openmeld 0.3.125 → 0.3.127

package/dist/auth-session-B1jSy0ws.js

@@ -0,0 +1,1905 @@
+#!/usr/bin/env node
+
+import { $ as runWithHeldLock, K as isOpenMeldLockError, Lt as openMeldRootDir, W as acquireLock, _t as CURRENT_PROCESS_START_IDENTITY, vt as isProcessIdentityAlive, xn as __exportAll } from "./base-url-BtqW4aLS.js";
+import { t as CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH } from "./runtime-transport-CHbXitKu.js";
+import { createRequire } from "node:module";
+import * as z$1 from "zod/v4";
+import { join, resolve } from "node:path";
+import { createHash, randomUUID } from "node:crypto";
+import { chmod, link, mkdir, open, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { spawn } from "node:child_process";
+import { setTimeout as setTimeout$1 } from "node:timers/promises";
+import { fileURLToPath } from "node:url";
+//#region ../../packages/schemas/dist/schemas/local-machine/macos-keychain-helper.js
+const MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION = "disallow";
+const macOsKeychainServiceSchema = z$1.string().trim().min(1).max(512);
+const macOsKeychainAccountSchema = z$1.string().trim().min(1).max(512);
+const macOsKeychainAccessTokenSchema = z$1.string().min(1).max(65536);
+const macOsKeychainHelperOperationSchema = z$1.enum([
+	"store",
+	"read",
+	"delete"
+]);
+const macOsKeychainHelperRequestSchema = z$1.discriminatedUnion("operation", [
+	z$1.strictObject({
+		schemaVersion: z$1.literal(2),
+		operation: z$1.literal("store"),
+		service: macOsKeychainServiceSchema,
+		account: macOsKeychainAccountSchema,
+		accessToken: macOsKeychainAccessTokenSchema,
+		authenticationInteraction: z$1.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)
+	}),
+	z$1.strictObject({
+		schemaVersion: z$1.literal(2),
+		operation: z$1.literal("read"),
+		service: macOsKeychainServiceSchema,
+		account: macOsKeychainAccountSchema,
+		authenticationInteraction: z$1.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)
+	}),
+	z$1.strictObject({
+		schemaVersion: z$1.literal(2),
+		operation: z$1.literal("delete"),
+		service: macOsKeychainServiceSchema,
+		account: macOsKeychainAccountSchema,
+		authenticationInteraction: z$1.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)
+	})
+]);
+const macOsKeychainHelperMutationSuccessSchema = z$1.strictObject({
+	schemaVersion: z$1.literal(2),
+	ok: z$1.literal(true),
+	operation: z$1.enum(["store", "delete"])
+});
+const macOsKeychainHelperReadSuccessSchema = z$1.strictObject({
+	schemaVersion: z$1.literal(2),
+	ok: z$1.literal(true),
+	operation: z$1.literal("read"),
+	accessToken: z$1.union([macOsKeychainAccessTokenSchema, z$1.null()])
+});
+const macOsKeychainHelperErrorSchema = z$1.strictObject({
+	schemaVersion: z$1.literal(2),
+	ok: z$1.literal(false),
+	operation: macOsKeychainHelperOperationSchema,
+	errorMessage: z$1.string().trim().min(1).max(2048)
+});
+const macOsKeychainHelperResponseSchema = z$1.union([
+	macOsKeychainHelperMutationSuccessSchema,
+	macOsKeychainHelperReadSuccessSchema,
+	macOsKeychainHelperErrorSchema
+]);
+//#endregion
+//#region src/strategy-constants.ts
+const DEFAULT_GATEWAY_CHAIN_TIMEOUT_MS = 3e4;
+const DEFAULT_REMOTE_SESSION_TIMEOUT_MS = 8e3;
+const LOOPBACK_REMOTE_SESSION_TIMEOUT_MS = 1500;
+const DEFAULT_SPACE_REQUEST_TIMEOUT_MS = 1e4;
+const MIN_SPACE_REQUEST_TIMEOUT_MS = 1e3;
+const MAX_SPACE_REQUEST_TIMEOUT_MS = 12e4;
+const DEFAULT_HEARTBEAT_INTERVAL_MS = 25e3;
+const MIN_HEARTBEAT_INTERVAL_MS = 5e3;
+const MAX_HEARTBEAT_INTERVAL_MS = 6e4;
+const DAEMON_STREAM_KEEPALIVE_INTERVAL_MS = 2e4;
+const DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS = 1e4;
+const CATALOG_SYNC_RETRY_INTERVAL_MS = 5e3;
+const CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS = 1e3;
+const ROUTE_CATALOG_LOAD_TIMEOUT_MS = 15e3;
+const RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS = 5 * 6e4;
+const RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS = 6e4;
+const PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS = 5 * 6e4;
+const PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS = 6e4;
+const RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS = 6e4;
+const DAEMON_STREAM_CONNECT_TIMEOUT_MS = 15e3;
+const REGISTER_RESPONSE_TIMEOUT_MS = 1e4;
+const HEARTBEAT_RESPONSE_TIMEOUT_MS = 15e3;
+const DAEMON_RUNTIME_CONTRACT_EPOCH = CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH;
+const OPENCLAW_CLI_TIMEOUT_MS = 3e4;
+//#endregion
+//#region src/config/auth-session-expiry.ts
+function resolveAuthSessionExpiryEligibility(expiresAt, nowMs = Date.now()) {
+	const normalized = String(expiresAt ?? "").trim();
+	if (!normalized) return { status: "no_expiry" };
+	const expiresAtMs = Date.parse(normalized);
+	if (Number.isNaN(expiresAtMs)) return { status: "invalid" };
+	return expiresAtMs <= nowMs ? {
+		expiresAtMs,
+		status: "expired"
+	} : {
+		expiresAtMs,
+		status: "valid"
+	};
+}
+//#endregion
+//#region src/config/auth-session-transition-lock.ts
+const AUTH_SESSION_LOCK_KEY = "session-transition-mutation";
+const AUTH_SESSION_LOCK_PROFILE = "auth-session";
+const AUTH_SESSION_LOCK_RETRY_DELAY_MS = 20;
+const AUTH_SESSION_LOCK_WAIT_MS = 1e4;
+async function withAuthSessionTransitionMutationLock(operation) {
+	return await runWithHeldLock({
+		lock: await acquireAuthSessionTransitionMutationLock(),
+		run: operation,
+		releaseContext: {
+			component: "auth_session_transition",
+			lockKey: AUTH_SESSION_LOCK_KEY
+		}
+	});
+}
+async function acquireAuthSessionTransitionMutationLock() {
+	const deadline = Date.now() + AUTH_SESSION_LOCK_WAIT_MS;
+	while (true) try {
+		return await acquireLock({
+			key: AUTH_SESSION_LOCK_KEY,
+			meta: { component: "auth_session_transition" },
+			openMeldProfileId: AUTH_SESSION_LOCK_PROFILE
+		});
+	} catch (error) {
+		if (!(isOpenMeldLockError(error) && Date.now() < deadline)) throw error;
+		await setTimeout$1(AUTH_SESSION_LOCK_RETRY_DELAY_MS);
+	}
+}
+//#endregion
+//#region src/runtime/distribution.ts
+const BINARY_DISTRIBUTION = "binary";
+const NPM_DISTRIBUTION = "npm";
+/**
+* The distribution form this CLI build was compiled for. Falls back to `npm`
+* when the marker is absent (e.g. under Vitest, where no build-time define
+* runs), which keeps the safe, path-independent default.
