openmeld 0.3.205 → 0.3.207

package/dist/{auth-session-wmefguut.js → auth-session-CO5XtFaq.js}

@@ -1,15 +1,19 @@
 #!/usr/bin/env node
 
 import { t as isLoopbackHostname } from "./loopback-hostname-DHQPKq8N.js";
-import { S as isProcessIdentityAlive, r as isOpenMeldLockError, t as acquireLock, tt as openMeldRootDir, u as runWithHeldLock, x as CURRENT_PROCESS_START_IDENTITY } from "./lock-CvBnBcFK.js";
-import { $r as int, Dn as START_ISO_DATE_TIME_SCHEMA, En as START_BOUNDED_VERSION_SCHEMA, Jr as boolean, Oi as openMeldProfileIdSchema, Qr as enumFactory, Tn as START_BOUNDED_ID_SCHEMA, Xr as discriminatedUnion, ci as record, d as CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH, ei as iso, i as authProfileManagedRoleSchema, ii as nullFactory, jn as localAgentCatalogSchema, kn as startReplyReadinessSummarySchema, li as strictObject, mi as unknown, ni as literal, oi as object, pi as union, qr as array, r as authProfileKindSchema, ui as string } from "./profiles-Dx3gaXgQ.js";
+import { C as isProcessIdentityAlive, S as CURRENT_PROCESS_START_IDENTITY, d as runWithHeldLock, i as isOpenMeldLockError, rt as openMeldRootDir, t as acquireLock, w as readProcessStartIdentity } from "./lock-Dxp6o_t_.js";
+import { Dr as START_BOUNDED_ID_SCHEMA, Gr as openMeldProfileIdSchema, Lr as authProfileKindSchema, Nr as localAgentCatalogSchema, Or as START_BOUNDED_VERSION_SCHEMA, Rr as authProfileManagedRoleSchema, jr as startReplyReadinessSummarySchema, kr as START_ISO_DATE_TIME_SCHEMA, t as CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH } from "./runtime-transport-QIZmAo4-.js";
+import { $ as literal, G as boolean, W as array, X as int, Y as enumFactory, Z as iso, at as record, dt as unknown, ot as strictObject, q as discriminatedUnion, rt as object, st as string, tt as nullFactory, ut as union } from "./control-plane-D9jDcbMZ.js";
 import { r as daemonServiceLaneSchema } from "./service-contract-CRyDcIIf.js";
+import { i as serviceAccountAdmissionSchema, t as isBinaryDistribution } from "./distribution-DY2fBeSW.js";
+import { n as writeDaemonLocalStateFile } from "./daemon-local-state-file-jOXuXrky.js";
 import { createRequire } from "node:module";
 import { createHash, randomUUID } from "node:crypto";
 import { join, resolve } from "node:path";
 import { chmod, link, mkdir, open, readFile, rename, rm, writeFile } from "node:fs/promises";
 import * as z$1 from "zod/v4";
 import { spawn } from "node:child_process";
+import { AsyncLocalStorage } from "node:async_hooks";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { fileURLToPath } from "node:url";
 //#region ../../packages/schemas/dist/schemas/start/device-projection.js
@@ -81,63 +85,6 @@ z$1.strictObject({
 	deviceReplyReadiness: startReplyReadinessSummarySchema
 });
 //#endregion
-//#region ../../packages/schemas/dist/schemas/local-machine/macos-keychain-helper.js
-const MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION = "disallow";
-const macOsKeychainServiceSchema = z$1.string().trim().min(1).max(512);
-const macOsKeychainAccountSchema = z$1.string().trim().min(1).max(512);
-const macOsKeychainAccessTokenSchema = z$1.string().min(1).max(65536);
-const macOsKeychainHelperOperationSchema = z$1.enum([
-	"store",
-	"read",
-	"delete"
-]);
-const macOsKeychainHelperRequestSchema = z$1.discriminatedUnion("operation", [
-	z$1.strictObject({
-		schemaVersion: z$1.literal(2),
-		operation: z$1.literal("store"),
-		service: macOsKeychainServiceSchema,
-		account: macOsKeychainAccountSchema,
-		accessToken: macOsKeychainAccessTokenSchema,
-		authenticationInteraction: z$1.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)
-	}),
-	z$1.strictObject({
-		schemaVersion: z$1.literal(2),
-		operation: z$1.literal("read"),
-		service: macOsKeychainServiceSchema,
-		account: macOsKeychainAccountSchema,
-		authenticationInteraction: z$1.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)
-	}),
-	z$1.strictObject({
-		schemaVersion: z$1.literal(2),
-		operation: z$1.literal("delete"),
-		service: macOsKeychainServiceSchema,
-		account: macOsKeychainAccountSchema,
-		authenticationInteraction: z$1.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)
-	})
-]);
-const macOsKeychainHelperMutationSuccessSchema = z$1.strictObject({
-	schemaVersion: z$1.literal(2),
