openmeld 0.3.134 → 0.3.136

package/dist/{auth-session-BbrUVaZd.js → auth-session-Bj8n8YwV.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 import { $ as runWithHeldLock, K as isOpenMeldLockError, Lt as openMeldRootDir, W as acquireLock, _t as CURRENT_PROCESS_START_IDENTITY, vt as isProcessIdentityAlive, xn as __exportAll } from "./base-url-BtqW4aLS.js";
-import { t as CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH } from "./runtime-transport-D4_-d5Yb.js";
+import { t as CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH } from "./runtime-transport-BiQfJGnw.js";
 import { createRequire } from "node:module";
 import * as z$1 from "zod/v4";
 import { join, resolve } from "node:path";
@@ -110,25 +110,40 @@ function resolveAuthSessionExpiryEligibility(expiresAt, nowMs = Date.now()) {
 //#endregion
 //#region src/config/auth-session-transition-lock.ts
 const AUTH_SESSION_LOCK_KEY = "session-transition-mutation";
+const AUTH_SESSION_CANDIDATE_REFRESH_LOCK_KEY = "candidate-session-refresh";
 const AUTH_SESSION_LOCK_PROFILE = "auth-session";
 const AUTH_SESSION_LOCK_RETRY_DELAY_MS = 20;
 const AUTH_SESSION_LOCK_WAIT_MS = 1e4;
 async function withAuthSessionTransitionMutationLock(operation) {
+	return await withAuthSessionLock({
+		component: "auth_session_transition",
+		key: AUTH_SESSION_LOCK_KEY,
+		operation
+	});
+}
+async function withAuthSessionCandidateRefreshLock(operation) {
+	return await withAuthSessionLock({
+		component: "auth_session_candidate_refresh",
+		key: AUTH_SESSION_CANDIDATE_REFRESH_LOCK_KEY,
+		operation
+	});
+}
+async function withAuthSessionLock(input) {
 	return await runWithHeldLock({
-		lock: await acquireAuthSessionTransitionMutationLock(),
-		run: operation,
+		lock: await acquireAuthSessionLock(input),
+		run: input.operation,
 		releaseContext: {
-			component: "auth_session_transition",
-			lockKey: AUTH_SESSION_LOCK_KEY
+			component: input.component,
+			lockKey: input.key
 		}
 	});
 }
-async function acquireAuthSessionTransitionMutationLock() {
+async function acquireAuthSessionLock(input) {
 	const deadline = Date.now() + AUTH_SESSION_LOCK_WAIT_MS;
 	while (true) try {
 		return await acquireLock({
-			key: AUTH_SESSION_LOCK_KEY,
-			meta: { component: "auth_session_transition" },
+			key: input.key,
+			meta: { component: input.component },
 			openMeldProfileId: AUTH_SESSION_LOCK_PROFILE
 		});
 	} catch (error) {
@@ -731,6 +746,8 @@ var auth_session_exports = /* @__PURE__ */ __exportAll({
 	setAuthSession: () => setAuthSession,
 	updateAuthSessionActiveOrganization: () => updateAuthSessionActiveOrganization
 });
+const MAX_CANDIDATE_SERVICE_PROCESSES = 16;
+const MAX_CANDIDATE_TOKEN_REFS = 64;
 var AuthSessionStorageError = class extends Error {
 	reason;
 	constructor(input) {
@@ -772,6 +789,9 @@ const TRAILING_SLASHES_RE = /\/+$/u;
 let cachedAuthSession = null;
 const activeAuthSessionTransitionIds = /* @__PURE__ */ new Set();
 async function getAuthSessionState(options = {}) {
+	return await getAuthSessionStateWithCandidateRefreshFence(options, false);
+}
+async function getAuthSessionStateWithCandidateRefreshFence(options, candidateRefreshFenceHeld) {
 	const localState = await getLocalAuthSessionState();
 	const localPayloadKey = cachedAuthSession?.payloadKey ?? null;
 	const shouldValidateRemote = options.validateRemote === true || options.refreshExpired === true && localState.state === "expired";
@@ -785,6 +805,7 @@ async function getAuthSessionState(options = {}) {
