openmeld 0.3.222 → 0.3.224

package/dist/{service-account-admission-Dy2W3n3_.js → service-account-admission-BfdJ-kKR.js}

@@ -8,15 +8,23 @@ const serviceControlCapabilitiesSchema = z$1.strictObject({
 	start: z$1.boolean(),
 	stop: z$1.boolean()
 });
-const serviceControlCarrierCapabilitySchema = z$1.discriminatedUnion("protocol", [z$1.strictObject({
-	protocol: z$1.literal("account-checked-service-control-v1"),
-	executable: z$1.string().min(1)
-}), z$1.strictObject({
-	protocol: z$1.literal("account-checked-service-control-v2"),
-	platform: z$1.literal("win32"),
-	executable: z$1.string().min(1),
-	entryScript: z$1.string().min(1)
-})]);
+const serviceControlCarrierCapabilitySchema = z$1.discriminatedUnion("protocol", [
+	z$1.strictObject({
+		protocol: z$1.literal("account-checked-service-control-v1"),
+		executable: z$1.string().min(1)
+	}),
+	z$1.strictObject({
+		protocol: z$1.literal("account-checked-service-control-v2"),
+		platform: z$1.literal("win32"),
+		executable: z$1.string().min(1),
+		entryScript: z$1.string().min(1)
+	}),
+	z$1.strictObject({
+		protocol: z$1.literal("account-checked-service-control-v3"),
+		platform: z$1.literal("win32"),
+		executable: z$1.string().min(1)
+	})
+]);
 const serviceAccountControlRequestSchema = z$1.strictObject({
 	operation: z$1.enum(["start", "stop"]),
 	expectedAccount: z$1.string().trim().min(1)
@@ -59,4 +67,4 @@ const serviceAccountAdmissionSchema = z$1.strictObject({
 //#endregion
 export { serviceControlCarrierCapabilitySchema as a, serviceControlCapabilitiesSchema as i, serviceAccountAdmissionSchema as n, serviceAccountControlRequestSchema as r, SERVICE_ACCOUNT_STOP_REFUSED_CODE as t };
 
-//# sourceMappingURL=service-account-admission-Dy2W3n3_.js.map
+//# sourceMappingURL=service-account-admission-BfdJ-kKR.js.map

package/dist/service-account-admission-BfdJ-kKR.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-account-admission-BfdJ-kKR.js","names":[],"sources":["../../../packages/schemas/dist/service-account-admission.js"],"sourcesContent":["import * as z$1 from \"zod/v4\";\n//#region src/service-account-admission.ts\nconst SERVICE_ACCOUNT_STOP_REFUSED_CODE = \"service.account_admission.stop_refused\";\nconst serviceControlCapabilitiesSchema = z$1.strictObject({\n\tdeviceId: z$1.string().min(1).nullable(),\n\tstart: z$1.boolean(),\n\tstop: z$1.boolean()\n});\nconst serviceControlCarrierCapabilitySchema = z$1.discriminatedUnion(\"protocol\", [\n\tz$1.strictObject({\n\t\tprotocol: z$1.literal(\"account-checked-service-control-v1\"),\n\t\texecutable: z$1.string().min(1)\n\t}),\n\tz$1.strictObject({\n\t\tprotocol: z$1.literal(\"account-checked-service-control-v2\"),\n\t\tplatform: z$1.literal(\"win32\"),\n\t\texecutable: z$1.string().min(1),\n\t\tentryScript: z$1.string().min(1)\n\t}),\n\tz$1.strictObject({\n\t\tprotocol: z$1.literal(\"account-checked-service-control-v3\"),\n\t\tplatform: z$1.literal(\"win32\"),\n\t\texecutable: z$1.string().min(1)\n\t})\n]);\nconst serviceAccountControlRequestSchema = z$1.strictObject({\n\toperation: z$1.enum([\"start\", \"stop\"]),\n\texpectedAccount: z$1.string().trim().min(1)\n});\nconst serviceAccountAdmissionIdentitySchema = z$1.strictObject({\n\taccountId: z$1.string().min(1),\n\tauthBaseUrl: z$1.url(),\n\tclientId: z$1.string().min(1),\n\tgatewayUrl: z$1.url(),\n\tlane: z$1.enum([\n\t\t\"prod\",\n\t\t\"dev-local\",\n\t\t\"canary\"\n\t]),\n\tdeviceId: z$1.string().min(1),\n\tcontractGeneration: z$1.int().positive()\n});\nconst processIdentitySchema = z$1.strictObject({\n\townerPid: z$1.int().positive(),\n\townerProcessStartedAt: z$1.string().min(1)\n});\nconst serviceAccountAdmissionSchema = z$1.strictObject({\n\tversion: z$1.literal(1),\n\tid: z$1.uuid(),\n\toperation: z$1.enum([\"start\", \"stop\"]),\n\tstate: z$1.enum([\n\t\t\"pending\",\n\t\t\"admitted\",\n\t\t\"cancelled\"\n\t]),\n\tidentity: serviceAccountAdmissionIdentitySchema,\n\trequester: processIdentitySchema,\n\ttarget: processIdentitySchema.optional(),\n\tcarrier: processIdentitySchema.optional(),\n\tstartupReceipt: z$1.strictObject({\n\t\tid: z$1.uuid(),\n\t\tcontractBinding: z$1.string().regex(/^[a-f0-9]{64}$/)\n\t}).optional()\n});\n//#endregion\nexport { SERVICE_ACCOUNT_STOP_REFUSED_CODE, serviceAccountAdmissionIdentitySchema, serviceAccountAdmissionSchema, serviceAccountControlRequestSchema, serviceControlCapabilitiesSchema, serviceControlCarrierCapabilitySchema };\n\n//# sourceMappingURL=service-account-admission.js.map"],"mappings":";;;;AAEA,MAAM,oCAAoC;AAC1C,MAAM,mCAAmC,IAAI,aAAa;CACzD,UAAU,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;CACvC,OAAO,IAAI,QAAQ;CACnB,MAAM,IAAI,QAAQ;AACnB,CAAC;AACD,MAAM,wCAAwC,IAAI,mBAAmB,YAAY;CAChF,IAAI,aAAa;EAChB,UAAU,IAAI,QAAQ,oCAAoC;EAC1D,YAAY,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC;CAC/B,CAAC;CACD,IAAI,aAAa;EAChB,UAAU,IAAI,QAAQ,oCAAoC;EAC1D,UAAU,IAAI,QAAQ,OAAO;EAC7B,YAAY,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC;EAC9B,aAAa,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC;CAChC,CAAC;CACD,IAAI,aAAa;EAChB,UAAU,IAAI,QAAQ,oCAAoC;EAC1D,UAAU,IAAI,QAAQ,OAAO;EAC7B,YAAY,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC;CAC/B,CAAC;AACF,CAAC;AACD,MAAM,qCAAqC,IAAI,aAAa;CAC3D,WAAW,IAAI,KAAK,CAAC,SAAS,MAAM,CAAC;CACrC,iBAAiB,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;AAC3C,CAAC;AACD,MAAM,wCAAwC,IAAI,aAAa;CAC9D,WAAW,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC;CAC7B,aAAa,IAAI,IAAI;CACrB,UAAU,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC;CAC5B,YAAY,IAAI,IAAI;CACpB,MAAM,IAAI,KAAK;EACd;EACA;EACA;CACD,CAAC;CACD,UAAU,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC;CAC5B,oBAAoB,IAAI,IAAI,CAAC,CAAC,SAAS;AACxC,CAAC;AACD,MAAM,wBAAwB,IAAI,aAAa;CAC9C,UAAU,IAAI,IAAI,CAAC,CAAC,SAAS;CAC7B,uBAAuB,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC;AAC1C,CAAC;AACD,MAAM,gCAAgC,IAAI,aAAa;CACtD,SAAS,IAAI,QAAQ,CAAC;CACtB,IAAI,IAAI,KAAK;CACb,WAAW,IAAI,KAAK,CAAC,SAAS,MAAM,CAAC;CACrC,OAAO,IAAI,KAAK;EACf;EACA;EACA;CACD,CAAC;CACD,UAAU;CACV,WAAW;CACX,QAAQ,sBAAsB,SAAS;CACvC,SAAS,sBAAsB,SAAS;CACxC,gBAAgB,IAAI,aAAa;EAChC,IAAI,IAAI,KAAK;EACb,iBAAiB,IAAI,OAAO,CAAC,CAAC,MAAM,gBAAgB;CACrD,CAAC,CAAC,CAAC,SAAS;AACb,CAAC"}

