return environment === "sandbox" ? REVOLUT_BUSINESS_DEFAULT_SANDBOX_REDIRECT_URI : REVOLUT_BUSINESS_DEFAULT_PRODUCTION_REDIRECT_URI;
@@ -74766,7 +74920,7 @@ async function exchangeRevolutBusinessAuthorizationCode(options) {
   if (!clientId) throw new Error("Missing Revolut Business client ID.");
   const code = extractRevolutBusinessAuthorizationCode(options.codeOrRedirectUrl);
   if (!code) throw new Error("Missing Revolut Business authorization code.");
-  const privateKeyPem = options.privateKeyPem ?? readFileSync11(options.privateKeyPath ?? join10(defaultRevolutBusinessCertificateDir(environment), "privatecert.pem"), "utf8");
+  const privateKeyPem = options.privateKeyPem ?? readFileSync11(options.privateKeyPath ?? join11(defaultRevolutBusinessCertificateDir(environment), "privatecert.pem"), "utf8");
   const redirectUri = (options.redirectUri ?? defaultRevolutBusinessRedirectUri(environment)).trim();
   const clientAssertion = generateRevolutBusinessClientAssertion({ clientId, privateKeyPem, redirectUri });
   const response = await fetch(environment === "sandbox" ? "https://sandbox-b2b.revolut.com/api/1.0/auth/token" : "https://b2b.revolut.com/api/1.0/auth/token", {
@@ -74819,10 +74973,10 @@ function generateRevolutBusinessCertificate(options = {}) {
   const redirectUri = (options.redirectUri ?? defaultRevolutBusinessRedirectUri(environment)).trim();
   if (!title) throw new Error("Revolut certificate title must not be empty.");
   if (!redirectUri.startsWith("https://")) throw new Error("Revolut OAuth redirect URI must start with https://.");
-  mkdirSync9(outputDir, { recursive: true, mode: 448 });
+  mkdirSync10(outputDir, { recursive: true, mode: 448 });
   chmodSync7(outputDir, 448);
-  const privateKeyPath = join10(outputDir, "privatecert.pem");
-  const publicCertificatePath = join10(outputDir, "publiccert.cer");
+  const privateKeyPath = join11(outputDir, "privatecert.pem");
+  const publicCertificatePath = join11(outputDir, "publiccert.cer");
   if (!options.overwrite && (existsSync12(privateKeyPath) || existsSync12(publicCertificatePath))) {
     throw new Error(`Revolut certificate files already exist in ${outputDir}. Re-run with --overwrite to replace them.`);
   }
@@ -74883,6 +75037,15 @@ async function main() {
     assertTrustedAccountGuardEnvironment(parsed.flags);
     assertTrustedAccountCommandAllowed(command);
   }
+  if (parsed.flags.profile !== void 0) {
+    const profile = parsed.flags.profile;
+    if (typeof profile !== "string" || !profile) throw new Error("--profile requires a profile name");
+    resolveStateDir({ profile, stateDir: "" });
+    if (process.env.OPENMATES_STATE_DIR?.trim()) {
+      throw new Error("--profile cannot be combined with OPENMATES_STATE_DIR");
+    }
+    process.env.OPENMATES_PROFILE = profile;
+  }
   const client = OpenMatesClient.load({
     apiUrl: typeof parsed.flags["api-url"] === "string" ? parsed.flags["api-url"] : void 0
   });
@@ -75248,6 +75411,9 @@ function assertTrustedAccountCommandAllowed(command) {
   }
 }
 function assertTrustedAccountGuardEnvironment(flags, environment = process.env) {
+  if (flags.profile !== void 0 && flags.profile !== TRUST_GUARD_PROFILE) {
+    throw new Error(`Trusted OpenCode CLI commands cannot override profile ${TRUST_GUARD_PROFILE}.`);
+  }
   if (environment.OPENMATES_PROFILE !== TRUST_GUARD_PROFILE) {
     throw new Error(`Trusted OpenCode CLI commands require OPENMATES_PROFILE=${TRUST_GUARD_PROFILE}.`);
   }
@@ -75287,11 +75453,14 @@ function handleSupport(flags) {
 function handleSelfUpdate(command, flags) {
   const plan = buildSelfUpdatePlan(flags);
   const status = checkSelfUpdateStatus(plan);
