openmeld 0.3.211 → 0.3.212

package/dist/{service-account-authorization-D1Wp-91j.js → service-account-authorization-Dq4LcAVa.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 
 import { ft as resolveOpenMeldRootDir, pt as resolveOpenMeldServiceOwnedPathInput, rt as openMeldRootDir } from "./lock-Dxp6o_t_.js";
-import { A as withAuthSessionTransitionMutationLock, C as withAdmittedServiceSession, E as admitServiceAccountOperation, T as ServiceAccountAdmissionError, v as readServiceAdmissionSessionWithOwnership } from "./auth-session-CB7m-csh.js";
+import { D as admitServiceAccountOperation, E as ServiceAccountAdmissionError, j as withAuthSessionTransitionMutationLock, w as withAdmittedServiceSession, y as readServiceAdmissionSessionWithOwnership } from "./auth-session-Dqz9X4F0.js";
 import { r as readDaemonRuntimeLease } from "./daemon-runtime-lease-Dd4hdHNo.js";
-import { Bt as readDaemonServiceContract } from "./daemon-service-runtime-D8KrOfSV.js";
+import { Vt as readDaemonServiceContract } from "./daemon-service-runtime-CWTlAhZY.js";
 import { t as resolveOpenMeldEnvironmentTarget } from "./openmeld-environment-target-NtJYJe1D.js";
 import { resolve } from "node:path";
 //#region src/local-service/lifecycle/service-account-authorization.ts
@@ -53,4 +53,4 @@ async function admitServiceAccountStop(input) {
 //#endregion
 export { resolveServiceAccountIdentity as n, runServiceAccountCarrier as r, admitServiceAccountStop as t };
 
-//# sourceMappingURL=service-account-authorization-D1Wp-91j.js.map
+//# sourceMappingURL=service-account-authorization-Dq4LcAVa.js.map

package/dist/{service-account-authorization-D1Wp-91j.js.map → service-account-authorization-Dq4LcAVa.js.map}