package/dist/{service-account-authorization-DKpIpxXo.js → service-account-authorization-DZbUOD29.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 
-import { et as openMeldRootDir, lt as resolveOpenMeldRootDir, ut as resolveOpenMeldServiceOwnedPathInput } from "./lock-Bsl_ElWy.js";
-import { D as admitServiceAccountOperation, E as ServiceAccountAdmissionError, j as withAuthSessionTransitionMutationLock, w as withAdmittedServiceSession, y as readServiceAdmissionSessionWithOwnership } from "./auth-session-nhS8jyux.js";
-import { r as readDaemonRuntimeLease } from "./daemon-runtime-lease-BUr4qsLo.js";
-import { i as readDaemonServiceContract } from "./daemon-service-contract-BpOBMGX0.js";
-import { t as resolveOpenMeldEnvironmentTarget } from "./openmeld-environment-target-B6HqY0_a.js";
+import { dt as resolveOpenMeldServiceOwnedPathInput, tt as openMeldRootDir, ut as resolveOpenMeldRootDir } from "./lock-iue1J2xy.js";
+import { D as admitServiceAccountOperation, E as ServiceAccountAdmissionError, j as withAuthSessionTransitionMutationLock, w as withAdmittedServiceSession, y as readServiceAdmissionSessionWithOwnership } from "./auth-session-uEk_Tx6T.js";
+import { r as readDaemonRuntimeLease } from "./daemon-runtime-lease-1LMeZ6IS.js";
+import { i as readDaemonServiceContract } from "./daemon-service-contract-GLmAxsq-.js";
+import { t as resolveOpenMeldEnvironmentTarget } from "./openmeld-environment-target-BBn5Ko6p.js";
 import { resolve } from "node:path";
 //#region src/local-service/lifecycle/service-account-authorization.ts
 function refused(reason, message) {
@@ -53,4 +53,4 @@ async function admitServiceAccountStop(input) {
 //#endregion
 export { resolveServiceAccountIdentity as n, runServiceAccountCarrier as r, admitServiceAccountStop as t };
 
-//# sourceMappingURL=service-account-authorization-DKpIpxXo.js.map
+//# sourceMappingURL=service-account-authorization-DZbUOD29.js.map

package/dist/{service-account-authorization-DKpIpxXo.js.map → service-account-authorization-DZbUOD29.js.map}

@@ -1 +1 @@
-{"version":3,"file":"service-account-authorization-DKpIpxXo.js","names":[],"sources":["../src/local-service/lifecycle/service-account-authorization.ts"],"sourcesContent":["import { resolve } from \"node:path\";\nimport type { ServiceAccountAdmissionIdentity } from \"@openmeld/schemas\";\nimport {\n  readServiceAdmissionSessionWithOwnership,\n  type StoredAuthSession,\n  withAdmittedServiceSession,\n} from \"../../config/auth-session\";\nimport { withAuthSessionTransitionMutationLock } from \"../../config/auth-session-transition-lock\";\nimport { readDaemonRuntimeLease } from \"../../config/daemon-runtime-lease\";\nimport { readDaemonServiceContract } from \"../../config/daemon-service-contract\";\nimport { resolveOpenMeldEnvironmentTarget } from \"../../config/openmeld-environment-target\";\nimport {\n  openMeldRootDir,\n  resolveOpenMeldRootDir,\n  resolveOpenMeldServiceOwnedPathInput,\n} from \"../../config/paths\";\nimport {\n  admitServiceAccountOperation,\n  ServiceAccountAdmissionError,\n} from \"../../config/service-account-admission\";\n\ntype Contract = NonNullable<\n  Awaited<ReturnType<typeof readDaemonServiceContract>>\n>;\nfunction refused(reason: string, message: string): never {\n  throw new ServiceAccountAdmissionError(reason, message);\n}\n\nexport async function resolveServiceAccountIdentity(\n  session: StoredAuthSession,\n  contract: Contract\n): Promise<ServiceAccountAdmissionIdentity> {\n  const target = await resolveOpenMeldEnvironmentTarget();\n  if (\n    resolve(openMeldRootDir()) !==\n      resolve(resolveOpenMeldRootDir(resolveOpenMeldServiceOwnedPathInput())) ||\n    contract.lane !== target.preset ||\n    contract.gatewayUrl !== target.gatewayUrl ||\n    session.authBaseUrl !== target.authBaseUrl ||\n    !contract.ownerUserId ||\n    contract.ownerUserId !== session.user?.id ||\n    !contract.connectedComputerId\n  ) {\n    refused(\n      \"ownership_mismatch\",\n      \"This Service does not match the signed-in account or environment. Reconnect it through OpenMeld setup before trying again.\"\n    );\n  }\n  return {\n    accountId: contract.ownerUserId,\n    authBaseUrl: session.authBaseUrl,\n    clientId: session.clientId,\n    gatewayUrl: target.gatewayUrl,\n    lane: target.preset,\n    deviceId: contract.deviceId,\n    contractGeneration: contract.generation,\n  };\n}\n\nexport async function runServiceAccountCarrier<T>(\n  id: string,\n  run: () => Promise<T>\n): Promise<T> {\n  const session = await withAuthSessionTransitionMutationLock(async () => {\n    const local = await readServiceAdmissionSessionWithOwnership();\n    const contract = await readDaemonServiceContract();\n    if (!contract || contract.desiredState !== \"background\") {\n      refused(\n        \"cancelled\",\n        \"This Service startup is no longer authorized. Start the Service again from the matching account.\"\n      );\n    }\n    await admitServiceAccountOperation({\n      id,\n      operation: \"start\",\n      identity: await resolveServiceAccountIdentity(local, contract),\n    });\n    return local;\n  });\n  return await withAdmittedServiceSession(session, run);\n}\n\nexport async function admitServiceAccountStop(input: {\n  id: string;\n  ownerUserId: string;\n  deviceId: string;\n  contractGeneration: number;\n  commit: () => void;\n}): Promise<void> {\n  await withAuthSessionTransitionMutationLock(async () => {\n    const session = await readServiceAdmissionSessionWithOwnership();\n    const contract = await readDaemonServiceContract();\n    const lease = await readDaemonRuntimeLease();\n    if (\n      !(contract && lease) ||\n      lease.pid !== process.pid ||\n      contract.generation !== input.contractGeneration ||\n      contract.ownerUserId !== input.ownerUserId ||\n      contract.deviceId !== input.deviceId\n    ) {\n      refused(\n        \"ownership_changed\",\n        \"The running Service changed before this Stop was accepted. Check its status and try again.\"\n      );\n    }\n    await admitServiceAccountOperation({\n      id: input.id,\n      operation: \"stop\",\n      identity: await resolveServiceAccountIdentity(session, contract),\n      commit: input.commit,\n    });\n  });\n}\n"],"mappings":";;;;;;;;;AAwBA,SAAS,QAAQ,QAAgB,SAAwB;CACvD,MAAM,IAAI,6BAA6B,QAAQ,OAAO;AACxD;AAEA,eAAsB,8BACpB,SACA,UAC0C;CAC1C,MAAM,SAAS,MAAM,iCAAiC;CACtD,IACE,QAAQ,gBAAgB,CAAC,MACvB,QAAQ,uBAAuB,qCAAqC,CAAC,CAAC,KACxE,SAAS,SAAS,OAAO,UACzB,SAAS,eAAe,OAAO,cAC/B,QAAQ,gBAAgB,OAAO,eAC/B,CAAC,SAAS,eACV,SAAS,gBAAgB,QAAQ,MAAM,MACvC,CAAC,SAAS,qBAEV,QACE,sBACA,4HACF;CAEF,OAAO;EACL,WAAW,SAAS;EACpB,aAAa,QAAQ;EACrB,UAAU,QAAQ;EAClB,YAAY,OAAO;EACnB,MAAM,OAAO;EACb,UAAU,SAAS;EACnB,oBAAoB,SAAS;CAC/B;AACF;AAEA,eAAsB,yBACpB,IACA,KACY;CAiBZ,OAAO,MAAM,2BAA2B,MAhBlB,sCAAsC,YAAY;EACtE,MAAM,QAAQ,MAAM,yCAAyC;EAC7D,MAAM,WAAW,MAAM,0BAA0B;EACjD,IAAI,CAAC,YAAY,SAAS,iBAAiB,cACzC,QACE,aACA,kGACF;EAEF,MAAM,6BAA6B;GACjC;GACA,WAAW;GACX,UAAU,MAAM,8BAA8B,OAAO,QAAQ;EAC/D,CAAC;EACD,OAAO;CACT,CAAC,GACgD,GAAG;AACtD;AAEA,eAAsB,wBAAwB,OAM5B;CAChB,MAAM,sCAAsC,YAAY;EACtD,MAAM,UAAU,MAAM,yCAAyC;EAC/D,MAAM,WAAW,MAAM,0BAA0B;EACjD,MAAM,QAAQ,MAAM,uBAAuB;EAC3C,IACE,EAAE,YAAY,UACd,MAAM,QAAQ,QAAQ,OACtB,SAAS,eAAe,MAAM,sBAC9B,SAAS,gBAAgB,MAAM,eAC/B,SAAS,aAAa,MAAM,UAE5B,QACE,qBACA,4FACF;EAEF,MAAM,6BAA6B;GACjC,IAAI,MAAM;GACV,WAAW;GACX,UAAU,MAAM,8BAA8B,SAAS,QAAQ;GAC/D,QAAQ,MAAM;EAChB,CAAC;CACH,CAAC;AACH"}
+{"version":3,"file":"service-account-authorization-DZbUOD29.js","names":[],"sources":["../src/local-service/lifecycle/service-account-authorization.ts"],"sourcesContent":["import { resolve } from \"node:path\";\nimport type { ServiceAccountAdmissionIdentity } from \"@openmeld/schemas\";\nimport {\n  readServiceAdmissionSessionWithOwnership,\n  type StoredAuthSession,\n  withAdmittedServiceSession,\n} from \"../../config/auth-session\";\nimport { withAuthSessionTransitionMutationLock } from \"../../config/auth-session-transition-lock\";\nimport { readDaemonRuntimeLease } from \"../../config/daemon-runtime-lease\";\nimport { readDaemonServiceContract } from \"../../config/daemon-service-contract\";\nimport { resolveOpenMeldEnvironmentTarget } from \"../../config/openmeld-environment-target\";\nimport {\n  openMeldRootDir,\n  resolveOpenMeldRootDir,\n  resolveOpenMeldServiceOwnedPathInput,\n} from \"../../config/paths\";\nimport {\n  admitServiceAccountOperation,\n  ServiceAccountAdmissionError,\n} from \"../../config/service-account-admission\";\n\ntype Contract = NonNullable<\n  Awaited<ReturnType<typeof readDaemonServiceContract>>\n>;\nfunction refused(reason: string, message: string): never {\n  throw new ServiceAccountAdmissionError(reason, message);\n}\n\nexport async function resolveServiceAccountIdentity(\n  session: StoredAuthSession,\n  contract: Contract\n): Promise<ServiceAccountAdmissionIdentity> {\n  const target = await resolveOpenMeldEnvironmentTarget();\n  if (\n    resolve(openMeldRootDir()) !==\n      resolve(resolveOpenMeldRootDir(resolveOpenMeldServiceOwnedPathInput())) ||\n    contract.lane !== target.preset ||\n    contract.gatewayUrl !== target.gatewayUrl ||\n    session.authBaseUrl !== target.authBaseUrl ||\n    !contract.ownerUserId ||\n    contract.ownerUserId !== session.user?.id ||\n    !contract.connectedComputerId\n  ) {\n    refused(\n      \"ownership_mismatch\",\n      \"This Service does not match the signed-in account or environment. Reconnect it through OpenMeld setup before trying again.\"\n    );\n  }\n  return {\n    accountId: contract.ownerUserId,\n    authBaseUrl: session.authBaseUrl,\n    clientId: session.clientId,\n    gatewayUrl: target.gatewayUrl,\n    lane: target.preset,\n    deviceId: contract.deviceId,\n    contractGeneration: contract.generation,\n  };\n}\n\nexport async function runServiceAccountCarrier<T>(\n  id: string,\n  run: () => Promise<T>\n): Promise<T> {\n  const session = await withAuthSessionTransitionMutationLock(async () => {\n    const local = await readServiceAdmissionSessionWithOwnership();\n    const contract = await readDaemonServiceContract();\n    if (!contract || contract.desiredState !== \"background\") {\n      refused(\n        \"cancelled\",\n        \"This Service startup is no longer authorized. Start the Service again from the matching account.\"\n      );\n    }\n    await admitServiceAccountOperation({\n      id,\n      operation: \"start\",\n      identity: await resolveServiceAccountIdentity(local, contract),\n    });\n    return local;\n  });\n  return await withAdmittedServiceSession(session, run);\n}\n\nexport async function admitServiceAccountStop(input: {\n  id: string;\n  ownerUserId: string;\n  deviceId: string;\n  contractGeneration: number;\n  commit: () => void;\n}): Promise<void> {\n  await withAuthSessionTransitionMutationLock(async () => {\n    const session = await readServiceAdmissionSessionWithOwnership();\n    const contract = await readDaemonServiceContract();\n    const lease = await readDaemonRuntimeLease();\n    if (\n      !(contract && lease) ||\n      lease.pid !== process.pid ||\n      contract.generation !== input.contractGeneration ||\n      contract.ownerUserId !== input.ownerUserId ||\n      contract.deviceId !== input.deviceId\n    ) {\n      refused(\n        \"ownership_changed\",\n        \"The running Service changed before this Stop was accepted. Check its status and try again.\"\n      );\n    }\n    await admitServiceAccountOperation({\n      id: input.id,\n      operation: \"stop\",\n      identity: await resolveServiceAccountIdentity(session, contract),\n      commit: input.commit,\n    });\n  });\n}\n"],"mappings":";;;;;;;;;AAwBA,SAAS,QAAQ,QAAgB,SAAwB;CACvD,MAAM,IAAI,6BAA6B,QAAQ,OAAO;AACxD;AAEA,eAAsB,8BACpB,SACA,UAC0C;CAC1C,MAAM,SAAS,MAAM,iCAAiC;CACtD,IACE,QAAQ,gBAAgB,CAAC,MACvB,QAAQ,uBAAuB,qCAAqC,CAAC,CAAC,KACxE,SAAS,SAAS,OAAO,UACzB,SAAS,eAAe,OAAO,cAC/B,QAAQ,gBAAgB,OAAO,eAC/B,CAAC,SAAS,eACV,SAAS,gBAAgB,QAAQ,MAAM,MACvC,CAAC,SAAS,qBAEV,QACE,sBACA,4HACF;CAEF,OAAO;EACL,WAAW,SAAS;EACpB,aAAa,QAAQ;EACrB,UAAU,QAAQ;EAClB,YAAY,OAAO;EACnB,MAAM,OAAO;EACb,UAAU,SAAS;EACnB,oBAAoB,SAAS;CAC/B;AACF;AAEA,eAAsB,yBACpB,IACA,KACY;CAiBZ,OAAO,MAAM,2BAA2B,MAhBlB,sCAAsC,YAAY;EACtE,MAAM,QAAQ,MAAM,yCAAyC;EAC7D,MAAM,WAAW,MAAM,0BAA0B;EACjD,IAAI,CAAC,YAAY,SAAS,iBAAiB,cACzC,QACE,aACA,kGACF;EAEF,MAAM,6BAA6B;GACjC;GACA,WAAW;GACX,UAAU,MAAM,8BAA8B,OAAO,QAAQ;EAC/D,CAAC;EACD,OAAO;CACT,CAAC,GACgD,GAAG;AACtD;AAEA,eAAsB,wBAAwB,OAM5B;CAChB,MAAM,sCAAsC,YAAY;EACtD,MAAM,UAAU,MAAM,yCAAyC;EAC/D,MAAM,WAAW,MAAM,0BAA0B;EACjD,MAAM,QAAQ,MAAM,uBAAuB;EAC3C,IACE,EAAE,YAAY,UACd,MAAM,QAAQ,QAAQ,OACtB,SAAS,eAAe,MAAM,sBAC9B,SAAS,gBAAgB,MAAM,eAC/B,SAAS,aAAa,MAAM,UAE5B,QACE,qBACA,4FACF;EAEF,MAAM,6BAA6B;GACjC,IAAI,MAAM;GACV,WAAW;GACX,UAAU,MAAM,8BAA8B,SAAS,QAAQ;GAC/D,QAAQ,MAAM;EAChB,CAAC;CACH,CAAC;AACH"}