-  const shouldInstall = status.updateAvailable !== false;
+  if (status.checkError) throw new Error(`Update check failed: ${status.checkError}`);
+  const shouldInstall = status.updateAvailable === true;
   if (flags.json === true) {
     if (!plan.dryRun && shouldInstall) runSelfUpdate(plan, { verbose: flags.verbose === true });
+    persistSelfUpdateChannel(plan);
     printJson2({
       command,
+      channel: plan.channel,
       status: status.updateAvailable === false ? "up_to_date" : plan.dryRun ? "planned" : "success",
       current_version: plan.currentVersion,
       latest_version: status.latestVersion,
@@ -75308,6 +75477,7 @@ function handleSelfUpdate(command, flags) {
   console.log("");
   console.log("Checking for updates...");
   console.log("");
+  console.log(`Release channel: ${plan.channel}`);
   console.log(`Current version: ${plan.currentVersion}`);
   console.log(`Latest version:  ${status.latestVersion ?? "unknown"}`);
   if (status.checkError) {
@@ -75323,11 +75493,13 @@ function handleSelfUpdate(command, flags) {
     return;
   }
   if (status.updateAvailable === false) {
+    persistSelfUpdateChannel(plan);
     console.log("OpenMates CLI is already up to date.");
     return;
   }
   console.log(`Updating OpenMates CLI with ${plan.packageManager}...`);
   runSelfUpdate(plan, { verbose: flags.verbose === true });
+  persistSelfUpdateChannel(plan);
   console.log(`Installed OpenMates CLI ${status.latestVersion ?? plan.target}.`);
   console.log("");
   console.log("OpenMates is up to date.");
@@ -75340,6 +75512,7 @@ function handleCliVersion(flags) {
   if (flags.json === true) {
     printJson2({
       command: "version",
+      channel: plan.channel,
       current_version: status.currentVersion,
       latest_version: status.latestVersion,
       update_available: status.updateAvailable,
@@ -75349,6 +75522,7 @@ function handleCliVersion(flags) {
     return;
   }
   console.log(`OpenMates CLI ${status.currentVersion}`);
+  console.log(`Release channel: ${plan.channel}`);
   if (status.checkError) {
     console.log(`Update check failed: ${status.checkError}`);
     return;
@@ -77740,7 +77914,7 @@ async function handleTeams(client, subcommand, rest, flags) {
     if (action === "get") {
       const output = requiredStringFlag(flags.output ?? flags.file ?? rest[2], "--output <path>");
       const image = await client.getTeamProfileImage(teamId);
-      writeFileSync9(output, image.data, { mode: 384 });
+      writeFileSync10(output, image.data, { mode: 384 });
       if (flags.json === true) printJson2({ output, content_type: image.contentType, size_bytes: image.data.byteLength });
       else console.log(`Team profile image written: ${output}`);
       return;
@@ -77899,7 +78073,7 @@ async function handleTeams(client, subcommand, rest, flags) {
     const output = requiredStringFlag(flags.output, "--output <path>");
     const result = await client.exportTeamData(teamId);
     const artifact = result.artifact && typeof result.artifact === "object" ? result.artifact : result;
-    writeFileSync9(output, `${JSON.stringify(artifact, null, 2)}
+    writeFileSync10(output, `${JSON.stringify(artifact, null, 2)}
 `, { encoding: "utf-8", mode: 384 });
     if (flags.json === true) printJson2({ ...result, output });
     else console.log(`Team export written: ${output}`);
@@ -78349,7 +78523,7 @@ async function resolveRemoteAccessBindings(client, masterKey, projects, candidat
     const answer = (await promptLine2(`Create ${unresolved.length} missing Project${unresolved.length === 1 ? "" : "s"}? [y/N] `)).trim().toLowerCase();