-	ok: z$1.literal(true),
-	operation: z$1.enum(["store", "delete"])
-});
-const macOsKeychainHelperReadSuccessSchema = z$1.strictObject({
-	schemaVersion: z$1.literal(2),
-	ok: z$1.literal(true),
-	operation: z$1.literal("read"),
-	accessToken: z$1.union([macOsKeychainAccessTokenSchema, z$1.null()])
-});
-const macOsKeychainHelperErrorSchema = z$1.strictObject({
-	schemaVersion: z$1.literal(2),
-	ok: z$1.literal(false),
-	operation: macOsKeychainHelperOperationSchema,
-	errorMessage: z$1.string().trim().min(1).max(2048)
-});
-const macOsKeychainHelperResponseSchema = z$1.union([
-	macOsKeychainHelperMutationSuccessSchema,
-	macOsKeychainHelperReadSuccessSchema,
-	macOsKeychainHelperErrorSchema
-]);
-//#endregion
 //#region ../../packages/schemas/dist/schemas/prepare/session.js
 const PREPARE_BOUNDED_ID_SCHEMA = string().trim().min(1).max(256);
 const prepareSessionContinuationSchema = strictObject({
@@ -590,7 +537,7 @@ const prepareSessionEventSchema = strictObject({
 	localAgentIds: prepareLocalAgentIdsSchema,
 	createdAt: PREPARE_ISO_DATE_TIME_SCHEMA
 });
-strictObject({
+const createPrepareSessionRequestSchema = strictObject({
 	connectedComputerId: union([PREPARE_BOUNDED_ID_SCHEMA, nullFactory()]).optional(),
 	humanProfileId: union([openMeldProfileIdSchema, nullFactory()]).optional(),
 	deviceId: union([PREPARE_BOUNDED_ID_SCHEMA, nullFactory()]).optional(),
@@ -706,6 +653,63 @@ const prepareSessionStreamServerFrameSchema = discriminatedUnion("type", [
 	})
 ]);
 //#endregion
+//#region ../../packages/schemas/dist/schemas/local-machine/macos-keychain-helper.js
+const MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION = "disallow";
+const macOsKeychainServiceSchema = z$1.string().trim().min(1).max(512);
+const macOsKeychainAccountSchema = z$1.string().trim().min(1).max(512);
+const macOsKeychainAccessTokenSchema = z$1.string().min(1).max(65536);
+const macOsKeychainHelperOperationSchema = z$1.enum([
+	"store",
+	"read",
+	"delete"
+]);
+const macOsKeychainHelperRequestSchema = z$1.discriminatedUnion("operation", [
+	z$1.strictObject({
+		schemaVersion: z$1.literal(2),
+		operation: z$1.literal("store"),
+		service: macOsKeychainServiceSchema,
+		account: macOsKeychainAccountSchema,
+		accessToken: macOsKeychainAccessTokenSchema,
+		authenticationInteraction: z$1.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)
+	}),
+	z$1.strictObject({
+		schemaVersion: z$1.literal(2),
+		operation: z$1.literal("read"),
+		service: macOsKeychainServiceSchema,
+		account: macOsKeychainAccountSchema,
+		authenticationInteraction: z$1.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)
+	}),
+	z$1.strictObject({
+		schemaVersion: z$1.literal(2),
+		operation: z$1.literal("delete"),
+		service: macOsKeychainServiceSchema,
+		account: macOsKeychainAccountSchema,
+		authenticationInteraction: z$1.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)
+	})
+]);
+const macOsKeychainHelperMutationSuccessSchema = z$1.strictObject({
+	schemaVersion: z$1.literal(2),
+	ok: z$1.literal(true),
+	operation: z$1.enum(["store", "delete"])
+});
+const macOsKeychainHelperReadSuccessSchema = z$1.strictObject({
+	schemaVersion: z$1.literal(2),
+	ok: z$1.literal(true),
+	operation: z$1.literal("read"),
+	accessToken: z$1.union([macOsKeychainAccessTokenSchema, z$1.null()])
+});
+const macOsKeychainHelperErrorSchema = z$1.strictObject({
+	schemaVersion: z$1.literal(2),
+	ok: z$1.literal(false),
+	operation: macOsKeychainHelperOperationSchema,
+	errorMessage: z$1.string().trim().min(1).max(2048)
+});
+const macOsKeychainHelperResponseSchema = z$1.union([
+	macOsKeychainHelperMutationSuccessSchema,
+	macOsKeychainHelperReadSuccessSchema,
+	macOsKeychainHelperErrorSchema
+]);
+//#endregion
 //#region src/strategy-constants.ts
 const DEFAULT_GATEWAY_CHAIN_TIMEOUT_MS = 3e4;
 const DEFAULT_REMOTE_SESSION_TIMEOUT_MS = 8e3;
@@ -791,19 +795,111 @@ async function acquireAuthSessionLock(input) {
 	}
 }
 //#endregion
-//#region src/runtime/distribution.ts
-const BINARY_DISTRIBUTION = "binary";
-const NPM_DISTRIBUTION = "npm";
-/**
-* The distribution form this CLI build was compiled for. Falls back to `npm`
-* when the marker is absent (e.g. under Vitest, where no build-time define
-* runs), which keeps the safe, path-independent default.