package/dist/{service-account-control-CCPQAZzn.js → service-account-control-DCMOKXDT.js}

@@ -1,19 +1,19 @@
 #!/usr/bin/env node
 
-import { A as reserveServiceAccountAdmission, E as ServiceAccountAdmissionError, O as cancelServiceAccountAdmission, d as getAuthSessionState, j as withAuthSessionTransitionMutationLock, k as readServiceAccountAdmission, o as buildStoredAuthSessionIdentity, w as withAdmittedServiceSession, y as readServiceAdmissionSessionWithOwnership } from "./auth-session-nhS8jyux.js";
-import { T as createQuietPresenter, d as runDaemonServiceDetached, m as runDaemonStop, mt as fetchAuthUserSnapshot } from "./service-CfO38_a-.js";
-import { r as serviceAccountControlRequestSchema } from "./service-account-admission-Dy2W3n3_.js";
-import "./daemon-device-id-DWO9_QW6.js";
-import { r as readDaemonRuntimeLease } from "./daemon-runtime-lease-BUr4qsLo.js";
-import { r as readCurrentDaemonRuntimeContext } from "./daemon-service-runtime-bKt0YjC7.js";
-import { Ht as buildDaemonSystemServiceCommandSpec } from "./daemon-service-update-coordinator-D8O1uTtu.js";
-import { i as readProcessStartIdentity } from "./process-identity-CNus0e6E.js";
-import { K as withDaemonServiceRunLock } from "./daemon-state-B44aq2nm.js";
-import { a as upsertDaemonServiceContract, i as readDaemonServiceContract } from "./daemon-service-contract-BpOBMGX0.js";
-import { n as resolveServiceAccountIdentity } from "./service-account-authorization-DKpIpxXo.js";
-import { S as requestLocalDaemonShutdown, y as LocalDaemonControlPlaneClientError } from "./daemon-lifecycle-journal-DyKx1xzm.js";
-import { S as resolveDaemonServiceManager } from "./daemon-service-manager-HL4VKbIU.js";
-import { n as resolveRuntimeContext } from "./context-l_31Mn4X.js";
+import { A as reserveServiceAccountAdmission, E as ServiceAccountAdmissionError, O as cancelServiceAccountAdmission, d as getAuthSessionState, j as withAuthSessionTransitionMutationLock, k as readServiceAccountAdmission, o as buildStoredAuthSessionIdentity, w as withAdmittedServiceSession, y as readServiceAdmissionSessionWithOwnership } from "./auth-session-uEk_Tx6T.js";
+import { T as createQuietPresenter, d as runDaemonServiceDetached, m as runDaemonStop, mt as fetchAuthUserSnapshot } from "./service-Dz2MsvGr.js";
+import { r as serviceAccountControlRequestSchema } from "./service-account-admission-BfdJ-kKR.js";
+import { r as readCurrentDaemonRuntimeContext } from "./daemon-service-runtime-CBJtgM4P.js";
+import "./daemon-device-id-B1Af2Zmn.js";
+import { r as readDaemonRuntimeLease } from "./daemon-runtime-lease-1LMeZ6IS.js";
+import { i as readProcessStartIdentity } from "./process-identity-BQLdaZdB.js";
+import { Ut as resolveInstalledDaemonSystemServiceCommandSpec } from "./daemon-service-update-coordinator-0LB_XGVZ.js";
+import { K as withDaemonServiceRunLock } from "./daemon-state-Ca0WK5x0.js";
+import { a as upsertDaemonServiceContract, i as readDaemonServiceContract } from "./daemon-service-contract-GLmAxsq-.js";
+import { n as resolveServiceAccountIdentity } from "./service-account-authorization-DZbUOD29.js";
+import { S as requestLocalDaemonShutdown, y as LocalDaemonControlPlaneClientError } from "./daemon-lifecycle-journal-CDZLWgMj.js";
+import { S as resolveDaemonServiceManager } from "./daemon-service-manager-C8RUCMDo.js";
+import { n as resolveRuntimeContext } from "./context-Bdh3nAzw.js";
 import { setTimeout } from "node:timers/promises";
 //#region src/commands/service-account-control.ts
 function refused(reason, message) {
@@ -80,7 +80,7 @@ async function runServiceAccountControl(request, expectedSessionIdentity) {
 					});
 				} else if (manager) {
 					await manager.deactivate();
-					await manager.install(buildDaemonSystemServiceCommandSpec({
+					await manager.install(await resolveInstalledDaemonSystemServiceCommandSpec({
 						controller: manager.controller,
 						accountAdmissionId: reservation.id
 					}));
@@ -145,4 +145,4 @@ async function requestAccountCheckedServiceStop({ id, manager }) {
 //#endregion
 export { runServiceAccountControl as t };
 
-//# sourceMappingURL=service-account-control-CCPQAZzn.js.map
+//# sourceMappingURL=service-account-control-DCMOKXDT.js.map

