openmeld 0.3.249 → 0.3.250

package/dist/{windows-task-entry-CNHG6kVI.js.map → windows-task-entry-C0RgF7b_.js.map}

@@ -1 +1 @@
-{"version":3,"file":"windows-task-entry-CNHG6kVI.js","names":[],"sources":["../src/local-service/lifecycle/windows-task-entry.ts"],"sourcesContent":["import { Console } from \"node:console\";\nimport { openSync, realpathSync, writeSync } from \"node:fs\";\nimport { Writable } from \"node:stream\";\nimport { windowsUserTaskActionSchema } from \"@openmeld/schemas\";\nimport { WINDOWS_TASK_ARGUMENT } from \"./windows-task-command\";\n\n// Run before importing business modules: they must see the registered lane and\n// log descriptors. Task Scheduler supervises this process directly; there is no\n// child process or stream-copy thread between it and the Service exit status.\nexport function initializeWindowsTaskEntry(): void {\n  const args = process.argv.slice(2);\n  const index = args.indexOf(WINDOWS_TASK_ARGUMENT);\n  if (index === -1) {\n    return;\n  }\n  if (process.platform !== \"win32\" || index !== args.length - 2) {\n    throw new Error(\"Invalid Windows task invocation.\");\n  }\n  const action = windowsUserTaskActionSchema.parse(\n    JSON.parse(Buffer.from(args[index + 1] ?? \"\", \"base64\").toString(\"utf8\"))\n  );\n  if (\n    realpathSync.native(action.executable).toLowerCase() !==\n      realpathSync.native(process.execPath).toLowerCase() ||\n    JSON.stringify(args.slice(0, index)) !== JSON.stringify(action.args)\n  ) {\n    throw new Error(\"The Windows task envelope does not match this process.\");\n  }\n  for (const [key, value] of Object.entries(action.env)) {\n    process.env[key] = value;\n  }\n  const fd = openSync(action.logPath, \"a\");\n  const output = new Writable({\n    write(chunk: Buffer, _encoding, callback) {\n      try {\n        let offset = 0;\n        while (offset < chunk.length) {\n          const written = writeSync(fd, chunk, offset, chunk.length - offset);\n          if (written === 0) {\n            throw new Error(\"Windows task log write made no progress.\");\n          }\n          offset += written;\n        }\n        callback();\n      } catch (error) {\n        callback(error instanceof Error ? error : new Error(String(error)));\n      }\n    },\n  });\n  // Explicit descriptors are also inherited by the private Execution Host and\n  // maintenance subprocesses. Keep them open until the OS closes this process.\n  Object.defineProperty(output, \"fd\", { value: fd });\n  Object.defineProperty(output, \"isTTY\", { value: false });\n  Object.defineProperty(process, \"stdout\", {\n    value: output,\n    configurable: true,\n  });\n  Object.defineProperty(process, \"stderr\", {\n    value: output,\n    configurable: true,\n  });\n  globalThis.console = new Console({\n    stdout: output,\n    stderr: output,\n    ignoreErrors: false,\n  });\n  process.argv.splice(index + 2, 2);\n}\n"],"mappings":";;;;;;;;AASA,SAAgB,6BAAmC;CACjD,MAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;CACjC,MAAM,QAAQ,KAAK,QAAQ,qBAAqB;CAChD,IAAI,UAAU,IACZ;CAEF,IAAI,QAAQ,aAAa,WAAW,UAAU,KAAK,SAAS,GAC1D,MAAM,IAAI,MAAM,kCAAkC;CAEpD,MAAM,SAAS,4BAA4B,MACzC,KAAK,MAAM,OAAO,KAAK,KAAK,QAAQ,MAAM,IAAI,QAAQ,CAAC,CAAC,SAAS,MAAM,CAAC,CAC1E;CACA,IACE,aAAa,OAAO,OAAO,UAAU,CAAC,CAAC,YAAY,MACjD,aAAa,OAAO,QAAQ,QAAQ,CAAC,CAAC,YAAY,KACpD,KAAK,UAAU,KAAK,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,UAAU,OAAO,IAAI,GAEnE,MAAM,IAAI,MAAM,wDAAwD;CAE1E,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAAG,GAClD,QAAQ,IAAI,OAAO;CAErB,MAAM,KAAK,SAAS,OAAO,SAAS,GAAG;CACvC,MAAM,SAAS,IAAI,SAAS,EAC1B,MAAM,OAAe,WAAW,UAAU;EACxC,IAAI;GACF,IAAI,SAAS;GACb,OAAO,SAAS,MAAM,QAAQ;IAC5B,MAAM,UAAU,UAAU,IAAI,OAAO,QAAQ,MAAM,SAAS,MAAM;IAClE,IAAI,YAAY,GACd,MAAM,IAAI,MAAM,0CAA0C;IAE5D,UAAU;GACZ;GACA,SAAS;EACX,SAAS,OAAO;GACd,SAAS,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC;EACpE;CACF,EACF,CAAC;CAGD,OAAO,eAAe,QAAQ,MAAM,EAAE,OAAO,GAAG,CAAC;CACjD,OAAO,eAAe,QAAQ,SAAS,EAAE,OAAO,MAAM,CAAC;CACvD,OAAO,eAAe,SAAS,UAAU;EACvC,OAAO;EACP,cAAc;CAChB,CAAC;CACD,OAAO,eAAe,SAAS,UAAU;EACvC,OAAO;EACP,cAAc;CAChB,CAAC;CACD,WAAW,UAAU,IAAI,QAAQ;EAC/B,QAAQ;EACR,QAAQ;EACR,cAAc;CAChB,CAAC;CACD,QAAQ,KAAK,OAAO,QAAQ,GAAG,CAAC;AAClC"}
+{"version":3,"file":"windows-task-entry-C0RgF7b_.js","names":[],"sources":["../src/local-service/lifecycle/windows-task-entry.ts"],"sourcesContent":["import { Console } from \"node:console\";\nimport { openSync, realpathSync, writeSync } from \"node:fs\";\nimport { Writable } from \"node:stream\";\nimport { windowsUserTaskActionSchema } from \"@openmeld/schemas\";\nimport { WINDOWS_TASK_ARGUMENT } from \"./windows-task-command\";\n\n// Run before importing business modules: they must see the registered lane and\n// log descriptors. Task Scheduler supervises this process directly; there is no\n// child process or stream-copy thread between it and the Service exit status.\nexport function initializeWindowsTaskEntry(): void {\n  const args = process.argv.slice(2);\n  const index = args.indexOf(WINDOWS_TASK_ARGUMENT);\n  if (index === -1) {\n    return;\n  }\n  if (process.platform !== \"win32\" || index !== args.length - 2) {\n    throw new Error(\"Invalid Windows task invocation.\");\n  }\n  const action = windowsUserTaskActionSchema.parse(\n    JSON.parse(Buffer.from(args[index + 1] ?? \"\", \"base64\").toString(\"utf8\"))\n  );\n  if (\n    realpathSync.native(action.executable).toLowerCase() !==\n      realpathSync.native(process.execPath).toLowerCase() ||\n    JSON.stringify(args.slice(0, index)) !== JSON.stringify(action.args)\n  ) {\n    throw new Error(\"The Windows task envelope does not match this process.\");\n  }\n  for (const [key, value] of Object.entries(action.env)) {\n    process.env[key] = value;\n  }\n  const fd = openSync(action.logPath, \"a\");\n  const output = new Writable({\n    write(chunk: Buffer, _encoding, callback) {\n      try {\n        let offset = 0;\n        while (offset < chunk.length) {\n          const written = writeSync(fd, chunk, offset, chunk.length - offset);\n          if (written === 0) {\n            throw new Error(\"Windows task log write made no progress.\");\n          }\n          offset += written;\n        }\n        callback();\n      } catch (error) {\n        callback(error instanceof Error ? error : new Error(String(error)));\n      }\n    },\n  });\n  // Explicit descriptors are also inherited by the private Execution Host and\n  // maintenance subprocesses. Keep them open until the OS closes this process.\n  Object.defineProperty(output, \"fd\", { value: fd });\n  Object.defineProperty(output, \"isTTY\", { value: false });\n  Object.defineProperty(process, \"stdout\", {\n    value: output,\n    configurable: true,\n  });\n  Object.defineProperty(process, \"stderr\", {\n    value: output,\n    configurable: true,\n  });\n  globalThis.console = new Console({\n    stdout: output,\n    stderr: output,\n    ignoreErrors: false,\n  });\n  process.argv.splice(index + 2, 2);\n}\n"],"mappings":";;;;;;;;AASA,SAAgB,6BAAmC;CACjD,MAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;CACjC,MAAM,QAAQ,KAAK,QAAQ,qBAAqB;CAChD,IAAI,UAAU,IACZ;CAEF,IAAI,QAAQ,aAAa,WAAW,UAAU,KAAK,SAAS,GAC1D,MAAM,IAAI,MAAM,kCAAkC;CAEpD,MAAM,SAAS,4BAA4B,MACzC,KAAK,MAAM,OAAO,KAAK,KAAK,QAAQ,MAAM,IAAI,QAAQ,CAAC,CAAC,SAAS,MAAM,CAAC,CAC1E;CACA,IACE,aAAa,OAAO,OAAO,UAAU,CAAC,CAAC,YAAY,MACjD,aAAa,OAAO,QAAQ,QAAQ,CAAC,CAAC,YAAY,KACpD,KAAK,UAAU,KAAK,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,UAAU,OAAO,IAAI,GAEnE,MAAM,IAAI,MAAM,wDAAwD;CAE1E,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAAG,GAClD,QAAQ,IAAI,OAAO;CAErB,MAAM,KAAK,SAAS,OAAO,SAAS,GAAG;CACvC,MAAM,SAAS,IAAI,SAAS,EAC1B,MAAM,OAAe,WAAW,UAAU;EACxC,IAAI;GACF,IAAI,SAAS;GACb,OAAO,SAAS,MAAM,QAAQ;IAC5B,MAAM,UAAU,UAAU,IAAI,OAAO,QAAQ,MAAM,SAAS,MAAM;IAClE,IAAI,YAAY,GACd,MAAM,IAAI,MAAM,0CAA0C;IAE5D,UAAU;GACZ;GACA,SAAS;EACX,SAAS,OAAO;GACd,SAAS,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC;EACpE;CACF,EACF,CAAC;CAGD,OAAO,eAAe,QAAQ,MAAM,EAAE,OAAO,GAAG,CAAC;CACjD,OAAO,eAAe,QAAQ,SAAS,EAAE,OAAO,MAAM,CAAC;CACvD,OAAO,eAAe,SAAS,UAAU;EACvC,OAAO;EACP,cAAc;CAChB,CAAC;CACD,OAAO,eAAe,SAAS,UAAU;EACvC,OAAO;EACP,cAAc;CAChB,CAAC;CACD,WAAW,UAAU,IAAI,QAAQ;EAC/B,QAAQ;EACR,QAAQ;EACR,cAAc;CAChB,CAAC;CACD,QAAQ,KAAK,OAAO,QAAQ,GAAG,CAAC;AAClC"}

package/dist/{windows-user-task-DjvrZWhN.js → windows-user-task-BklwFGVl.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 
-import { Fa as windowsUserTaskStoredActionSchema, Ma as windowsUserTaskActionSchema, Na as windowsUserTaskRequestSchema, Pa as windowsUserTaskStatusSchema, TP as WINDOWS_PROCESS_HELPER_FILENAME } from "./dist-CPhE1Two.js";
-import { n as attachLockProcess, s as releaseLock } from "./lock-BN1rO-D-.js";
+import { Fa as windowsUserTaskStoredActionSchema, Ma as windowsUserTaskActionSchema, Na as windowsUserTaskRequestSchema, Pa as windowsUserTaskStatusSchema, TP as WINDOWS_PROCESS_HELPER_FILENAME } from "./dist-B5iixKPM.js";
+import { n as attachLockProcess, s as releaseLock } from "./lock-DShA302g.js";
 import { n as normalizeCommandEnvironment } from "./process-environment-BWSFeUu6.js";
-import { l as resolveWindowsPowerShellPath, o as powerShellEncodedArguments, s as pruneWindowsBinaryBundle } from "./process-identity-CUAkapyW.js";
-import { p as daemonRuntimeBundlesPath, u as currentDaemonServiceLifecycleLock } from "./daemon-state-ecGzjsoG.js";
-import { n as readWindowsDirectTaskAction } from "./windows-task-command-DfSWC5WF.js";
+import { l as resolveWindowsPowerShellPath, o as powerShellEncodedArguments, s as pruneWindowsBinaryBundle } from "./process-identity-C1tKCeQs.js";
+import { p as daemonRuntimeBundlesPath, u as currentDaemonServiceLifecycleLock } from "./daemon-state-DLzP-fC_.js";
+import { n as readWindowsDirectTaskAction } from "./windows-task-command-BhNvBjQ-.js";
 import { createHash } from "node:crypto";
 import { dirname, join } from "node:path";
 import { copyFile, mkdir, mkdtemp, open, rename, rm, stat } from "node:fs/promises";
@@ -382,4 +382,4 @@ async function runWindowsUserTask(request) {
 //#endregion
 export { expectedBinaryServiceFingerprint as a, verifyWindowsServiceSubsystem as c, windowsTaskActionArguments as i, windowsMaintenanceBinaryPath as l, runWindowsUserTask as n, hashBinaryServiceBundle as o, windowsPowerShellPath as r, prepareWindowsMaintenanceBinary as s, readWindowsTaskAction as t };
 
