openmeld 0.3.212 → 0.3.213

package/dist/{service-account-authorization-Dq4LcAVa.js → service-account-authorization-AbowIr6n.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 
 import { ft as resolveOpenMeldRootDir, pt as resolveOpenMeldServiceOwnedPathInput, rt as openMeldRootDir } from "./lock-Dxp6o_t_.js";
-import { D as admitServiceAccountOperation, E as ServiceAccountAdmissionError, j as withAuthSessionTransitionMutationLock, w as withAdmittedServiceSession, y as readServiceAdmissionSessionWithOwnership } from "./auth-session-Dqz9X4F0.js";
+import { D as admitServiceAccountOperation, E as ServiceAccountAdmissionError, j as withAuthSessionTransitionMutationLock, w as withAdmittedServiceSession, y as readServiceAdmissionSessionWithOwnership } from "./auth-session-DgHvRt5i.js";
 import { r as readDaemonRuntimeLease } from "./daemon-runtime-lease-Dd4hdHNo.js";
-import { Vt as readDaemonServiceContract } from "./daemon-service-runtime-CWTlAhZY.js";
+import { Vt as readDaemonServiceContract } from "./daemon-service-runtime-CY6wdBe1.js";
 import { t as resolveOpenMeldEnvironmentTarget } from "./openmeld-environment-target-NtJYJe1D.js";
 import { resolve } from "node:path";
 //#region src/local-service/lifecycle/service-account-authorization.ts
@@ -53,4 +53,4 @@ async function admitServiceAccountStop(input) {
 //#endregion
 export { resolveServiceAccountIdentity as n, runServiceAccountCarrier as r, admitServiceAccountStop as t };
 
-//# sourceMappingURL=service-account-authorization-Dq4LcAVa.js.map
+//# sourceMappingURL=service-account-authorization-AbowIr6n.js.map

package/dist/{service-account-authorization-Dq4LcAVa.js.map → service-account-authorization-AbowIr6n.js.map}

@@ -1 +1 @@
-{"version":3,"file":"service-account-authorization-Dq4LcAVa.js","names":[],"sources":["../src/local-service/lifecycle/service-account-authorization.ts"],"sourcesContent":["import { resolve } from \"node:path\";\nimport type { ServiceAccountAdmissionIdentity } from \"@openmeld/schemas\";\nimport {\n  readServiceAdmissionSessionWithOwnership,\n  type StoredAuthSession,\n  withAdmittedServiceSession,\n} from \"../../config/auth-session\";\nimport { withAuthSessionTransitionMutationLock } from \"../../config/auth-session-transition-lock\";\nimport { readDaemonRuntimeLease } from \"../../config/daemon-runtime-lease\";\nimport { readDaemonServiceContract } from \"../../config/daemon-service-contract\";\nimport { resolveOpenMeldEnvironmentTarget } from \"../../config/openmeld-environment-target\";\nimport {\n  openMeldRootDir,\n  resolveOpenMeldRootDir,\n  resolveOpenMeldServiceOwnedPathInput,\n} from \"../../config/paths\";\nimport {\n  admitServiceAccountOperation,\n  ServiceAccountAdmissionError,\n} from \"../../config/service-account-admission\";\n\ntype Contract = NonNullable<\n  Awaited<ReturnType<typeof readDaemonServiceContract>>\n>;\nfunction refused(reason: string, message: string): never {\n  throw new ServiceAccountAdmissionError(reason, message);\n}\n\nexport async function resolveServiceAccountIdentity(\n  session: StoredAuthSession,\n  contract: Contract\n): Promise<ServiceAccountAdmissionIdentity> {\n  const target = await resolveOpenMeldEnvironmentTarget();\n  if (\n    resolve(openMeldRootDir()) !==\n      resolve(resolveOpenMeldRootDir(resolveOpenMeldServiceOwnedPathInput())) ||\n    contract.lane !== target.preset ||\n    contract.gatewayUrl !== target.gatewayUrl ||\n    session.authBaseUrl !== target.authBaseUrl ||\n    !contract.ownerUserId ||\n    contract.ownerUserId !== session.user?.id ||\n    !contract.connectedComputerId\n  ) {\n    refused(\n      \"ownership_mismatch\",\n      \"This Service does not match the signed-in account or environment. Reconnect it through OpenMeld setup before trying again.\"\n    );\n  }\n  return {\n    accountId: contract.ownerUserId,\n    authBaseUrl: session.authBaseUrl,\n    clientId: session.clientId,\n    gatewayUrl: target.gatewayUrl,\n    lane: target.preset,\n    deviceId: contract.deviceId,\n    contractGeneration: contract.generation,\n  };\n}\n\nexport async function runServiceAccountCarrier<T>(\n  id: string,\n  run: () => Promise<T>\n): Promise<T> {\n  const session = await withAuthSessionTransitionMutationLock(async () => {\n    const local = await readServiceAdmissionSessionWithOwnership();\n    const contract = await readDaemonServiceContract();\n    if (!contract || contract.desiredState !== \"background\") {\n      refused(\n        \"cancelled\",\n        \"This Service startup is no longer authorized. Start the Service again from the matching account.\"\n      );\n    }\n    await admitServiceAccountOperation({\n      id,\n      operation: \"start\",\n      identity: await resolveServiceAccountIdentity(local, contract),\n    });\n    return local;\n  });\n  return await withAdmittedServiceSession(session, run);\n}\n\nexport async function admitServiceAccountStop(input: {\n  id: string;\n  ownerUserId: string;\n  deviceId: string;\n  contractGeneration: number;\n  commit: () => void;\n}): Promise<void> {\n  await withAuthSessionTransitionMutationLock(async () => {\n    const session = await readServiceAdmissionSessionWithOwnership();\n    const contract = await readDaemonServiceContract();\n    const lease = await readDaemonRuntimeLease();\n    if (\n      !(contract && lease) ||\n      lease.pid !== process.pid ||\n      contract.generation !== input.contractGeneration ||\n      contract.ownerUserId !== input.ownerUserId ||\n      contract.deviceId !== input.deviceId\n    ) {\n      refused(\n        \"ownership_changed\",\n        \"The running Service changed before this Stop was accepted. Check its status and try again.\"\n      );\n    }\n    await admitServiceAccountOperation({\n      id: input.id,\n      operation: \"stop\",\n      identity: await resolveServiceAccountIdentity(session, contract),\n      commit: input.commit,\n    });\n  });\n}\n"],"mappings":";;;;;;;;;AAwBA,SAAS,QAAQ,QAAgB,SAAwB;CACvD,MAAM,IAAI,6BAA6B,QAAQ,OAAO;AACxD;AAEA,eAAsB,8BACpB,SACA,UAC0C;CAC1C,MAAM,SAAS,MAAM,iCAAiC;CACtD,IACE,QAAQ,gBAAgB,CAAC,MACvB,QAAQ,uBAAuB,qCAAqC,CAAC,CAAC,KACxE,SAAS,SAAS,OAAO,UACzB,SAAS,eAAe,OAAO,cAC/B,QAAQ,gBAAgB,OAAO,eAC/B,CAAC,SAAS,eACV,SAAS,gBAAgB,QAAQ,MAAM,MACvC,CAAC,SAAS,qBAEV,QACE,sBACA,4HACF;CAEF,OAAO;EACL,WAAW,SAAS;EACpB,aAAa,QAAQ;EACrB,UAAU,QAAQ;EAClB,YAAY,OAAO;EACnB,MAAM,OAAO;EACb,UAAU,SAAS;EACnB,oBAAoB,SAAS;CAC/B;AACF;AAEA,eAAsB,yBACpB,IACA,KACY;CAiBZ,OAAO,MAAM,2BAA2B,MAhBlB,sCAAsC,YAAY;EACtE,MAAM,QAAQ,MAAM,yCAAyC;EAC7D,MAAM,WAAW,MAAM,0BAA0B;EACjD,IAAI,CAAC,YAAY,SAAS,iBAAiB,cACzC,QACE,aACA,kGACF;EAEF,MAAM,6BAA6B;GACjC;GACA,WAAW;GACX,UAAU,MAAM,8BAA8B,OAAO,QAAQ;EAC/D,CAAC;EACD,OAAO;CACT,CAAC,GACgD,GAAG;AACtD;AAEA,eAAsB,wBAAwB,OAM5B;CAChB,MAAM,sCAAsC,YAAY;EACtD,MAAM,UAAU,MAAM,yCAAyC;EAC/D,MAAM,WAAW,MAAM,0BAA0B;EACjD,MAAM,QAAQ,MAAM,uBAAuB;EAC3C,IACE,EAAE,YAAY,UACd,MAAM,QAAQ,QAAQ,OACtB,SAAS,eAAe,MAAM,sBAC9B,SAAS,gBAAgB,MAAM,eAC/B,SAAS,aAAa,MAAM,UAE5B,QACE,qBACA,4FACF;EAEF,MAAM,6BAA6B;GACjC,IAAI,MAAM;GACV,WAAW;GACX,UAAU,MAAM,8BAA8B,SAAS,QAAQ;GAC/D,QAAQ,MAAM;EAChB,CAAC;CACH,CAAC;AACH"}
+{"version":3,"file":"service-account-authorization-AbowIr6n.js","names":[],"sources":["../src/local-service/lifecycle/service-account-authorization.ts"],"sourcesContent":["import { resolve } from \"node:path\";\nimport type { ServiceAccountAdmissionIdentity } from \"@openmeld/schemas\";\nimport {\n  readServiceAdmissionSessionWithOwnership,\n  type StoredAuthSession,\n  withAdmittedServiceSession,\n} from \"../../config/auth-session\";\nimport { withAuthSessionTransitionMutationLock } from \"../../config/auth-session-transition-lock\";\nimport { readDaemonRuntimeLease } from \"../../config/daemon-runtime-lease\";\nimport { readDaemonServiceContract } from \"../../config/daemon-service-contract\";\nimport { resolveOpenMeldEnvironmentTarget } from \"../../config/openmeld-environment-target\";\nimport {\n  openMeldRootDir,\n  resolveOpenMeldRootDir,\n  resolveOpenMeldServiceOwnedPathInput,\n} from \"../../config/paths\";\nimport {\n  admitServiceAccountOperation,\n  ServiceAccountAdmissionError,\n} from \"../../config/service-account-admission\";\n\ntype Contract = NonNullable<\n  Awaited<ReturnType<typeof readDaemonServiceContract>>\n>;\nfunction refused(reason: string, message: string): never {\n  throw new ServiceAccountAdmissionError(reason, message);\n}\n\nexport async function resolveServiceAccountIdentity(\n  session: StoredAuthSession,\n  contract: Contract\n): Promise<ServiceAccountAdmissionIdentity> {\n  const target = await resolveOpenMeldEnvironmentTarget();\n  if (\n    resolve(openMeldRootDir()) !==\n      resolve(resolveOpenMeldRootDir(resolveOpenMeldServiceOwnedPathInput())) ||\n    contract.lane !== target.preset ||\n    contract.gatewayUrl !== target.gatewayUrl ||\n    session.authBaseUrl !== target.authBaseUrl ||\n    !contract.ownerUserId ||\n    contract.ownerUserId !== session.user?.id ||\n    !contract.connectedComputerId\n  ) {\n    refused(\n      \"ownership_mismatch\",\n      \"This Service does not match the signed-in account or environment. Reconnect it through OpenMeld setup before trying again.\"\n    );\n  }\n  return {\n    accountId: contract.ownerUserId,\n    authBaseUrl: session.authBaseUrl,\n    clientId: session.clientId,\n    gatewayUrl: target.gatewayUrl,\n    lane: target.preset,\n    deviceId: contract.deviceId,\n    contractGeneration: contract.generation,\n  };\n}\n\nexport async function runServiceAccountCarrier<T>(\n  id: string,\n  run: () => Promise<T>\n): Promise<T> {\n  const session = await withAuthSessionTransitionMutationLock(async () => {\n    const local = await readServiceAdmissionSessionWithOwnership();\n    const contract = await readDaemonServiceContract();\n    if (!contract || contract.desiredState !== \"background\") {\n      refused(\n        \"cancelled\",\n        \"This Service startup is no longer authorized. Start the Service again from the matching account.\"\n      );\n    }\n    await admitServiceAccountOperation({\n      id,\n      operation: \"start\",\n      identity: await resolveServiceAccountIdentity(local, contract),\n    });\n    return local;\n  });\n  return await withAdmittedServiceSession(session, run);\n}\n\nexport async function admitServiceAccountStop(input: {\n  id: string;\n  ownerUserId: string;\n  deviceId: string;\n  contractGeneration: number;\n  commit: () => void;\n}): Promise<void> {\n  await withAuthSessionTransitionMutationLock(async () => {\n    const session = await readServiceAdmissionSessionWithOwnership();\n    const contract = await readDaemonServiceContract();\n    const lease = await readDaemonRuntimeLease();\n    if (\n      !(contract && lease) ||\n      lease.pid !== process.pid ||\n      contract.generation !== input.contractGeneration ||\n      contract.ownerUserId !== input.ownerUserId ||\n      contract.deviceId !== input.deviceId\n    ) {\n      refused(\n        \"ownership_changed\",\n        \"The running Service changed before this Stop was accepted. Check its status and try again.\"\n      );\n    }\n    await admitServiceAccountOperation({\n      id: input.id,\n      operation: \"stop\",\n      identity: await resolveServiceAccountIdentity(session, contract),\n      commit: input.commit,\n    });\n  });\n}\n"],"mappings":";;;;;;;;;AAwBA,SAAS,QAAQ,QAAgB,SAAwB;CACvD,MAAM,IAAI,6BAA6B,QAAQ,OAAO;AACxD;AAEA,eAAsB,8BACpB,SACA,UAC0C;CAC1C,MAAM,SAAS,MAAM,iCAAiC;CACtD,IACE,QAAQ,gBAAgB,CAAC,MACvB,QAAQ,uBAAuB,qCAAqC,CAAC,CAAC,KACxE,SAAS,SAAS,OAAO,UACzB,SAAS,eAAe,OAAO,cAC/B,QAAQ,gBAAgB,OAAO,eAC/B,CAAC,SAAS,eACV,SAAS,gBAAgB,QAAQ,MAAM,MACvC,CAAC,SAAS,qBAEV,QACE,sBACA,4HACF;CAEF,OAAO;EACL,WAAW,SAAS;EACpB,aAAa,QAAQ;EACrB,UAAU,QAAQ;EAClB,YAAY,OAAO;EACnB,MAAM,OAAO;EACb,UAAU,SAAS;EACnB,oBAAoB,SAAS;CAC/B;AACF;AAEA,eAAsB,yBACpB,IACA,KACY;CAiBZ,OAAO,MAAM,2BAA2B,MAhBlB,sCAAsC,YAAY;EACtE,MAAM,QAAQ,MAAM,yCAAyC;EAC7D,MAAM,WAAW,MAAM,0BAA0B;EACjD,IAAI,CAAC,YAAY,SAAS,iBAAiB,cACzC,QACE,aACA,kGACF;EAEF,MAAM,6BAA6B;GACjC;GACA,WAAW;GACX,UAAU,MAAM,8BAA8B,OAAO,QAAQ;EAC/D,CAAC;EACD,OAAO;CACT,CAAC,GACgD,GAAG;AACtD;AAEA,eAAsB,wBAAwB,OAM5B;CAChB,MAAM,sCAAsC,YAAY;EACtD,MAAM,UAAU,MAAM,yCAAyC;EAC/D,MAAM,WAAW,MAAM,0BAA0B;EACjD,MAAM,QAAQ,MAAM,uBAAuB;EAC3C,IACE,EAAE,YAAY,UACd,MAAM,QAAQ,QAAQ,OACtB,SAAS,eAAe,MAAM,sBAC9B,SAAS,gBAAgB,MAAM,eAC/B,SAAS,aAAa,MAAM,UAE5B,QACE,qBACA,4FACF;EAEF,MAAM,6BAA6B;GACjC,IAAI,MAAM;GACV,WAAW;GACX,UAAU,MAAM,8BAA8B,SAAS,QAAQ;GAC/D,QAAQ,MAAM;EAChB,CAAC;CACH,CAAC;AACH"}