@@ -1 +1 @@
-{"version":3,"file":"service-account-authorization-D1Wp-91j.js","names":[],"sources":["../src/local-service/lifecycle/service-account-authorization.ts"],"sourcesContent":["import { resolve } from \"node:path\";\nimport type { ServiceAccountAdmissionIdentity } from \"@openmeld/schemas\";\nimport {\n  readServiceAdmissionSessionWithOwnership,\n  type StoredAuthSession,\n  withAdmittedServiceSession,\n} from \"../../config/auth-session\";\nimport { withAuthSessionTransitionMutationLock } from \"../../config/auth-session-transition-lock\";\nimport { readDaemonRuntimeLease } from \"../../config/daemon-runtime-lease\";\nimport { readDaemonServiceContract } from \"../../config/daemon-service-contract\";\nimport { resolveOpenMeldEnvironmentTarget } from \"../../config/openmeld-environment-target\";\nimport {\n  openMeldRootDir,\n  resolveOpenMeldRootDir,\n  resolveOpenMeldServiceOwnedPathInput,\n} from \"../../config/paths\";\nimport {\n  admitServiceAccountOperation,\n  ServiceAccountAdmissionError,\n} from \"../../config/service-account-admission\";\n\ntype Contract = NonNullable<\n  Awaited<ReturnType<typeof readDaemonServiceContract>>\n>;\nfunction refused(reason: string, message: string): never {\n  throw new ServiceAccountAdmissionError(reason, message);\n}\n\nexport async function resolveServiceAccountIdentity(\n  session: StoredAuthSession,\n  contract: Contract\n): Promise<ServiceAccountAdmissionIdentity> {\n  const target = await resolveOpenMeldEnvironmentTarget();\n  if (\n    resolve(openMeldRootDir()) !==\n      resolve(resolveOpenMeldRootDir(resolveOpenMeldServiceOwnedPathInput())) ||\n    contract.lane !== target.preset ||\n    contract.gatewayUrl !== target.gatewayUrl ||\n    session.authBaseUrl !== target.authBaseUrl ||\n    !contract.ownerUserId ||\n    contract.ownerUserId !== session.user?.id ||\n    !contract.connectedComputerId\n  ) {\n    refused(\n      \"ownership_mismatch\",\n      \"This Service does not match the signed-in account or environment. Reconnect it through OpenMeld setup before trying again.\"\n    );\n  }\n  return {\n    accountId: contract.ownerUserId,\n    authBaseUrl: session.authBaseUrl,\n    clientId: session.clientId,\n    gatewayUrl: target.gatewayUrl,\n    lane: target.preset,\n    deviceId: contract.deviceId,\n    contractGeneration: contract.generation,\n  };\n}\n\nexport async function runServiceAccountCarrier<T>(\n  id: string,\n  run: () => Promise<T>\n): Promise<T> {\n  const session = await withAuthSessionTransitionMutationLock(async () => {\n    const local = await readServiceAdmissionSessionWithOwnership();\n    const contract = await readDaemonServiceContract();\n    if (!contract || contract.desiredState !== \"background\") {\n      refused(\n        \"cancelled\",\n        \"This Service startup is no longer authorized. Start the Service again from the matching account.\"\n      );\n    }\n    await admitServiceAccountOperation({\n      id,\n      operation: \"start\",\n      identity: await resolveServiceAccountIdentity(local, contract),\n    });\n    return local;\n  });\n  return await withAdmittedServiceSession(session, run);\n}\n\nexport async function admitServiceAccountStop(input: {\n  id: string;\n  ownerUserId: string;\n  deviceId: string;\n  contractGeneration: number;\n  commit: () => void;\n}): Promise<void> {\n  await withAuthSessionTransitionMutationLock(async () => {\n    const session = await readServiceAdmissionSessionWithOwnership();\n    const contract = await readDaemonServiceContract();\n    const lease = await readDaemonRuntimeLease();\n    if (\n      !(contract && lease) ||\n      lease.pid !== process.pid ||\n      contract.generation !== input.contractGeneration ||\n      contract.ownerUserId !== input.ownerUserId ||\n      contract.deviceId !== input.deviceId\n    ) {\n      refused(\n        \"ownership_changed\",\n        \"The running Service changed before this Stop was accepted. Check its status and try again.\"\n      );\n    }\n    await admitServiceAccountOperation({\n      id: input.id,\n      operation: \"stop\",\n      identity: await resolveServiceAccountIdentity(session, contract),\n      commit: input.commit,\n    });\n  });\n}\n"],"mappings":";;;;;;;;;AAwBA,SAAS,QAAQ,QAAgB,SAAwB;CACvD,MAAM,IAAI,6BAA6B,QAAQ,OAAO;AACxD;AAEA,eAAsB,8BACpB,SACA,UAC0C;CAC1C,MAAM,SAAS,MAAM,iCAAiC;CACtD,IACE,QAAQ,gBAAgB,CAAC,MACvB,QAAQ,uBAAuB,qCAAqC,CAAC,CAAC,KACxE,SAAS,SAAS,OAAO,UACzB,SAAS,eAAe,OAAO,cAC/B,QAAQ,gBAAgB,OAAO,eAC/B,CAAC,SAAS,eACV,SAAS,gBAAgB,QAAQ,MAAM,MACvC,CAAC,SAAS,qBAEV,QACE,sBACA,4HACF;CAEF,OAAO;EACL,WAAW,SAAS;EACpB,aAAa,QAAQ;EACrB,UAAU,QAAQ;EAClB,YAAY,OAAO;EACnB,MAAM,OAAO;EACb,UAAU,SAAS;EACnB,oBAAoB,SAAS;CAC/B;AACF;AAEA,eAAsB,yBACpB,IACA,KACY;CAiBZ,OAAO,MAAM,2BAA2B,MAhBlB,sCAAsC,YAAY;EACtE,MAAM,QAAQ,MAAM,yCAAyC;EAC7D,MAAM,WAAW,MAAM,0BAA0B;EACjD,IAAI,CAAC,YAAY,SAAS,iBAAiB,cACzC,QACE,aACA,kGACF;EAEF,MAAM,6BAA6B;GACjC;GACA,WAAW;GACX,UAAU,MAAM,8BAA8B,OAAO,QAAQ;EAC/D,CAAC;EACD,OAAO;CACT,CAAC,GACgD,GAAG;AACtD;AAEA,eAAsB,wBAAwB,OAM5B;CAChB,MAAM,sCAAsC,YAAY;EACtD,MAAM,UAAU,MAAM,yCAAyC;EAC/D,MAAM,WAAW,MAAM,0BAA0B;EACjD,MAAM,QAAQ,MAAM,uBAAuB;EAC3C,IACE,EAAE,YAAY,UACd,MAAM,QAAQ,QAAQ,OACtB,SAAS,eAAe,MAAM,sBAC9B,SAAS,gBAAgB,MAAM,eAC/B,SAAS,aAAa,MAAM,UAE5B,QACE,qBACA,4FACF;EAEF,MAAM,6BAA6B;GACjC,IAAI,MAAM;GACV,WAAW;GACX,UAAU,MAAM,8BAA8B,SAAS,QAAQ;GAC/D,QAAQ,MAAM;EAChB,CAAC;CACH,CAAC;AACH"}
+{"version":3,"file":"service-account-authorization-Dq4LcAVa.js","names":[],"sources":["../src/local-service/lifecycle/service-account-authorization.ts"],"sourcesContent":["import { resolve } from \"node:path\";\nimport type { ServiceAccountAdmissionIdentity } from \"@openmeld/schemas\";\nimport {\n  readServiceAdmissionSessionWithOwnership,\n  type StoredAuthSession,\n  withAdmittedServiceSession,\n} from \"../../config/auth-session\";\nimport { withAuthSessionTransitionMutationLock } from \"../../config/auth-session-transition-lock\";\nimport { readDaemonRuntimeLease } from \"../../config/daemon-runtime-lease\";\nimport { readDaemonServiceContract } from \"../../config/daemon-service-contract\";\nimport { resolveOpenMeldEnvironmentTarget } from \"../../config/openmeld-environment-target\";\nimport {\n  openMeldRootDir,\n  resolveOpenMeldRootDir,\n  resolveOpenMeldServiceOwnedPathInput,\n} from \"../../config/paths\";\nimport {\n  admitServiceAccountOperation,\n  ServiceAccountAdmissionError,\n} from \"../../config/service-account-admission\";\n\ntype Contract = NonNullable<\n  Awaited<ReturnType<typeof readDaemonServiceContract>>\n>;\nfunction refused(reason: string, message: string): never {\n  throw new ServiceAccountAdmissionError(reason, message);\n}\n\nexport async function resolveServiceAccountIdentity(\n  session: StoredAuthSession,\n  contract: Contract\n): Promise<ServiceAccountAdmissionIdentity> {\n  const target = await resolveOpenMeldEnvironmentTarget();\n  if (\n    resolve(openMeldRootDir()) !==\n      resolve(resolveOpenMeldRootDir(resolveOpenMeldServiceOwnedPathInput())) ||\n    contract.lane !== target.preset ||\n    contract.gatewayUrl !== target.gatewayUrl ||\n    session.authBaseUrl !== target.authBaseUrl ||\n    !contract.ownerUserId ||\n    contract.ownerUserId !== session.user?.id ||\n    !contract.connectedComputerId\n  ) {\n    refused(\n      \"ownership_mismatch\",\n      \"This Service does not match the signed-in account or environment. Reconnect it through OpenMeld setup before trying again.\"\n    );\n  }\n  return {\n    accountId: contract.ownerUserId,\n    authBaseUrl: session.authBaseUrl,\n    clientId: session.clientId,\n    gatewayUrl: target.gatewayUrl,\n    lane: target.preset,\n    deviceId: contract.deviceId,\n    contractGeneration: contract.generation,\n  };\n}\n\nexport async function runServiceAccountCarrier<T>(\n  id: string,\n  run: () => Promise<T>\n): Promise<T> {\n  const session = await withAuthSessionTransitionMutationLock(async () => {\n    const local = await readServiceAdmissionSessionWithOwnership();\n    const contract = await readDaemonServiceContract();\n    if (!contract || contract.desiredState !== \"background\") {\n      refused(\n        \"cancelled\",\n        \"This Service startup is no longer authorized. Start the Service again from the matching account.\"\n      );\n    }\n    await admitServiceAccountOperation({\n      id,\n      operation: \"start\",\n      identity: await resolveServiceAccountIdentity(local, contract),\n    });\n    return local;\n  });\n  return await withAdmittedServiceSession(session, run);\n}\n\nexport async function admitServiceAccountStop(input: {\n  id: string;\n  ownerUserId: string;\n  deviceId: string;\n  contractGeneration: number;\n  commit: () => void;\n}): Promise<void> {\n  await withAuthSessionTransitionMutationLock(async () => {\n    const session = await readServiceAdmissionSessionWithOwnership();\n    const contract = await readDaemonServiceContract();\n    const lease = await readDaemonRuntimeLease();\n    if (\n      !(contract && lease) ||\n      lease.pid !== process.pid ||\n      contract.generation !== input.contractGeneration ||\n      contract.ownerUserId !== input.ownerUserId ||\n      contract.deviceId !== input.deviceId\n    ) {\n      refused(\n        \"ownership_changed\",\n        \"The running Service changed before this Stop was accepted. Check its status and try again.\"\n      );\n    }\n    await admitServiceAccountOperation({\n      id: input.id,\n      operation: \"stop\",\n      identity: await resolveServiceAccountIdentity(session, contract),\n      commit: input.commit,\n    });\n  });\n}\n"],"mappings":";;;;;;;;;AAwBA,SAAS,QAAQ,QAAgB,SAAwB;CACvD,MAAM,IAAI,6BAA6B,QAAQ,OAAO;AACxD;AAEA,eAAsB,8BACpB,SACA,UAC0C;CAC1C,MAAM,SAAS,MAAM,iCAAiC;CACtD,IACE,QAAQ,gBAAgB,CAAC,MACvB,QAAQ,uBAAuB,qCAAqC,CAAC,CAAC,KACxE,SAAS,SAAS,OAAO,UACzB,SAAS,eAAe,OAAO,cAC/B,QAAQ,gBAAgB,OAAO,eAC/B,CAAC,SAAS,eACV,SAAS,gBAAgB,QAAQ,MAAM,MACvC,CAAC,SAAS,qBAEV,QACE,sBACA,4HACF;CAEF,OAAO;EACL,WAAW,SAAS;EACpB,aAAa,QAAQ;EACrB,UAAU,QAAQ;EAClB,YAAY,OAAO;EACnB,MAAM,OAAO;EACb,UAAU,SAAS;EACnB,oBAAoB,SAAS;CAC/B;AACF;AAEA,eAAsB,yBACpB,IACA,KACY;CAiBZ,OAAO,MAAM,2BAA2B,MAhBlB,sCAAsC,YAAY;EACtE,MAAM,QAAQ,MAAM,yCAAyC;EAC7D,MAAM,WAAW,MAAM,0BAA0B;EACjD,IAAI,CAAC,YAAY,SAAS,iBAAiB,cACzC,QACE,aACA,kGACF;EAEF,MAAM,6BAA6B;GACjC;GACA,WAAW;GACX,UAAU,MAAM,8BAA8B,OAAO,QAAQ;EAC/D,CAAC;EACD,OAAO;CACT,CAAC,GACgD,GAAG;AACtD;AAEA,eAAsB,wBAAwB,OAM5B;CAChB,MAAM,sCAAsC,YAAY;EACtD,MAAM,UAAU,MAAM,yCAAyC;EAC/D,MAAM,WAAW,MAAM,0BAA0B;EACjD,MAAM,QAAQ,MAAM,uBAAuB;EAC3C,IACE,EAAE,YAAY,UACd,MAAM,QAAQ,QAAQ,OACtB,SAAS,eAAe,MAAM,sBAC9B,SAAS,gBAAgB,MAAM,eAC/B,SAAS,aAAa,MAAM,UAE5B,QACE,qBACA,4FACF;EAEF,MAAM,6BAA6B;GACjC,IAAI,MAAM;GACV,WAAW;GACX,UAAU,MAAM,8BAA8B,SAAS,QAAQ;GAC/D,QAAQ,MAAM;EAChB,CAAC;CACH,CAAC;AACH"}

