openmeld 0.3.206 → 0.3.208

package/dist/{auth-session-BjSqMLTz.js → auth-session-ijcuaSsZ.js}

@@ -1,15 +1,19 @@
 #!/usr/bin/env node
 
 import { t as isLoopbackHostname } from "./loopback-hostname-DHQPKq8N.js";
-import { S as isProcessIdentityAlive, r as isOpenMeldLockError, t as acquireLock, tt as openMeldRootDir, u as runWithHeldLock, x as CURRENT_PROCESS_START_IDENTITY } from "./lock-CvBnBcFK.js";
-import { $r as int, Jr as boolean, Oi as openMeldProfileIdSchema, Qr as enumFactory, Xr as discriminatedUnion, _ as localAgentCatalogSchema, ci as record, d as START_BOUNDED_ID_SCHEMA, ei as iso, f as START_BOUNDED_VERSION_SCHEMA, h as startReplyReadinessSummarySchema, i as authProfileManagedRoleSchema, ii as nullFactory, li as strictObject, mi as unknown, ni as literal, oi as object, p as START_ISO_DATE_TIME_SCHEMA, pi as union, qr as array, r as authProfileKindSchema, ui as string, y as CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH } from "./profiles-BCecj4Pj.js";
+import { C as isProcessIdentityAlive, S as CURRENT_PROCESS_START_IDENTITY, d as runWithHeldLock, i as isOpenMeldLockError, rt as openMeldRootDir, t as acquireLock, w as readProcessStartIdentity } from "./lock-Dxp6o_t_.js";
+import { Fr as startReplyReadinessSummarySchema, Hr as authProfileManagedRoleSchema, Lr as localAgentCatalogSchema, Mr as START_BOUNDED_VERSION_SCHEMA, Nr as START_ISO_DATE_TIME_SCHEMA, Vr as authProfileKindSchema, Yr as openMeldProfileIdSchema, jr as START_BOUNDED_ID_SCHEMA, t as CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH } from "./runtime-transport-DryoU4rm.js";
+import { $ as literal, G as boolean, W as array, X as int, Y as enumFactory, Z as iso, at as record, dt as unknown, ot as strictObject, q as discriminatedUnion, rt as object, st as string, tt as nullFactory, ut as union } from "./control-plane-D9jDcbMZ.js";
 import { r as daemonServiceLaneSchema } from "./service-contract-CRyDcIIf.js";
+import { i as serviceAccountAdmissionSchema, t as isBinaryDistribution } from "./distribution-DY2fBeSW.js";
+import { n as writeDaemonLocalStateFile } from "./daemon-local-state-file-jOXuXrky.js";
 import { createRequire } from "node:module";
 import { createHash, randomUUID } from "node:crypto";
 import { join, resolve } from "node:path";
 import { chmod, link, mkdir, open, readFile, rename, rm, writeFile } from "node:fs/promises";
 import * as z$1 from "zod/v4";
 import { spawn } from "node:child_process";
+import { AsyncLocalStorage } from "node:async_hooks";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { fileURLToPath } from "node:url";
 //#region ../../packages/schemas/dist/schemas/start/device-projection.js
@@ -81,63 +85,6 @@ z$1.strictObject({
 	deviceReplyReadiness: startReplyReadinessSummarySchema
 });
 //#endregion
-//#region ../../packages/schemas/dist/schemas/local-machine/macos-keychain-helper.js
-const MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION = "disallow";
-const macOsKeychainServiceSchema = z$1.string().trim().min(1).max(512);
-const macOsKeychainAccountSchema = z$1.string().trim().min(1).max(512);
-const macOsKeychainAccessTokenSchema = z$1.string().min(1).max(65536);
-const macOsKeychainHelperOperationSchema = z$1.enum([
-	"store",
-	"read",
-	"delete"
-]);
-const macOsKeychainHelperRequestSchema = z$1.discriminatedUnion("operation", [
-	z$1.strictObject({
-		schemaVersion: z$1.literal(2),
-		operation: z$1.literal("store"),
-		service: macOsKeychainServiceSchema,
-		account: macOsKeychainAccountSchema,
-		accessToken: macOsKeychainAccessTokenSchema,
-		authenticationInteraction: z$1.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)