 		default: return localState;
 	}
 	if (!shouldValidateRemote) return localState;
+	if (!candidateRefreshFenceHeld && await shouldFencePendingCandidateRemoteValidation()) return await withAuthSessionCandidateRefreshLock(async () => await getAuthSessionStateWithCandidateRefreshFence(options, true));
 	const remoteValidation = await getRemoteAuthSessionState(localState.session);
 	if (remoteValidation.state === "valid") return await resolveRemotelyValidatedAuthSession({
 		localPayloadKey,
@@ -804,6 +825,10 @@ async function getAuthSessionState(options = {}) {
 		session: null
 	};
 }
+async function shouldFencePendingCandidateRemoteValidation() {
+	const journal = await readAuthSessionTransitionJournal();
+	return Boolean(journal?.state === "pending" && journal.candidateCredentialRefreshVersion === 1 && isAuthSessionTransitionCandidateVisibleToCurrentProcess(journal));
+}
 async function resolveRemotelyValidatedAuthSession(input) {
 	if (!input.remoteValidation.expiresAt || isExpired(input.remoteValidation.expiresAt)) return input.localState;
 	let refreshedSession;
@@ -816,7 +841,14 @@ async function resolveRemotelyValidatedAuthSession(input) {
 		});
 	} catch (error) {
 		if (!(error instanceof AuthSessionRecoveryInProgressError)) throw error;
-		return await getLocalAuthSessionState({ recover: false });
+		return {
+			state: "valid",
+			session: {
+				...input.localState.session,
+				accessToken: input.remoteValidation.accessToken ?? input.localState.session.accessToken,
+				expiresAt: input.remoteValidation.expiresAt
+			}
+		};
 	}
 	if (!refreshedSession) return await getLocalAuthSessionState();
 	return {
@@ -922,6 +954,8 @@ async function beginAuthSessionTransition(input, context = {}) {
 			ownerProcessStartedAt: CURRENT_PROCESS_START_IDENTITY,
 			previousPayload: previousPayload?.v === 1 ? previousPayload : null,
 			candidatePayload: nextPayload,
+			candidateCredentialRefreshVersion: 1,
+			candidateTokenRefs: [tokenRef],
 			...context.computerHandoff ? { computerHandoff: { gatewayUrl: context.computerHandoff.gatewayUrl } } : {}
 		};
 		let journalClaimed = false;
@@ -957,14 +991,14 @@ async function beginAuthSessionTransition(input, context = {}) {
 			if (!journal.previousPayload) return currentPayload === null;
 			return currentPayload?.v === 1 && buildAuthSessionPayloadKey(currentPayload) === buildAuthSessionPayloadKey(journal.previousPayload);
 		};
-		const isCandidateSessionCurrent = (currentPayload) => currentPayload?.v === 1 && buildAuthSessionPayloadKey(currentPayload) === buildAuthSessionPayloadKey(nextPayload);
+		const isCandidateSessionCurrent = (currentPayload, candidatePayload = nextPayload) => currentPayload?.v === 1 && buildAuthSessionPayloadKey(currentPayload) === buildAuthSessionPayloadKey(candidatePayload);
 		const assertPreviousSessionCurrent = async () => {
 			const currentPayload = await readSessionPayloadFile();
 			if (!isPreviousSessionCurrent(currentPayload)) throw new Error("auth session changed before the setup transition completed");
 		};
-		const assertTransitionSessionCurrent = async () => {
+		const assertTransitionSessionCurrent = async (candidatePayload = nextPayload) => {
 			const currentPayload = await readSessionPayloadFile();
-			if (!(isPreviousSessionCurrent(currentPayload) || isCandidateSessionCurrent(currentPayload))) throw new Error("auth session changed before the setup transition completed");