+*/
+function resolveOpenMeldDistribution() {
+	return NPM_DISTRIBUTION;
+}
+function isBinaryDistribution() {
+	return resolveOpenMeldDistribution() === BINARY_DISTRIBUTION;
+}
+//#endregion
+//#region src/config/macos-native-keychain.ts
+const MAC_OS_KEYCHAIN_HELPER_ARG = "__openmeld_macos_keychain_helper";
+const HELPER_OUTPUT_MAX_BYTES = 128 * 1024;
+let loadedAddon = null;
+let unresponsiveKeychainError = null;
+async function storeMacOsNativeKeychainToken(input) {
+	if (isBinaryDistribution()) {
+		await runBoundedMacOsNativeKeychainRequest({
+			operation: "store",
+			service: input.service,
+			account: input.account,
+			accessToken: input.accessToken
+		});
+		return;
+	}
+	(await loadAddon()).store(input.service, input.account, input.accessToken);
+}
+async function readMacOsNativeKeychainToken(input) {
+	if (isBinaryDistribution()) return await runBoundedMacOsNativeKeychainRequest({
+		operation: "read",
+		service: input.service,
+		account: input.account
+	});
+	return (await loadAddon()).read(input.service, input.account);
+}
+async function deleteMacOsNativeKeychainToken(input) {
+	if (isBinaryDistribution()) {
+		await runBoundedMacOsNativeKeychainRequest({
+			operation: "delete",
+			service: input.service,
+			account: input.account
+		});
+		return;
+	}
+	(await loadAddon()).remove(input.service, input.account);
+}
+async function runMacOsNativeKeychainRequestInChild(input, options = {}) {
+	const request = macOsKeychainHelperRequestSchema.parse({
+		schemaVersion: 2,
+		authenticationInteraction: MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION,
+		...input
+	});
+	const timeoutMs = options.timeoutMs ?? 5e3;
+	if (!(Number.isSafeInteger(timeoutMs) && timeoutMs > 0)) throw new Error("macOS Keychain helper timeout must be a positive integer");
+	return await new Promise((resolve, reject) => {
+		const child = spawn(process.execPath, [MAC_OS_KEYCHAIN_HELPER_ARG], {
+			env: process.env,
+			shell: false,
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			],
+			windowsHide: true
+		});
+		let settled = false;
+		let stdout = "";
+		let stderr = "";
+		const clearDeadline = () => {
+			clearTimeout(deadline);
+		};
+		const rejectOnce = (error) => {
+			if (settled) return;
+			settled = true;
+			clearDeadline();
+			reject(error);
+		};
+		const deadline = setTimeout(() => {
+			if (settled) return;
+			settled = true;
+			child.kill("SIGKILL");
+			reject(new MacOsNativeKeychainTimeoutError(`macOS Keychain did not respond within ${formatTimeout(timeoutMs)}`));
+		}, timeoutMs);
+		child.stdout.setEncoding("utf8");
+		child.stderr.setEncoding("utf8");
+		child.stdout.on("data", (chunk) => {
+			stdout += String(chunk);
+			if (Buffer.byteLength(stdout, "utf8") > HELPER_OUTPUT_MAX_BYTES) {
+				child.kill("SIGKILL");
+				rejectOnce(/* @__PURE__ */ new Error("macOS Keychain helper output was too large"));
+			}
+		});
+		child.stderr.on("data", (chunk) => {
+			stderr += String(chunk);
+			if (Buffer.byteLength(stderr, "utf8") > HELPER_OUTPUT_MAX_BYTES) stderr = stderr.slice(-131072);
+		});
+		child.once("error", (error) => {
+			rejectOnce(/* @__PURE__ */ new Error(`macOS Keychain helper could not start: ${toErrorMessage$2(error)}`));
+		});
+		child.stdin.once("error", (error) => {
+			rejectOnce(/* @__PURE__ */ new Error(`macOS Keychain helper input failed: ${toErrorMessage$2(error)}`));
+		});
+		child.once("close", (code) => {
+			if (settled) return;
+			clearDeadline();
+			settled = true;
+			try {
+				resolve(parseMacOsKeychainHelperResult({
+					code,
+					operation: request.operation,
+					stderr,
+					stdout
+				}));
+			} catch (error) {
+				reject(toError(error));
+			}
+		});
+		child.stdin.end(JSON.stringify(request), "utf8");
+	});
+}
+async function runMacOsNativeKeychainHelperIfRequested(argv = process.argv) {
+	if (!argv.includes(MAC_OS_KEYCHAIN_HELPER_ARG)) return false;
+	if (!(isBinaryDistribution() && process.platform === "darwin")) throw new Error("the internal macOS Keychain helper is only available in the macOS binary");
+	if (!(await loadAddon()).isParentSameExecutable()) throw new Error("the internal macOS Keychain helper is reserved for an OpenMeld child process");
+	const rawRequest = await readHelperStdin();
+	let json;
+	try {
+		json = JSON.parse(rawRequest);
+	} catch {
+		throw new Error("invalid macOS Keychain helper request");
+	}
+	const request = macOsKeychainHelperRequestSchema.safeParse(json);
+	if (!request.success) throw new Error("invalid macOS Keychain helper request");
+	const response = await executeHelperRequest(request.data).catch((error) => ({
+		schemaVersion: 2,
+		ok: false,
+		operation: request.data.operation,
+		errorMessage: truncateErrorMessage(toErrorMessage$2(error))
+	}));
+	process.stdout.write(JSON.stringify(response));
+	return true;
+}
+async function runBoundedMacOsNativeKeychainRequest(input) {
+	if (unresponsiveKeychainError) throw unresponsiveKeychainError;
+	try {
+		if (input.operation === "read") return await runMacOsNativeKeychainRequestInChild(input);
+		await runMacOsNativeKeychainRequestInChild(input);
+	} catch (error) {
+		if (error instanceof MacOsNativeKeychainTimeoutError) unresponsiveKeychainError = error;
+		throw error;
+	}
+}
+function parseMacOsKeychainHelperResult(input) {
+	if (input.code !== 0) throw new Error(`macOS Keychain helper exited with code ${input.code ?? "unknown"}${input.stderr.trim() ? `: ${input.stderr.trim()}` : ""}`);
+	let rawResponse;
+	try {
+		rawResponse = JSON.parse(input.stdout);
+	} catch {
+		throw new Error("macOS Keychain helper returned an invalid response");
+	}
+	const parsed = macOsKeychainHelperResponseSchema.safeParse(rawResponse);
+	if (!(parsed.success && parsed.data.operation === input.operation)) throw new Error("macOS Keychain helper returned an invalid response");
+	if (!parsed.data.ok) throw new Error(parsed.data.errorMessage);
+	return parsed.data.operation === "read" ? parsed.data.accessToken : void 0;
+}
+async function executeHelperRequest(input) {
+	const addon = await loadAddon();
+	if (input.operation === "store") {
+		addon.store(input.service, input.account, input.accessToken);
+		return {
+			schemaVersion: 2,
+			ok: true,
+			operation: "store"
+		};
+	}
+	if (input.operation === "delete") {
+		addon.remove(input.service, input.account);
+		return {
+			schemaVersion: 2,
+			ok: true,
+			operation: "delete"
+		};
+	}
+	return {
+		schemaVersion: 2,
+		ok: true,
+		operation: "read",
+		accessToken: addon.read(input.service, input.account)
+	};
+}
+async function readHelperStdin() {
+	let raw = "";
+	process.stdin.setEncoding("utf8");
+	for await (const chunk of process.stdin) {
+		raw += String(chunk);
+		if (Buffer.byteLength(raw, "utf8") > HELPER_OUTPUT_MAX_BYTES) throw new Error("macOS Keychain helper request was too large");
+	}
+	return raw;
+}
+function truncateErrorMessage(message) {
+	return (message.trim() || "macOS Keychain operation failed").slice(0, 2048);
+}
+function formatTimeout(timeoutMs) {
+	return timeoutMs % 1e3 === 0 ? `${timeoutMs / 1e3} seconds` : `${timeoutMs} ms`;
+}
+function toErrorMessage$2(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+function toError(error) {
+	return error instanceof Error ? error : new Error(String(error));
+}
+var MacOsNativeKeychainTimeoutError = class extends Error {
+	name = "MacOsNativeKeychainTimeoutError";
+};
+async function loadAddon() {
+	if (loadedAddon) return loadedAddon;
+	if (process.platform !== "darwin") throw new Error("macOS Keychain is only available on macOS");
+	if (isBinaryDistribution()) {
+		loadedAddon = (await import("./config/macos-native-keychain-embedded")).loadEmbeddedMacOsKeychainAddon();
+		return loadedAddon;
+	}
+	loadedAddon = createRequire(import.meta.url)(fileURLToPath(new URL("./native/openmeld-keychain.node", import.meta.url)));
+	return loadedAddon;
+}
+//#endregion
+//#region src/config/token-store.ts
+const TOKEN_STORE_KEYCHAIN_SERVICE = "sh.openmeld.auth.token";
+const INSECURE_FALLBACK_ENV_KEY = "OPENMELD_AUTH_ALLOW_INSECURE_FILE_TOKEN";
+const FORCE_INSECURE_STORE_ENV_KEY = "OPENMELD_AUTH_FORCE_INSECURE_FILE_TOKEN";
+const MAC_OS_KEYCHAIN_NONINTERACTIVE_UNAVAILABLE_MESSAGE = "macOS Keychain access is unavailable in this OpenMeld distribution. OpenMeld will not open an authorization window from an unattended process. Run setup or login with the current packaged OpenMeld CLI.";
+const COMMAND_MAX_BUFFER_BYTES = 1024 * 1024;
+const COMMAND_TIMEOUT_MS = 3e4;
+const TOKEN_FILE_KEY_PATTERN = /^[a-f0-9]{64}$/u;
+const EXEC_FILE_BASE_OPTIONS = {
+	windowsHide: true,
+	maxBuffer: COMMAND_MAX_BUFFER_BYTES,
+	timeout: COMMAND_TIMEOUT_MS
+};
+let insecureFallbackWarningShown = false;
+let macOsPrivateStorageWarningShown = false;
+async function storeAccessToken(input) {
+	const key = buildTokenKey({
+		authBaseUrl: input.authBaseUrl,
+		clientId: input.clientId
+	});
+	const storageKey = input.unique ? buildUniqueTokenFileKey(key) : key;
+	if (shouldForceInsecureStore()) {
+		await setInsecureFileToken({
+			key: storageKey,
+			accessToken: input.accessToken
+		});
+		return {
+			provider: "insecure-file",
+			key: storageKey
+		};
+	}
+	if (process.platform === "darwin") try {
+		const account = buildUniqueMacOsAccount(key);
+		if (shouldUseNativeMacOsKeychain()) await storeMacOsNativeKeychainToken({
+			account,
+			service: TOKEN_STORE_KEYCHAIN_SERVICE,
+			accessToken: input.accessToken
+		});
+		else throw new Error(MAC_OS_KEYCHAIN_NONINTERACTIVE_UNAVAILABLE_MESSAGE);
+		return {
+			provider: "macos-keychain",
+			service: TOKEN_STORE_KEYCHAIN_SERVICE,
+			account
+		};
+	} catch (error) {
+		if (allowInsecureFallback()) {
+			await setInsecureFileToken({
+				key: storageKey,
+				accessToken: input.accessToken
+			});
+			return {
+				provider: "insecure-file",
+				key: storageKey
+			};
+		}
+		const privateKey = buildUniqueTokenFileKey(key);