-	}),
-	z$1.strictObject({
-		schemaVersion: z$1.literal(2),
-		operation: z$1.literal("read"),
-		service: macOsKeychainServiceSchema,
-		account: macOsKeychainAccountSchema,
-		authenticationInteraction: z$1.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)
-	}),
-	z$1.strictObject({
-		schemaVersion: z$1.literal(2),
-		operation: z$1.literal("delete"),
-		service: macOsKeychainServiceSchema,
-		account: macOsKeychainAccountSchema,
-		authenticationInteraction: z$1.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)
-	})
-]);
-const macOsKeychainHelperMutationSuccessSchema = z$1.strictObject({
-	schemaVersion: z$1.literal(2),
-	ok: z$1.literal(true),
-	operation: z$1.enum(["store", "delete"])
-});
-const macOsKeychainHelperReadSuccessSchema = z$1.strictObject({
-	schemaVersion: z$1.literal(2),
-	ok: z$1.literal(true),
-	operation: z$1.literal("read"),
-	accessToken: z$1.union([macOsKeychainAccessTokenSchema, z$1.null()])
-});
-const macOsKeychainHelperErrorSchema = z$1.strictObject({
-	schemaVersion: z$1.literal(2),
-	ok: z$1.literal(false),
-	operation: macOsKeychainHelperOperationSchema,
-	errorMessage: z$1.string().trim().min(1).max(2048)
-});
-const macOsKeychainHelperResponseSchema = z$1.union([
-	macOsKeychainHelperMutationSuccessSchema,
-	macOsKeychainHelperReadSuccessSchema,
-	macOsKeychainHelperErrorSchema
-]);
-//#endregion
 //#region ../../packages/schemas/dist/schemas/prepare/session.js
 const PREPARE_BOUNDED_ID_SCHEMA = string().trim().min(1).max(256);
 const prepareSessionContinuationSchema = strictObject({
@@ -590,7 +537,7 @@ const prepareSessionEventSchema = strictObject({
 	localAgentIds: prepareLocalAgentIdsSchema,
 	createdAt: PREPARE_ISO_DATE_TIME_SCHEMA
 });
-strictObject({
+const createPrepareSessionRequestSchema = strictObject({
 	connectedComputerId: union([PREPARE_BOUNDED_ID_SCHEMA, nullFactory()]).optional(),
 	humanProfileId: union([openMeldProfileIdSchema, nullFactory()]).optional(),
 	deviceId: union([PREPARE_BOUNDED_ID_SCHEMA, nullFactory()]).optional(),
@@ -706,6 +653,63 @@ const prepareSessionStreamServerFrameSchema = discriminatedUnion("type", [
 	})
 ]);
 //#endregion
+//#region ../../packages/schemas/dist/schemas/local-machine/macos-keychain-helper.js
+const MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION = "disallow";
+const macOsKeychainServiceSchema = z$1.string().trim().min(1).max(512);
+const macOsKeychainAccountSchema = z$1.string().trim().min(1).max(512);
+const macOsKeychainAccessTokenSchema = z$1.string().min(1).max(65536);
+const macOsKeychainHelperOperationSchema = z$1.enum([
+	"store",
+	"read",
+	"delete"
+]);
+const macOsKeychainHelperRequestSchema = z$1.discriminatedUnion("operation", [
+	z$1.strictObject({
+		schemaVersion: z$1.literal(2),
+		operation: z$1.literal("store"),
+		service: macOsKeychainServiceSchema,
+		account: macOsKeychainAccountSchema,
+		accessToken: macOsKeychainAccessTokenSchema,
+		authenticationInteraction: z$1.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)
+	}),
+	z$1.strictObject({
+		schemaVersion: z$1.literal(2),
+		operation: z$1.literal("read"),
+		service: macOsKeychainServiceSchema,
+		account: macOsKeychainAccountSchema,
+		authenticationInteraction: z$1.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)
+	}),
+	z$1.strictObject({
+		schemaVersion: z$1.literal(2),
+		operation: z$1.literal("delete"),
+		service: macOsKeychainServiceSchema,
+		account: macOsKeychainAccountSchema,
+		authenticationInteraction: z$1.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)
+	})
+]);