+			if (!(isPreviousSessionCurrent(currentPayload) || isCandidateSessionCurrent(currentPayload, candidatePayload))) throw new Error("auth session changed before the setup transition completed");
 		};
 		const restoreMissingJournalTransition = async () => {
 			const currentPayload = await readSessionPayloadFile();
@@ -1016,14 +1050,13 @@ async function beginAuthSessionTransition(input, context = {}) {
 						reason: currentJournal.status
 					});
 				}
+				const committedPayload = currentJournal.journal.candidatePayload;
+				const committedSession = await readStoredAuthSessionFromPayload(committedPayload);
 				await assertPreviousSessionCurrent();
-				await writeSessionPayloadAtomically(authSessionPath(), nextPayload);
+				await writeSessionPayloadAtomically(authSessionPath(), committedPayload);
 				cacheAuthSession({
-					payload: nextPayload,
-					session: buildStoredAuthSession({
-						accessToken,
-						payload: nextPayload
-					})
+					payload: committedPayload,
+					session: committedSession
 				});
 				const committedJournal = {
 					...currentJournal.journal,
@@ -1054,7 +1087,7 @@ async function beginAuthSessionTransition(input, context = {}) {
 						reason: currentJournal.status
 					});
 				}
-				await assertTransitionSessionCurrent();
+				await assertTransitionSessionCurrent(currentJournal.journal.candidatePayload);
 				await restoreTransitionPreviousPayload(currentJournal.journal, previousSession);
 				settlement = "rolled_back";
 				activeAuthSessionTransitionIds.delete(journal.id);
@@ -1066,7 +1099,7 @@ async function beginAuthSessionTransition(input, context = {}) {
 					});
 					return;
 				}
-				await deleteAccessTokenOrRetainForCleanup(tokenRef);
+				await cleanupCandidateTokenRefs(currentJournal.journal);
 				await removeAuthSessionTransitionJournalIfOwned(currentJournal.journal);
 			})
 		};
@@ -1164,7 +1197,7 @@ async function completeInterruptedComputerAuthSessionRecovery(id) {
 		const journal = await readRequiredComputerAuthRecoveryJournal(id);
 		if (!(journal.computerHandoff.serviceReconciledAt && journal.computerHandoff.remoteSessionRevokedAt)) throw new Error("computer auth recovery cannot complete before service and remote-session cleanup");
 		try {
-			await deleteAccessTokenOrRetainForCleanup(journal.candidatePayload.tokenRef);
+			await cleanupCandidateTokenRefs(journal);
 			await removeAuthSessionTransitionJournalIfOwned(journal);
 			return true;
 		} catch (error) {
@@ -1436,7 +1469,7 @@ function buildStoredAuthSessionIdentity(session) {
 async function cleanupTransitionTokensNotReferencedByCurrentSession(input) {
 	const currentTokenRef = normalizeTokenRef(input.currentPayload?.tokenRef);
 	const previousTokenRef = normalizeTokenRef(input.journal.previousPayload?.tokenRef);
-	const transitionTokenRefs = [...previousTokenRef ? [previousTokenRef] : [], input.journal.candidatePayload.tokenRef];
+	const transitionTokenRefs = [...previousTokenRef ? [previousTokenRef] : [], ...getCandidateTokenRefs(input.journal)];
 	for (const [index, tokenRef] of transitionTokenRefs.entries()) {
 		if (transitionTokenRefs.slice(0, index).some((previousRef) => areStoredTokenRefsEqual(previousRef, tokenRef)) || currentTokenRef && areStoredTokenRefsEqual(currentTokenRef, tokenRef)) continue;
 		await deleteAccessTokenOrRetainForCleanup(tokenRef);
@@ -1458,57 +1491,134 @@ function buildAuthSessionPayloadKey(payload) {
 function areStoredTokenRefsEqual(left, right) {