     if (answer !== "y" && answer !== "yes") throw new Error("Remote access Project creation cancelled.");
     for (const rootPath of unresolved) {
-      const project = await createEncryptedRemoteAccessProject(client, masterKey, basename3(rootPath), context);
+      const project = await createEncryptedRemoteAccessProject(client, masterKey, basename4(rootPath), context);
       resolved.push({ rootPath, project, sourceId: randomUUID15() });
     }
   }
@@ -78361,7 +78535,7 @@ async function resolveRemoteAccessBindings(client, masterKey, projects, candidat
       projectId: item.project.projectId,
       rootPath: item.rootPath,
       sourceType,
-      displayName: basename3(item.rootPath)
+      displayName: basename4(item.rootPath)
     });
     const remoteSources = await client.listProjectSources(item.project.projectId, context);
     const remoteSource = remoteSources.find((entry) => entry.source_id === source.sourceId);
@@ -79204,16 +79378,16 @@ ${deleted}/${resolved.length} chat(s) deleted.`);
       }
     }
     const { mkdir: mkdir2, writeFile: writeFile2 } = await import("fs/promises");
-    const { join: join11 } = await import("path");
+    const { join: join12 } = await import("path");
     if (useZip) {
-      const tmpDir = join11(outputDir, `.${filenameBase}_tmp`);
+      const tmpDir = join12(outputDir, `.${filenameBase}_tmp`);
       await mkdir2(tmpDir, { recursive: true });
-      await writeFile2(join11(tmpDir, `${filenameBase}.yml`), yamlContent);
-      await writeFile2(join11(tmpDir, `${filenameBase}.md`), mdContent);
+      await writeFile2(join12(tmpDir, `${filenameBase}.yml`), yamlContent);
+      await writeFile2(join12(tmpDir, `${filenameBase}.md`), mdContent);
       if (codeEmbeds.length > 0) {
         for (const ce of codeEmbeds) {
           const fpath = ce.filePath ?? ce.filename ?? `${ce.embedId.slice(0, 8)}.${getExtForLang(ce.language)}`;
-          const fullPath = join11(tmpDir, "code", fpath);
+          const fullPath = join12(tmpDir, "code", fpath);
           await mkdir2(fullPath.substring(0, fullPath.lastIndexOf("/")), {
             recursive: true
           });
@@ -79221,13 +79395,13 @@ ${deleted}/${resolved.length} chat(s) deleted.`);
         }
       }
       if (transcriptEmbeds.length > 0) {
-        const tDir = join11(tmpDir, "transcripts");
+        const tDir = join12(tmpDir, "transcripts");
         await mkdir2(tDir, { recursive: true });
         for (const te of transcriptEmbeds) {
-          await writeFile2(join11(tDir, te.filename), te.content);
+          await writeFile2(join12(tDir, te.filename), te.content);
         }
       }
-      const zipPath = join11(outputDir, `${filenameBase}.zip`);
+      const zipPath = join12(outputDir, `${filenameBase}.zip`);
       const { execSync: execSync2 } = await import("child_process");
       try {
         execSync2(`cd "${tmpDir}" && zip -r "${zipPath}" .`, { stdio: "pipe" });
@@ -79242,17 +79416,17 @@ ${deleted}/${resolved.length} chat(s) deleted.`);
         );
       }
     } else {
-      const chatDir = join11(outputDir, filenameBase);
+      const chatDir = join12(outputDir, filenameBase);
       await mkdir2(chatDir, { recursive: true });
       const written = [];
-      await writeFile2(join11(chatDir, `${filenameBase}.yml`), yamlContent);
+      await writeFile2(join12(chatDir, `${filenameBase}.yml`), yamlContent);
       written.push(`${filenameBase}.yml`);
-      await writeFile2(join11(chatDir, `${filenameBase}.md`), mdContent);
+      await writeFile2(join12(chatDir, `${filenameBase}.md`), mdContent);
       written.push(`${filenameBase}.md`);
       if (codeEmbeds.length > 0) {