package/dist/service-account-control-BTR_X7QM.js

@@ -0,0 +1,145 @@
+#!/usr/bin/env node
+
+import { w as readProcessStartIdentity } from "./lock-Dxp6o_t_.js";
+import { Ra as resolveRuntimeContext, _a as buildDaemonSystemServiceCommandSpec } from "./daemon-service-update-coordinator-DcjOzGu1.js";
+import { A as reserveServiceAccountAdmission, E as ServiceAccountAdmissionError, O as cancelServiceAccountAdmission, d as getAuthSessionState, j as withAuthSessionTransitionMutationLock, k as readServiceAccountAdmission, o as buildStoredAuthSessionIdentity, w as withAdmittedServiceSession, y as readServiceAdmissionSessionWithOwnership } from "./auth-session-Dqz9X4F0.js";
+import { T as createQuietPresenter, d as runDaemonServiceDetached, m as runDaemonStop, or as fetchAuthUserSnapshot } from "./service-CTG3_X0o.js";
+import { a as serviceAccountControlRequestSchema } from "./distribution-DY2fBeSW.js";
+import { r as readDaemonRuntimeLease } from "./daemon-runtime-lease-Dd4hdHNo.js";
+import { Ft as requestLocalDaemonShutdown, Ht as upsertDaemonServiceContract, Mt as LocalDaemonControlPlaneClientError, Vt as readDaemonServiceContract, r as readCurrentDaemonRuntimeContext } from "./daemon-service-runtime-CWTlAhZY.js";
+import { K as withDaemonServiceRunLock } from "./daemon-state-C37ZtIZK.js";
+import { S as resolveDaemonServiceManager } from "./daemon-service-manager-GiMCiTmu.js";
+import { n as resolveServiceAccountIdentity } from "./service-account-authorization-Dq4LcAVa.js";
+import { setTimeout } from "node:timers/promises";
+//#region src/commands/service-account-control.ts
+function refused(reason, message) {
+	throw new ServiceAccountAdmissionError(reason, message);
+}
+async function runServiceAccountControl(request, expectedSessionIdentity) {
+	const parsed = serviceAccountControlRequestSchema.safeParse(request);
+	if (!parsed.success) refused("missing_account", "Choose a signed-in account before controlling this Service.");
+	const input = parsed.data;
+	if (process.platform === "win32") refused("unsupported_platform", "Account-checked Service control is not available on Windows yet.");
+	const auth = await getAuthSessionState();
+	if (auth.state !== "valid" || !auth.session) refused("authentication_required", "Sign in to the CLI with the matching account and try again.");
+	const preparedSession = auth.session;
+	if (preparedSession.user?.id !== input.expectedAccount) refused("account_mismatch", "The CLI is signed in to a different account. Sign in with the matching account and try again.");
+	if ((await fetchAuthUserSnapshot({
+		authBaseUrl: preparedSession.authBaseUrl,
+		accessToken: preparedSession.accessToken
+	})).id !== input.expectedAccount) refused("account_mismatch", "The CLI session belongs to a different account. Sign in again and retry.");
+	await withDaemonServiceRunLock(async () => {
+		const contract = await readDaemonServiceContract();
+		if (!contract) refused("ownership_unknown", "Connect this computer through OpenMeld setup before controlling its Service.");
+		const observed = await readCurrentDaemonRuntimeContext();
+		const lease = await readDaemonRuntimeLease();
+		if (input.operation === "start" && observed.effectiveRuntimeStatus !== "not_running") refused("busy", "The Service is already running or its state is uncertain. Check Service status before trying again.");
+		if (input.operation === "stop" && (observed.effectiveRuntimeStatus !== "running" || !lease || lease.generation !== contract.generation)) refused("ownership_unknown", "OpenMeld could not verify the running Service. Check Service status before trying again.");
+		let boundSession = preparedSession;
+		const reservation = await withAuthSessionTransitionMutationLock(async () => {
+			boundSession = await readServiceAdmissionSessionWithOwnership();
+			if (expectedSessionIdentity !== void 0 && buildStoredAuthSessionIdentity(boundSession) !== expectedSessionIdentity || boundSession.accessToken !== preparedSession.accessToken || boundSession.createdAt !== preparedSession.createdAt || boundSession.user?.id !== input.expectedAccount) refused("account_changed", "The CLI sign-in changed before this action was accepted. Check the account and try again.");
+			const current = await readDaemonServiceContract();
+			if (!current || JSON.stringify(current) !== JSON.stringify(contract)) refused("ownership_changed", "The Service changed before this action was accepted. Check its status and try again.");
+			const identity = await resolveServiceAccountIdentity(boundSession, contract);
+			if (input.operation === "start" && contract.desiredState !== "background") identity.contractGeneration += 1;
+			return await reserveServiceAccountAdmission({
+				operation: input.operation,
+				identity,
+				...input.operation === "stop" && lease ? { target: {
+					ownerPid: lease.pid,
+					ownerProcessStartedAt: readProcessStartIdentity(lease.pid) ?? refused("ownership_unknown", "OpenMeld could not identify the Service process. Check its status and try again.")
+				} } : {}
+			});
+		});
+		try {
+			await withAdmittedServiceSession(boundSession, async () => {
+				if (input.operation === "stop") {
+					await stopReservedService(contract, reservation.id, lease?.pid ?? 0);
+					return;
+				}
+				const manager = contract.serviceController === "legacy-detached" ? null : await resolveDaemonServiceManager(contract.serviceController);
+				if (contract.serviceController !== "legacy-detached" && !(manager && (await manager.status()).installed)) refused("installation_required", "This Service needs setup before it can start. Run OpenMeld setup and try again.");
+				await upsertDaemonServiceContract({
+					...contract,
+					desiredState: "background"
+				});
+				if (contract.serviceController === "legacy-detached") {
+					const runtime = await resolveRuntimeContext({ view: "agent" });
+					await runDaemonServiceDetached({
+						accountAdmissionId: reservation.id,
+						deviceId: contract.deviceId,
+						gatewayUrl: contract.gatewayUrl,
+						heartbeatMs: contract.heartbeatMs,
+						runtime,
+						presenter: createQuietPresenter(runtime),
+						mode: "background"
+					});
+				} else if (manager) {
+					await manager.deactivate();
+					await manager.install(buildDaemonSystemServiceCommandSpec({
+						controller: manager.controller,
+						accountAdmissionId: reservation.id
+					}));
+					await manager.start();
+				}
+				await waitForAdmittedService(reservation.id);
+			});
+		} finally {
+			await cancelServiceAccountAdmission(reservation.id);
+		}
+	});
+}
+async function waitForAdmittedService(id) {
+	const deadline = Date.now() + 15e3;
+	while (Date.now() < deadline) {
+		const current = await readServiceAccountAdmission();
+		const runtime = await readCurrentDaemonRuntimeContext();
+		if (current?.id === id && current.state === "admitted" && current.carrier?.ownerPid === runtime.runtimeStatus.pid && runtime.effectiveRuntimeStatus === "running") return;
+		await setTimeout(50);
+	}
+	refused("startup_unconfirmed", "OpenMeld could not confirm that this Service started. Check Service status before trying again.");
+}
+async function stopReservedService(contract, id, pid) {
+	await requestAccountCheckedServiceStop({
+		id,
+		manager: contract.serviceController === "legacy-detached" ? null : await resolveDaemonServiceManager(contract.serviceController)
+	});
+	const admitted = await readServiceAccountAdmission();
+	if (admitted?.id !== id || admitted.state !== "admitted" || admitted.carrier?.ownerPid !== pid) refused("admission_unconfirmed", "OpenMeld could not verify that the matching Service accepted Stop. Check Service status before trying again.");
+	const current = await readCurrentDaemonRuntimeContext();
+	if (current.runtimeStatus.pid !== null && current.runtimeStatus.pid !== pid) refused("ownership_changed", "Another Service instance is now running. Its state was left unchanged.");
+	await runDaemonStop({
+		json: true,
+		view: "agent"
+	}, { completedControlledShutdownOwnerPid: pid });
+}
+async function requestAccountCheckedServiceStop({ id, manager }) {
+	const wasEnabled = manager ? (await manager.status()).enabled : false;
+	if (manager) await manager.disableAutostart();
+	try {
+		if (!(await requestLocalDaemonShutdown({
+			payload: {
+				accountAdmissionId: id,
+				mode: "graceful",
+				gracePeriodMs: 2e3
+			},
+			timeoutMs: 15e3
+		})).accepted) throw new Error("The Service did not confirm controlled shutdown.");
+	} catch (error) {
+		if (manager && wasEnabled && error instanceof LocalDaemonControlPlaneClientError && error.code === "service.account_admission.stop_refused") try {
+			await manager.enableAutostart();
+		} catch (restoreError) {
+			throw new AggregateError([error, restoreError], "Stop was refused and its previous autostart setting could not be restored.");
+		}
+		if (!(error instanceof LocalDaemonControlPlaneClientError && error.code === "service.account_admission.stop_refused")) {
+			const detail = error instanceof Error ? error.message : String(error);
+			refused("stop_unconfirmed", `Stop may already be in progress. ${manager ? "Autostart remains disabled. " : ""}Check Service status before trying again. ${detail}`);
+		}
+		throw error;
+	}
+}
+//#endregion
+export { runServiceAccountControl as t };
+
+//# sourceMappingURL=service-account-control-BTR_X7QM.js.map