+const macOsKeychainHelperMutationSuccessSchema = z$1.strictObject({
+	schemaVersion: z$1.literal(2),
+	ok: z$1.literal(true),
+	operation: z$1.enum(["store", "delete"])
+});
+const macOsKeychainHelperReadSuccessSchema = z$1.strictObject({
+	schemaVersion: z$1.literal(2),
+	ok: z$1.literal(true),
+	operation: z$1.literal("read"),
+	accessToken: z$1.union([macOsKeychainAccessTokenSchema, z$1.null()])
+});
+const macOsKeychainHelperErrorSchema = z$1.strictObject({
+	schemaVersion: z$1.literal(2),
+	ok: z$1.literal(false),
+	operation: macOsKeychainHelperOperationSchema,
+	errorMessage: z$1.string().trim().min(1).max(2048)
+});
+const macOsKeychainHelperResponseSchema = z$1.union([
+	macOsKeychainHelperMutationSuccessSchema,
+	macOsKeychainHelperReadSuccessSchema,
+	macOsKeychainHelperErrorSchema
+]);
+//#endregion
 //#region src/strategy-constants.ts
 const DEFAULT_GATEWAY_CHAIN_TIMEOUT_MS = 3e4;
 const DEFAULT_REMOTE_SESSION_TIMEOUT_MS = 8e3;
@@ -791,19 +795,111 @@ async function acquireAuthSessionLock(input) {
 	}
 }
 //#endregion
-//#region src/runtime/distribution.ts
-const BINARY_DISTRIBUTION = "binary";
-const NPM_DISTRIBUTION = "npm";
-/**
-* The distribution form this CLI build was compiled for. Falls back to `npm`
-* when the marker is absent (e.g. under Vitest, where no build-time define
-* runs), which keeps the safe, path-independent default.
-*/
-function resolveOpenMeldDistribution() {
-	return NPM_DISTRIBUTION;
-}
-function isBinaryDistribution() {
-	return resolveOpenMeldDistribution() === BINARY_DISTRIBUTION;
+//#region src/config/service-account-admission.ts
+var ServiceAccountAdmissionError = class extends Error {
+	code;
+	constructor(reason, message) {
+		super(message);
+		this.name = "ServiceAccountAdmissionError";
+		this.code = `service.account_admission.${reason}`;
+	}
+};
+function admissionPath() {
+	return join(openMeldRootDir(), "auth", "service-account-admission.json");
+}
+async function readServiceAccountAdmission() {
+	let raw;
+	try {
+		raw = await readFile(admissionPath(), "utf8");
+	} catch (error) {
+		if (error.code === "ENOENT") return null;
+		throw error;
+	}
+	let value;
+	try {
+		value = JSON.parse(raw);
+	} catch {
+		value = null;
+	}
+	const parsed = serviceAccountAdmissionSchema.safeParse(value);
+	if (!parsed.success) throw new ServiceAccountAdmissionError("unknown", "OpenMeld could not verify the pending Service action. Run `openmeld service status --json` for diagnostics.");
+	return parsed.data;
+}
+async function writeAdmission(value) {
+	await writeDaemonLocalStateFile({
+		path: admissionPath(),
+		schema: serviceAccountAdmissionSchema,
+		value,
+		mode: 384
+	});
+}
+async function assertServiceAccountAdmissionMutationAvailable() {
+	const current = await readServiceAccountAdmission();
+	if (current?.state !== "pending") return;
+	if (isProcessIdentityAlive(current.requester)) throw new ServiceAccountAdmissionError("busy", "OpenMeld is starting or stopping this Service. Try the account change again when that action is accepted.");
+	await writeAdmission({
+		...current,
+		state: "cancelled"
+	});
+}
+async function reserveServiceAccountAdmission(input) {
+	await assertServiceAccountAdmissionMutationAvailable();
+	const previous = await readServiceAccountAdmission();
+	if (!CURRENT_PROCESS_START_IDENTITY.startsWith("ps:")) throw new ServiceAccountAdmissionError("unknown", "OpenMeld could not verify this command's process identity. Try again from a supported local CLI.");
+	const reservation = {
+		version: 1,
+		id: randomUUID(),
+		operation: input.operation,
+		state: "pending",
+		identity: input.identity,
