openmeld 0.3.218 → 0.3.220

package/dist/{service-account-authorization-A5Ly0UFD.js → service-account-authorization-DAPQy2yP.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 import { et as openMeldRootDir, lt as resolveOpenMeldRootDir, ut as resolveOpenMeldServiceOwnedPathInput } from "./lock-Bsl_ElWy.js";
-import { D as admitServiceAccountOperation, E as ServiceAccountAdmissionError, j as withAuthSessionTransitionMutationLock, w as withAdmittedServiceSession, y as readServiceAdmissionSessionWithOwnership } from "./auth-session-BAq7KkIa.js";
+import { D as admitServiceAccountOperation, E as ServiceAccountAdmissionError, j as withAuthSessionTransitionMutationLock, w as withAdmittedServiceSession, y as readServiceAdmissionSessionWithOwnership } from "./auth-session-CDhQANWx.js";
 import { r as readDaemonRuntimeLease } from "./daemon-runtime-lease-BUr4qsLo.js";
 import { i as readDaemonServiceContract } from "./daemon-service-contract-BpOBMGX0.js";
 import { t as resolveOpenMeldEnvironmentTarget } from "./openmeld-environment-target-B6HqY0_a.js";
@@ -53,4 +53,4 @@ async function admitServiceAccountStop(input) {
 //#endregion
 export { resolveServiceAccountIdentity as n, runServiceAccountCarrier as r, admitServiceAccountStop as t };
 
-//# sourceMappingURL=service-account-authorization-A5Ly0UFD.js.map
+//# sourceMappingURL=service-account-authorization-DAPQy2yP.js.map

package/dist/{service-account-authorization-A5Ly0UFD.js.map → service-account-authorization-DAPQy2yP.js.map}

@@ -1 +1 @@
-{"version":3,"file":"service-account-authorization-A5Ly0UFD.js","names":[],"sources":["../src/local-service/lifecycle/service-account-authorization.ts"],"sourcesContent":["import { resolve } from \"node:path\";\nimport type { ServiceAccountAdmissionIdentity } from \"@openmeld/schemas\";\nimport {\n  readServiceAdmissionSessionWithOwnership,\n  type StoredAuthSession,\n  withAdmittedServiceSession,\n} from \"../../config/auth-session\";\nimport { withAuthSessionTransitionMutationLock } from \"../../config/auth-session-transition-lock\";\nimport { readDaemonRuntimeLease } from \"../../config/daemon-runtime-lease\";\nimport { readDaemonServiceContract } from \"../../config/daemon-service-contract\";\nimport { resolveOpenMeldEnvironmentTarget } from \"../../config/openmeld-environment-target\";\nimport {\n  openMeldRootDir,\n  resolveOpenMeldRootDir,\n  resolveOpenMeldServiceOwnedPathInput,\n} from \"../../config/paths\";\nimport {\n  admitServiceAccountOperation,\n  ServiceAccountAdmissionError,\n} from \"../../config/service-account-admission\";\n\ntype Contract = NonNullable<\n  Awaited<ReturnType<typeof readDaemonServiceContract>>\n>;\nfunction refused(reason: string, message: string): never {\n  throw new ServiceAccountAdmissionError(reason, message);\n}\n\nexport async function resolveServiceAccountIdentity(\n  session: StoredAuthSession,\n  contract: Contract\n): Promise<ServiceAccountAdmissionIdentity> {\n  const target = await resolveOpenMeldEnvironmentTarget();\n  if (\n    resolve(openMeldRootDir()) !==\n      resolve(resolveOpenMeldRootDir(resolveOpenMeldServiceOwnedPathInput())) ||\n    contract.lane !== target.preset ||\n    contract.gatewayUrl !== target.gatewayUrl ||\n    session.authBaseUrl !== target.authBaseUrl ||\n    !contract.ownerUserId ||\n    contract.ownerUserId !== session.user?.id ||\n    !contract.connectedComputerId\n  ) {\n    refused(\n      \"ownership_mismatch\",\n      \"This Service does not match the signed-in account or environment. Reconnect it through OpenMeld setup before trying again.\"\n    );\n  }\n  return {\n    accountId: contract.ownerUserId,\n    authBaseUrl: session.authBaseUrl,\n    clientId: session.clientId,\n    gatewayUrl: target.gatewayUrl,\n    lane: target.preset,\n    deviceId: contract.deviceId,\n    contractGeneration: contract.generation,\n  };\n}\n\nexport async function runServiceAccountCarrier<T>(\n  id: string,\n  run: () => Promise<T>\n): Promise<T> {\n  const session = await withAuthSessionTransitionMutationLock(async () => {\n    const local = await readServiceAdmissionSessionWithOwnership();\n    const contract = await readDaemonServiceContract();\n    if (!contract || contract.desiredState !== \"background\") {\n      refused(\n        \"cancelled\",\n        \"This Service startup is no longer authorized. Start the Service again from the matching account.\"\n      );\n    }\n    await admitServiceAccountOperation({\n      id,\n      operation: \"start\",\n      identity: await resolveServiceAccountIdentity(local, contract),\n    });\n    return local;\n  });\n  return await withAdmittedServiceSession(session, run);\n}\n\nexport async function admitServiceAccountStop(input: {\n  id: string;\n  ownerUserId: string;\n  deviceId: string;\n  contractGeneration: number;\n  commit: () => void;\n}): Promise<void> {\n  await withAuthSessionTransitionMutationLock(async () => {\n    const session = await readServiceAdmissionSessionWithOwnership();\n    const contract = await readDaemonServiceContract();\n    const lease = await readDaemonRuntimeLease();\n    if (\n      !(contract && lease) ||\n      lease.pid !== process.pid ||\n      contract.generation !== input.contractGeneration ||\n      contract.ownerUserId !== input.ownerUserId ||\n      contract.deviceId !== input.deviceId\n    ) {\n      refused(\n        \"ownership_changed\",\n        \"The running Service changed before this Stop was accepted. Check its status and try again.\"\n      );\n    }\n    await admitServiceAccountOperation({\n      id: input.id,\n      operation: \"stop\",\n      identity: await resolveServiceAccountIdentity(session, contract),\n      commit: input.commit,\n    });\n  });\n}\n"],"mappings":";;;;;;;;;AAwBA,SAAS,QAAQ,QAAgB,SAAwB;CACvD,MAAM,IAAI,6BAA6B,QAAQ,OAAO;AACxD;AAEA,eAAsB,8BACpB,SACA,UAC0C;CAC1C,MAAM,SAAS,MAAM,iCAAiC;CACtD,IACE,QAAQ,gBAAgB,CAAC,MACvB,QAAQ,uBAAuB,qCAAqC,CAAC,CAAC,KACxE,SAAS,SAAS,OAAO,UACzB,SAAS,eAAe,OAAO,cAC/B,QAAQ,gBAAgB,OAAO,eAC/B,CAAC,SAAS,eACV,SAAS,gBAAgB,QAAQ,MAAM,MACvC,CAAC,SAAS,qBAEV,QACE,sBACA,4HACF;CAEF,OAAO;EACL,WAAW,SAAS;EACpB,aAAa,QAAQ;EACrB,UAAU,QAAQ;EAClB,YAAY,OAAO;EACnB,MAAM,OAAO;EACb,UAAU,SAAS;EACnB,oBAAoB,SAAS;CAC/B;AACF;AAEA,eAAsB,yBACpB,IACA,KACY;CAiBZ,OAAO,MAAM,2BAA2B,MAhBlB,sCAAsC,YAAY;EACtE,MAAM,QAAQ,MAAM,yCAAyC;EAC7D,MAAM,WAAW,MAAM,0BAA0B;EACjD,IAAI,CAAC,YAAY,SAAS,iBAAiB,cACzC,QACE,aACA,kGACF;EAEF,MAAM,6BAA6B;GACjC;GACA,WAAW;GACX,UAAU,MAAM,8BAA8B,OAAO,QAAQ;EAC/D,CAAC;EACD,OAAO;CACT,CAAC,GACgD,GAAG;AACtD;AAEA,eAAsB,wBAAwB,OAM5B;CAChB,MAAM,sCAAsC,YAAY;EACtD,MAAM,UAAU,MAAM,yCAAyC;EAC/D,MAAM,WAAW,MAAM,0BAA0B;EACjD,MAAM,QAAQ,MAAM,uBAAuB;EAC3C,IACE,EAAE,YAAY,UACd,MAAM,QAAQ,QAAQ,OACtB,SAAS,eAAe,MAAM,sBAC9B,SAAS,gBAAgB,MAAM,eAC/B,SAAS,aAAa,MAAM,UAE5B,QACE,qBACA,4FACF;EAEF,MAAM,6BAA6B;GACjC,IAAI,MAAM;GACV,WAAW;GACX,UAAU,MAAM,8BAA8B,SAAS,QAAQ;GAC/D,QAAQ,MAAM;EAChB,CAAC;CACH,CAAC;AACH"}
+{"version":3,"file":"service-account-authorization-DAPQy2yP.js","names":[],"sources":["../src/local-service/lifecycle/service-account-authorization.ts"],"sourcesContent":["import { resolve } from \"node:path\";\nimport type { ServiceAccountAdmissionIdentity } from \"@openmeld/schemas\";\nimport {\n  readServiceAdmissionSessionWithOwnership,\n  type StoredAuthSession,\n  withAdmittedServiceSession,\n} from \"../../config/auth-session\";\nimport { withAuthSessionTransitionMutationLock } from \"../../config/auth-session-transition-lock\";\nimport { readDaemonRuntimeLease } from \"../../config/daemon-runtime-lease\";\nimport { readDaemonServiceContract } from \"../../config/daemon-service-contract\";\nimport { resolveOpenMeldEnvironmentTarget } from \"../../config/openmeld-environment-target\";\nimport {\n  openMeldRootDir,\n  resolveOpenMeldRootDir,\n  resolveOpenMeldServiceOwnedPathInput,\n} from \"../../config/paths\";\nimport {\n  admitServiceAccountOperation,\n  ServiceAccountAdmissionError,\n} from \"../../config/service-account-admission\";\n\ntype Contract = NonNullable<\n  Awaited<ReturnType<typeof readDaemonServiceContract>>\n>;\nfunction refused(reason: string, message: string): never {\n  throw new ServiceAccountAdmissionError(reason, message);\n}\n\nexport async function resolveServiceAccountIdentity(\n  session: StoredAuthSession,\n  contract: Contract\n): Promise<ServiceAccountAdmissionIdentity> {\n  const target = await resolveOpenMeldEnvironmentTarget();\n  if (\n    resolve(openMeldRootDir()) !==\n      resolve(resolveOpenMeldRootDir(resolveOpenMeldServiceOwnedPathInput())) ||\n    contract.lane !== target.preset ||\n    contract.gatewayUrl !== target.gatewayUrl ||\n    session.authBaseUrl !== target.authBaseUrl ||\n    !contract.ownerUserId ||\n    contract.ownerUserId !== session.user?.id ||\n    !contract.connectedComputerId\n  ) {\n    refused(\n      \"ownership_mismatch\",\n      \"This Service does not match the signed-in account or environment. Reconnect it through OpenMeld setup before trying again.\"\n    );\n  }\n  return {\n    accountId: contract.ownerUserId,\n    authBaseUrl: session.authBaseUrl,\n    clientId: session.clientId,\n    gatewayUrl: target.gatewayUrl,\n    lane: target.preset,\n    deviceId: contract.deviceId,\n    contractGeneration: contract.generation,\n  };\n}\n\nexport async function runServiceAccountCarrier<T>(\n  id: string,\n  run: () => Promise<T>\n): Promise<T> {\n  const session = await withAuthSessionTransitionMutationLock(async () => {\n    const local = await readServiceAdmissionSessionWithOwnership();\n    const contract = await readDaemonServiceContract();\n    if (!contract || contract.desiredState !== \"background\") {\n      refused(\n        \"cancelled\",\n        \"This Service startup is no longer authorized. Start the Service again from the matching account.\"\n      );\n    }\n    await admitServiceAccountOperation({\n      id,\n      operation: \"start\",\n      identity: await resolveServiceAccountIdentity(local, contract),\n    });\n    return local;\n  });\n  return await withAdmittedServiceSession(session, run);\n}\n\nexport async function admitServiceAccountStop(input: {\n  id: string;\n  ownerUserId: string;\n  deviceId: string;\n  contractGeneration: number;\n  commit: () => void;\n}): Promise<void> {\n  await withAuthSessionTransitionMutationLock(async () => {\n    const session = await readServiceAdmissionSessionWithOwnership();\n    const contract = await readDaemonServiceContract();\n    const lease = await readDaemonRuntimeLease();\n    if (\n      !(contract && lease) ||\n      lease.pid !== process.pid ||\n      contract.generation !== input.contractGeneration ||\n      contract.ownerUserId !== input.ownerUserId ||\n      contract.deviceId !== input.deviceId\n    ) {\n      refused(\n        \"ownership_changed\",\n        \"The running Service changed before this Stop was accepted. Check its status and try again.\"\n      );\n    }\n    await admitServiceAccountOperation({\n      id: input.id,\n      operation: \"stop\",\n      identity: await resolveServiceAccountIdentity(session, contract),\n      commit: input.commit,\n    });\n  });\n}\n"],"mappings":";;;;;;;;;AAwBA,SAAS,QAAQ,QAAgB,SAAwB;CACvD,MAAM,IAAI,6BAA6B,QAAQ,OAAO;AACxD;AAEA,eAAsB,8BACpB,SACA,UAC0C;CAC1C,MAAM,SAAS,MAAM,iCAAiC;CACtD,IACE,QAAQ,gBAAgB,CAAC,MACvB,QAAQ,uBAAuB,qCAAqC,CAAC,CAAC,KACxE,SAAS,SAAS,OAAO,UACzB,SAAS,eAAe,OAAO,cAC/B,QAAQ,gBAAgB,OAAO,eAC/B,CAAC,SAAS,eACV,SAAS,gBAAgB,QAAQ,MAAM,MACvC,CAAC,SAAS,qBAEV,QACE,sBACA,4HACF;CAEF,OAAO;EACL,WAAW,SAAS;EACpB,aAAa,QAAQ;EACrB,UAAU,QAAQ;EAClB,YAAY,OAAO;EACnB,MAAM,OAAO;EACb,UAAU,SAAS;EACnB,oBAAoB,SAAS;CAC/B;AACF;AAEA,eAAsB,yBACpB,IACA,KACY;CAiBZ,OAAO,MAAM,2BAA2B,MAhBlB,sCAAsC,YAAY;EACtE,MAAM,QAAQ,MAAM,yCAAyC;EAC7D,MAAM,WAAW,MAAM,0BAA0B;EACjD,IAAI,CAAC,YAAY,SAAS,iBAAiB,cACzC,QACE,aACA,kGACF;EAEF,MAAM,6BAA6B;GACjC;GACA,WAAW;GACX,UAAU,MAAM,8BAA8B,OAAO,QAAQ;EAC/D,CAAC;EACD,OAAO;CACT,CAAC,GACgD,GAAG;AACtD;AAEA,eAAsB,wBAAwB,OAM5B;CAChB,MAAM,sCAAsC,YAAY;EACtD,MAAM,UAAU,MAAM,yCAAyC;EAC/D,MAAM,WAAW,MAAM,0BAA0B;EACjD,MAAM,QAAQ,MAAM,uBAAuB;EAC3C,IACE,EAAE,YAAY,UACd,MAAM,QAAQ,QAAQ,OACtB,SAAS,eAAe,MAAM,sBAC9B,SAAS,gBAAgB,MAAM,eAC/B,SAAS,aAAa,MAAM,UAE5B,QACE,qBACA,4FACF;EAEF,MAAM,6BAA6B;GACjC,IAAI,MAAM;GACV,WAAW;GACX,UAAU,MAAM,8BAA8B,SAAS,QAAQ;GAC/D,QAAQ,MAAM;EAChB,CAAC;CACH,CAAC;AACH"}

package/dist/{service-account-control-DCz_pwrV.js → service-account-control-BQ1e5Y1X.js}