package/dist/service-account-control-BTR_X7QM.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-account-control-BTR_X7QM.js","names":["delay"],"sources":["../src/commands/service-account-control.ts"],"sourcesContent":["import { setTimeout as delay } from \"node:timers/promises\";\nimport {\n  SERVICE_ACCOUNT_STOP_REFUSED_CODE,\n  type ServiceAccountControlRequest,\n  serviceAccountControlRequestSchema,\n} from \"@openmeld/schemas\";\nimport {\n  buildStoredAuthSessionIdentity,\n  getAuthSessionState,\n  readServiceAdmissionSessionWithOwnership,\n  type StoredAuthSession,\n  withAdmittedServiceSession,\n} from \"../config/auth-session\";\nimport { withAuthSessionTransitionMutationLock } from \"../config/auth-session-transition-lock\";\nimport { readDaemonRuntimeLease } from \"../config/daemon-runtime-lease\";\nimport {\n  readDaemonServiceContract,\n  upsertDaemonServiceContract,\n} from \"../config/daemon-service-contract\";\nimport { withDaemonServiceRunLock } from \"../config/daemon-state\";\nimport {\n  cancelServiceAccountAdmission,\n  readServiceAccountAdmission,\n  reserveServiceAccountAdmission,\n  ServiceAccountAdmissionError,\n} from \"../config/service-account-admission\";\nimport {\n  LocalDaemonControlPlaneClientError,\n  requestLocalDaemonShutdown,\n} from \"../local-service/control-plane/client\";\nimport { CONTROLLED_SHUTDOWN_REQUEST_TIMEOUT_MS } from \"../local-service/core/constants\";\nimport { buildDaemonSystemServiceCommandSpec } from \"../local-service/lifecycle/daemon-service-command-spec\";\nimport {\n  type DaemonServiceManager,\n  resolveDaemonServiceManager,\n} from \"../local-service/lifecycle/daemon-service-manager\";\nimport { readCurrentDaemonRuntimeContext } from \"../local-service/lifecycle/daemon-service-runtime\";\nimport { resolveServiceAccountIdentity } from \"../local-service/lifecycle/service-account-authorization\";\nimport { resolveRuntimeContext } from \"../runtime/context\";\nimport { readProcessStartIdentity } from \"../system/process-identity\";\nimport { fetchAuthUserSnapshot } from \"./auth-device-session-client\";\nimport { runDaemonServiceDetached, runDaemonStop } from \"./service\";\nimport { createQuietPresenter } from \"./service-output\";\n\ntype Contract = NonNullable<\n  Awaited<ReturnType<typeof readDaemonServiceContract>>\n>;\n\nfunction refused(reason: string, message: string): never {\n  throw new ServiceAccountAdmissionError(reason, message);\n}\n\nexport async function runServiceAccountControl(\n  request: ServiceAccountControlRequest,\n  expectedSessionIdentity?: string\n): Promise<void> {\n  const parsed = serviceAccountControlRequestSchema.safeParse(request);\n  if (!parsed.success) {\n    refused(\n      \"missing_account\",\n      \"Choose a signed-in account before controlling this Service.\"\n    );\n  }\n  const input = parsed.data;\n  if (process.platform === \"win32\") {\n    refused(\n      \"unsupported_platform\",\n      \"Account-checked Service control is not available on Windows yet.\"\n    );\n  }\n  const auth = await getAuthSessionState();\n  if (auth.state !== \"valid\" || !auth.session) {\n    refused(\n      \"authentication_required\",\n      \"Sign in to the CLI with the matching account and try again.\"\n    );\n  }\n  const preparedSession = auth.session;\n  if (preparedSession.user?.id !== input.expectedAccount) {\n    refused(\n      \"account_mismatch\",\n      \"The CLI is signed in to a different account. Sign in with the matching account and try again.\"\n    );\n  }\n  // The shared Auth endpoint proves the principal. Local metadata alone does not.\n  const user = await fetchAuthUserSnapshot({\n    authBaseUrl: preparedSession.authBaseUrl,\n    accessToken: preparedSession.accessToken,\n  });\n  if (user.id !== input.expectedAccount) {\n    refused(\n      \"account_mismatch\",\n      \"The CLI session belongs to a different account. Sign in again and retry.\"\n    );\n  }\n\n  await withDaemonServiceRunLock(async () => {\n    const contract = await readDaemonServiceContract();\n    if (!contract) {\n      refused(\n        \"ownership_unknown\",\n        \"Connect this computer through OpenMeld setup before controlling its Service.\"\n      );\n    }\n    const observed = await readCurrentDaemonRuntimeContext();\n    const lease = await readDaemonRuntimeLease();\n    if (\n      input.operation === \"start\" &&\n      observed.effectiveRuntimeStatus !== \"not_running\"\n    ) {\n      refused(\n        \"busy\",\n        \"The Service is already running or its state is uncertain. Check Service status before trying again.\"\n      );\n    }\n    if (\n      input.operation === \"stop\" &&\n      (observed.effectiveRuntimeStatus !== \"running\" ||\n        !lease ||\n        lease.generation !== contract.generation)\n    ) {\n      refused(\n        \"ownership_unknown\",\n        \"OpenMeld could not verify the running Service. Check Service status before trying again.\"\n      );\n    }\n\n    let boundSession: StoredAuthSession = preparedSession;\n    const reservation = await withAuthSessionTransitionMutationLock(\n      async () => {\n        boundSession = await readServiceAdmissionSessionWithOwnership();\n        if (\n          (expectedSessionIdentity !== undefined &&\n            buildStoredAuthSessionIdentity(boundSession) !==\n              expectedSessionIdentity) ||\n          boundSession.accessToken !== preparedSession.accessToken ||\n          boundSession.createdAt !== preparedSession.createdAt ||\n          boundSession.user?.id !== input.expectedAccount\n        ) {\n          refused(\n            \"account_changed\",\n            \"The CLI sign-in changed before this action was accepted. Check the account and try again.\"\n          );\n        }\n        const current = await readDaemonServiceContract();\n        if (!current || JSON.stringify(current) !== JSON.stringify(contract)) {\n          refused(\n            \"ownership_changed\",\n            \"The Service changed before this action was accepted. Check its status and try again.\"\n          );\n        }\n        const identity = await resolveServiceAccountIdentity(\n          boundSession,\n          contract\n        );\n        if (\n          input.operation === \"start\" &&\n          contract.desiredState !== \"background\"\n        ) {\n          identity.contractGeneration += 1;\n        }\n        return await reserveServiceAccountAdmission({\n          operation: input.operation,\n          identity,\n          ...(input.operation === \"stop\" && lease\n            ? {\n                target: {\n                  ownerPid: lease.pid,\n                  ownerProcessStartedAt:\n                    readProcessStartIdentity(lease.pid) ??\n                    refused(\n                      \"ownership_unknown\",\n                      \"OpenMeld could not identify the Service process. Check its status and try again.\"\n                    ),\n                },\n              }\n            : {}),\n        });\n      }\n    );\n\n    try {\n      await withAdmittedServiceSession(boundSession, async () => {\n        if (input.operation === \"stop\") {\n          await stopReservedService(contract, reservation.id, lease?.pid ?? 0);\n          return;\n        }\n        const manager =\n          contract.serviceController === \"legacy-detached\"\n            ? null\n            : await resolveDaemonServiceManager(contract.serviceController);\n        if (\n          contract.serviceController !== \"legacy-detached\" &&\n          !(manager && (await manager.status()).installed)\n        ) {\n          refused(\n            \"installation_required\",\n            \"This Service needs setup before it can start. Run OpenMeld setup and try again.