-*/
-function resolveOpenMeldDistribution() {
-	return NPM_DISTRIBUTION;
-}
-function isBinaryDistribution() {
-	return resolveOpenMeldDistribution() === BINARY_DISTRIBUTION;
+//#region src/config/service-account-admission.ts
+var ServiceAccountAdmissionError = class extends Error {
+	code;
+	constructor(reason, message) {
+		super(message);
+		this.name = "ServiceAccountAdmissionError";
+		this.code = `service.account_admission.${reason}`;
+	}
+};
+function admissionPath() {
+	return join(openMeldRootDir(), "auth", "service-account-admission.json");
+}
+async function readServiceAccountAdmission() {
+	let raw;
+	try {
+		raw = await readFile(admissionPath(), "utf8");
+	} catch (error) {
+		if (error.code === "ENOENT") return null;
+		throw error;
+	}
+	let value;
+	try {
+		value = JSON.parse(raw);
+	} catch {
+		value = null;
+	}
+	const parsed = serviceAccountAdmissionSchema.safeParse(value);
+	if (!parsed.success) throw new ServiceAccountAdmissionError("unknown", "OpenMeld could not verify the pending Service action. Run `openmeld service status --json` for diagnostics.");
+	return parsed.data;
+}
+async function writeAdmission(value) {
+	await writeDaemonLocalStateFile({
+		path: admissionPath(),
+		schema: serviceAccountAdmissionSchema,
+		value,
+		mode: 384
+	});
+}
+async function assertServiceAccountAdmissionMutationAvailable() {
+	const current = await readServiceAccountAdmission();
+	if (current?.state !== "pending") return;
+	if (isProcessIdentityAlive(current.requester)) throw new ServiceAccountAdmissionError("busy", "OpenMeld is starting or stopping this Service. Try the account change again when that action is accepted.");
+	await writeAdmission({
+		...current,
+		state: "cancelled"
+	});
+}
+async function reserveServiceAccountAdmission(input) {
+	await assertServiceAccountAdmissionMutationAvailable();
+	const previous = await readServiceAccountAdmission();
+	if (!CURRENT_PROCESS_START_IDENTITY.startsWith("ps:")) throw new ServiceAccountAdmissionError("unknown", "OpenMeld could not verify this command's process identity. Try again from a supported local CLI.");
+	const reservation = {
+		version: 1,
+		id: randomUUID(),
+		operation: input.operation,
+		state: "pending",
+		identity: input.identity,
+		...input.target ? { target: input.target } : {},
+		requester: {
+			ownerPid: process.pid,
+			ownerProcessStartedAt: CURRENT_PROCESS_START_IDENTITY
+		},
+		...previous?.startupReceipt ? { startupReceipt: previous.startupReceipt } : {}
+	};
+	await writeAdmission(reservation);
+	return reservation;
+}
+async function cancelServiceAccountAdmission(id) {
+	await withAuthSessionTransitionMutationLock(async () => {
+		const current = await readServiceAccountAdmission();
+		if (current?.id === id && current.state === "pending") await writeAdmission({
+			...current,
+			state: "cancelled"
+		});
+	});
+}
+async function admitServiceAccountOperation(input) {
+	const current = await readServiceAccountAdmission();
+	const contractBinding = bindServiceAccountIdentity(input.identity);
+	if (input.operation === "start" && current?.startupReceipt?.id === input.id && current.startupReceipt.contractBinding === contractBinding) return;
+	if (!current || current.id !== input.id || current.operation !== input.operation || current.state !== "pending" || readProcessStartIdentity(current.requester.ownerPid) !== current.requester.ownerProcessStartedAt || current.target !== void 0 && (current.target.ownerPid !== process.pid || current.target.ownerProcessStartedAt !== CURRENT_PROCESS_START_IDENTITY) || JSON.stringify(current.identity) !== JSON.stringify(input.identity)) throw new ServiceAccountAdmissionError("cancelled", "This Service action is no longer authorized. Check the signed-in account and try again.");
+	input.commit?.();
+	await writeAdmission({
+		...current,
+		state: "admitted",
+		carrier: {
+			ownerPid: process.pid,
+			ownerProcessStartedAt: CURRENT_PROCESS_START_IDENTITY
+		},
+		...input.operation === "start" ? { startupReceipt: {
+			id: input.id,
+			contractBinding
+		} } : {}
+	});
+}
+function bindServiceAccountIdentity(identity) {
+	return createHash("sha256").update(JSON.stringify([