@@ -1,19 +1,19 @@
 #!/usr/bin/env node
 
-import { A as reserveServiceAccountAdmission, E as ServiceAccountAdmissionError, O as cancelServiceAccountAdmission, d as getAuthSessionState, j as withAuthSessionTransitionMutationLock, k as readServiceAccountAdmission, o as buildStoredAuthSessionIdentity, w as withAdmittedServiceSession, y as readServiceAdmissionSessionWithOwnership } from "./auth-session-BAq7KkIa.js";
-import { T as createQuietPresenter, d as runDaemonServiceDetached, m as runDaemonStop, mt as fetchAuthUserSnapshot } from "./service-BlcIfxYE.js";
+import { A as reserveServiceAccountAdmission, E as ServiceAccountAdmissionError, O as cancelServiceAccountAdmission, d as getAuthSessionState, j as withAuthSessionTransitionMutationLock, k as readServiceAccountAdmission, o as buildStoredAuthSessionIdentity, w as withAdmittedServiceSession, y as readServiceAdmissionSessionWithOwnership } from "./auth-session-CDhQANWx.js";
+import { T as createQuietPresenter, d as runDaemonServiceDetached, m as runDaemonStop, mt as fetchAuthUserSnapshot } from "./service-yziCG6lR.js";
 import { r as serviceAccountControlRequestSchema } from "./service-account-admission-Dy2W3n3_.js";
-import "./daemon-device-id-bP58j3NL.js";
+import "./daemon-device-id-YnLMx1kN.js";
 import { r as readDaemonRuntimeLease } from "./daemon-runtime-lease-BUr4qsLo.js";
-import { r as readCurrentDaemonRuntimeContext } from "./daemon-service-runtime-686fUcq9.js";
-import { Ht as buildDaemonSystemServiceCommandSpec } from "./daemon-service-update-coordinator-DaoVYK6k.js";
+import { r as readCurrentDaemonRuntimeContext } from "./daemon-service-runtime-M-kfrWro.js";
+import { Ht as buildDaemonSystemServiceCommandSpec } from "./daemon-service-update-coordinator-Clqxj3A1.js";
 import { i as readProcessStartIdentity } from "./process-identity-CNus0e6E.js";
 import { K as withDaemonServiceRunLock } from "./daemon-state-B44aq2nm.js";
 import { a as upsertDaemonServiceContract, i as readDaemonServiceContract } from "./daemon-service-contract-BpOBMGX0.js";
-import { n as resolveServiceAccountIdentity } from "./service-account-authorization-A5Ly0UFD.js";
-import { S as requestLocalDaemonShutdown, y as LocalDaemonControlPlaneClientError } from "./daemon-lifecycle-journal-57QR_a3_.js";
-import { S as resolveDaemonServiceManager } from "./daemon-service-manager-rNRRVrj1.js";
-import { n as resolveRuntimeContext } from "./context-DN_LvdgC.js";
+import { n as resolveServiceAccountIdentity } from "./service-account-authorization-DAPQy2yP.js";
+import { S as requestLocalDaemonShutdown, y as LocalDaemonControlPlaneClientError } from "./daemon-lifecycle-journal-DDrWgEzN.js";
+import { S as resolveDaemonServiceManager } from "./daemon-service-manager-HL4VKbIU.js";
+import { n as resolveRuntimeContext } from "./context-D9Ebb5wl.js";
 import { setTimeout } from "node:timers/promises";
 //#region src/commands/service-account-control.ts
 function refused(reason, message) {
@@ -145,4 +145,4 @@ async function requestAccountCheckedServiceStop({ id, manager }) {
 //#endregion
 export { runServiceAccountControl as t };
 
-//# sourceMappingURL=service-account-control-DCz_pwrV.js.map
+//# sourceMappingURL=service-account-control-BQ1e5Y1X.js.map

package/dist/{service-account-control-DCz_pwrV.js.map → service-account-control-BQ1e5Y1X.js.map}