-//# sourceMappingURL=windows-user-task-DjvrZWhN.js.map
+//# sourceMappingURL=windows-user-task-BklwFGVl.js.map

package/dist/{windows-user-task-DjvrZWhN.js.map → windows-user-task-BklwFGVl.js.map}

@@ -1 +1 @@
-{"version":3,"file":"windows-user-task-DjvrZWhN.js","names":[],"sources":["../src/local-service/lifecycle/windows-service-binary.ts","../src/local-service/lifecycle/windows-task-host.ts","../src/local-service/lifecycle/windows-user-task.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { createReadStream } from \"node:fs\";\nimport {\n  copyFile,\n  mkdir,\n  mkdtemp,\n  open,\n  rename,\n  rm,\n  stat,\n} from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\nimport { pruneWindowsBinaryBundle } from \"@openmeld/adapter-core/windows-system\";\nimport { WINDOWS_PROCESS_HELPER_FILENAME } from \"@openmeld/schemas\";\nimport { daemonRuntimeBundlesPath } from \"../../config/daemon-state\";\nimport type { OpenMeldPathResolutionInput } from \"../../config/paths\";\nimport type { CliBinaryReleaseInfo } from \"../../config/version-state\";\nimport type { DaemonActiveBundleState } from \"./daemon-service-bundle\";\n\nconst FINGERPRINT_PATTERN = /^[0-9a-f]{64}$/u;\n\nexport function windowsMaintenanceBinaryPath(\n  bundle: DaemonActiveBundleState,\n  pathInput: OpenMeldPathResolutionInput = {}\n): string {\n  if (\n    !(\n      bundle.sourceDistFingerprint &&\n      FINGERPRINT_PATTERN.test(bundle.sourceDistFingerprint)\n    )\n  ) {\n    throw new Error(\n      \"OpenMeld maintenance needs a verified Windows Service bundle.\"\n    );\n  }\n  return join(\n    daemonRuntimeBundlesPath(pathInput),\n    `maintenance-${bundle.sourceDistFingerprint}`,\n    \"openmeld.exe\"\n  );\n}\n\nexport async function prepareWindowsMaintenanceBinary(\n  bundle: DaemonActiveBundleState,\n  pathInput: OpenMeldPathResolutionInput = {}\n): Promise<string> {\n  const target = windowsMaintenanceBinaryPath(bundle, pathInput);\n  const expected = bundle.sourceDistFingerprint;\n  if (\n    (await hashBinaryServiceBundle(target, true).catch(() => null)) === expected\n  ) {\n    return target;\n  }\n  if (\n    (await hashBinaryServiceBundle(bundle.sourceEntryScriptPath, true)) !==\n    expected\n  ) {\n    throw new Error(\n      \"The Windows maintenance source no longer matches its verified bundle.\"\n    );\n  }\n  const directory = dirname(target);\n  if (\n    await stat(directory).catch((error: NodeJS.ErrnoException) => {\n      if (error.code === \"ENOENT\") {\n        return null;\n      }\n      throw error;\n    })\n  ) {\n    const result = await pruneWindowsBinaryBundle(directory);\n    if (result !== \"removed\" && result !== \"absent\") {\n      throw new Error(\n        \"The existing Windows maintenance copy is still in use or contains unrecognized files.\"\n      );\n    }\n  }\n  await mkdir(daemonRuntimeBundlesPath(pathInput), { recursive: true });\n  const temporary = await mkdtemp(\n    join(daemonRuntimeBundlesPath(pathInput), \".maintenance-\")\n  );\n  try {\n    for (const name of [\"openmeld.exe\", WINDOWS_PROCESS_HELPER_FILENAME]) {\n      await copyFile(\n        name === \"openmeld.exe\"\n          ? bundle.sourceEntryScriptPath\n          : join(dirname(bundle.sourceEntryScriptPath), name),\n        join(temporary, name)\n      );\n    }\n    if (\n      (await hashBinaryServiceBundle(join(temporary, \"openmeld.exe\"), true)) !==\n      expected\n    ) {\n      throw new Error(\n        \"The prepared Windows maintenance copy failed verification.\"\n      );\n    }\n    await rename(temporary, directory);\n  } finally {\n    await rm(temporary, { recursive: true, force: true });\n  }\n  return target;\n}\n\n// Windows binary_v1 bundles contain two indivisible, independently signed files.\n// Keep one bundle fingerprint for inventory, update jobs, and maintenance copies.\nexport function expectedBinaryServiceFingerprint(\n  release: CliBinaryReleaseInfo\n): string {\n  if (!release.platform.startsWith(\"windows-\")) {\n    return release.sha256.toLowerCase();\n  }\n  if (!release.windows) {\n    throw new Error(\n      \"The selected Windows Service has no native helper metadata.\"\n    );\n  }\n  return fingerprint(release.sha256, release.windows.processHelper.sha256);\n}\n\nexport async function hashBinaryServiceBundle(\n  executablePath: string,\n  windows: boolean = process.platform === \"win32\"\n): Promise<string> {\n  const executableHash = await hashFile(executablePath);\n  return windows\n    ? fingerprint(\n        executableHash,\n        await hashFile(\n          join(dirname(executablePath), WINDOWS_PROCESS_HELPER_FILENAME)\n        )\n      )\n    : executableHash;\n}\n\nfunction fingerprint(executableHash: string, helperHash: string): string {\n  return createHash(\"sha256\")\n    .update(\n      JSON.stringify([executableHash.toLowerCase(), helperHash.toLowerCase()])\n    )\n    .digest(\"hex\");\n}\n\nasync function hashFile(file: string): Promise<string> {\n  const hash = createHash(\"sha256\");\n  for await (const chunk of createReadStream(file)) {\n    hash.update(chunk);\n  }\n  return hash.digest(\"hex\");\n}\n\n/** A valid signature does not establish the required console-free PE subsystem. */\nexport async function verifyWindowsServiceSubsystem(\n  file: string\n): Promise<void> {\n  const handle = await open(file, \"r\");\n  try {\n    const dos = Buffer.alloc(64);\n    const first = await handle.read(dos, 0, dos.length, 0);\n    if (\n      first.bytesRead !== dos.length ||\n      dos.toString(\"ascii\", 0, 2) !== \"MZ\"\n    ) {\n      throw new Error(\"The Windows Service artifact is not a PE executable.\");\n    }\n    const header = Buffer.alloc(94);\n    const second = await handle.read(\n      header,\n      0,\n      header.length,\n      dos.readUInt32LE(0x3c)\n    );\n    if (\n      second.bytesRead !== header.length ||\n      header.toString(\"ascii\", 0, 4) !== \"PE\\0\\0\" ||\n      header.readUInt16LE(4) !== 0x86_64 ||\n      header.readUInt16LE(24 + 68) !== 2\n    ) {\n      throw new Error(\n        \"The selected Windows Service must be a console-free x64 executable.\"\n      );\n    }\n  } finally {\n    await handle.close();\n  }\n}\n","// Task Scheduler must start a Windows-subsystem executable, not a console\n// executable that hides its window after startup. Keep the existing encoded\n// PowerShell action as the command/environment/logging owner.\n// Windows PowerShell 5.1 compiles this fixed source during guarded installation;\n// no SDK, downloaded executable, WSH/VBScript, or administrator access is needed.\nexport const WINDOWS_TASK_HOST_SOURCE = String.raw`\nusing System;\nusing System.Diagnostics;\nusing System.IO;\nusing System.Reflection;\nusing System.Text;\nusing System.Text.RegularExpressions;\n\npublic static class OpenMeldTaskHostV1 {\n  public static int Main(string[] args) {\n    string logPath = Assembly.GetExecutingAssembly().Location + \".log\";\n    try {\n      // Accept only the existing OpenMeld action, never an arbitrary executable\n      // or a shell-interpolated command line. Base64 contains no quoting syntax.\n      if (args.Length != 7 || args[0] != \"-NoLogo\" || args[1] != \"-NoProfile\" ||\n          args[2] != \"-NonInteractive\" || args[3] != \"-WindowStyle\" ||\n          args[4] != \"Hidden\" || args[5] != \"-EncodedCommand\" ||\n          !Regex.IsMatch(args[6], @\"\\A[A-Za-z0-9+/]+={0,2}\\z\"))\n        throw new ArgumentException(\"Invalid OpenMeld task arguments.\");\n      Convert.FromBase64String(args[6]);\n      var start = new ProcessStartInfo();\n      start.FileName = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.System),\n        @\"WindowsPowerShell\\v1.0\\powershell.exe\");\n      start.Arguments = String.Join(\" \", args);\n      start.UseShellExecute = false;\n      start.CreateNoWindow = true;\n      start.RedirectStandardInput = true;\n      start.RedirectStandardOutput = true;\n      start.RedirectStandardError = true;\n      using (var log = Stream.Synchronized(new FileStream(logPath, FileMode.Append,\n          FileAccess.Write, FileShare.ReadWrite)))\n      using (var child = new Process()) {\n        child.StartInfo = start;\n        child.Start();\n        child.StandardInput.Close();\n        var stdout = child.StandardOutput.BaseStream.CopyToAsync(log);\n        var stderr = child.StandardError.BaseStream.CopyToAsync(log);\n        // Do not detach or break away from Task Scheduler's process ownership.\n        // The task remains running until the action completes, and restart-on-\n        // failure still receives the action's real exit code.\n        child.WaitForExit();\n        stdout.GetAwaiter().GetResult();\n        stderr.GetAwaiter().GetResult();\n        return child.ExitCode;\n      }\n    } catch (Exception error) {\n      try { File.AppendAllText(logPath, DateTime.UtcNow.ToString(\"o\") + \" \" +\n        error.GetType().Name + \": \" + error.Message + Environment.NewLine, Encoding.UTF8); }\n      catch { /* Task Scheduler still receives a nonzero result if logging fails. */ }\n      return 1;\n    }\n  }\n}\n`;\n\n// Per-task, lane-owned path: updating the maintenance host cannot replace the\n// executable of a running main Service, or vice versa. Keep v1 stable; a future\n// host format must explicitly support migration from this path.\nexport const WINDOWS_TASK_HOST_SUFFIX = \".task-host-v1.exe\";\n\n// The caller has already verified identity and acquired the lifecycle grant.\n// Build beside the target and replace atomically, never overwrite a running\n// host or fall back to a flashing console when compilation is unavailable.\nexport const WINDOWS_TASK_HOST_INSTALL_SCRIPT = `\n$hostDirectory = [IO.Path]::GetDirectoryName($hostPath)\n$null = [IO.Directory]::CreateDirectory($hostDirectory)\n$temporaryHost = Join-Path $hostDirectory ([Guid]::NewGuid().ToString('N') + '.exe')\ntry {\n  Add-Type -TypeDefinition @'\n${WINDOWS_TASK_HOST_SOURCE}\n'@ -OutputAssembly $temporaryHost -OutputType WindowsApplication -ErrorAction Stop\n  if ($task -and $task.State -eq 4) { throw 'OpenMeld cannot replace a background task while it is running.' }\n  if ([IO.File]::Exists($hostPath)) {\n    # PowerShell coerces bare $null to an empty string for this .NET parameter.\n    # Pass a real null backup path; an empty path breaks repeat setup/repair.\n    [IO.File]::Replace($temporaryHost, $hostPath, [NullString]::Value)\n  } else {\n    [IO.File]::Move($temporaryHost, $hostPath)\n  }\n} finally {\n  if ([IO.File]::Exists($temporaryHost)) { [IO.File]::Delete($temporaryHost) }\n}\n`;\n","import { type ExecFileException, execFile } from \"node:child_process\";\nimport { normalizeCommandEnvironment } from \"@openmeld/adapter-core/process-environment\";\nimport {\n  powerShellEncodedArguments,\n  resolveWindowsPowerShellPath,\n} from \"@openmeld/adapter-core/windows-system\";\nimport {\n  type WindowsUserTaskAction,\n  type WindowsUserTaskRequest,\n  windowsUserTaskActionSchema,\n  windowsUserTaskRequestSchema,\n  windowsUserTaskStatusSchema,\n  windowsUserTaskStoredActionSchema,\n} from \"@openmeld/schemas\";\nimport { currentDaemonServiceLifecycleLock } from \"../../config/daemon-state\";\nimport {\n  attachLockProcess,\n  type OpenMeldLock,\n  releaseLock,\n} from \"../../config/lock\";\nimport { verifyWindowsServiceSubsystem } from \"./windows-service-binary\";\nimport { readWindowsDirectTaskAction } from \"./windows-task-command\";\nimport {\n  WINDOWS_TASK_HOST_INSTALL_SCRIPT,\n  WINDOWS_TASK_HOST_SUFFIX,\n} from \"./windows-task-host\";\n\n// Task Scheduler runs in the signed-in user's session, with that user's tokens\n// and ordinary permissions. No password, elevation, or third-party service host.