openmeld 0.3.206 → 0.3.207

package/dist/computer-connection-BOl79Ftf.js

@@ -0,0 +1,54 @@
+#!/usr/bin/env node
+
+import { rt as prepareSessionSnapshotSchema, tt as createPrepareSessionRequestSchema } from "./auth-session-CO5XtFaq.js";
+import * as z$1 from "zod/v4";
+//#region ../../packages/schemas/dist/computer-connection.js
+const computerConnectionIntentSchema = z$1.strictObject({
+	expectedAccount: z$1.string().trim().min(1).max(256),
+	previousSessionIdentity: z$1.string().min(1).max(128)
+});
+const computerConnectionReviewSchema = z$1.strictObject({
+	protocol: z$1.literal("computer-connection-v1"),
+	previousSessionIdentity: z$1.string().min(1).max(128),
+	account: z$1.strictObject({
+		id: z$1.string().min(1).max(256),
+		email: z$1.string().max(512).nullable()
+	}).nullable(),
+	existingConnection: z$1.strictObject({
+		deviceId: z$1.string().min(1),
+		runtimeLane: z$1.enum([
+			"prod",
+			"dev-local",
+			"canary"
+		])
+	}).nullable()
+});
+createPrepareSessionRequestSchema.pick({
+	humanProfileId: true,
+	targetSpaceId: true,
+	sourceNavigationAction: true,
+	connectedComputerId: true
+}).extend({
+	expectedAccount: computerConnectionIntentSchema.shape.expectedAccount,
+	resetThisComputer: z$1.boolean().optional()
+});
+z$1.discriminatedUnion("status", [
+	z$1.strictObject({
+		status: z$1.literal("failed"),
+		message: z$1.string().min(1),
+		diagnosticId: z$1.string().min(1)
+	}),
+	z$1.strictObject({
+		status: z$1.literal("reused"),
+		connection: computerConnectionReviewSchema.shape.existingConnection.unwrap()
+	}),
+	z$1.strictObject({
+		status: z$1.literal("completed"),
+		snapshot: prepareSessionSnapshotSchema
+	}),
+	z$1.strictObject({ status: z$1.literal("cancelled") })
+]);
+//#endregion
+export { computerConnectionReviewSchema as n, computerConnectionIntentSchema as t };
+
+//# sourceMappingURL=computer-connection-BOl79Ftf.js.map