+		identity.accountId,
+		identity.authBaseUrl,
+		identity.clientId,
+		identity.gatewayUrl,
+		identity.lane,
+		identity.deviceId,
+		identity.contractGeneration
+	])).digest("hex");
 }
 //#endregion
 //#region src/config/macos-native-keychain.ts
@@ -816,6 +912,9 @@ let unresponsiveKeychainError = null;
 let keychainRetryAt = 0;
 let lastKeychainFailureCode = null;
 const MAC_OS_KEYCHAIN_RETRY_DELAY_MS = 3e4;
+function getMacOsKeychainRetryAfterMs() {
+	return Math.max(0, keychainRetryAt - Date.now());
+}
 async function storeMacOsNativeKeychainToken(input) {
 	if (isBinaryDistribution()) {
 		await runBoundedMacOsNativeKeychainRequest({
@@ -1172,6 +1271,7 @@ async function readAccessToken(ref) {
 	} catch (error) {
 		return {
 			errorMessage: toErrorMessage$1(error),
+			...ref.provider === "macos-keychain" ? { retryAfterMs: getMacOsKeychainRetryAfterMs() } : {},
 			status: "unavailable"
 		};
 	}
@@ -1447,13 +1547,128 @@ var AuthSessionTransitionConflictError = class extends Error {
 };
 const TRAILING_SLASHES_RE = /\/+$/u;
 let cachedAuthSession = null;
+const pendingCredentialReads = /* @__PURE__ */ new Map();
+const credentialAvailabilityListeners = /* @__PURE__ */ new Set();
+function onAuthSessionCredentialAvailable(notify) {
+	const listener = {
+		path: authSessionPath(),
+		notify
+	};
+	credentialAvailabilityListeners.add(listener);
+	return () => {
+		credentialAvailabilityListeners.delete(listener);
+	};
+}
 const activeAuthSessionTransitionIds = /* @__PURE__ */ new Set();
+const admittedServiceSession = new AsyncLocalStorage();
+const boundSessionPayloadKeys = /* @__PURE__ */ new WeakMap();
+function withAdmittedServiceSession(session, run) {
+	return admittedServiceSession.run(structuredClone(session), run);
+}
+async function readServiceAdmissionSessionWithOwnership() {
+	if (await readAuthSessionTransitionJournal()) throw new AuthSessionRecoveryInProgressError();
+	const state = await getLocalAuthSessionState({ recover: false });
+	if (state.state !== "valid" || !state.session?.user?.id) throw new Error("Service control requires a valid CLI sign-in. Sign in with the matching account and try again.");
+	return state.session;
+}
+const credentialObservationListeners = /* @__PURE__ */ new Set();
+function onAuthSessionCredentialObservation(notify) {
+	const listener = {
+		path: authSessionPath(),
+		notify
+	};
+	credentialObservationListeners.add(listener);
+	return () => {
+		credentialObservationListeners.delete(listener);
+	};
+}
+function observeCredential(reason) {
+	const path = authSessionPath();
+	for (const listener of credentialObservationListeners) if (listener.path === path) try {
+		listener.notify(reason);
+	} catch {}
+}
 async function getAuthSessionState(options = {}) {
-	return await getAuthSessionStateWithCandidateRefreshFence(options, false);
+	const bound = admittedServiceSession.getStore();
+	if (bound) return await getBoundServiceSessionState(bound, options);
+	const result = await getAuthSessionStateWithCandidateRefreshFence(options, false);
+	if (result.reasonCode === "session_metadata_invalid") observeCredential("metadata_unavailable");
+	return {
+		state: result.state,
+		session: result.session,
+		...result.reasonCode ? { reasonCode: result.reasonCode } : {},
+		...result.errorMessage ? { errorMessage: result.errorMessage } : {},
+		...result.retryAfterMs !== void 0 ? { retryAfterMs: result.retryAfterMs } : {}
+	};
+}
+async function syncBoundServiceCredentials(bound) {
+	const local = await getLocalAuthSessionState({ recover: false });
+	const samePrincipal = isSameAuthPrincipal(local.session, bound);
+	const localPayloadKey = samePrincipal && "payloadKey" in local ? local.payloadKey : null;
+	if (samePrincipal && local.session && boundSessionPayloadKeys.get(bound) !== localPayloadKey) {
+		Object.assign(bound, local.session, { activeOrganization: local.session.activeOrganization });
+		boundSessionPayloadKeys.set(bound, localPayloadKey);
+	}
+	if (samePrincipal && local.session && bound.expiresAt && (bound.accessToken !== local.session.accessToken || bound.expiresAt !== local.session.expiresAt)) await persistBoundServiceRefresh(bound, {