package/dist/{service-account-control-BTR_X7QM.js → service-account-control-BV_tBiio.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 
 import { w as readProcessStartIdentity } from "./lock-Dxp6o_t_.js";
-import { Ra as resolveRuntimeContext, _a as buildDaemonSystemServiceCommandSpec } from "./daemon-service-update-coordinator-DcjOzGu1.js";
-import { A as reserveServiceAccountAdmission, E as ServiceAccountAdmissionError, O as cancelServiceAccountAdmission, d as getAuthSessionState, j as withAuthSessionTransitionMutationLock, k as readServiceAccountAdmission, o as buildStoredAuthSessionIdentity, w as withAdmittedServiceSession, y as readServiceAdmissionSessionWithOwnership } from "./auth-session-Dqz9X4F0.js";
-import { T as createQuietPresenter, d as runDaemonServiceDetached, m as runDaemonStop, or as fetchAuthUserSnapshot } from "./service-CTG3_X0o.js";
+import { va as buildDaemonSystemServiceCommandSpec, za as resolveRuntimeContext } from "./daemon-service-update-coordinator-BcbbIDzC.js";
+import { A as reserveServiceAccountAdmission, E as ServiceAccountAdmissionError, O as cancelServiceAccountAdmission, d as getAuthSessionState, j as withAuthSessionTransitionMutationLock, k as readServiceAccountAdmission, o as buildStoredAuthSessionIdentity, w as withAdmittedServiceSession, y as readServiceAdmissionSessionWithOwnership } from "./auth-session-DgHvRt5i.js";
+import { T as createQuietPresenter, d as runDaemonServiceDetached, m as runDaemonStop, or as fetchAuthUserSnapshot } from "./service-Cev-7yAJ.js";
 import { a as serviceAccountControlRequestSchema } from "./distribution-DY2fBeSW.js";
 import { r as readDaemonRuntimeLease } from "./daemon-runtime-lease-Dd4hdHNo.js";
-import { Ft as requestLocalDaemonShutdown, Ht as upsertDaemonServiceContract, Mt as LocalDaemonControlPlaneClientError, Vt as readDaemonServiceContract, r as readCurrentDaemonRuntimeContext } from "./daemon-service-runtime-CWTlAhZY.js";
+import { Ft as requestLocalDaemonShutdown, Ht as upsertDaemonServiceContract, Mt as LocalDaemonControlPlaneClientError, Vt as readDaemonServiceContract, r as readCurrentDaemonRuntimeContext } from "./daemon-service-runtime-CY6wdBe1.js";
 import { K as withDaemonServiceRunLock } from "./daemon-state-C37ZtIZK.js";
 import { S as resolveDaemonServiceManager } from "./daemon-service-manager-GiMCiTmu.js";
-import { n as resolveServiceAccountIdentity } from "./service-account-authorization-Dq4LcAVa.js";
+import { n as resolveServiceAccountIdentity } from "./service-account-authorization-AbowIr6n.js";
 import { setTimeout } from "node:timers/promises";
 //#region src/commands/service-account-control.ts
 function refused(reason, message) {
@@ -142,4 +142,4 @@ async function requestAccountCheckedServiceStop({ id, manager }) {
 //#endregion
 export { runServiceAccountControl as t };
 
-//# sourceMappingURL=service-account-control-BTR_X7QM.js.map
+//# sourceMappingURL=service-account-control-BV_tBiio.js.map

package/dist/{service-account-control-BTR_X7QM.js.map → service-account-control-BV_tBiio.js.map}