package/dist/service-account-control-DCMOKXDT.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-account-control-DCMOKXDT.js","names":["delay"],"sources":["../src/commands/service-account-control.ts"],"sourcesContent":["import { setTimeout as delay } from \"node:timers/promises\";\nimport {\n  SERVICE_ACCOUNT_STOP_REFUSED_CODE,\n  type ServiceAccountControlRequest,\n  serviceAccountControlRequestSchema,\n} from \"@openmeld/schemas\";\nimport {\n  buildStoredAuthSessionIdentity,\n  getAuthSessionState,\n  readServiceAdmissionSessionWithOwnership,\n  type StoredAuthSession,\n  withAdmittedServiceSession,\n} from \"../config/auth-session\";\nimport { withAuthSessionTransitionMutationLock } from \"../config/auth-session-transition-lock\";\nimport { readDaemonRuntimeLease } from \"../config/daemon-runtime-lease\";\nimport {\n  readDaemonServiceContract,\n  upsertDaemonServiceContract,\n} from \"../config/daemon-service-contract\";\nimport { withDaemonServiceRunLock } from \"../config/daemon-state\";\nimport {\n  cancelServiceAccountAdmission,\n  readServiceAccountAdmission,\n  reserveServiceAccountAdmission,\n  ServiceAccountAdmissionError,\n} from \"../config/service-account-admission\";\nimport {\n  LocalDaemonControlPlaneClientError,\n  requestLocalDaemonShutdown,\n} from \"../local-service/control-plane/client\";\nimport { CONTROLLED_SHUTDOWN_REQUEST_TIMEOUT_MS } from \"../local-service/core/constants\";\nimport { resolveInstalledDaemonSystemServiceCommandSpec } from \"../local-service/lifecycle/daemon-service-command-spec\";\nimport {\n  type DaemonServiceManager,\n  resolveDaemonServiceManager,\n} from \"../local-service/lifecycle/daemon-service-manager\";\nimport { readCurrentDaemonRuntimeContext } from \"../local-service/lifecycle/daemon-service-runtime\";\nimport { resolveServiceAccountIdentity } from \"../local-service/lifecycle/service-account-authorization\";\nimport { resolveRuntimeContext } from \"../runtime/context\";\nimport { readProcessStartIdentity } from \"../system/process-identity\";\nimport { fetchAuthUserSnapshot } from \"./auth-device-session-client\";\nimport { runDaemonServiceDetached, runDaemonStop } from \"./service\";\nimport { createQuietPresenter } from \"./service-output\";\n\ntype Contract = NonNullable<\n  Awaited<ReturnType<typeof readDaemonServiceContract>>\n>;\n\nfunction refused(reason: string, message: string): never {\n  throw new ServiceAccountAdmissionError(reason, message);\n}\n\nexport async function runServiceAccountControl(\n  request: ServiceAccountControlRequest,\n  expectedSessionIdentity?: string\n): Promise<void> {\n  const parsed = serviceAccountControlRequestSchema.safeParse(request);\n  if (!parsed.success) {\n    refused(\n      \"missing_account\",\n      \"Choose a signed-in account before controlling this Service.\"\n    );\n  }\n  const input = parsed.data;\n  const auth = await getAuthSessionState();\n  if (auth.state !== \"valid\" || !auth.session) {\n    refused(\n      \"authentication_required\",\n      \"Sign in to the CLI with the matching account and try again.\"\n    );\n  }\n  const preparedSession = auth.session;\n  if (preparedSession.user?.id !== input.expectedAccount) {\n    refused(\n      \"account_mismatch\",\n      \"The CLI is signed in to a different account. Sign in with the matching account and try again.\"\n    );\n  }\n  // The shared Auth endpoint proves the principal. Local metadata alone does not.\n  const user = await fetchAuthUserSnapshot({\n    authBaseUrl: preparedSession.authBaseUrl,\n    accessToken: preparedSession.accessToken,\n  });\n  if (user.id !== input.expectedAccount) {\n    refused(\n      \"account_mismatch\",\n      \"The CLI session belongs to a different account. Sign in again and retry.\"\n    );\n  }\n\n  await withDaemonServiceRunLock(async () => {\n    const contract = await readDaemonServiceContract();\n    if (!contract) {\n      refused(\n        \"ownership_unknown\",\n        \"Connect this computer through OpenMeld setup before controlling its Service.\"\n      );\n    }\n    const observed = await readCurrentDaemonRuntimeContext();\n    const lease = await readDaemonRuntimeLease();\n    if (\n      input.operation === \"start\" &&\n      observed.effectiveRuntimeStatus !== \"not_running\"\n    ) {\n      refused(\n        \"busy\",\n        \"The Service is already running or its state is uncertain. Check Service status before trying again.\"\n      );\n    }\n    if (\n      input.operation === \"stop\" &&\n      (observed.effectiveRuntimeStatus !== \"running\" ||\n        !lease ||\n        lease.generation !== contract.generation)\n    ) {\n      refused(\n        \"ownership_unknown\",\n        \"OpenMeld could not verify the running Service. Check Service status before trying again.\"\n      );\n    }\n\n    let boundSession: StoredAuthSession = preparedSession;\n    const reservation = await withAuthSessionTransitionMutationLock(\n      async () => {\n        boundSession = await readServiceAdmissionSessionWithOwnership();\n        if (\n          (expectedSessionIdentity !== undefined &&\n            buildStoredAuthSessionIdentity(boundSession) !==\n              expectedSessionIdentity) ||\n          boundSession.accessToken !== preparedSession.accessToken ||\n          boundSession.createdAt !== preparedSession.createdAt ||\n          boundSession.user?.id !== input.expectedAccount\n        ) {\n          refused(\n            \"account_changed\",\n            \"The CLI sign-in changed before this action was accepted. Check the account and try again.\"\n          );\n        }\n        const current = await readDaemonServiceContract();\n        if (!current || JSON.stringify(current) !== JSON.stringify(contract)) {\n          refused(\n            \"ownership_changed\",\n            \"The Service changed before this action was accepted. Check its status and try again.\"\n          );\n        }\n        const identity = await resolveServiceAccountIdentity(\n          boundSession,\n          contract\n        );\n        if (\n          input.operation === \"start\" &&\n          contract.desiredState !== \"background\"\n        ) {\n          identity.contractGeneration += 1;\n        }\n        return await reserveServiceAccountAdmission({\n          operation: input.operation,\n          identity,\n          ...(input.operation === \"stop\" && lease\n            ? {\n                target: {\n                  ownerPid: lease.pid,\n                  ownerProcessStartedAt:\n                    readProcessStartIdentity(lease.pid) ??\n                    refused(\n                      \"ownership_unknown\",\n                      \"OpenMeld could not identify the Service process. Check its status and try again.\"\n                    ),\n                },\n              }\n            : {}),\n        });\n      }\n    );\n\n    try {\n      await withAdmittedServiceSession(boundSession, async () => {\n        if (input.operation === \"stop\") {\n          await stopReservedService(contract, reservation.id, lease?.pid ?? 0);\n          return;\n        }\n        const manager =\n          contract.serviceController === \"legacy-detached\"\n            ? null\n            : await resolveDaemonServiceManager(contract.serviceController);\n        if (\n          contract.serviceController !== \"legacy-detached\" &&\n          !(manager && (await manager.status()).installed)\n        ) {\n          refused(\n            \"installation_required\",\n            \"This Service needs setup before it can start. Run OpenMeld setup and try again.