 	return JSON.stringify(left) === JSON.stringify(right);
 }
+function getUniqueTokenRefs(tokenRefs) {
+	const uniqueTokenRefs = [];
+	for (const tokenRef of tokenRefs) if (!uniqueTokenRefs.some((existing) => areStoredTokenRefsEqual(existing, tokenRef))) uniqueTokenRefs.push(tokenRef);
+	return uniqueTokenRefs;
+}
+function getCandidateTokenRefs(journal) {
+	return getUniqueTokenRefs([...journal.candidateTokenRefs ?? [], journal.candidatePayload.tokenRef]);
+}
+async function cleanupCandidateTokenRefs(journal, keepTokenRef) {
+	for (const tokenRef of getCandidateTokenRefs(journal)) {
+		if (keepTokenRef && areStoredTokenRefsEqual(keepTokenRef, tokenRef)) continue;
+		await deleteAccessTokenOrRetainForCleanup(tokenRef);
+	}
+}
 async function persistRemoteSessionRefresh(input) {
 	return await withAuthSessionTransitionMutationLock(async () => {
-		await assertAuthSessionMutationAvailableWithOwnership();
-		const payload = await readSessionPayloadFile();
-		if (payload?.v !== 1 || input.expectedPayloadKey === null || buildAuthSessionPayloadKey(payload) !== input.expectedPayloadKey) return null;
-		const tokenRef = normalizeTokenRef(payload.tokenRef);
-		const tokenType = normalizeOptionalString(payload.tokenType);
-		const authBaseUrl = normalizeOptionalString(payload.authBaseUrl);
-		const clientId = normalizeOptionalString(payload.clientId);
-		const createdAt = normalizeOptionalString(payload.createdAt);
-		if (!(tokenRef && tokenType && authBaseUrl && clientId && createdAt)) return null;
-		const nextAccessToken = normalizeOptionalString(input.accessToken);
-		if (!nextAccessToken) return null;
-		const nextTokenRef = nextAccessToken === input.previousAccessToken ? tokenRef : await storeAccessToken({
-			accessToken: nextAccessToken,
-			authBaseUrl,
-			clientId
-		});
-		const nextPayload = {
-			v: 1,
-			tokenRef: nextTokenRef,
-			tokenType,
-			authBaseUrl,
-			clientId,
-			createdAt,
-			expiresAt: input.expiresAt,
-			...typeof payload.scope === "string" && payload.scope.trim() ? { scope: payload.scope.trim() } : {},
-			...buildAuthUserPayload(payload.user),
-			...buildActiveOrganizationPayload(payload.activeOrganization)
-		};
-		const nextSession = buildStoredAuthSession({
-			accessToken: nextAccessToken,
-			payload: nextPayload
-		});
-		try {
-			await assertStoredAccessTokenReloads({
-				accessToken: nextAccessToken,
-				tokenRef: nextTokenRef
+		await recoverInterruptedAuthSessionTransitionWithOwnership();
+		const transitionJournal = await readAuthSessionTransitionJournal();
+		if (transitionJournal) {
+			if (transitionJournal.state === "pending" && transitionJournal.candidateCredentialRefreshVersion === 1 && isAuthSessionTransitionCandidateVisibleToCurrentProcess(transitionJournal) && input.expectedPayloadKey !== null && buildAuthSessionPayloadKey(transitionJournal.candidatePayload) === input.expectedPayloadKey) return await persistPendingCandidateRemoteSessionRefresh({
+				...input,
+				journal: transitionJournal
 			});
-			await writeSessionPayloadAtomically(authSessionPath(), nextPayload);
-		} catch (error) {
-			if (!areStoredTokenRefsEqual(tokenRef, nextTokenRef)) await deleteAccessTokenOrRetainForCleanup(nextTokenRef);
-			throw error;
+			throw new AuthSessionRecoveryInProgressError();
 		}
-		cacheAuthSession({
-			payload: nextPayload,
-			session: nextSession
+		return await persistCommittedRemoteSessionRefresh(input);
+	});
+}
+async function persistCommittedRemoteSessionRefresh(input) {