+		state: "valid",
+		accessToken: bound.accessToken,
+		expiresAt: bound.expiresAt
+	}, localPayloadKey, local.session.accessToken);
+	return samePrincipal ? boundSessionPayloadKeys.get(bound) ?? null : null;
+}
+async function getBoundServiceSessionState(bound, options) {
+	const localPayloadKey = await syncBoundServiceCredentials(bound);
+	if (options.validateRemote || options.refreshExpired && isExpired(bound.expiresAt)) {
+		const remote = await getRemoteAuthSessionState(bound);
+		if (remote.state === "revoked" || remote.state === "invalid") return {
+			state: remote.state,
+			session: null,
+			reasonCode: resolveRemoteAuthSessionReasonCode(remote.state)
+		};
+		if (remote.state === "valid") {
+			await persistBoundServiceRefresh(bound, remote, localPayloadKey);
+			if (remote.accessToken) bound.accessToken = remote.accessToken;
+			if (remote.expiresAt) bound.expiresAt = remote.expiresAt;
+		}
+	}
+	const expiry = resolveAuthSessionExpiryEligibility(bound.expiresAt);
+	if (expiry.status === "expired") return {
+		session: bound,
+		state: "expired",
+		reasonCode: "session_expired"
+	};
+	if (expiry.status === "invalid") return {
+		session: null,
+		state: "invalid",
+		reasonCode: "session_expiry_invalid"
+	};
+	return {
+		session: bound,
+		state: "valid"
+	};
+}
+async function persistBoundServiceRefresh(bound, remote, localPayloadKey, previousAccessToken = bound.accessToken) {
+	if (!(localPayloadKey && remote.expiresAt) || isExpired(remote.expiresAt)) return;
+	try {
+		if (await persistRemoteSessionRefresh({
+			accessToken: remote.accessToken ?? bound.accessToken,
+			previousAccessToken,
+			expectedPayloadKey: localPayloadKey,
+			expiresAt: remote.expiresAt
+		})) {
+			const current = await getLocalAuthSessionState({ recover: false });
+			boundSessionPayloadKeys.set(bound, isSameAuthPrincipal(current.session, bound) && "payloadKey" in current ? current.payloadKey : null);
+		}
+	} catch (error) {
+		if (!(error instanceof ServiceAccountAdmissionError && error.code === "service.account_admission.busy")) throw error;
+	}
+}
+function isSameAuthPrincipal(current, expected) {
+	return Boolean(expected.user?.id && current?.user?.id === expected.user.id && current.authBaseUrl === expected.authBaseUrl && current.clientId === expected.clientId);
 }
 async function getAuthSessionStateWithCandidateRefreshFence(options, candidateRefreshFenceHeld) {
 	const localState = await getLocalAuthSessionState();
-	const localPayloadKey = cachedAuthSession?.payloadKey ?? null;
+	const localPayloadKey = "payloadKey" in localState ? localState.payloadKey : null;
 	const shouldValidateRemote = options.validateRemote === true || options.refreshExpired === true && localState.state === "expired";
 	switch (localState.state) {
 		case "missing":
@@ -1970,6 +2185,11 @@ async function completeInterruptedComputerAuthSessionRecovery(id) {
 	});
 }
 async function getAuthSessionMetadata() {
+	const bound = admittedServiceSession.getStore();
+	if (bound) {
+		await getBoundServiceSessionState(bound, {});
+		return buildAuthSessionMetadata(bound);
+	}
 	return buildAuthSessionMetadata(await readSessionPayload());
 }
 function buildAuthSessionMetadata(payload) {
@@ -2049,6 +2269,12 @@ async function assertAuthSessionMutationAvailable() {
 	await withAuthSessionTransitionMutationLock(assertAuthSessionMutationAvailableWithOwnership);
 }
 async function assertAuthSessionMutationAvailableWithOwnership() {
+	await assertServiceAccountAdmissionMutationAvailable();
+	const bound = admittedServiceSession.getStore();
+	if (bound) {
+		const current = await readSessionPayloadFile();
+		if (current?.user?.id !== bound.user?.id || current?.authBaseUrl !== bound.authBaseUrl || current?.clientId !== bound.clientId) throw new AuthSessionChangedBeforeTransitionError();
+	}
 	await recoverInterruptedAuthSessionTransitionWithOwnership();
 	if (await readAuthSessionTransitionJournal()) throw new AuthSessionRecoveryInProgressError();
 }
@@ -2124,65 +2350,59 @@ async function getLocalAuthSessionState(options = {}) {
 	try {
 		payload = options.recover === false ? await readSessionPayloadFile() : await readSessionPayload();