\"\n          );\n        }\n        await upsertDaemonServiceContract({\n          ...contract,\n          desiredState: \"background\",\n        });\n        if (contract.serviceController === \"legacy-detached\") {\n          const runtime = await resolveRuntimeContext({ view: \"agent\" });\n          await runDaemonServiceDetached({\n            accountAdmissionId: reservation.id,\n            deviceId: contract.deviceId,\n            gatewayUrl: contract.gatewayUrl,\n            heartbeatMs: contract.heartbeatMs,\n            runtime,\n            presenter: createQuietPresenter(runtime),\n            mode: \"background\",\n          });\n        } else if (manager) {\n          // Refresh the existing stopped supervisor definition with an immutable\n          // generation argument. Never install a missing Service.\n          await manager.deactivate();\n          await manager.install(\n            buildDaemonSystemServiceCommandSpec({\n              controller: manager.controller,\n              accountAdmissionId: reservation.id,\n            })\n          );\n          await manager.start();\n        }\n        await waitForAdmittedService(reservation.id);\n      });\n    } finally {\n      await cancelServiceAccountAdmission(reservation.id);\n    }\n  });\n}\n\nasync function waitForAdmittedService(id: string): Promise<void> {\n  const deadline = Date.now() + 15_000;\n  while (Date.now() < deadline) {\n    const current = await readServiceAccountAdmission();\n    const runtime = await readCurrentDaemonRuntimeContext();\n    if (\n      current?.id === id &&\n      current.state === \"admitted\" &&\n      current.carrier?.ownerPid === runtime.runtimeStatus.pid &&\n      runtime.effectiveRuntimeStatus === \"running\"\n    ) {\n      return;\n    }\n    await delay(50);\n  }\n  refused(\n    \"startup_unconfirmed\",\n    \"OpenMeld could not confirm that this Service started. Check Service status before trying again.\"\n  );\n}\n\nasync function stopReservedService(\n  contract: Contract,\n  id: string,\n  pid: number\n): Promise<void> {\n  const manager =\n    contract.serviceController === \"legacy-detached\"\n      ? null\n      : await resolveDaemonServiceManager(contract.serviceController);\n  await requestAccountCheckedServiceStop({ id, manager });\n  const admitted = await readServiceAccountAdmission();\n  if (\n    admitted?.id !== id ||\n    admitted.state !== \"admitted\" ||\n    admitted.carrier?.ownerPid !== pid\n  ) {\n    refused(\n      \"admission_unconfirmed\",\n      \"OpenMeld could not verify that the matching Service accepted Stop. Check Service status before trying again.\"\n    );\n  }\n  const current = await readCurrentDaemonRuntimeContext();\n  if (current.runtimeStatus.pid !== null && current.runtimeStatus.pid !== pid) {\n    refused(\n      \"ownership_changed\",\n      \"Another Service instance is now running. Its state was left unchanged.\"\n    );\n  }\n  await runDaemonStop(\n    { json: true, view: \"agent\" },\n    {\n      completedControlledShutdownOwnerPid: pid,\n    }\n  );\n}\n\nexport async function requestAccountCheckedServiceStop({\n  id,\n  manager,\n}: {\n  id: string;\n  manager: Pick<\n    DaemonServiceManager,\n    \"status\" | \"disableAutostart\" | \"enableAutostart\"\n  > | null;\n}): Promise<void> {\n  const wasEnabled = manager ? (await manager.status()).enabled : false;\n  if (manager) {\n    await manager.disableAutostart();\n  }\n  // No compatibility fallback: only the verified carrier may admit this stop.\n  try {\n    const shutdown = await requestLocalDaemonShutdown({\n      payload: {\n        accountAdmissionId: id,\n        mode: \"graceful\",\n        gracePeriodMs: 2000,\n      },\n      timeoutMs: CONTROLLED_SHUTDOWN_REQUEST_TIMEOUT_MS,\n    });\n    if (!shutdown.accepted) {\n      throw new Error(\"The Service did not confirm controlled shutdown.\");\n    }\n  } catch (error) {\n    if (\n      manager &&\n      wasEnabled &&\n      error instanceof LocalDaemonControlPlaneClientError &&\n      error.code === SERVICE_ACCOUNT_STOP_REFUSED_CODE\n    ) {\n      try {\n        await manager.enableAutostart();\n      } catch (restoreError) {\n        throw new AggregateError(\n          [error, restoreError],\n          \"Stop was refused and its previous autostart setting could not be restored.\"\n        );\n      }\n    }\n    if (\n      !(\n        error instanceof LocalDaemonControlPlaneClientError &&\n        error.code === SERVICE_ACCOUNT_STOP_REFUSED_CODE\n      )\n    ) {\n      const detail = error instanceof Error ? error.message : String(error);\n      refused(\n        \"stop_unconfirmed\",\n        `Stop may already be in progress. ${manager ? \"Autostart remains disabled. \" : \"\"}Check Service status before trying again. ${detail}`\n      );\n    }\n    throw error;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;AAgDA,SAAS,QAAQ,QAAgB,SAAwB;CACvD,MAAM,IAAI,6BAA6B,QAAQ,OAAO;AACxD;AAEA,eAAsB,yBACpB,SACA,yBACe;CACf,MAAM,SAAS,mCAAmC,UAAU,OAAO;CACnE,IAAI,CAAC,OAAO,SACV,QACE,mBACA,6DACF;CAEF,MAAM,QAAQ,OAAO;CACrB,IAAI,QAAQ,aAAa,SACvB,QACE,wBACA,kEACF;CAEF,MAAM,OAAO,MAAM,oBAAoB;CACvC,IAAI,KAAK,UAAU,WAAW,CAAC,KAAK,SAClC,QACE,2BACA,6DACF;CAEF,MAAM,kBAAkB,KAAK;CAC7B,IAAI,gBAAgB,MAAM,OAAO,MAAM,iBACrC,QACE,oBACA,+FACF;CAOF,KAAI,MAJe,sBAAsB;EACvC,aAAa,gBAAgB;EAC7B,aAAa,gBAAgB;CAC/B,CAAC,EAAA,CACQ,OAAO,MAAM,iBACpB,QACE,oBACA,0EACF;CAGF,MAAM,yBAAyB,YAAY;EACzC,MAAM,WAAW,MAAM,0BAA0B;EACjD,IAAI,CAAC,UACH,QACE,qBACA,8EACF;EAEF,MAAM,WAAW,MAAM,gCAAgC;EACvD,MAAM,QAAQ,MAAM,uBAAuB;EAC3C,IACE,MAAM,cAAc,WACpB,SAAS,2BAA2B,eAEpC,QACE,QACA,qGACF;EAEF,IACE,MAAM,cAAc,WACnB,SAAS,2BAA2B,aACnC,CAAC,SACD,MAAM,eAAe,SAAS,aAEhC,QACE,qBACA,0FACF;EAGF,IAAI,eAAkC;EACtC,MAAM,cAAc,MAAM,sCACxB,YAAY;GACV,eAAe,MAAM,yCAAyC;GAC9D,IACG,4BAA4B,KAAA,KAC3B,+BAA+B,YAAY,MACzC,2BACJ,aAAa,gBAAgB,gBAAgB,eAC7C,aAAa,cAAc,gBAAgB,aAC3C,aAAa,MAAM,OAAO,MAAM,iBAEhC,QACE,mBACA,2FACF;GAEF,MAAM,UAAU,MAAM,0BAA0B;GAChD,IAAI,CAAC,WAAW,KAAK,UAAU,OAAO,MAAM,KAAK,UAAU,QAAQ,GACjE,QACE,qBACA,sFACF;GAEF,MAAM,WAAW,MAAM,8BACrB,cACA,QACF;GACA,IACE,MAAM,cAAc,WACpB,SAAS,iBAAiB,cAE1B,SAAS,sBAAsB;GAEjC,OAAO,MAAM,+BAA+B;IAC1C,WAAW,MAAM;IACjB;IACA,GAAI,MAAM,cAAc,UAAU,QAC9B,EACE,QAAQ;KACN,UAAU,MAAM;KAChB,uBACE,yBAAyB,MAAM,GAAG,KAClC,QACE,qBACA,kFACF;IACJ,EACF,IACA,CAAC;GACP,CAAC;EACH,CACF;EAEA,IAAI;GACF,MAAM,2BAA2B,cAAc,YAAY;IACzD,IAAI,MAAM,cAAc,QAAQ;KAC9B,MAAM,oBAAoB,UAAU,YAAY,IAAI,OAAO,OAAO,CAAC;KACnE;IACF;IACA,MAAM,UACJ,SAAS,sBAAsB,oBAC3B,OACA,MAAM,4BAA4B,SAAS,iBAAiB;IAClE,IACE,SAAS,sBAAsB,qBAC/B,EAAE,YAAY,MAAM,QAAQ,OAAO,EAAA,CAAG,YAEtC,QACE,yBACA,iFACF;IAEF,MAAM,4BAA4B;KAChC,GAAG;KACH,cAAc;IAChB,CAAC;IACD,IAAI,SAAS,sBAAsB,mBAAmB;KACpD,MAAM,UAAU,MAAM,sBAAsB,EAAE,MAAM,QAAQ,CAAC;KAC7D,MAAM,yBAAyB;MAC7B,oBAAoB,YAAY;MAChC,UAAU,SAAS;MACnB,YAAY,SAAS;MACrB,aAAa,SAAS;MACtB;MACA,WAAW,qBAAqB,OAAO;MACvC,MAAM;KACR,CAAC;IACH,OAAO,IAAI,SAAS;KAGlB,MAAM,QAAQ,WAAW;KACzB,MAAM,QAAQ,QACZ,oCAAoC;MAClC,YAAY,QAAQ;MACpB,oBAAoB,YAAY;KAClC,CAAC,CACH;KACA,MAAM,QAAQ,MAAM;IACtB;IACA,MAAM,uBAAuB,YAAY,EAAE;GAC7C,CAAC;EACH,UAAU;GACR,MAAM,8BAA8B,YAAY,EAAE;EACpD;CACF,CAAC;AACH;AAEA,eAAe,uBAAuB,IAA2B;CAC/D,MAAM,WAAW,KAAK,IAAI,IAAI;CAC9B,OAAO,KAAK,IAAI,IAAI,UAAU;EAC5B,MAAM,UAAU,MAAM,4BAA4B;EAClD,MAAM,UAAU,MAAM,gCAAgC;EACtD,IACE,SAAS,OAAO,MAChB,QAAQ,UAAU,cAClB,QAAQ,SAAS,aAAa,QAAQ,cAAc,OACpD,QAAQ,2BAA2B,WAEnC;EAEF,MAAMA,WAAM,EAAE;CAChB;CACA,QACE,uBACA,iGACF;AACF;AAEA,eAAe,oBACb,UACA,IACA,KACe;CAKf,MAAM,iCAAiC;EAAE;EAAI,SAH3C,SAAS,sBAAsB,oBAC3B,OACA,MAAM,4BAA4B,SAAS,iBAAiB;CACb,CAAC;CACtD,MAAM,WAAW,MAAM,4BAA4B;CACnD,IACE,UAAU,OAAO,MACjB,SAAS,UAAU,cACnB,SAAS,SAAS,aAAa,KAE/B,QACE,yBACA,8GACF;CAEF,MAAM,UAAU,MAAM,gCAAgC;CACtD,IAAI,QAAQ,cAAc,QAAQ,QAAQ,QAAQ,cAAc,QAAQ,KACtE,QACE,qBACA,wEACF;CAEF,MAAM,cACJ;EAAE,MAAM;EAAM,MAAM;CAAQ,GAC5B,EACE,qCAAqC,IACvC,CACF;AACF;AAEA,eAAsB,iCAAiC,EACrD,IACA,WAOgB;CAChB,MAAM,aAAa,WAAW,MAAM,QAAQ,OAAO,EAAA,CAAG,UAAU;CAChE,IAAI,SACF,MAAM,QAAQ,iBAAiB;CAGjC,IAAI;EASF,IAAI,EAAC,MARkB,2BAA2B;GAChD,SAAS;IACP,oBAAoB;IACpB,MAAM;IACN,eAAe;GACjB;GACA,WAAA;EACF,CAAC,EAAA,CACa,UACZ,MAAM,IAAI,MAAM,kDAAkD;CAEtE,SAAS,OAAO;EACd,IACE,WACA,cACA,iBAAiB,sCACjB,MAAM,SAAA,0CAEN,IAAI;GACF,MAAM,QAAQ,gBAAgB;EAChC,SAAS,cAAc;GACrB,MAAM,IAAI,eACR,CAAC,OAAO,YAAY,GACpB,4EACF;EACF;EAEF,IACE,EACE,iBAAiB,sCACjB,MAAM,SAAA,2CAER;GACA,MAAM,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GACpE,QACE,oBACA,oCAAoC,UAAU,iCAAiC,GAAG,4CAA4C,QAChI;EACF;EACA,MAAM;CACR;AACF"}