\"\n          );\n        }\n        await upsertDaemonServiceContract({\n          ...contract,\n          desiredState: \"background\",\n        });\n        if (contract.serviceController === \"legacy-detached\") {\n          const runtime = await resolveRuntimeContext({ view: \"agent\" });\n          await runDaemonServiceDetached({\n            accountAdmissionId: reservation.id,\n            deviceId: contract.deviceId,\n            gatewayUrl: contract.gatewayUrl,\n            heartbeatMs: contract.heartbeatMs,\n            runtime,\n            presenter: createQuietPresenter(runtime),\n            mode: \"background\",\n          });\n        } else if (manager) {\n          // Refresh the existing stopped supervisor definition with an immutable\n          // generation argument. Never install a missing Service.\n          await manager.deactivate();\n          await manager.install(\n            await resolveInstalledDaemonSystemServiceCommandSpec({\n              controller: manager.controller,\n              accountAdmissionId: reservation.id,\n            })\n          );\n          await manager.start();\n        }\n        await waitForAdmittedService(reservation.id);\n      });\n    } finally {\n      await cancelServiceAccountAdmission(reservation.id);\n    }\n  });\n}\n\nasync function waitForAdmittedService(id: string): Promise<void> {\n  const deadline = Date.now() + 15_000;\n  while (Date.now() < deadline) {\n    const current = await readServiceAccountAdmission();\n    const runtime = await readCurrentDaemonRuntimeContext();\n    if (\n      current?.id === id &&\n      current.state === \"admitted\" &&\n      current.carrier?.ownerPid === runtime.runtimeStatus.pid &&\n      runtime.effectiveRuntimeStatus === \"running\"\n    ) {\n      return;\n    }\n    await delay(50);\n  }\n  refused(\n    \"startup_unconfirmed\",\n    \"OpenMeld could not confirm that this Service started. Check Service status before trying again.\"\n  );\n}\n\nasync function stopReservedService(\n  contract: Contract,\n  id: string,\n  pid: number\n): Promise<void> {\n  const manager =\n    contract.serviceController === \"legacy-detached\"\n      ? null\n      : await resolveDaemonServiceManager(contract.serviceController);\n  await requestAccountCheckedServiceStop({ id, manager });\n  const admitted = await readServiceAccountAdmission();\n  if (\n    admitted?.id !== id ||\n    admitted.state !== \"admitted\" ||\n    admitted.carrier?.ownerPid !== pid\n  ) {\n    refused(\n      \"admission_unconfirmed\",\n      \"OpenMeld could not verify that the matching Service accepted Stop. Check Service status before trying again.\"\n    );\n  }\n  const current = await readCurrentDaemonRuntimeContext();\n  if (current.runtimeStatus.pid !== null && current.runtimeStatus.pid !== pid) {\n    refused(\n      \"ownership_changed\",\n      \"Another Service instance is now running. Its state was left unchanged.\"\n    );\n  }\n  await runDaemonStop(\n    { json: true, view: \"agent\" },\n    {\n      completedControlledShutdownOwnerPid: pid,\n    }\n  );\n}\n\nexport async function requestAccountCheckedServiceStop({\n  id,\n  manager,\n}: {\n  id: string;\n  manager: Pick<\n    DaemonServiceManager,\n    \"status\" | \"disableAutostart\" | \"enableAutostart\"\n  > | null;\n}): Promise<void> {\n  const wasEnabled = manager ? (await manager.status()).enabled : false;\n  if (manager) {\n    await manager.disableAutostart();\n  }\n  // No compatibility fallback: only the verified carrier may admit this stop.\n  try {\n    const shutdown = await requestLocalDaemonShutdown({\n      payload: {\n        accountAdmissionId: id,\n        mode: \"graceful\",\n        gracePeriodMs: 2000,\n      },\n      timeoutMs: CONTROLLED_SHUTDOWN_REQUEST_TIMEOUT_MS,\n    });\n    if (!shutdown.accepted) {\n      throw new Error(\"The Service did not confirm controlled shutdown.\");\n    }\n  } catch (error) {\n    if (\n      manager &&\n      wasEnabled &&\n      error instanceof LocalDaemonControlPlaneClientError &&\n      error.code === SERVICE_ACCOUNT_STOP_REFUSED_CODE\n    ) {\n      try {\n        await manager.enableAutostart();\n      } catch (restoreError) {\n        throw new AggregateError(\n          [error, restoreError],\n          \"Stop was refused and its previous autostart setting could not be restored.\"\n        );\n      }\n    }\n    if (\n      !(\n        error instanceof LocalDaemonControlPlaneClientError &&\n        error.code === SERVICE_ACCOUNT_STOP_REFUSED_CODE\n      )\n    ) {\n      const detail = error instanceof Error ? error.message : String(error);\n      refused(\n        \"stop_unconfirmed\",\n        `Stop may already be in progress. ${manager ? \"Autostart remains disabled. \" : \"\"}Check Service status before trying again. ${detail}`\n      );\n    }\n    throw error;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAgDA,SAAS,QAAQ,QAAgB,SAAwB;CACvD,MAAM,IAAI,6BAA6B,QAAQ,OAAO;AACxD;AAEA,eAAsB,yBACpB,SACA,yBACe;CACf,MAAM,SAAS,mCAAmC,UAAU,OAAO;CACnE,IAAI,CAAC,OAAO,SACV,QACE,mBACA,6DACF;CAEF,MAAM,QAAQ,OAAO;CACrB,MAAM,OAAO,MAAM,oBAAoB;CACvC,IAAI,KAAK,UAAU,WAAW,CAAC,KAAK,SAClC,QACE,2BACA,6DACF;CAEF,MAAM,kBAAkB,KAAK;CAC7B,IAAI,gBAAgB,MAAM,OAAO,MAAM,iBACrC,QACE,oBACA,+FACF;CAOF,KAAI,MAJe,sBAAsB;EACvC,aAAa,gBAAgB;EAC7B,aAAa,gBAAgB;CAC/B,CAAC,EAAA,CACQ,OAAO,MAAM,iBACpB,QACE,oBACA,0EACF;CAGF,MAAM,yBAAyB,YAAY;EACzC,MAAM,WAAW,MAAM,0BAA0B;EACjD,IAAI,CAAC,UACH,QACE,qBACA,8EACF;EAEF,MAAM,WAAW,MAAM,gCAAgC;EACvD,MAAM,QAAQ,MAAM,uBAAuB;EAC3C,IACE,MAAM,cAAc,WACpB,SAAS,2BAA2B,eAEpC,QACE,QACA,qGACF;EAEF,IACE,MAAM,cAAc,WACnB,SAAS,2BAA2B,aACnC,CAAC,SACD,MAAM,eAAe,SAAS,aAEhC,QACE,qBACA,0FACF;EAGF,IAAI,eAAkC;EACtC,MAAM,cAAc,MAAM,sCACxB,YAAY;GACV,eAAe,MAAM,yCAAyC;GAC9D,IACG,4BAA4B,KAAA,KAC3B,+BAA+B,YAAY,MACzC,2BACJ,aAAa,gBAAgB,gBAAgB,eAC7C,aAAa,cAAc,gBAAgB,aAC3C,aAAa,MAAM,OAAO,MAAM,iBAEhC,QACE,mBACA,2FACF;GAEF,MAAM,UAAU,MAAM,0BAA0B;GAChD,IAAI,CAAC,WAAW,KAAK,UAAU,OAAO,MAAM,KAAK,UAAU,QAAQ,GACjE,QACE,qBACA,sFACF;GAEF,MAAM,WAAW,MAAM,8BACrB,cACA,QACF;GACA,IACE,MAAM,cAAc,WACpB,SAAS,iBAAiB,cAE1B,SAAS,sBAAsB;GAEjC,OAAO,MAAM,+BAA+B;IAC1C,WAAW,MAAM;IACjB;IACA,GAAI,MAAM,cAAc,UAAU,QAC9B,EACE,QAAQ;KACN,UAAU,MAAM;KAChB,uBACE,yBAAyB,MAAM,GAAG,KAClC,QACE,qBACA,kFACF;IACJ,EACF,IACA,CAAC;GACP,CAAC;EACH,CACF;EAEA,IAAI;GACF,MAAM,2BAA2B,cAAc,YAAY;IACzD,IAAI,MAAM,cAAc,QAAQ;KAC9B,MAAM,oBAAoB,UAAU,YAAY,IAAI,OAAO,OAAO,CAAC;KACnE;IACF;IACA,MAAM,UACJ,SAAS,sBAAsB,oBAC3B,OACA,MAAM,4BAA4B,SAAS,iBAAiB;IAClE,IACE,SAAS,sBAAsB,qBAC/B,EAAE,YAAY,MAAM,QAAQ,OAAO,EAAA,CAAG,YAEtC,QACE,yBACA,iFACF;IAEF,MAAM,4BAA4B;KAChC,GAAG;KACH,cAAc;IAChB,CAAC;IACD,IAAI,SAAS,sBAAsB,mBAAmB;KACpD,MAAM,UAAU,MAAM,sBAAsB,EAAE,MAAM,QAAQ,CAAC;KAC7D,MAAM,yBAAyB;MAC7B,oBAAoB,YAAY;MAChC,UAAU,SAAS;MACnB,YAAY,SAAS;MACrB,aAAa,SAAS;MACtB;MACA,WAAW,qBAAqB,OAAO;MACvC,MAAM;KACR,CAAC;IACH,OAAO,IAAI,SAAS;KAGlB,MAAM,QAAQ,WAAW;KACzB,MAAM,QAAQ,QACZ,MAAM,+CAA+C;MACnD,YAAY,QAAQ;MACpB,oBAAoB,YAAY;KAClC,CAAC,CACH;KACA,MAAM,QAAQ,MAAM;IACtB;IACA,MAAM,uBAAuB,YAAY,EAAE;GAC7C,CAAC;EACH,UAAU;GACR,MAAM,8BAA8B,YAAY,EAAE;EACpD;CACF,CAAC;AACH;AAEA,eAAe,uBAAuB,IAA2B;CAC/D,MAAM,WAAW,KAAK,IAAI,IAAI;CAC9B,OAAO,KAAK,IAAI,IAAI,UAAU;EAC5B,MAAM,UAAU,MAAM,4BAA4B;EAClD,MAAM,UAAU,MAAM,gCAAgC;EACtD,IACE,SAAS,OAAO,MAChB,QAAQ,UAAU,cAClB,QAAQ,SAAS,aAAa,QAAQ,cAAc,OACpD,QAAQ,2BAA2B,WAEnC;EAEF,MAAMA,WAAM,EAAE;CAChB;CACA,QACE,uBACA,iGACF;AACF;AAEA,eAAe,oBACb,UACA,IACA,KACe;CAKf,MAAM,iCAAiC;EAAE;EAAI,SAH3C,SAAS,sBAAsB,oBAC3B,OACA,MAAM,4BAA4B,SAAS,iBAAiB;CACb,CAAC;CACtD,MAAM,WAAW,MAAM,4BAA4B;CACnD,IACE,UAAU,OAAO,MACjB,SAAS,UAAU,cACnB,SAAS,SAAS,aAAa,KAE/B,QACE,yBACA,8GACF;CAEF,MAAM,UAAU,MAAM,gCAAgC;CACtD,IAAI,QAAQ,cAAc,QAAQ,QAAQ,QAAQ,cAAc,QAAQ,KACtE,QACE,qBACA,wEACF;CAEF,MAAM,cACJ;EAAE,MAAM;EAAM,MAAM;CAAQ,GAC5B,EACE,qCAAqC,IACvC,CACF;AACF;AAEA,eAAsB,iCAAiC,EACrD,IACA,WAOgB;CAChB,MAAM,aAAa,WAAW,MAAM,QAAQ,OAAO,EAAA,CAAG,UAAU;CAChE,IAAI,SACF,MAAM,QAAQ,iBAAiB;CAGjC,IAAI;EASF,IAAI,EAAC,MARkB,2BAA2B;GAChD,SAAS;IACP,oBAAoB;IACpB,MAAM;IACN,eAAe;GACjB;GACA,WAAA;EACF,CAAC,EAAA,CACa,UACZ,MAAM,IAAI,MAAM,kDAAkD;CAEtE,SAAS,OAAO;EACd,IACE,WACA,cACA,iBAAiB,sCACjB,MAAM,SAAA,0CAEN,IAAI;GACF,MAAM,QAAQ,gBAAgB;EAChC,SAAS,cAAc;GACrB,MAAM,IAAI,eACR,CAAC,OAAO,YAAY,GACpB,4EACF;EACF;EAEF,IACE,EACE,iBAAiB,sCACjB,MAAM,SAAA,2CAER;GACA,MAAM,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GACpE,QACE,oBACA,oCAAoC,UAAU,iCAAiC,GAAG,4CAA4C,QAChI;EACF;EACA,MAAM;CACR;AACF"}