@@ -1 +1 @@
-{"version":3,"file":"service-account-control-BTR_X7QM.js","names":["delay"],"sources":["../src/commands/service-account-control.ts"],"sourcesContent":["import { setTimeout as delay } from \"node:timers/promises\";\nimport {\n  SERVICE_ACCOUNT_STOP_REFUSED_CODE,\n  type ServiceAccountControlRequest,\n  serviceAccountControlRequestSchema,\n} from \"@openmeld/schemas\";\nimport {\n  buildStoredAuthSessionIdentity,\n  getAuthSessionState,\n  readServiceAdmissionSessionWithOwnership,\n  type StoredAuthSession,\n  withAdmittedServiceSession,\n} from \"../config/auth-session\";\nimport { withAuthSessionTransitionMutationLock } from \"../config/auth-session-transition-lock\";\nimport { readDaemonRuntimeLease } from \"../config/daemon-runtime-lease\";\nimport {\n  readDaemonServiceContract,\n  upsertDaemonServiceContract,\n} from \"../config/daemon-service-contract\";\nimport { withDaemonServiceRunLock } from \"../config/daemon-state\";\nimport {\n  cancelServiceAccountAdmission,\n  readServiceAccountAdmission,\n  reserveServiceAccountAdmission,\n  ServiceAccountAdmissionError,\n} from \"../config/service-account-admission\";\nimport {\n  LocalDaemonControlPlaneClientError,\n  requestLocalDaemonShutdown,\n} from \"../local-service/control-plane/client\";\nimport { CONTROLLED_SHUTDOWN_REQUEST_TIMEOUT_MS } from \"../local-service/core/constants\";\nimport { buildDaemonSystemServiceCommandSpec } from \"../local-service/lifecycle/daemon-service-command-spec\";\nimport {\n  type DaemonServiceManager,\n  resolveDaemonServiceManager,\n} from \"../local-service/lifecycle/daemon-service-manager\";\nimport { readCurrentDaemonRuntimeContext } from \"../local-service/lifecycle/daemon-service-runtime\";\nimport { resolveServiceAccountIdentity } from \"../local-service/lifecycle/service-account-authorization\";\nimport { resolveRuntimeContext } from \"../runtime/context\";\nimport { readProcessStartIdentity } from \"../system/process-identity\";\nimport { fetchAuthUserSnapshot } from \"./auth-device-session-client\";\nimport { runDaemonServiceDetached, runDaemonStop } from \"./service\";\nimport { createQuietPresenter } from \"./service-output\";\n\ntype Contract = NonNullable<\n  Awaited<ReturnType<typeof readDaemonServiceContract>>\n>;\n\nfunction refused(reason: string, message: string): never {\n  throw new ServiceAccountAdmissionError(reason, message);\n}\n\nexport async function runServiceAccountControl(\n  request: ServiceAccountControlRequest,\n  expectedSessionIdentity?: string\n): Promise<void> {\n  const parsed = serviceAccountControlRequestSchema.safeParse(request);\n  if (!parsed.success) {\n    refused(\n      \"missing_account\",\n      \"Choose a signed-in account before controlling this Service.\"\n    );\n  }\n  const input = parsed.data;\n  if (process.platform === \"win32\") {\n    refused(\n      \"unsupported_platform\",\n      \"Account-checked Service control is not available on Windows yet.\"\n    );\n  }\n  const auth = await getAuthSessionState();\n  if (auth.state !== \"valid\" || !auth.session) {\n    refused(\n      \"authentication_required\",\n      \"Sign in to the CLI with the matching account and try again.\"\n    );\n  }\n  const preparedSession = auth.session;\n  if (preparedSession.user?.id !== input.expectedAccount) {\n    refused(\n      \"account_mismatch\",\n      \"The CLI is signed in to a different account. Sign in with the matching account and try again.\"\n    );\n  }\n  // The shared Auth endpoint proves the principal. Local metadata alone does not.\n  const user = await fetchAuthUserSnapshot({\n    authBaseUrl: preparedSession.authBaseUrl,\n    accessToken: preparedSession.accessToken,\n  });\n  if (user.id !== input.expectedAccount) {\n    refused(\n      \"account_mismatch\",\n      \"The CLI session belongs to a different account. Sign in again and retry.\"\n    );\n  }\n\n  await withDaemonServiceRunLock(async () => {\n    const contract = await readDaemonServiceContract();\n    if (!contract) {\n      refused(\n        \"ownership_unknown\",\n        \"Connect this computer through OpenMeld setup before controlling its Service.\"\n      );\n    }\n    const observed = await readCurrentDaemonRuntimeContext();\n    const lease = await readDaemonRuntimeLease();\n    if (\n      input.operation === \"start\" &&\n      observed.effectiveRuntimeStatus !== \"not_running\"\n    ) {\n      refused(\n        \"busy\",\n        \"The Service is already running or its state is uncertain. Check Service status before trying again.\"\n      );\n    }\n    if (\n      input.operation === \"stop\" &&\n      (observed.effectiveRuntimeStatus !== \"running\" ||\n        !lease ||\n        lease.generation !== contract.generation)\n    ) {\n      refused(\n        \"ownership_unknown\",\n        \"OpenMeld could not verify the running Service. Check Service status before trying again.\"\n      );\n    }\n\n    let boundSession: StoredAuthSession = preparedSession;\n    const reservation = await withAuthSessionTransitionMutationLock(\n      async () => {\n        boundSession = await readServiceAdmissionSessionWithOwnership();\n        if (\n          (expectedSessionIdentity !== undefined &&\n            buildStoredAuthSessionIdentity(boundSession) !==\n              expectedSessionIdentity) ||\n          boundSession.accessToken !== preparedSession.accessToken ||\n          boundSession.createdAt !== preparedSession.createdAt ||\n          boundSession.user?.id !== input.expectedAccount\n        ) {\n          refused(\n            \"account_changed\",\n            \"The CLI sign-in changed before this action was accepted. Check the account and try again.\"\n          );\n        }\n        const current = await readDaemonServiceContract();\n        if (!current || JSON.stringify(current) !== JSON.stringify(contract)) {\n          refused(\n            \"ownership_changed\",\n            \"The Service changed before this action was accepted. Check its status and try again.\"\n          );\n        }\n        const identity = await resolveServiceAccountIdentity(\n          boundSession,\n          contract\n        );\n        if (\n          input.operation === \"start\" &&\n          contract.desiredState !== \"background\"\n        ) {\n          identity.contractGeneration += 1;\n        }\n        return await reserveServiceAccountAdmission({\n          operation: input.operation,\n          identity,\n          ...(input.operation === \"stop\" && lease\n            ? {\n                target: {\n                  ownerPid: lease.pid,\n                  ownerProcessStartedAt:\n                    readProcessStartIdentity(lease.pid) ??\n                    refused(\n                      \"ownership_unknown\",\n                      \"OpenMeld could not identify the Service process. Check its status and try again.\"\n                    ),\n                },\n              }\n            : {}),\n        });\n      }\n    );\n\n    try {\n      await withAdmittedServiceSession(boundSession, async () => {\n        if (input.operation === \"stop\") {\n          await stopReservedService(contract, reservation.id, lease?.pid ?? 0);\n          return;\n        }\n        const manager =\n          contract.serviceController === \"legacy-detached\"\n            ? null\n            : await resolveDaemonServiceManager(contract.serviceController);\n        if (\n          contract.serviceController !== \"legacy-detached\" &&\n          !(manager && (await manager.status()).installed)\n        ) {\n          refused(\n            \"installation_required\",\n            \"This Service needs setup before it can start. Run OpenMeld setup and try again.