\n// Native COM contracts: learn.microsoft.com/windows/win32/taskschd/\nconst TASK_CONTROL = String.raw`\n$ErrorActionPreference = 'Stop'\n$ProgressPreference = 'SilentlyContinue'\n[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)\n$r = ConvertFrom-Json ([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($env:OPENMELD_TASK_REQUEST)))\nif ($env:OPENMELD_TASK_GRANT_REQUIRED -eq '1' -and [Console]::In.ReadLine() -ne 'execute') { exit 125 }\n$env:OPENMELD_TASK_GRANT_REQUIRED = $null\n$sid = [Security.Principal.WindowsIdentity]::GetCurrent().User.Value\nif ($sid -in @('S-1-5-18','S-1-5-19','S-1-5-20')) { throw 'Run OpenMeld setup from your own Windows account, not a system account.' }\n$scheduler = New-Object -ComObject 'Schedule.Service'\n$scheduler.Connect()\n$folder = $scheduler.GetFolder('\\')\n$name = $r.name + '-' + $sid\n$hostPath = $r.legacyScript + '${WINDOWS_TASK_HOST_SUFFIX}'\n$runtimeRoot = [IO.Path]::GetDirectoryName($r.legacyScript)\nfunction Read-OwnedDirectAction($path, $arguments) {\n  if ($arguments -notmatch '(?:^| )--openmeld-windows-task ([A-Za-z0-9+/=]+)$') { return $null }\n  $c = ConvertFrom-Json ([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($Matches[1])))\n  $bundles = [IO.Path]::GetFullPath((Join-Path $runtimeRoot 'bundles')) + '\\'\n  $fullPath = [IO.Path]::GetFullPath($path)\n  if ($c.executable -ne $path -or !$fullPath.StartsWith($bundles, [StringComparison]::OrdinalIgnoreCase) -or [IO.Path]::GetFileName($path) -ne 'openmeld.exe' -or !$c.env.OPENMELD_HOME -or [IO.Path]::GetFullPath((Join-Path $c.env.OPENMELD_HOME 'runtime\\daemon')) -ne [IO.Path]::GetFullPath($runtimeRoot)) {\n    throw 'The Windows task does not belong to this OpenMeld installation.'\n  }\n  return $c\n}\n$existingDirect = $null\n$task = $null\ntry { $task = $folder.GetTask($name) } catch {\n  if ($_.Exception.GetBaseException().HResult -ne -2147024894) { throw }\n}\nif ($task) {\n  $principal = $task.Definition.Principal\n  $taskSid = $principal.UserId\n  if ($taskSid -notmatch '^S-\\d-') { $taskSid = ([Security.Principal.NTAccount]$taskSid).Translate([Security.Principal.SecurityIdentifier]).Value }\n  $actionPath = $task.Definition.Actions.Item(1).Path\n  $existingDirect = Read-OwnedDirectAction $actionPath $task.Definition.Actions.Item(1).Arguments\n  if ($taskSid -ne $sid -or $principal.LogonType -ne 3 -or $principal.RunLevel -ne 0 -or $task.Definition.Actions.Count -ne 1 -or (!$existingDirect -and $actionPath -ne (Join-Path $PSHOME 'powershell.exe') -and $actionPath -ne $hostPath)) {\n    throw 'An existing OpenMeld task uses a different user or launch configuration. Resolve that installation before continuing.'\n  }\n}\n# Migration only owns the exact legacy script in this lane. Never stop another\n# user's or an administrator-customized service merely because its name matches.\n$legacy = Get-CimInstance Win32_Service -Filter (\"Name='\" + $r.name.Replace(\"'\",\"''\") + \"'\")\nif ($legacy -and $legacy.PathName.Trim('\"') -ne $r.legacyScript) {\n  throw 'An existing Windows service uses a different installation. Resolve that installation before continuing.'\n}\nswitch ($r.operation) {\n  'install' {\n    if ($legacy -and $legacy.State -ne 'Stopped') { throw 'The previous OpenMeld Service must finish stopping before migration.' }\n    $nextDirect = Read-OwnedDirectAction $r.executable $r.arguments\n    # A running maintenance invocation keeps its immutable copy and lease. Only\n    # subsequent invocations select the new copy. Main Service replacement still\n    # requires the existing drain and stopped-state proof.\n    $maintenanceUpdate = $r.periodic -and $existingDirect -and $nextDirect -and $existingDirect.args.Count -eq 2 -and $nextDirect.args.Count -eq 2 -and $existingDirect.args[0] -eq 'service' -and $existingDirect.args[1] -eq 'update-worker' -and $nextDirect.args[0] -eq 'service' -and $nextDirect.args[1] -eq 'update-worker'\n    if ($task -and $task.State -eq 4 -and !$maintenanceUpdate) { throw 'OpenMeld cannot replace a background task while it is running.' }\n    if (!$nextDirect) {\n      if ($r.executable -ne (Join-Path $PSHOME 'powershell.exe')) { throw 'OpenMeld tasks require a verified background executable.' }\n      ${WINDOWS_TASK_HOST_INSTALL_SCRIPT}\n    }\n    $definition = $scheduler.NewTask(0)\n    $definition.RegistrationInfo.Description = 'OpenMeld background process for the signed-in user.'\n    $definition.Principal.UserId = $sid\n    $definition.Principal.LogonType = 3\n    $definition.Principal.RunLevel = 0\n    $definition.Settings.Enabled = ($null -eq $legacy)\n    $definition.Settings.Hidden = $true\n    $definition.Settings.AllowDemandStart = $true\n    $definition.Settings.DisallowStartIfOnBatteries = $false\n    $definition.Settings.StopIfGoingOnBatteries = $false\n    $definition.Settings.RunOnlyIfNetworkAvailable = $false\n    $definition.Settings.StartWhenAvailable = $true\n    $definition.Settings.ExecutionTimeLimit = 'PT0S'\n    $definition.Settings.MultipleInstances = 2\n    $definition.Settings.RestartInterval = 'PT1M'\n    $definition.Settings.RestartCount = 999\n    $trigger = $definition.Triggers.Create(9)\n    $trigger.UserId = $sid\n    if ($r.periodic) {\n      $timer = $definition.Triggers.Create(1)\n      $timer.StartBoundary = (Get-Date).AddMinutes(1).ToString('yyyy-MM-ddTHH:mm:ss')\n      $timer.Repetition.Interval = 'PT1H'\n    }\n    $action = $definition.Actions.Create(0)\n    $action.Path = $(if ($nextDirect) { $r.executable } else { $hostPath })\n    $action.Arguments = $r.arguments\n    $action.WorkingDirectory = $r.workingDirectory\n    $task = $folder.RegisterTaskDefinition($name, $definition, 6, $sid, $null, 3, $null)\n    if ($legacy) {\n      try {\n        $deleted = Invoke-CimMethod -InputObject $legacy -MethodName Delete\n        if ($deleted.ReturnValue -ne 0) { throw ('Cannot remove the old Windows Service (code ' + $deleted.ReturnValue + '). An administrator must remove the old registration before setup can continue.') }\n      } catch {\n        $folder.DeleteTask($name,0)\n        throw\n      }\n      $task.Enabled = $true\n    }\n    $legacy = $null\n  }\n  'start' { if (!$task) { throw 'OpenMeld background task is not installed. Run setup to repair it.' }; $null = $task.Run($null) }\n  'enable' { if ($task) { $task.Enabled = $true } }\n  'disable' { if ($task) { $task.Enabled = $false }; if ($legacy) { $result = Invoke-CimMethod -InputObject $legacy -MethodName ChangeStartMode -Arguments @{StartMode='Manual'}; if ($result.ReturnValue -ne 0) { throw 'Cannot disable the old Windows Service. Administrator assistance is required.' } } }\n  'stop' {\n    if ($task) { $task.Stop(0) }\n    if ($legacy -and $legacy.State -ne 'Stopped') {\n      $result = Invoke-CimMethod -InputObject $legacy -MethodName StopService\n      if ($result.ReturnValue -notin @(0,6)) { throw 'Cannot stop the old Windows Service. Administrator assistance is required.' }\n    }\n  }\n  'uninstall' {\n    if ($task) { $task.Stop(0); $folder.DeleteTask($name,0); $task = $null }\n    if ($legacy) {\n      if ($legacy.State -ne 'Stopped') { throw 'The old OpenMeld Service is still running.' }\n      $result = Invoke-CimMethod -InputObject $legacy -MethodName Delete\n      if ($result.ReturnValue -ne 0) { throw 'Cannot remove the old Windows Service. Administrator assistance is required.' }\n      $legacy = $null\n    }\n  }\n  'status' { }\n  default { throw 'Unknown OpenMeld task operation.' }\n}\n@{ installed=($null -ne $task -or $null -ne $legacy); running=($(if ($task) { $task.State -eq 4 } else { $legacy -and $legacy.State -ne 'Stopped' })); enabled=($(if ($task) { [bool]$task.Enabled } else { $legacy -and $legacy.StartMode -eq 'Auto' })); legacy=($null -ne $legacy); actionArguments=($(if ($task) { $task.Definition.Actions.Item(1).Arguments } else { $null })) } | ConvertTo-Json -Compress\n`;\n\nexport function windowsPowerShellPath(): string {\n  return resolveWindowsPowerShellPath();\n}\n\nexport function windowsTaskActionArguments(\n  input: WindowsUserTaskAction\n): string {\n  // TypeScript's structural type does not strip fields from a spread spec.\n  // Project and validate the actual wire value before encoding it.\n  const action = windowsUserTaskActionSchema.parse({\n    executable: input.executable,\n    args: input.args,\n    env: input.env,\n    logPath: input.logPath,\n  });\n  const data = Buffer.from(JSON.stringify(action)).toString(\"base64\");\n  const script = String.raw`\n$ErrorActionPreference = 'Stop'\n$c = ConvertFrom-Json ([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${data}')))\nfunction Quote-ProcessArgument([string]$value) {\n  '\"' + [regex]::Replace([regex]::Replace($value, '(\\\\*)\"', '$1$1\\\"'), '(\\\\+)$', '$1$1') + '\"'\n}\n$start = New-Object Diagnostics.ProcessStartInfo\n$start.FileName = $c.executable\n$start.Arguments = (@($c.args | ForEach-Object { Quote-ProcessArgument $_ }) -join ' ')\n$start.UseShellExecute = $false\n$start.CreateNoWindow = $true\n$start.RedirectStandardOutput = $true\n$start.RedirectStandardError = $true\nforeach ($property in $c.env.PSObject.Properties) { $start.EnvironmentVariables[$property.Name] = [string]$property.Value }\n$log = [IO.Stream]::Synchronized([IO.File]::Open($c.logPath, [IO.FileMode]::Append, [IO.FileAccess]::Write, [IO.FileShare]::ReadWrite))\n$process = New-Object Diagnostics.Process\n$process.StartInfo = $start\ntry {\n  $null = $process.Start()\n  $stdout = $process.StandardOutput.BaseStream.CopyToAsync($log)\n  $stderr = $process.StandardError.BaseStream.CopyToAsync($log)\n  $process.WaitForExit()\n  $stdout.GetAwaiter().GetResult()\n  $stderr.GetAwaiter().GetResult()\n  $exitCode = $process.ExitCode\n} finally {\n  $log.Dispose()\n  $process.Dispose()\n}\nexit $exitCode\n`;\n  return `-NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand ${Buffer.from(script, \"utf16le\").toString(\"base64\")}`;\n}\n\nconst ENCODED_ACTION_PATTERN = /-EncodedCommand ([A-Za-z0-9+/=]+)$/u;\nconst ACTION_DATA_PATTERN = /FromBase64String\\('([A-Za-z0-9+/=]+)'\\)/u;\n\nexport function readWindowsTaskAction(argumentsText: string) {\n  const direct = readWindowsDirectTaskAction(argumentsText);\n  if (direct) {\n    return direct;\n  }\n  const encoded = argumentsText.match(ENCODED_ACTION_PATTERN)?.[1];\n  const data =\n    encoded &&\n    Buffer.from(encoded, \"base64\")\n      .toString(\"utf16le\")\n      .match(ACTION_DATA_PATTERN)?.[1];\n  if (!data) {\n    throw new Error(\n      \"Windows task does not contain an OpenMeld launch command.\"\n    );\n  }\n  const action = windowsUserTaskStoredActionSchema.safeParse(\n    JSON.parse(Buffer.from(data, \"base64\").toString(\"utf8\"))\n  );\n  if (!action.success) {\n    throw new Error(\n      \"Windows task contains an invalid OpenMeld launch command.\"\n    );\n  }\n  return action.data;\n}\n\nexport async function runWindowsUserTask(\n  request: WindowsUserTaskRequest\n): Promise<{\n  installed: boolean;\n  running: boolean;\n  enabled: boolean;\n  legacy: boolean;\n  actionArguments: string | null;\n}> {\n  const lock = currentDaemonServiceLifecycleLock();\n  if (request.operation === \"install\" && request.arguments) {\n    const direct = readWindowsDirectTaskAction(request.arguments);\n    if (direct) {\n      if (request.executable !== direct.executable) {\n        throw new Error(\n          \"The Windows task executable does not match its launch envelope.\"\n        );\n      }\n      await verifyWindowsServiceSubsystem(direct.executable);\n    }\n  }\n  const payload = Buffer.from(\n    JSON.stringify(windowsUserTaskRequestSchema.parse(request))\n  ).toString(\"base64\");\n  let finish!: (value: {\n    error: ExecFileException | null;\n    stdout: string;\n  }) => void;\n  const completed = new Promise<{\n    error: ExecFileException | null;\n    stdout: string;\n  }>((resolve) => {\n    finish = resolve;\n  });\n  const child = execFile(\n    windowsPowerShellPath(),\n    powerShellEncodedArguments(TASK_CONTROL),\n    {\n      encoding: \"utf8\",\n      windowsHide: true,\n      timeout: 30_000,\n      maxBuffer: 1024 * 1024,\n      env: {\n        ...normalizeCommandEnvironment(process.env),\n        OPENMELD_TASK_REQUEST: payload,\n        OPENMELD_TASK_GRANT_REQUIRED: lock ? \"1\" : \"0\",\n      },\n    },\n    (error, stdout) => finish({ error, stdout })\n  );\n  // EOF before the grant prevents the COM operation. Once granted, this exact\n  // PowerShell instance retains the existing lifecycle fence if its CLI dies.