@@ -1 +1 @@
-{"version":3,"file":"service-account-control-DCz_pwrV.js","names":["delay"],"sources":["../src/commands/service-account-control.ts"],"sourcesContent":["import { setTimeout as delay } from \"node:timers/promises\";\nimport {\n  SERVICE_ACCOUNT_STOP_REFUSED_CODE,\n  type ServiceAccountControlRequest,\n  serviceAccountControlRequestSchema,\n} from \"@openmeld/schemas\";\nimport {\n  buildStoredAuthSessionIdentity,\n  getAuthSessionState,\n  readServiceAdmissionSessionWithOwnership,\n  type StoredAuthSession,\n  withAdmittedServiceSession,\n} from \"../config/auth-session\";\nimport { withAuthSessionTransitionMutationLock } from \"../config/auth-session-transition-lock\";\nimport { readDaemonRuntimeLease } from \"../config/daemon-runtime-lease\";\nimport {\n  readDaemonServiceContract,\n  upsertDaemonServiceContract,\n} from \"../config/daemon-service-contract\";\nimport { withDaemonServiceRunLock } from \"../config/daemon-state\";\nimport {\n  cancelServiceAccountAdmission,\n  readServiceAccountAdmission,\n  reserveServiceAccountAdmission,\n  ServiceAccountAdmissionError,\n} from \"../config/service-account-admission\";\nimport {\n  LocalDaemonControlPlaneClientError,\n  requestLocalDaemonShutdown,\n} from \"../local-service/control-plane/client\";\nimport { CONTROLLED_SHUTDOWN_REQUEST_TIMEOUT_MS } from \"../local-service/core/constants\";\nimport { buildDaemonSystemServiceCommandSpec } from \"../local-service/lifecycle/daemon-service-command-spec\";\nimport {\n  type DaemonServiceManager,\n  resolveDaemonServiceManager,\n} from \"../local-service/lifecycle/daemon-service-manager\";\nimport { readCurrentDaemonRuntimeContext } from \"../local-service/lifecycle/daemon-service-runtime\";\nimport { resolveServiceAccountIdentity } from \"../local-service/lifecycle/service-account-authorization\";\nimport { resolveRuntimeContext } from \"../runtime/context\";\nimport { readProcessStartIdentity } from \"../system/process-identity\";\nimport { fetchAuthUserSnapshot } from \"./auth-device-session-client\";\nimport { runDaemonServiceDetached, runDaemonStop } from \"./service\";\nimport { createQuietPresenter } from \"./service-output\";\n\ntype Contract = NonNullable<\n  Awaited<ReturnType<typeof readDaemonServiceContract>>\n>;\n\nfunction refused(reason: string, message: string): never {\n  throw new ServiceAccountAdmissionError(reason, message);\n}\n\nexport async function runServiceAccountControl(\n  request: ServiceAccountControlRequest,\n  expectedSessionIdentity?: string\n): Promise<void> {\n  const parsed = serviceAccountControlRequestSchema.safeParse(request);\n  if (!parsed.success) {\n    refused(\n      \"missing_account\",\n      \"Choose a signed-in account before controlling this Service.\"\n    );\n  }\n  const input = parsed.data;\n  const auth = await getAuthSessionState();\n  if (auth.state !== \"valid\" || !auth.session) {\n    refused(\n      \"authentication_required\",\n      \"Sign in to the CLI with the matching account and try again.\"\n    );\n  }\n  const preparedSession = auth.session;\n  if (preparedSession.user?.id !== input.expectedAccount) {\n    refused(\n      \"account_mismatch\",\n      \"The CLI is signed in to a different account. Sign in with the matching account and try again.\"\n    );\n  }\n  // The shared Auth endpoint proves the principal. Local metadata alone does not.\n  const user = await fetchAuthUserSnapshot({\n    authBaseUrl: preparedSession.authBaseUrl,\n    accessToken: preparedSession.accessToken,\n  });\n  if (user.id !== input.expectedAccount) {\n    refused(\n      \"account_mismatch\",\n      \"The CLI session belongs to a different account. Sign in again and retry.\"\n    );\n  }\n\n  await withDaemonServiceRunLock(async () => {\n    const contract = await readDaemonServiceContract();\n    if (!contract) {\n      refused(\n        \"ownership_unknown\",\n        \"Connect this computer through OpenMeld setup before controlling its Service.\"\n      );\n    }\n    const observed = await readCurrentDaemonRuntimeContext();\n    const lease = await readDaemonRuntimeLease();\n    if (\n      input.operation === \"start\" &&\n      observed.effectiveRuntimeStatus !== \"not_running\"\n    ) {\n      refused(\n        \"busy\",\n        \"The Service is already running or its state is uncertain. Check Service status before trying again.\"\n      );\n    }\n    if (\n      input.operation === \"stop\" &&\n      (observed.effectiveRuntimeStatus !== \"running\" ||\n        !lease ||\n        lease.generation !== contract.generation)\n    ) {\n      refused(\n        \"ownership_unknown\",\n        \"OpenMeld could not verify the running Service. Check Service status before trying again.\"\n      );\n    }\n\n    let boundSession: StoredAuthSession = preparedSession;\n    const reservation = await withAuthSessionTransitionMutationLock(\n      async () => {\n        boundSession = await readServiceAdmissionSessionWithOwnership();\n        if (\n          (expectedSessionIdentity !== undefined &&\n            buildStoredAuthSessionIdentity(boundSession) !==\n              expectedSessionIdentity) ||\n          boundSession.accessToken !== preparedSession.accessToken ||\n          boundSession.createdAt !== preparedSession.createdAt ||\n          boundSession.user?.id !== input.expectedAccount\n        ) {\n          refused(\n            \"account_changed\",\n            \"The CLI sign-in changed before this action was accepted. Check the account and try again.\"\n          );\n        }\n        const current = await readDaemonServiceContract();\n        if (!current || JSON.stringify(current) !== JSON.stringify(contract)) {\n          refused(\n            \"ownership_changed\",\n            \"The Service changed before this action was accepted. Check its status and try again.\"\n          );\n        }\n        const identity = await resolveServiceAccountIdentity(\n          boundSession,\n          contract\n        );\n        if (\n          input.operation === \"start\" &&\n          contract.desiredState !== \"background\"\n        ) {\n          identity.contractGeneration += 1;\n        }\n        return await reserveServiceAccountAdmission({\n          operation: input.operation,\n          identity,\n          ...(input.operation === \"stop\" && lease\n            ? {\n                target: {\n                  ownerPid: lease.pid,\n                  ownerProcessStartedAt:\n                    readProcessStartIdentity(lease.pid) ??\n                    refused(\n                      \"ownership_unknown\",\n                      \"OpenMeld could not identify the Service process. Check its status and try again.\"\n                    ),\n                },\n              }\n            : {}),\n        });\n      }\n    );\n\n    try {\n      await withAdmittedServiceSession(boundSession, async () => {\n        if (input.operation === \"stop\") {\n          await stopReservedService(contract, reservation.id, lease?.pid ?? 0);\n          return;\n        }\n        const manager =\n          contract.serviceController === \"legacy-detached\"\n            ? null\n            : await resolveDaemonServiceManager(contract.serviceController);\n        if (\n          contract.serviceController !== \"legacy-detached\" &&\n          !(manager && (await manager.status()).installed)\n        ) {\n          refused(\n            \"installation_required\",\n            \"This Service needs setup before it can start. Run OpenMeld setup and try again.\"\n          );\n        }\n        await upsertDaemonServiceContract({\n          ...contract,\n          desiredState: \"background\",\n        });\n        if (contract.serviceController === \"legacy-detached\") {\n          const runtime = await resolveRuntimeContext({ view: \"agent\" });\n          await runDaemonServiceDetached({\n            accountAdmissionId: reservation.id,\n            deviceId: contract.deviceId,\n            gatewayUrl: contract.gatewayUrl,\n            heartbeatMs: contract.heartbeatMs,\n            runtime,\n            presenter: createQuietPresenter(runtime),\n            mode: \"background\",\n          });\n        } else if (manager) {\n          // Refresh the existing stopped supervisor definition with an immutable\n          // generation argument. Never install a missing Service.\n          await manager.deactivate();\n          await manager.install(\n            buildDaemonSystemServiceCommandSpec({\n              controller: manager.controller,\n              accountAdmissionId: reservation.id,\n            })\n          );\n          await manager.start();\n        }\n        await waitForAdmittedService(reservation.id);\n      });\n    } finally {\n      await cancelServiceAccountAdmission(reservation.id);\n    }\n  });\n}\n\nasync function waitForAdmittedService(id: string): Promise<void> {\n  const deadline = Date.now() + 15_000;\n  while (Date.now() < deadline) {\n    const current = await readServiceAccountAdmission();\n    const runtime = await readCurrentDaemonRuntimeContext();\n    if (\n      current?.id === id &&\n      current.state === \"admitted\" &&\n      current.carrier?.ownerPid === runtime.runtimeStatus.pid &&\n      runtime.effectiveRuntimeStatus === \"running\"\n    ) {\n      return;\n    }\n    await delay(50);\n  }\n  refused(\n    \"startup_unconfirmed\",\n    \"OpenMeld could not confirm that this Service started. Check Service status before trying again.\"\n  );\n}\n\nasync function stopReservedService(\n  contract: Contract,\n  id: string,\n  pid: number\n): Promise<void> {\n  const manager =\n    contract.serviceController === \"legacy-detached\"\n      ? null\n      : await resolveDaemonServiceManager(contract.serviceController);\n  await requestAccountCheckedServiceStop({ id, manager });\n  const admitted = await readServiceAccountAdmission();\n  if (\n    admitted?.id !== id ||\n    admitted.state !== \"admitted\" ||\n    admitted.carrier?.ownerPid !== pid\n  ) {\n    refused(\n      \"admission_unconfirmed\",\n      \"OpenMeld could not verify that the matching Service accepted Stop. Check Service status before trying again.\"\n    );\n  }\n  const current = await readCurrentDaemonRuntimeContext();\n  if (current.runtimeStatus.pid !== null && current.runtimeStatus.pid !== pid) {\n    refused(\n      \"ownership_changed\",\n      \"Another Service instance is now running. Its state was left unchanged.\"\n    );\n  }\n  await runDaemonStop(\n    { json: true, view: \"agent\" },\n    {\n      completedControlledShutdownOwnerPid: pid,\n    }\n  );\n}\n\nexport async function requestAccountCheckedServiceStop({\n  id,\n  manager,\n}: {\n  id: string;\n  manager: Pick<\n    DaemonServiceManager,\n    \"status\" | \"disableAutostart\" | \"enableAutostart\"\n  > | null;\n}): Promise<void> {\n  const wasEnabled = manager ? (await manager.status()).enabled : false;\n  if (manager) {\n    await manager.disableAutostart();\n  }\n  // No compatibility fallback: only the verified carrier may admit this stop.\n  try {\n    const shutdown = await requestLocalDaemonShutdown({\n      payload: {\n        accountAdmissionId: id,\n        mode: \"graceful\",\n        gracePeriodMs: 2000,\n      },\n      timeoutMs: CONTROLLED_SHUTDOWN_REQUEST_TIMEOUT_MS,\n    });\n    if (!shutdown.accepted) {\n      throw new Error(\"The Service did not confirm controlled shutdown.\");\n    }\n  } catch (error) {\n    if (\n      manager &&\n      wasEnabled &&\n      error instanceof LocalDaemonControlPlaneClientError &&\n      error.code === SERVICE_ACCOUNT_STOP_REFUSED_CODE\n    ) {\n      try {\n        await manager.enableAutostart();\n      } catch (restoreError) {\n        throw new AggregateError(\n          [error, restoreError],\n          \"Stop was refused and its previous autostart setting could not be restored.\"\n        );\n      }\n    }\n    if (\n      !(\n        error instanceof LocalDaemonControlPlaneClientError &&\n        error.code === SERVICE_ACCOUNT_STOP_REFUSED_CODE\n      )\n    ) {\n      const detail = error instanceof Error ? error.message : String(error);\n      refused(\n        \"stop_unconfirmed\",\n        `Stop may already be in progress. ${manager ? \"Autostart remains disabled. \" : \"\"}Check Service status before trying again. ${detail}`\n      );\n    }\n    throw error;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAgDA,SAAS,QAAQ,QAAgB,SAAwB;CACvD,MAAM,IAAI,6BAA6B,QAAQ,OAAO;AACxD;AAEA,eAAsB,yBACpB,SACA,yBACe;CACf,MAAM,SAAS,mCAAmC,UAAU,OAAO;CACnE,IAAI,CAAC,OAAO,SACV,QACE,mBACA,6DACF;CAEF,MAAM,QAAQ,OAAO;CACrB,MAAM,OAAO,MAAM,oBAAoB;CACvC,IAAI,KAAK,UAAU,WAAW,CAAC,KAAK,SAClC,QACE,2BACA,6DACF;CAEF,MAAM,kBAAkB,KAAK;CAC7B,IAAI,gBAAgB,MAAM,OAAO,MAAM,iBACrC,QACE,oBACA,+FACF;CAOF,KAAI,MAJe,sBAAsB;EACvC,aAAa,gBAAgB;EAC7B,aAAa,gBAAgB;CAC/B,CAAC,EAAA,CACQ,OAAO,MAAM,iBACpB,QACE,oBACA,0EACF;CAGF,MAAM,yBAAyB,YAAY;EACzC,MAAM,WAAW,MAAM,0BAA0B;EACjD,IAAI,CAAC,UACH,QACE,qBACA,8EACF;EAEF,MAAM,WAAW,MAAM,gCAAgC;EACvD,MAAM,QAAQ,MAAM,uBAAuB;EAC3C,IACE,MAAM,cAAc,WACpB,SAAS,2BAA2B,eAEpC,QACE,QACA,qGACF;EAEF,IACE,MAAM,cAAc,WACnB,SAAS,2BAA2B,aACnC,CAAC,SACD,MAAM,eAAe,SAAS,aAEhC,QACE,qBACA,0FACF;EAGF,IAAI,eAAkC;EACtC,MAAM,cAAc,MAAM,sCACxB,YAAY;GACV,eAAe,MAAM,yCAAyC;GAC9D,IACG,4BAA4B,KAAA,KAC3B,+BAA+B,YAAY,MACzC,2BACJ,aAAa,gBAAgB,gBAAgB,eAC7C,aAAa,cAAc,gBAAgB,aAC3C,aAAa,MAAM,OAAO,MAAM,iBAEhC,QACE,mBACA,2FACF;GAEF,MAAM,UAAU,MAAM,0BAA0B;GAChD,IAAI,CAAC,WAAW,KAAK,UAAU,OAAO,MAAM,KAAK,UAAU,QAAQ,GACjE,QACE,qBACA,sFACF;GAEF,MAAM,WAAW,MAAM,8BACrB,cACA,QACF;GACA,IACE,MAAM,cAAc,WACpB,SAAS,iBAAiB,cAE1B,SAAS,sBAAsB;GAEjC,OAAO,MAAM,+BAA+B;IAC1C,WAAW,MAAM;IACjB;IACA,GAAI,MAAM,cAAc,UAAU,QAC9B,EACE,QAAQ;KACN,UAAU,MAAM;KAChB,uBACE,yBAAyB,MAAM,GAAG,KAClC,QACE,qBACA,kFACF;IACJ,EACF,IACA,CAAC;GACP,CAAC;EACH,CACF;EAEA,IAAI;GACF,MAAM,2BAA2B,cAAc,YAAY;IACzD,IAAI,MAAM,cAAc,QAAQ;KAC9B,MAAM,oBAAoB,UAAU,YAAY,IAAI,OAAO,OAAO,CAAC;KACnE;IACF;IACA,MAAM,UACJ,SAAS,sBAAsB,oBAC3B,OACA,MAAM,4BAA4B,SAAS,iBAAiB;IAClE,IACE,SAAS,sBAAsB,qBAC/B,EAAE,YAAY,MAAM,QAAQ,OAAO,EAAA,CAAG,YAEtC,QACE,yBACA,iFACF;IAEF,MAAM,4BAA4B;KAChC,GAAG;KACH,cAAc;IAChB,CAAC;IACD,IAAI,SAAS,sBAAsB,mBAAmB;KACpD,MAAM,UAAU,MAAM,sBAAsB,EAAE,MAAM,QAAQ,CAAC;KAC7D,MAAM,yBAAyB;MAC7B,oBAAoB,YAAY;MAChC,UAAU,SAAS;MACnB,YAAY,SAAS;MACrB,aAAa,SAAS;MACtB;MACA,WAAW,qBAAqB,OAAO;MACvC,MAAM;KACR,CAAC;IACH,OAAO,IAAI,SAAS;KAGlB,MAAM,QAAQ,WAAW;KACzB,MAAM,QAAQ,QACZ,oCAAoC;MAClC,YAAY,QAAQ;MACpB,oBAAoB,YAAY;KAClC,CAAC,CACH;KACA,MAAM,QAAQ,MAAM;IACtB;IACA,MAAM,uBAAuB,YAAY,EAAE;GAC7C,CAAC;EACH,UAAU;GACR,MAAM,8BAA8B,YAAY,EAAE;EACpD;CACF,CAAC;AACH;AAEA,eAAe,uBAAuB,IAA2B;CAC/D,MAAM,WAAW,KAAK,IAAI,IAAI;CAC9B,OAAO,KAAK,IAAI,IAAI,UAAU;EAC5B,MAAM,UAAU,MAAM,4BAA4B;EAClD,MAAM,UAAU,MAAM,gCAAgC;EACtD,IACE,SAAS,OAAO,MAChB,QAAQ,UAAU,cAClB,QAAQ,SAAS,aAAa,QAAQ,cAAc,OACpD,QAAQ,2BAA2B,WAEnC;EAEF,MAAMA,WAAM,EAAE;CAChB;CACA,QACE,uBACA,iGACF;AACF;AAEA,eAAe,oBACb,UACA,IACA,KACe;CAKf,MAAM,iCAAiC;EAAE;EAAI,SAH3C,SAAS,sBAAsB,oBAC3B,OACA,MAAM,4BAA4B,SAAS,iBAAiB;CACb,CAAC;CACtD,MAAM,WAAW,MAAM,4BAA4B;CACnD,IACE,UAAU,OAAO,MACjB,SAAS,UAAU,cACnB,SAAS,SAAS,aAAa,KAE/B,QACE,yBACA,8GACF;CAEF,MAAM,UAAU,MAAM,gCAAgC;CACtD,IAAI,QAAQ,cAAc,QAAQ,QAAQ,QAAQ,cAAc,QAAQ,KACtE,QACE,qBACA,wEACF;CAEF,MAAM,cACJ;EAAE,MAAM;EAAM,MAAM;CAAQ,GAC5B,EACE,qCAAqC,IACvC,CACF;AACF;AAEA,eAAsB,iCAAiC,EACrD,IACA,WAOgB;CAChB,MAAM,aAAa,WAAW,MAAM,QAAQ,OAAO,EAAA,CAAG,UAAU;CAChE,IAAI,SACF,MAAM,QAAQ,iBAAiB;CAGjC,IAAI;EASF,IAAI,EAAC,MARkB,2BAA2B;GAChD,SAAS;IACP,oBAAoB;IACpB,MAAM;IACN,eAAe;GACjB;GACA,WAAA;EACF,CAAC,EAAA,CACa,UACZ,MAAM,IAAI,MAAM,kDAAkD;CAEtE,SAAS,OAAO;EACd,IACE,WACA,cACA,iBAAiB,sCACjB,MAAM,SAAA,0CAEN,IAAI;GACF,MAAM,QAAQ,gBAAgB;EAChC,SAAS,cAAc;GACrB,MAAM,IAAI,eACR,CAAC,OAAO,YAAY,GACpB,4EACF;EACF;EAEF,IACE,EACE,iBAAiB,sCACjB,MAAM,SAAA,2CAER;GACA,MAAM,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GACpE,QACE,oBACA,oCAAoC,UAAU,iCAAiC,GAAG,4CAA4C,QAChI;EACF;EACA,MAAM;CACR;AACF"}