\"\n          );\n        }\n        await upsertDaemonServiceContract({\n          ...contract,\n          desiredState: \"background\",\n        });\n        if (contract.serviceController === \"legacy-detached\") {\n          const runtime = await resolveRuntimeContext({ view: \"agent\" });\n          await runDaemonServiceDetached({\n            accountAdmissionId: reservation.id,\n            deviceId: contract.deviceId,\n            gatewayUrl: contract.gatewayUrl,\n            heartbeatMs: contract.heartbeatMs,\n            runtime,\n            presenter: createQuietPresenter(runtime),\n            mode: \"background\",\n          });\n        } else if (manager) {\n          // Refresh the existing stopped supervisor definition with an immutable\n          // generation argument. Never install a missing Service.\n          await manager.deactivate();\n          await manager.install(\n            buildDaemonSystemServiceCommandSpec({\n              controller: manager.controller,\n              accountAdmissionId: reservation.id,\n            })\n          );\n          await manager.start();\n        }\n        await waitForAdmittedService(reservation.id);\n      });\n    } finally {\n      await cancelServiceAccountAdmission(reservation.id);\n    }\n  });\n}\n\nasync function waitForAdmittedService(id: string): Promise<void> {\n  const deadline = Date.now() + 15_000;\n  while (Date.now() < deadline) {\n    const current = await readServiceAccountAdmission();\n    const runtime = await readCurrentDaemonRuntimeContext();\n    if (\n      current?.id === id &&\n      current.state === \"admitted\" &&\n      current.carrier?.ownerPid === runtime.runtimeStatus.pid &&\n      runtime.effectiveRuntimeStatus === \"running\"\n    ) {\n      return;\n    }\n    await delay(50);\n  }\n  refused(\n    \"startup_unconfirmed\",\n    \"OpenMeld could not confirm that this Service started. Check Service status before trying again.\"\n  );\n}\n\nasync function stopReservedService(\n  contract: Contract,\n  id: string,\n  pid: number\n): Promise<void> {\n  const manager =\n    contract.serviceController === \"legacy-detached\"\n      ? null\n      : await resolveDaemonServiceManager(contract.serviceController);\n  await requestAccountCheckedServiceStop({ id, manager });\n  const admitted = await readServiceAccountAdmission();\n  if (\n    admitted?.id !== id ||\n    admitted.state !== \"admitted\" ||\n    admitted.carrier?.ownerPid !== pid\n  ) {\n    refused(\n      \"admission_unconfirmed\",\n      \"OpenMeld could not verify that the matching Service accepted Stop. Check Service status before trying again.\"\n    );\n  }\n  const current = await readCurrentDaemonRuntimeContext();\n  if (current.runtimeStatus.pid !== null && current.runtimeStatus.pid !== pid) {\n    refused(\n      \"ownership_changed\",\n      \"Another Service instance is now running. Its state was left unchanged.\"\n    );\n  }\n  await runDaemonStop(\n    { json: true, view: \"agent\" },\n    {\n      completedControlledShutdownOwnerPid: pid,\n    }\n  );\n}\n\nexport async function requestAccountCheckedServiceStop({\n  id,\n  manager,\n}: {\n  id: string;\n  manager: Pick<\n    DaemonServiceManager,\n    \"status\" | \"disableAutostart\" | \"enableAutostart\"\n  > | null;\n}): Promise<void> {\n  const wasEnabled = manager ? (await manager.status()).enabled : false;\n  if (manager) {\n    await manager.disableAutostart();\n  }\n  // No compatibility fallback: only the verified carrier may admit this stop.\n  try {\n    const shutdown = await requestLocalDaemonShutdown({\n      payload: {\n        accountAdmissionId: id,\n        mode: \"graceful\",\n        gracePeriodMs: 2000,\n      },\n      timeoutMs: CONTROLLED_SHUTDOWN_REQUEST_TIMEOUT_MS,\n    });\n    if (!shutdown.accepted) {\n      throw new Error(\"The Service did not confirm controlled shutdown.\");\n    }\n  } catch (error) {\n    if (\n      manager &&\n      wasEnabled &&\n      error instanceof LocalDaemonControlPlaneClientError &&\n      error.code === SERVICE_ACCOUNT_STOP_REFUSED_CODE\n    ) {\n      try {\n        await manager.enableAutostart();\n      } catch (restoreError) {\n        throw new AggregateError(\n          [error, restoreError],\n          \"Stop was refused and its previous autostart setting could not be restored.\"\n        );\n      }\n    }\n    if (\n      !(\n        error instanceof LocalDaemonControlPlaneClientError &&\n        error.code === SERVICE_ACCOUNT_STOP_REFUSED_CODE\n      )\n    ) {\n      const detail = error instanceof Error ? error.message : String(error);\n      refused(\n        \"stop_unconfirmed\",\n        `Stop may already be in progress. ${manager ? \"Autostart remains disabled. \" : \"\"}Check Service status before trying again. ${detail}`\n      );\n    }\n    throw error;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;AAgDA,SAAS,QAAQ,QAAgB,SAAwB;CACvD,MAAM,IAAI,6BAA6B,QAAQ,OAAO;AACxD;AAEA,eAAsB,yBACpB,SACA,yBACe;CACf,MAAM,SAAS,mCAAmC,UAAU,OAAO;CACnE,IAAI,CAAC,OAAO,SACV,QACE,mBACA,6DACF;CAEF,MAAM,QAAQ,OAAO;CACrB,IAAI,QAAQ,aAAa,SACvB,QACE,wBACA,kEACF;CAEF,MAAM,OAAO,MAAM,oBAAoB;CACvC,IAAI,KAAK,UAAU,WAAW,CAAC,KAAK,SAClC,QACE,2BACA,6DACF;CAEF,MAAM,kBAAkB,KAAK;CAC7B,IAAI,gBAAgB,MAAM,OAAO,MAAM,iBACrC,QACE,oBACA,+FACF;CAOF,KAAI,MAJe,sBAAsB;EACvC,aAAa,gBAAgB;EAC7B,aAAa,gBAAgB;CAC/B,CAAC,EAAA,CACQ,OAAO,MAAM,iBACpB,QACE,oBACA,0EACF;CAGF,MAAM,yBAAyB,YAAY;EACzC,MAAM,WAAW,MAAM,0BAA0B;EACjD,IAAI,CAAC,UACH,QACE,qBACA,8EACF;EAEF,MAAM,WAAW,MAAM,gCAAgC;EACvD,MAAM,QAAQ,MAAM,uBAAuB;EAC3C,IACE,MAAM,cAAc,WACpB,SAAS,2BAA2B,eAEpC,QACE,QACA,qGACF;EAEF,IACE,MAAM,cAAc,WACnB,SAAS,2BAA2B,aACnC,CAAC,SACD,MAAM,eAAe,SAAS,aAEhC,QACE,qBACA,0FACF;EAGF,IAAI,eAAkC;EACtC,MAAM,cAAc,MAAM,sCACxB,YAAY;GACV,eAAe,MAAM,yCAAyC;GAC9D,IACG,4BAA4B,KAAA,KAC3B,+BAA+B,YAAY,MACzC,2BACJ,aAAa,gBAAgB,gBAAgB,eAC7C,aAAa,cAAc,gBAAgB,aAC3C,aAAa,MAAM,OAAO,MAAM,iBAEhC,QACE,mBACA,2FACF;GAEF,MAAM,UAAU,MAAM,0BAA0B;GAChD,IAAI,CAAC,WAAW,KAAK,UAAU,OAAO,MAAM,KAAK,UAAU,QAAQ,GACjE,QACE,qBACA,sFACF;GAEF,MAAM,WAAW,MAAM,8BACrB,cACA,QACF;GACA,IACE,MAAM,cAAc,WACpB,SAAS,iBAAiB,cAE1B,SAAS,sBAAsB;GAEjC,OAAO,MAAM,+BAA+B;IAC1C,WAAW,MAAM;IACjB;IACA,GAAI,MAAM,cAAc,UAAU,QAC9B,EACE,QAAQ;KACN,UAAU,MAAM;KAChB,uBACE,yBAAyB,MAAM,GAAG,KAClC,QACE,qBACA,kFACF;IACJ,EACF,IACA,CAAC;GACP,CAAC;EACH,CACF;EAEA,IAAI;GACF,MAAM,2BAA2B,cAAc,YAAY;IACzD,IAAI,MAAM,cAAc,QAAQ;KAC9B,MAAM,oBAAoB,UAAU,YAAY,IAAI,OAAO,OAAO,CAAC;KACnE;IACF;IACA,MAAM,UACJ,SAAS,sBAAsB,oBAC3B,OACA,MAAM,4BAA4B,SAAS,iBAAiB;IAClE,IACE,SAAS,sBAAsB,qBAC/B,EAAE,YAAY,MAAM,QAAQ,OAAO,EAAA,CAAG,YAEtC,QACE,yBACA,iFACF;IAEF,MAAM,4BAA4B;KAChC,GAAG;KACH,cAAc;IAChB,CAAC;IACD,IAAI,SAAS,sBAAsB,mBAAmB;KACpD,MAAM,UAAU,MAAM,sBAAsB,EAAE,MAAM,QAAQ,CAAC;KAC7D,MAAM,yBAAyB;MAC7B,oBAAoB,YAAY;MAChC,UAAU,SAAS;MACnB,YAAY,SAAS;MACrB,aAAa,SAAS;MACtB;MACA,WAAW,qBAAqB,OAAO;MACvC,MAAM;KACR,CAAC;IACH,OAAO,IAAI,SAAS;KAGlB,MAAM,QAAQ,WAAW;KACzB,MAAM,QAAQ,QACZ,oCAAoC;MAClC,YAAY,QAAQ;MACpB,oBAAoB,YAAY;KAClC,CAAC,CACH;KACA,MAAM,QAAQ,MAAM;IACtB;IACA,MAAM,uBAAuB,YAAY,EAAE;GAC7C,CAAC;EACH,UAAU;GACR,MAAM,8BAA8B,YAAY,EAAE;EACpD;CACF,CAAC;AACH;AAEA,eAAe,uBAAuB,IAA2B;CAC/D,MAAM,WAAW,KAAK,IAAI,IAAI;CAC9B,OAAO,KAAK,IAAI,IAAI,UAAU;EAC5B,MAAM,UAAU,MAAM,4BAA4B;EAClD,MAAM,UAAU,MAAM,gCAAgC;EACtD,IACE,SAAS,OAAO,MAChB,QAAQ,UAAU,cAClB,QAAQ,SAAS,aAAa,QAAQ,cAAc,OACpD,QAAQ,2BAA2B,WAEnC;EAEF,MAAMA,WAAM,EAAE;CAChB;CACA,QACE,uBACA,iGACF;AACF;AAEA,eAAe,oBACb,UACA,IACA,KACe;CAKf,MAAM,iCAAiC;EAAE;EAAI,SAH3C,SAAS,sBAAsB,oBAC3B,OACA,MAAM,4BAA4B,SAAS,iBAAiB;CACb,CAAC;CACtD,MAAM,WAAW,MAAM,4BAA4B;CACnD,IACE,UAAU,OAAO,MACjB,SAAS,UAAU,cACnB,SAAS,SAAS,aAAa,KAE/B,QACE,yBACA,8GACF;CAEF,MAAM,UAAU,MAAM,gCAAgC;CACtD,IAAI,QAAQ,cAAc,QAAQ,QAAQ,QAAQ,cAAc,QAAQ,KACtE,QACE,qBACA,wEACF;CAEF,MAAM,cACJ;EAAE,MAAM;EAAM,MAAM;CAAQ,GAC5B,EACE,qCAAqC,IACvC,CACF;AACF;AAEA,eAAsB,iCAAiC,EACrD,IACA,WAOgB;CAChB,MAAM,aAAa,WAAW,MAAM,QAAQ,OAAO,EAAA,CAAG,UAAU;CAChE,IAAI,SACF,MAAM,QAAQ,iBAAiB;CAGjC,IAAI;EASF,IAAI,EAAC,MARkB,2BAA2B;GAChD,SAAS;IACP,oBAAoB;IACpB,MAAM;IACN,eAAe;GACjB;GACA,WAAA;EACF,CAAC,EAAA,CACa,UACZ,MAAM,IAAI,MAAM,kDAAkD;CAEtE,SAAS,OAAO;EACd,IACE,WACA,cACA,iBAAiB,sCACjB,MAAM,SAAA,0CAEN,IAAI;GACF,MAAM,QAAQ,gBAAgB;EAChC,SAAS,cAAc;GACrB,MAAM,IAAI,eACR,CAAC,OAAO,YAAY,GACpB,4EACF;EACF;EAEF,IACE,EACE,iBAAiB,sCACjB,MAAM,SAAA,2CAER;GACA,MAAM,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GACpE,QACE,oBACA,oCAAoC,UAAU,iCAAiC,GAAG,4CAA4C,QAChI;EACF;EACA,MAAM;CACR;AACF"}