+		...input.target ? { target: input.target } : {},
+		requester: {
+			ownerPid: process.pid,
+			ownerProcessStartedAt: CURRENT_PROCESS_START_IDENTITY
+		},
+		...previous?.startupReceipt ? { startupReceipt: previous.startupReceipt } : {}
+	};
+	await writeAdmission(reservation);
+	return reservation;
+}
+async function cancelServiceAccountAdmission(id) {
+	await withAuthSessionTransitionMutationLock(async () => {
+		const current = await readServiceAccountAdmission();
+		if (current?.id === id && current.state === "pending") await writeAdmission({
+			...current,
+			state: "cancelled"
+		});
+	});
+}
+async function admitServiceAccountOperation(input) {
+	const current = await readServiceAccountAdmission();
+	const contractBinding = bindServiceAccountIdentity(input.identity);
+	if (input.operation === "start" && current?.startupReceipt?.id === input.id && current.startupReceipt.contractBinding === contractBinding) return;
+	if (!current || current.id !== input.id || current.operation !== input.operation || current.state !== "pending" || readProcessStartIdentity(current.requester.ownerPid) !== current.requester.ownerProcessStartedAt || current.target !== void 0 && (current.target.ownerPid !== process.pid || current.target.ownerProcessStartedAt !== CURRENT_PROCESS_START_IDENTITY) || JSON.stringify(current.identity) !== JSON.stringify(input.identity)) throw new ServiceAccountAdmissionError("cancelled", "This Service action is no longer authorized. Check the signed-in account and try again.");
+	input.commit?.();
+	await writeAdmission({
+		...current,
+		state: "admitted",
+		carrier: {
+			ownerPid: process.pid,
+			ownerProcessStartedAt: CURRENT_PROCESS_START_IDENTITY
+		},
+		...input.operation === "start" ? { startupReceipt: {
+			id: input.id,
+			contractBinding
+		} } : {}
+	});
+}
+function bindServiceAccountIdentity(identity) {
+	return createHash("sha256").update(JSON.stringify([
+		identity.accountId,
+		identity.authBaseUrl,
+		identity.clientId,
+		identity.gatewayUrl,
+		identity.lane,
+		identity.deviceId,
+		identity.contractGeneration
+	])).digest("hex");
 }
 //#endregion
 //#region src/config/macos-native-keychain.ts
@@ -1464,6 +1560,17 @@ function onAuthSessionCredentialAvailable(notify) {
 	};
 }
 const activeAuthSessionTransitionIds = /* @__PURE__ */ new Set();
+const admittedServiceSession = new AsyncLocalStorage();
+const boundSessionPayloadKeys = /* @__PURE__ */ new WeakMap();
+function withAdmittedServiceSession(session, run) {
+	return admittedServiceSession.run(structuredClone(session), run);
+}
+async function readServiceAdmissionSessionWithOwnership() {
+	if (await readAuthSessionTransitionJournal()) throw new AuthSessionRecoveryInProgressError();
+	const state = await getLocalAuthSessionState({ recover: false });
+	if (state.state !== "valid" || !state.session?.user?.id) throw new Error("Service control requires a valid CLI sign-in. Sign in with the matching account and try again.");
+	return state.session;
+}
 const credentialObservationListeners = /* @__PURE__ */ new Set();
 function onAuthSessionCredentialObservation(notify) {
 	const listener = {
@@ -1482,6 +1589,8 @@ function observeCredential(reason) {
 	} catch {}
 }
 async function getAuthSessionState(options = {}) {
+	const bound = admittedServiceSession.getStore();
+	if (bound) return await getBoundServiceSessionState(bound, options);
 	const result = await getAuthSessionStateWithCandidateRefreshFence(options, false);
 	if (result.reasonCode === "session_metadata_invalid") observeCredential("metadata_unavailable");
 	return {