+{"version":3,"file":"service-account-control-BQ1e5Y1X.js","names":["delay"],"sources":["../src/commands/service-account-control.ts"],"sourcesContent":["import { setTimeout as delay } from \"node:timers/promises\";\nimport {\n  SERVICE_ACCOUNT_STOP_REFUSED_CODE,\n  type ServiceAccountControlRequest,\n  serviceAccountControlRequestSchema,\n} from \"@openmeld/schemas\";\nimport {\n  buildStoredAuthSessionIdentity,\n  getAuthSessionState,\n  readServiceAdmissionSessionWithOwnership,\n  type StoredAuthSession,\n  withAdmittedServiceSession,\n} from \"../config/auth-session\";\nimport { withAuthSessionTransitionMutationLock } from \"../config/auth-session-transition-lock\";\nimport { readDaemonRuntimeLease } from \"../config/daemon-runtime-lease\";\nimport {\n  readDaemonServiceContract,\n  upsertDaemonServiceContract,\n} from \"../config/daemon-service-contract\";\nimport { withDaemonServiceRunLock } from \"../config/daemon-state\";\nimport {\n  cancelServiceAccountAdmission,\n  readServiceAccountAdmission,\n  reserveServiceAccountAdmission,\n  ServiceAccountAdmissionError,\n} from \"../config/service-account-admission\";\nimport {\n  LocalDaemonControlPlaneClientError,\n  requestLocalDaemonShutdown,\n} from \"../local-service/control-plane/client\";\nimport { CONTROLLED_SHUTDOWN_REQUEST_TIMEOUT_MS } from \"../local-service/core/constants\";\nimport { buildDaemonSystemServiceCommandSpec } from \"../local-service/lifecycle/daemon-service-command-spec\";\nimport {\n  type DaemonServiceManager,\n  resolveDaemonServiceManager,\n} from \"../local-service/lifecycle/daemon-service-manager\";\nimport { readCurrentDaemonRuntimeContext } from \"../local-service/lifecycle/daemon-service-runtime\";\nimport { resolveServiceAccountIdentity } from \"../local-service/lifecycle/service-account-authorization\";\nimport { resolveRuntimeContext } from \"../runtime/context\";\nimport { readProcessStartIdentity } from \"../system/process-identity\";\nimport { fetchAuthUserSnapshot } from \"./auth-device-session-client\";\nimport { runDaemonServiceDetached, runDaemonStop } from \"./service\";\nimport { createQuietPresenter } from \"./service-output\";\n\ntype Contract = NonNullable<\n  Awaited<ReturnType<typeof readDaemonServiceContract>>\n>;\n\nfunction refused(reason: string, message: string): never {\n  throw new ServiceAccountAdmissionError(reason, message);\n}\n\nexport async function runServiceAccountControl(\n  request: ServiceAccountControlRequest,\n  expectedSessionIdentity?: string\n): Promise<void> {\n  const parsed = serviceAccountControlRequestSchema.safeParse(request);\n  if (!parsed.success) {\n    refused(\n      \"missing_account\",\n      \"Choose a signed-in account before controlling this Service.\"\n    );\n  }\n  const input = parsed.data;\n  const auth = await getAuthSessionState();\n  if (auth.state !== \"valid\" || !auth.session) {\n    refused(\n      \"authentication_required\",\n      \"Sign in to the CLI with the matching account and try again.\"\n    );\n  }\n  const preparedSession = auth.session;\n  if (preparedSession.user?.id !== input.expectedAccount) {\n    refused(\n      \"account_mismatch\",\n      \"The CLI is signed in to a different account. Sign in with the matching account and try again.\"\n    );\n  }\n  // The shared Auth endpoint proves the principal. Local metadata alone does not.\n  const user = await fetchAuthUserSnapshot({\n    authBaseUrl: preparedSession.authBaseUrl,\n    accessToken: preparedSession.accessToken,\n  });\n  if (user.id !== input.expectedAccount) {\n    refused(\n      \"account_mismatch\",\n      \"The CLI session belongs to a different account. Sign in again and retry.\"\n    );\n  }\n\n  await withDaemonServiceRunLock(async () => {\n    const contract = await readDaemonServiceContract();\n    if (!contract) {\n      refused(\n        \"ownership_unknown\",\n        \"Connect this computer through OpenMeld setup before controlling its Service.\"\n      );\n    }\n    const observed = await readCurrentDaemonRuntimeContext();\n    const lease = await readDaemonRuntimeLease();\n    if (\n      input.operation === \"start\" &&\n      observed.effectiveRuntimeStatus !== \"not_running\"\n    ) {\n      refused(\n        \"busy\",\n        \"The Service is already running or its state is uncertain. Check Service status before trying again.\"\n      );\n    }\n    if (\n      input.operation === \"stop\" &&\n      (observed.effectiveRuntimeStatus !== \"running\" ||\n        !lease ||\n        lease.generation !== contract.generation)\n    ) {\n      refused(\n        \"ownership_unknown\",\n        \"OpenMeld could not verify the running Service. Check Service status before trying again.\"\n      );\n    }\n\n    let boundSession: StoredAuthSession = preparedSession;\n    const reservation = await withAuthSessionTransitionMutationLock(\n      async () => {\n        boundSession = await readServiceAdmissionSessionWithOwnership();\n        if (\n          (expectedSessionIdentity !== undefined &&\n            buildStoredAuthSessionIdentity(boundSession) !==\n              expectedSessionIdentity) ||\n          boundSession.accessToken !== preparedSession.accessToken ||\n          boundSession.createdAt !== preparedSession.createdAt ||\n          boundSession.user?.id !== input.expectedAccount\n        ) {\n          refused(\n            \"account_changed\",\n            \"The CLI sign-in changed before this action was accepted. Check the account and try again.\"\n          );\n        }\n        const current = await readDaemonServiceContract();\n        if (!current || JSON.stringify(current) !== JSON.stringify(contract)) {\n          refused(\n            \"ownership_changed\",\n            \"The Service changed before this action was accepted. Check its status and try again.\"\n          );\n        }\n        const identity = await resolveServiceAccountIdentity(\n          boundSession,\n          contract\n        );\n        if (\n          input.operation === \"start\" &&\n          contract.desiredState !== \"background\"\n        ) {\n          identity.contractGeneration += 1;\n        }\n        return await reserveServiceAccountAdmission({\n          operation: input.operation,\n          identity,\n          ...(input.operation === \"stop\" && lease\n            ? {\n                target: {\n                  ownerPid: lease.pid,\n                  ownerProcessStartedAt:\n                    readProcessStartIdentity(lease.pid) ??\n                    refused(\n                      \"ownership_unknown\",\n                      \"OpenMeld could not identify the Service process. Check its status and try again.\"\n                    ),\n                },\n              }\n            : {}),\n        });\n      }\n    );\n\n    try {\n      await withAdmittedServiceSession(boundSession, async () => {\n        if (input.operation === \"stop\") {\n          await stopReservedService(contract, reservation.id, lease?.pid ?? 0);\n          return;\n        }\n        const manager =\n          contract.serviceController === \"legacy-detached\"\n            ? null\n            : await resolveDaemonServiceManager(contract.serviceController);\n        if (\n          contract.serviceController !== \"legacy-detached\" &&\n          !(manager && (await manager.status()).installed)\n        ) {\n          refused(\n            \"installation_required\",\n            \"This Service needs setup before it can start. Run OpenMeld setup and try again.\"\n          );\n        }\n        await upsertDaemonServiceContract({\n          ...contract,\n          desiredState: \"background\",\n        });\n        if (contract.serviceController === \"legacy-detached\") {\n          const runtime = await resolveRuntimeContext({ view: \"agent\" });\n          await runDaemonServiceDetached({\n            accountAdmissionId: reservation.id,\n            deviceId: contract.deviceId,\n            gatewayUrl: contract.gatewayUrl,\n            heartbeatMs: contract.heartbeatMs,\n            runtime,\n            presenter: createQuietPresenter(runtime),\n            mode: \"background\",\n          });\n        } else if (manager) {\n          // Refresh the existing stopped supervisor definition with an immutable\n          // generation argument. Never install a missing Service.\n          await manager.deactivate();\n          await manager.install(\n            buildDaemonSystemServiceCommandSpec({\n              controller: manager.controller,\n              accountAdmissionId: reservation.id,\n            })\n          );\n          await manager.start();\n        }\n        await waitForAdmittedService(reservation.id);\n      });\n    } finally {\n      await cancelServiceAccountAdmission(reservation.id);\n    }\n  });\n}\n\nasync function waitForAdmittedService(id: string): Promise<void> {\n  const deadline = Date.now() + 15_000;\n  while (Date.now() < deadline) {\n    const current = await readServiceAccountAdmission();\n    const runtime = await readCurrentDaemonRuntimeContext();\n    if (\n      current?.id === id &&\n      current.state === \"admitted\" &&\n      current.carrier?.ownerPid === runtime.runtimeStatus.pid &&\n      runtime.effectiveRuntimeStatus === \"running\"\n    ) {\n      return;\n    }\n    await delay(50);\n  }\n  refused(\n    \"startup_unconfirmed\",\n    \"OpenMeld could not confirm that this Service started. Check Service status before trying again.\"\n  );\n}\n\nasync function stopReservedService(\n  contract: Contract,\n  id: string,\n  pid: number\n): Promise<void> {\n  const manager =\n    contract.serviceController === \"legacy-detached\"\n      ? null\n      : await resolveDaemonServiceManager(contract.serviceController);\n  await requestAccountCheckedServiceStop({ id, manager });\n  const admitted = await readServiceAccountAdmission();\n  if (\n    admitted?.id !== id ||\n    admitted.state !== \"admitted\" ||\n    admitted.carrier?.ownerPid !== pid\n  ) {\n    refused(\n      \"admission_unconfirmed\",\n      \"OpenMeld could not verify that the matching Service accepted Stop. Check Service status before trying again.\"\n    );\n  }\n  const current = await readCurrentDaemonRuntimeContext();\n  if (current.runtimeStatus.pid !== null && current.runtimeStatus.pid !== pid) {\n    refused(\n      \"ownership_changed\",\n      \"Another Service instance is now running. Its state was left unchanged.\"\n    );\n  }\n  await runDaemonStop(\n    { json: true, view: \"agent\" },\n    {\n      completedControlledShutdownOwnerPid: pid,\n    }\n  );\n}\n\nexport async function requestAccountCheckedServiceStop({\n  id,\n  manager,\n}: {\n  id: string;\n  manager: Pick<\n    DaemonServiceManager,\n    \"status\" | \"disableAutostart\" | \"enableAutostart\"\n  > | null;\n}): Promise<void> {\n  const wasEnabled = manager ? (await manager.status()).enabled : false;\n  if (manager) {\n    await manager.disableAutostart();\n  }\n  // No compatibility fallback: only the verified carrier may admit this stop.\n  try {\n    const shutdown = await requestLocalDaemonShutdown({\n      payload: {\n        accountAdmissionId: id,\n        mode: \"graceful\",\n        gracePeriodMs: 2000,\n      },\n      timeoutMs: CONTROLLED_SHUTDOWN_REQUEST_TIMEOUT_MS,\n    });\n    if (!shutdown.accepted) {\n      throw new Error(\"The Service did not confirm controlled shutdown.\");\n    }\n  } catch (error) {\n    if (\n      manager &&\n      wasEnabled &&\n      error instanceof LocalDaemonControlPlaneClientError &&\n      error.code === SERVICE_ACCOUNT_STOP_REFUSED_CODE\n    ) {\n      try {\n        await manager.enableAutostart();\n      } catch (restoreError) {\n        throw new AggregateError(\n          [error, restoreError],\n          \"Stop was refused and its previous autostart setting could not be restored.\"\n        );\n      }\n    }\n    if (\n      !(\n        error instanceof LocalDaemonControlPlaneClientError &&\n        error.code === SERVICE_ACCOUNT_STOP_REFUSED_CODE\n      )\n    ) {\n      const detail = error instanceof Error ? error.message : String(error);\n      refused(\n        \"stop_unconfirmed\",\n        `Stop may already be in progress. ${manager ? \"Autostart remains disabled. \" : \"\"}Check Service status before trying again. ${detail}`\n      );\n    }\n    throw error;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAgDA,SAAS,QAAQ,QAAgB,SAAwB;CACvD,MAAM,IAAI,6BAA6B,QAAQ,OAAO;AACxD;AAEA,eAAsB,yBACpB,SACA,yBACe;CACf,MAAM,SAAS,mCAAmC,UAAU,OAAO;CACnE,IAAI,CAAC,OAAO,SACV,QACE,mBACA,6DACF;CAEF,MAAM,QAAQ,OAAO;CACrB,MAAM,OAAO,MAAM,oBAAoB;CACvC,IAAI,KAAK,UAAU,WAAW,CAAC,KAAK,SAClC,QACE,2BACA,6DACF;CAEF,MAAM,kBAAkB,KAAK;CAC7B,IAAI,gBAAgB,MAAM,OAAO,MAAM,iBACrC,QACE,oBACA,+FACF;CAOF,KAAI,MAJe,sBAAsB;EACvC,aAAa,gBAAgB;EAC7B,aAAa,gBAAgB;CAC/B,CAAC,EAAA,CACQ,OAAO,MAAM,iBACpB,QACE,oBACA,0EACF;CAGF,MAAM,yBAAyB,YAAY;EACzC,MAAM,WAAW,MAAM,0BAA0B;EACjD,IAAI,CAAC,UACH,QACE,qBACA,8EACF;EAEF,MAAM,WAAW,MAAM,gCAAgC;EACvD,MAAM,QAAQ,MAAM,uBAAuB;EAC3C,IACE,MAAM,cAAc,WACpB,SAAS,2BAA2B,eAEpC,QACE,QACA,qGACF;EAEF,IACE,MAAM,cAAc,WACnB,SAAS,2BAA2B,aACnC,CAAC,SACD,MAAM,eAAe,SAAS,aAEhC,QACE,qBACA,0FACF;EAGF,IAAI,eAAkC;EACtC,MAAM,cAAc,MAAM,sCACxB,YAAY;GACV,eAAe,MAAM,yCAAyC;GAC9D,IACG,4BAA4B,KAAA,KAC3B,+BAA+B,YAAY,MACzC,2BACJ,aAAa,gBAAgB,gBAAgB,eAC7C,aAAa,cAAc,gBAAgB,aAC3C,aAAa,MAAM,OAAO,MAAM,iBAEhC,QACE,mBACA,2FACF;GAEF,MAAM,UAAU,MAAM,0BAA0B;GAChD,IAAI,CAAC,WAAW,KAAK,UAAU,OAAO,MAAM,KAAK,UAAU,QAAQ,GACjE,QACE,qBACA,sFACF;GAEF,MAAM,WAAW,MAAM,8BACrB,cACA,QACF;GACA,IACE,MAAM,cAAc,WACpB,SAAS,iBAAiB,cAE1B,SAAS,sBAAsB;GAEjC,OAAO,MAAM,+BAA+B;IAC1C,WAAW,MAAM;IACjB;IACA,GAAI,MAAM,cAAc,UAAU,QAC9B,EACE,QAAQ;KACN,UAAU,MAAM;KAChB,uBACE,yBAAyB,MAAM,GAAG,KAClC,QACE,qBACA,kFACF;IACJ,EACF,IACA,CAAC;GACP,CAAC;EACH,CACF;EAEA,IAAI;GACF,MAAM,2BAA2B,cAAc,YAAY;IACzD,IAAI,MAAM,cAAc,QAAQ;KAC9B,MAAM,oBAAoB,UAAU,YAAY,IAAI,OAAO,OAAO,CAAC;KACnE;IACF;IACA,MAAM,UACJ,SAAS,sBAAsB,oBAC3B,OACA,MAAM,4BAA4B,SAAS,iBAAiB;IAClE,IACE,SAAS,sBAAsB,qBAC/B,EAAE,YAAY,MAAM,QAAQ,OAAO,EAAA,CAAG,YAEtC,QACE,yBACA,iFACF;IAEF,MAAM,4BAA4B;KAChC,GAAG;KACH,cAAc;IAChB,CAAC;IACD,IAAI,SAAS,sBAAsB,mBAAmB;KACpD,MAAM,UAAU,MAAM,sBAAsB,EAAE,MAAM,QAAQ,CAAC;KAC7D,MAAM,yBAAyB;MAC7B,oBAAoB,YAAY;MAChC,UAAU,SAAS;MACnB,YAAY,SAAS;MACrB,aAAa,SAAS;MACtB;MACA,WAAW,qBAAqB,OAAO;MACvC,MAAM;KACR,CAAC;IACH,OAAO,IAAI,SAAS;KAGlB,MAAM,QAAQ,WAAW;KACzB,MAAM,QAAQ,QACZ,oCAAoC;MAClC,YAAY,QAAQ;MACpB,oBAAoB,YAAY;KAClC,CAAC,CACH;KACA,MAAM,QAAQ,MAAM;IACtB;IACA,MAAM,uBAAuB,YAAY,EAAE;GAC7C,CAAC;EACH,UAAU;GACR,MAAM,8BAA8B,YAAY,EAAE;EACpD;CACF,CAAC;AACH;AAEA,eAAe,uBAAuB,IAA2B;CAC/D,MAAM,WAAW,KAAK,IAAI,IAAI;CAC9B,OAAO,KAAK,IAAI,IAAI,UAAU;EAC5B,MAAM,UAAU,MAAM,4BAA4B;EAClD,MAAM,UAAU,MAAM,gCAAgC;EACtD,IACE,SAAS,OAAO,MAChB,QAAQ,UAAU,cAClB,QAAQ,SAAS,aAAa,QAAQ,cAAc,OACpD,QAAQ,2BAA2B,WAEnC;EAEF,MAAMA,WAAM,EAAE;CAChB;CACA,QACE,uBACA,iGACF;AACF;AAEA,eAAe,oBACb,UACA,IACA,KACe;CAKf,MAAM,iCAAiC;EAAE;EAAI,SAH3C,SAAS,sBAAsB,oBAC3B,OACA,MAAM,4BAA4B,SAAS,iBAAiB;CACb,CAAC;CACtD,MAAM,WAAW,MAAM,4BAA4B;CACnD,IACE,UAAU,OAAO,MACjB,SAAS,UAAU,cACnB,SAAS,SAAS,aAAa,KAE/B,QACE,yBACA,8GACF;CAEF,MAAM,UAAU,MAAM,gCAAgC;CACtD,IAAI,QAAQ,cAAc,QAAQ,QAAQ,QAAQ,cAAc,QAAQ,KACtE,QACE,qBACA,wEACF;CAEF,MAAM,cACJ;EAAE,MAAM;EAAM,MAAM;CAAQ,GAC5B,EACE,qCAAqC,IACvC,CACF;AACF;AAEA,eAAsB,iCAAiC,EACrD,IACA,WAOgB;CAChB,MAAM,aAAa,WAAW,MAAM,QAAQ,OAAO,EAAA,CAAG,UAAU;CAChE,IAAI,SACF,MAAM,QAAQ,iBAAiB;CAGjC,IAAI;EASF,IAAI,EAAC,MARkB,2BAA2B;GAChD,SAAS;IACP,oBAAoB;IACpB,MAAM;IACN,eAAe;GACjB;GACA,WAAA;EACF,CAAC,EAAA,CACa,UACZ,MAAM,IAAI,MAAM,kDAAkD;CAEtE,SAAS,OAAO;EACd,IACE,WACA,cACA,iBAAiB,sCACjB,MAAM,SAAA,0CAEN,IAAI;GACF,MAAM,QAAQ,gBAAgB;EAChC,SAAS,cAAc;GACrB,MAAM,IAAI,eACR,CAAC,OAAO,YAAY,GACpB,4EACF;EACF;EAEF,IACE,EACE,iBAAiB,sCACjB,MAAM,SAAA,2CAER;GACA,MAAM,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GACpE,QACE,oBACA,oCAAoC,UAAU,iCAAiC,GAAG,4CAA4C,QAChI;EACF;EACA,MAAM;CACR;AACF"}