+	const payload = await readSessionPayloadFile();
+	if (payload?.v !== 1 || input.expectedPayloadKey === null || buildAuthSessionPayloadKey(payload) !== input.expectedPayloadKey) return null;
+	const refresh = await prepareRemoteSessionRefresh({
+		...input,
+		payload,
+		uniqueTokenRef: false
+	});
+	if (!refresh) return null;
+	try {
+		await assertStoredAccessTokenReloads({
+			accessToken: refresh.nextSession.accessToken,
+			tokenRef: refresh.nextTokenRef
 		});
-		if (!areStoredTokenRefsEqual(tokenRef, nextTokenRef)) await deleteAccessTokenOrRetainForCleanup(tokenRef);
-		return nextSession;
+		await writeSessionPayloadAtomically(authSessionPath(), refresh.nextPayload);
+	} catch (error) {
+		await cleanupFailedRemoteSessionRefresh(refresh);
+		throw error;
+	}
+	cacheAuthSession({
+		payload: refresh.nextPayload,
+		session: refresh.nextSession
 	});
+	if (!areStoredTokenRefsEqual(refresh.currentTokenRef, refresh.nextTokenRef)) await deleteAccessTokenOrRetainForCleanup(refresh.currentTokenRef);
+	return refresh.nextSession;
+}
+async function persistPendingCandidateRemoteSessionRefresh(input) {
+	const refresh = await prepareRemoteSessionRefresh({
+		...input,
+		payload: input.journal.candidatePayload,
+		uniqueTokenRef: true
+	});
+	if (!refresh) return null;
+	const candidateTokenRefs = getUniqueTokenRefs([...getCandidateTokenRefs(input.journal), refresh.nextTokenRef]);
+	if (candidateTokenRefs.length > MAX_CANDIDATE_TOKEN_REFS) {
+		await cleanupFailedRemoteSessionRefresh(refresh);
+		throw new AuthSessionStorageError({
+			message: `auth session transition has more than ${String(MAX_CANDIDATE_TOKEN_REFS)} candidate token rotations`,
+			reason: "unreadable"
+		});
+	}
+	const nextJournal = {
+		...input.journal,
+		candidatePayload: refresh.nextPayload,
+		candidateTokenRefs
+	};
+	try {
+		await assertStoredAccessTokenReloads({
+			accessToken: refresh.nextSession.accessToken,
+			tokenRef: refresh.nextTokenRef
+		});
+		await writeAuthSessionTransitionJournalIfOwned(input.journal, nextJournal);
+	} catch (error) {
+		await cleanupFailedRemoteSessionRefresh(refresh);
+		throw error;
+	}
+	cacheAuthSession({
+		payload: refresh.nextPayload,
+		session: refresh.nextSession
+	});
+	return refresh.nextSession;
+}
+async function prepareRemoteSessionRefresh(input) {
+	const currentTokenRef = normalizeTokenRef(input.payload.tokenRef);
+	const tokenType = normalizeOptionalString(input.payload.tokenType);
+	const authBaseUrl = normalizeOptionalString(input.payload.authBaseUrl);
+	const clientId = normalizeOptionalString(input.payload.clientId);
+	const createdAt = normalizeOptionalString(input.payload.createdAt);
+	const nextAccessToken = normalizeOptionalString(input.accessToken);
+	if (!(currentTokenRef && tokenType && authBaseUrl && clientId && createdAt && nextAccessToken)) return null;
+	const nextTokenRef = nextAccessToken === input.previousAccessToken ? currentTokenRef : await storeAccessToken({
+		accessToken: nextAccessToken,
+		authBaseUrl,
+		clientId,
+		unique: input.uniqueTokenRef
+	});
+	const nextPayload = {
+		v: 1,
+		tokenRef: nextTokenRef,
+		tokenType,
+		authBaseUrl,
+		clientId,
+		createdAt,
+		expiresAt: input.expiresAt,
+		...typeof input.payload.scope === "string" && input.payload.scope.trim() ? { scope: input.payload.scope.trim() } : {},
+		...buildAuthUserPayload(input.payload.user),
+		...buildActiveOrganizationPayload(input.payload.activeOrganization)