 	} catch (error) {
-		if (error instanceof AuthSessionStorageError) return {
-			errorMessage: error.message,
-			reasonCode: "session_metadata_invalid",
-			state: "invalid",
+		if (error instanceof AuthSessionStorageError) {
+			cachedAuthSession = null;
+			return {
+				errorMessage: error.message,
+				reasonCode: "session_metadata_invalid",
+				state: "invalid",
+				session: null
+			};
+		}
+		throw error;
+	}
+	if (payload?.v !== 1) {
+		cachedAuthSession = null;
+		return {
+			reasonCode: "session_missing",
+			state: "missing",
 			session: null
 		};
-		throw error;
 	}
-	if (payload?.v !== 1) return {
-		reasonCode: "session_missing",
-		state: "missing",
-		session: null
-	};
 	const tokenRef = normalizeTokenRef(payload.tokenRef);
-	if (!tokenRef) return {
-		reasonCode: "session_token_ref_invalid",
-		state: "invalid",
-		session: null
-	};
+	if (!tokenRef) {
+		cachedAuthSession = null;
+		return {
+			reasonCode: "session_token_ref_invalid",
+			state: "invalid",
+			session: null
+		};
+	}
 	const tokenType = normalizeOptionalString(payload.tokenType);
 	const authBaseUrl = normalizeOptionalString(payload.authBaseUrl);
 	const clientId = normalizeOptionalString(payload.clientId);
 	const createdAt = normalizeOptionalString(payload.createdAt);
-	if (!(tokenType && authBaseUrl && clientId && createdAt)) return {
-		reasonCode: "session_metadata_invalid",
-		state: "invalid",
-		session: null
-	};
-	let session = readCachedAuthSession(payload);
-	if (!session) {
-		const accessToken = await readAccessToken(tokenRef);
-		if (accessToken.status === "missing") return {
-			reasonCode: "session_token_missing",
-			state: "invalid",
-			session: null
-		};
-		if (accessToken.status === "unavailable") return {
-			errorMessage: accessToken.errorMessage,
-			reasonCode: "session_token_unavailable",
+	if (!(tokenType && authBaseUrl && clientId && createdAt)) {
+		cachedAuthSession = null;
+		return {
+			reasonCode: "session_metadata_invalid",
 			state: "invalid",
 			session: null
 		};
-		session = buildStoredAuthSession({
-			accessToken: accessToken.accessToken,
-			payload: {
-				...payload,
-				v: 1,
-				tokenRef,
-				tokenType,
-				authBaseUrl,
-				clientId,
-				createdAt
-			}
-		});
-		cacheAuthSession({
-			payload,
-			session
-		});
 	}
+	const session = readCachedAuthSession(payload);
+	if (!session) return await loadCurrentSessionCredential({
+		...payload,
+		v: 1,
+		tokenRef,
+		tokenType,
+		authBaseUrl,
+		clientId,
+		createdAt
+	}, options);
+	return resolveLocalStoredSessionState(session, buildAuthSessionPayloadKey(payload));
+}
+function resolveLocalStoredSessionState(session, payloadKey) {
 	const expiryEligibility = resolveAuthSessionExpiryEligibility(session.expiresAt);
 	if (expiryEligibility.status === "invalid") return {
 		reasonCode: "session_expiry_invalid",
@@ -2192,13 +2412,68 @@ async function getLocalAuthSessionState(options = {}) {
 	if (expiryEligibility.status === "expired") return {
 		reasonCode: "session_expired",
 		state: "expired",
+		payloadKey,
 		session
 	};
 	return {
 		state: "valid",
+		payloadKey,
 		session
 	};
 }
+async function loadCurrentSessionCredential(payload, options) {
+	const credentialKey = buildAuthSessionCredentialCacheKey(payload);
+	const accessToken = await readSessionCredential(credentialKey, payload.tokenRef);
+	let currentPayload;
+	try {
+		currentPayload = options.recover === false ? await readSessionPayloadFile() : await readSessionPayload();
+	} catch (error) {
+		if (!(error instanceof AuthSessionStorageError)) throw error;
+		cachedAuthSession = null;
+		return {
+			state: "invalid",
+			session: null,
+			reasonCode: "session_metadata_invalid",
+			errorMessage: error.message
+		};
+	}
+	if (!currentPayload || buildAuthSessionCredentialCacheKey(currentPayload) !== credentialKey) {
+		if ((options.reloadCount ?? 0) >= 2) {
+			cachedAuthSession = null;
+			return {
+				state: "invalid",
+				session: null,
+				reasonCode: "session_metadata_invalid",
+				errorMessage: "The local login changed while reading its credentials. Try again."