+		await setInsecureFileToken({
+			key: privateKey,
+			accessToken: input.accessToken
+		});
+		warnMacOsPrivateStorageFallback(error);
+		return {
+			provider: "insecure-file",
+			key: privateKey
+		};
+	}
+	if (process.platform === "win32") try {
+		await setWindowsDpapiToken({
+			key: storageKey,
+			accessToken: input.accessToken
+		});
+		return {
+			provider: "windows-dpapi",
+			key: storageKey
+		};
+	} catch (error) {
+		if (allowInsecureFallback()) {
+			await setInsecureFileToken({
+				key: storageKey,
+				accessToken: input.accessToken
+			});
+			return {
+				provider: "insecure-file",
+				key: storageKey
+			};
+		}
+		throw new Error(`failed to store access token via Windows DPAPI: ${toErrorMessage$1(error)}`);
+	}
+	if (allowInsecureFallback()) {
+		await setInsecureFileToken({
+			key: storageKey,
+			accessToken: input.accessToken
+		});
+		return {
+			provider: "insecure-file",
+			key: storageKey
+		};
+	}
+	throw new Error(`secure token storage is unavailable on platform "${process.platform}". Use ${INSECURE_FALLBACK_ENV_KEY}=1 only for local testing fallback.`);
+}
+async function readAccessToken(ref) {
+	try {
+		if (ref.provider === "macos-keychain") {
+			if (!shouldUseNativeMacOsKeychain()) throw new Error(MAC_OS_KEYCHAIN_NONINTERACTIVE_UNAVAILABLE_MESSAGE);
+			return toAccessTokenReadResult(await readMacOsNativeKeychainToken(ref));
+		}
+		if (ref.provider === "windows-dpapi") return toAccessTokenReadResult(await getWindowsDpapiToken(ref));
+		if (ref.provider === "insecure-file") return toAccessTokenReadResult(await getInsecureFileToken(ref));
+		return { status: "missing" };
+	} catch (error) {
+		return {
+			errorMessage: toErrorMessage$1(error),
+			status: "unavailable"
+		};
+	}
+}
+async function deleteAccessToken(ref) {
+	if (ref.provider === "macos-keychain") {
+		if (!shouldUseNativeMacOsKeychain()) throw new Error(MAC_OS_KEYCHAIN_NONINTERACTIVE_UNAVAILABLE_MESSAGE);
+		await deleteMacOsNativeKeychainToken(ref);
+		return;
+	}
+	if (ref.provider === "windows-dpapi") {
+		await deleteWindowsDpapiToken(ref);
+		return;
+	}
+	if (ref.provider === "insecure-file") await deleteInsecureFileToken(ref);
+}
+function isStoredTokenRef(value) {
+	if (!(value && typeof value === "object")) return false;
+	const record = value;
+	const provider = normalizeString(record.provider);
+	if (provider === "macos-keychain") return Boolean(normalizeString(record.service) && normalizeString(record.account) && record.accessGroup === void 0);
+	if (provider === "windows-dpapi" || provider === "insecure-file") return normalizeTokenFileKey(record.key) !== null;
+	return false;
+}
+function buildTokenKey(input) {
+	const rootDir = resolve(openMeldRootDir());
+	return createHash("sha256").update(`${input.clientId}\n${input.authBaseUrl}\n${rootDir}`).digest("hex");
+}
+function buildUniqueMacOsAccount(key) {
+	return `openmeld-auth-${key}-${randomUUID()}`;
+}
+function buildUniqueTokenFileKey(key) {
+	return createHash("sha256").update(`${key}\n${randomUUID()}`).digest("hex");
+}
+function shouldUseNativeMacOsKeychain() {
+	return isBinaryDistribution();
+}
+async function setWindowsDpapiToken(input) {
+	const encrypted = await runPowerShellScript(WINDOWS_DPAPI_ENCRYPT_SCRIPT, input.accessToken, input.key);
+	await mkdir(tokenDirectoryPath(), { recursive: true });
+	await writeFile(windowsDpapiTokenPath(input.key), `${encrypted.trim()}\n`, {
+		encoding: "utf8",
+		mode: 384
+	});
+}
+async function getWindowsDpapiToken(input) {
+	const encrypted = await readFile(windowsDpapiTokenPath(input.key), "utf8").catch((error) => {
+		if (isFileNotFoundError$1(error)) return null;
+		throw error;
+	});
+	if (!encrypted) return null;
+	return runPowerShellScript(WINDOWS_DPAPI_DECRYPT_SCRIPT, encrypted.trim(), input.key);
+}
+async function deleteWindowsDpapiToken(input) {
+	await rm(windowsDpapiTokenPath(input.key), { force: true });
+}
+async function setInsecureFileToken(input) {
+	await ensurePrivateTokenDirectory();
+	const path = insecureTokenPath(input.key);
+	await writeFile(path, `${input.accessToken}\n`, {
+		encoding: "utf8",
+		mode: 384
+	});
+	if (process.platform !== "win32") await chmod(path, 384);
+}
+async function getInsecureFileToken(input) {
+	const raw = await readFile(insecureTokenPath(input.key), "utf8").catch((error) => {
+		if (isFileNotFoundError$1(error)) return null;
+		throw error;
+	});
+	return raw ? raw.trim() : null;
+}
+async function deleteInsecureFileToken(input) {
+	await rm(insecureTokenPath(input.key), { force: true });
+}
+function tokenDirectoryPath() {
+	return join(openMeldRootDir(), "auth", "tokens");
+}
+function windowsDpapiTokenPath(key) {
+	return join(tokenDirectoryPath(), `${requireValidTokenFileKey(key)}.dpapi`);
+}
+function insecureTokenPath(key) {
+	return join(tokenDirectoryPath(), `${requireValidTokenFileKey(key)}.token`);
+}
+function allowInsecureFallback() {
+	if (process.env[INSECURE_FALLBACK_ENV_KEY] === "1") {
+		warnInsecureFallback("env");
+		return true;
+	}
+	const fallbackEnabled = !isNativeSecureStorePlatform();
+	if (fallbackEnabled) warnInsecureFallback("platform");
+	return fallbackEnabled;
+}
+function warnMacOsPrivateStorageFallback(error) {
+	if (macOsPrivateStorageWarningShown) return;
+	macOsPrivateStorageWarningShown = true;
+	const storageExpectation = isBinaryDistribution() ? "This session stays in private local storage unless a later sign-in replaces it." : "This npm installation cannot use macOS Keychain. This session stays in private local storage.";
+	console.warn(`[openmeld auth] macOS Keychain is unavailable. OpenMeld saved this session in a private file protected for your macOS user account, so setup can continue. ${storageExpectation} Details: ${toErrorMessage$1(error)}`);
+}
+function warnInsecureFallback(reason) {
+	if (insecureFallbackWarningShown) return;
+	insecureFallbackWarningShown = true;
+	const reasonText = reason === "env" ? `enabled by ${INSECURE_FALLBACK_ENV_KEY}=1` : `enabled automatically on platform "${process.platform}"`;
+	console.warn(`[openmeld auth] plaintext file token storage fallback is active (${reasonText}). Unset ${INSECURE_FALLBACK_ENV_KEY} to disable explicit opt-in, and prefer macOS or Windows for native secure token storage.`);
+}
+function shouldForceInsecureStore() {
+	return process.env[FORCE_INSECURE_STORE_ENV_KEY] === "1";
+}
+function isNativeSecureStorePlatform() {
+	return process.platform === "darwin" || process.platform === "win32";
+}
+async function ensurePrivateTokenDirectory() {
+	const directory = tokenDirectoryPath();
+	await mkdir(directory, {
+		recursive: true,
+		mode: 448
+	});
+	if (process.platform !== "win32") await chmod(directory, 448);
+}
+async function runPowerShellScript(script, token, entropy) {
+	const payload = JSON.stringify({
+		token,
+		entropy
+	});
+	return (await runCommand("powershell.exe", [
+		"-NoProfile",
+		"-NonInteractive",
+		"-ExecutionPolicy",
+		"Bypass",
+		"-Command",
+		script
+	], payload)).stdout.trim();
+}
+async function runCommand(command, args, stdinPayload) {
+	try {
+		const { execFile } = await import("node:child_process");
+		return await new Promise((resolve, reject) => {
+			let stdout = "";
+			let stderr = "";
+			const child = execFile(command, args, { ...EXEC_FILE_BASE_OPTIONS });
+			child.stdout?.setEncoding("utf8");
+			child.stderr?.setEncoding("utf8");
+			child.stdout?.on("data", (chunk) => {
+				stdout += String(chunk);
+			});
+			child.stderr?.on("data", (chunk) => {
+				stderr += String(chunk);
+			});
+			child.on("error", (error) => {
+				reject(toCommandError(error, command));
+			});
+			child.on("close", (code) => {
+				if (code === 0) {
+					resolve({
+						stdout,
+						stderr
+					});
+					return;
+				}
+				reject(toCommandError({ message: `command failed (${command}) with exit code ${code}` }, command));
+			});
+			child.stdin?.write(stdinPayload);
+			child.stdin?.end();
+		});
+	} catch (error) {
+		throw toCommandError(error, command);
+	}
+}
+function toCommandError(error, command) {
+	if (!(error && typeof error === "object")) return /* @__PURE__ */ new Error(`command failed (${command}): ${String(error)}`);
+	const e = error;
+	const code = typeof e.code === "number" ? e.code : null;
+	const messageParts = [`command failed (${command})`];
+	if (typeof e.stderr === "string" && e.stderr.trim()) messageParts.push(`stderr: ${e.stderr.trim()}`);
+	else if (e.message) messageParts.push(e.message);
+	const wrapped = new Error(messageParts.join("; "));
+	wrapped.code = code;
+	wrapped.stdout = e.stdout;
+	wrapped.stderr = e.stderr;
+	return wrapped;
+}
+function normalizeString(value) {
+	return String(value ?? "").trim();
+}
+function normalizeTokenFileKey(value) {
+	const normalized = normalizeString(value);
+	if (!TOKEN_FILE_KEY_PATTERN.test(normalized)) return null;
+	return normalized;
+}
+function requireValidTokenFileKey(value) {
+	const normalized = normalizeTokenFileKey(value);
+	if (normalized === null) throw new Error("stored token key is invalid");
+	return normalized;
+}
+function normalizeToken(value) {
+	if (value === null) return null;
+	const normalized = value.trim();
+	return normalized.length > 0 ? normalized : null;
+}
+function toAccessTokenReadResult(value) {
+	const accessToken = normalizeToken(value);
+	if (!accessToken) return { status: "missing" };
+	return {
+		accessToken,
+		status: "found"
+	};
+}
+function toErrorMessage$1(error) {
+	if (error instanceof Error) return error.message;
+	return String(error);
+}
+function isFileNotFoundError$1(error) {
+	return Boolean(error && typeof error === "object" && "code" in error && error.code === "ENOENT");
+}
+const WINDOWS_DPAPI_ENCRYPT_SCRIPT = [
+	"$ErrorActionPreference='Stop'",
+	"$rawInput = [Console]::In.ReadToEnd()",
+	"$payload = $rawInput | ConvertFrom-Json",