+{"version":3,"file":"service-account-control-BV_tBiio.js","names":["delay"],"sources":["../src/commands/service-account-control.ts"],"sourcesContent":["import { setTimeout as delay } from \"node:timers/promises\";\nimport {\n  SERVICE_ACCOUNT_STOP_REFUSED_CODE,\n  type ServiceAccountControlRequest,\n  serviceAccountControlRequestSchema,\n} from \"@openmeld/schemas\";\nimport {\n  buildStoredAuthSessionIdentity,\n  getAuthSessionState,\n  readServiceAdmissionSessionWithOwnership,\n  type StoredAuthSession,\n  withAdmittedServiceSession,\n} from \"../config/auth-session\";\nimport { withAuthSessionTransitionMutationLock } from \"../config/auth-session-transition-lock\";\nimport { readDaemonRuntimeLease } from \"../config/daemon-runtime-lease\";\nimport {\n  readDaemonServiceContract,\n  upsertDaemonServiceContract,\n} from \"../config/daemon-service-contract\";\nimport { withDaemonServiceRunLock } from \"../config/daemon-state\";\nimport {\n  cancelServiceAccountAdmission,\n  readServiceAccountAdmission,\n  reserveServiceAccountAdmission,\n  ServiceAccountAdmissionError,\n} from \"../config/service-account-admission\";\nimport {\n  LocalDaemonControlPlaneClientError,\n  requestLocalDaemonShutdown,\n} from \"../local-service/control-plane/client\";\nimport { CONTROLLED_SHUTDOWN_REQUEST_TIMEOUT_MS } from \"../local-service/core/constants\";\nimport { buildDaemonSystemServiceCommandSpec } from \"../local-service/lifecycle/daemon-service-command-spec\";\nimport {\n  type DaemonServiceManager,\n  resolveDaemonServiceManager,\n} from \"../local-service/lifecycle/daemon-service-manager\";\nimport { readCurrentDaemonRuntimeContext } from \"../local-service/lifecycle/daemon-service-runtime\";\nimport { resolveServiceAccountIdentity } from \"../local-service/lifecycle/service-account-authorization\";\nimport { resolveRuntimeContext } from \"../runtime/context\";\nimport { readProcessStartIdentity } from \"../system/process-identity\";\nimport { fetchAuthUserSnapshot } from \"./auth-device-session-client\";\nimport { runDaemonServiceDetached, runDaemonStop } from \"./service\";\nimport { createQuietPresenter } from \"./service-output\";\n\ntype Contract = NonNullable<\n  Awaited<ReturnType<typeof readDaemonServiceContract>>\n>;\n\nfunction refused(reason: string, message: string): never {\n  throw new ServiceAccountAdmissionError(reason, message);\n}\n\nexport async function runServiceAccountControl(\n  request: ServiceAccountControlRequest,\n  expectedSessionIdentity?: string\n): Promise<void> {\n  const parsed = serviceAccountControlRequestSchema.safeParse(request);\n  if (!parsed.success) {\n    refused(\n      \"missing_account\",\n      \"Choose a signed-in account before controlling this Service.\"\n    );\n  }\n  const input = parsed.data;\n  if (process.platform === \"win32\") {\n    refused(\n      \"unsupported_platform\",\n      \"Account-checked Service control is not available on Windows yet.\"\n    );\n  }\n  const auth = await getAuthSessionState();\n  if (auth.state !== \"valid\" || !auth.session) {\n    refused(\n      \"authentication_required\",\n      \"Sign in to the CLI with the matching account and try again.\"\n    );\n  }\n  const preparedSession = auth.session;\n  if (preparedSession.user?.id !== input.expectedAccount) {\n    refused(\n      \"account_mismatch\",\n      \"The CLI is signed in to a different account. Sign in with the matching account and try again.\"\n    );\n  }\n  // The shared Auth endpoint proves the principal. Local metadata alone does not.\n  const user = await fetchAuthUserSnapshot({\n    authBaseUrl: preparedSession.authBaseUrl,\n    accessToken: preparedSession.accessToken,\n  });\n  if (user.id !== input.expectedAccount) {\n    refused(\n      \"account_mismatch\",\n      \"The CLI session belongs to a different account. Sign in again and retry.\"\n    );\n  }\n\n  await withDaemonServiceRunLock(async () => {\n    const contract = await readDaemonServiceContract();\n    if (!contract) {\n      refused(\n        \"ownership_unknown\",\n        \"Connect this computer through OpenMeld setup before controlling its Service.\"\n      );\n    }\n    const observed = await readCurrentDaemonRuntimeContext();\n    const lease = await readDaemonRuntimeLease();\n    if (\n      input.operation === \"start\" &&\n      observed.effectiveRuntimeStatus !== \"not_running\"\n    ) {\n      refused(\n        \"busy\",\n        \"The Service is already running or its state is uncertain. Check Service status before trying again.\"\n      );\n    }\n    if (\n      input.operation === \"stop\" &&\n      (observed.effectiveRuntimeStatus !== \"running\" ||\n        !lease ||\n        lease.generation !== contract.generation)\n    ) {\n      refused(\n        \"ownership_unknown\",\n        \"OpenMeld could not verify the running Service. Check Service status before trying again.\"\n      );\n    }\n\n    let boundSession: StoredAuthSession = preparedSession;\n    const reservation = await withAuthSessionTransitionMutationLock(\n      async () => {\n        boundSession = await readServiceAdmissionSessionWithOwnership();\n        if (\n          (expectedSessionIdentity !== undefined &&\n            buildStoredAuthSessionIdentity(boundSession) !==\n              expectedSessionIdentity) ||\n          boundSession.accessToken !== preparedSession.accessToken ||\n          boundSession.createdAt !== preparedSession.createdAt ||\n          boundSession.user?.id !== input.expectedAccount\n        ) {\n          refused(\n            \"account_changed\",\n            \"The CLI sign-in changed before this action was accepted. Check the account and try again.\"\n          );\n        }\n        const current = await readDaemonServiceContract();\n        if (!current || JSON.stringify(current) !== JSON.stringify(contract)) {\n          refused(\n            \"ownership_changed\",\n            \"The Service changed before this action was accepted. Check its status and try again.\"\n          );\n        }\n        const identity = await resolveServiceAccountIdentity(\n          boundSession,\n          contract\n        );\n        if (\n          input.operation === \"start\" &&\n          contract.desiredState !== \"background\"\n        ) {\n          identity.contractGeneration += 1;\n        }\n        return await reserveServiceAccountAdmission({\n          operation: input.operation,\n          identity,\n          ...(input.operation === \"stop\" && lease\n            ? {\n                target: {\n                  ownerPid: lease.pid,\n                  ownerProcessStartedAt:\n                    readProcessStartIdentity(lease.pid) ??\n                    refused(\n                      \"ownership_unknown\",\n                      \"OpenMeld could not identify the Service process. Check its status and try again.\"\n                    ),\n                },\n              }\n            : {}),\n        });\n      }\n    );\n\n    try {\n      await withAdmittedServiceSession(boundSession, async () => {\n        if (input.operation === \"stop\") {\n          await stopReservedService(contract, reservation.id, lease?.pid ?? 0);\n          return;\n        }\n        const manager =\n          contract.serviceController === \"legacy-detached\"\n            ? null\n            : await resolveDaemonServiceManager(contract.serviceController);\n        if (\n          contract.serviceController !== \"legacy-detached\" &&\n          !(manager && (await manager.status()).installed)\n        ) {\n          refused(\n            \"installation_required\",\n            \"This Service needs setup before it can start. Run OpenMeld setup and try again.