+			};
+		}
+		return await getLocalAuthSessionState({
+			...options,
+			reloadCount: (options.reloadCount ?? 0) + 1
+		});
+	}
+	if (accessToken.status === "missing") return {
+		reasonCode: "session_token_missing",
+		state: "invalid",
+		session: null
+	};
+	if (accessToken.status === "unavailable") return {
+		errorMessage: accessToken.errorMessage,
+		retryAfterMs: accessToken.retryAfterMs,
+		reasonCode: "session_token_unavailable",
+		state: "invalid",
+		session: null
+	};
+	const session = buildStoredAuthSession({
+		accessToken: accessToken.accessToken,
+		payload: currentPayload
+	});
+	cacheAuthSession({
+		payload: currentPayload,
+		session
+	});
+	return resolveLocalStoredSessionState(session, buildAuthSessionPayloadKey(currentPayload));
+}
 async function assertStoredAccessTokenReloads(input) {
 	const reloaded = await readAccessToken(input.tokenRef);
 	if (reloaded.status === "found" && reloaded.accessToken === input.accessToken) return;
@@ -2243,14 +2518,55 @@ async function cleanupTransitionTokensNotReferencedByCurrentSession(input) {
 	}
 }
 function cacheAuthSession(input) {
+	const credentialKey = buildAuthSessionCredentialCacheKey(input.payload);
+	const becameAvailable = cachedAuthSession?.credentialKey !== credentialKey;
+	const previous = cachedAuthSession;
 	cachedAuthSession = {
-		payloadKey: buildAuthSessionPayloadKey(input.payload),
+		credentialKey,
 		session: input.session
 	};
+	if (!previous) observeCredential("credential_available");
+	else if (previous.session.user?.id !== input.session.user?.id) observeCredential("account_changed");
+	else if (becameAvailable) observeCredential("credential_changed");
+	else if (JSON.stringify([previous.session.activeOrganization, previous.session.user]) !== JSON.stringify([input.session.activeOrganization, input.session.user])) observeCredential("context_changed");
+	if (becameAvailable) {
+		const path = authSessionPath();
+		for (const listener of credentialAvailabilityListeners) if (listener.path === path) listener.notify();
+	}
 }
 function readCachedAuthSession(payload) {
-	const payloadKey = buildAuthSessionPayloadKey(payload);
-	return cachedAuthSession?.payloadKey === payloadKey ? cachedAuthSession.session : null;
+	if (cachedAuthSession?.credentialKey !== buildAuthSessionCredentialCacheKey(payload)) return null;
+	const session = buildStoredAuthSession({
+		accessToken: cachedAuthSession.session.accessToken,
+		payload
+	});
+	cacheAuthSession({
+		payload,
+		session
+	});
+	return session;
+}
+function buildAuthSessionCredentialCacheKey(payload) {
+	return `${authSessionPath()}\n${JSON.stringify({
+		v: payload.v,
+		tokenRef: payload.tokenRef,
+		tokenType: payload.tokenType,
+		authBaseUrl: payload.authBaseUrl,
+		clientId: payload.clientId,
+		createdAt: payload.createdAt,
+		expiresAt: payload.expiresAt,
+		scope: payload.scope,
+		ownerUserId: payload.user?.id
+	})}`;
+}
+async function readSessionCredential(key, ref) {
+	const pending = pendingCredentialReads.get(key);
+	if (pending) return await pending;
+	const read = readAccessToken(ref).finally(() => {
+		if (pendingCredentialReads.get(key) === read) pendingCredentialReads.delete(key);
+	});
+	pendingCredentialReads.set(key, read);
+	return await read;
 }
 function buildAuthSessionPayloadKey(payload) {
 	return `${authSessionPath()}\n${JSON.stringify(payload)}`;
@@ -2274,6 +2590,11 @@ async function cleanupCandidateTokenRefs(journal, keepTokenRef) {
 }
 async function persistRemoteSessionRefresh(input) {
 	return await withAuthSessionTransitionMutationLock(async () => {
+		const bound = admittedServiceSession.getStore();
+		if (bound) {
+			if (!isSameAuthPrincipal((await getLocalAuthSessionState({ recover: false })).session, bound)) return null;
+		}
+		await assertServiceAccountAdmissionMutationAvailable();
 		await recoverInterruptedAuthSessionTransitionWithOwnership();
 		const transitionJournal = await readAuthSessionTransitionJournal();
 		if (transitionJournal) {
@@ -2292,7 +2613,7 @@ async function persistCommittedRemoteSessionRefresh(input) {
 	const refresh = await prepareRemoteSessionRefresh({
 		...input,
 		payload,
-		uniqueTokenRef: false
+		uniqueTokenRef: true
 	});
 	if (!refresh) return null;
 	try {
@@ -2501,6 +2822,7 @@ async function recoverInterruptedAuthSessionTransition() {
 async function recoverInterruptedAuthSessionTransitionWithOwnership() {
 	let journal = await readAuthSessionTransitionJournal();
 	if (!journal) return;
+	await assertServiceAccountAdmissionMutationAvailable();
 	if (activeAuthSessionTransitionIds.has(journal.id)) return;
 	if (journal.state === "pending" && isProcessIdentityAlive({
 		ownerPid: journal.ownerPid,
@@ -2873,6 +3195,6 @@ async function removeSessionFile() {
 	await rm(authSessionPath(), { force: true });
 }
 //#endregion