package/dist/computer-connection-BOl79Ftf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"computer-connection-BOl79Ftf.js","names":[],"sources":["../../../packages/schemas/dist/computer-connection.js"],"sourcesContent":["import { createPrepareSessionRequestSchema, prepareSessionSnapshotSchema } from \"./schemas/prepare/session.js\";\nimport * as z$1 from \"zod/v4\";\n//#region src/computer-connection.ts\nconst computerConnectionIntentSchema = z$1.strictObject({\n\texpectedAccount: z$1.string().trim().min(1).max(256),\n\tpreviousSessionIdentity: z$1.string().min(1).max(128)\n});\nconst computerConnectionReviewSchema = z$1.strictObject({\n\tprotocol: z$1.literal(\"computer-connection-v1\"),\n\tpreviousSessionIdentity: z$1.string().min(1).max(128),\n\taccount: z$1.strictObject({\n\t\tid: z$1.string().min(1).max(256),\n\t\temail: z$1.string().max(512).nullable()\n\t}).nullable(),\n\texistingConnection: z$1.strictObject({\n\t\tdeviceId: z$1.string().min(1),\n\t\truntimeLane: z$1.enum([\n\t\t\t\"prod\",\n\t\t\t\"dev-local\",\n\t\t\t\"canary\"\n\t\t])\n\t}).nullable()\n});\nconst desktopComputerConnectionRequestSchema = createPrepareSessionRequestSchema.pick({\n\thumanProfileId: true,\n\ttargetSpaceId: true,\n\tsourceNavigationAction: true,\n\tconnectedComputerId: true\n}).extend({\n\texpectedAccount: computerConnectionIntentSchema.shape.expectedAccount,\n\tresetThisComputer: z$1.boolean().optional()\n});\nconst desktopComputerConnectionResultSchema = z$1.discriminatedUnion(\"status\", [\n\tz$1.strictObject({\n\t\tstatus: z$1.literal(\"failed\"),\n\t\tmessage: z$1.string().min(1),\n\t\tdiagnosticId: z$1.string().min(1)\n\t}),\n\tz$1.strictObject({\n\t\tstatus: z$1.literal(\"reused\"),\n\t\tconnection: computerConnectionReviewSchema.shape.existingConnection.unwrap()\n\t}),\n\tz$1.strictObject({\n\t\tstatus: z$1.literal(\"completed\"),\n\t\tsnapshot: prepareSessionSnapshotSchema\n\t}),\n\tz$1.strictObject({ status: z$1.literal(\"cancelled\") })\n]);\n//#endregion\nexport { computerConnectionIntentSchema, computerConnectionReviewSchema, desktopComputerConnectionRequestSchema, desktopComputerConnectionResultSchema };\n\n//# sourceMappingURL=computer-connection.js.map"],"mappings":";;;;;AAGA,MAAM,iCAAiC,IAAI,aAAa;CACvD,iBAAiB,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;CACnD,yBAAyB,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;AACrD,CAAC;AACD,MAAM,iCAAiC,IAAI,aAAa;CACvD,UAAU,IAAI,QAAQ,wBAAwB;CAC9C,yBAAyB,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;CACpD,SAAS,IAAI,aAAa;EACzB,IAAI,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;EAC/B,OAAO,IAAI,OAAO,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS;CACvC,CAAC,CAAC,CAAC,SAAS;CACZ,oBAAoB,IAAI,aAAa;EACpC,UAAU,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC;EAC5B,aAAa,IAAI,KAAK;GACrB;GACA;GACA;EACD,CAAC;CACF,CAAC,CAAC,CAAC,SAAS;AACb,CAAC;AAC8C,kCAAkC,KAAK;CACrF,gBAAgB;CAChB,eAAe;CACf,wBAAwB;CACxB,qBAAqB;AACtB,CAAC,CAAC,CAAC,OAAO;CACT,iBAAiB,+BAA+B,MAAM;CACtD,mBAAmB,IAAI,QAAQ,CAAC,CAAC,SAAS;AAC3C,CAAC;AAC6C,IAAI,mBAAmB,UAAU;CAC9E,IAAI,aAAa;EAChB,QAAQ,IAAI,QAAQ,QAAQ;EAC5B,SAAS,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC;EAC3B,cAAc,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC;CACjC,CAAC;CACD,IAAI,aAAa;EAChB,QAAQ,IAAI,QAAQ,QAAQ;EAC5B,YAAY,+BAA+B,MAAM,mBAAmB,OAAO;CAC5E,CAAC;CACD,IAAI,aAAa;EAChB,QAAQ,IAAI,QAAQ,WAAW;EAC/B,UAAU;CACX,CAAC;CACD,IAAI,aAAa,EAAE,QAAQ,IAAI,QAAQ,WAAW,EAAE,CAAC;AACtD,CAAC"}

package/dist/computer-connection-review-BTOvbJYL.js

@@ -0,0 +1,39 @@
+#!/usr/bin/env node
+
+import { l as getAuthSessionMetadata, o as buildStoredAuthSessionIdentity, u as getAuthSessionState } from "./auth-session-CO5XtFaq.js";
+import { n as computerConnectionReviewSchema } from "./computer-connection-BOl79Ftf.js";
+import { Bt as readDaemonServiceContract } from "./daemon-service-runtime-DQW9gSLT.js";
+import { n as resolveServiceAccountIdentity } from "./service-account-authorization-Dt8kGvq8.js";
+import { t as readServiceControlCapabilities } from "./service-control-capabilities-BU5F75zi.js";
+//#region src/commands/computer-connection-review.ts
+/** Display evidence only. Auth and Service owners validate an existing connection. */
+async function readComputerConnectionReview() {
+	const session = await getAuthSessionMetadata();
+	if (session && !session.user?.id) throw new Error("The computer account cannot be identified. Review its sign-in before connecting.");
+	let existingConnection = null;
+	const contract = await readDaemonServiceContract();
+	if (session && contract && contract.ownerUserId === session.user?.id) {
+		const auth = await getAuthSessionState({ validateRemote: true });
+		if (auth.state === "valid" && auth.session) {
+			const identity = await resolveServiceAccountIdentity(auth.session, contract);
+			const capabilities = await readServiceControlCapabilities();
+			if (capabilities.stop && capabilities.deviceId === identity.deviceId) existingConnection = {
+				deviceId: identity.deviceId,
+				runtimeLane: identity.lane
+			};
+		}
+	}
+	return computerConnectionReviewSchema.parse({
+		protocol: "computer-connection-v1",
+		previousSessionIdentity: buildStoredAuthSessionIdentity(session),
+		account: session ? {
+			id: session.user?.id,
+			email: session.user?.email ?? null
+		} : null,
+		existingConnection
+	});
+}
+//#endregion
+export { readComputerConnectionReview };
+
+//# sourceMappingURL=computer-connection-review-BTOvbJYL.js.map