+	};
+	return {
+		currentTokenRef,
+		nextPayload,
+		nextSession: buildStoredAuthSession({
+			accessToken: nextAccessToken,
+			payload: nextPayload
+		}),
+		nextTokenRef
+	};
+}
+async function cleanupFailedRemoteSessionRefresh(refresh) {
+	if (!areStoredTokenRefsEqual(refresh.currentTokenRef, refresh.nextTokenRef)) await deleteAccessTokenOrRetainForCleanup(refresh.nextTokenRef);
 }
 function normalizeTokenRef(input) {
 	if (!isStoredTokenRef(input)) return null;
@@ -1587,12 +1697,17 @@ function resolveRemoteAuthSessionReasonCode(state) {
 async function readSessionPayload() {
 	await recoverInterruptedAuthSessionTransition();
 	const journal = await readAuthSessionTransitionJournal();
-	if (journal?.state === "pending" && isAuthSessionTransitionCandidateVisibleToCurrentProcess(journal)) return journal.candidatePayload;
+	if (journal?.state === "pending") {
+		if (isAuthSessionTransitionCandidateVisibleToCurrentProcess(journal)) return journal.candidatePayload;
+	}
 	return await readSessionPayloadFile();
 }
 function isAuthSessionTransitionCandidateVisibleToCurrentProcess(journal) {
 	if (activeAuthSessionTransitionIds.has(journal.id)) return true;
-	return journal.candidateServiceProcess?.ownerPid === process.pid && journal.candidateServiceProcess.ownerProcessStartedAt === CURRENT_PROCESS_START_IDENTITY;
+	return getRegisteredCandidateServiceProcesses(journal).some((candidateServiceProcess) => isSameProcessIdentity(candidateServiceProcess, {
+		ownerPid: process.pid,
+		ownerProcessStartedAt: CURRENT_PROCESS_START_IDENTITY
+	}));
 }
 async function readSessionPayloadFile() {
 	const path = authSessionPath();
@@ -1639,7 +1754,7 @@ async function recoverInterruptedAuthSessionTransitionWithOwnership() {
 			});
 			return;
 		}
-		await deleteAccessTokenOrRetainForCleanup(journal.candidatePayload.tokenRef);
+		await cleanupCandidateTokenRefs(journal);
 		await removeAuthSessionTransitionJournalIfOwned(journal);
 		return;
 	}
@@ -1664,6 +1779,7 @@ async function recoverInterruptedAuthSessionTransitionWithOwnership() {
 async function finalizeCommittedAuthSessionTransition(journal) {
 	const previousTokenRef = normalizeTokenRef(journal.previousPayload?.tokenRef);
 	if (previousTokenRef && !areStoredTokenRefsEqual(previousTokenRef, journal.candidatePayload.tokenRef)) await deleteAccessTokenOrRetainForCleanup(previousTokenRef);
+	await cleanupCandidateTokenRefs(journal, journal.candidatePayload.tokenRef);
 	await removeAuthSessionTransitionJournalIfOwned(journal);
 }
 async function registerCurrentCandidateServiceProcess(journal) {
@@ -1672,29 +1788,43 @@ async function registerCurrentCandidateServiceProcess(journal) {
 		ownerPid: process.pid,
 		ownerProcessStartedAt: CURRENT_PROCESS_START_IDENTITY
 	};
-	if (journal.candidateServiceProcess?.ownerPid === currentProcess.ownerPid && journal.candidateServiceProcess.ownerProcessStartedAt === currentProcess.ownerProcessStartedAt) return journal;
+	if (getRegisteredCandidateServiceProcesses(journal).some((candidateServiceProcess) => isSameProcessIdentity(candidateServiceProcess, currentProcess))) return journal;
 	const currentJournal = await readAuthSessionTransitionJournal();
 	if (currentJournal?.id !== journal.id || currentJournal.state !== "pending") return currentJournal ?? journal;
+	const candidateServiceProcesses = getRegisteredCandidateServiceProcesses(currentJournal).filter(isProcessIdentityAlive);
+	candidateServiceProcesses.push(currentProcess);