+	"$plain=[System.Text.Encoding]::UTF8.GetBytes($payload.token)",
+	"$entropy=[System.Text.Encoding]::UTF8.GetBytes($payload.entropy)",
+	"$cipher=[System.Security.Cryptography.ProtectedData]::Protect($plain,$entropy,[System.Security.Cryptography.DataProtectionScope]::CurrentUser)",
+	"[System.Convert]::ToBase64String($cipher)"
+].join(";");
+const WINDOWS_DPAPI_DECRYPT_SCRIPT = [
+	"$ErrorActionPreference='Stop'",
+	"$rawInput = [Console]::In.ReadToEnd()",
+	"$payload = $rawInput | ConvertFrom-Json",
+	"$cipher=[System.Convert]::FromBase64String($payload.token)",
+	"$entropy=[System.Text.Encoding]::UTF8.GetBytes($payload.entropy)",
+	"$plain=[System.Security.Cryptography.ProtectedData]::Unprotect($cipher,$entropy,[System.Security.Cryptography.DataProtectionScope]::CurrentUser)",
+	"[System.Text.Encoding]::UTF8.GetString($plain)"
+].join(";");
+//#endregion
+//#region src/config/auth-session.ts
+var auth_session_exports = /* @__PURE__ */ __exportAll({
+	AuthSessionRecoveryInProgressError: () => AuthSessionRecoveryInProgressError,
+	AuthSessionTransitionConflictError: () => AuthSessionTransitionConflictError,
+	assertAuthSessionMutationAvailable: () => assertAuthSessionMutationAvailable,
+	beginAuthSessionTransition: () => beginAuthSessionTransition,
+	clearAuthSession: () => clearAuthSession,
+	completeInterruptedComputerAuthSessionRecovery: () => completeInterruptedComputerAuthSessionRecovery,
+	getAuthSessionMetadata: () => getAuthSessionMetadata,
+	getAuthSessionState: () => getAuthSessionState,
+	getCurrentAuthOwnerUserId: () => getCurrentAuthOwnerUserId,
+	getInterruptedComputerAuthSessionRecovery: () => getInterruptedComputerAuthSessionRecovery,
+	markInterruptedComputerAuthSessionRecovery: () => markInterruptedComputerAuthSessionRecovery,
+	normalizeStoredActiveOrganization: () => normalizeStoredActiveOrganization,
+	recordInterruptedComputerAuthSessionRecoveryFailure: () => recordInterruptedComputerAuthSessionRecoveryFailure,
+	setAuthSession: () => setAuthSession,
+	updateAuthSessionActiveOrganization: () => updateAuthSessionActiveOrganization
+});
+var AuthSessionStorageError = class extends Error {
+	reason;
+	constructor(input) {
+		super(input.message, input.cause === void 0 ? void 0 : { cause: input.cause });
+		this.name = "AuthSessionStorageError";
+		this.reason = input.reason;
+	}
+};
+var AuthSessionRecoveryInProgressError = class extends Error {
+	constructor() {
+		super("OpenMeld is still finishing an interrupted Computer sign-in recovery. The current sign-in was not changed; retry after the recovery cleanup succeeds.");
+		this.name = "AuthSessionRecoveryInProgressError";
+	}
+};
+var AuthSessionTransitionConflictError = class extends Error {
+	previousOwnerRestored;
+	reason;
+	constructor(input) {
+		const conflict = {
+			journal_missing: "missing",
+			journal_not_pending: "no longer pending",
+			journal_replaced: "owned by another sign-in"
+		}[input.reason];
+		const outcome = input.previousOwnerRestored ? "The previous sign-in was restored." : "No local sign-in state was changed.";
+		super(`The auth session transition journal is ${conflict}. ${outcome}`);
+		this.name = "AuthSessionTransitionConflictError";
+		this.reason = input.reason;
+		this.previousOwnerRestored = input.previousOwnerRestored;
+	}
+};
+const TRAILING_SLASHES_RE = /\/+$/u;
+let cachedAuthSession = null;
+const activeAuthSessionTransitionIds = /* @__PURE__ */ new Set();
+async function getAuthSessionState(options = {}) {
+	const localState = await getLocalAuthSessionState();
+	const localPayloadKey = cachedAuthSession?.payloadKey ?? null;
+	const shouldValidateRemote = options.validateRemote === true || options.refreshExpired === true && localState.state === "expired";
+	switch (localState.state) {
+		case "missing":
+		case "invalid": return localState;
+		case "expired":
+			if (!shouldValidateRemote) return localState;
+			break;
+		case "valid": break;
+		default: return localState;
+	}
+	if (!shouldValidateRemote) return localState;
+	const remoteValidation = await getRemoteAuthSessionState(localState.session);
+	if (remoteValidation.state === "valid") {
+		if (!remoteValidation.expiresAt) return localState;
+		if (isExpired(remoteValidation.expiresAt)) return localState;
+		const refreshedSession = await persistRemoteSessionRefresh({
+			accessToken: remoteValidation.accessToken ?? localState.session.accessToken,
+			expectedPayloadKey: localPayloadKey,
+			expiresAt: remoteValidation.expiresAt,
+			previousAccessToken: localState.session.accessToken
+		});
+		if (refreshedSession) return {
+			state: "valid",
+			session: refreshedSession
+		};
+		return await getLocalAuthSessionState();
+	}
+	if (remoteValidation.state === "unknown") {
+		if (localState.state === "expired" && options.refreshExpired === true) return {
+			state: "valid",
+			session: localState.session
+		};
+		return localState;
+	}
+	return {
+		reasonCode: resolveRemoteAuthSessionReasonCode(remoteValidation.state),
+		state: remoteValidation.state,
+		session: null
+	};
+}
+async function getCurrentAuthOwnerUserId() {
+	const ownerUserId = (await getAuthSessionState({ validateRemote: false }).catch(() => null))?.session?.user?.id?.trim() ?? "";
+	return ownerUserId.length > 0 ? ownerUserId : null;
+}
+async function setAuthSession(input) {
+	const accessToken = String(input.accessToken ?? "").trim();
+	if (!accessToken) throw new Error("access token is required");
+	const authBaseUrl = String(input.authBaseUrl ?? "").trim();
+	if (!authBaseUrl) throw new Error("auth base URL is required");
+	const clientId = String(input.clientId ?? "").trim();
+	if (!clientId) throw new Error("client_id is required");
+	await withAuthSessionTransitionMutationLock(async () => {
+		await assertAuthSessionMutationAvailableWithOwnership();
+		await retryPendingTokenCleanup();
+		const previousTokenRef = normalizeTokenRef((await readSessionPayloadFile())?.tokenRef);
+		const tokenRef = await storeAccessToken({
+			accessToken,
+			authBaseUrl,
+			clientId
+		});
+		const payload = {
+			v: 1,
+			tokenRef,
+			tokenType: String(input.tokenType ?? "Bearer").trim() || "Bearer",
+			authBaseUrl,
+			clientId,
+			createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+			...input.expiresAt ? { expiresAt: input.expiresAt } : {},
+			...input.scope ? { scope: input.scope } : {},
+			...buildAuthUserPayload(input.user),
+			...buildActiveOrganizationPayload(input.activeOrganization)
+		};
+		const path = authSessionPath();
+		await ensureAuthSessionDirectory();
+		try {
+			await assertStoredAccessTokenReloads({
+				accessToken,
+				tokenRef
+			});
+			await writeSessionPayloadAtomically(path, payload);
+		} catch (error) {
+			await deleteAccessTokenOrRetainForCleanup(tokenRef);
+			throw error;
+		}
+		cacheAuthSession({
+			payload,
+			session: buildStoredAuthSession({
+				accessToken,
+				payload
+			})
+		});
+		if (previousTokenRef && !areStoredTokenRefsEqual(previousTokenRef, tokenRef)) await deleteAccessTokenOrRetainForCleanup(previousTokenRef);
+	});
+}
+async function beginAuthSessionTransition(input, context = {}) {
+	const accessToken = String(input.accessToken ?? "").trim();
+	if (!accessToken) throw new Error("access token is required");
+	const authBaseUrl = String(input.authBaseUrl ?? "").trim();
+	if (!authBaseUrl) throw new Error("auth base URL is required");
+	const clientId = String(input.clientId ?? "").trim();
+	if (!clientId) throw new Error("client_id is required");
+	return await withAuthSessionTransitionMutationLock(async () => {
+		await assertAuthSessionMutationAvailableWithOwnership();
+		await retryPendingTokenCleanup();
+		await ensureAuthSessionDirectory();
+		const previousPayload = await readSessionPayloadFile();
+		const previousState = await getLocalAuthSessionState({ recover: false });
+		const previousSession = previousState.state === "valid" || previousState.state === "expired" ? previousState.session : null;
+		const tokenRef = await storeAccessToken({
+			accessToken,
+			authBaseUrl,
+			clientId,
+			unique: true
+		});
+		const nextPayload = {
+			v: 1,
+			tokenRef,
+			tokenType: String(input.tokenType ?? "Bearer").trim() || "Bearer",
+			authBaseUrl,
+			clientId,
+			createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+			...input.expiresAt ? { expiresAt: input.expiresAt } : {},
+			...input.scope ? { scope: input.scope } : {},
+			...buildAuthUserPayload(input.user),
+			...buildActiveOrganizationPayload(input.activeOrganization)
+		};
+		const journal = {
+			v: 1,
+			id: randomUUID(),
+			state: "pending",
+			ownerPid: process.pid,
+			ownerProcessStartedAt: CURRENT_PROCESS_START_IDENTITY,
+			previousPayload: previousPayload?.v === 1 ? previousPayload : null,
+			candidatePayload: nextPayload,
+			...context.computerHandoff ? { computerHandoff: { gatewayUrl: context.computerHandoff.gatewayUrl } } : {}
+		};
+		let journalClaimed = false;
+		try {
+			await assertStoredAccessTokenReloads({
+				accessToken,
+				tokenRef
+			});
+			await claimAuthSessionTransitionJournal(journal);
+			journalClaimed = true;
+			activeAuthSessionTransitionIds.add(journal.id);
+			await writeSessionPayloadAtomically(authSessionPath(), nextPayload);
+		} catch (error) {
+			activeAuthSessionTransitionIds.delete(journal.id);
+			if (journalClaimed) {
+				await restoreTransitionPreviousPayload(journal).catch(() => void 0);
+				await removeAuthSessionTransitionJournalIfOwned(journal).catch(() => void 0);
+			}
+			await deleteAccessTokenOrRetainForCleanup(tokenRef);
+			throw error;
+		}
+		cacheAuthSession({
+			payload: nextPayload,
+			session: buildStoredAuthSession({
+				accessToken,
+				payload: nextPayload
+			})
+		});
+		let settlement = "pending";
+		const assertTransitionPending = () => {
+			if (settlement !== "pending") throw new Error("auth session transition is already settled");
+		};