@@ -1492,6 +1601,71 @@ async function getAuthSessionState(options = {}) {
 		...result.retryAfterMs !== void 0 ? { retryAfterMs: result.retryAfterMs } : {}
 	};
 }
+async function syncBoundServiceCredentials(bound) {
+	const local = await getLocalAuthSessionState({ recover: false });
+	const samePrincipal = isSameAuthPrincipal(local.session, bound);
+	const localPayloadKey = samePrincipal && "payloadKey" in local ? local.payloadKey : null;
+	if (samePrincipal && local.session && boundSessionPayloadKeys.get(bound) !== localPayloadKey) {
+		Object.assign(bound, local.session, { activeOrganization: local.session.activeOrganization });
+		boundSessionPayloadKeys.set(bound, localPayloadKey);
+	}
+	if (samePrincipal && local.session && bound.expiresAt && (bound.accessToken !== local.session.accessToken || bound.expiresAt !== local.session.expiresAt)) await persistBoundServiceRefresh(bound, {
+		state: "valid",
+		accessToken: bound.accessToken,
+		expiresAt: bound.expiresAt
+	}, localPayloadKey, local.session.accessToken);
+	return samePrincipal ? boundSessionPayloadKeys.get(bound) ?? null : null;
+}
+async function getBoundServiceSessionState(bound, options) {
+	const localPayloadKey = await syncBoundServiceCredentials(bound);
+	if (options.validateRemote || options.refreshExpired && isExpired(bound.expiresAt)) {
+		const remote = await getRemoteAuthSessionState(bound);
+		if (remote.state === "revoked" || remote.state === "invalid") return {
+			state: remote.state,
+			session: null,
+			reasonCode: resolveRemoteAuthSessionReasonCode(remote.state)
+		};
+		if (remote.state === "valid") {
+			await persistBoundServiceRefresh(bound, remote, localPayloadKey);
+			if (remote.accessToken) bound.accessToken = remote.accessToken;
+			if (remote.expiresAt) bound.expiresAt = remote.expiresAt;
+		}
+	}
+	const expiry = resolveAuthSessionExpiryEligibility(bound.expiresAt);
+	if (expiry.status === "expired") return {
+		session: bound,
+		state: "expired",
+		reasonCode: "session_expired"
+	};
+	if (expiry.status === "invalid") return {
+		session: null,
+		state: "invalid",
+		reasonCode: "session_expiry_invalid"
+	};
+	return {
+		session: bound,
+		state: "valid"
+	};
+}
+async function persistBoundServiceRefresh(bound, remote, localPayloadKey, previousAccessToken = bound.accessToken) {
+	if (!(localPayloadKey && remote.expiresAt) || isExpired(remote.expiresAt)) return;
+	try {
+		if (await persistRemoteSessionRefresh({
+			accessToken: remote.accessToken ?? bound.accessToken,
+			previousAccessToken,
+			expectedPayloadKey: localPayloadKey,
+			expiresAt: remote.expiresAt
+		})) {
+			const current = await getLocalAuthSessionState({ recover: false });
+			boundSessionPayloadKeys.set(bound, isSameAuthPrincipal(current.session, bound) && "payloadKey" in current ? current.payloadKey : null);
+		}
+	} catch (error) {
+		if (!(error instanceof ServiceAccountAdmissionError && error.code === "service.account_admission.busy")) throw error;
+	}
+}
+function isSameAuthPrincipal(current, expected) {
+	return Boolean(expected.user?.id && current?.user?.id === expected.user.id && current.authBaseUrl === expected.authBaseUrl && current.clientId === expected.clientId);
+}
 async function getAuthSessionStateWithCandidateRefreshFence(options, candidateRefreshFenceHeld) {
 	const localState = await getLocalAuthSessionState();
 	const localPayloadKey = "payloadKey" in localState ? localState.payloadKey : null;
@@ -2011,6 +2185,11 @@ async function completeInterruptedComputerAuthSessionRecovery(id) {
 	});
 }
 async function getAuthSessionMetadata() {
+	const bound = admittedServiceSession.getStore();