\n  // This is not a Wake Job: the independently scheduled Service must survive it.\n  child.stdin?.on(\"error\", () => undefined);\n  let participant: OpenMeldLock | undefined;\n  try {\n    if (lock) {\n      if (!child.pid) {\n        throw new Error(\"Windows task control did not establish a process.\");\n      }\n      participant = await attachLockProcess(lock, child.pid);\n    }\n    child.stdin?.end(lock ? \"execute\\n\" : undefined);\n    const result = await completed;\n    if (result.error) {\n      throw result.error;\n    }\n    const status = windowsUserTaskStatusSchema.safeParse(\n      JSON.parse(result.stdout.trim())\n    );\n    if (!status.success) {\n      throw new Error(\"Windows returned an invalid OpenMeld task status.\");\n    }\n    return status.data;\n  } finally {\n    child.stdin?.destroy();\n    if (child.exitCode === null && child.signalCode === null) {\n      child.kill();\n    }\n    await completed;\n    if (participant) {\n      await releaseLock(participant);\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;AAmBA,MAAM,sBAAsB;AAE5B,SAAgB,6BACd,QACA,YAAyC,CAAC,GAClC;CACR,IACE,EACE,OAAO,yBACP,oBAAoB,KAAK,OAAO,qBAAqB,IAGvD,MAAM,IAAI,MACR,+DACF;CAEF,OAAO,KACL,yBAAyB,SAAS,GAClC,eAAe,OAAO,yBACtB,cACF;AACF;AAEA,eAAsB,gCACpB,QACA,YAAyC,CAAC,GACzB;CACjB,MAAM,SAAS,6BAA6B,QAAQ,SAAS;CAC7D,MAAM,WAAW,OAAO;CACxB,IACG,MAAM,wBAAwB,QAAQ,IAAI,CAAC,CAAC,YAAY,IAAI,MAAO,UAEpE,OAAO;CAET,IACG,MAAM,wBAAwB,OAAO,uBAAuB,IAAI,MACjE,UAEA,MAAM,IAAI,MACR,uEACF;CAEF,MAAM,YAAY,QAAQ,MAAM;CAChC,IACE,MAAM,KAAK,SAAS,CAAC,CAAC,OAAO,UAAiC;EAC5D,IAAI,MAAM,SAAS,UACjB,OAAO;EAET,MAAM;CACR,CAAC,GACD;EACA,MAAM,SAAS,MAAM,yBAAyB,SAAS;EACvD,IAAI,WAAW,aAAa,WAAW,UACrC,MAAM,IAAI,MACR,uFACF;CAEJ;CACA,MAAM,MAAM,yBAAyB,SAAS,GAAG,EAAE,WAAW,KAAK,CAAC;CACpE,MAAM,YAAY,MAAM,QACtB,KAAK,yBAAyB,SAAS,GAAG,eAAe,CAC3D;CACA,IAAI;EACF,KAAK,MAAM,QAAQ,CAAC,gBAAgB,+BAA+B,GACjE,MAAM,SACJ,SAAS,iBACL,OAAO,wBACP,KAAK,QAAQ,OAAO,qBAAqB,GAAG,IAAI,GACpD,KAAK,WAAW,IAAI,CACtB;EAEF,IACG,MAAM,wBAAwB,KAAK,WAAW,cAAc,GAAG,IAAI,MACpE,UAEA,MAAM,IAAI,MACR,4DACF;EAEF,MAAM,OAAO,WAAW,SAAS;CACnC,UAAU;EACR,MAAM,GAAG,WAAW;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CACtD;CACA,OAAO;AACT;AAIA,SAAgB,iCACd,SACQ;CACR,IAAI,CAAC,QAAQ,SAAS,WAAW,UAAU,GACzC,OAAO,QAAQ,OAAO,YAAY;CAEpC,IAAI,CAAC,QAAQ,SACX,MAAM,IAAI,MACR,6DACF;CAEF,OAAO,YAAY,QAAQ,QAAQ,QAAQ,QAAQ,cAAc,MAAM;AACzE;AAEA,eAAsB,wBACpB,gBACA,UAAmB,QAAQ,aAAa,SACvB;CACjB,MAAM,iBAAiB,MAAM,SAAS,cAAc;CACpD,OAAO,UACH,YACE,gBACA,MAAM,SACJ,KAAK,QAAQ,cAAc,GAAG,+BAA+B,CAC/D,CACF,IACA;AACN;AAEA,SAAS,YAAY,gBAAwB,YAA4B;CACvE,OAAO,WAAW,QAAQ,CAAC,CACxB,OACC,KAAK,UAAU,CAAC,eAAe,YAAY,GAAG,WAAW,YAAY,CAAC,CAAC,CACzE,CAAC,CACA,OAAO,KAAK;AACjB;AAEA,eAAe,SAAS,MAA+B;CACrD,MAAM,OAAO,WAAW,QAAQ;CAChC,WAAW,MAAM,SAAS,iBAAiB,IAAI,GAC7C,KAAK,OAAO,KAAK;CAEnB,OAAO,KAAK,OAAO,KAAK;AAC1B;;AAGA,eAAsB,8BACpB,MACe;CACf,MAAM,SAAS,MAAM,KAAK,MAAM,GAAG;CACnC,IAAI;EACF,MAAM,MAAM,OAAO,MAAM,EAAE;EAE3B,KACE,MAFkB,OAAO,KAAK,KAAK,GAAG,IAAI,QAAQ,CAAC,EAAA,CAE7C,cAAc,IAAI,UACxB,IAAI,SAAS,SAAS,GAAG,CAAC,MAAM,MAEhC,MAAM,IAAI,MAAM,sDAAsD;EAExE,MAAM,SAAS,OAAO,MAAM,EAAE;EAO9B,KACE,MAPmB,OAAO,KAC1B,QACA,GACA,OAAO,QACP,IAAI,aAAa,EAAI,CACvB,EAAA,CAES,cAAc,OAAO,UAC5B,OAAO,SAAS,SAAS,GAAG,CAAC,MAAM,YACnC,OAAO,aAAa,CAAC,MAAM,SAC3B,OAAO,aAAa,EAAO,MAAM,GAEjC,MAAM,IAAI,MACR,qEACF;CAEJ,UAAU;EACR,MAAM,OAAO,MAAM;CACrB;AACF;;;ACrLA,MAAa,2BAA2B,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0DlD,MAAa,2BAA2B;AAKxC,MAAa,mCAAmC;;;;;;EAM9C,yBAAyB;;;;;;;;;;;;;;;;AC5C3B,MAAM,eAAe,OAAO,GAAG;;;;;;;;;;;;;iCAaE,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA4ClD,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmEzC,SAAgB,wBAAgC;CAC9C,OAAO,6BAA6B;AACtC;AAEA,SAAgB,2BACd,OACQ;CAGR,MAAM,SAAS,4BAA4B,MAAM;EAC/C,YAAY,MAAM;EAClB,MAAM,MAAM;EACZ,KAAK,MAAM;EACX,SAAS,MAAM;CACjB,CAAC;CACD,MAAM,OAAO,OAAO,KAAK,KAAK,UAAU,MAAM,CAAC,CAAC,CAAC,SAAS,QAAQ;CAClE,MAAM,SAAS,OAAO,GAAG;;sFAE2D,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BzF,OAAO,0EAA0E,OAAO,KAAK,QAAQ,SAAS,CAAC,CAAC,SAAS,QAAQ;AACnI;AAEA,MAAM,yBAAyB;AAC/B,MAAM,sBAAsB;AAE5B,SAAgB,sBAAsB,eAAuB;CAC3D,MAAM,SAAS,4BAA4B,aAAa;CACxD,IAAI,QACF,OAAO;CAET,MAAM,UAAU,cAAc,MAAM,sBAAsB,CAAC,GAAG;CAC9D,MAAM,OACJ,WACA,OAAO,KAAK,SAAS,QAAQ,CAAC,CAC3B,SAAS,SAAS,CAAC,CACnB,MAAM,mBAAmB,CAAC,GAAG;CAClC,IAAI,CAAC,MACH,MAAM,IAAI,MACR,2DACF;CAEF,MAAM,SAAS,kCAAkC,UAC/C,KAAK,MAAM,OAAO,KAAK,MAAM,QAAQ,CAAC,CAAC,SAAS,MAAM,CAAC,CACzD;CACA,IAAI,CAAC,OAAO,SACV,MAAM,IAAI,MACR,2DACF;CAEF,OAAO,OAAO;AAChB;AAEA,eAAsB,mBACpB,SAOC;CACD,MAAM,OAAO,kCAAkC;CAC/C,IAAI,QAAQ,cAAc,aAAa,QAAQ,WAAW;EACxD,MAAM,SAAS,4BAA4B,QAAQ,SAAS;EAC5D,IAAI,QAAQ;GACV,IAAI,QAAQ,eAAe,OAAO,YAChC,MAAM,IAAI,MACR,iEACF;GAEF,MAAM,8BAA8B,OAAO,UAAU;EACvD;CACF;CACA,MAAM,UAAU,OAAO,KACrB,KAAK,UAAU,6BAA6B,MAAM,OAAO,CAAC,CAC5D,CAAC,CAAC,SAAS,QAAQ;CACnB,IAAI;CAIJ,MAAM,YAAY,IAAI,SAGlB,YAAY;EACd,SAAS;CACX,CAAC;CACD,MAAM,QAAQ,SACZ,sBAAsB,GACtB,2BAA2B,YAAY,GACvC;EACE,UAAU;EACV,aAAa;EACb,SAAS;EACT,WAAW,OAAO;EAClB,KAAK;GACH,GAAG,4BAA4B,QAAQ,GAAG;GAC1C,uBAAuB;GACvB,8BAA8B,OAAO,MAAM;EAC7C;CACF,IACC,OAAO,WAAW,OAAO;EAAE;EAAO;CAAO,CAAC,CAC7C;CAIA,MAAM,OAAO,GAAG,eAAe,KAAA,CAAS;CACxC,IAAI;CACJ,IAAI;EACF,IAAI,MAAM;GACR,IAAI,CAAC,MAAM,KACT,MAAM,IAAI,MAAM,mDAAmD;GAErE,cAAc,MAAM,kBAAkB,MAAM,MAAM,GAAG;EACvD;EACA,MAAM,OAAO,IAAI,OAAO,cAAc,KAAA,CAAS;EAC/C,MAAM,SAAS,MAAM;EACrB,IAAI,OAAO,OACT,MAAM,OAAO;EAEf,MAAM,SAAS,4BAA4B,UACzC,KAAK,MAAM,OAAO,OAAO,KAAK,CAAC,CACjC;EACA,IAAI,CAAC,OAAO,SACV,MAAM,IAAI,MAAM,mDAAmD;EAErE,OAAO,OAAO;CAChB,UAAU;EACR,MAAM,OAAO,QAAQ;EACrB,IAAI,MAAM,aAAa,QAAQ,MAAM,eAAe,MAClD,MAAM,KAAK;EAEb,MAAM;EACN,IAAI,aACF,MAAM,YAAY,WAAW;CAEjC;AACF"}
+{"version":3,"file":"windows-user-task-BklwFGVl.js","names":[],"sources":["../src/local-service/lifecycle/windows-service-binary.ts","../src/local-service/lifecycle/windows-task-host.ts","../src/local-service/lifecycle/windows-user-task.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { createReadStream } from \"node:fs\";\nimport {\n  copyFile,\n  mkdir,\n  mkdtemp,\n  open,\n  rename,\n  rm,\n  stat,\n} from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\nimport { pruneWindowsBinaryBundle } from \"@openmeld/adapter-core/windows-system\";\nimport { WINDOWS_PROCESS_HELPER_FILENAME } from \"@openmeld/schemas\";\nimport { daemonRuntimeBundlesPath } from \"../../config/daemon-state\";\nimport type { OpenMeldPathResolutionInput } from \"../../config/paths\";\nimport type { CliBinaryReleaseInfo } from \"../../config/version-state\";\nimport type { DaemonActiveBundleState } from \"./daemon-service-bundle\";\n\nconst FINGERPRINT_PATTERN = /^[0-9a-f]{64}$/u;\n\nexport function windowsMaintenanceBinaryPath(\n  bundle: DaemonActiveBundleState,\n  pathInput: OpenMeldPathResolutionInput = {}\n): string {\n  if (\n    !(\n      bundle.sourceDistFingerprint &&\n      FINGERPRINT_PATTERN.test(bundle.sourceDistFingerprint)\n    )\n  ) {\n    throw new Error(\n      \"OpenMeld maintenance needs a verified Windows Service bundle.\"\n    );\n  }\n  return join(\n    daemonRuntimeBundlesPath(pathInput),\n    `maintenance-${bundle.sourceDistFingerprint}`,\n    \"openmeld.exe\"\n  );\n}\n\nexport async function prepareWindowsMaintenanceBinary(\n  bundle: DaemonActiveBundleState,\n  pathInput: OpenMeldPathResolutionInput = {}\n): Promise<string> {\n  const target = windowsMaintenanceBinaryPath(bundle, pathInput);\n  const expected = bundle.sourceDistFingerprint;\n  if (\n    (await hashBinaryServiceBundle(target, true).catch(() => null)) === expected\n  ) {\n    return target;\n  }\n  if (\n    (await hashBinaryServiceBundle(bundle.sourceEntryScriptPath, true)) !==\n    expected\n  ) {\n    throw new Error(\n      \"The Windows maintenance source no longer matches its verified bundle.\"\n    );\n  }\n  const directory = dirname(target);\n  if (\n    await stat(directory).catch((error: NodeJS.ErrnoException) => {\n      if (error.code === \"ENOENT\") {\n        return null;\n      }\n      throw error;\n    })\n  ) {\n    const result = await pruneWindowsBinaryBundle(directory);\n    if (result !== \"removed\" && result !== \"absent\") {\n      throw new Error(\n        \"The existing Windows maintenance copy is still in use or contains unrecognized files.\"\n      );\n    }\n  }\n  await mkdir(daemonRuntimeBundlesPath(pathInput), { recursive: true });\n  const temporary = await mkdtemp(\n    join(daemonRuntimeBundlesPath(pathInput), \".maintenance-\")\n  );\n  try {\n    for (const name of [\"openmeld.exe\", WINDOWS_PROCESS_HELPER_FILENAME]) {\n      await copyFile(\n        name === \"openmeld.exe\"\n          ? bundle.sourceEntryScriptPath\n          : join(dirname(bundle.sourceEntryScriptPath), name),\n        join(temporary, name)\n      );\n    }\n    if (\n      (await hashBinaryServiceBundle(join(temporary, \"openmeld.exe\"), true)) !==\n      expected\n    ) {\n      throw new Error(\n        \"The prepared Windows maintenance copy failed verification.\"\n      );\n    }\n    await rename(temporary, directory);\n  } finally {\n    await rm(temporary, { recursive: true, force: true });\n  }\n  return target;\n}\n\n// Windows binary_v1 bundles contain two indivisible, independently signed files.\n// Keep one bundle fingerprint for inventory, update jobs, and maintenance copies.\nexport function expectedBinaryServiceFingerprint(\n  release: CliBinaryReleaseInfo\n): string {\n  if (!release.platform.startsWith(\"windows-\")) {\n    return release.sha256.toLowerCase();\n  }\n  if (!release.windows) {\n    throw new Error(\n      \"The selected Windows Service has no native helper metadata.\"\n    );\n  }\n  return fingerprint(release.sha256, release.windows.processHelper.sha256);\n}\n\nexport async function hashBinaryServiceBundle(\n  executablePath: string,\n  windows: boolean = process.platform === \"win32\"\n): Promise<string> {\n  const executableHash = await hashFile(executablePath);\n  return windows\n    ? fingerprint(\n        executableHash,\n        await hashFile(\n          join(dirname(executablePath), WINDOWS_PROCESS_HELPER_FILENAME)\n        )\n      )\n    : executableHash;\n}\n\nfunction fingerprint(executableHash: string, helperHash: string): string {\n  return createHash(\"sha256\")\n    .update(\n      JSON.stringify([executableHash.toLowerCase(), helperHash.toLowerCase()])\n    )\n    .digest(\"hex\");\n}\n\nasync function hashFile(file: string): Promise<string> {\n  const hash = createHash(\"sha256\");\n  for await (const chunk of createReadStream(file)) {\n    hash.update(chunk);\n  }\n  return hash.digest(\"hex\");\n}\n\n/** A valid signature does not establish the required console-free PE subsystem. */\nexport async function verifyWindowsServiceSubsystem(\n  file: string\n): Promise<void> {\n  const handle = await open(file, \"r\");\n  try {\n    const dos = Buffer.alloc(64);\n    const first = await handle.read(dos, 0, dos.length, 0);\n    if (\n      first.bytesRead !== dos.length ||\n      dos.toString(\"ascii\", 0, 2) !== \"MZ\"\n    ) {\n      throw new Error(\"The Windows Service artifact is not a PE executable.\");\n    }\n    const header = Buffer.alloc(94);\n    const second = await handle.read(\n      header,\n      0,\n      header.length,\n      dos.readUInt32LE(0x3c)\n    );\n    if (\n      second.bytesRead !== header.length ||\n      header.toString(\"ascii\", 0, 4) !== \"PE\\0\\0\" ||\n      header.readUInt16LE(4) !== 0x86_64 ||\n      header.readUInt16LE(24 + 68) !