package/dist/{service-control-capabilities-COkZ1Ceh.js → service-control-capabilities-C5SxnBg2.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 import { o as serviceControlCapabilitiesSchema, s as serviceControlCarrierCapabilitySchema } from "./distribution-DY2fBeSW.js";
-import { Bt as readDaemonServiceContract, It as sendLocalDaemonControlPlaneRequest, S as daemonServiceBinaryExecutablePath, j as readDaemonActiveBundleState, r as readCurrentDaemonRuntimeContext } from "./daemon-service-runtime-D8KrOfSV.js";
+import { Lt as sendLocalDaemonControlPlaneRequest, S as daemonServiceBinaryExecutablePath, Vt as readDaemonServiceContract, j as readDaemonActiveBundleState, r as readCurrentDaemonRuntimeContext } from "./daemon-service-runtime-CWTlAhZY.js";
 import { S as resolveDaemonServiceManager } from "./daemon-service-manager-GiMCiTmu.js";
 import { realpath } from "node:fs/promises";
 import { execFile } from "node:child_process";
@@ -51,4 +51,4 @@ async function readServiceControlCapabilities() {
 //#endregion
 export { readServiceControlCapabilities as t };
 
-//# sourceMappingURL=service-control-capabilities-COkZ1Ceh.js.map
+//# sourceMappingURL=service-control-capabilities-C5SxnBg2.js.map

package/dist/{service-control-capabilities-COkZ1Ceh.js.map → service-control-capabilities-C5SxnBg2.js.map}