         for (const ce of codeEmbeds) {
           const fpath = ce.filePath ?? ce.filename ?? `${ce.embedId.slice(0, 8)}.${getExtForLang(ce.language)}`;
-          const fullPath = join11(chatDir, "code", fpath);
+          const fullPath = join12(chatDir, "code", fpath);
           await mkdir2(fullPath.substring(0, fullPath.lastIndexOf("/")), {
             recursive: true
           });
@@ -79261,10 +79435,10 @@ ${deleted}/${resolved.length} chat(s) deleted.`);
         }
       }
       if (transcriptEmbeds.length > 0) {
-        const tDir = join11(chatDir, "transcripts");
+        const tDir = join12(chatDir, "transcripts");
         await mkdir2(tDir, { recursive: true });
         for (const te of transcriptEmbeds) {
-          await writeFile2(join11(tDir, te.filename), te.content);
+          await writeFile2(join12(tDir, te.filename), te.content);
           written.push(`transcripts/${te.filename}`);
         }
       }
@@ -79300,7 +79474,7 @@ ${deleted}/${resolved.length} chat(s) deleted.`);
       printJson2({
         chat_id: chat.id,
         title: chat.title,
-        output_dir: useZip ? join11(outputDir, `${filenameBase}.zip`) : join11(outputDir, filenameBase),
+        output_dir: useZip ? join12(outputDir, `${filenameBase}.zip`) : join12(outputDir, filenameBase),
         files,
         code_embeds: codeEmbeds.length,
         transcript_embeds: transcriptEmbeds.length
@@ -80326,7 +80500,7 @@ function buildImagesAiDetectionSummary(uploadResult, filePath) {
   const classification = classifyImagesAiDetection(score);
   return {
     file: filePath,
-    filename: uploadResult.filename || basename3(filePath),
+    filename: uploadResult.filename || basename4(filePath),
     content_type: uploadResult.content_type,
     embed_id: uploadResult.embed_id,
     deduplicated: uploadResult.deduplicated,
@@ -81357,7 +81531,7 @@ async function handleEmbeds(client, subcommand, rest, flags) {
         throw new Error("Embed version content was not available after local reconstruction.");
       }
       if (typeof flags.output === "string") {
-        writeFileSync9(flags.output, result.content, "utf-8");
+        writeFileSync10(flags.output, result.content, "utf-8");
         if (flags.json === true) {
           printJson2({ ...result, output: flags.output });
         } else {
@@ -81641,12 +81815,12 @@ async function parseAccountImportFile(parserFormat, file, flags = {}) {
   const selectedSource = requestedSource;
   if (parserFormat === "generic") {
     if (selectedSource !== "gemini" && selectedSource !== "other") throw new Error("Generic account import requires --source gemini or --source other.");
-    return parseGenericImportBuffer(payload, basename3(file), selectedSource);
+    return parseGenericImportBuffer(payload, basename4(file), selectedSource);
   }
-  if (parserFormat === "claude") return parseClaudeImportBuffer(payload, basename3(file), selectedSource);
-  if (parserFormat === "chatgpt") return parseChatGPTImportBuffer(payload, basename3(file), selectedSource);
-  if (parserFormat === "opencode") return parseOpenCodeImportBuffer(payload, basename3(file), selectedSource);
-  return parseOpenMatesImportBuffer(payload, basename3(file), typeof flags.password === "string" ? flags.password : void 0, selectedSource);
+  if (parserFormat === "claude") return parseClaudeImportBuffer(payload, basename4(file), selectedSource);
+  if (parserFormat === "chatgpt") return parseChatGPTImportBuffer(payload, basename4(file), selectedSource);
+  if (parserFormat === "opencode") return parseOpenCodeImportBuffer(payload, basename4(file), selectedSource);