== 2\n    ) {\n      throw new Error(\n        \"The selected Windows Service must be a console-free x64 executable.\"\n      );\n    }\n  } finally {\n    await handle.close();\n  }\n}\n","// Task Scheduler must start a Windows-subsystem executable, not a console\n// executable that hides its window after startup. Keep the existing encoded\n// PowerShell action as the command/environment/logging owner.\n// Windows PowerShell 5.1 compiles this fixed source during guarded installation;\n// no SDK, downloaded executable, WSH/VBScript, or administrator access is needed.\nexport const WINDOWS_TASK_HOST_SOURCE = String.raw`\nusing System;\nusing System.Diagnostics;\nusing System.IO;\nusing System.Reflection;\nusing System.Text;\nusing System.Text.RegularExpressions;\n\npublic static class OpenMeldTaskHostV1 {\n  public static int Main(string[] args) {\n    string logPath = Assembly.GetExecutingAssembly().Location + \".log\";\n    try {\n      // Accept only the existing OpenMeld action, never an arbitrary executable\n      // or a shell-interpolated command line. Base64 contains no quoting syntax.\n      if (args.Length != 7 || args[0] != \"-NoLogo\" || args[1] != \"-NoProfile\" ||\n          args[2] != \"-NonInteractive\" || args[3] != \"-WindowStyle\" ||\n          args[4] != \"Hidden\" || args[5] != \"-EncodedCommand\" ||\n          !Regex.IsMatch(args[6], @\"\\A[A-Za-z0-9+/]+={0,2}\\z\"))\n        throw new ArgumentException(\"Invalid OpenMeld task arguments.\");\n      Convert.FromBase64String(args[6]);\n      var start = new ProcessStartInfo();\n      start.FileName = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.System),\n        @\"WindowsPowerShell\\v1.0\\powershell.exe\");\n      start.Arguments = String.Join(\" \", args);\n      start.UseShellExecute = false;\n      start.CreateNoWindow = true;\n      start.RedirectStandardInput = true;\n      start.RedirectStandardOutput = true;\n      start.RedirectStandardError = true;\n      using (var log = Stream.Synchronized(new FileStream(logPath, FileMode.Append,\n          FileAccess.Write, FileShare.ReadWrite)))\n      using (var child = new Process()) {\n        child.StartInfo = start;\n        child.Start();\n        child.StandardInput.Close();\n        var stdout = child.StandardOutput.BaseStream.CopyToAsync(log);\n        var stderr = child.StandardError.BaseStream.CopyToAsync(log);\n        // Do not detach or break away from Task Scheduler's process ownership.\n        // The task remains running until the action completes, and restart-on-\n        // failure still receives the action's real exit code.\n        child.WaitForExit();\n        stdout.GetAwaiter().GetResult();\n        stderr.GetAwaiter().GetResult();\n        return child.ExitCode;\n      }\n    } catch (Exception error) {\n      try { File.AppendAllText(logPath, DateTime.UtcNow.ToString(\"o\") + \" \" +\n        error.GetType().Name + \": \" + error.Message + Environment.NewLine, Encoding.UTF8); }\n      catch { /* Task Scheduler still receives a nonzero result if logging fails. */ }\n      return 1;\n    }\n  }\n}\n`;\n\n// Per-task, lane-owned path: updating the maintenance host cannot replace the\n// executable of a running main Service, or vice versa. Keep v1 stable; a future\n// host format must explicitly support migration from this path.\nexport const WINDOWS_TASK_HOST_SUFFIX = \".task-host-v1.exe\";\n\n// The caller has already verified identity and acquired the lifecycle grant.\n// Build beside the target and replace atomically, never overwrite a running\n// host or fall back to a flashing console when compilation is unavailable.\nexport const WINDOWS_TASK_HOST_INSTALL_SCRIPT = `\n$hostDirectory = [IO.Path]::GetDirectoryName($hostPath)\n$null = [IO.Directory]::CreateDirectory($hostDirectory)\n$temporaryHost = Join-Path $hostDirectory ([Guid]::NewGuid().ToString('N') + '.exe')\ntry {\n  Add-Type -TypeDefinition @'\n${WINDOWS_TASK_HOST_SOURCE}\n'@ -OutputAssembly $temporaryHost -OutputType WindowsApplication -ErrorAction Stop\n  if ($task -and $task.State -eq 4) { throw 'OpenMeld cannot replace a background task while it is running.' }\n  if ([IO.File]::Exists($hostPath)) {\n    # PowerShell coerces bare $null to an empty string for this .NET parameter.\n    # Pass a real null backup path; an empty path breaks repeat setup/repair.\n    [IO.File]::Replace($temporaryHost, $hostPath, [NullString]::Value)\n  } else {\n    [IO.File]::Move($temporaryHost, $hostPath)\n  }\n} finally {\n  if ([IO.File]::Exists($temporaryHost)) { [IO.File]::Delete($temporaryHost) }\n}\n`;\n","import { type ExecFileException, execFile } from \"node:child_process\";\nimport { normalizeCommandEnvironment } from \"@openmeld/adapter-core/process-environment\";\nimport {\n  powerShellEncodedArguments,\n  resolveWindowsPowerShellPath,\n} from \"@openmeld/adapter-core/windows-system\";\nimport {\n  type WindowsUserTaskAction,\n  type WindowsUserTaskRequest,\n  windowsUserTaskActionSchema,\n  windowsUserTaskRequestSchema,\n  windowsUserTaskStatusSchema,\n  windowsUserTaskStoredActionSchema,\n} from \"@openmeld/schemas\";\nimport { currentDaemonServiceLifecycleLock } from \"../../config/daemon-state\";\nimport {\n  attachLockProcess,\n  type OpenMeldLock,\n  releaseLock,\n} from \"../../config/lock\";\nimport { verifyWindowsServiceSubsystem } from \"./windows-service-binary\";\nimport { readWindowsDirectTaskAction } from \"./windows-task-command\";\nimport {\n  WINDOWS_TASK_HOST_INSTALL_SCRIPT,\n  WINDOWS_TASK_HOST_SUFFIX,\n} from \"./windows-task-host\";\n\n// Task Scheduler runs in the signed-in user's session, with that user's tokens\n// and ordinary permissions. No password, elevation, or third-party service host.\n// Native COM contracts: learn.microsoft.com/windows/win32/taskschd/\nconst TASK_CONTROL = String.raw`\n$ErrorActionPreference = 'Stop'\n$ProgressPreference = 'SilentlyContinue'\n[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)\n$r = ConvertFrom-Json ([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($env:OPENMELD_TASK_REQUEST)))\nif ($env:OPENMELD_TASK_GRANT_REQUIRED -eq '1' -and [Console]::In.ReadLine() -ne 'execute') { exit 125 }\n$env:OPENMELD_TASK_GRANT_REQUIRED = $null\n$sid = [Security.Principal.WindowsIdentity]::GetCurrent().User.Value\nif ($sid -in @('S-1-5-18','S-1-5-19','S-1-5-20')) { throw 'Run OpenMeld setup from your own Windows account, not a system account.' }\n$scheduler = New-Object -ComObject 'Schedule.Service'\n$scheduler.Connect()\n$folder = $scheduler.GetFolder('\\')\n$name = $r.name + '-' + $sid\n$hostPath = $r.legacyScript + '${WINDOWS_TASK_HOST_SUFFIX}'\n$runtimeRoot = [IO.Path]::GetDirectoryName($r.legacyScript)\nfunction Read-OwnedDirectAction($path, $arguments) {\n  if ($arguments -notmatch '(?:^| )--openmeld-windows-task ([A-Za-z0-9+/=]+)$') { return $null }\n  $c = ConvertFrom-Json ([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($Matches[1])))\n  $bundles = [IO.Path]::GetFullPath((Join-Path $runtimeRoot 'bundles')) + '\\'\n  $fullPath = [IO.Path]::GetFullPath($path)\n  if ($c.executable -ne $path -or !$fullPath.StartsWith($bundles, [StringComparison]::OrdinalIgnoreCase) -or [IO.Path]::GetFileName($path) -ne 'openmeld.exe' -or !$c.env.OPENMELD_HOME -or [IO.Path]::GetFullPath((Join-Path $c.env.OPENMELD_HOME 'runtime\\daemon')) -ne [IO.Path]::GetFullPath($runtimeRoot)) {\n    throw 'The Windows task does not belong to this OpenMeld installation.'\n  }\n  return $c\n}\n$existingDirect = $null\n$task = $null\ntry { $task = $folder.GetTask($name) } catch {\n  if ($_.Exception.GetBaseException().HResult -ne -2147024894) { throw }\n}\nif ($task) {\n  $principal = $task.Definition.Principal\n  $taskSid = $principal.UserId\n  if ($taskSid -notmatch '^S-\\d-') { $taskSid = ([Security.Principal.NTAccount]$taskSid).Translate([Security.Principal.SecurityIdentifier]).Value }\n  $actionPath = $task.Definition.Actions.Item(1).Path\n  $existingDirect = Read-OwnedDirectAction $actionPath $task.Definition.Actions.Item(1).Arguments\n  if ($taskSid -ne $sid -or $principal.LogonType -ne 3 -or $principal.RunLevel -ne 0 -or $task.Definition.Actions.Count -ne 1 -or (!$existingDirect -and $actionPath -ne (Join-Path $PSHOME 'powershell.exe') -and $actionPath -ne $hostPath)) {\n    throw 'An existing OpenMeld task uses a different user or launch configuration. Resolve that installation before continuing.'\n  }\n}\n# Migration only owns the exact legacy script in this lane. Never stop another\n# user's or an administrator-customized service merely because its name matches.\n$legacy = Get-CimInstance Win32_Service -Filter (\"Name='\" + $r.name.Replace(\"'\",\"''\") + \"'\")\nif ($legacy -and $legacy.PathName.Trim('\"') -ne $r.legacyScript) {\n  throw 'An existing Windows service uses a different installation. Resolve that installation before continuing.'\n}\nswitch ($r.operation) {\n  'install' {\n    if ($legacy -and $legacy.State -ne 'Stopped') { throw 'The previous OpenMeld Service must finish stopping before migration.' }\n    $nextDirect = Read-OwnedDirectAction $r.executable $r.arguments\n    # A running maintenance invocation keeps its immutable copy and lease. Only\n    # subsequent invocations select the new copy. Main Service replacement still\n    # requires the existing drain and stopped-state proof.\n    $maintenanceUpdate = $r.periodic -and $existingDirect -and $nextDirect -and $existingDirect.args.Count -eq 2 -and $nextDirect.args.Count -eq 2 -and $existingDirect.args[0] -eq 'service' -and $existingDirect.args[1] -eq 'update-worker' -and $nextDirect.args[0] -eq 'service' -and $nextDirect.args[1] -eq 'update-worker'\n    if ($task -and $task.State -eq 4 -and !$maintenanceUpdate) { throw 'OpenMeld cannot replace a background task while it is running.' }\n    if (!$nextDirect) {\n      if ($r.executable -ne (Join-Path $PSHOME 'powershell.exe')) { throw 'OpenMeld tasks require a verified background executable.' }\n      ${WINDOWS_TASK_HOST_INSTALL_SCRIPT}\n    }\n    $definition = $scheduler.NewTask(0)\n    $definition.RegistrationInfo.Description = 'OpenMeld background process for the signed-in user.'\n    $definition.Principal.UserId = $sid\n    $definition.Principal.LogonType = 3\n    $definition.Principal.RunLevel = 0\n    $definition.Settings.Enabled = ($null -eq $legacy)\n    $definition.Settings.Hidden = $true\n    $definition.Settings.AllowDemandStart = $true\n    $definition.Settings.DisallowStartIfOnBatteries = $false\n    $definition.Settings.StopIfGoingOnBatteries = $false\n    $definition.Settings.RunOnlyIfNetworkAvailable = $false\n    $definition.Settings.StartWhenAvailable = $true\n    $definition.Settings.ExecutionTimeLimit = 'PT0S'\n    $definition.Settings.MultipleInstances = 2\n    $definition.Settings.RestartInterval = 'PT1M'\n    $definition.Settings.RestartCount = 999\n    $trigger = $definition.Triggers.Create(9)\n    $trigger.UserId = $sid\n    if ($r.periodic) {\n      $timer = $definition.Triggers.Create(1)\n      $timer.StartBoundary = (Get-Date).AddMinutes(1).ToString('yyyy-MM-ddTHH:mm:ss')\n      $timer.Repetition.Interval = 'PT1H'\n    }\n    $action = $definition.Actions.Create(0)\n    $action.Path = $(if ($nextDirect) { $r.executable } else { $hostPath })\n    $action.Arguments = $r.arguments\n    $action.WorkingDirectory = $r.workingDirectory\n    $task = $folder.RegisterTaskDefinition($name, $definition, 6, $sid, $null, 3, $null)\n    if ($legacy) {\n      try {\n        $deleted = Invoke-CimMethod -InputObject $legacy -MethodName Delete\n        if ($deleted.ReturnValue -ne 0) { throw ('Cannot remove the old Windows Service (code ' + $deleted.ReturnValue + '). An administrator must remove the old registration before setup can continue.') }\n      } catch {\n        $folder.DeleteTask($name,0)\n        throw\n      }\n      $task.Enabled = $true\n    }\n    $legacy = $null\n  }\n  'start' { if (!