package/dist/{service-control-capabilities-C9UHSMPz.js → service-control-capabilities-3_bdeHXu.js}

@@ -1,4 +1,4 @@
 #!/usr/bin/env node
 
-import { t as readServiceControlCapabilities } from "./service-control-capabilities-xGylBNoH.js";
+import { t as readServiceControlCapabilities } from "./service-control-capabilities-Bb738e_d.js";
 export { readServiceControlCapabilities };

package/dist/{service-control-capabilities-xGylBNoH.js → service-control-capabilities-Bb738e_d.js}

@@ -1,23 +1,25 @@
 #!/usr/bin/env node
 
-import { a as serviceControlCarrierCapabilitySchema, i as serviceControlCapabilitiesSchema } from "./service-account-admission-Dy2W3n3_.js";
-import { M as resolveAlignedDaemonActiveBundleEntryPath, S as daemonServiceBinaryExecutablePath, j as readDaemonActiveBundleState, r as readCurrentDaemonRuntimeContext } from "./daemon-service-runtime-bKt0YjC7.js";
-import { i as readDaemonServiceContract } from "./daemon-service-contract-BpOBMGX0.js";
-import { w as sendLocalDaemonControlPlaneRequest } from "./daemon-lifecycle-journal-DyKx1xzm.js";
-import { S as resolveDaemonServiceManager } from "./daemon-service-manager-HL4VKbIU.js";
+import { a as serviceControlCarrierCapabilitySchema, i as serviceControlCapabilitiesSchema } from "./service-account-admission-BfdJ-kKR.js";
+import { M as resolveAlignedDaemonActiveBundleEntryPath, S as daemonServiceBinaryExecutablePath, j as readDaemonActiveBundleState, r as readCurrentDaemonRuntimeContext } from "./daemon-service-runtime-CBJtgM4P.js";
+import { i as readDaemonServiceContract } from "./daemon-service-contract-GLmAxsq-.js";
+import { w as sendLocalDaemonControlPlaneRequest } from "./daemon-lifecycle-journal-CDZLWgMj.js";
+import { S as resolveDaemonServiceManager } from "./daemon-service-manager-C8RUCMDo.js";
 import { realpath } from "node:fs/promises";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 //#region src/commands/service-control-capabilities.ts
-async function resolveCarrierProbe(platform, expectedVersion) {
+async function resolveCarrierProbe(platform, expectedVersion, binary) {
 	if (platform === "darwin") return {
 		executable: await realpath(daemonServiceBinaryExecutablePath()),
-		canonicalEntry: null
+		canonicalEntry: null,
+		protocol: "account-checked-service-control-v1"
 	};
 	const entry = await resolveAlignedDaemonActiveBundleEntryPath({ expectedVersion });
 	return entry ? {
-		executable: await realpath(process.execPath),
-		canonicalEntry: await realpath(entry)
+		executable: await realpath(binary ? entry : process.execPath),
+		canonicalEntry: binary ? null : await realpath(entry),
+		protocol: binary ? "account-checked-service-control-v3" : "account-checked-service-control-v2"
 	} : null;
 }
 /** Read only: never invoke the repairing npm launcher or a lifecycle operation. */
@@ -30,12 +32,13 @@ async function readServiceControlCapabilities(platform = process.platform) {
 	if (platform !== "darwin" && platform !== "win32") return unsupported;
 	const contract = await readDaemonServiceContract();
 	const bundle = await readDaemonActiveBundleState();
-	if (contract?.serviceController !== (platform === "win32" ? "windows-service" : "launchd") || bundle?.bundleFormat !== (platform === "win32" ? "self_contained_v1" : "binary_v1")) return unsupported;
+	const binary = bundle?.bundleFormat === "binary_v1";
+	if (contract?.serviceController !== (platform === "win32" ? "windows-service" : "launchd") || !(binary || platform === "win32" && bundle?.bundleFormat === "self_contained_v1")) return unsupported;
 	const manager = await resolveDaemonServiceManager(contract.serviceController);
 	if (!(manager && (await manager.status()).installed)) return unsupported;
-	const probe = await resolveCarrierProbe(platform, contract.daemonVersion);
+	const probe = await resolveCarrierProbe(platform, contract.daemonVersion, binary);
 	if (!probe) return unsupported;
-	const { executable, canonicalEntry } = probe;
+	const { executable, canonicalEntry, protocol } = probe;
 	const { stdout } = await promisify(execFile)(executable, [
 		...canonicalEntry ? [canonicalEntry] : [],
 		"service",
@@ -47,8 +50,9 @@ async function readServiceControlCapabilities(platform = process.platform) {
 		windowsHide: true
 	});
 	const carrier = serviceControlCarrierCapabilitySchema.safeParse(JSON.parse(stdout));
-	if (!carrier.success || await realpath(carrier.data.executable) !== executable) return unsupported;
-	if (platform === "win32" && (carrier.data.protocol !== "account-checked-service-control-v2" || await realpath(carrier.data.entryScript) !== canonicalEntry || JSON.stringify(await readDaemonActiveBundleState()) !== JSON.stringify(bundle))) return unsupported;
+	if (!carrier.success || carrier.data.protocol !== protocol || await realpath(carrier.data.executable) !== executable) return unsupported;
+	if (carrier.data.protocol === "account-checked-service-control-v2" && await realpath(carrier.data.entryScript) !== canonicalEntry) return unsupported;
+	if (JSON.stringify(await readDaemonActiveBundleState()) !== JSON.stringify(bundle)) return unsupported;
 	const runtime = await readCurrentDaemonRuntimeContext();
 	if (runtime.effectiveRuntimeStatus === "not_running") return {
 		deviceId: contract.deviceId,
@@ -69,4 +73,4 @@ async function readServiceControlCapabilities(platform = process.platform) {
 //#endregion
 export { readServiceControlCapabilities as t };
 