+		const isCandidateSessionCurrent = (currentPayload) => {
+			return !(currentPayload?.v !== 1 || buildAuthSessionPayloadKey(currentPayload) !== buildAuthSessionPayloadKey(nextPayload));
+		};
+		const assertCandidateSessionCurrent = async () => {
+			const currentPayload = await readSessionPayloadFile();
+			if (!isCandidateSessionCurrent(currentPayload)) throw new Error("auth session changed before the setup transition completed");
+		};
+		const restoreMissingJournalTransition = async () => {
+			const currentPayload = await readSessionPayloadFile();
+			if (!isCandidateSessionCurrent(currentPayload)) {
+				try {
+					await cleanupTransitionTokensNotReferencedByCurrentSession({
+						currentPayload,
+						journal
+					});
+				} finally {
+					activeAuthSessionTransitionIds.delete(journal.id);
+				}
+				throw new AuthSessionTransitionConflictError({
+					previousOwnerRestored: false,
+					reason: "journal_missing"
+				});
+			}
+			await claimAuthSessionTransitionJournal(journal);
+			try {
+				await restoreTransitionPreviousPayload(journal, previousSession);
+				settlement = "rolled_back";
+				await deleteAccessTokenOrRetainForCleanup(tokenRef).catch((error) => {
+					logDeferredAuthSessionTransitionCleanup({
+						error,
+						transitionId: journal.id
+					});
+				});
+			} finally {
+				activeAuthSessionTransitionIds.delete(journal.id);
+				await removeAuthSessionTransitionJournalIfOwned(journal);
+			}
+		};
+		return {
+			previousSession,
+			commit: async () => await withAuthSessionTransitionMutationLock(async () => {
+				assertTransitionPending();
+				const currentJournal = await readOwnedPendingAuthSessionTransition(journal);
+				if (currentJournal.status === "missing") {
+					await restoreMissingJournalTransition();
+					throw new AuthSessionTransitionConflictError({
+						previousOwnerRestored: true,
+						reason: "journal_missing"
+					});
+				}
+				if (currentJournal.status !== "current") {
+					activeAuthSessionTransitionIds.delete(journal.id);
+					throw new AuthSessionTransitionConflictError({
+						previousOwnerRestored: false,
+						reason: currentJournal.status
+					});
+				}
+				await assertCandidateSessionCurrent();
+				const committedJournal = {
+					...currentJournal.journal,
+					state: "committed"
+				};
+				await writeAuthSessionTransitionJournalIfOwned(currentJournal.journal, committedJournal);
+				settlement = "committed";
+				activeAuthSessionTransitionIds.delete(journal.id);
+				await finalizeCommittedAuthSessionTransition(committedJournal).catch((error) => {
+					logDeferredAuthSessionTransitionCleanup({
+						error,
+						transitionId: journal.id
+					});
+				});
+			}),
+			rollback: async () => await withAuthSessionTransitionMutationLock(async () => {
+				if (settlement === "rolled_back") return;
+				assertTransitionPending();
+				const currentJournal = await readOwnedPendingAuthSessionTransition(journal);
+				if (currentJournal.status === "missing") {
+					await restoreMissingJournalTransition();
+					return;
+				}
+				if (currentJournal.status !== "current") {
+					activeAuthSessionTransitionIds.delete(journal.id);
+					throw new AuthSessionTransitionConflictError({
+						previousOwnerRestored: false,
+						reason: currentJournal.status
+					});
+				}
+				await assertCandidateSessionCurrent();
+				await restoreTransitionPreviousPayload(currentJournal.journal, previousSession);
+				settlement = "rolled_back";
+				activeAuthSessionTransitionIds.delete(journal.id);
+				stopRegisteredCandidateService(currentJournal.journal);
+				if (currentJournal.journal.computerHandoff) {
+					await writeAuthSessionTransitionJournalIfOwned(currentJournal.journal, {
+						...currentJournal.journal,
+						state: "recovery_required"
+					});
+					return;
+				}
+				await deleteAccessTokenOrRetainForCleanup(tokenRef);
+				await removeAuthSessionTransitionJournalIfOwned(currentJournal.journal);
+			})
+		};
+	});
+}
+async function readOwnedPendingAuthSessionTransition(expected) {
+	const currentJournal = await readAuthSessionTransitionJournal();
+	if (!currentJournal) return { status: "missing" };
+	if (!hasSameAuthSessionTransitionIdentity(expected, currentJournal)) return {
+		status: "journal_replaced",
+		journal: currentJournal
+	};
+	if (currentJournal.state !== "pending") return {
+		status: "journal_not_pending",
+		journal: currentJournal
+	};
+	return {
+		status: "current",
+		journal: currentJournal
+	};
+}
+async function getInterruptedComputerAuthSessionRecovery() {
+	return await withAuthSessionTransitionMutationLock(async () => {
+		await recoverInterruptedAuthSessionTransitionWithOwnership();
+		const journal = await readAuthSessionTransitionJournal();
+		if (!(journal?.state === "recovery_required" && journal.computerHandoff)) return null;
+		const candidateSession = await readStoredAuthSessionFromPayloadIfPresent(journal.candidatePayload);
+		if (!candidateSession) {
+			if (journal.computerHandoff.serviceReconciledAt && journal.computerHandoff.remoteSessionRevokedAt) {
+				await removeAuthSessionTransitionJournalIfOwned(journal);
+				return null;
+			}
+			throw new AuthSessionStorageError({
+				message: "auth session recovery token is missing",
+				reason: "corrupt"
+			});
+		}
+		const candidateOwnerUserId = normalizeOptionalString(candidateSession.user?.id);
+		if (!candidateOwnerUserId) throw new AuthSessionStorageError({
+			message: "computer auth recovery candidate is missing its owner user id",
+			reason: "corrupt"
+		});
+		return {
+			candidateSession: {
+				...candidateSession,
+				user: {
+					...candidateSession.user,
+					id: candidateOwnerUserId
+				}
+			},
+			gatewayUrl: journal.computerHandoff.gatewayUrl,
+			id: journal.id,
+			previousSession: journal.previousPayload ? await readStoredAuthSessionFromPayload(journal.previousPayload) : null,
+			remoteSessionRevoked: Boolean(journal.computerHandoff.remoteSessionRevokedAt),
+			serviceReconciled: Boolean(journal.computerHandoff.serviceReconciledAt)
+		};
+	});
+}
+async function markInterruptedComputerAuthSessionRecovery(input) {
+	await withAuthSessionTransitionMutationLock(async () => {
+		const journal = await readRequiredComputerAuthRecoveryJournal(input.id);
+		await writeAuthSessionTransitionJournalIfOwned(journal, {
+			...journal,
+			computerHandoff: {
+				...journal.computerHandoff,
+				...input.phase === "service" ? { serviceReconciledAt: (/* @__PURE__ */ new Date()).toISOString() } : { remoteSessionRevokedAt: (/* @__PURE__ */ new Date()).toISOString() },
+				lastRecoveryFailure: void 0
+			}
+		});
+	});
+}
+async function recordInterruptedComputerAuthSessionRecoveryFailure(input) {
+	await withAuthSessionTransitionMutationLock(async () => {
+		await recordInterruptedComputerAuthSessionRecoveryFailureWithOwnership(input);
+	});
+}
+async function recordInterruptedComputerAuthSessionRecoveryFailureWithOwnership(input) {
+	const journal = await readRequiredComputerAuthRecoveryJournal(input.id);
+	await writeAuthSessionTransitionJournalIfOwned(journal, {
+		...journal,
+		computerHandoff: {
+			...journal.computerHandoff,
+			lastRecoveryFailure: {
+				at: (/* @__PURE__ */ new Date()).toISOString(),
+				message: input.message,
+				phase: input.phase,
+				...input.endpoint ? { endpoint: input.endpoint } : {},
+				...input.status === void 0 ? {} : { status: input.status }
+			}
+		}
+	});
+}
+async function completeInterruptedComputerAuthSessionRecovery(id) {
+	return await withAuthSessionTransitionMutationLock(async () => {
+		const journal = await readRequiredComputerAuthRecoveryJournal(id);
+		if (!(journal.computerHandoff.serviceReconciledAt && journal.computerHandoff.remoteSessionRevokedAt)) throw new Error("computer auth recovery cannot complete before service and remote-session cleanup");
+		try {
+			await deleteAccessTokenOrRetainForCleanup(journal.candidatePayload.tokenRef);
+			await removeAuthSessionTransitionJournalIfOwned(journal);
+			return true;
+		} catch (error) {
+			await recordInterruptedComputerAuthSessionRecoveryFailureWithOwnership({
+				id,
+				message: toErrorMessage(error),
+				phase: "local_cleanup"
+			}).catch(() => void 0);
+			logDeferredAuthSessionTransitionCleanup({
+				error,
+				transitionId: id
+			});
+			return false;
+		}
+	});
+}
+async function getAuthSessionMetadata() {
+	const payload = await readSessionPayload();
+	if (payload?.v !== 1) return null;
+	const authBaseUrl = normalizeOptionalString(payload.authBaseUrl);
+	const clientId = normalizeOptionalString(payload.clientId);
+	const createdAt = normalizeOptionalString(payload.createdAt);
+	if (!(authBaseUrl && clientId && createdAt)) return null;
+	return {
+		authBaseUrl,
+		clientId,
+		createdAt,
+		...typeof payload.expiresAt === "string" && payload.expiresAt.trim() ? { expiresAt: payload.expiresAt.trim() } : {},
+		...typeof payload.scope === "string" && payload.scope.trim() ? { scope: payload.scope.trim() } : {},
+		...buildAuthUserPayload(payload.user),
+		...buildActiveOrganizationPayload(payload.activeOrganization)
+	};
+}
+async function updateAuthSessionActiveOrganization(activeOrganization) {
+	await withAuthSessionTransitionMutationLock(async () => {
+		await assertAuthSessionMutationAvailableWithOwnership();
+		const payload = await readSessionPayloadFile();
+		if (payload?.v !== 1) throw new Error("cannot update active organization without auth session");
+		const tokenRef = normalizeTokenRef(payload.tokenRef);
+		const tokenType = normalizeOptionalString(payload.tokenType);
+		const authBaseUrl = normalizeOptionalString(payload.authBaseUrl);
+		const clientId = normalizeOptionalString(payload.clientId);
+		const createdAt = normalizeOptionalString(payload.createdAt);
+		if (!(tokenRef && tokenType && authBaseUrl && clientId && createdAt)) throw new Error("cannot update active organization for invalid auth session");