$task) { throw 'OpenMeld background task is not installed. Run setup to repair it.' }; $null = $task.Run($null) }\n  'enable' { if ($task) { $task.Enabled = $true } }\n  'disable' { if ($task) { $task.Enabled = $false }; if ($legacy) { $result = Invoke-CimMethod -InputObject $legacy -MethodName ChangeStartMode -Arguments @{StartMode='Manual'}; if ($result.ReturnValue -ne 0) { throw 'Cannot disable the old Windows Service. Administrator assistance is required.' } } }\n  'stop' {\n    if ($task) { $task.Stop(0) }\n    if ($legacy -and $legacy.State -ne 'Stopped') {\n      $result = Invoke-CimMethod -InputObject $legacy -MethodName StopService\n      if ($result.ReturnValue -notin @(0,6)) { throw 'Cannot stop the old Windows Service. Administrator assistance is required.' }\n    }\n  }\n  'uninstall' {\n    if ($task) { $task.Stop(0); $folder.DeleteTask($name,0); $task = $null }\n    if ($legacy) {\n      if ($legacy.State -ne 'Stopped') { throw 'The old OpenMeld Service is still running.' }\n      $result = Invoke-CimMethod -InputObject $legacy -MethodName Delete\n      if ($result.ReturnValue -ne 0) { throw 'Cannot remove the old Windows Service. Administrator assistance is required.' }\n      $legacy = $null\n    }\n  }\n  'status' { }\n  default { throw 'Unknown OpenMeld task operation.' }\n}\n@{ installed=($null -ne $task -or $null -ne $legacy); running=($(if ($task) { $task.State -eq 4 } else { $legacy -and $legacy.State -ne 'Stopped' })); enabled=($(if ($task) { [bool]$task.Enabled } else { $legacy -and $legacy.StartMode -eq 'Auto' })); legacy=($null -ne $legacy); actionArguments=($(if ($task) { $task.Definition.Actions.Item(1).Arguments } else { $null })) } | ConvertTo-Json -Compress\n`;\n\nexport function windowsPowerShellPath(): string {\n  return resolveWindowsPowerShellPath();\n}\n\nexport function windowsTaskActionArguments(\n  input: WindowsUserTaskAction\n): string {\n  // TypeScript's structural type does not strip fields from a spread spec.\n  // Project and validate the actual wire value before encoding it.\n  const action = windowsUserTaskActionSchema.parse({\n    executable: input.executable,\n    args: input.args,\n    env: input.env,\n    logPath: input.logPath,\n  });\n  const data = Buffer.from(JSON.stringify(action)).toString(\"base64\");\n  const script = String.raw`\n$ErrorActionPreference = 'Stop'\n$c = ConvertFrom-Json ([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${data}')))\nfunction Quote-ProcessArgument([string]$value) {\n  '\"' + [regex]::Replace([regex]::Replace($value, '(\\\\*)\"', '$1$1\\\"'), '(\\\\+)$', '$1$1') + '\"'\n}\n$start = New-Object Diagnostics.ProcessStartInfo\n$start.FileName = $c.executable\n$start.Arguments = (@($c.args | ForEach-Object { Quote-ProcessArgument $_ }) -join ' ')\n$start.UseShellExecute = $false\n$start.CreateNoWindow = $true\n$start.RedirectStandardOutput = $true\n$start.RedirectStandardError = $true\nforeach ($property in $c.env.PSObject.Properties) { $start.EnvironmentVariables[$property.Name] = [string]$property.Value }\n$log = [IO.Stream]::Synchronized([IO.File]::Open($c.logPath, [IO.FileMode]::Append, [IO.FileAccess]::Write, [IO.FileShare]::ReadWrite))\n$process = New-Object Diagnostics.Process\n$process.StartInfo = $start\ntry {\n  $null = $process.Start()\n  $stdout = $process.StandardOutput.BaseStream.CopyToAsync($log)\n  $stderr = $process.StandardError.BaseStream.CopyToAsync($log)\n  $process.WaitForExit()\n  $stdout.GetAwaiter().GetResult()\n  $stderr.GetAwaiter().GetResult()\n  $exitCode = $process.ExitCode\n} finally {\n  $log.Dispose()\n  $process.Dispose()\n}\nexit $exitCode\n`;\n  return `-NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand ${Buffer.from(script, \"utf16le\").toString(\"base64\")}`;\n}\n\nconst ENCODED_ACTION_PATTERN = /-EncodedCommand ([A-Za-z0-9+/=]+)$/u;\nconst ACTION_DATA_PATTERN = /FromBase64String\\('([A-Za-z0-9+/=]+)'\\)/u;\n\nexport function readWindowsTaskAction(argumentsText: string) {\n  const direct = readWindowsDirectTaskAction(argumentsText);\n  if (direct) {\n    return direct;\n  }\n  const encoded = argumentsText.match(ENCODED_ACTION_PATTERN)?.[1];\n  const data =\n    encoded &&\n    Buffer.from(encoded, \"base64\")\n      .toString(\"utf16le\")\n      .match(ACTION_DATA_PATTERN)?.[1];\n  if (!data) {\n    throw new Error(\n      \"Windows task does not contain an OpenMeld launch command.\"\n    );\n  }\n  const action = windowsUserTaskStoredActionSchema.safeParse(\n    JSON.parse(Buffer.from(data, \"base64\").toString(\"utf8\"))\n  );\n  if (!action.success) {\n    throw new Error(\n      \"Windows task contains an invalid OpenMeld launch command.\"\n    );\n  }\n  return action.data;\n}\n\nexport async function runWindowsUserTask(\n  request: WindowsUserTaskRequest\n): Promise<{\n  installed: boolean;\n  running: boolean;\n  enabled: boolean;\n  legacy: boolean;\n  actionArguments: string | null;\n}> {\n  const lock = currentDaemonServiceLifecycleLock();\n  if (request.operation === \"install\" && request.arguments) {\n    const direct = readWindowsDirectTaskAction(request.arguments);\n    if (direct) {\n      if (request.executable !== direct.executable) {\n        throw new Error(\n          \"The Windows task executable does not match its launch envelope.\"\n        );\n      }\n      await verifyWindowsServiceSubsystem(direct.executable);\n    }\n  }\n  const payload = Buffer.from(\n    JSON.stringify(windowsUserTaskRequestSchema.parse(request))\n  ).toString(\"base64\");\n  let finish!: (value: {\n    error: ExecFileException | null;\n    stdout: string;\n  }) => void;\n  const completed = new Promise<{\n    error: ExecFileException | null;\n    stdout: string;\n  }>((resolve) => {\n    finish = resolve;\n  });\n  const child = execFile(\n    windowsPowerShellPath(),\n    powerShellEncodedArguments(TASK_CONTROL),\n    {\n      encoding: \"utf8\",\n      windowsHide: true,\n      timeout: 30_000,\n      maxBuffer: 1024 * 1024,\n      env: {\n        ...normalizeCommandEnvironment(process.env),\n        OPENMELD_TASK_REQUEST: payload,\n        OPENMELD_TASK_GRANT_REQUIRED: lock ? \"1\" : \"0\",\n      },\n    },\n    (error, stdout) => finish({ error, stdout })\n  );\n  // EOF before the grant prevents the COM operation. Once granted, this exact\n  // PowerShell instance retains the existing lifecycle fence if its CLI dies.\n  // This is not a Wake Job: the independently scheduled Service must survive it.\n  child.stdin?.on(\"error\", () => undefined);\n  let participant: OpenMeldLock | undefined;\n  try {\n    if (lock) {\n      if (!child.pid) {\n        throw new Error(\"Windows task control did not establish a process.\");\n      }\n      participant = await attachLockProcess(lock, child.pid);\n    }\n    child.stdin?.end(lock ? \"execute\\n\" : undefined);\n    const result = await completed;\n    if (result.error) {\n      throw result.error;\n    }\n    const status = windowsUserTaskStatusSchema.safeParse(\n      JSON.parse(result.stdout.trim())\n    );\n    if (!status.success) {\n      throw new Error(\"Windows returned an invalid OpenMeld task status.\");\n    }\n    return status.data;\n  } finally {\n    child.stdin?.destroy();\n    if (child.exitCode === null && child.signalCode === null) {\n      child.kill();\n    }\n    await completed;\n    if (participant) {\n      await releaseLock(participant);\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;AAmBA,MAAM,sBAAsB;AAE5B,SAAgB,6BACd,QACA,YAAyC,CAAC,GAClC;CACR,IACE,EACE,OAAO,yBACP,oBAAoB,KAAK,OAAO,qBAAqB,IAGvD,MAAM,IAAI,MACR,+DACF;CAEF,OAAO,KACL,yBAAyB,SAAS,GAClC,eAAe,OAAO,yBACtB,cACF;AACF;AAEA,eAAsB,gCACpB,QACA,YAAyC,CAAC,GACzB;CACjB,MAAM,SAAS,6BAA6B,QAAQ,SAAS;CAC7D,MAAM,WAAW,OAAO;CACxB,IACG,MAAM,wBAAwB,QAAQ,IAAI,CAAC,CAAC,YAAY,IAAI,MAAO,UAEpE,OAAO;CAET,IACG,MAAM,wBAAwB,OAAO,uBAAuB,IAAI,MACjE,UAEA,MAAM,IAAI,MACR,uEACF;CAEF,MAAM,YAAY,QAAQ,MAAM;CAChC,IACE,MAAM,KAAK,SAAS,CAAC,CAAC,OAAO,UAAiC;EAC5D,IAAI,MAAM,SAAS,UACjB,OAAO;EAET,MAAM;CACR,CAAC,GACD;EACA,MAAM,SAAS,MAAM,yBAAyB,SAAS;EACvD,IAAI,WAAW,aAAa,WAAW,UACrC,MAAM,IAAI,MACR,uFACF;CAEJ;CACA,MAAM,MAAM,yBAAyB,SAAS,GAAG,EAAE,WAAW,KAAK,CAAC;CACpE,MAAM,YAAY,MAAM,QACtB,KAAK,yBAAyB,SAAS,GAAG,eAAe,CAC3D;CACA,IAAI;EACF,KAAK,MAAM,QAAQ,CAAC,gBAAgB,+BAA+B,GACjE,MAAM,SACJ,SAAS,iBACL,OAAO,wBACP,KAAK,QAAQ,OAAO,qBAAqB,GAAG,IAAI,GACpD,KAAK,WAAW,IAAI,CACtB;EAEF,IACG,MAAM,wBAAwB,KAAK,WAAW,cAAc,GAAG,IAAI,MACpE,UAEA,MAAM,IAAI,MACR,4DACF;EAEF,MAAM,OAAO,WAAW,SAAS;CACnC,UAAU;EACR,MAAM,GAAG,WAAW;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CACtD;CACA,OAAO;AACT;AAIA,SAAgB,iCACd,SACQ;CACR,IAAI,CAAC,QAAQ,SAAS,WAAW,UAAU,GACzC,OAAO,QAAQ,OAAO,YAAY;CAEpC,IAAI,CAAC,QAAQ,SACX,MAAM,IAAI,MACR,6DACF;CAEF,OAAO,YAAY,QAAQ,QAAQ,QAAQ,QAAQ,cAAc,MAAM;AACzE;AAEA,eAAsB,wBACpB,gBACA,UAAmB,QAAQ,aAAa,SACvB;CACjB,MAAM,iBAAiB,MAAM,SAAS,cAAc;CACpD,OAAO,UACH,YACE,gBACA,MAAM,SACJ,KAAK,QAAQ,cAAc,GAAG,+BAA+B,CAC/D,CACF,IACA;AACN;AAEA,SAAS,YAAY,gBAAwB,YAA4B;CACvE,OAAO,WAAW,QAAQ,CAAC,CACxB,OACC,KAAK,UAAU,CAAC,eAAe,YAAY,GAAG,WAAW,YAAY,CAAC,CAAC,CACzE,CAAC,CACA,OAAO,KAAK;AACjB;AAEA,eAAe,SAAS,MAA+B;CACrD,MAAM,OAAO,WAAW,QAAQ;CAChC,WAAW,MAAM,SAAS,iBAAiB,IAAI,GAC7C,KAAK,OAAO,KAAK;CAEnB,OAAO,KAAK,OAAO,KAAK;AAC1B;;AAGA,eAAsB,8BACpB,MACe;CACf,MAAM,SAAS,MAAM,KAAK,MAAM,GAAG;CACnC,IAAI;EACF,MAAM,MAAM,OAAO,MAAM,EAAE;EAE3B,KACE,MAFkB,OAAO,KAAK,KAAK,GAAG,IAAI,QAAQ,CAAC,EAAA,CAE7C,cAAc,IAAI,UACxB,IAAI,SAAS,SAAS,GAAG,CAAC,MAAM,MAEhC,MAAM,IAAI,MAAM,sDAAsD;EAExE,MAAM,SAAS,OAAO,MAAM,EAAE;EAO9B,KACE,MAPmB,OAAO,KAC1B,QACA,GACA,OAAO,QACP,IAAI,aAAa,EAAI,CACvB,EAAA,CAES,cAAc,OAAO,UAC5B,OAAO,SAAS,SAAS,GAAG,CAAC,MAAM,YACnC,OAAO,aAAa,CAAC,MAAM,SAC3B,OAAO,aAAa,EAAO,MAAM,GAEjC,MAAM,IAAI,MACR,qEACF;CAEJ,UAAU;EACR,MAAM,OAAO,MAAM;CACrB;AACF;;;ACrLA,MAAa,2BAA2B,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0DlD,MAAa,2BAA2B;AAKxC,MAAa,mCAAmC;;;;;;EAM9C,yBAAyB;;;;;;;;;;;;;;;;AC5C3B,MAAM,eAAe,OAAO,GAAG;;;;;;;;;;;;;iCAaE,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA4ClD,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmEzC,SAAgB,wBAAgC;CAC9C,OAAO,6BAA6B;AACtC;AAEA,SAAgB,2BACd,OACQ;CAGR,MAAM,SAAS,4BAA4B,MAAM;EAC/C,YAAY,MAAM;EAClB,MAAM,MAAM;EACZ,KAAK,MAAM;EACX,SAAS,MAAM;CACjB,CAAC;CACD,MAAM,OAAO,OAAO,KAAK,KAAK,UAAU,MAAM,CAAC,CAAC,CAAC,SAAS,QAAQ;CAClE,MAAM,SAAS,OAAO,GAAG;;sFAE2D,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BzF,OAAO,0EAA0E,OAAO,KAAK,QAAQ,SAAS,CAAC,CAAC,SAAS,QAAQ;AACnI;AAEA,MAAM,yBAAyB;AAC/B,MAAM,sBAAsB;AAE5B,SAAgB,sBAAsB,eAAuB;CAC3D,MAAM,SAAS,4BAA4B,aAAa;CACxD,IAAI,QACF,OAAO;CAET,MAAM,UAAU,cAAc,MAAM,sBAAsB,CAAC,GAAG;CAC9D,MAAM,OACJ,WACA,OAAO,KAAK,SAAS,QAAQ,CAAC,CAC3B,SAAS,SAAS,CAAC,CACnB,MAAM,mBAAmB,CAAC,GAAG;CAClC,IAAI,CAAC,MACH,MAAM,IAAI,MACR,2DACF;CAEF,MAAM,SAAS,kCAAkC,UAC/C,KAAK,MAAM,OAAO,KAAK,MAAM,QAAQ,CAAC,CAAC,SAAS,MAAM,CAAC,CACzD;CACA,IAAI,CAAC,OAAO,SACV,MAAM,IAAI,MACR,2DACF;CAEF,OAAO,OAAO;AAChB;AAEA,eAAsB,mBACpB,SAOC;CACD,MAAM,OAAO,kCAAkC;CAC/C,IAAI,QAAQ,cAAc,aAAa,QAAQ,WAAW;EACxD,MAAM,SAAS,4BAA4B,QAAQ,SAAS;EAC5D,IAAI,QAAQ;GACV,IAAI,QAAQ,eAAe,OAAO,YAChC,MAAM,IAAI,MACR,iEACF;GAEF,MAAM,8BAA8B,OAAO,UAAU;EACvD;CACF;CACA,MAAM,UAAU,OAAO,KACrB,KAAK,UAAU,6BAA6B,MAAM,OAAO,CAAC,CAC5D,CAAC,CAAC,SAAS,QAAQ;CACnB,IAAI;CAIJ,MAAM,YAAY,IAAI,SAGlB,YAAY;EACd,SAAS;CACX,CAAC;CACD,MAAM,QAAQ,SACZ,sBAAsB,GACtB,2BAA2B,YAAY,GACvC;EACE,UAAU;EACV,aAAa;EACb,SAAS;EACT,WAAW,OAAO;EAClB,KAAK;GACH,GAAG,4BAA4B,QAAQ,GAAG;GAC1C,uBAAuB;GACvB,8BAA8B,OAAO,MAAM;EAC7C;CACF,IACC,OAAO,WAAW,OAAO;EAAE;EAAO;CAAO,CAAC,CAC7C;CAIA,MAAM,OAAO,GAAG,eAAe,KAAA,CAAS;CACxC,IAAI;CACJ,IAAI;EACF,IAAI,MAAM;GACR,IAAI,CAAC,MAAM,KACT,MAAM,IAAI,MAAM,mDAAmD;GAErE,cAAc,MAAM,kBAAkB,MAAM,MAAM,GAAG;EACvD;EACA,MAAM,OAAO,IAAI,OAAO,cAAc,KAAA,CAAS;EAC/C,MAAM,SAAS,MAAM;EACrB,IAAI,OAAO,OACT,MAAM,OAAO;EAEf,MAAM,SAAS,4BAA4B,UACzC,KAAK,MAAM,OAAO,OAAO,KAAK,CAAC,CACjC;EACA,IAAI,CAAC,OAAO,SACV,MAAM,IAAI,MAAM,mDAAmD;EAErE,OAAO,OAAO;CAChB,UAAU;EACR,MAAM,OAAO,QAAQ;EACrB,IAAI,MAAM,aAAa,QAAQ,MAAM,eAAe,MAClD,MAAM,KAAK;EAEb,MAAM;EACN,IAAI,aACF,MAAM,YAAY,WAAW;CAEjC;AACF"}