+	if (candidateServiceProcesses.length > MAX_CANDIDATE_SERVICE_PROCESSES) throw new Error(`auth session transition has more than ${String(MAX_CANDIDATE_SERVICE_PROCESSES)} live candidate OpenMeld Service processes`);
 	const updatedJournal = {
 		...currentJournal,
+		candidateServiceProcesses,
 		candidateServiceProcess: currentProcess
 	};
 	await writeAuthSessionTransitionJournalIfOwned(currentJournal, updatedJournal);
 	return updatedJournal;
 }
 function stopRegisteredCandidateService(journal) {
-	const candidateServiceProcess = journal.candidateServiceProcess;
-	if (!(candidateServiceProcess && isProcessIdentityAlive(candidateServiceProcess))) return;
-	try {
-		process.kill(candidateServiceProcess.ownerPid, "SIGTERM");
-	} catch (error) {
-		if (!isFileNotFoundErrorCode(error, "ESRCH")) throw new AuthSessionStorageError({
-			message: `candidate OpenMeld Service process ${String(candidateServiceProcess.ownerPid)} could not be stopped: ${toErrorMessage(error)}`,
-			reason: "unreadable",
-			cause: error
-		});
+	for (const candidateServiceProcess of getRegisteredCandidateServiceProcesses(journal)) {
+		if (!isProcessIdentityAlive(candidateServiceProcess)) continue;
+		try {
+			process.kill(candidateServiceProcess.ownerPid, "SIGTERM");
+		} catch (error) {
+			if (!isFileNotFoundErrorCode(error, "ESRCH")) throw new AuthSessionStorageError({
+				message: `candidate OpenMeld Service process ${String(candidateServiceProcess.ownerPid)} could not be stopped: ${toErrorMessage(error)}`,
+				reason: "unreadable",
+				cause: error
+			});
+		}
 	}
 }
+function getRegisteredCandidateServiceProcesses(journal) {
+	const candidates = [...journal.candidateServiceProcesses ?? [], ...journal.candidateServiceProcess ? [journal.candidateServiceProcess] : []];
+	const uniqueCandidates = [];
+	for (const candidate of candidates) if (!uniqueCandidates.some((existing) => isSameProcessIdentity(existing, candidate))) uniqueCandidates.push(candidate);
+	return uniqueCandidates;
+}
+function isSameProcessIdentity(left, right) {
+	return left.ownerPid === right.ownerPid && left.ownerProcessStartedAt === right.ownerProcessStartedAt;
+}
 function isCurrentProcessCandidateService() {
 	const runtimeMode = String(process.env.OPENMELD_DAEMON_RUNTIME_MODE ?? "").trim();
 	return runtimeMode === "background" || runtimeMode === "foreground";
@@ -1771,10 +1901,19 @@ async function readAuthSessionTransitionJournal() {
 }
 function isAuthSessionTransitionJournal(value) {
 	if (!isRecord(value)) return false;
-	return value.v === 1 && typeof value.id === "string" && value.id.length > 0 && (value.state === "pending" || value.state === "recovery_required" || value.state === "committed") && Number.isSafeInteger(value.ownerPid) && Number(value.ownerPid) > 0 && typeof value.ownerProcessStartedAt === "string" && value.ownerProcessStartedAt.length > 0 && (value.previousPayload === null || isAuthSessionPayload(value.previousPayload)) && isAuthSessionPayload(value.candidatePayload) && isOptionalProcessIdentity(value.candidateServiceProcess) && isOptionalComputerHandoffRecovery(value.computerHandoff);