+		const nextPayload = {
+			v: 1,
+			tokenRef,
+			tokenType,
+			authBaseUrl,
+			clientId,
+			createdAt,
+			...typeof payload.expiresAt === "string" && payload.expiresAt.trim() ? { expiresAt: payload.expiresAt.trim() } : {},
+			...typeof payload.scope === "string" && payload.scope.trim() ? { scope: payload.scope.trim() } : {},
+			...buildAuthUserPayload(payload.user),
+			...buildActiveOrganizationPayload(activeOrganization)
+		};
+		await writeSessionPayloadAtomically(authSessionPath(), nextPayload);
+		const currentCachedSession = readCachedAuthSession(payload);
+		if (currentCachedSession) cacheAuthSession({
+			payload: nextPayload,
+			session: buildStoredAuthSession({
+				accessToken: currentCachedSession.accessToken,
+				payload: nextPayload
+			})
+		});
+	});
+}
+async function clearAuthSession() {
+	return await withAuthSessionTransitionMutationLock(async () => {
+		await assertAuthSessionMutationAvailableWithOwnership();
+		cachedAuthSession = null;
+		await retryPendingTokenCleanup();
+		const hadLocalSession = await authSessionFileExists();
+		const payload = await readSessionPayloadFile();
+		if (payload?.v === 1 && isStoredTokenRef(payload.tokenRef)) await deleteAccessTokenOrRetainForCleanup(payload.tokenRef);
+		await removeSessionFile();
+		return { hadLocalSession };
+	});
+}
+async function assertAuthSessionMutationAvailable() {
+	await withAuthSessionTransitionMutationLock(assertAuthSessionMutationAvailableWithOwnership);
+}
+async function assertAuthSessionMutationAvailableWithOwnership() {
+	await recoverInterruptedAuthSessionTransitionWithOwnership();
+	if (await readAuthSessionTransitionJournal()) throw new AuthSessionRecoveryInProgressError();
+}
+async function retryPendingTokenCleanup() {
+	const pending = await readPendingTokenCleanup();
+	if (pending.tokenRefs.length === 0) return;
+	const remaining = [];
+	for (const tokenRef of pending.tokenRefs) try {
+		await deleteAccessToken(tokenRef);
+	} catch {
+		remaining.push(tokenRef);
+	}
+	await persistPendingTokenCleanup(remaining);
+}
+async function deleteAccessTokenOrRetainForCleanup(tokenRef) {
+	try {
+		await deleteAccessToken(tokenRef);
+	} catch {
+		const pending = await readPendingTokenCleanup();
+		if (pending.tokenRefs.some((ref) => areStoredTokenRefsEqual(ref, tokenRef))) return;
+		await persistPendingTokenCleanup([...pending.tokenRefs, tokenRef]);
+	}
+}
+async function readPendingTokenCleanup() {
+	const raw = await readFile(pendingTokenCleanupPath(), "utf8").catch((error) => {
+		if (isFileNotFoundError(error)) return null;
+		throw error;
+	});
+	if (raw === null) return {
+		v: 1,
+		tokenRefs: []
+	};
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		throw new Error("pending access-token cleanup state is invalid");
+	}
+	if (!(isRecord(parsed) && parsed.v === 1 && Array.isArray(parsed.tokenRefs))) throw new Error("pending access-token cleanup state is invalid");
+	const tokenRefs = parsed.tokenRefs.filter(isStoredTokenRef);
+	if (tokenRefs.length !== parsed.tokenRefs.length) throw new Error("pending access-token cleanup state is invalid");
+	return {
+		v: 1,
+		tokenRefs
+	};
+}
+async function persistPendingTokenCleanup(tokenRefs) {
+	const path = pendingTokenCleanupPath();
+	if (tokenRefs.length === 0) {
+		await rm(path, { force: true });
+		return;
+	}
+	await mkdir(join(openMeldRootDir(), "auth"), { recursive: true });
+	await writeJsonAtomically(path, {
+		v: 1,
+		tokenRefs
+	});
+}
+function pendingTokenCleanupPath() {
+	return join(openMeldRootDir(), "auth", "pending-token-cleanup.json");
+}
+async function authSessionFileExists() {
+	try {
+		await readFile(authSessionPath(), "utf8");
+		return true;
+	} catch (error) {
+		if (isFileNotFoundError(error)) return false;
+		throw error;
+	}
+}
+async function getLocalAuthSessionState(options = {}) {
+	let payload;
+	try {
+		payload = options.recover === false ? await readSessionPayloadFile() : await readSessionPayload();
+	} catch (error) {
+		if (error instanceof AuthSessionStorageError) return {
+			errorMessage: error.message,
+			reasonCode: "session_metadata_invalid",
+			state: "invalid",
+			session: null
+		};
+		throw error;
+	}
+	if (payload?.v !== 1) return {
+		reasonCode: "session_missing",
+		state: "missing",
+		session: null
+	};
+	const tokenRef = normalizeTokenRef(payload.tokenRef);
+	if (!tokenRef) return {
+		reasonCode: "session_token_ref_invalid",
+		state: "invalid",
+		session: null
+	};
+	const tokenType = normalizeOptionalString(payload.tokenType);
+	const authBaseUrl = normalizeOptionalString(payload.authBaseUrl);
+	const clientId = normalizeOptionalString(payload.clientId);
+	const createdAt = normalizeOptionalString(payload.createdAt);
+	if (!(tokenType && authBaseUrl && clientId && createdAt)) return {
+		reasonCode: "session_metadata_invalid",
+		state: "invalid",
+		session: null
+	};
+	let session = readCachedAuthSession(payload);
+	if (!session) {
+		const accessToken = await readAccessToken(tokenRef);
+		if (accessToken.status === "missing") return {
+			reasonCode: "session_token_missing",
+			state: "invalid",
+			session: null
+		};
+		if (accessToken.status === "unavailable") return {
+			errorMessage: accessToken.errorMessage,
+			reasonCode: "session_token_unavailable",
+			state: "invalid",
+			session: null
+		};
+		session = buildStoredAuthSession({
+			accessToken: accessToken.accessToken,
+			payload: {
+				...payload,
+				v: 1,
+				tokenRef,
+				tokenType,
+				authBaseUrl,
+				clientId,
+				createdAt
+			}
+		});
+		cacheAuthSession({
+			payload,
+			session
+		});
+	}
+	const expiryEligibility = resolveAuthSessionExpiryEligibility(session.expiresAt);
+	if (expiryEligibility.status === "invalid") return {
+		reasonCode: "session_expiry_invalid",
+		state: "invalid",
+		session: null
+	};
+	if (expiryEligibility.status === "expired") return {
+		reasonCode: "session_expired",
+		state: "expired",
+		session
+	};
+	return {
+		state: "valid",
+		session
+	};
+}
+async function assertStoredAccessTokenReloads(input) {
+	const reloaded = await readAccessToken(input.tokenRef);
+	if (reloaded.status === "found" && reloaded.accessToken === input.accessToken) return;
+	if (reloaded.status === "unavailable") throw new Error(`stored access token could not be reloaded: ${reloaded.errorMessage}`);
+	throw new Error("stored access token could not be reloaded");
+}
+function buildStoredAuthSession(input) {
+	return {
+		v: 1,
+		accessToken: input.accessToken,
+		tokenType: input.payload.tokenType,
+		authBaseUrl: input.payload.authBaseUrl,
+		clientId: input.payload.clientId,
+		createdAt: input.payload.createdAt,
+		...typeof input.payload.expiresAt === "string" && input.payload.expiresAt.trim() ? { expiresAt: input.payload.expiresAt.trim() } : {},
+		...typeof input.payload.scope === "string" && input.payload.scope.trim() ? { scope: input.payload.scope.trim() } : {},
+		...buildAuthUserPayload(input.payload.user),
+		...buildActiveOrganizationPayload(input.payload.activeOrganization)
+	};
+}
+async function cleanupTransitionTokensNotReferencedByCurrentSession(input) {
+	const currentTokenRef = normalizeTokenRef(input.currentPayload?.tokenRef);
+	const previousTokenRef = normalizeTokenRef(input.journal.previousPayload?.tokenRef);
+	const transitionTokenRefs = [...previousTokenRef ? [previousTokenRef] : [], input.journal.candidatePayload.tokenRef];
+	for (const [index, tokenRef] of transitionTokenRefs.entries()) {
+		if (transitionTokenRefs.slice(0, index).some((previousRef) => areStoredTokenRefsEqual(previousRef, tokenRef)) || currentTokenRef && areStoredTokenRefsEqual(currentTokenRef, tokenRef)) continue;
+		await deleteAccessTokenOrRetainForCleanup(tokenRef);
+	}
+}
+function cacheAuthSession(input) {
+	cachedAuthSession = {
+		payloadKey: buildAuthSessionPayloadKey(input.payload),
+		session: input.session
+	};
+}
+function readCachedAuthSession(payload) {
+	const payloadKey = buildAuthSessionPayloadKey(payload);
+	return cachedAuthSession?.payloadKey === payloadKey ? cachedAuthSession.session : null;
+}
+function buildAuthSessionPayloadKey(payload) {
+	return `${authSessionPath()}\n${JSON.stringify(payload)}`;
+}
+function areStoredTokenRefsEqual(left, right) {
+	return JSON.stringify(left) === JSON.stringify(right);
+}
+async function persistRemoteSessionRefresh(input) {
+	return await withAuthSessionTransitionMutationLock(async () => {
+		await assertAuthSessionMutationAvailableWithOwnership();
+		const payload = await readSessionPayloadFile();
+		if (payload?.v !== 1 || input.expectedPayloadKey === null || buildAuthSessionPayloadKey(payload) !== input.expectedPayloadKey) return null;
+		const tokenRef = normalizeTokenRef(payload.tokenRef);
+		const tokenType = normalizeOptionalString(payload.tokenType);
+		const authBaseUrl = normalizeOptionalString(payload.authBaseUrl);
+		const clientId = normalizeOptionalString(payload.clientId);
+		const createdAt = normalizeOptionalString(payload.createdAt);
+		if (!(tokenRef && tokenType && authBaseUrl && clientId && createdAt)) return null;
+		const nextAccessToken = normalizeOptionalString(input.accessToken);
+		if (!nextAccessToken) return null;
+		const nextTokenRef = nextAccessToken === input.previousAccessToken ? tokenRef : await storeAccessToken({
+			accessToken: nextAccessToken,
+			authBaseUrl,
+			clientId
+		});
+		const nextPayload = {
+			v: 1,
+			tokenRef: nextTokenRef,
+			tokenType,
+			authBaseUrl,
+			clientId,
+			createdAt,
+			expiresAt: input.expiresAt,
+			...typeof payload.scope === "string" && payload.scope.trim() ? { scope: payload.scope.trim() } : {},
+			...buildAuthUserPayload(payload.user),
+			...buildActiveOrganizationPayload(payload.activeOrganization)
+		};
+		const nextSession = buildStoredAuthSession({
+			accessToken: nextAccessToken,
+			payload: nextPayload
+		});
+		try {
+			await assertStoredAccessTokenReloads({