package/dist/computer-connection-review-BTOvbJYL.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"computer-connection-review-BTOvbJYL.js","names":[],"sources":["../src/commands/computer-connection-review.ts"],"sourcesContent":["import { computerConnectionReviewSchema } from \"@openmeld/schemas\";\nimport {\n  buildStoredAuthSessionIdentity,\n  getAuthSessionMetadata,\n  getAuthSessionState,\n} from \"../config/auth-session\";\nimport { readDaemonServiceContract } from \"../config/daemon-service-contract\";\nimport { resolveServiceAccountIdentity } from \"../local-service/lifecycle/service-account-authorization\";\nimport { readServiceControlCapabilities } from \"./service-control-capabilities\";\n\n/** Display evidence only. Auth and Service owners validate an existing connection. */\nexport async function readComputerConnectionReview() {\n  const session = await getAuthSessionMetadata();\n  if (session && !session.user?.id) {\n    throw new Error(\n      \"The computer account cannot be identified. Review its sign-in before connecting.\"\n    );\n  }\n  let existingConnection: ReturnType<\n    typeof computerConnectionReviewSchema.parse\n  >[\"existingConnection\"] = null;\n  const contract = await readDaemonServiceContract();\n  if (session && contract && contract.ownerUserId === session.user?.id) {\n    const auth = await getAuthSessionState({ validateRemote: true });\n    if (auth.state === \"valid\" && auth.session) {\n      const identity = await resolveServiceAccountIdentity(\n        auth.session,\n        contract\n      );\n      const capabilities = await readServiceControlCapabilities();\n      if (capabilities.stop && capabilities.deviceId === identity.deviceId) {\n        existingConnection = {\n          deviceId: identity.deviceId,\n          runtimeLane: identity.lane,\n        };\n      }\n    }\n  }\n  return computerConnectionReviewSchema.parse({\n    protocol: \"computer-connection-v1\",\n    previousSessionIdentity: buildStoredAuthSessionIdentity(session),\n    account: session\n      ? { id: session.user?.id, email: session.user?.email ?? null }\n      : null,\n    existingConnection,\n  });\n}\n"],"mappings":";;;;;;;;;AAWA,eAAsB,+BAA+B;CACnD,MAAM,UAAU,MAAM,uBAAuB;CAC7C,IAAI,WAAW,CAAC,QAAQ,MAAM,IAC5B,MAAM,IAAI,MACR,kFACF;CAEF,IAAI,qBAEsB;CAC1B,MAAM,WAAW,MAAM,0BAA0B;CACjD,IAAI,WAAW,YAAY,SAAS,gBAAgB,QAAQ,MAAM,IAAI;EACpE,MAAM,OAAO,MAAM,oBAAoB,EAAE,gBAAgB,KAAK,CAAC;EAC/D,IAAI,KAAK,UAAU,WAAW,KAAK,SAAS;GAC1C,MAAM,WAAW,MAAM,8BACrB,KAAK,SACL,QACF;GACA,MAAM,eAAe,MAAM,+BAA+B;GAC1D,IAAI,aAAa,QAAQ,aAAa,aAAa,SAAS,UAC1D,qBAAqB;IACnB,UAAU,SAAS;IACnB,aAAa,SAAS;GACxB;EAEJ;CACF;CACA,OAAO,+BAA+B,MAAM;EAC1C,UAAU;EACV,yBAAyB,+BAA+B,OAAO;EAC/D,SAAS,UACL;GAAE,IAAI,QAAQ,MAAM;GAAI,OAAO,QAAQ,MAAM,SAAS;EAAK,IAC3D;EACJ;CACF,CAAC;AACH"}

package/dist/{computer-setup-continuation-Cd9nhLQ-.js → computer-setup-continuation-DmKdhR5u.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
-import { f as hasPendingComputerSetupContinuation, v as resumeInterruptedComputerSetup } from "./auth-session-BjSqMLTz.js";
-import { qt as createPresenter } from "./elapsed-time-C7P-nWIO.js";
-import { A as mintPrepareSessionReconnectToken, D as recoverInterruptedComputerAuthHandoff, i as runPrepareSessionExecutor } from "./prepare-session-executor-CLmDoHom.js";
+import { b as resumeInterruptedComputerSetup, p as hasPendingComputerSetupContinuation } from "./auth-session-CO5XtFaq.js";
+import { qt as createPresenter } from "./elapsed-time-CcoM2R3N.js";
+import { A as mintPrepareSessionReconnectToken, D as recoverInterruptedComputerAuthHandoff, i as runPrepareSessionExecutor } from "./prepare-session-executor-B0NtjHEL.js";
 import { setTimeout } from "node:timers/promises";
 //#region src/commands/computer-setup-continuation.ts
 const runtime = {
@@ -39,4 +39,4 @@ async function recoverComputerSetupAfterBackgroundUpdate() {
 //#endregion
 export { finishComputerSetupAfterBackgroundUpdate, recoverComputerSetupAfterBackgroundUpdate };
 