package/dist/{service-control-capabilities-plI5rUzP.js → service-control-capabilities-C4520NIi.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 
 import { a as serviceControlCarrierCapabilitySchema, i as serviceControlCapabilitiesSchema } from "./service-account-admission-Dy2W3n3_.js";
-import { M as resolveAlignedDaemonActiveBundleEntryPath, S as daemonServiceBinaryExecutablePath, j as readDaemonActiveBundleState, r as readCurrentDaemonRuntimeContext } from "./daemon-service-runtime-686fUcq9.js";
+import { M as resolveAlignedDaemonActiveBundleEntryPath, S as daemonServiceBinaryExecutablePath, j as readDaemonActiveBundleState, r as readCurrentDaemonRuntimeContext } from "./daemon-service-runtime-M-kfrWro.js";
 import { i as readDaemonServiceContract } from "./daemon-service-contract-BpOBMGX0.js";
-import { w as sendLocalDaemonControlPlaneRequest } from "./daemon-lifecycle-journal-57QR_a3_.js";
-import { S as resolveDaemonServiceManager } from "./daemon-service-manager-rNRRVrj1.js";
+import { w as sendLocalDaemonControlPlaneRequest } from "./daemon-lifecycle-journal-DDrWgEzN.js";
+import { S as resolveDaemonServiceManager } from "./daemon-service-manager-HL4VKbIU.js";
 import { realpath } from "node:fs/promises";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
@@ -69,4 +69,4 @@ async function readServiceControlCapabilities(platform = process.platform) {
 //#endregion
 export { readServiceControlCapabilities as t };
 