+	if (bound) {
+		await getBoundServiceSessionState(bound, {});
+		return buildAuthSessionMetadata(bound);
+	}
 	return buildAuthSessionMetadata(await readSessionPayload());
 }
 function buildAuthSessionMetadata(payload) {
@@ -2090,6 +2269,12 @@ async function assertAuthSessionMutationAvailable() {
 	await withAuthSessionTransitionMutationLock(assertAuthSessionMutationAvailableWithOwnership);
 }
 async function assertAuthSessionMutationAvailableWithOwnership() {
+	await assertServiceAccountAdmissionMutationAvailable();
+	const bound = admittedServiceSession.getStore();
+	if (bound) {
+		const current = await readSessionPayloadFile();
+		if (current?.user?.id !== bound.user?.id || current?.authBaseUrl !== bound.authBaseUrl || current?.clientId !== bound.clientId) throw new AuthSessionChangedBeforeTransitionError();
+	}
 	await recoverInterruptedAuthSessionTransitionWithOwnership();
 	if (await readAuthSessionTransitionJournal()) throw new AuthSessionRecoveryInProgressError();
 }
@@ -2405,6 +2590,11 @@ async function cleanupCandidateTokenRefs(journal, keepTokenRef) {
 }
 async function persistRemoteSessionRefresh(input) {
 	return await withAuthSessionTransitionMutationLock(async () => {
+		const bound = admittedServiceSession.getStore();
+		if (bound) {
+			if (!isSameAuthPrincipal((await getLocalAuthSessionState({ recover: false })).session, bound)) return null;
+		}
+		await assertServiceAccountAdmissionMutationAvailable();
 		await recoverInterruptedAuthSessionTransitionWithOwnership();
 		const transitionJournal = await readAuthSessionTransitionJournal();
 		if (transitionJournal) {
@@ -2632,6 +2822,7 @@ async function recoverInterruptedAuthSessionTransition() {
 async function recoverInterruptedAuthSessionTransitionWithOwnership() {
 	let journal = await readAuthSessionTransitionJournal();
 	if (!journal) return;
+	await assertServiceAccountAdmissionMutationAvailable();
 	if (activeAuthSessionTransitionIds.has(journal.id)) return;
 	if (journal.state === "pending" && isProcessIdentityAlive({
 		ownerPid: journal.ownerPid,
@@ -3004,6 +3195,6 @@ async function removeSessionFile() {
 	await rm(authSessionPath(), { force: true });
 }
 //#endregion
-export { redactPrepareStepDiagnosticsBundle as $, DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS as A, PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS as B, resolveOpenMeldDistribution as C, DAEMON_RUNTIME_CONTRACT_EPOCH as D, CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS as E, MAX_HEARTBEAT_INTERVAL_MS as F, RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS as G, REGISTER_RESPONSE_TIMEOUT_MS as H, MAX_SPACE_REQUEST_TIMEOUT_MS as I, prepareSessionResponseSchema as J, RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS as K, MIN_HEARTBEAT_INTERVAL_MS as L, DEFAULT_HEARTBEAT_INTERVAL_MS as M, DEFAULT_SPACE_REQUEST_TIMEOUT_MS as N, DAEMON_STREAM_CONNECT_TIMEOUT_MS as O, HEARTBEAT_RESPONSE_TIMEOUT_MS as P, prepareStepDiagnosticsBundleSchema as Q, MIN_SPACE_REQUEST_TIMEOUT_MS as R, isBinaryDistribution as S, CATALOG_SYNC_RETRY_INTERVAL_MS as T, ROUTE_CATALOG_LOAD_TIMEOUT_MS as U, PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS as V, RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS as W, prepareSessionWithTokenResponseSchema as X, prepareSessionStreamServerFrameSchema as Y, prepareSetupBootstrapWriteSchema as Z, recordInterruptedComputerAuthSessionRecoveryFailure as _, beginAuthSessionTransition as a, updateAuthSessionActiveOrganization as b, getAuthSessionMetadata as c, getInterruptedComputerAuthSessionRecovery as d, redactPrepareStepDiagnosticsText