+  return parseOpenMatesImportBuffer(payload, basename4(file), typeof flags.password === "string" ? flags.password : void 0, selectedSource);
 }
 async function runAccountImport(client, parserFormat, file, flags) {
   if (parserFormat === "generic" && typeof flags.source !== "string") throw new Error("Generic account import requires --source gemini or --source other.");
@@ -82016,11 +82190,11 @@ function parseYamlScalar(value) {
 }
 async function saveDownloadedDocument(document, output) {
   const { mkdir: mkdir2, writeFile: writeFile2 } = await import("fs/promises");
-  const { join: join11, basename: basename4, dirname: dirname10 } = await import("path");
+  const { join: join12, basename: basename5, dirname: dirname11 } = await import("path");
   const target = typeof output === "string" ? output : ".";
-  const filename = basename4(document.filename || "document.pdf");
-  const filePath = target.endsWith(".pdf") ? target : join11(target, filename);
-  await mkdir2(dirname10(filePath), { recursive: true });
+  const filename = basename5(document.filename || "document.pdf");
+  const filePath = target.endsWith(".pdf") ? target : join12(target, filename);
+  await mkdir2(dirname11(filePath), { recursive: true });
   await writeFile2(filePath, document.data);
   return filePath;
 }
@@ -82192,7 +82366,7 @@ async function handleFinance(client, subcommand, _rest, flags) {
 }
 function readFinanceCsvStatements(flags) {
   const paths = parseCsvFlag(flags.csv) ?? [];
-  return paths.map((filePath) => ({ filename: basename3(filePath), content: readFileSync12(filePath, "utf8") }));
+  return paths.map((filePath) => ({ filename: basename4(filePath), content: readFileSync12(filePath, "utf8") }));
 }
 function buildFinanceCheckAccountsInput(flags, csvStatements, connectedAccount) {
   const input = {
@@ -82487,7 +82661,7 @@ async function promptPlainText(question) {
 }
 async function writeSecretFile(filePath, content, force = false) {
   const { mkdir: mkdir2, writeFile: writeFile2, stat: stat2 } = await import("fs/promises");
-  const { dirname: dirname10 } = await import("path");
+  const { dirname: dirname11 } = await import("path");
   try {
     await stat2(filePath);
     if (!force) throw new Error(`${filePath} already exists. Use --force to overwrite.`);
@@ -82497,7 +82671,7 @@ async function writeSecretFile(filePath, content, force = false) {
     }
     if (error instanceof Error && !("code" in error)) throw error;
   }
-  await mkdir2(dirname10(filePath), { recursive: true });
+  await mkdir2(dirname11(filePath), { recursive: true });
   await writeFile2(filePath, content, { mode: 384 });
   return filePath;
 }
@@ -85642,6 +85816,7 @@ Commands:
 
 Flags:
   --json          Output raw JSON instead of formatted output
+  --profile <name>        Use an isolated login profile (also OPENMATES_PROFILE)
   --api-url <url> Override API base URL (default: installed self-host server, then https://api.openmates.org)
   --api-key <key> Optional API key override (or set OPENMATES_API_KEY)
   --version       Show CLI version and update availability
@@ -85663,12 +85838,16 @@ function printSelfUpdateHelp() {
   openmates update [--version <version|tag>] [--package-manager <name>] [--dry-run] [--verbose] [--json]
   openmates upgrade [--version <version|tag>] [--package-manager <name>] [--dry-run] [--verbose] [--json]
 
-Updates the globally installed openmates package. The default target is latest.
+Updates the globally installed openmates package using the saved release channel.
+Stable installations default to stable; prereleases default to dev.
+Channel changes persist only after a successful update or up-to-date check.