@@ -1 +1 @@
-{"version":3,"file":"service-control-capabilities-COkZ1Ceh.js","names":[],"sources":["../src/commands/service-control-capabilities.ts"],"sourcesContent":["import { execFile } from \"node:child_process\";\nimport { realpath } from \"node:fs/promises\";\nimport { promisify } from \"node:util\";\nimport {\n  serviceControlCapabilitiesSchema,\n  serviceControlCarrierCapabilitySchema,\n} from \"@openmeld/schemas\";\nimport { readDaemonServiceContract } from \"../config/daemon-service-contract\";\nimport { sendLocalDaemonControlPlaneRequest } from \"../local-service/control-plane/client\";\nimport {\n  daemonServiceBinaryExecutablePath,\n  readDaemonActiveBundleState,\n} from \"../local-service/lifecycle/daemon-service-bundle\";\nimport { resolveDaemonServiceManager } from \"../local-service/lifecycle/daemon-service-manager\";\nimport { readCurrentDaemonRuntimeContext } from \"../local-service/lifecycle/daemon-service-runtime\";\n\n/** Read only: never invoke the repairing npm launcher or a lifecycle operation. */\nexport async function readServiceControlCapabilities() {\n  const unsupported = { deviceId: null, start: false, stop: false };\n  if (process.platform !== \"darwin\") {\n    return unsupported;\n  }\n  const contract = await readDaemonServiceContract();\n  const bundle = await readDaemonActiveBundleState();\n  if (\n    contract?.serviceController !== \"launchd\" ||\n    bundle?.bundleFormat !== \"binary_v1\"\n  ) {\n    return unsupported;\n  }\n  const manager = await resolveDaemonServiceManager(\"launchd\");\n  if (!(manager && (await manager.status()).installed)) {\n    return unsupported;\n  }\n  // Guarded Start refreshes the supervisor command to this canonical executable.\n  // Verify the executable that answered, so an old CLI delegating elsewhere\n  // cannot advertise another binary's capability as its own.\n  const executable = await realpath(daemonServiceBinaryExecutablePath());\n  const { stdout } = await promisify(execFile)(\n    executable,\n    [\"service\", \"control-carrier-capability\", \"--json\"],\n    { timeout: 5000, maxBuffer: 16_384 }\n  );\n  const carrier = serviceControlCarrierCapabilitySchema.safeParse(\n    JSON.parse(stdout)\n  );\n  if (\n    !carrier.success ||\n    (await realpath(carrier.data.executable)) !== executable\n  ) {\n    return unsupported;\n  }\n  const runtime = await readCurrentDaemonRuntimeContext();\n  if (runtime.effectiveRuntimeStatus === \"not_running\") {\n    return { deviceId: contract.deviceId, start: true, stop: false };\n  }\n  if (runtime.effectiveRuntimeStatus !== \"running\") {\n    return unsupported;\n  }\n  const response = await sendLocalDaemonControlPlaneRequest({\n    request: { v: 1, command: \"account_control_capabilities\" },\n  });\n  return serviceControlCapabilitiesSchema.parse({\n    deviceId: contract.deviceId,\n    start: false,\n    stop:\n      response.code === \"service.account_control_capabilities\" &&\n      response.payload.supported,\n  });\n}\n"],"mappings":";;;;;;;;;;AAiBA,eAAsB,iCAAiC;CACrD,MAAM,cAAc;EAAE,UAAU;EAAM,OAAO;EAAO,MAAM;CAAM;CAChE,IAAI,QAAQ,aAAa,UACvB,OAAO;CAET,MAAM,WAAW,MAAM,0BAA0B;CACjD,MAAM,SAAS,MAAM,4BAA4B;CACjD,IACE,UAAU,sBAAsB,aAChC,QAAQ,iBAAiB,aAEzB,OAAO;CAET,MAAM,UAAU,MAAM,4BAA4B,SAAS;CAC3D,IAAI,EAAE,YAAY,MAAM,QAAQ,OAAO,EAAA,CAAG,YACxC,OAAO;CAKT,MAAM,aAAa,MAAM,SAAS,kCAAkC,CAAC;CACrE,MAAM,EAAE,WAAW,MAAM,UAAU,QAAQ,CAAC,CAC1C,YACA;EAAC;EAAW;EAA8B;CAAQ,GAClD;EAAE,SAAS;EAAM,WAAW;CAAO,CACrC;CACA,MAAM,UAAU,sCAAsC,UACpD,KAAK,MAAM,MAAM,CACnB;CACA,IACE,CAAC,QAAQ,WACR,MAAM,SAAS,QAAQ,KAAK,UAAU,MAAO,YAE9C,OAAO;CAET,MAAM,UAAU,MAAM,gCAAgC;CACtD,IAAI,QAAQ,2BAA2B,eACrC,OAAO;EAAE,UAAU,SAAS;EAAU,OAAO;EAAM,MAAM;CAAM;CAEjE,IAAI,QAAQ,2BAA2B,WACrC,OAAO;CAET,MAAM,WAAW,MAAM,mCAAmC,EACxD,SAAS;EAAE,GAAG;EAAG,SAAS;CAA+B,EAC3D,CAAC;CACD,OAAO,iCAAiC,MAAM;EAC5C,UAAU,SAAS;EACnB,OAAO;EACP,MACE,SAAS,SAAS,0CAClB,SAAS,QAAQ;CACrB,CAAC;AACH"}
+{"version":3,"file":"service-control-capabilities-C5SxnBg2.js","names":[],"sources":["../src/commands/service-control-capabilities.ts"],"sourcesContent":["import { execFile } from \"node:child_process\";\nimport { realpath } from \"node:fs/promises\";\nimport { promisify } from \"node:util\";\nimport {\n  serviceControlCapabilitiesSchema,\n  serviceControlCarrierCapabilitySchema,\n} from \"@openmeld/schemas\";\nimport { readDaemonServiceContract } from \"../config/daemon-service-contract\";\nimport { sendLocalDaemonControlPlaneRequest } from \"../local-service/control-plane/client\";\nimport {\n  daemonServiceBinaryExecutablePath,\n  readDaemonActiveBundleState,\n} from \"../local-service/lifecycle/daemon-service-bundle\";\nimport { resolveDaemonServiceManager } from \"../local-service/lifecycle/daemon-service-manager\";\nimport { readCurrentDaemonRuntimeContext } from \"../local-service/lifecycle/daemon-service-runtime\";\n\n/** Read only: never invoke the repairing npm launcher or a lifecycle operation. */\nexport async function readServiceControlCapabilities() {\n  const unsupported = { deviceId: null, start: false, stop: false };\n  if (process.platform !== \"darwin\") {\n    return unsupported;\n  }\n  const contract = await readDaemonServiceContract();\n  const bundle = await readDaemonActiveBundleState();\n  if (\n    contract?.serviceController !== \"launchd\" ||\n    bundle?.bundleFormat !== \"binary_v1\"\n  ) {\n    return unsupported;\n  }\n  const manager = await resolveDaemonServiceManager(\"launchd\");\n  if (!(manager && (await manager.status()).installed)) {\n    return unsupported;\n  }\n  // Guarded Start refreshes the supervisor command to this canonical executable.\n  // Verify the executable that answered, so an old CLI delegating elsewhere\n  // cannot advertise another binary's capability as its own.\n  const executable = await realpath(daemonServiceBinaryExecutablePath());\n  const { stdout } = await promisify(execFile)(\n    executable,\n    [\"service\", \"control-carrier-capability\", \"--json\"],\n    { timeout: 5000, maxBuffer: 16_384 }\n  );\n  const carrier = serviceControlCarrierCapabilitySchema.safeParse(\n    JSON.parse(stdout)\n  );\n  if (\n    !carrier.success ||\n    (await realpath(carrier.data.executable)) !== executable\n  ) {\n    return unsupported;\n  }\n  const runtime = await readCurrentDaemonRuntimeContext();\n  if (runtime.effectiveRuntimeStatus === \"not_running\") {\n    return { deviceId: contract.deviceId, start: true, stop: false };\n  }\n  if (runtime.effectiveRuntimeStatus !== \"running\") {\n    return unsupported;\n  }\n  const response = await sendLocalDaemonControlPlaneRequest({\n    request: { v: 1, command: \"account_control_capabilities\" },\n  });\n  return serviceControlCapabilitiesSchema.parse({\n    deviceId: contract.deviceId,\n    start: false,\n    stop:\n      response.code === \"service.account_control_capabilities\" &&\n      response.payload.supported,\n  });\n}\n"],"mappings":";;;;;;;;;;AAiBA,eAAsB,iCAAiC;CACrD,MAAM,cAAc;EAAE,UAAU;EAAM,OAAO;EAAO,MAAM;CAAM;CAChE,IAAI,QAAQ,aAAa,UACvB,OAAO;CAET,MAAM,WAAW,MAAM,0BAA0B;CACjD,MAAM,SAAS,MAAM,4BAA4B;CACjD,IACE,UAAU,sBAAsB,aAChC,QAAQ,iBAAiB,aAEzB,OAAO;CAET,MAAM,UAAU,MAAM,4BAA4B,SAAS;CAC3D,IAAI,EAAE,YAAY,MAAM,QAAQ,OAAO,EAAA,CAAG,YACxC,OAAO;CAKT,MAAM,aAAa,MAAM,SAAS,kCAAkC,CAAC;CACrE,MAAM,EAAE,WAAW,MAAM,UAAU,QAAQ,CAAC,CAC1C,YACA;EAAC;EAAW;EAA8B;CAAQ,GAClD;EAAE,SAAS;EAAM,WAAW;CAAO,CACrC;CACA,MAAM,UAAU,sCAAsC,UACpD,KAAK,MAAM,MAAM,CACnB;CACA,IACE,CAAC,QAAQ,WACR,MAAM,SAAS,QAAQ,KAAK,UAAU,MAAO,YAE9C,OAAO;CAET,MAAM,UAAU,MAAM,gCAAgC;CACtD,IAAI,QAAQ,2BAA2B,eACrC,OAAO;EAAE,UAAU,SAAS;EAAU,OAAO;EAAM,MAAM;CAAM;CAEjE,IAAI,QAAQ,2BAA2B,WACrC,OAAO;CAET,MAAM,WAAW,MAAM,mCAAmC,EACxD,SAAS;EAAE,GAAG;EAAG,SAAS;CAA+B,EAC3D,CAAC;CACD,OAAO,iCAAiC,MAAM;EAC5C,UAAU,SAAS;EACnB,OAAO;EACP,MACE,SAAS,SAAS,0CAClB,SAAS,QAAQ;CACrB,CAAC;AACH"}

package/dist/{service-control-capabilities-CP1XCSVm.js → service-control-capabilities-ChRe8hkw.js}

@@ -1,4 +1,4 @@
 #!/usr/bin/env node
 
-import { t as readServiceControlCapabilities } from "./service-control-capabilities-COkZ1Ceh.js";
+import { t as readServiceControlCapabilities } from "./service-control-capabilities-C5SxnBg2.js";
 export { readServiceControlCapabilities };