\"\n          );\n        }\n        await upsertDaemonServiceContract({\n          ...contract,\n          desiredState: \"background\",\n        });\n        if (contract.serviceController === \"legacy-detached\") {\n          const runtime = await resolveRuntimeContext({ view: \"agent\" });\n          await runDaemonServiceDetached({\n            accountAdmissionId: reservation.id,\n            deviceId: contract.deviceId,\n            gatewayUrl: contract.gatewayUrl,\n            heartbeatMs: contract.heartbeatMs,\n            runtime,\n            presenter: createQuietPresenter(runtime),\n            mode: \"background\",\n          });\n        } else if (manager) {\n          // Refresh the existing stopped supervisor definition with an immutable\n          // generation argument. Never install a missing Service.\n          await manager.deactivate();\n          await manager.install(\n            buildDaemonSystemServiceCommandSpec({\n              controller: manager.controller,\n              accountAdmissionId: reservation.id,\n            })\n          );\n          await manager.start();\n        }\n        await waitForAdmittedService(reservation.id);\n      });\n    } finally {\n      await cancelServiceAccountAdmission(reservation.id);\n    }\n  });\n}\n\nasync function waitForAdmittedService(id: string): Promise<void> {\n  const deadline = Date.now() + 15_000;\n  while (Date.now() < deadline) {\n    const current = await readServiceAccountAdmission();\n    const runtime = await readCurrentDaemonRuntimeContext();\n    if (\n      current?.id === id &&\n      current.state === \"admitted\" &&\n      current.carrier?.ownerPid === runtime.runtimeStatus.pid &&\n      runtime.effectiveRuntimeStatus === \"running\"\n    ) {\n      return;\n    }\n    await delay(50);\n  }\n  refused(\n    \"startup_unconfirmed\",\n    \"OpenMeld could not confirm that this Service started. Check Service status before trying again.\"\n  );\n}\n\nasync function stopReservedService(\n  contract: Contract,\n  id: string,\n  pid: number\n): Promise<void> {\n  const manager =\n    contract.serviceController === \"legacy-detached\"\n      ? null\n      : await resolveDaemonServiceManager(contract.serviceController);\n  await requestAccountCheckedServiceStop({ id, manager });\n  const admitted = await readServiceAccountAdmission();\n  if (\n    admitted?.id !== id ||\n    admitted.state !== \"admitted\" ||\n    admitted.carrier?.ownerPid !== pid\n  ) {\n    refused(\n      \"admission_unconfirmed\",\n      \"OpenMeld could not verify that the matching Service accepted Stop. Check Service status before trying again.\"\n    );\n  }\n  const current = await readCurrentDaemonRuntimeContext();\n  if (current.runtimeStatus.pid !== null && current.runtimeStatus.pid !== pid) {\n    refused(\n      \"ownership_changed\",\n      \"Another Service instance is now running. Its state was left unchanged.\"\n    );\n  }\n  await runDaemonStop(\n    { json: true, view: \"agent\" },\n    {\n      completedControlledShutdownOwnerPid: pid,\n    }\n  );\n}\n\nexport async function requestAccountCheckedServiceStop({\n  id,\n  manager,\n}: {\n  id: string;\n  manager: Pick<\n    DaemonServiceManager,\n    \"status\" | \"disableAutostart\" | \"enableAutostart\"\n  > | null;\n}): Promise<void> {\n  const wasEnabled = manager ? (await manager.status()).enabled : false;\n  if (manager) {\n    await manager.disableAutostart();\n  }\n  // No compatibility fallback: only the verified carrier may admit this stop.\n  try {\n    const shutdown = await requestLocalDaemonShutdown({\n      payload: {\n        accountAdmissionId: id,\n        mode: \"graceful\",\n        gracePeriodMs: 2000,\n      },\n      timeoutMs: CONTROLLED_SHUTDOWN_REQUEST_TIMEOUT_MS,\n    });\n    if (!shutdown.accepted) {\n      throw new Error(\"The Service did not confirm controlled shutdown.\");\n    }\n  } catch (error) {\n    if (\n      manager &&\n      wasEnabled &&\n      error instanceof LocalDaemonControlPlaneClientError &&\n      error.code === SERVICE_ACCOUNT_STOP_REFUSED_CODE\n    ) {\n      try {\n        await manager.enableAutostart();\n      } catch (restoreError) {\n        throw new AggregateError(\n          [error, restoreError],\n          \"Stop was refused and its previous autostart setting could not be restored.\"\n        );\n      }\n    }\n    if (\n      !(\n        error instanceof LocalDaemonControlPlaneClientError &&\n        error.code === SERVICE_ACCOUNT_STOP_REFUSED_CODE\n      )\n    ) {\n      const detail = error instanceof Error ? error.message : String(error);\n      refused(\n        \"stop_unconfirmed\",\n        `Stop may already be in progress. ${manager ? \"Autostart remains disabled. \" : \"\"}Check Service status before trying again. ${detail}`\n      );\n    }\n    throw error;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;AAgDA,SAAS,QAAQ,QAAgB,SAAwB;CACvD,MAAM,IAAI,6BAA6B,QAAQ,OAAO;AACxD;AAEA,eAAsB,yBACpB,SACA,yBACe;CACf,MAAM,SAAS,mCAAmC,UAAU,OAAO;CACnE,IAAI,CAAC,OAAO,SACV,QACE,mBACA,6DACF;CAEF,MAAM,QAAQ,OAAO;CACrB,IAAI,QAAQ,aAAa,SACvB,QACE,wBACA,kEACF;CAEF,MAAM,OAAO,MAAM,oBAAoB;CACvC,IAAI,KAAK,UAAU,WAAW,CAAC,KAAK,SAClC,QACE,2BACA,6DACF;CAEF,MAAM,kBAAkB,KAAK;CAC7B,IAAI,gBAAgB,MAAM,OAAO,MAAM,iBACrC,QACE,oBACA,+FACF;CAOF,KAAI,MAJe,sBAAsB;EACvC,aAAa,gBAAgB;EAC7B,aAAa,gBAAgB;CAC/B,CAAC,EAAA,CACQ,OAAO,MAAM,iBACpB,QACE,oBACA,0EACF;CAGF,MAAM,yBAAyB,YAAY;EACzC,MAAM,WAAW,MAAM,0BAA0B;EACjD,IAAI,CAAC,UACH,QACE,qBACA,8EACF;EAEF,MAAM,WAAW,MAAM,gCAAgC;EACvD,MAAM,QAAQ,MAAM,uBAAuB;EAC3C,IACE,MAAM,cAAc,WACpB,SAAS,2BAA2B,eAEpC,QACE,QACA,qGACF;EAEF,IACE,MAAM,cAAc,WACnB,SAAS,2BAA2B,aACnC,CAAC,SACD,MAAM,eAAe,SAAS,aAEhC,QACE,qBACA,0FACF;EAGF,IAAI,eAAkC;EACtC,MAAM,cAAc,MAAM,sCACxB,YAAY;GACV,eAAe,MAAM,yCAAyC;GAC9D,IACG,4BAA4B,KAAA,KAC3B,+BAA+B,YAAY,MACzC,2BACJ,aAAa,gBAAgB,gBAAgB,eAC7C,aAAa,cAAc,gBAAgB,aAC3C,aAAa,MAAM,OAAO,MAAM,iBAEhC,QACE,mBACA,2FACF;GAEF,MAAM,UAAU,MAAM,0BAA0B;GAChD,IAAI,CAAC,WAAW,KAAK,UAAU,OAAO,MAAM,KAAK,UAAU,QAAQ,GACjE,QACE,qBACA,sFACF;GAEF,MAAM,WAAW,MAAM,8BACrB,cACA,QACF;GACA,IACE,MAAM,cAAc,WACpB,SAAS,iBAAiB,cAE1B,SAAS,sBAAsB;GAEjC,OAAO,MAAM,+BAA+B;IAC1C,WAAW,MAAM;IACjB;IACA,GAAI,MAAM,cAAc,UAAU,QAC9B,EACE,QAAQ;KACN,UAAU,MAAM;KAChB,uBACE,yBAAyB,MAAM,GAAG,KAClC,QACE,qBACA,kFACF;IACJ,EACF,IACA,CAAC;GACP,CAAC;EACH,CACF;EAEA,IAAI;GACF,MAAM,2BAA2B,cAAc,YAAY;IACzD,IAAI,MAAM,cAAc,QAAQ;KAC9B,MAAM,oBAAoB,UAAU,YAAY,IAAI,OAAO,OAAO,CAAC;KACnE;IACF;IACA,MAAM,UACJ,SAAS,sBAAsB,oBAC3B,OACA,MAAM,4BAA4B,SAAS,iBAAiB;IAClE,IACE,SAAS,sBAAsB,qBAC/B,EAAE,YAAY,MAAM,QAAQ,OAAO,EAAA,CAAG,YAEtC,QACE,yBACA,iFACF;IAEF,MAAM,4BAA4B;KAChC,GAAG;KACH,cAAc;IAChB,CAAC;IACD,IAAI,SAAS,sBAAsB,mBAAmB;KACpD,MAAM,UAAU,MAAM,sBAAsB,EAAE,MAAM,QAAQ,CAAC;KAC7D,MAAM,yBAAyB;MAC7B,oBAAoB,YAAY;MAChC,UAAU,SAAS;MACnB,YAAY,SAAS;MACrB,aAAa,SAAS;MACtB;MACA,WAAW,qBAAqB,OAAO;MACvC,MAAM;KACR,CAAC;IACH,OAAO,IAAI,SAAS;KAGlB,MAAM,QAAQ,WAAW;KACzB,MAAM,QAAQ,QACZ,oCAAoC;MAClC,YAAY,QAAQ;MACpB,oBAAoB,YAAY;KAClC,CAAC,CACH;KACA,MAAM,QAAQ,MAAM;IACtB;IACA,MAAM,uBAAuB,YAAY,EAAE;GAC7C,CAAC;EACH,UAAU;GACR,MAAM,8BAA8B,YAAY,EAAE;EACpD;CACF,CAAC;AACH;AAEA,eAAe,uBAAuB,IAA2B;CAC/D,MAAM,WAAW,KAAK,IAAI,IAAI;CAC9B,OAAO,KAAK,IAAI,IAAI,UAAU;EAC5B,MAAM,UAAU,MAAM,4BAA4B;EAClD,MAAM,UAAU,MAAM,gCAAgC;EACtD,IACE,SAAS,OAAO,MAChB,QAAQ,UAAU,cAClB,QAAQ,SAAS,aAAa,QAAQ,cAAc,OACpD,QAAQ,2BAA2B,WAEnC;EAEF,MAAMA,WAAM,EAAE;CAChB;CACA,QACE,uBACA,iGACF;AACF;AAEA,eAAe,oBACb,UACA,IACA,KACe;CAKf,MAAM,iCAAiC;EAAE;EAAI,SAH3C,SAAS,sBAAsB,oBAC3B,OACA,MAAM,4BAA4B,SAAS,iBAAiB;CACb,CAAC;CACtD,MAAM,WAAW,MAAM,4BAA4B;CACnD,IACE,UAAU,OAAO,MACjB,SAAS,UAAU,cACnB,SAAS,SAAS,aAAa,KAE/B,QACE,yBACA,8GACF;CAEF,MAAM,UAAU,MAAM,gCAAgC;CACtD,IAAI,QAAQ,cAAc,QAAQ,QAAQ,QAAQ,cAAc,QAAQ,KACtE,QACE,qBACA,wEACF;CAEF,MAAM,cACJ;EAAE,MAAM;EAAM,MAAM;CAAQ,GAC5B,EACE,qCAAqC,IACvC,CACF;AACF;AAEA,eAAsB,iCAAiC,EACrD,IACA,WAOgB;CAChB,MAAM,aAAa,WAAW,MAAM,QAAQ,OAAO,EAAA,CAAG,UAAU;CAChE,IAAI,SACF,MAAM,QAAQ,iBAAiB;CAGjC,IAAI;EASF,IAAI,EAAC,MARkB,2BAA2B;GAChD,SAAS;IACP,oBAAoB;IACpB,MAAM;IACN,eAAe;GACjB;GACA,WAAA;EACF,CAAC,EAAA,CACa,UACZ,MAAM,IAAI,MAAM,kDAAkD;CAEtE,SAAS,OAAO;EACd,IACE,WACA,cACA,iBAAiB,sCACjB,MAAM,SAAA,0CAEN,IAAI;GACF,MAAM,QAAQ,gBAAgB;EAChC,SAAS,cAAc;GACrB,MAAM,IAAI,eACR,CAAC,OAAO,YAAY,GACpB,4EACF;EACF;EAEF,IACE,EACE,iBAAiB,sCACjB,MAAM,SAAA,2CAER;GACA,MAAM,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GACpE,QACE,oBACA,oCAAoC,UAAU,iCAAiC,GAAG,4CAA4C,QAChI;EACF;EACA,MAAM;CACR;AACF"}