 
 Options:
-  --version <version|tag>       Install a specific npm version or dist-tag (default: latest)
+  --version <version|tag>       Install a specific npm version or dist-tag (one-time override)
   --package-manager <name>      npm, pnpm, yarn, or bun (default: detect, then npm)
   --dry-run                     Print the package-manager command without running it
+  --channel <dev|stable|main>    Save release channel (dev uses npm alpha; stable/main uses latest)
+  --allow-downgrade             Explicitly allow installing an older version
   --verbose                     Stream package-manager output during installation
   --json                        Output the update plan/result as JSON`);
 }
@@ -86475,7 +86654,7 @@ async function handleDocs(client, subcommand, rest, flags) {
   }
   if (subcommand === "download") {
     const { writeFile: writeFile2, mkdir: mkdir2 } = await import("fs/promises");
-    const { join: join11, dirname: dirname10 } = await import("path");
+    const { join: join12, dirname: dirname11 } = await import("path");
     if (flags.all === true) {
       const outputDir = typeof flags.output === "string" ? flags.output : "./openmates-docs";
       const tree = await client.listDocs();
@@ -86484,8 +86663,8 @@ async function handleDocs(client, subcommand, rest, flags) {
       let count = 0;
       for (const slug2 of slugs) {
         const content2 = await client.getDoc(slug2);
-        const filePath = join11(outputDir, `${slug2}.md`);
-        await mkdir2(dirname10(filePath), { recursive: true });
+        const filePath = join12(outputDir, `${slug2}.md`);
+        await mkdir2(dirname11(filePath), { recursive: true });
         await writeFile2(filePath, content2, "utf-8");
         count++;
         process.stderr.write(`\r  Downloaded ${count}/${slugs.length}`);
@@ -86557,8 +86736,8 @@ function isCliEntrypoint() {
   if (!entrypoint) return false;
   try {
     const invokedPath = realpathSync2(entrypoint);
-    const modulePath = realpathSync2(fileURLToPath2(import.meta.url));
-    return invokedPath === modulePath || basename3(invokedPath) === "cli.js" && dirname9(invokedPath) === dirname9(modulePath);
+    const modulePath = realpathSync2(fileURLToPath3(import.meta.url));
+    return invokedPath === modulePath || basename4(invokedPath) === "cli.js" && dirname10(invokedPath) === dirname10(modulePath);
   } catch {
     return false;
   }

package/dist/{cli-BMrmfKIF.d.ts → cli-BLFXUeuE.d.ts}

@@ -1734,6 +1734,7 @@ declare class OpenMatesClient {
     readonly apiUrl: string;
     private session;
     private readonly http;
+    private readonly explicitSession;
     constructor(options?: OpenMatesClientOptions);
     static load(options?: OpenMatesClientOptions): OpenMatesClient;
     hasSession(): boolean;
@@ -2741,6 +2742,8 @@ declare class OpenMatesClient {
     private downloadPaymentPdf;
     private ensureEmailEncryptionKey;
     private hydrateEmailEncryptionKey;
+    private withFreshStoredSession;
+    private loginRecoveryCommand;
     private requireSession;
     getMasterKeyBytes(): Uint8Array;
     private decryptTopicPreferences;

package/dist/cli.d.ts

@@ -1,2 +1,2 @@
 #!/usr/bin/env node
-export { aa as ImagesAiDetectionClassification, ab as ImagesAiDetectionSummary, aA as assertTrustedAccountCommandAllowed, aB as assertTrustedAccountGuardEnvironment, as as buildImagesAiDetectionSummary, aC as buildTravelConnectionsRequest, at as classifyImagesAiDetection, av as formatImagesAiDetectionLabel, aw as getExtForLang, aD as requireExactConfirmation, aE as resolveProjectContext, az as serializeToYaml, aF as shouldRequireTrustedAccountGuard } from './cli-BMrmfKIF.js';