-//# sourceMappingURL=service-control-capabilities-plI5rUzP.js.map
+//# sourceMappingURL=service-control-capabilities-C4520NIi.js.map

package/dist/{service-control-capabilities-plI5rUzP.js.map → service-control-capabilities-C4520NIi.js.map}

@@ -1 +1 @@
-{"version":3,"file":"service-control-capabilities-plI5rUzP.js","names":[],"sources":["../src/commands/service-control-capabilities.ts"],"sourcesContent":["import { execFile } from \"node:child_process\";\nimport { realpath } from \"node:fs/promises\";\nimport { promisify } from \"node:util\";\nimport {\n  serviceControlCapabilitiesSchema,\n  serviceControlCarrierCapabilitySchema,\n} from \"@openmeld/schemas\";\nimport { readDaemonServiceContract } from \"../config/daemon-service-contract\";\nimport { sendLocalDaemonControlPlaneRequest } from \"../local-service/control-plane/client\";\nimport {\n  daemonServiceBinaryExecutablePath,\n  readDaemonActiveBundleState,\n  resolveAlignedDaemonActiveBundleEntryPath,\n} from \"../local-service/lifecycle/daemon-service-bundle\";\nimport { resolveDaemonServiceManager } from \"../local-service/lifecycle/daemon-service-manager\";\nimport { readCurrentDaemonRuntimeContext } from \"../local-service/lifecycle/daemon-service-runtime\";\n\nasync function resolveCarrierProbe(\n  platform: \"darwin\" | \"win32\",\n  expectedVersion: string\n) {\n  if (platform === \"darwin\") {\n    return {\n      executable: await realpath(daemonServiceBinaryExecutablePath()),\n      canonicalEntry: null,\n    };\n  }\n  // The npm launcher can repair state. Probe its verified active JS entry\n  // directly with the exact Node executable that guarded Start will register.\n  const entry = await resolveAlignedDaemonActiveBundleEntryPath({\n    expectedVersion,\n  });\n  return entry\n    ? {\n        executable: await realpath(process.execPath),\n        canonicalEntry: await realpath(entry),\n      }\n    : null;\n}\n\n/** Read only: never invoke the repairing npm launcher or a lifecycle operation. */\nexport async function readServiceControlCapabilities(\n  platform: NodeJS.Platform = process.platform\n) {\n  const unsupported = { deviceId: null, start: false, stop: false };\n  if (platform !== \"darwin\" && platform !== \"win32\") {\n    return unsupported;\n  }\n  const contract = await readDaemonServiceContract();\n  const bundle = await readDaemonActiveBundleState();\n  if (\n    contract?.serviceController !==\n      (platform === \"win32\" ? \"windows-service\" : \"launchd\") ||\n    bundle?.bundleFormat !==\n      (platform === \"win32\" ? \"self_contained_v1\" : \"binary_v1\")\n  ) {\n    return unsupported;\n  }\n  const manager = await resolveDaemonServiceManager(contract.serviceController);\n  if (!(manager && (await manager.status()).installed)) {\n    return unsupported;\n  }\n  // Guarded Start refreshes the supervisor command to this canonical executable.\n  // Verify the executable that answered, so an old CLI delegating elsewhere\n  // cannot advertise another binary's capability as its own.\n  const probe = await resolveCarrierProbe(platform, contract.daemonVersion);\n  if (!probe) {\n    return unsupported;\n  }\n  const { executable, canonicalEntry } = probe;\n  const { stdout } = await promisify(execFile)(\n    executable,\n    [\n      ...(canonicalEntry ? [canonicalEntry] : []),\n      \"service\",\n      \"control-carrier-capability\",\n      \"--json\",\n    ],\n    { timeout: 10_000, maxBuffer: 16_384, windowsHide: true }\n  );\n  const carrier = serviceControlCarrierCapabilitySchema.safeParse(\n    JSON.parse(stdout)\n  );\n  if (\n    !carrier.success ||\n    (await realpath(carrier.data.executable)) !== executable\n  ) {\n    return unsupported;\n  }\n  if (\n    platform === \"win32\" &&\n    (carrier.data.protocol !== \"account-checked-service-control-v2\" ||\n      (await realpath(carrier.data.entryScript)) !== canonicalEntry ||\n      JSON.stringify(await readDaemonActiveBundleState()) !==\n        JSON.stringify(bundle))\n  ) {\n    return unsupported;\n  }\n  const runtime = await readCurrentDaemonRuntimeContext();\n  if (runtime.effectiveRuntimeStatus === \"not_running\") {\n    return { deviceId: contract.deviceId, start: true, stop: false };\n  }\n  if (runtime.effectiveRuntimeStatus !== \"running\") {\n    return unsupported;\n  }\n  const response = await sendLocalDaemonControlPlaneRequest({\n    request: { v: 1, command: \"account_control_capabilities\" },\n  });\n  return serviceControlCapabilitiesSchema.parse({\n    deviceId: contract.deviceId,\n    start: false,\n    stop:\n      response.code === \"service.account_control_capabilities\" &&\n      response.payload.supported,\n  });\n}\n"],"mappings":";;;;;;;;;;;AAiBA,eAAe,oBACb,UACA,iBACA;CACA,IAAI,aAAa,UACf,OAAO;EACL,YAAY,MAAM,SAAS,kCAAkC,CAAC;EAC9D,gBAAgB;CAClB;CAIF,MAAM,QAAQ,MAAM,0CAA0C,EAC5D,gBACF,CAAC;CACD,OAAO,QACH;EACE,YAAY,MAAM,SAAS,QAAQ,QAAQ;EAC3C,gBAAgB,MAAM,SAAS,KAAK;CACtC,IACA;AACN;;AAGA,eAAsB,+BACpB,WAA4B,QAAQ,UACpC;CACA,MAAM,cAAc;EAAE,UAAU;EAAM,OAAO;EAAO,MAAM;CAAM;CAChE,IAAI,aAAa,YAAY,aAAa,SACxC,OAAO;CAET,MAAM,WAAW,MAAM,0BAA0B;CACjD,MAAM,SAAS,MAAM,4BAA4B;CACjD,IACE,UAAU,uBACP,aAAa,UAAU,oBAAoB,cAC9C,QAAQ,kBACL,aAAa,UAAU,sBAAsB,cAEhD,OAAO;CAET,MAAM,UAAU,MAAM,4BAA4B,SAAS,iBAAiB;CAC5E,IAAI,EAAE,YAAY,MAAM,QAAQ,OAAO,EAAA,CAAG,YACxC,OAAO;CAKT,MAAM,QAAQ,MAAM,oBAAoB,UAAU,SAAS,aAAa;CACxE,IAAI,CAAC,OACH,OAAO;CAET,MAAM,EAAE,YAAY,mBAAmB;CACvC,MAAM,EAAE,WAAW,MAAM,UAAU,QAAQ,CAAC,CAC1C,YACA;EACE,GAAI,iBAAiB,CAAC,cAAc,IAAI,CAAC;EACzC;EACA;EACA;CACF,GACA;EAAE,SAAS;EAAQ,WAAW;EAAQ,aAAa;CAAK,CAC1D;CACA,MAAM,UAAU,sCAAsC,UACpD,KAAK,MAAM,MAAM,CACnB;CACA,IACE,CAAC,QAAQ,WACR,MAAM,SAAS,QAAQ,KAAK,UAAU,MAAO,YAE9C,OAAO;CAET,IACE,aAAa,YACZ,QAAQ,KAAK,aAAa,wCACxB,MAAM,SAAS,QAAQ,KAAK,WAAW,MAAO,kBAC/C,KAAK,UAAU,MAAM,4BAA4B,CAAC,MAChD,KAAK,UAAU,MAAM,IAEzB,OAAO;CAET,MAAM,UAAU,MAAM,gCAAgC;CACtD,IAAI,QAAQ,2BAA2B,eACrC,OAAO;EAAE,UAAU,SAAS;EAAU,OAAO;EAAM,MAAM;CAAM;CAEjE,IAAI,QAAQ,2BAA2B,WACrC,OAAO;CAET,MAAM,WAAW,MAAM,mCAAmC,EACxD,SAAS;EAAE,GAAG;EAAG,SAAS;CAA+B,EAC3D,CAAC;CACD,OAAO,iCAAiC,MAAM;EAC5C,UAAU,SAAS;EACnB,OAAO;EACP,MACE,SAAS,SAAS,0CAClB,SAAS,QAAQ;CACrB,CAAC;AACH"}
+{"version":3,"file":"service-control-capabilities-C4520NIi.js","names":[],"sources":["../src/commands/service-control-capabilities.ts"],"sourcesContent":["import { execFile } from \"node:child_process\";\nimport { realpath } from \"node:fs/promises\";\nimport { promisify } from \"node:util\";\nimport {\n  serviceControlCapabilitiesSchema,\n  serviceControlCarrierCapabilitySchema,\n} from \"@openmeld/schemas\";\nimport { readDaemonServiceContract } from \"../config/daemon-service-contract\";\nimport { sendLocalDaemonControlPlaneRequest } from \"../local-service/control-plane/client\";\nimport {\n  daemonServiceBinaryExecutablePath,\n  readDaemonActiveBundleState,\n  resolveAlignedDaemonActiveBundleEntryPath,\n} from \"../local-service/lifecycle/daemon-service-bundle\";\nimport { resolveDaemonServiceManager } from \"../local-service/lifecycle/daemon-service-manager\";\nimport { readCurrentDaemonRuntimeContext } from \"../local-service/lifecycle/daemon-service-runtime\";\n\nasync function resolveCarrierProbe(\n  platform: \"darwin\" | \"win32\",\n  expectedVersion: string\n) {\n  if (platform === \"darwin\") {\n    return {\n      executable: await realpath(daemonServiceBinaryExecutablePath()),\n      canonicalEntry: null,\n    };\n  }\n  // The npm launcher can repair state. Probe its verified active JS entry\n  // directly with the exact Node executable that guarded Start will register.\n  const entry = await resolveAlignedDaemonActiveBundleEntryPath({\n    expectedVersion,\n  });\n  return entry\n    ? {\n        executable: await realpath(process.execPath),\n        canonicalEntry: await realpath(entry),\n      }\n    : null;\n}\n\n/** Read only: never invoke the repairing npm launcher or a lifecycle operation. */\nexport async function readServiceControlCapabilities(\n  platform: NodeJS.Platform = process.platform\n) {\n  const unsupported = { deviceId: null, start: false, stop: false };\n  if (platform !== \"darwin\" && platform !== \"win32\") {\n    return unsupported;\n  }\n  const contract = await readDaemonServiceContract();\n  const bundle = await readDaemonActiveBundleState();\n  if (\n    contract?.serviceController !==\n      (platform === \"win32\" ? \"windows-service\" : \"launchd\") ||\n    bundle?.bundleFormat !==\n      (platform === \"win32\" ? \"self_contained_v1\" : \"binary_v1\")\n  ) {\n    return unsupported;\n  }\n  const manager = await resolveDaemonServiceManager(contract.serviceController);\n  if (!(manager && (await manager.status()).installed)) {\n    return unsupported;\n  }\n  // Guarded Start refreshes the supervisor command to this canonical executable.\n  // Verify the executable that answered, so an old CLI delegating elsewhere\n  // cannot advertise another binary's capability as its own.\n  const probe = await resolveCarrierProbe(platform, contract.daemonVersion);\n  if (!probe) {\n    return unsupported;\n  }\n  const { executable, canonicalEntry } = probe;\n  const { stdout } = await promisify(execFile)(\n    executable,\n    [\n      ...(canonicalEntry ? [canonicalEntry] : []),\n      \"service\",\n      \"control-carrier-capability\",\n      \"--json\",\n    ],\n    { timeout: 10_000, maxBuffer: 16_384, windowsHide: true }\n  );\n  const carrier = serviceControlCarrierCapabilitySchema.safeParse(\n    JSON.parse(stdout)\n  );\n  if (\n    !carrier.success ||\n    (await realpath(carrier.data.executable)) !== executable\n  ) {\n    return unsupported;\n  }\n  if (\n    platform === \"win32\" &&\n    (carrier.data.protocol !== \"account-checked-service-control-v2\" ||\n      (await realpath(carrier.data.entryScript)) !== canonicalEntry ||\n      JSON.stringify(await readDaemonActiveBundleState()) !==\n        JSON.stringify(bundle))\n  ) {\n    return unsupported;\n  }\n  const runtime = await readCurrentDaemonRuntimeContext();\n  if (runtime.effectiveRuntimeStatus === \"not_running\") {\n    return { deviceId: contract.deviceId, start: true, stop: false };\n  }\n  if (runtime.effectiveRuntimeStatus !== \"running\") {\n    return unsupported;\n  }\n  const response = await sendLocalDaemonControlPlaneRequest({\n    request: { v: 1, command: \"account_control_capabilities\" },\n  });\n  return serviceControlCapabilitiesSchema.parse({\n    deviceId: contract.deviceId,\n    start: false,\n    stop:\n      response.code === \"service.account_control_capabilities\" &&\n      response.payload.supported,\n  });\n}\n"],"mappings":";;;;;;;;;;;AAiBA,eAAe,oBACb,UACA,iBACA;CACA,IAAI,aAAa,UACf,OAAO;EACL,YAAY,MAAM,SAAS,kCAAkC,CAAC;EAC9D,gBAAgB;CAClB;CAIF,MAAM,QAAQ,MAAM,0CAA0C,EAC5D,gBACF,CAAC;CACD,OAAO,QACH;EACE,YAAY,MAAM,SAAS,QAAQ,QAAQ;EAC3C,gBAAgB,MAAM,SAAS,KAAK;CACtC,IACA;AACN;;AAGA,eAAsB,+BACpB,WAA4B,QAAQ,UACpC;CACA,MAAM,cAAc;EAAE,UAAU;EAAM,OAAO;EAAO,MAAM;CAAM;CAChE,IAAI,aAAa,YAAY,aAAa,SACxC,OAAO;CAET,MAAM,WAAW,MAAM,0BAA0B;CACjD,MAAM,SAAS,MAAM,4BAA4B;CACjD,IACE,UAAU,uBACP,aAAa,UAAU,oBAAoB,cAC9C,QAAQ,kBACL,aAAa,UAAU,sBAAsB,cAEhD,OAAO;CAET,MAAM,UAAU,MAAM,4BAA4B,SAAS,iBAAiB;CAC5E,IAAI,EAAE,YAAY,MAAM,QAAQ,OAAO,EAAA,CAAG,YACxC,OAAO;CAKT,MAAM,QAAQ,MAAM,oBAAoB,UAAU,SAAS,aAAa;CACxE,IAAI,CAAC,OACH,OAAO;CAET,MAAM,EAAE,YAAY,mBAAmB;CACvC,MAAM,EAAE,WAAW,MAAM,UAAU,QAAQ,CAAC,CAC1C,YACA;EACE,GAAI,iBAAiB,CAAC,cAAc,IAAI,CAAC;EACzC;EACA;EACA;CACF,GACA;EAAE,SAAS;EAAQ,WAAW;EAAQ,aAAa;CAAK,CAC1D;CACA,MAAM,UAAU,sCAAsC,UACpD,KAAK,MAAM,MAAM,CACnB;CACA,IACE,CAAC,QAAQ,WACR,MAAM,SAAS,QAAQ,KAAK,UAAU,MAAO,YAE9C,OAAO;CAET,IACE,aAAa,YACZ,QAAQ,KAAK,aAAa,wCACxB,MAAM,SAAS,QAAQ,KAAK,WAAW,MAAO,kBAC/C,KAAK,UAAU,MAAM,4BAA4B,CAAC,MAChD,KAAK,UAAU,MAAM,IAEzB,OAAO;CAET,MAAM,UAAU,MAAM,gCAAgC;CACtD,IAAI,QAAQ,2BAA2B,eACrC,OAAO;EAAE,UAAU,SAAS;EAAU,OAAO;EAAM,MAAM;CAAM;CAEjE,IAAI,QAAQ,2BAA2B,WACrC,OAAO;CAET,MAAM,WAAW,MAAM,mCAAmC,EACxD,SAAS;EAAE,GAAG;EAAG,SAAS;CAA+B,EAC3D,CAAC;CACD,OAAO,iCAAiC,MAAM;EAC5C,UAAU,SAAS;EACnB,OAAO;EACP,MACE,SAAS,SAAS,0CAClB,SAAS,QAAQ;CACrB,CAAC;AACH"}