-//# sourceMappingURL=service-control-capabilities-xGylBNoH.js.map
+//# sourceMappingURL=service-control-capabilities-Bb738e_d.js.map

package/dist/service-control-capabilities-Bb738e_d.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-control-capabilities-Bb738e_d.js","names":[],"sources":["../src/commands/service-control-capabilities.ts"],"sourcesContent":["import { execFile } from \"node:child_process\";\nimport { realpath } from \"node:fs/promises\";\nimport { promisify } from \"node:util\";\nimport {\n  serviceControlCapabilitiesSchema,\n  serviceControlCarrierCapabilitySchema,\n} from \"@openmeld/schemas\";\nimport { readDaemonServiceContract } from \"../config/daemon-service-contract\";\nimport { sendLocalDaemonControlPlaneRequest } from \"../local-service/control-plane/client\";\nimport {\n  daemonServiceBinaryExecutablePath,\n  readDaemonActiveBundleState,\n  resolveAlignedDaemonActiveBundleEntryPath,\n} from \"../local-service/lifecycle/daemon-service-bundle\";\nimport { resolveDaemonServiceManager } from \"../local-service/lifecycle/daemon-service-manager\";\nimport { readCurrentDaemonRuntimeContext } from \"../local-service/lifecycle/daemon-service-runtime\";\n\nasync function resolveCarrierProbe(\n  platform: \"darwin\" | \"win32\",\n  expectedVersion: string,\n  binary: boolean\n) {\n  if (platform === \"darwin\") {\n    return {\n      executable: await realpath(daemonServiceBinaryExecutablePath()),\n      canonicalEntry: null,\n      protocol: \"account-checked-service-control-v1\",\n    };\n  }\n  // Probe the aligned immutable GUI carrier directly. For npm, bypass the\n  // repairing launcher and use its verified JS entry with Start's exact Node.\n  const entry = await resolveAlignedDaemonActiveBundleEntryPath({\n    expectedVersion,\n  });\n  return entry\n    ? {\n        executable: await realpath(binary ? entry : process.execPath),\n        canonicalEntry: binary ? null : await realpath(entry),\n        protocol: binary\n          ? \"account-checked-service-control-v3\"\n          : \"account-checked-service-control-v2\",\n      }\n    : null;\n}\n\n/** Read only: never invoke the repairing npm launcher or a lifecycle operation. */\nexport async function readServiceControlCapabilities(\n  platform: NodeJS.Platform = process.platform\n) {\n  const unsupported = { deviceId: null, start: false, stop: false };\n  if (platform !== \"darwin\" && platform !== \"win32\") {\n    return unsupported;\n  }\n  const contract = await readDaemonServiceContract();\n  const bundle = await readDaemonActiveBundleState();\n  const binary = bundle?.bundleFormat === \"binary_v1\";\n  if (\n    contract?.serviceController !==\n      (platform === \"win32\" ? \"windows-service\" : \"launchd\") ||\n    !(\n      binary ||\n      (platform === \"win32\" && bundle?.bundleFormat === \"self_contained_v1\")\n    )\n  ) {\n    return unsupported;\n  }\n  const manager = await resolveDaemonServiceManager(contract.serviceController);\n  if (!(manager && (await manager.status()).installed)) {\n    return unsupported;\n  }\n  // Guarded Start refreshes the supervisor command to this canonical executable.\n  // Verify the executable that answered, so an old CLI delegating elsewhere\n  // cannot advertise another binary's capability as its own.\n  const probe = await resolveCarrierProbe(\n    platform,\n    contract.daemonVersion,\n    binary\n  );\n  if (!probe) {\n    return unsupported;\n  }\n  const { executable, canonicalEntry, protocol } = probe;\n  const { stdout } = await promisify(execFile)(\n    executable,\n    [\n      ...(canonicalEntry ? [canonicalEntry] : []),\n      \"service\",\n      \"control-carrier-capability\",\n      \"--json\",\n    ],\n    { timeout: 10_000, maxBuffer: 16_384, windowsHide: true }\n  );\n  const carrier = serviceControlCarrierCapabilitySchema.safeParse(\n    JSON.parse(stdout)\n  );\n  if (\n    !carrier.success ||\n    carrier.data.protocol !== protocol ||\n    (await realpath(carrier.data.executable)) !== executable\n  ) {\n    return unsupported;\n  }\n  if (\n    carrier.data.protocol === \"account-checked-service-control-v2\" &&\n    (await realpath(carrier.data.entryScript)) !== canonicalEntry\n  ) {\n    return unsupported;\n  }\n  if (\n    JSON.stringify(await readDaemonActiveBundleState()) !==\n    JSON.stringify(bundle)\n  ) {\n    return unsupported;\n  }\n  const runtime = await readCurrentDaemonRuntimeContext();\n  if (runtime.effectiveRuntimeStatus === \"not_running\") {\n    return { deviceId: contract.deviceId, start: true, stop: false };\n  }\n  if (runtime.effectiveRuntimeStatus !== \"running\") {\n    return unsupported;\n  }\n  const response = await sendLocalDaemonControlPlaneRequest({\n    request: { v: 1, command: \"account_control_capabilities\" },\n  });\n  return serviceControlCapabilitiesSchema.parse({\n    deviceId: contract.deviceId,\n    start: false,\n    stop:\n      response.code === \"service.account_control_capabilities\" &&\n      response.payload.supported,\n  });\n}\n"],"mappings":";;;;;;;;;;;AAiBA,eAAe,oBACb,UACA,iBACA,QACA;CACA,IAAI,aAAa,UACf,OAAO;EACL,YAAY,MAAM,SAAS,kCAAkC,CAAC;EAC9D,gBAAgB;EAChB,UAAU;CACZ;CAIF,MAAM,QAAQ,MAAM,0CAA0C,EAC5D,gBACF,CAAC;CACD,OAAO,QACH;EACE,YAAY,MAAM,SAAS,SAAS,QAAQ,QAAQ,QAAQ;EAC5D,gBAAgB,SAAS,OAAO,MAAM,SAAS,KAAK;EACpD,UAAU,SACN,uCACA;CACN,IACA;AACN;;AAGA,eAAsB,+BACpB,WAA4B,QAAQ,UACpC;CACA,MAAM,cAAc;EAAE,UAAU;EAAM,OAAO;EAAO,MAAM;CAAM;CAChE,IAAI,aAAa,YAAY,aAAa,SACxC,OAAO;CAET,MAAM,WAAW,MAAM,0BAA0B;CACjD,MAAM,SAAS,MAAM,4BAA4B;CACjD,MAAM,SAAS,QAAQ,iBAAiB;CACxC,IACE,UAAU,uBACP,aAAa,UAAU,oBAAoB,cAC9C,EACE,UACC,aAAa,WAAW,QAAQ,iBAAiB,sBAGpD,OAAO;CAET,MAAM,UAAU,MAAM,4BAA4B,SAAS,iBAAiB;CAC5E,IAAI,EAAE,YAAY,MAAM,QAAQ,OAAO,EAAA,CAAG,YACxC,OAAO;CAKT,MAAM,QAAQ,MAAM,oBAClB,UACA,SAAS,eACT,MACF;CACA,IAAI,CAAC,OACH,OAAO;CAET,MAAM,EAAE,YAAY,gBAAgB,aAAa;CACjD,MAAM,EAAE,WAAW,MAAM,UAAU,QAAQ,CAAC,CAC1C,YACA;EACE,GAAI,iBAAiB,CAAC,cAAc,IAAI,CAAC;EACzC;EACA;EACA;CACF,GACA;EAAE,SAAS;EAAQ,WAAW;EAAQ,aAAa;CAAK,CAC1D;CACA,MAAM,UAAU,sCAAsC,UACpD,KAAK,MAAM,MAAM,CACnB;CACA,IACE,CAAC,QAAQ,WACT,QAAQ,KAAK,aAAa,YACzB,MAAM,SAAS,QAAQ,KAAK,UAAU,MAAO,YAE9C,OAAO;CAET,IACE,QAAQ,KAAK,aAAa,wCACzB,MAAM,SAAS,QAAQ,KAAK,WAAW,MAAO,gBAE/C,OAAO;CAET,IACE,KAAK,UAAU,MAAM,4BAA4B,CAAC,MAClD,KAAK,UAAU,MAAM,GAErB,OAAO;CAET,MAAM,UAAU,MAAM,gCAAgC;CACtD,IAAI,QAAQ,2BAA2B,eACrC,OAAO;EAAE,UAAU,SAAS;EAAU,OAAO;EAAM,MAAM;CAAM;CAEjE,IAAI,QAAQ,2BAA2B,WACrC,OAAO;CAET,MAAM,WAAW,MAAM,mCAAmC,EACxD,SAAS;EAAE,GAAG;EAAG,SAAS;CAA+B,EAC3D,CAAC;CACD,OAAO,iCAAiC,MAAM;EAC5C,UAAU,SAAS;EACnB,OAAO;EACP,MACE,SAAS,SAAS,0CAClB,SAAS,QAAQ;CACrB,CAAC;AACH"}