package/dist/{upgrade-DJLqTfBA.js → upgrade-DAVEeo8B.js}

@@ -1,10 +1,12 @@
 #!/usr/bin/env node
 
-import { Oi as inspectDaemonServiceInventory, Vi as resolveCurrentDaemonExpectedVersion, a as resolveServiceUpdateUrgency, g as scheduleDaemonServiceUpdate, ia as resolveVersionChangeDirection, k as formatDaemonFailureContextText, m as readOpenMeldToolsUpdateContextFromEnv, na as resolveDaemonServiceAlignmentDecision, qi as resolveRuntimeContext, t as createOpenMeldToolsUpdateCoordinator, ta as buildDaemonServiceTargetSpec } from "./openmeld-tools-update-coordinator-qrZLtDMv.js";
+import { $t as resolveCurrentDaemonExpectedVersion, Kt as resolveVersionChangeDirection, Ra as resolveRuntimeContext, St as readOpenMeldToolsUpdateContextFromEnv, Ut as buildDaemonServiceTargetSpec, Wt as resolveDaemonServiceAlignmentDecision, Xi as resolveServiceUpdateUrgency, f as formatDaemonFailureContextText, jt as inspectDaemonServiceInventory, n as scheduleDaemonServiceUpdate, xt as createOpenMeldToolsUpdateCoordinator } from "./daemon-service-update-coordinator-DcjOzGu1.js";
 import { t as isBinaryDistribution } from "./distribution-DY2fBeSW.js";
-import { At as verifyCliBinaryCodeSignature, Ot as downloadCliBinaryUpdateArtifact, ct as buildNextVersionState, dt as fetchLatestCliBinaryRelease, ft as fetchLatestPackageInfo, ht as writeVersionState, kt as resolveCliBinaryUpdatePlan, mt as readVersionState, nt as OPENMELD_VERSION, xt as hasIndependentMaintenanceRegistration } from "./daemon-service-runtime-D8KrOfSV.js";
-import { Rt as buildAgentOverviewFromContract, Ut as resolveExternalOpenMeldToolsUpdate, Zt as outJsonLine, a as formatDaemonServiceDowngradeBlockedRecommendation, c as formatDaemonServiceMissingRecommendation, m as canUseInteractivePrompts, n as resolveElapsedTimeMs, pt as getCommandEntryContract, q as createUpgradeConfirmationGuideError, qt as createPresenter, t as formatElapsedTime } from "./elapsed-time-BE9NPM-x.js";
+import { At as resolveCliBinaryUpdatePlan, Ot as DEFAULT_CLI_BINARY_DOWNLOAD_POLICY, ct as buildNextVersionState, dt as fetchLatestCliBinaryRelease, ft as fetchLatestPackageInfo, ht as writeVersionState, jt as verifyCliBinaryCodeSignature, kt as downloadCliBinaryUpdateArtifact, mt as readVersionState, nt as OPENMELD_VERSION, xt as hasIndependentMaintenanceRegistration } from "./daemon-service-runtime-CWTlAhZY.js";
+import { Bt as buildAgentOverviewFromContract, Gt as createPresenter, Y as createUpgradeConfirmationGuideError, Yt as outJsonLine, a as formatDaemonServiceDowngradeBlockedRecommendation, c as formatDaemonServiceMissingRecommendation, g as canUseInteractivePrompts, ht as getCommandEntryContract, n as resolveElapsedTimeMs, t as formatElapsedTime } from "./elapsed-time-iFOSSUJo.js";
 import { c as formatOpenMeldCliTextBlock, i as formatInlineOpenMeldCliCommands } from "./openmeld-environment-target-NtJYJe1D.js";
+import { c as withOpenMeldToolsUpdateFailure, i as OpenMeldToolsUpdateFailureError, r as parseOpenMeldToolsUpdateFailureFrame } from "./openmeld-tools-update-process-frame-CbZPpc7D.js";
+import { t as resolveExternalOpenMeldToolsUpdate } from "./openmeld-tools-update-join-DS_EIL5q.js";
 import { tmpdir } from "node:os";
 import { basename, dirname, join } from "node:path";
 import { chmod, mkdtemp, realpath, rm, stat, writeFile } from "node:fs/promises";
@@ -164,7 +166,6 @@ function resolveTopLevelEntryName(command) {
 //#endregion
 //#region src/commands/upgrade.ts
 const OPENMELD_PACKAGE_NAME = "openmeld";
-const CLI_BINARY_DOWNLOAD_TIMEOUT_MS = 6e4;
 const BINARY_MANUAL_OPENMELD_UPGRADE_COMMAND = "curl -fsSL 'https://openmeld.ai/setup?dist=binary' | sh";
 const STAGING_BINARY_MANIFEST_URL = "https://staging.openmeld.ai/cli/manifest.json";
 const STAGING_BINARY_SETUP_COMMAND = "curl -fsSL 'https://staging.openmeld.ai/setup?lane=canary&dist=binary' | sh";
@@ -180,7 +181,14 @@ var UpgradeOutputHandledError = class extends Error {
 	}
 };
 function isUpgradeOutputHandledError(error) {
-	return error instanceof UpgradeOutputHandledError || typeof error === "object" && error !== null && "code" in error && error.code === "openmeld.upgrade.output_handled";
+	const seen = /* @__PURE__ */ new Set();
+	let current = error;
+	while (current && typeof current === "object" && !seen.has(current)) {
+		seen.add(current);
+		if (current instanceof UpgradeOutputHandledError || current.code === "openmeld.upgrade.output_handled") return true;
+		current = current.cause;
+	}
+	return false;
 }
 async function runUpgrade(input) {
 	await runUpgradeWithRuntime(input, await resolveRuntimeContext({ view: input.view }));
@@ -215,11 +223,9 @@ async function runUpgradeWithRuntime(input, runtime) {
 		}
 	}
 	if (input.internalAlignService) {
-		await runInternalUpgradeServiceAlignment({
+		await alignServiceWithCurrentCli({
 			presenter,
-			resolvedView: runtime.resolvedView,
-			daemonVersion: await resolveCurrentDaemonExpectedVersion(),
-			...process.argv[1] && !isBinaryDistribution() ? { cliScriptPath: process.argv[1] } : {}
+			resolvedView: runtime.resolvedView
 		});
 		return;
 	}
@@ -315,11 +321,15 @@ async function runUpgradeWithRuntime(input, runtime) {
 	});
 }
 async function alignServiceWithCurrentCli(input) {
-	await runInternalUpgradeServiceAlignment({
-		...input,
-		daemonVersion: await resolveCurrentDaemonExpectedVersion(),
-		...process.argv[1] && !isBinaryDistribution() ? { cliScriptPath: process.argv[1] } : {}
-	});
+	try {
+		await runInternalUpgradeServiceAlignment({
+			...input,
+			daemonVersion: await resolveCurrentDaemonExpectedVersion(),
+			...process.argv[1] && !isBinaryDistribution() ? { cliScriptPath: process.argv[1] } : {}
+		});
+	} catch (error) {
+		throw withOpenMeldToolsUpdateFailure(error, "cli.update.service_alignment_failed");
+	}
 }
 async function requestMaintainedUpgrade(input) {
 	const result = await createOpenMeldToolsUpdateCoordinator({}, { executeUpdates: false }).requestUpdate({ requestSource: "cli" });
@@ -448,6 +458,7 @@ async function installAndReconcileBinaryUpgrade(input) {
 			distribution: input.upgradeStatus.distribution,
 			preferredTransport: updatePlan.transport
 		},
+		failureCode: "cli.update.install_failed",
 		run: async () => await installLatestCliBinary({
 			release: binaryRelease,
 			manualUpgradeCommand: input.manualUpgradeCommand,
@@ -468,6 +479,7 @@ async function installAndReconcileBinaryUpgrade(input) {
 		code: "upgrade.service_alignment",
 		startedText: SERVICE_CHECK_STARTED_TEXT,
 		completedText: SERVICE_CHECK_COMPLETED_TEXT,
+		failureCode: "cli.update.service_alignment_failed",
 		run: async () => await handoffUpgradeServiceAlignmentToLatestBinary({
 			resolvedView: input.resolvedView,
 			command: binaryInstall.managedBinaryPath,
@@ -497,6 +509,7 @@ async function installAndReconcileNpmUpgrade(input) {
 			command: input.manualUpgradeCommand,
 			distribution: input.upgradeStatus.distribution
 		},
+		failureCode: "cli.update.install_failed",
 		run: async () => await installLatestPackage({
 			npmCommandSpec,
 			currentGlobalInstall: input.currentGlobalInstall,
@@ -517,6 +530,7 @@ async function installAndReconcileNpmUpgrade(input) {
 		code: "upgrade.service_alignment",
 		startedText: SERVICE_CHECK_STARTED_TEXT,
 		completedText: SERVICE_CHECK_COMPLETED_TEXT,
+		failureCode: "cli.update.service_alignment_failed",
 		run: async () => await handoffUpgradeServiceAlignmentToLatestBinary({
 			resolvedView: input.resolvedView,
 			command: process.execPath,
@@ -660,7 +674,7 @@ async function installLatestCliBinary(input) {
 	const tmpDir = await mkdtemp(join(tmpdir(), "openmeld-cli-upgrade-"));
 	try {
 		const artifactBytes = await downloadCliBinaryUpdateArtifact({
-			downloadTimeoutMs: CLI_BINARY_DOWNLOAD_TIMEOUT_MS,
+			downloadPolicy: DEFAULT_CLI_BINARY_DOWNLOAD_POLICY,
 			fetchImpl: fetch,
 			onDeltaFallback: (error) => {
 				process.stderr.write(`Small update could not be used; downloading the full update instead. (${error.message})\n`);
@@ -824,6 +838,11 @@ async function handoffUpgradeServiceAlignmentToLatestBinary(input) {
 		UPGRADE_INTERNAL_ALIGN_SERVICE_FLAG
 	], { OPENMELD_INTERNAL_SKIP_STARTUP_UPGRADE: "1" }, useInheritedOutput);
 	if (handoffResult.code !== 0) {
+		const processFailure = parseOpenMeldToolsUpdateFailureFrame(handoffResult.stdout);
+		if (processFailure) throw new OpenMeldToolsUpdateFailureError({
+			failureCode: processFailure.failureCode,
+			message: processFailure.detail
+		});
 		if (useInheritedOutput) throw new Error(formatUpgradeReconcileFailureMessage({
 			errorMessage: `latest CLI handoff exited with status ${String(handoffResult.code)}`,
 			backupDataPath: null,
@@ -1034,7 +1053,7 @@ async function runUpgradeStage(input) {
 		return result;
 	} catch (error) {
 		stage.fail(input.failedText ?? `${input.startedText} failed.`);
-		throw error;
+		throw input.failureCode ? withOpenMeldToolsUpdateFailure(error, input.failureCode) : error;
 	}
 }
 function emitUpgradeCompleted(input) {
@@ -1060,4 +1079,4 @@ function toErrorMessage(error) {
 //#endregion
 export { runUpgrade as a, OPENMELD_UPGRADE_FAILURE_HINTS as c, runMaintenanceUpgrade as i, OPENMELD_UPGRADE_METADATA_RECOVERY_HINTS as l, isUpgradeOutputHandledError as n, emitTopLevelAgentOverview as o, resolveBinaryManualOpenMeldUpgradeCommand as r, emitTopLevelCliAgentOverview as s, UPGRADE_INTERNAL_ALIGN_SERVICE_FLAG as t };
 
-//# sourceMappingURL=upgrade-DJLqTfBA.js.map
+//# sourceMappingURL=upgrade-DAVEeo8B.js.map