package/dist/{service-control-capabilities-BPL-T8xI.js → service-control-capabilities-DPYmrWgX.js}

@@ -1,4 +1,4 @@
 #!/usr/bin/env node
 
-import { t as readServiceControlCapabilities } from "./service-control-capabilities-plI5rUzP.js";
+import { t as readServiceControlCapabilities } from "./service-control-capabilities-C4520NIi.js";
 export { readServiceControlCapabilities };

package/dist/{service-BlcIfxYE.js → service-yziCG6lR.js}

@@ -1,21 +1,21 @@
 #!/usr/bin/env node
 
 import { C as assessLocalMachineFailure, E as createServiceSpawnPendingIssue, F as accountsDir, W as isPublishedOpenMeldHome, ct as resolveOpenMeldEnvPreset, et as openMeldRootDir, i as isOpenMeldLockError, k as formatLocalMachineIssueMessage, lt as resolveOpenMeldRootDir, q as normalizeAccountKey, u as resolveOpenMeldOrphanedLockIssue, ut as resolveOpenMeldServiceOwnedPathInput, x as resolveOpenMeldLaneDescriptor } from "./lock-Bsl_ElWy.js";
-import { Ai as createProjectResponseSchema, Bn as DAEMON_STREAM_KEEPALIVE_PING, Ci as serviceConnectionEvidenceEventSchema, Di as localProjectControlDaemonFrameSchema, Ei as localProjectControlConnectionSchema, Fi as COMPUTER_FILE_ACCESS_RUNTIME_CAPABILITY, Fr as organizationSkillReleaseSummarySchema, Gr as spaceMemberDirectorySchema, Hr as spaceMemberAgentWakeAvailabilitySchema, Ii as OPENMELD_RUNTIME_CAPABILITIES_HEADER, Ir as organizationSkillSummarySchema, Kr as spaceMemberKindSchema, Li as computerFileAccessDaemonFrameSchema, Mi as projectSchema, Mr as getOrganizationSkillResponseSchema, Ni as updateProjectResponseSchema, Nr as listOrganizationSkillsResponseSchema, Oi as localProjectControlDiscoverProjectsResponseSchema, Si as centerAgentToolSpeakerSchema, Ur as spaceMemberDirectoryAllowedRelationsSchema, Zr as organizationComputersResponseSchema, ar as betterAuthDeviceAuthorizationErrorResponseSchema, br as submitFeedbackIssueRequestSchema, ci as deleteCenterAgentRoutineResponseSchema, cr as betterAuthSessionSnapshotResponseSchema, di as pauseCenterAgentRoutineResponseSchema, fi as resumeCenterAgentRoutineResponseSchema, ir as betterAuthDeviceAuthorizationCodeResponseSchema, ji as listProjectsResponseSchema, ki as archiveProjectResponseSchema, li as listCenterAgentRoutineRunsResponseSchema, nr as BETTER_AUTH_DEVICE_AUTHORIZATION_GRANT_TYPE, on as createServiceConnectionEvidenceApi, or as betterAuthDeviceAuthorizationTokenRequestSchema, pi as updateCenterAgentRoutineResponseSchema, rr as betterAuthDeviceAuthorizationCodeRequestSchema, si as createCenterAgentRoutineResponseSchema, sr as betterAuthDeviceAuthorizationTokenResponseSchema, ti as agentActivitySessionInventoryResponseSchema, ui as listCenterAgentRoutinesResponseSchema, vr as organizationSpaceDirectoryWithMemberCountsResponseSchema, wi as serviceConnectionEvidenceJournalSchema, xi as agentActivitySnapshotResponseSchema, xr as submitFeedbackIssueResponseSchema, yr as organizationDirectoryResponseSchema } from "./dist-CiLvbjZA.js";
-import { At as ensureOpenMeldManagedProfileWorkspace, Bt as createMutableRouteCatalogState, Cr as MAX_HEARTBEAT_INTERVAL_MS, Dn as emitReconcileCompletedEvidence, Dr as pruneStaleLeases, En as emitDriftDetectedEvidence, Er as applyIntervalJitterMs$1, Ft as resolveConfiguredProfileWorkspacePathForAccount, Hn as buildAuthenticatedControlPlaneResponse, Ht as summarizeSkippedDaemonProfiles, I as listAgentTargetStates, It as setCustomProfileWorkspace, Jt as isDaemonReconcileInProgressError, Nt as readProfileWorkspaceConfigForAccount, O as syncDeviceRuntimeStateProjection, On as emitReconcileStartedEvidence, Or as resolveAdaptiveHeartbeatIntervalMs, Ot as resolveRegistryRuntimeAdapterCapabilitySnapshot, Sr as ADAPTIVE_HEARTBEAT_JITTER_RATIO, Tr as applyAcceptedLeases, Ut as syncDaemonRouteCatalogState, Vt as createRouteCatalogFromMutableState, _t as removeProjectConnection, bt as setDefaultProjectConnection, ct as ProjectBindingOperationError, ft as listProjectBindings, gt as removeMissingProjectConnections, kn as DaemonServiceRunError, kr as resolveCatalogSyncIntervalMs, ln as resolveCatalogSyncSkippedProfilesLogState, lt as ProjectBindingStoreUpdateRequiredError, pt as listProjectConnectionsWithStatus, tn as buildLocalServiceDiagnosticsPayload, ut as bindProject, wr as MIN_HEARTBEAT_INTERVAL_MS, xr as resolveRouteRegistrationReconcileDecision } from "./prepare-provider-runtime-3eIWxGgM.js";
-import { A as runtimeTransportLocalAgentControlSetProfileWorkspaceFramePayloadSchema, Ar as OPENMELD_REASONING_STREAM_HEADER, Br as localFolderPickerHelperResultSchema, Bt as SPACE_WORK_HANDOFF_CAPABILITY_HEADER, Ir as LOCAL_FOLDER_PICKER_RUNTIME_CAPABILITY, Lr as OPENMELD_LOCAL_FOLDER_PICKER_CAPABILITY_HEADER, M as runtimeTransportOpenMeldToolsControlFramePayloadSchema, N as runtimeTransportOpenMeldToolsControlResultFramePayloadSchema, O as runtimeTransportLocalAgentControlRefreshCatalogFramePayloadSchema, P as runtimeTransportRegisterSessionRequestSchema, Rr as localFolderPickerDaemonFrameSchema, Sn as OPENMELD_COMPUTER_CARE_HEADER, li as openMeldRequestContextSchema, n as OPENMELD_EXECUTION_ADMISSION_HEADER, o as localWakeRouteWorkingFolderObservationSchema, t as CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH, tt as sanitizeDispatchErrorSummary, x as runtimeTransportHeartbeatRequestSchema, z as runtimeTransportRouteCatalogChangedFramePayloadSchema, zr as localFolderPickerHelperProtocolResultSchema } from "./runtime-transport-KEwcSZ89.js";
-import { E as ServiceAccountAdmissionError, S as setAuthSession, _ as onAuthSessionCredentialAvailable, a as beginAuthSessionTransition, d as getAuthSessionState, i as assertAuthSessionMutationAvailable, o as buildStoredAuthSessionIdentity, s as clearAuthSession, v as onAuthSessionCredentialObservation, w as withAdmittedServiceSession } from "./auth-session-BAq7KkIa.js";
+import { Ai as createProjectResponseSchema, Bn as DAEMON_STREAM_KEEPALIVE_PING, Ci as serviceConnectionEvidenceEventSchema, Di as localProjectControlDaemonFrameSchema, Ei as localProjectControlConnectionSchema, Fi as COMPUTER_FILE_ACCESS_RUNTIME_CAPABILITY, Fr as organizationSkillReleaseSummarySchema, Gr as spaceMemberDirectorySchema, Hr as spaceMemberAgentWakeAvailabilitySchema, Ii as OPENMELD_RUNTIME_CAPABILITIES_HEADER, Ir as organizationSkillSummarySchema, Kr as spaceMemberKindSchema, Li as computerFileAccessDaemonFrameSchema, Mi as projectSchema, Mr as getOrganizationSkillResponseSchema, Ni as updateProjectResponseSchema, Nr as listOrganizationSkillsResponseSchema, Oi as localProjectControlDiscoverProjectsResponseSchema, Si as centerAgentToolSpeakerSchema, Ur as spaceMemberDirectoryAllowedRelationsSchema, Zr as organizationComputersResponseSchema, ar as betterAuthDeviceAuthorizationErrorResponseSchema, br as submitFeedbackIssueRequestSchema, ci as deleteCenterAgentRoutineResponseSchema, cr as betterAuthSessionSnapshotResponseSchema, di as pauseCenterAgentRoutineResponseSchema, fi as resumeCenterAgentRoutineResponseSchema, ir as betterAuthDeviceAuthorizationCodeResponseSchema, ji as listProjectsResponseSchema, ki as archiveProjectResponseSchema, li as listCenterAgentRoutineRunsResponseSchema, nr as BETTER_AUTH_DEVICE_AUTHORIZATION_GRANT_TYPE, on as createServiceConnectionEvidenceApi, or as betterAuthDeviceAuthorizationTokenRequestSchema, pi as updateCenterAgentRoutineResponseSchema, rr as betterAuthDeviceAuthorizationCodeRequestSchema, si as createCenterAgentRoutineResponseSchema, sr as betterAuthDeviceAuthorizationTokenResponseSchema, ti as agentActivitySessionInventoryResponseSchema, ui as listCenterAgentRoutinesResponseSchema, vr as organizationSpaceDirectoryWithMemberCountsResponseSchema, wi as serviceConnectionEvidenceJournalSchema, xi as agentActivitySnapshotResponseSchema, xr as submitFeedbackIssueResponseSchema, yr as organizationDirectoryResponseSchema } from "./dist-YPzkhLLp.js";
+import { At as ensureOpenMeldManagedProfileWorkspace, Bt as createMutableRouteCatalogState, Cr as MAX_HEARTBEAT_INTERVAL_MS, Dn as emitReconcileCompletedEvidence, Dr as pruneStaleLeases, En as emitDriftDetectedEvidence, Er as applyIntervalJitterMs$1, Ft as resolveConfiguredProfileWorkspacePathForAccount, Hn as buildAuthenticatedControlPlaneResponse, Ht as summarizeSkippedDaemonProfiles, I as listAgentTargetStates, It as setCustomProfileWorkspace, Jt as isDaemonReconcileInProgressError, Nt as readProfileWorkspaceConfigForAccount, O as syncDeviceRuntimeStateProjection, On as emitReconcileStartedEvidence, Or as resolveAdaptiveHeartbeatIntervalMs, Ot as resolveRegistryRuntimeAdapterCapabilitySnapshot, Sr as ADAPTIVE_HEARTBEAT_JITTER_RATIO, Tr as applyAcceptedLeases, Ut as syncDaemonRouteCatalogState, Vt as createRouteCatalogFromMutableState, _t as removeProjectConnection, bt as setDefaultProjectConnection, ct as ProjectBindingOperationError, ft as listProjectBindings, gt as removeMissingProjectConnections, kn as DaemonServiceRunError, kr as resolveCatalogSyncIntervalMs, ln as resolveCatalogSyncSkippedProfilesLogState, lt as ProjectBindingStoreUpdateRequiredError, pt as listProjectConnectionsWithStatus, tn as buildLocalServiceDiagnosticsPayload, ut as bindProject, wr as MIN_HEARTBEAT_INTERVAL_MS, xr as resolveRouteRegistrationReconcileDecision } from "./prepare-provider-runtime-iA3g-8MS.js";
+import { A as runtimeTransportLocalAgentControlSetProfileWorkspaceFramePayloadSchema, Ar as OPENMELD_REASONING_STREAM_HEADER, Br as localFolderPickerHelperResultSchema, Bt as SPACE_WORK_HANDOFF_CAPABILITY_HEADER, Ir as LOCAL_FOLDER_PICKER_RUNTIME_CAPABILITY, Lr as OPENMELD_LOCAL_FOLDER_PICKER_CAPABILITY_HEADER, M as runtimeTransportOpenMeldToolsControlFramePayloadSchema, N as runtimeTransportOpenMeldToolsControlResultFramePayloadSchema, O as runtimeTransportLocalAgentControlRefreshCatalogFramePayloadSchema, P as runtimeTransportRegisterSessionRequestSchema, Rr as localFolderPickerDaemonFrameSchema, Sn as OPENMELD_COMPUTER_CARE_HEADER, li as openMeldRequestContextSchema, n as OPENMELD_EXECUTION_ADMISSION_HEADER, o as localWakeRouteWorkingFolderObservationSchema, t as CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH, tt as sanitizeDispatchErrorSummary, x as runtimeTransportHeartbeatRequestSchema, z as runtimeTransportRouteCatalogChangedFramePayloadSchema, zr as localFolderPickerHelperProtocolResultSchema } from "./runtime-transport-0F5E6So6.js";
+import { E as ServiceAccountAdmissionError, S as setAuthSession, _ as onAuthSessionCredentialAvailable, a as beginAuthSessionTransition, d as getAuthSessionState, i as assertAuthSessionMutationAvailable, o as buildStoredAuthSessionIdentity, s as clearAuthSession, v as onAuthSessionCredentialObservation, w as withAdmittedServiceSession } from "./auth-session-CDhQANWx.js";
 import { s as openMeldDaemonControlPlaneResponseSchema } from "./control-plane-BDS63N7Y.js";
 import { F as iso, G as string, L as literal, N as enumFactory, W as strictObject, X as url, a as formatLocalSetupActionLabel, f as localServiceComponentUpdateProjectionSchema, i as formatLocalSetupActionDescription, j as discriminatedUnion, k as boolean, n as formatLocalComponentsSummaryDescription, o as installedLocalComponentsSnapshotSchema, r as formatLocalComponentsSummaryLabel, s as localCliComponentUpdateProjectionSchema } from "./local-components-B6SCXZf9.js";
 import { r as daemonServiceLaneSchema } from "./service-contract-CRyDcIIf.js";
-import { m as hashBundledSkillAssets, p as computeDirectoryContentHash, u as loadSelectedSkillAssets } from "./state-Dj3YS3aV.js";
+import { m as hashBundledSkillAssets, p as computeDirectoryContentHash, u as loadSelectedSkillAssets } from "./state-DLMkZqd8.js";
 import { i as serviceControlCapabilitiesSchema } from "./service-account-admission-Dy2W3n3_.js";
-import { $ as buildCommandAuthenticationPromptMessage$1, A as DEFAULT_RECONNECT_DELAY_MS, C as CONTROLLED_SHUTDOWN_SOCKET_CLOSE_TIMEOUT_MS, D as DAEMON_STREAM_CONNECT_TIMEOUT_MS, F as REGISTER_RESPONSE_TIMEOUT_MS, I as RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS, L as RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS, M as MAX_RECONNECT_DELAY_MS, N as PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS, O as DAEMON_STREAM_KEEPALIVE_INTERVAL_MS, P as PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS, Q as buildAuthenticationStatusLabel, R as RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS, Y as readDaemonCatalogSyncSignal, _ as toErrorMessage$5, b as CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS, c as normalizeHeartbeatIntervalMs, d as normalizeText$1, et as buildHumanAuthenticationCard, f as nowIsoString, i as resolvePreferredDaemonDeviceId, j as HEARTBEAT_RESPONSE_TIMEOUT_MS, k as DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS, n as ensureDaemonRuntimePaths, nt as extractAuthenticationPromptAction, ot as resolveAuthenticationReasonFromState, r as resolveDaemonDeviceId, rt as resolveAuthenticationGuidance, s as emitRunLine, tt as createAuthenticationError, u as normalizeOptionalText$1, v as warnDaemonEvent, w as DAEMON_RUNTIME_CONTRACT_EPOCH, x as CONTROLLED_SHUTDOWN_REQUEST_TIMEOUT_MS, y as CATALOG_SYNC_RETRY_INTERVAL_MS } from "./daemon-device-id-bP58j3NL.js";
+import { $ as buildCommandAuthenticationPromptMessage$1, A as DEFAULT_RECONNECT_DELAY_MS, C as CONTROLLED_SHUTDOWN_SOCKET_CLOSE_TIMEOUT_MS, D as DAEMON_STREAM_CONNECT_TIMEOUT_MS, F as REGISTER_RESPONSE_TIMEOUT_MS, I as RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS, L as RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS, M as MAX_RECONNECT_DELAY_MS, N as PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS, O as DAEMON_STREAM_KEEPALIVE_INTERVAL_MS, P as PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS, Q as buildAuthenticationStatusLabel, R as RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS, Y as readDaemonCatalogSyncSignal, _ as toErrorMessage$5, b as CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS, c as normalizeHeartbeatIntervalMs, d as normalizeText$1, et as buildHumanAuthenticationCard, f as nowIsoString, i as resolvePreferredDaemonDeviceId, j as HEARTBEAT_RESPONSE_TIMEOUT_MS, k as DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS, n as ensureDaemonRuntimePaths, nt as extractAuthenticationPromptAction, ot as resolveAuthenticationReasonFromState, r as resolveDaemonDeviceId, rt as resolveAuthenticationGuidance, s as emitRunLine, tt as createAuthenticationError, u as normalizeOptionalText$1, v as warnDaemonEvent, w as DAEMON_RUNTIME_CONTRACT_EPOCH, x as CONTROLLED_SHUTDOWN_REQUEST_TIMEOUT_MS, y as CATALOG_SYNC_RETRY_INTERVAL_MS } from "./daemon-device-id-YnLMx1kN.js";
 import { i as writeDaemonRuntimeLease } from "./daemon-runtime-lease-BUr4qsLo.js";
-import { A as prepareDaemonServiceBundle, G as readManagedCliInstallation, M as resolveAlignedDaemonActiveBundleEntryPath, N as resolveDaemonBundleEntryPathFromState, a as resolveDaemonRuntimeState, b as cleanupInactiveDaemonServiceBundles, f as listDaemonOwnedProcesses, h as resolveDaemonBundleIdFromEntryPath, i as readCurrentObservedDaemonRuntimeStatus, j as readDaemonActiveBundleState, n as getEffectiveDaemonRuntimeStatus, o as resolveDaemonServiceManagerForRuntimeState, p as extractDaemonCommandEntryPath, r as readCurrentDaemonRuntimeContext, s as waitForDaemonSystemServiceToStop, t as clearDaemonRuntimeStateIfDefinitelyStopped, u as cleanupLegacySharedDaemonServiceState, v as isOpenMeldManagedBinaryPath } from "./daemon-service-runtime-686fUcq9.js";