package/dist/{windows-user-task-DITX-iuM.js → windows-user-task-Cl0xT62s.js}

@@ -1,4 +1,4 @@
 #!/usr/bin/env node
 
-import { n as runWindowsUserTask, t as readWindowsTaskAction } from "./windows-user-task-DjvrZWhN.js";
+import { n as runWindowsUserTask, t as readWindowsTaskAction } from "./windows-user-task-BklwFGVl.js";
 export { readWindowsTaskAction, runWindowsUserTask };

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://www.schemastore.org/package.json",
   "name": "openmeld",
-  "version": "0.3.249",
+  "version": "0.3.250",
   "openMeldReleaseDate": "2026-10-08",
   "description": "OpenMeld CLI - https://openmeld.ai",
   "license": "MIT",
@@ -50,25 +50,25 @@
     "vitest": "~3.2.0",
     "@openmeld/adapter-antigravity": "0.0.1",
     "@openmeld/adapter-claude-code": "0.0.1",
-    "@openmeld/adapter-codex": "0.0.1",
     "@openmeld/adapter-core": "0.0.1",
+    "@openmeld/adapter-codex": "0.0.1",
+    "@openmeld/adapter-openclaw": "0.0.1",
     "@openmeld/adapter-cursor": "0.0.1",
     "@openmeld/adapter-grok-build": "0.0.1",
-    "@openmeld/adapter-openclaw": "0.0.1",
-    "@openmeld/agent-runtime": "0.0.1",
+    "@openmeld/adapter-opencode": "0.0.1",
     "@openmeld/api-client": "0.0.1",
+    "@openmeld/local-execution": "0.0.1",
+    "@openmeld/agent-runtime": "0.0.1",
     "@openmeld/gateway-contract": "0.0.1",
-    "@openmeld/adapter-opencode": "0.0.1",
-    "@openmeld/local-service": "0.0.1",
     "@openmeld/projects": "0.0.1",
-    "@openmeld/local-execution": "0.0.1",
+    "@openmeld/local-service": "0.0.1",
     "@openmeld/protocol": "0.0.1",
+    "@openmeld/schemas": "0.0.1",
     "@openmeld/routine-schedule": "0.0.1",
     "@openmeld/space": "0.0.1",
-    "@openmeld/schemas": "0.0.1",
-    "@openmeld/start": "0.0.1",
+    "@openmeld/space-mesh": "0.0.1",
     "@openmeld/utils": "0.0.1",
-    "@openmeld/space-mesh": "0.0.1"
+    "@openmeld/start": "0.0.1"
   },
   "openmeld": {
     "releaseLine": "openmeld-greenfield-2026-07",
@@ -86,5 +86,5 @@
     "test:local-service": "vitest run --config vitest.integration.config.ts tests/local-service-state.integration.test.ts tests/local-service-command.integration.test.ts tests/local-service-menu.integration.test.ts tests/local-service-run.integration.test.ts tests/local-service-bootstrap-recommendation.test.ts",
     "test:watch": "vitest"
   },
-  "gitHead": "a04028d7a6a16ca123163576ce2b3f00d311684e"
+  "gitHead": "2de34997f690f3c6bc87c396a2a40e040a96051c"
 }

package/skills/openmeld-cli/SKILL.md

@@ -120,6 +120,12 @@ Organization and continuing that same identity matches the user's intent.
 