+	return value.v === 1 && typeof value.id === "string" && value.id.length > 0 && (value.state === "pending" || value.state === "recovery_required" || value.state === "committed") && Number.isSafeInteger(value.ownerPid) && Number(value.ownerPid) > 0 && typeof value.ownerProcessStartedAt === "string" && value.ownerProcessStartedAt.length > 0 && (value.previousPayload === null || isAuthSessionPayload(value.previousPayload)) && isAuthSessionPayload(value.candidatePayload) && (value.candidateCredentialRefreshVersion === void 0 || value.candidateCredentialRefreshVersion === 1) && isOptionalStoredTokenRefList(value.candidateTokenRefs) && isOptionalProcessIdentityList(value.candidateServiceProcesses) && isOptionalProcessIdentity(value.candidateServiceProcess) && isOptionalComputerHandoffRecovery(value.computerHandoff);
+}
+function isOptionalStoredTokenRefList(value) {
+	return value === void 0 || Array.isArray(value) && value.length <= MAX_CANDIDATE_TOKEN_REFS && value.every((tokenRef) => isStoredTokenRef(tokenRef));
+}
+function isOptionalProcessIdentityList(value) {
+	return value === void 0 || Array.isArray(value) && value.length <= MAX_CANDIDATE_SERVICE_PROCESSES && value.every((candidate) => isProcessIdentity(candidate));
 }
 function isOptionalProcessIdentity(value) {
-	return value === void 0 || isRecord(value) && Number.isSafeInteger(value.ownerPid) && Number(value.ownerPid) > 0 && typeof value.ownerProcessStartedAt === "string" && value.ownerProcessStartedAt.length > 0;
+	return value === void 0 || isProcessIdentity(value);
+}
+function isProcessIdentity(value) {
+	return isRecord(value) && Number.isSafeInteger(value.ownerPid) && Number(value.ownerPid) > 0 && typeof value.ownerProcessStartedAt === "string" && value.ownerProcessStartedAt.length > 0;
 }
 function isOptionalComputerHandoffRecovery(value) {
 	if (value === void 0) return true;
@@ -1958,4 +2097,4 @@ async function removeSessionFile() {
 //#endregion
 export { HEARTBEAT_RESPONSE_TIMEOUT_MS as A, RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS as B, DAEMON_RUNTIME_CONTRACT_EPOCH as C, DEFAULT_GATEWAY_CHAIN_TIMEOUT_MS as D, DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS as E, OPENCLAW_CLI_TIMEOUT_MS as F, RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS as H, PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS as I, PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS as L, MAX_SPACE_REQUEST_TIMEOUT_MS as M, MIN_HEARTBEAT_INTERVAL_MS as N, DEFAULT_HEARTBEAT_INTERVAL_MS as O, MIN_SPACE_REQUEST_TIMEOUT_MS as P, REGISTER_RESPONSE_TIMEOUT_MS as R, CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS as S, DAEMON_STREAM_KEEPALIVE_INTERVAL_MS as T, RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS as V, runMacOsNativeKeychainHelperIfRequested as _, beginAuthSessionTransition as a, resolveAuthSessionExpiryEligibility as b, getAuthSessionMetadata as c, getInterruptedComputerAuthSessionRecovery as d, markInterruptedComputerAuthSessionRecovery as f, updateAuthSessionActiveOrganization as g, setAuthSession as h, auth_session_exports as i, MAX_HEARTBEAT_INTERVAL_MS as j, DEFAULT_SPACE_REQUEST_TIMEOUT_MS as k, getAuthSessionState as l, recordInterruptedComputerAuthSessionRecoveryFailure as m, AuthSessionRecoveryInProgressError as n, clearAuthSession as o, normalizeStoredActiveOrganization as p, assertAuthSessionMutationAvailable as r, completeInterruptedComputerAuthSessionRecovery as s, AuthSessionChangedBeforeTransitionError as t, getCurrentAuthOwnerUserId as u, isBinaryDistribution as v, DAEMON_STREAM_CONNECT_TIMEOUT_MS as w, CATALOG_SYNC_RETRY_INTERVAL_MS as x, resolveOpenMeldDistribution as y, ROUTE_CATALOG_LOAD_TIMEOUT_MS as z };
 
-//# sourceMappingURL=auth-session-BbrUVaZd.js.map
+//# sourceMappingURL=auth-session-Bj8n8YwV.js.map