-import { $ as buildDaemonServiceDependencyTitle, At as DAEMON_SERVICE_REPAIR_ANOMALIES, Bt as assessCliUpdate, C as formatDaemonServiceRefreshReliabilityMessage, Ct as readDaemonRuntimeContractRepairReport, D as writeDaemonStartFailureState, E as clearDaemonStartFailureState, Et as isVersionDowngrade, Ft as resolveServiceUpdateUrgency, Ht as buildDaemonSystemServiceCommandSpec, It as assessServerRequiredVersion, Lt as describeServerRequiredVersionUnavailableReason, Mt as classifyDaemonServiceRunStartability, Nt as classifyDaemonServiceWakeability, Ot as DAEMON_SERVICE_AUTO_HEAL_ANOMALIES, Pt as resolveCurrentDaemonExpectedVersion, Q as buildDaemonServiceDependencySummary, S as buildDaemonServiceUpdateRequiredNextStep, St as ensureDaemonRuntimeContractState, Tt as resolveDaemonServiceAlignmentDecision, Ut as ensureDaemonSystemServiceCommandFiles, W as resolveLocalServiceDemand, X as buildDaemonServiceDependencyMeaning, Y as buildDaemonServiceDependencyDetails, Z as buildDaemonServiceDependencyNextStep, _t as resolveDaemonStopStrategy, a as isDaemonInventoryRunningAndStartReady$1, c as waitForSystemServiceStartup$1, ct as writeOpenMeldToolsMaintenancePolicy, d as captureDaemonServiceEvidenceBestEffort, dt as uninstallDaemonServiceUpdateWorker, et as resolveDaemonServiceDependencyDiagnostics, f as formatDaemonFailureContextText, ft as inspectDaemonServiceInventory, g as resolveServiceReadiness, gt as readCurrentDaemonOwnerSnapshot, h as resolveDaemonStatusAuthenticationAttention, ht as hasActiveDaemonOwners, i as runDaemonServiceLifecycle, kt as DAEMON_SERVICE_FULL_ALIGNMENT_ANOMALIES, l as startDaemonSystemServiceWithAutoRepair, lt as ensureDaemonServiceMaintenanceInstalled, m as resolveDaemonStatusAttention, mt as formatDaemonOwnerSummaryLabel, n as scheduleDaemonServiceUpdate, nt as createOpenMeldToolsUpdateCoordinator, o as isSystemServiceStartupTimeoutError, ot as readOpenMeldToolsMaintenancePolicy, p as resolveDaemonStatusSnapshot, pt as buildDaemonOwnerSnapshotFromObservedState, r as DaemonServiceLifecycleDrainTimeoutError, s as resolveSystemServiceStartupWaitMs, st as resolveOpenMeldToolsMaintenanceProjection, tt as writeDaemonServiceContract, u as captureDaemonServiceEvidence, v as buildDaemonServiceRefreshNextStep, vt as resolveStoppedContractWriteBlockedReason, w as formatDaemonServiceUpdateRequiredMessage, wt as buildDaemonServiceTargetSpec, x as buildDaemonServiceStatusReadOnlyDetail, y as buildDaemonServiceRefreshPromptMessage, yt as summarizeDaemonOwnerSnapshot } from "./daemon-service-update-coordinator-DaoVYK6k.js";
-import { $ as emitDaemonDispatchJournalEvent, R as resolveNextRuntimeAgentControllerReportSyncAtMs, it as updateComputerFileAccessPolicy, n as handleDaemonTransportFrame, nt as readComputerFileAccessPolicy, o as sendDaemonFrame, r as parseDaemonFrame, rt as resolveComputerFileAccessStorePath, s as collectObservedSessionWorkingDirectories, tt as ComputerFileAccessStoreError } from "./daemon-frame-transport-DFfxVRi2.js";
-import { c as serviceExecutionHostSnapshotSchema, n as createExecutionHostClient, o as serviceExecutionHostMethods, t as ExecutionHostError } from "./channel-DAZr7cKE.js";
+import { A as prepareDaemonServiceBundle, G as readManagedCliInstallation, M as resolveAlignedDaemonActiveBundleEntryPath, N as resolveDaemonBundleEntryPathFromState, a as resolveDaemonRuntimeState, b as cleanupInactiveDaemonServiceBundles, f as listDaemonOwnedProcesses, h as resolveDaemonBundleIdFromEntryPath, i as readCurrentObservedDaemonRuntimeStatus, j as readDaemonActiveBundleState, n as getEffectiveDaemonRuntimeStatus, o as resolveDaemonServiceManagerForRuntimeState, p as extractDaemonCommandEntryPath, r as readCurrentDaemonRuntimeContext, s as waitForDaemonSystemServiceToStop, t as clearDaemonRuntimeStateIfDefinitelyStopped, u as cleanupLegacySharedDaemonServiceState, v as isOpenMeldManagedBinaryPath } from "./daemon-service-runtime-M-kfrWro.js";
+import { $ as buildDaemonServiceDependencyTitle, At as DAEMON_SERVICE_REPAIR_ANOMALIES, Bt as assessCliUpdate, C as formatDaemonServiceRefreshReliabilityMessage, Ct as readDaemonRuntimeContractRepairReport, D as writeDaemonStartFailureState, E as clearDaemonStartFailureState, Et as isVersionDowngrade, Ft as resolveServiceUpdateUrgency, Ht as buildDaemonSystemServiceCommandSpec, It as assessServerRequiredVersion, Lt as describeServerRequiredVersionUnavailableReason, Mt as classifyDaemonServiceRunStartability, Nt as classifyDaemonServiceWakeability, Ot as DAEMON_SERVICE_AUTO_HEAL_ANOMALIES, Pt as resolveCurrentDaemonExpectedVersion, Q as buildDaemonServiceDependencySummary, S as buildDaemonServiceUpdateRequiredNextStep, St as ensureDaemonRuntimeContractState, Tt as resolveDaemonServiceAlignmentDecision, Ut as ensureDaemonSystemServiceCommandFiles, W as resolveLocalServiceDemand, X as buildDaemonServiceDependencyMeaning, Y as buildDaemonServiceDependencyDetails, Z as buildDaemonServiceDependencyNextStep, _t as resolveDaemonStopStrategy, a as isDaemonInventoryRunningAndStartReady$1, c as waitForSystemServiceStartup$1, ct as writeOpenMeldToolsMaintenancePolicy, d as captureDaemonServiceEvidenceBestEffort, dt as uninstallDaemonServiceUpdateWorker, et as resolveDaemonServiceDependencyDiagnostics, f as formatDaemonFailureContextText, ft as inspectDaemonServiceInventory, g as resolveServiceReadiness, gt as readCurrentDaemonOwnerSnapshot, h as resolveDaemonStatusAuthenticationAttention, ht as hasActiveDaemonOwners, i as runDaemonServiceLifecycle, kt as DAEMON_SERVICE_FULL_ALIGNMENT_ANOMALIES, l as startDaemonSystemServiceWithAutoRepair, lt as ensureDaemonServiceMaintenanceInstalled, m as resolveDaemonStatusAttention, mt as formatDaemonOwnerSummaryLabel, n as scheduleDaemonServiceUpdate, nt as createOpenMeldToolsUpdateCoordinator, o as isSystemServiceStartupTimeoutError, ot as readOpenMeldToolsMaintenancePolicy, p as resolveDaemonStatusSnapshot, pt as buildDaemonOwnerSnapshotFromObservedState, r as DaemonServiceLifecycleDrainTimeoutError, s as resolveSystemServiceStartupWaitMs, st as resolveOpenMeldToolsMaintenanceProjection, tt as writeDaemonServiceContract, u as captureDaemonServiceEvidence, v as buildDaemonServiceRefreshNextStep, vt as resolveStoppedContractWriteBlockedReason, w as formatDaemonServiceUpdateRequiredMessage, wt as buildDaemonServiceTargetSpec, x as buildDaemonServiceStatusReadOnlyDetail, y as buildDaemonServiceRefreshPromptMessage, yt as summarizeDaemonOwnerSnapshot } from "./daemon-service-update-coordinator-Clqxj3A1.js";
+import { $ as emitDaemonDispatchJournalEvent, R as resolveNextRuntimeAgentControllerReportSyncAtMs, it as updateComputerFileAccessPolicy, n as handleDaemonTransportFrame, nt as readComputerFileAccessPolicy, o as sendDaemonFrame, r as parseDaemonFrame, rt as resolveComputerFileAccessStorePath, s as collectObservedSessionWorkingDirectories, tt as ComputerFileAccessStoreError } from "./daemon-frame-transport-E-H3DjWA.js";
+import { c as serviceExecutionHostSnapshotSchema, n as createExecutionHostClient, o as serviceExecutionHostMethods, t as ExecutionHostError } from "./channel-D5ABuavH.js";
 import { a as resolveBaseUrl, c as resolveExplicitGatewayUrlOrThrow, f as getConfiguredDaemonDispatchLimits, i as normalizeGatewayBaseUrlOrNull, o as resolveBaseUrlOrNull, r as normalizeGatewayBaseUrl } from "./base-url-D7uE_xTo.js";
 import { i as readProcessStartIdentity, n as isPreciseProcessStartIdentity, t as CURRENT_PROCESS_START_IDENTITY } from "./process-identity-CNus0e6E.js";
 import { n as writeDaemonLocalStateFile, t as readDaemonLocalStateFile } from "./daemon-local-state-file-jOXuXrky.js";
@@ -24,16 +24,16 @@ import { A as getDaemonStatus, G as withDaemonServiceRegistrationMutationLock, H
 import { a as upsertDaemonServiceContract, i as readDaemonServiceContract, n as isDaemonServiceContractIdentityReusable, t as clearDaemonServiceContract } from "./daemon-service-contract-BpOBMGX0.js";
 import { a as formatOpenMeldCliTextBlock, n as formatOpenMeldCliCommand, r as formatOpenMeldCliCommands, t as formatInlineOpenMeldCliCommands } from "./cli-entry-command-CR_9QU1i.js";
 import { r as resolveAuthBaseUrl, t as resolveOpenMeldEnvironmentTarget } from "./openmeld-environment-target-B6HqY0_a.js";
-import { t as admitServiceAccountStop } from "./service-account-authorization-A5Ly0UFD.js";
-import { S as requestLocalDaemonShutdown, c as runWithDaemonLifecycleCommandJournal, d as compareSemver, i as readLatestDaemonLifecycleOriginEvent, l as OPENMELD_VERSION, n as formatDaemonLifecycleOriginSummary, o as resolveRecentDaemonSignalStopCause, r as readLatestDaemonLifecycleConnectionStateEvent, s as runDaemonServiceManagerAction, t as emitDaemonLifecycleEvent, w as sendLocalDaemonControlPlaneRequest, y as LocalDaemonControlPlaneClientError } from "./daemon-lifecycle-journal-57QR_a3_.js";
+import { t as admitServiceAccountStop } from "./service-account-authorization-DAPQy2yP.js";
+import { S as requestLocalDaemonShutdown, c as runWithDaemonLifecycleCommandJournal, d as compareSemver, i as readLatestDaemonLifecycleOriginEvent, l as OPENMELD_VERSION, n as formatDaemonLifecycleOriginSummary, o as resolveRecentDaemonSignalStopCause, r as readLatestDaemonLifecycleConnectionStateEvent, s as runDaemonServiceManagerAction, t as emitDaemonLifecycleEvent, w as sendLocalDaemonControlPlaneRequest, y as LocalDaemonControlPlaneClientError } from "./daemon-lifecycle-journal-DDrWgEzN.js";
 import { n as toErrorMessage$6, t as sleep } from "./dist-BLuEEVHh.js";
-import { S as resolveDaemonServiceManager, _ as readDaemonServiceJobCrashExitCode, a as disableDaemonServiceAutostartIfConfigured, c as getDaemonSystemServiceLogPath, f as isDaemonServiceJobSpawnPending, o as formatDaemonServiceJobDiagnosticsEvidence, s as getDaemonServiceLaunchdLabel } from "./daemon-service-manager-rNRRVrj1.js";
-import { a as requireOpenMeldProfile, c as clearAllSelectedOpenMeldProfileIds, n as resolveRuntimeContext, o as resolveOpenMeldProfileOrNull } from "./context-DN_LvdgC.js";
+import { S as resolveDaemonServiceManager, _ as readDaemonServiceJobCrashExitCode, a as disableDaemonServiceAutostartIfConfigured, c as getDaemonSystemServiceLogPath, f as isDaemonServiceJobSpawnPending, o as formatDaemonServiceJobDiagnosticsEvidence, s as getDaemonServiceLaunchdLabel } from "./daemon-service-manager-HL4VKbIU.js";
+import { a as requireOpenMeldProfile, c as clearAllSelectedOpenMeldProfileIds, n as resolveRuntimeContext, o as resolveOpenMeldProfileOrNull } from "./context-D9Ebb5wl.js";
 import { a as outJsonLine, n as sanitizeTerminalDisplayText, o as outLine, t as createPresenter } from "./presenter-BcxiQyJg.js";
-import { X as getCommandEntryContract, _ as createAuthLoginGuideError, a as formatDaemonServiceDowngradeBlockedRecommendation, d as formatDaemonServiceMissingStatus, f as getDaemonDowngradeBlockedTitle, g as canUseInteractivePrompts, h as resolveOpenMeldToolsUpdateOperationProjection, l as formatDaemonServiceMissingRunStepOne, n as resolveElapsedTimeMs, o as formatDaemonServiceMissingAction, pt as validateDaemonControlTargetInput, r as formatDaemonDowngradeBlockedNextStep, s as formatDaemonServiceMissingMeaning, t as formatElapsedTime, u as formatDaemonServiceMissingRunStepTwo, xt as buildAgentOverviewFromContract } from "./elapsed-time-DslUBczL.js";
-import { c as buildRequestAuthHeaders, i as AuthRequestCredentialError, l as canAttachAuthTokenToRequest, o as buildOpenMeldProfileRequestHeadersWithAuth, p as deriveAuthBaseUrlFromGatewayUrl, t as createCliApiClientFoundation, u as fingerprintRequestAuthorization } from "./api-client-foundation-BOBrz3Lx.js";
-import { t as childExecutionHostChannel } from "./process-channel-48ZNmEF6.js";
-import { n as collectSkillsReadinessSnapshot } from "./installation-inventory-BZJmaCVr.js";
+import { X as getCommandEntryContract, _ as createAuthLoginGuideError, a as formatDaemonServiceDowngradeBlockedRecommendation, d as formatDaemonServiceMissingStatus, f as getDaemonDowngradeBlockedTitle, g as canUseInteractivePrompts, h as resolveOpenMeldToolsUpdateOperationProjection, l as formatDaemonServiceMissingRunStepOne, n as resolveElapsedTimeMs, o as formatDaemonServiceMissingAction, pt as validateDaemonControlTargetInput, r as formatDaemonDowngradeBlockedNextStep, s as formatDaemonServiceMissingMeaning, t as formatElapsedTime, u as formatDaemonServiceMissingRunStepTwo, xt as buildAgentOverviewFromContract } from "./elapsed-time-4PuBjDUi.js";
+import { c as buildRequestAuthHeaders, i as AuthRequestCredentialError, l as canAttachAuthTokenToRequest, o as buildOpenMeldProfileRequestHeadersWithAuth, p as deriveAuthBaseUrlFromGatewayUrl, t as createCliApiClientFoundation, u as fingerprintRequestAuthorization } from "./api-client-foundation-CDlVc0zT.js";
+import { t as childExecutionHostChannel } from "./process-channel-B2BU2X7x.js";
+import { n as collectSkillsReadinessSnapshot } from "./installation-inventory-CuPmLaLZ.js";
 import { createHash, randomUUID } from "node:crypto";
 import { delimiter, dirname, isAbsolute, join, resolve } from "node:path";
 import { access, mkdir, open, readFile, readdir, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
@@ -7709,7 +7709,7 @@ async function resolveDaemonServiceParticipationStatus(input) {
 }
 //#endregion
 //#region src/local-components/manifest.ts
-const OPENMELD_CLI_COMMAND_CONTRACT_VERSION = "openmeld-cli-command-contract-2026-09-antigravity-permissions-v1";
+const OPENMELD_CLI_COMMAND_CONTRACT_VERSION = "openmeld-cli-command-contract-2026-09-space-task-result-review-v1";
 const OPENMELD_SKILLS_CONTRACT_VERSION = "openmeld-skills-contract-2026-09-explicit-space-recipients-v1";
 const OPENMELD_SERVICE_CONTRACT_VERSION = "openmeld-service-contract-2026-09-antigravity-permissions-v1";
 const LOCAL_COMPONENTS_SNAPSHOT_FILE = "local-components.json";
@@ -16364,4 +16364,4 @@ function parseDaemonRunMode(rawMode) {
 //#endregion
 export { buildAuthStatusSnapshot as $, buildDaemonStartNeedsAttentionCard as A, resolveDaemonServiceParticipationStatus as B, buildProfileWorkspaceRows as C, cliJsonSkillsShowEnvelopeSchema as Ct, createDelayedSpinner as D, organizationJoinLinkManagementQuerySchema as Dt, emitDaemonAgentOverview as E, organizationJoinLinkErrorResponseSchema as Et, emitCliJsonEnvelope as F, ensureCommandAuthenticationOrCancel as G, validateLocalProjectConnectionPath as H, runDaemonStartupPreflight as I, runAuthLogout as J, evaluateCommandAuthentication as K, readDaemonIncidentLogTail as L, buildHumanErrorCopy as M, renderHumanErrorCard as N, shouldEmitAgentOverview as O, revokeOrganizationJoinLinkResponseSchema as Ot, renderHumanTextErrorCard as P, buildAuthStatusRows as Q, resolveLocalComponentsStatus as R, buildProfileWorkspacePresentation as S, cliJsonSkillsLoadEnvelopeSchema as St, createQuietPresenter as T, getOrganizationJoinLinkResponseSchema as Tt, connectWebSocket as U, LocalProjectConnectionError as V, buildCommandAuthenticationPromptMessage as W, runAuthStatus as X, runAuthMenu as Y, exchangeOneTimeTokenAuthSession as Z, buildDaemonBackgroundStartFailure as _, resolveDeviceTokenExpiresAt as _t, runDaemonBackgroundStartForDecision as a, promptTextEntry as at, formatServiceRuntimeHeadline as b, cliJsonOutputEnvelopeSchema as bt, runDaemonInterrupt as c, finishCurrentCommandCheckScope as ct, runDaemonServiceDetached as d, resetCurrentCommandCheckState as dt, formatActiveOrganizationLabel as et, runDaemonSnapshot as f, startCurrentCommandCheckScope as ft, runDaemonUninstall as g, resolveDeviceAuthClientId as gt, runDaemonTeardownStrict as h, requestDeviceToken as ht, runDaemonAutostart as i, buildUnifiedCardFrame as it, runDaemonStartDecisionPrompt as j, buildDaemonStartDeferredCard as k, runDaemonReinstall as l, getCurrentCommandCheckState as lt, runDaemonStop as m, fetchAuthUserSnapshot as mt, isManagedSystemServiceBootstrapRun as n, renderInfoCard as nt, runDaemonCancel as o, isReturnKeypress as ot, runDaemonStatusFlow as p, extractAuthApiErrorMessage as pt, runAuthLogin as q, runDaemon as r, renderTextInfoCard as rt, runDaemonInstall as s, runInteractivePrompt as st, bestEffortStopCurrentLaneDaemonService as t, buildTextInfoCardLines as tt, runDaemonRunAfterEntryChecks as u, isCurrentCommandCheckScopeActive as ut, buildSystemServiceStartupFailureReportFromVerdict as v, revokeAuthAccessToken as vt, reconcileCliVersionView as w, acceptOrganizationJoinLinkBodySchema as wt, resolveServiceParticipationReadiness as x, cliJsonSkillsListEnvelopeSchema as xt, formatServiceParticipationReadinessLabel as y, cliJsonErrorEnvelopeSchema as yt, writeInstalledLocalComponentsSnapshot as z };
 
-//# sourceMappingURL=service-BlcIfxYE.js.map
+//# sourceMappingURL=service-yziCG6lR.js.map