as et, hasPendingComputerSetupContinuation as f, onAuthSessionCredentialObservation as g, onAuthSessionCredentialAvailable as h, assertAuthSessionMutationAvailable as i, DEFAULT_GATEWAY_CHAIN_TIMEOUT_MS as j, DAEMON_STREAM_KEEPALIVE_INTERVAL_MS as k, getAuthSessionState as l, normalizeStoredActiveOrganization as m, AuthSessionRecoveryInProgressError as n, clearAuthSession as o, markInterruptedComputerAuthSessionRecovery as p, PREPARE_STEP_DIAGNOSTICS_MAX_CHARS as q, AuthSessionTransitionConflictError as r, completeInterruptedComputerAuthSessionRecovery as s, AuthSessionChangedBeforeTransitionError as t, redactPrepareStepDiagnosticsValue as tt, getCurrentAuthOwnerUserId as u, resumeInterruptedComputerSetup as v, resolveAuthSessionExpiryEligibility as w, runMacOsNativeKeychainHelperIfRequested as x, setAuthSession as y, OPENCLAW_CLI_TIMEOUT_MS as z };
+export { RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS as $, withAuthSessionTransitionMutationLock as A, DEFAULT_SPACE_REQUEST_TIMEOUT_MS as B, withAdmittedServiceSession as C, cancelServiceAccountAdmission as D, admitServiceAccountOperation as E, DAEMON_STREAM_CONNECT_TIMEOUT_MS as F, MIN_SPACE_REQUEST_TIMEOUT_MS as G, MAX_HEARTBEAT_INTERVAL_MS as H, DAEMON_STREAM_KEEPALIVE_INTERVAL_MS as I, PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS as J, OPENCLAW_CLI_TIMEOUT_MS as K, DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS as L, CATALOG_SYNC_RETRY_INTERVAL_MS as M, CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS as N, readServiceAccountAdmission as O, DAEMON_RUNTIME_CONTRACT_EPOCH as P, RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS as Q, DEFAULT_GATEWAY_CHAIN_TIMEOUT_MS as R, updateAuthSessionActiveOrganization as S, ServiceAccountAdmissionError as T, MAX_SPACE_REQUEST_TIMEOUT_MS as U, HEARTBEAT_RESPONSE_TIMEOUT_MS as V, MIN_HEARTBEAT_INTERVAL_MS as W, ROUTE_CATALOG_LOAD_TIMEOUT_MS as X, REGISTER_RESPONSE_TIMEOUT_MS as Y, RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS as Z, onAuthSessionCredentialObservation as _, beginAuthSessionTransition as a, prepareSessionWithTokenResponseSchema as at, resumeInterruptedComputerSetup as b, completeInterruptedComputerAuthSessionRecovery as c, redactPrepareStepDiagnosticsBundle as ct, getCurrentAuthOwnerUserId as d, PREPARE_STEP_DIAGNOSTICS_MAX_CHARS as et, getInterruptedComputerAuthSessionRecovery as f, onAuthSessionCredentialAvailable as g, normalizeStoredActiveOrganization as h, assertAuthSessionMutationAvailable as i, prepareSessionStreamServerFrameSchema as it, resolveAuthSessionExpiryEligibility as j, reserveServiceAccountAdmission as k, getAuthSessionMetadata as l, redactPrepareStepDiagnosticsText as lt, markInterruptedComputerAuthSessionRecovery as m, AuthSessionRecoveryInProgressError as n, prepareSessionResponseSchema as nt, buildStoredAuthSessionIdentity as o, prepareSetupBootstrapWriteSchema as ot, hasPendingComputerSetupContinuation as p, PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS as q, AuthSessionTransitionConflictError as r, prepareSessionSnapshotSchema as rt, clearAuthSession as s, prepareStepDiagnosticsBundleSchema as st, AuthSessionChangedBeforeTransitionError as t, createPrepareSessionRequestSchema as tt, getAuthSessionState as u, redactPrepareStepDiagnosticsValue as ut, readServiceAdmissionSessionWithOwnership as v, runMacOsNativeKeychainHelperIfRequested as w, setAuthSession as x, recordInterruptedComputerAuthSessionRecoveryFailure as y, DEFAULT_HEARTBEAT_INTERVAL_MS as z };
 
-//# sourceMappingURL=auth-session-BjSqMLTz.js.map
+//# sourceMappingURL=auth-session-ijcuaSsZ.js.map