+				accessToken: nextAccessToken,
+				tokenRef: nextTokenRef
+			});
+			await writeSessionPayloadAtomically(authSessionPath(), nextPayload);
+		} catch (error) {
+			if (!areStoredTokenRefsEqual(tokenRef, nextTokenRef)) await deleteAccessTokenOrRetainForCleanup(nextTokenRef);
+			throw error;
+		}
+		cacheAuthSession({
+			payload: nextPayload,
+			session: nextSession
+		});
+		if (!areStoredTokenRefsEqual(tokenRef, nextTokenRef)) await deleteAccessTokenOrRetainForCleanup(tokenRef);
+		return nextSession;
+	});
+}
+function normalizeTokenRef(input) {
+	if (!isStoredTokenRef(input)) return null;
+	return input;
+}
+async function getRemoteAuthSessionState(session) {
+	let endpoint = "";
+	try {
+		endpoint = toAuthEndpoint(session.authBaseUrl, "/api/auth/get-session");
+	} catch {
+		return { state: "invalid" };
+	}
+	try {
+		const timeoutMs = resolveRemoteSessionTimeoutMs(endpoint);
+		const response = await fetch(endpoint, {
+			method: "GET",
+			headers: { Authorization: `${normalizeTokenType(session.tokenType)} ${session.accessToken}` },
+			signal: AbortSignal.timeout(timeoutMs)
+		});
+		if (response.status === 401 || response.status === 403) return { state: "revoked" };
+		if (!response.ok) return { state: "unknown" };
+		const payload = await parseResponseJson(response);
+		if (!hasActiveSessionPayload(payload)) return { state: "invalid" };
+		return {
+			state: "valid",
+			...readRemoteAccessToken(response),
+			...readRemoteSessionExpiration(payload)
+		};
+	} catch {
+		return { state: "unknown" };
+	}
+}
+function readRemoteAccessToken(response) {
+	const accessToken = normalizeOptionalString(response.headers.get("set-auth-token"));
+	return accessToken ? { accessToken } : {};
+}
+function readRemoteSessionExpiration(payload) {
+	if (!isRecord(payload)) return {};
+	const session = payload.session;
+	if (!isRecord(session)) return {};
+	const expiresAt = normalizeOptionalString(session.expiresAt);
+	if (!expiresAt) return {};
+	const expiresAtMs = Date.parse(expiresAt);
+	if (Number.isNaN(expiresAtMs)) return {};
+	return { expiresAt: new Date(expiresAtMs).toISOString() };
+}
+function resolveRemoteSessionTimeoutMs(endpoint) {
+	const url = parseUrlOrNull(endpoint);
+	if (url && isLoopbackHostname(url.hostname)) return LOOPBACK_REMOTE_SESSION_TIMEOUT_MS;
+	return DEFAULT_REMOTE_SESSION_TIMEOUT_MS;
+}
+function parseUrlOrNull(value) {
+	try {
+		return new URL(value);
+	} catch {
+		return null;
+	}
+}
+function isLoopbackHostname(hostname) {
+	return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1";
+}
+function hasActiveSessionPayload(payload) {
+	if (!isRecord(payload)) return false;
+	return isRecord(payload.session) && isRecord(payload.user);
+}
+function isExpired(expiresAt) {
+	return resolveAuthSessionExpiryEligibility(expiresAt).status === "expired";
+}
+function resolveRemoteAuthSessionReasonCode(state) {
+	switch (state) {
+		case "invalid": return "remote_session_invalid";
+		case "revoked": return "remote_session_revoked";
+		default: throw new Error(`unsupported remote auth session state: ${state}`);
+	}
+}
+async function readSessionPayload() {
+	await recoverInterruptedAuthSessionTransition();
+	return await readSessionPayloadFile();
+}
+async function readSessionPayloadFile() {
+	const path = authSessionPath();
+	const raw = await readFile(path, "utf8").catch((error) => {
+		if (isFileNotFoundError(error)) return null;
+		throw new AuthSessionStorageError({
+			message: `current auth session metadata could not be read at ${path}: ${toErrorMessage(error)}`,
+			reason: "unreadable",
+			cause: error
+		});
+	});
+	if (raw === null) return null;
+	try {
+		return JSON.parse(raw);
+	} catch (error) {
+		throw new AuthSessionStorageError({
+			message: `current auth session metadata is corrupt at ${path}`,
+			reason: "corrupt",
+			cause: error
+		});
+	}
+}
+async function recoverInterruptedAuthSessionTransition() {
+	await withAuthSessionTransitionMutationLock(recoverInterruptedAuthSessionTransitionWithOwnership);
+}
+async function recoverInterruptedAuthSessionTransitionWithOwnership() {
+	let journal = await readAuthSessionTransitionJournal();
+	if (!journal) return;
+	if (activeAuthSessionTransitionIds.has(journal.id)) return;
+	if (journal.state === "pending" && isProcessIdentityAlive({
+		ownerPid: journal.ownerPid,
+		ownerProcessStartedAt: journal.ownerProcessStartedAt
+	})) {
+		journal = await registerCurrentCandidateServiceProcess(journal);
+		return;
+	}
+	if (journal.state === "pending") {
+		await restoreTransitionPreviousPayload(journal);
+		stopRegisteredCandidateService(journal);
+		if (journal.computerHandoff) {
+			await writeAuthSessionTransitionJournalIfOwned(journal, {
+				...journal,
+				state: "recovery_required"
+			});
+			return;
+		}
+		await deleteAccessTokenOrRetainForCleanup(journal.candidatePayload.tokenRef);
+		await removeAuthSessionTransitionJournalIfOwned(journal);
+		return;
+	}
+	if (journal.state === "recovery_required") {
+		stopRegisteredCandidateService(journal);
+		return;
+	}
+	if (journal.state === "committed") {
+		const currentPayload = await readSessionPayloadFile();
+		if (currentPayload?.v !== 1 || buildAuthSessionPayloadKey(currentPayload) !== buildAuthSessionPayloadKey(journal.candidatePayload)) throw new AuthSessionStorageError({
+			message: "committed auth session transition does not match current session metadata",
+			reason: "corrupt"
+		});
+		await finalizeCommittedAuthSessionTransition(journal).catch((error) => {
+			logDeferredAuthSessionTransitionCleanup({
+				error,
+				transitionId: journal.id
+			});
+		});
+	}
+}
+async function finalizeCommittedAuthSessionTransition(journal) {
+	const previousTokenRef = normalizeTokenRef(journal.previousPayload?.tokenRef);
+	if (previousTokenRef && !areStoredTokenRefsEqual(previousTokenRef, journal.candidatePayload.tokenRef)) await deleteAccessTokenOrRetainForCleanup(previousTokenRef);
+	await removeAuthSessionTransitionJournalIfOwned(journal);
+}
+async function registerCurrentCandidateServiceProcess(journal) {
+	if (!isCurrentProcessCandidateService()) return journal;
+	const currentProcess = {
+		ownerPid: process.pid,
+		ownerProcessStartedAt: CURRENT_PROCESS_START_IDENTITY
+	};
+	if (journal.candidateServiceProcess?.ownerPid === currentProcess.ownerPid && journal.candidateServiceProcess.ownerProcessStartedAt === currentProcess.ownerProcessStartedAt) return journal;
+	const currentJournal = await readAuthSessionTransitionJournal();
+	if (currentJournal?.id !== journal.id || currentJournal.state !== "pending") return currentJournal ?? journal;
+	const updatedJournal = {
+		...currentJournal,
+		candidateServiceProcess: currentProcess
+	};
+	await writeAuthSessionTransitionJournalIfOwned(currentJournal, updatedJournal);
+	return updatedJournal;
+}
+function stopRegisteredCandidateService(journal) {
+	const candidateServiceProcess = journal.candidateServiceProcess;
+	if (!(candidateServiceProcess && isProcessIdentityAlive(candidateServiceProcess))) return;
+	try {
+		process.kill(candidateServiceProcess.ownerPid, "SIGTERM");
+	} catch (error) {
+		if (!isFileNotFoundErrorCode(error, "ESRCH")) throw new AuthSessionStorageError({
+			message: `candidate OpenMeld Service process ${String(candidateServiceProcess.ownerPid)} could not be stopped: ${toErrorMessage(error)}`,
+			reason: "unreadable",
+			cause: error
+		});
+	}
+}
+function isCurrentProcessCandidateService() {
+	const runtimeMode = String(process.env.OPENMELD_DAEMON_RUNTIME_MODE ?? "").trim();
+	return runtimeMode === "background" || runtimeMode === "foreground";
+}
+async function readStoredAuthSessionFromPayload(payload) {
+	const session = await readStoredAuthSessionFromPayloadIfPresent(payload);
+	if (!session) throw new AuthSessionStorageError({
+		message: "auth session recovery token is missing",
+		reason: "corrupt"
+	});
+	return session;
+}
+async function readStoredAuthSessionFromPayloadIfPresent(payload) {
+	const accessToken = await readAccessToken(payload.tokenRef);
+	if (accessToken.status === "missing") return null;
+	if (accessToken.status === "unavailable") throw new AuthSessionStorageError({
+		message: accessToken.errorMessage,
+		reason: "unreadable"
+	});
+	return buildStoredAuthSession({
+		accessToken: accessToken.accessToken,
+		payload
+	});
+}
+async function readRequiredComputerAuthRecoveryJournal(id) {
+	const journal = await readAuthSessionTransitionJournal();
+	if (journal?.id !== id || journal.state !== "recovery_required" || !journal.computerHandoff) throw new Error("computer auth recovery is no longer current");
+	return journal;
+}
+function logDeferredAuthSessionTransitionCleanup(input) {
+	console.warn("[openmeld.auth.session_transition_cleanup_deferred]", {
+		error: toErrorMessage(input.error),
+		transitionId: input.transitionId
+	});
+}
+async function restoreTransitionPreviousPayload(journal, previousSession) {
+	cachedAuthSession = null;
+	if (!journal.previousPayload) {
+		await removeSessionFile();
+		return;
+	}
+	await writeSessionPayloadAtomically(authSessionPath(), journal.previousPayload);
+	if (previousSession) cacheAuthSession({
+		payload: journal.previousPayload,
+		session: previousSession
+	});
+}
+async function readAuthSessionTransitionJournal() {
+	const path = authSessionTransitionPath();
+	const raw = await readFile(path, "utf8").catch((error) => {
+		if (isFileNotFoundError(error)) return null;
+		throw new AuthSessionStorageError({
+			message: `auth session transition state could not be read at ${path}: ${toErrorMessage(error)}`,
+			reason: "unreadable",
+			cause: error
+		});
+	});
+	if (raw === null) return null;
+	let value;
+	try {
+		value = JSON.parse(raw);
+	} catch (error) {
+		throw new AuthSessionStorageError({
+			message: `auth session transition state is corrupt at ${path}`,
+			reason: "corrupt",
+			cause: error