package/dist/{service-control-capabilities-ChRe8hkw.js → service-control-capabilities-BGXPenm1.js}

@@ -1,4 +1,4 @@
 #!/usr/bin/env node
 
-import { t as readServiceControlCapabilities } from "./service-control-capabilities-C5SxnBg2.js";
+import { t as readServiceControlCapabilities } from "./service-control-capabilities-DUudAKoj.js";
 export { readServiceControlCapabilities };

package/dist/{service-control-capabilities-C5SxnBg2.js → service-control-capabilities-DUudAKoj.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 import { o as serviceControlCapabilitiesSchema, s as serviceControlCarrierCapabilitySchema } from "./distribution-DY2fBeSW.js";
-import { Lt as sendLocalDaemonControlPlaneRequest, S as daemonServiceBinaryExecutablePath, Vt as readDaemonServiceContract, j as readDaemonActiveBundleState, r as readCurrentDaemonRuntimeContext } from "./daemon-service-runtime-CWTlAhZY.js";
+import { Lt as sendLocalDaemonControlPlaneRequest, S as daemonServiceBinaryExecutablePath, Vt as readDaemonServiceContract, j as readDaemonActiveBundleState, r as readCurrentDaemonRuntimeContext } from "./daemon-service-runtime-CY6wdBe1.js";
 import { S as resolveDaemonServiceManager } from "./daemon-service-manager-GiMCiTmu.js";
 import { realpath } from "node:fs/promises";
 import { execFile } from "node:child_process";
@@ -51,4 +51,4 @@ async function readServiceControlCapabilities() {
 //#endregion
 export { readServiceControlCapabilities as t };
 
-//# sourceMappingURL=service-control-capabilities-C5SxnBg2.js.map
+//# sourceMappingURL=service-control-capabilities-DUudAKoj.js.map

package/dist/{service-control-capabilities-C5SxnBg2.js.map → service-control-capabilities-DUudAKoj.js.map}

@@ -1 +1 @@
-{"version":3,"file":"service-control-capabilities-C5SxnBg2.js","names":[],"sources":["../src/commands/service-control-capabilities.ts"],"sourcesContent":["import { execFile } from \"node:child_process\";\nimport { realpath } from \"node:fs/promises\";\nimport { promisify } from \"node:util\";\nimport {\n  serviceControlCapabilitiesSchema,\n  serviceControlCarrierCapabilitySchema,\n} from \"@openmeld/schemas\";\nimport { readDaemonServiceContract } from \"../config/daemon-service-contract\";\nimport { sendLocalDaemonControlPlaneRequest } from \"../local-service/control-plane/client\";\nimport {\n  daemonServiceBinaryExecutablePath,\n  readDaemonActiveBundleState,\n} from \"../local-service/lifecycle/daemon-service-bundle\";\nimport { resolveDaemonServiceManager } from \"../local-service/lifecycle/daemon-service-manager\";\nimport { readCurrentDaemonRuntimeContext } from \"../local-service/lifecycle/daemon-service-runtime\";\n\n/** Read only: never invoke the repairing npm launcher or a lifecycle operation. */\nexport async function readServiceControlCapabilities() {\n  const unsupported = { deviceId: null, start: false, stop: false };\n  if (process.platform !== \"darwin\") {\n    return unsupported;\n  }\n  const contract = await readDaemonServiceContract();\n  const bundle = await readDaemonActiveBundleState();\n  if (\n    contract?.serviceController !== \"launchd\" ||\n    bundle?.bundleFormat !== \"binary_v1\"\n  ) {\n    return unsupported;\n  }\n  const manager = await resolveDaemonServiceManager(\"launchd\");\n  if (!(manager && (await manager.status()).installed)) {\n    return unsupported;\n  }\n  // Guarded Start refreshes the supervisor command to this canonical executable.\n  // Verify the executable that answered, so an old CLI delegating elsewhere\n  // cannot advertise another binary's capability as its own.\n  const executable = await realpath(daemonServiceBinaryExecutablePath());\n  const { stdout } = await promisify(execFile)(\n    executable,\n    [\"service\", \"control-carrier-capability\", \"--json\"],\n    { timeout: 5000, maxBuffer: 16_384 }\n  );\n  const carrier = serviceControlCarrierCapabilitySchema.safeParse(\n    JSON.parse(stdout)\n  );\n  if (\n    !carrier.success ||\n    (await realpath(carrier.data.executable)) !== executable\n  ) {\n    return unsupported;\n  }\n  const runtime = await readCurrentDaemonRuntimeContext();\n  if (runtime.effectiveRuntimeStatus === \"not_running\") {\n    return { deviceId: contract.deviceId, start: true, stop: false };\n  }\n  if (runtime.effectiveRuntimeStatus !== \"running\") {\n    return unsupported;\n  }\n  const response = await sendLocalDaemonControlPlaneRequest({\n    request: { v: 1, command: \"account_control_capabilities\" },\n  });\n  return serviceControlCapabilitiesSchema.parse({\n    deviceId: contract.deviceId,\n    start: false,\n    stop:\n      response.code === \"service.account_control_capabilities\" &&\n      response.payload.supported,\n  });\n}\n"],"mappings":";;;;;;;;;;AAiBA,eAAsB,iCAAiC;CACrD,MAAM,cAAc;EAAE,UAAU;EAAM,OAAO;EAAO,MAAM;CAAM;CAChE,IAAI,QAAQ,aAAa,UACvB,OAAO;CAET,MAAM,WAAW,MAAM,0BAA0B;CACjD,MAAM,SAAS,MAAM,4BAA4B;CACjD,IACE,UAAU,sBAAsB,aAChC,QAAQ,iBAAiB,aAEzB,OAAO;CAET,MAAM,UAAU,MAAM,4BAA4B,SAAS;CAC3D,IAAI,EAAE,YAAY,MAAM,QAAQ,OAAO,EAAA,CAAG,YACxC,OAAO;CAKT,MAAM,aAAa,MAAM,SAAS,kCAAkC,CAAC;CACrE,MAAM,EAAE,WAAW,MAAM,UAAU,QAAQ,CAAC,CAC1C,YACA;EAAC;EAAW;EAA8B;CAAQ,GAClD;EAAE,SAAS;EAAM,WAAW;CAAO,CACrC;CACA,MAAM,UAAU,sCAAsC,UACpD,KAAK,MAAM,MAAM,CACnB;CACA,IACE,CAAC,QAAQ,WACR,MAAM,SAAS,QAAQ,KAAK,UAAU,MAAO,YAE9C,OAAO;CAET,MAAM,UAAU,MAAM,gCAAgC;CACtD,IAAI,QAAQ,2BAA2B,eACrC,OAAO;EAAE,UAAU,SAAS;EAAU,OAAO;EAAM,MAAM;CAAM;CAEjE,IAAI,QAAQ,2BAA2B,WACrC,OAAO;CAET,MAAM,WAAW,MAAM,mCAAmC,EACxD,SAAS;EAAE,GAAG;EAAG,SAAS;CAA+B,EAC3D,CAAC;CACD,OAAO,iCAAiC,MAAM;EAC5C,UAAU,SAAS;EACnB,OAAO;EACP,MACE,SAAS,SAAS,0CAClB,SAAS,QAAQ;CACrB,CAAC;AACH"}
+{"version":3,"file":"service-control-capabilities-DUudAKoj.js","names":[],"sources":["../src/commands/service-control-capabilities.ts"],"sourcesContent":["import { execFile } from \"node:child_process\";\nimport { realpath } from \"node:fs/promises\";\nimport { promisify } from \"node:util\";\nimport {\n  serviceControlCapabilitiesSchema,\n  serviceControlCarrierCapabilitySchema,\n} from \"@openmeld/schemas\";\nimport { readDaemonServiceContract } from \"../config/daemon-service-contract\";\nimport { sendLocalDaemonControlPlaneRequest } from \"../local-service/control-plane/client\";\nimport {\n  daemonServiceBinaryExecutablePath,\n  readDaemonActiveBundleState,\n} from \"../local-service/lifecycle/daemon-service-bundle\";\nimport { resolveDaemonServiceManager } from \"../local-service/lifecycle/daemon-service-manager\";\nimport { readCurrentDaemonRuntimeContext } from \"../local-service/lifecycle/daemon-service-runtime\";\n\n/** Read only: never invoke the repairing npm launcher or a lifecycle operation. */\nexport async function readServiceControlCapabilities() {\n  const unsupported = { deviceId: null, start: false, stop: false };\n  if (process.platform !== \"darwin\") {\n    return unsupported;\n  }\n  const contract = await readDaemonServiceContract();\n  const bundle = await readDaemonActiveBundleState();\n  if (\n    contract?.serviceController !== \"launchd\" ||\n    bundle?.bundleFormat !== \"binary_v1\"\n  ) {\n    return unsupported;\n  }\n  const manager = await resolveDaemonServiceManager(\"launchd\");\n  if (!(manager && (await manager.status()).installed)) {\n    return unsupported;\n  }\n  // Guarded Start refreshes the supervisor command to this canonical executable.\n  // Verify the executable that answered, so an old CLI delegating elsewhere\n  // cannot advertise another binary's capability as its own.\n  const executable = await realpath(daemonServiceBinaryExecutablePath());\n  const { stdout } = await promisify(execFile)(\n    executable,\n    [\"service\", \"control-carrier-capability\", \"--json\"],\n    { timeout: 5000, maxBuffer: 16_384 }\n  );\n  const carrier = serviceControlCarrierCapabilitySchema.safeParse(\n    JSON.parse(stdout)\n  );\n  if (\n    !carrier.success ||\n    (await realpath(carrier.data.executable)) !== executable\n  ) {\n    return unsupported;\n  }\n  const runtime = await readCurrentDaemonRuntimeContext();\n  if (runtime.effectiveRuntimeStatus === \"not_running\") {\n    return { deviceId: contract.deviceId, start: true, stop: false };\n  }\n  if (runtime.effectiveRuntimeStatus !== \"running\") {\n    return unsupported;\n  }\n  const response = await sendLocalDaemonControlPlaneRequest({\n    request: { v: 1, command: \"account_control_capabilities\" },\n  });\n  return serviceControlCapabilitiesSchema.parse({\n    deviceId: contract.deviceId,\n    start: false,\n    stop:\n      response.code === \"service.account_control_capabilities\" &&\n      response.payload.supported,\n  });\n}\n"],"mappings":";;;;;;;;;;AAiBA,eAAsB,iCAAiC;CACrD,MAAM,cAAc;EAAE,UAAU;EAAM,OAAO;EAAO,MAAM;CAAM;CAChE,IAAI,QAAQ,aAAa,UACvB,OAAO;CAET,MAAM,WAAW,MAAM,0BAA0B;CACjD,MAAM,SAAS,MAAM,4BAA4B;CACjD,IACE,UAAU,sBAAsB,aAChC,QAAQ,iBAAiB,aAEzB,OAAO;CAET,MAAM,UAAU,MAAM,4BAA4B,SAAS;CAC3D,IAAI,EAAE,YAAY,MAAM,QAAQ,OAAO,EAAA,CAAG,YACxC,OAAO;CAKT,MAAM,aAAa,MAAM,SAAS,kCAAkC,CAAC;CACrE,MAAM,EAAE,WAAW,MAAM,UAAU,QAAQ,CAAC,CAC1C,YACA;EAAC;EAAW;EAA8B;CAAQ,GAClD;EAAE,SAAS;EAAM,WAAW;CAAO,CACrC;CACA,MAAM,UAAU,sCAAsC,UACpD,KAAK,MAAM,MAAM,CACnB;CACA,IACE,CAAC,QAAQ,WACR,MAAM,SAAS,QAAQ,KAAK,UAAU,MAAO,YAE9C,OAAO;CAET,MAAM,UAAU,MAAM,gCAAgC;CACtD,IAAI,QAAQ,2BAA2B,eACrC,OAAO;EAAE,UAAU,SAAS;EAAU,OAAO;EAAM,MAAM;CAAM;CAEjE,IAAI,QAAQ,2BAA2B,WACrC,OAAO;CAET,MAAM,WAAW,MAAM,mCAAmC,EACxD,SAAS;EAAE,GAAG;EAAG,SAAS;CAA+B,EAC3D,CAAC;CACD,OAAO,iCAAiC,MAAM;EAC5C,UAAU,SAAS;EACnB,OAAO;EACP,MACE,SAAS,SAAS,0CAClB,SAAS,QAAQ;CACrB,CAAC;AACH"}