+export { aa as ImagesAiDetectionClassification, ab as ImagesAiDetectionSummary, aA as assertTrustedAccountCommandAllowed, aB as assertTrustedAccountGuardEnvironment, as as buildImagesAiDetectionSummary, aC as buildTravelConnectionsRequest, at as classifyImagesAiDetection, av as formatImagesAiDetectionLabel, aw as getExtForLang, aD as requireExactConfirmation, aE as resolveProjectContext, az as serializeToYaml, aF as shouldRequireTrustedAccountGuard } from './cli-BLFXUeuE.js';

package/dist/cli.js

@@ -11,7 +11,7 @@ import {
   resolveProjectContext,
   serializeToYaml,
   shouldRequireTrustedAccountGuard
-} from "./chunk-XKIFO4JO.js";
+} from "./chunk-EKALVG2T.js";
 import "./chunk-IWKP55ZB.js";
 import "./chunk-BBKJZ23O.js";
 export {

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { U as UserTaskStatus, a as UserTaskAssigneeType, b as UserTaskAssigneeIdentity, c as UserTaskRecord, d as UserTaskActivityRecord, e as UserPlanStatus, f as UserPlanRecord, g as UserPlanVerificationStatus, h as UserPlanLearningType, i as UserPlanLearningTargetKind, j as UserPlanLearningStatus, k as UserPlanLearningLevel, l as UserPlanLearningRecord, m as UserPlanCriterionRecord, n as UserPlanVerificationRecord, o as UserPlanCreateInput, p as UserPlanUpdateInput, P as ProjectItemRecord, q as UserPlanLearningCreateTasksInput, r as UserPlanLearningCreateTasksResult, s as UserTaskReorderInput, W as WorkflowSummary, t as WorkflowCapability, u as WorkflowDetail, v as WorkflowInputStartParams, w as WorkflowInputSessionResult, x as WorkflowInputSessionDetail, y as WorkflowInputEvent, z as WorkflowGraph, A as WorkflowRunContentRetention, B as WorkflowRunDetail, C as WorkflowRunCancellationResult, D as WorkflowTemplateProjectionUpsertParams, E as WorkflowTemplateProjectionResult, F as PublicWorkflowTemplateProjection, G as WorkflowTemplateProjectionRevocationResult, H as WorkflowTemplateBindingCompletionParams, I as WorkflowTemplateBindingCompletionResult, J as WorkflowTemplateShortUrlParams, K as WorkflowTemplateShortUrlResult, S as ShortUrlRevokeResult, L as WorkflowTemplateImportPayload, M as ImportedWorkflowTemplate } from './cli-BMrmfKIF.js';
-export { N as AuthMethodsStatus, O as AuthoritativeChatReconciliation, Q as BackupCodesResult, R as BankTransferOrderDetails, T as BankTransferStatus, V as CachedChat, X as CachedNewChatSuggestion, Y as ChatListPage, Z as CliSignupResult, _ as DecryptedDraft, $ as DecryptedEmbed, a0 as DecryptedMemoryEntry, a1 as DecryptedMessage, a2 as DecryptedNewChatSuggestion, a3 as DocsFile, a4 as DocsFolder, a5 as DocsSearchResult, a6 as DocsTree, a7 as EncryptedDraft, a8 as GiftCardBankTransferStatus, a9 as INTEREST_TAG_IDS, aa as ImagesAiDetectionClassification, ab as ImagesAiDetectionSummary, ac as InterestTagId, ad as MATE_NAMES, ae as MEMORY_TYPE_REGISTRY, af as MemoryFieldDef, ag as MemoryTypeDef, ah as OpenMatesClient, ai as OpenMatesClientOptions, aj as OpenMatesSession, ak as SyncCache, al as TopicPreferencesPayload, am as TotpSetupStartResult, an as WorkflowEdge, ao as WorkflowNode, ap as WorkflowNodeRun, aq as WorkflowNodeType, ar as WorkflowRunContentStorage, as as buildImagesAiDetectionSummary, at as classifyImagesAiDetection, au as deriveAppUrl, av as formatImagesAiDetectionLabel, aw as getExtForLang, ax as normalizeInterestTagIds, ay as reconcileAuthoritativeChats, az as serializeToYaml } from './cli-BMrmfKIF.js';