package/dist/{service-control-carrier-capability-DDNyE5cB.js → service-control-carrier-capability-gMk5gMKU.js}

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
 
-import { a as serviceControlCarrierCapabilitySchema } from "./service-account-admission-Dy2W3n3_.js";
-import { n as isPreciseProcessStartIdentity, t as CURRENT_PROCESS_START_IDENTITY } from "./process-identity-CNus0e6E.js";
+import { a as serviceControlCarrierCapabilitySchema } from "./service-account-admission-BfdJ-kKR.js";
+import { n as isPreciseProcessStartIdentity, t as CURRENT_PROCESS_START_IDENTITY } from "./process-identity-BQLdaZdB.js";
+import { t as isBinaryDistribution } from "./distribution-BDQT2ilb.js";
 import { resolve } from "node:path";
 //#region src/commands/service-control-carrier-capability.ts
 /** Describe this exact process before any repairing launcher or managed delegation. */
@@ -10,7 +11,13 @@ function readServiceControlCarrierCapability() {
 		protocol: "account-checked-service-control-v1",
 		executable: process.execPath
 	});
-	if (!(process.argv[1] && isPreciseProcessStartIdentity(CURRENT_PROCESS_START_IDENTITY))) throw new Error("Windows Service process identity could not be verified.");
+	if (!isPreciseProcessStartIdentity(CURRENT_PROCESS_START_IDENTITY)) throw new Error("Windows Service process identity could not be verified.");
+	if (isBinaryDistribution()) return serviceControlCarrierCapabilitySchema.parse({
+		protocol: "account-checked-service-control-v3",
+		platform: "win32",
+		executable: process.execPath
+	});
+	if (!process.argv[1]) throw new Error("Windows Service entry script could not be verified.");
 	return serviceControlCarrierCapabilitySchema.parse({
 		protocol: "account-checked-service-control-v2",
 		platform: "win32",
@@ -21,4 +28,4 @@ function readServiceControlCarrierCapability() {
 //#endregion
 export { readServiceControlCarrierCapability };
 
-//# sourceMappingURL=service-control-carrier-capability-DDNyE5cB.js.map
+//# sourceMappingURL=service-control-carrier-capability-gMk5gMKU.js.map

package/dist/service-control-carrier-capability-gMk5gMKU.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-control-carrier-capability-gMk5gMKU.js","names":[],"sources":["../src/commands/service-control-carrier-capability.ts"],"sourcesContent":["import { resolve } from \"node:path\";\nimport { serviceControlCarrierCapabilitySchema } from \"@openmeld/schemas\";\nimport { isBinaryDistribution } from \"../runtime/distribution\";\nimport {\n  CURRENT_PROCESS_START_IDENTITY,\n  isPreciseProcessStartIdentity,\n} from \"../system/process-identity\";\n\n/** Describe this exact process before any repairing launcher or managed delegation. */\nexport function readServiceControlCarrierCapability() {\n  if (process.platform !== \"win32\") {\n    return serviceControlCarrierCapabilitySchema.parse({\n      protocol: \"account-checked-service-control-v1\",\n      executable: process.execPath,\n    });\n  }\n  if (!isPreciseProcessStartIdentity(CURRENT_PROCESS_START_IDENTITY)) {\n    throw new Error(\"Windows Service process identity could not be verified.\");\n  }\n  if (isBinaryDistribution()) {\n    return serviceControlCarrierCapabilitySchema.parse({\n      protocol: \"account-checked-service-control-v3\",\n      platform: \"win32\",\n      executable: process.execPath,\n    });\n  }\n  if (!process.argv[1]) {\n    throw new Error(\"Windows Service entry script could not be verified.\");\n  }\n  return serviceControlCarrierCapabilitySchema.parse({\n    protocol: \"account-checked-service-control-v2\",\n    platform: \"win32\",\n    executable: process.execPath,\n    entryScript: resolve(process.argv[1]),\n  });\n}\n"],"mappings":";;;;;;;;AASA,SAAgB,sCAAsC;CACpD,IAAI,QAAQ,aAAa,SACvB,OAAO,sCAAsC,MAAM;EACjD,UAAU;EACV,YAAY,QAAQ;CACtB,CAAC;CAEH,IAAI,CAAC,8BAA8B,8BAA8B,GAC/D,MAAM,IAAI,MAAM,yDAAyD;CAE3E,IAAI,qBAAqB,GACvB,OAAO,sCAAsC,MAAM;EACjD,UAAU;EACV,UAAU;EACV,YAAY,QAAQ;CACtB,CAAC;CAEH,IAAI,CAAC,QAAQ,KAAK,IAChB,MAAM,IAAI,MAAM,qDAAqD;CAEvE,OAAO,sCAAsC,MAAM;EACjD,UAAU;EACV,UAAU;EACV,YAAY,QAAQ;EACpB,aAAa,QAAQ,QAAQ,KAAK,EAAE;CACtC,CAAC;AACH"}

package/dist/{state-CQG3k9eh.js → state-GxF_KAM1.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 
-import { ct as resolveOpenMeldEnvPreset, et as openMeldRootDir, mt as skillsDir, pt as runtimeLogsDir } from "./lock-Bsl_ElWy.js";
+import { ht as skillsDir, lt as resolveOpenMeldEnvPreset, mt as runtimeLogsDir, tt as openMeldRootDir } from "./lock-iue1J2xy.js";
 import { t as isBinaryDistribution } from "./distribution-BDQT2ilb.js";
-import { d as compareSemver, l as OPENMELD_VERSION } from "./daemon-lifecycle-journal-DyKx1xzm.js";
+import { d as compareSemver, l as OPENMELD_VERSION } from "./daemon-lifecycle-journal-CDZLWgMj.js";
 import { createHash, randomUUID, verify } from "node:crypto";
 import path, { basename, dirname, join, relative, resolve } from "node:path";
 import { lstat, mkdir, readFile, readdir, readlink, rename, rm, stat, writeFile } from "node:fs/promises";
 import * as z$1 from "zod/v4";
 import { existsSync } from "node:fs";
-import { AsyncLocalStorage } from "node:async_hooks";
 import { fileURLToPath } from "node:url";
+import { AsyncLocalStorage } from "node:async_hooks";
 const OFFICIAL_CLI_SKILL_URL = "https://openmeld.ai/skills/openmeld-cli/SKILL.md";
 const OFFICIAL_CLI_SKILL_PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
 MCowBQYDK2VwAyEAFZjFHrQ/QLsJQpHkAbKBRG57fEazhm7zc0dMa54ilWQ=
@@ -746,4 +746,4 @@ function pathsEqual(left, right) {
 //#endregion
 export { readOpenMeldSkillMarker as a, replaceSkillDirectory as c, readSelectedSkillDocument as d, withSkillsInstallLock as f, OFFICIAL_CLI_SKILL_URL as h, isOpenMeldManagedSkillDir as i, downloadOfficialSkillUpdate as l, hashBundledSkillAssets as m, resolveSkillsInstallStates as n, writeOpenMeldSkillMarker as o, computeDirectoryContentHash as p, ensureLocalSkills as r, recoverSkillReplacement as s, resolveSkillInstallStateForTarget as t, loadSelectedSkillAssets as u };
 
-//# sourceMappingURL=state-CQG3k9eh.js.map
+//# sourceMappingURL=state-GxF_KAM1.js.map