-export { redactPrepareStepDiagnosticsValue as $, DEFAULT_HEARTBEAT_INTERVAL_MS as A, REGISTER_RESPONSE_TIMEOUT_MS as B, CATALOG_SYNC_RETRY_INTERVAL_MS as C, DAEMON_STREAM_KEEPALIVE_INTERVAL_MS as D, DAEMON_STREAM_CONNECT_TIMEOUT_MS as E, MIN_HEARTBEAT_INTERVAL_MS as F, PREPARE_STEP_DIAGNOSTICS_MAX_CHARS as G, RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS as H, MIN_SPACE_REQUEST_TIMEOUT_MS as I, prepareSessionWithTokenResponseSchema as J, prepareSessionResponseSchema as K, OPENCLAW_CLI_TIMEOUT_MS as L, HEARTBEAT_RESPONSE_TIMEOUT_MS as M, MAX_HEARTBEAT_INTERVAL_MS as N, DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS as O, MAX_SPACE_REQUEST_TIMEOUT_MS as P, redactPrepareStepDiagnosticsText as Q, PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS as R, resolveAuthSessionExpiryEligibility as S, DAEMON_RUNTIME_CONTRACT_EPOCH as T, RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS as U, ROUTE_CATALOG_LOAD_TIMEOUT_MS as V, RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS as W, prepareStepDiagnosticsBundleSchema as X, prepareSetupBootstrapWriteSchema as Y, redactPrepareStepDiagnosticsBundle as Z, setAuthSession as _, beginAuthSessionTransition as a, isBinaryDistribution as b, getAuthSessionMetadata as c, getInterruptedComputerAuthSessionRecovery as d, hasPendingComputerSetupContinuation as f, resumeInterruptedComputerSetup as g, recordInterruptedComputerAuthSessionRecoveryFailure as h, assertAuthSessionMutationAvailable as i, DEFAULT_SPACE_REQUEST_TIMEOUT_MS as j, DEFAULT_GATEWAY_CHAIN_TIMEOUT_MS as k, getAuthSessionState as l, normalizeStoredActiveOrganization as m, AuthSessionRecoveryInProgressError as n, clearAuthSession as o, markInterruptedComputerAuthSessionRecovery as p, prepareSessionStreamServerFrameSchema as q, AuthSessionTransitionConflictError as r, completeInterruptedComputerAuthSessionRecovery as s, AuthSessionChangedBeforeTransitionError as t, getCurrentAuthOwnerUserId as u, updateAuthSessionActiveOrganization as v, CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS as w, resolveOpenMeldDistribution as x, runMacOsNativeKeychainHelperIfRequested as y, PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS as z };
+export { RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS as $, withAuthSessionTransitionMutationLock as A, DEFAULT_SPACE_REQUEST_TIMEOUT_MS as B, withAdmittedServiceSession as C, cancelServiceAccountAdmission as D, admitServiceAccountOperation as E, DAEMON_STREAM_CONNECT_TIMEOUT_MS as F, MIN_SPACE_REQUEST_TIMEOUT_MS as G, MAX_HEARTBEAT_INTERVAL_MS as H, DAEMON_STREAM_KEEPALIVE_INTERVAL_MS as I, PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS as J, OPENCLAW_CLI_TIMEOUT_MS as K, DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS as L, CATALOG_SYNC_RETRY_INTERVAL_MS as M, CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS as N, readServiceAccountAdmission as O, DAEMON_RUNTIME_CONTRACT_EPOCH as P, RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS as Q, DEFAULT_GATEWAY_CHAIN_TIMEOUT_MS as R, updateAuthSessionActiveOrganization as S, ServiceAccountAdmissionError as T, MAX_SPACE_REQUEST_TIMEOUT_MS as U, HEARTBEAT_RESPONSE_TIMEOUT_MS as V, MIN_HEARTBEAT_INTERVAL_MS as W, ROUTE_CATALOG_LOAD_TIMEOUT_MS as X, REGISTER_RESPONSE_TIMEOUT_MS as Y, RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS as Z, onAuthSessionCredentialObservation as _, beginAuthSessionTransition as a, prepareSessionWithTokenResponseSchema as at, resumeInterruptedComputerSetup as b, completeInterruptedComputerAuthSessionRecovery as c, redactPrepareStepDiagnosticsBundle as ct, getCurrentAuthOwnerUserId as d, PREPARE_STEP_DIAGNOSTICS_MAX_CHARS as et, getInterruptedComputerAuthSessionRecovery as f, onAuthSessionCredentialAvailable as g, normalizeStoredActiveOrganization as h, assertAuthSessionMutationAvailable as i, prepareSessionStreamServerFrameSchema as it, resolveAuthSessionExpiryEligibility as j, reserveServiceAccountAdmission as k, getAuthSessionMetadata as l, redactPrepareStepDiagnosticsText as lt, markInterruptedComputerAuthSessionRecovery as m, AuthSessionRecoveryInProgressError as n, prepareSessionResponseSchema as nt, buildStoredAuthSessionIdentity as o, prepareSetupBootstrapWriteSchema as ot, hasPendingComputerSetupContinuation as p, PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS as q, AuthSessionTransitionConflictError as r, prepareSessionSnapshotSchema as rt, clearAuthSession as s, prepareStepDiagnosticsBundleSchema as st, AuthSessionChangedBeforeTransitionError as t, createPrepareSessionRequestSchema as tt, getAuthSessionState as u, redactPrepareStepDiagnosticsValue as ut, readServiceAdmissionSessionWithOwnership as v, runMacOsNativeKeychainHelperIfRequested as w, setAuthSession as x, recordInterruptedComputerAuthSessionRecoveryFailure as y, DEFAULT_HEARTBEAT_INTERVAL_MS as z };
 
-//# sourceMappingURL=auth-session-wmefguut.js.map
+//# sourceMappingURL=auth-session-CO5XtFaq.js.map