+		});
+	}
+	if (!isAuthSessionTransitionJournal(value)) throw new AuthSessionStorageError({
+		message: `auth session transition state is corrupt at ${path}`,
+		reason: "corrupt"
+	});
+	return value;
+}
+function isAuthSessionTransitionJournal(value) {
+	if (!isRecord(value)) return false;
+	return value.v === 1 && typeof value.id === "string" && value.id.length > 0 && (value.state === "pending" || value.state === "recovery_required" || value.state === "committed") && Number.isSafeInteger(value.ownerPid) && Number(value.ownerPid) > 0 && typeof value.ownerProcessStartedAt === "string" && value.ownerProcessStartedAt.length > 0 && (value.previousPayload === null || isAuthSessionPayload(value.previousPayload)) && isAuthSessionPayload(value.candidatePayload) && isOptionalProcessIdentity(value.candidateServiceProcess) && isOptionalComputerHandoffRecovery(value.computerHandoff);
+}
+function isOptionalProcessIdentity(value) {
+	return value === void 0 || isRecord(value) && Number.isSafeInteger(value.ownerPid) && Number(value.ownerPid) > 0 && typeof value.ownerProcessStartedAt === "string" && value.ownerProcessStartedAt.length > 0;
+}
+function isOptionalComputerHandoffRecovery(value) {
+	if (value === void 0) return true;
+	if (!(isRecord(value) && typeof value.gatewayUrl === "string")) return false;
+	return (value.serviceReconciledAt === void 0 || typeof value.serviceReconciledAt === "string") && (value.remoteSessionRevokedAt === void 0 || typeof value.remoteSessionRevokedAt === "string") && (value.lastRecoveryFailure === void 0 || isComputerHandoffRecoveryFailure(value.lastRecoveryFailure));
+}
+function isComputerHandoffRecoveryFailure(value) {
+	return isRecord(value) && typeof value.at === "string" && typeof value.message === "string" && (value.phase === "service" || value.phase === "remote_session" || value.phase === "local_cleanup") && (value.endpoint === void 0 || typeof value.endpoint === "string") && (value.status === void 0 || value.status === null || typeof value.status === "number");
+}
+function isAuthSessionPayload(value) {
+	return isRecord(value) && value.v === 1 && isStoredTokenRef(value.tokenRef);
+}
+async function writeAuthSessionTransitionJournalIfOwned(expected, next) {
+	if (!hasSameAuthSessionTransitionIdentity(expected, next)) throw new Error("auth session transition identity cannot change");
+	const current = await readAuthSessionTransitionJournal();
+	if (!current) throw new AuthSessionTransitionConflictError({
+		previousOwnerRestored: false,
+		reason: "journal_missing"
+	});
+	if (!hasSameAuthSessionTransitionIdentity(expected, current)) throw new AuthSessionTransitionConflictError({
+		previousOwnerRestored: false,
+		reason: "journal_replaced"
+	});
+	await writeJsonAtomically(authSessionTransitionPath(), next);
+}
+async function claimAuthSessionTransitionJournal(journal) {
+	const path = authSessionTransitionPath();
+	const claimPath = `${path}.claim-${process.pid}-${Date.now()}-${randomUUID()}`;
+	const file = await open(claimPath, "wx", 384);
+	let failure;
+	try {
+		await file.writeFile(`${JSON.stringify(journal, null, 2)}\n`, "utf8");
+		await file.sync();
+	} catch (error) {
+		failure = error;
+	}
+	try {
+		await file.close();
+	} catch (error) {
+		failure ??= error;
+	}
+	if (failure !== void 0) {
+		await rm(claimPath, { force: true }).catch(() => void 0);
+		throw failure;
+	}
+	try {
+		await link(claimPath, path);
+	} catch (error) {
+		if (isFileNotFoundErrorCode(error, "EEXIST")) throw new AuthSessionRecoveryInProgressError();
+		throw error;
+	} finally {
+		await rm(claimPath, { force: true }).catch(() => void 0);
+	}
+}
+async function removeAuthSessionTransitionJournalIfOwned(expected) {
+	const currentJournal = await readAuthSessionTransitionJournal();
+	if (!currentJournal) return;
+	if (!hasSameAuthSessionTransitionIdentity(expected, currentJournal)) throw new AuthSessionTransitionConflictError({
+		previousOwnerRestored: false,
+		reason: "journal_replaced"
+	});
+	await rm(authSessionTransitionPath(), { force: true });
+}
+function hasSameAuthSessionTransitionIdentity(left, right) {
+	return left.id === right.id && left.ownerPid === right.ownerPid && left.ownerProcessStartedAt === right.ownerProcessStartedAt;
+}
+function authSessionTransitionPath() {
+	return join(openMeldRootDir(), "auth", "session-transition.json");
+}
+function authSessionPath() {
+	return join(openMeldRootDir(), "auth", "session.json");
+}
+async function ensureAuthSessionDirectory() {
+	await mkdir(join(openMeldRootDir(), "auth"), { recursive: true });
+}
+async function writeSessionPayloadAtomically(path, payload) {
+	await writeJsonAtomically(path, payload);
+}
+async function writeJsonAtomically(path, payload) {
+	const tempPath = `${path}.tmp-${process.pid}-${Date.now()}-${randomUUID()}`;
+	try {
+		const file = await open(tempPath, "wx", 384);
+		try {
+			await file.writeFile(`${JSON.stringify(payload, null, 2)}\n`, "utf8");
+			await file.sync();
+		} finally {
+			await file.close();
+		}
+		await rename(tempPath, path);
+	} catch (error) {
+		await rm(tempPath, { force: true }).catch(() => void 0);
+		throw error;
+	}
+}
+function isFileNotFoundError(error) {
+	return Boolean(error && typeof error === "object" && "code" in error && error.code === "ENOENT");
+}
+function isFileNotFoundErrorCode(error, code) {
+	return Boolean(error && typeof error === "object" && "code" in error && error.code === code);
+}
+function toErrorMessage(error) {
+	return error instanceof Error && error.message.trim() ? error.message.trim() : String(error ?? "unknown error");
+}
+function buildAuthUserPayload(value) {
+	if (!(value && typeof value === "object")) return {};
+	const record = value;
+	const id = normalizeOptionalString(record.id);
+	const email = normalizeOptionalString(record.email);
+	const name = normalizeOptionalString(record.name);
+	if (!(id || email || name)) return {};
+	return { user: {
+		...id ? { id } : {},
+		...email ? { email } : {},
+		...name ? { name } : {}
+	} };
+}
+function buildActiveOrganizationPayload(value) {
+	const activeOrganization = normalizeStoredActiveOrganization(value);
+	return activeOrganization ? { activeOrganization } : {};
+}
+function normalizeStoredActiveOrganization(value) {
+	if (!isRecord(value)) return null;
+	const id = normalizeOptionalString(value.id);
+	const slug = normalizeOptionalString(value.slug);
+	const name = normalizeOptionalString(value.name);
+	const role = normalizeOptionalString(value.role);
+	const personal = readOrganizationIsPersonal(value);
+	if (!(id && slug && name)) return null;
+	return {
+		id,
+		slug,
+		name,
+		...role ? { role } : {},
+		...personal ? { personal } : {}
+	};
+}
+function normalizeTokenType(value) {
+	const normalized = value.trim();
+	return normalized.length > 0 ? normalized : "Bearer";
+}
+function normalizeOptionalString(value) {
+	const normalized = String(value ?? "").trim();
+	return normalized.length > 0 ? normalized : null;
+}
+function readOrganizationIsPersonal(value) {
+	if (value.personal === true || value.isPersonal === true) return true;
+	return readOrganizationMetadata(value.metadata)?.personal === true;
+}
+function readOrganizationMetadata(metadata) {
+	if (metadata === null || metadata === void 0) return null;
+	if (typeof metadata === "string") try {
+		const parsed = JSON.parse(metadata);
+		return isRecord(parsed) ? parsed : null;
+	} catch {
+		return null;
+	}
+	return isRecord(metadata) ? metadata : null;
+}
+function toAuthEndpoint(baseUrl, pathname) {
+	const url = new URL(baseUrl);
+	url.pathname = `${url.pathname.replace(TRAILING_SLASHES_RE, "")}${pathname.startsWith("/") ? pathname : `/${pathname}`}` || "/";
+	url.search = "";
+	url.hash = "";
+	return url.toString();
+}
+function isRecord(value) {
+	return Boolean(value && typeof value === "object");
+}
+async function parseResponseJson(response) {
+	const raw = await response.text();
+	if (!raw) return null;
+	try {
+		return JSON.parse(raw);
+	} catch {
+		return { message: raw };
+	}
+}
+async function removeSessionFile() {
+	await rm(authSessionPath(), { force: true });
+}
+//#endregion
+export { MAX_HEARTBEAT_INTERVAL_MS as A, RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS as B, DAEMON_STREAM_CONNECT_TIMEOUT_MS as C, DEFAULT_HEARTBEAT_INTERVAL_MS as D, DEFAULT_GATEWAY_CHAIN_TIMEOUT_MS as E, PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS as F, PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS as I, REGISTER_RESPONSE_TIMEOUT_MS as L, MIN_HEARTBEAT_INTERVAL_MS as M, MIN_SPACE_REQUEST_TIMEOUT_MS as N, DEFAULT_SPACE_REQUEST_TIMEOUT_MS as O, OPENCLAW_CLI_TIMEOUT_MS as P, ROUTE_CATALOG_LOAD_TIMEOUT_MS as R, DAEMON_RUNTIME_CONTRACT_EPOCH as S, DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS as T, RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS as V, isBinaryDistribution as _, clearAuthSession as a, CATALOG_SYNC_RETRY_INTERVAL_MS as b, getAuthSessionState as c, markInterruptedComputerAuthSessionRecovery as d, normalizeStoredActiveOrganization as f, runMacOsNativeKeychainHelperIfRequested as g, updateAuthSessionActiveOrganization as h, beginAuthSessionTransition as i, MAX_SPACE_REQUEST_TIMEOUT_MS as j, HEARTBEAT_RESPONSE_TIMEOUT_MS as k, getCurrentAuthOwnerUserId as l, setAuthSession as m, assertAuthSessionMutationAvailable as n, completeInterruptedComputerAuthSessionRecovery as o, recordInterruptedComputerAuthSessionRecoveryFailure as p, auth_session_exports as r, getAuthSessionMetadata as s, AuthSessionRecoveryInProgressError as t, getInterruptedComputerAuthSessionRecovery as u, resolveOpenMeldDistribution as v, DAEMON_STREAM_KEEPALIVE_INTERVAL_MS as w, CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS as x, resolveAuthSessionExpiryEligibility as y, RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS as z };
+
+//# sourceMappingURL=auth-session-B1jSy0ws.js.map