-//# sourceMappingURL=computer-setup-continuation-Cd9nhLQ-.js.map
+//# sourceMappingURL=computer-setup-continuation-DmKdhR5u.js.map

package/dist/{computer-setup-continuation-Cd9nhLQ-.js.map → computer-setup-continuation-DmKdhR5u.js.map}

@@ -1 +1 @@
-{"version":3,"file":"computer-setup-continuation-Cd9nhLQ-.js","names":["sleep"],"sources":["../src/commands/computer-setup-continuation.ts"],"sourcesContent":["import { setTimeout as sleep } from \"node:timers/promises\";\nimport {\n  hasPendingComputerSetupContinuation,\n  resumeInterruptedComputerSetup,\n} from \"../config/auth-session\";\nimport { mintPrepareSessionReconnectToken } from \"../config/prepare-session-api\";\nimport { createPresenter } from \"../runtime/presenter/index\";\nimport type { RuntimeContext } from \"../runtime/types\";\nimport { recoverInterruptedComputerAuthHandoff } from \"./computer-auth-handoff-recovery\";\nimport { runPrepareSessionExecutor } from \"./prepare-session-executor\";\n\nconst runtime: RuntimeContext = {\n  interactive: false,\n  resolvedView: \"agent\",\n  viewMode: \"agent\",\n};\n\n// Called only by the existing OS-owned maintenance worker after its update.\n// The live Terminal keeps ownership. If it exits, continue the same Core\n// Prepare session using the existing auth journal, not a second setup plan.\nexport async function finishComputerSetupAfterBackgroundUpdate(): Promise<void> {\n  while (await hasPendingComputerSetupContinuation()) {\n    const resumed = await resumeInterruptedComputerSetup(\n      async (continuation) => {\n        const { snapshot, opaqueToken } =\n          await mintPrepareSessionReconnectToken({\n            baseUrl: continuation.gatewayUrl,\n            prepareSessionId: continuation.prepareSessionId,\n          });\n        if (\n          snapshot.lifecycleStatus !== \"active\" &&\n          snapshot.lifecycleStatus !== \"completed\"\n        ) {\n          return \"not_completed\";\n        }\n        const result = await runPrepareSessionExecutor({\n          gatewayUrl: continuation.gatewayUrl,\n          initialSnapshot: snapshot,\n          interactive: false,\n          localAgentSelection: continuation.localAgentSelection,\n          presenter: createPresenter(runtime),\n          runtime,\n          startSession: opaqueToken,\n          view: \"agent\",\n        });\n        return result.status;\n      }\n    );\n    if (!resumed) {\n      await sleep(500);\n    }\n  }\n}\n\n// Run after the completed update has released its pending job. Account rollback\n// uses the existing handoff recovery, which itself waits for active updates.\nexport async function recoverComputerSetupAfterBackgroundUpdate(): Promise<void> {\n  await recoverInterruptedComputerAuthHandoff({\n    presenter: createPresenter(runtime),\n    runtime,\n    view: \"agent\",\n  });\n}\n"],"mappings":";;;;;;;AAWA,MAAM,UAA0B;CAC9B,aAAa;CACb,cAAc;CACd,UAAU;AACZ;AAKA,eAAsB,2CAA0D;CAC9E,OAAO,MAAM,oCAAoC,GA2B/C,IAAI,CAAC,MA1BiB,+BACpB,OAAO,iBAAiB;EACtB,MAAM,EAAE,UAAU,gBAChB,MAAM,iCAAiC;GACrC,SAAS,aAAa;GACtB,kBAAkB,aAAa;EACjC,CAAC;EACH,IACE,SAAS,oBAAoB,YAC7B,SAAS,oBAAoB,aAE7B,OAAO;EAYT,QAAO,MAVc,0BAA0B;GAC7C,YAAY,aAAa;GACzB,iBAAiB;GACjB,aAAa;GACb,qBAAqB,aAAa;GAClC,WAAW,gBAAgB,OAAO;GAClC;GACA,cAAc;GACd,MAAM;EACR,CAAC,EAAA,CACa;CAChB,CACF,GAEE,MAAMA,WAAM,GAAG;AAGrB;AAIA,eAAsB,4CAA2D;CAC/E,MAAM,sCAAsC;EAC1C,WAAW,gBAAgB,OAAO;EAClC;EACA,MAAM;CACR,CAAC;AACH"}