+import { U as UserTaskStatus, a as UserTaskAssigneeType, b as UserTaskAssigneeIdentity, c as UserTaskRecord, d as UserTaskActivityRecord, e as UserPlanStatus, f as UserPlanRecord, g as UserPlanVerificationStatus, h as UserPlanLearningType, i as UserPlanLearningTargetKind, j as UserPlanLearningStatus, k as UserPlanLearningLevel, l as UserPlanLearningRecord, m as UserPlanCriterionRecord, n as UserPlanVerificationRecord, o as UserPlanCreateInput, p as UserPlanUpdateInput, P as ProjectItemRecord, q as UserPlanLearningCreateTasksInput, r as UserPlanLearningCreateTasksResult, s as UserTaskReorderInput, W as WorkflowSummary, t as WorkflowCapability, u as WorkflowDetail, v as WorkflowInputStartParams, w as WorkflowInputSessionResult, x as WorkflowInputSessionDetail, y as WorkflowInputEvent, z as WorkflowGraph, A as WorkflowRunContentRetention, B as WorkflowRunDetail, C as WorkflowRunCancellationResult, D as WorkflowTemplateProjectionUpsertParams, E as WorkflowTemplateProjectionResult, F as PublicWorkflowTemplateProjection, G as WorkflowTemplateProjectionRevocationResult, H as WorkflowTemplateBindingCompletionParams, I as WorkflowTemplateBindingCompletionResult, J as WorkflowTemplateShortUrlParams, K as WorkflowTemplateShortUrlResult, S as ShortUrlRevokeResult, L as WorkflowTemplateImportPayload, M as ImportedWorkflowTemplate } from './cli-BLFXUeuE.js';
+export { N as AuthMethodsStatus, O as AuthoritativeChatReconciliation, Q as BackupCodesResult, R as BankTransferOrderDetails, T as BankTransferStatus, V as CachedChat, X as CachedNewChatSuggestion, Y as ChatListPage, Z as CliSignupResult, _ as DecryptedDraft, $ as DecryptedEmbed, a0 as DecryptedMemoryEntry, a1 as DecryptedMessage, a2 as DecryptedNewChatSuggestion, a3 as DocsFile, a4 as DocsFolder, a5 as DocsSearchResult, a6 as DocsTree, a7 as EncryptedDraft, a8 as GiftCardBankTransferStatus, a9 as INTEREST_TAG_IDS, aa as ImagesAiDetectionClassification, ab as ImagesAiDetectionSummary, ac as InterestTagId, ad as MATE_NAMES, ae as MEMORY_TYPE_REGISTRY, af as MemoryFieldDef, ag as MemoryTypeDef, ah as OpenMatesClient, ai as OpenMatesClientOptions, aj as OpenMatesSession, ak as SyncCache, al as TopicPreferencesPayload, am as TotpSetupStartResult, an as WorkflowEdge, ao as WorkflowNode, ap as WorkflowNodeRun, aq as WorkflowNodeType, ar as WorkflowRunContentStorage, as as buildImagesAiDetectionSummary, at as classifyImagesAiDetection, au as deriveAppUrl, av as formatImagesAiDetectionLabel, aw as getExtForLang, ax as normalizeInterestTagIds, ay as reconcileAuthoritativeChats, az as serializeToYaml } from './cli-BLFXUeuE.js';
 
 interface ProjectedAssistantSpeechSegment {
     sequence: number;

package/dist/index.js

@@ -42,7 +42,7 @@ import {
   selectAssistantMessagesForSpeech,
   serializeToYaml,
   summarizeAssistantSpeech
-} from "./chunk-XKIFO4JO.js";
+} from "./chunk-EKALVG2T.js";
 import "./chunk-IWKP55ZB.js";
 import "./chunk-BBKJZ23O.js";
 export {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openmates",
-  "version": "0.18.0-alpha.2",
+  "version": "0.18.0-alpha.4",
   "description": "OpenMates CLI and SDK",
   "type": "module",
   "main": "dist/index.js",
@@ -73,6 +73,7 @@
     "@toon-format/toon": "2.3.1",
     "ahocorasick": "1.0.2",
     "jszip": "^3.10.1",
+    "proper-lockfile": "^4.1.2",
     "qrcode-terminal": "^0.12.0",
     "tweetnacl": "^1.0.3",
     "ws": "8.21.0",
@@ -81,6 +82,7 @@
   "devDependencies": {
     "@repo/eslint-config": "workspace:*",
     "@types/node": "^24.5.0",
+    "@types/proper-lockfile": "^4.1.4",
     "@types/qrcode-terminal": "^0.12.2",
     "@types/ws": "^8.18.1",
     "eslint": "^9.35.0",