package/dist/{upgrade-DAVEeo8B.js → upgrade-9h70HCQP.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 
-import { $t as resolveCurrentDaemonExpectedVersion, Kt as resolveVersionChangeDirection, Ra as resolveRuntimeContext, St as readOpenMeldToolsUpdateContextFromEnv, Ut as buildDaemonServiceTargetSpec, Wt as resolveDaemonServiceAlignmentDecision, Xi as resolveServiceUpdateUrgency, f as formatDaemonFailureContextText, jt as inspectDaemonServiceInventory, n as scheduleDaemonServiceUpdate, xt as createOpenMeldToolsUpdateCoordinator } from "./daemon-service-update-coordinator-DcjOzGu1.js";
+import { $t as resolveCurrentDaemonExpectedVersion, Kt as resolveVersionChangeDirection, St as readOpenMeldToolsUpdateContextFromEnv, Ut as buildDaemonServiceTargetSpec, Wt as resolveDaemonServiceAlignmentDecision, Zi as resolveServiceUpdateUrgency, f as formatDaemonFailureContextText, jt as inspectDaemonServiceInventory, n as scheduleDaemonServiceUpdate, xt as createOpenMeldToolsUpdateCoordinator, za as resolveRuntimeContext } from "./daemon-service-update-coordinator-BcbbIDzC.js";
 import { t as isBinaryDistribution } from "./distribution-DY2fBeSW.js";
-import { At as resolveCliBinaryUpdatePlan, Ot as DEFAULT_CLI_BINARY_DOWNLOAD_POLICY, ct as buildNextVersionState, dt as fetchLatestCliBinaryRelease, ft as fetchLatestPackageInfo, ht as writeVersionState, jt as verifyCliBinaryCodeSignature, kt as downloadCliBinaryUpdateArtifact, mt as readVersionState, nt as OPENMELD_VERSION, xt as hasIndependentMaintenanceRegistration } from "./daemon-service-runtime-CWTlAhZY.js";
-import { Bt as buildAgentOverviewFromContract, Gt as createPresenter, Y as createUpgradeConfirmationGuideError, Yt as outJsonLine, a as formatDaemonServiceDowngradeBlockedRecommendation, c as formatDaemonServiceMissingRecommendation, g as canUseInteractivePrompts, ht as getCommandEntryContract, n as resolveElapsedTimeMs, t as formatElapsedTime } from "./elapsed-time-iFOSSUJo.js";
+import { At as resolveCliBinaryUpdatePlan, Ot as DEFAULT_CLI_BINARY_DOWNLOAD_POLICY, ct as buildNextVersionState, dt as fetchLatestCliBinaryRelease, ft as fetchLatestPackageInfo, ht as writeVersionState, jt as verifyCliBinaryCodeSignature, kt as downloadCliBinaryUpdateArtifact, mt as readVersionState, nt as OPENMELD_VERSION, xt as hasIndependentMaintenanceRegistration } from "./daemon-service-runtime-CY6wdBe1.js";
+import { Bt as buildAgentOverviewFromContract, Gt as createPresenter, Y as createUpgradeConfirmationGuideError, Yt as outJsonLine, a as formatDaemonServiceDowngradeBlockedRecommendation, c as formatDaemonServiceMissingRecommendation, g as canUseInteractivePrompts, ht as getCommandEntryContract, n as resolveElapsedTimeMs, t as formatElapsedTime } from "./elapsed-time-Do3uIV__.js";
 import { c as formatOpenMeldCliTextBlock, i as formatInlineOpenMeldCliCommands } from "./openmeld-environment-target-NtJYJe1D.js";
-import { c as withOpenMeldToolsUpdateFailure, i as OpenMeldToolsUpdateFailureError, r as parseOpenMeldToolsUpdateFailureFrame } from "./openmeld-tools-update-process-frame-CbZPpc7D.js";
-import { t as resolveExternalOpenMeldToolsUpdate } from "./openmeld-tools-update-join-DS_EIL5q.js";
+import { c as withOpenMeldToolsUpdateFailure, i as OpenMeldToolsUpdateFailureError, r as parseOpenMeldToolsUpdateFailureFrame } from "./openmeld-tools-update-process-frame-0X-t0Kjv.js";
+import { t as resolveExternalOpenMeldToolsUpdate } from "./openmeld-tools-update-join-DsQdgYNw.js";
 import { tmpdir } from "node:os";
 import { basename, dirname, join } from "node:path";
 import { chmod, mkdtemp, realpath, rm, stat, writeFile } from "node:fs/promises";
@@ -805,11 +805,14 @@ async function runInternalUpgradeServiceAlignment(input) {
 		});
 		throw new UpgradeOutputHandledError(errorMessage);
 	}
+	const updateContext = readOpenMeldToolsUpdateContextFromEnv();
 	const scheduled = await scheduleDaemonServiceUpdate({
 		targetVersion: daemonVersion,
 		...binaryRelease?.version === daemonVersion ? { binaryRelease } : {},
 		urgency: await resolveServiceUpdateUrgency(),
-		...readOpenMeldToolsUpdateContextFromEnv() ?? {},
+		...updateContext ?? {},
+		targetCliVersion: OPENMELD_VERSION,
+		targetServiceVersion: daemonVersion,
 		...input.cliScriptPath ? { cliScriptPath: input.cliScriptPath } : {}
 	});
 	if (input.resolvedView === "human") {
@@ -1079,4 +1082,4 @@ function toErrorMessage(error) {
 //#endregion
 export { runUpgrade as a, OPENMELD_UPGRADE_FAILURE_HINTS as c, runMaintenanceUpgrade as i, OPENMELD_UPGRADE_METADATA_RECOVERY_HINTS as l, isUpgradeOutputHandledError as n, emitTopLevelAgentOverview as o, resolveBinaryManualOpenMeldUpgradeCommand as r, emitTopLevelCliAgentOverview as s, UPGRADE_INTERNAL_ALIGN_SERVICE_FLAG as t };
 
-//# sourceMappingURL=upgrade-DAVEeo8B.js.map
+//# sourceMappingURL=upgrade-9h70HCQP.js.map