+{"version":3,"file":"computer-setup-continuation-DmKdhR5u.js","names":["sleep"],"sources":["../src/commands/computer-setup-continuation.ts"],"sourcesContent":["import { setTimeout as sleep } from \"node:timers/promises\";\nimport {\n  hasPendingComputerSetupContinuation,\n  resumeInterruptedComputerSetup,\n} from \"../config/auth-session\";\nimport { mintPrepareSessionReconnectToken } from \"../config/prepare-session-api\";\nimport { createPresenter } from \"../runtime/presenter/index\";\nimport type { RuntimeContext } from \"../runtime/types\";\nimport { recoverInterruptedComputerAuthHandoff } from \"./computer-auth-handoff-recovery\";\nimport { runPrepareSessionExecutor } from \"./prepare-session-executor\";\n\nconst runtime: RuntimeContext = {\n  interactive: false,\n  resolvedView: \"agent\",\n  viewMode: \"agent\",\n};\n\n// Called only by the existing OS-owned maintenance worker after its update.\n// The live Terminal keeps ownership. If it exits, continue the same Core\n// Prepare session using the existing auth journal, not a second setup plan.\nexport async function finishComputerSetupAfterBackgroundUpdate(): Promise<void> {\n  while (await hasPendingComputerSetupContinuation()) {\n    const resumed = await resumeInterruptedComputerSetup(\n      async (continuation) => {\n        const { snapshot, opaqueToken } =\n          await mintPrepareSessionReconnectToken({\n            baseUrl: continuation.gatewayUrl,\n            prepareSessionId: continuation.prepareSessionId,\n          });\n        if (\n          snapshot.lifecycleStatus !== \"active\" &&\n          snapshot.lifecycleStatus !== \"completed\"\n        ) {\n          return \"not_completed\";\n        }\n        const result = await runPrepareSessionExecutor({\n          gatewayUrl: continuation.gatewayUrl,\n          initialSnapshot: snapshot,\n          interactive: false,\n          localAgentSelection: continuation.localAgentSelection,\n          presenter: createPresenter(runtime),\n          runtime,\n          startSession: opaqueToken,\n          view: \"agent\",\n        });\n        return result.status;\n      }\n    );\n    if (!resumed) {\n      await sleep(500);\n    }\n  }\n}\n\n// Run after the completed update has released its pending job. Account rollback\n// uses the existing handoff recovery, which itself waits for active updates.\nexport async function recoverComputerSetupAfterBackgroundUpdate(): Promise<void> {\n  await recoverInterruptedComputerAuthHandoff({\n    presenter: createPresenter(runtime),\n    runtime,\n    view: \"agent\",\n  });\n}\n"],"mappings":";;;;;;;AAWA,MAAM,UAA0B;CAC9B,aAAa;CACb,cAAc;CACd,UAAU;AACZ;AAKA,eAAsB,2CAA0D;CAC9E,OAAO,MAAM,oCAAoC,GA2B/C,IAAI,CAAC,MA1BiB,+BACpB,OAAO,iBAAiB;EACtB,MAAM,EAAE,UAAU,gBAChB,MAAM,iCAAiC;GACrC,SAAS,aAAa;GACtB,kBAAkB,aAAa;EACjC,CAAC;EACH,IACE,SAAS,oBAAoB,YAC7B,SAAS,oBAAoB,aAE7B,OAAO;EAYT,QAAO,MAVc,0BAA0B;GAC7C,YAAY,aAAa;GACzB,iBAAiB;GACjB,aAAa;GACb,qBAAqB,aAAa;GAClC,WAAW,gBAAgB,OAAO;GAClC;GACA,cAAc;GACd,MAAM;EACR,CAAC,EAAA,CACa;CAChB,CACF,GAEE,MAAMA,WAAM,GAAG;AAGrB;AAIA,eAAsB,4CAA2D;CAC/E,MAAM,sCAAsC;EAC1C,WAAW,gBAAgB,OAAO;EAClC;EACA,MAAM;CACR,CAAC;AACH"}