 ## Setup Entry And Health
 
+For code work, a Local Agent uses its already authorized local Project folder
+or working directory by default. Use cloud Computer when the user chooses it
+or a concrete environment or isolation requirement justifies it. Explain the
+requirement before changing environments. Continue an existing cloud task in
+its current environment and preserve its work.
+
 When OpenMeld Web provides a setup command, run it exactly. Do not rewrite its
 token, lane, distribution, bootstrap URL, or local-agent selection. After setup,
 use the `cliCommandPrefix` and `nextCommands` from `setup.complete`; do not
@@ -145,7 +151,11 @@ openmeld computer cloud --operation '{"action":"command","invocationId":"report-
 
 Keep `invocationId` and command `key` stable across retries. Use `poll` or `list`
 after an uncertain response; do not start another command. `stop` addresses only
-that invocation's key. Independent tasks can run concurrently. Use separate
+that invocation's key. `syncPending` means the process exited but file
+synchronization is unconfirmed. Continue polling unless `syncError` or
+`nextAction: inspect` is present. Then stop polling and inspect persistent files.
+An exit code does not prove file synchronization succeeded.
+Independent tasks can run concurrently. Use separate
 files or Git worktrees for concurrent edits. `edit` checks exact old text;
 `write` can include `expectedContent` to reject a stale overwrite. Shell writes
 do not participate in this conflict check. Select what to share from the

package/skills/openmeld-cli/playbooks/computer.md

@@ -1,5 +1,11 @@
 # Work on the cloud Computer
 
+A Local Agent uses its already authorized local Project folder or working
+directory for code work by default. Use cloud Computer when the user chooses
+it or a concrete environment or isolation requirement justifies it. Explain
+the requirement before changing environments. Continue an existing cloud task
+in its current environment and preserve its work.
+
 Use `openmeld computer cloud --operation '{"action":"describe"}' --view agent`
 to inspect current capabilities and persistent storage. Missing storage data
 on an older server means unknown, not empty. The Computer belongs to the signed-in
@@ -29,10 +35,25 @@ Worktrees share Git objects, but working files, dependencies and builds can stil
 consume space. Do not share mutable dependency directories across tasks blindly.
 
 Use the selected Plugin account for fresh Git access; see `plugins.md`.
+Refresh temporary Git transport through the current Plugin connection before
+fetching in a reused repository. Keep the same selected account and connection
+key. Do not save temporary URLs or credentials in Git remotes or configuration.
 Cached files do not grant new permissions to fetch, publish or disclose code.
 Pass an explicit `cwd` in the Computer command. Task logs and temporary outputs
 can remain under `/computer/tasks/<task-id>`.
 
+## Recover command results
+
+Start once with a stable invocation ID and command key. Poll that same key.
+Use `list` after an uncertain response. A timeout or missing native record
+never proves the command had no effect and never permits an automatic relaunch.
+
+`syncPending` means the process exited but file synchronization is unconfirmed.
+Continue polling unless `syncError` or `nextAction: inspect` is present. Then
+stop polling and inspect persistent files. The receipt preserves the known
+exit code and output. An exit code does not prove file synchronization succeeded.
+Explain unresolved synchronization before treating a generated file as complete.
+
 ## Check capacity and preserve work
 
 Before a large clone, download, dependency install or build, inspect

package/dist/api-client-foundation-BIYsNssD.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"api-client-foundation-BIYsNssD.js","names":["resolveSpaceRequestTimeoutMsForDiagnostics","resolveSpaceRequestTimeoutMsForCliDiagnostics"],"sources":["../src/config/auth-request-compatibility.ts","../src/config/openmeld-request-context.ts","../src/config/request-headers.ts","../src/space/request-timeout.ts","../src/space/fetch-with-timeout.ts","../src/space/api-client-foundation.ts"],"sourcesContent":["import { normalizeBaseUrl } from \"../protocol/urls\";\nimport type { StoredAuthSession } from \"./auth-session\";\nimport { isLoopbackHostname } from \"./loopback-hostname\";\n\nexport type AuthRequestCompatibilityReason =\n  | \"invalid_request_url\"\n  | \"invalid_auth_url\"\n  | \"insecure_transport\"\n  | \"host_mismatch\"\n  | \"loopback\"\n  | \"same_host\"\n  | \"gateway_sibling\";\n\nexport type AuthRequestCompatibility = {\n  compatible: boolean;\n  reason: AuthRequestCompatibilityReason;\n  requestHost: string | null;\n  authHost: string | null;\n  expectedGatewayHost: string | null;\n};\n\nexport function resolveAuthRequestCompatibility(input: {\n  session: StoredAuthSession;\n  requestUrl: string;\n}): AuthRequestCompatibility {\n  const requestUrl = parseUrlOrNull(input.requestUrl);\n  if (!requestUrl) {\n    return {\n      compatible: false,\n      reason: \"invalid_request_url\",\n      requestHost: null,\n      authHost: null,\n      expectedGatewayHost: null,\n    };\n  }\n\n  const authBaseUrl = parseUrlOrNull(input.session.authBaseUrl);\n  if (!authBaseUrl) {\n    return {\n      compatible: false,\n      reason: \"invalid_auth_url\",\n      requestHost: requestUrl.host,\n      authHost: null,\n      expectedGatewayHost: null,\n    };\n  }\n\n  const expectedGatewayHost = deriveGatewayHost(authBaseUrl);\n  const requestHost = requestUrl.host;\n  const authHost = authBaseUrl.host;\n\n  if (\n    (isLoopbackHostname(requestUrl.hostname) &&\n      isLoopbackHostname(authBaseUrl.hostname)) ||\n    // Isolated worktrees share a hostname across Auth and Gateway ports.\n    // Never treat different named localhost lanes as interchangeable.\n    (requestUrl.hostname.endsWith(\".localhost\") &&\n      requestUrl.hostname === authBaseUrl.hostname &&\n      isHttpTransportProtocol(authBaseUrl.protocol) &&\n      [\"http:\", \"https:\", \"ws:\", \"wss:\"].includes(requestUrl.protocol))\n  ) {\n    return {\n      compatible: true,\n      reason: \"loopback\",\n      requestHost,\n      authHost,\n      expectedGatewayHost,\n    };\n  }\n\n  if (!isSecureTransportProtocol(requestUrl.protocol)) {\n    return {\n      compatible: false,\n      reason: \"insecure_transport\",\n      requestHost,\n      authHost,\n      expectedGatewayHost,\n    };\n  }\n\n  if (requestHost === authHost) {\n    return {\n      compatible: true,\n      reason: \"same_host\",\n      requestHost,\n      authHost,\n      expectedGatewayHost,\n    };\n  }\n\n  if (expectedGatewayHost && requestHost === expectedGatewayHost) {\n    return {\n      compatible: true,\n      reason: \"gateway_sibling\",\n      requestHost,\n      authHost,\n      expectedGatewayHost,\n    };\n  }\n\n  return {\n    compatible: false,\n    reason: \"host_mismatch\",\n    requestHost,\n    authHost,\n    expectedGatewayHost,\n  };\n}\n\nexport function deriveAuthBaseUrlFromGatewayUrl(\n  gatewayUrl: string\n): string | null {\n  const parsed = parseUrlOrNull(gatewayUrl);\n  if (!parsed) {\n    return null;\n  }\n  if (!isHttpTransportProtocol(parsed.protocol)) {\n    return null;\n  }\n  if (!parsed.hostname.startsWith(\"gateway.\")) {\n    return null;\n  }\n\n  const authUrl = new URL(parsed.toString());\n  authUrl.hostname = `auth.${parsed.hostname.slice(\"gateway.\".length)}`;\n  authUrl.pathname = \"/\";\n  authUrl.search = \"\";\n  authUrl.hash = \"\";\n  return normalizeBaseUrl(authUrl.toString());\n}\n\nfunction deriveGatewayHost(authBaseUrl: URL): string | null {\n  if (!authBaseUrl.hostname.startsWith(\"auth.\")) {\n    return null;\n  }\n\n  const gatewayUrl = new URL(authBaseUrl.toString());\n  gatewayUrl.hostname = `gateway.${authBaseUrl.hostname.slice(\"auth.\".length)}`;\n  return gatewayUrl.host;\n}\n\nfunction parseUrlOrNull(value: string): URL | null {\n  try {\n    return new URL(value);\n  } catch {\n    return null;\n  }\n}\n\nfunction isSecureTransportProtocol(protocol: string): boolean {\n  return protocol === \"https:\" || protocol === \"wss:\";\n}\n\nfunction isHttpTransportProtocol(protocol: string): boolean {\n  return protocol === \"http:\" || protocol === \"https:\";\n}\n","import crypto from \"node:crypto\";\nimport type { OpenMeldRequestContext } from \"@openmeld/schemas/types\";\nimport type { OpenMeldProfile } from \"./openmeld-profiles-api\";\n\nexport type OpenMeldRequestContextProfileIdentity = {\n  openMeldProfileId: string;\n  profileKind?: \"human\" | \"agent\" | \"system\";\n  kind?: \"human\" | \"agent\";\n  profileHandle?: string;\n  profileName: string;\n  ownerUserId?: string;\n  ownerName?: string;\n  agentControllerConversationId?: string;\n};\n\nexport function buildOpenMeldRequestContextFromProfile(input: {\n  openMeldProfile: OpenMeldProfile;\n  requestId?: string;\n  agentControllerConversationId?: string;\n}): OpenMeldRequestContext {\n  const requestId =\n    normalizeOptionalText(input.requestId) ?? crypto.randomUUID();\n  const agentControllerConversationId = normalizeOptionalText(\n    input.agentControllerConversationId\n  );\n  const ownerName = normalizeOptionalText(input.openMeldProfile.ownerName);\n\n  return {\n    actorContext: {\n      requestId,\n      openMeldProfileId: input.openMeldProfile.openMeldProfileId,\n      profileKind: input.openMeldProfile.profileKind,\n      profileHandle: input.openMeldProfile.profileHandle,\n      profileName: input.openMeldProfile.profileName,\n      ownerUserId: input.openMeldProfile.ownerUserId,\n      ...(ownerName ? { ownerName } : {}),\n    },\n    ...(agentControllerConversationId ? { agentControllerConversationId } : {}),\n  };\n}\n\nexport function buildOpenMeldRequestContextFromProfileIdentity(input: {\n  profileIdentity: OpenMeldRequestContextProfileIdentity;\n  requestId?: string;\n}): OpenMeldRequestContext {\n  const requestId =\n    normalizeOptionalText(input.requestId) ?? crypto.randomUUID();\n  const profileHandle = normalizeOptionalText(\n    input.profileIdentity.profileHandle\n  );\n  const ownerUserId = normalizeOptionalText(input.profileIdentity.ownerUserId);\n  const ownerName = normalizeOptionalText(input.profileIdentity.ownerName);\n  const agentControllerConversationId = normalizeOptionalText(\n    input.profileIdentity.agentControllerConversationId\n  );\n  const profileKind =\n    input.profileIdentity.profileKind ??\n    (input.profileIdentity.kind === \"human\" ||\n    input.profileIdentity.kind === \"agent\"\n      ? input.profileIdentity.kind\n      : \"system\");\n\n  return {\n    actorContext: {\n      requestId,\n      openMeldProfileId: input.profileIdentity.openMeldProfileId,\n      profileKind,\n      ...(profileHandle ? { profileHandle } : {}),\n      profileName: input.profileIdentity.profileName,\n      ...(ownerUserId ? { ownerUserId } : {}),\n      ...(ownerName ? { ownerName } : {}),\n    },\n    ...(agentControllerConversationId ? { agentControllerConversationId } : {}),\n  };\n}\n\nfunction normalizeOptionalText(value: unknown): string | null {\n  const normalized = String(value ?? \"\").trim();\n  return normalized.length > 0 ? normalized : null;\n}\n","import { createHash } from \"node:crypto\";\nimport {\n  buildOpenMeldRequestContextHeaders,\n  type OpenMeldRequestContextHeadersInput,\n} from \"@openmeld/gateway-contract\";\nimport type { OpenMeldRequestContext } from \"@openmeld/schemas/types\";\nimport {\n  type AuthRequestCompatibilityReason,\n  resolveAuthRequestCompatibility,\n} from \"./auth-request-compatibility\";\nimport {\n  type AuthSessionStateReasonCode,\n  getAuthSessionState,\n  type StoredAuthSession,\n} from \"./auth-session\";\nimport { resolveAuthSessionExpiryEligibility } from \"./auth-session-expiry\";\nimport type { OpenMeldProfile } from \"./openmeld-profiles-api\";\nimport {\n  buildOpenMeldRequestContextFromProfile,\n  buildOpenMeldRequestContextFromProfileIdentity,\n  type OpenMeldRequestContextProfileIdentity,\n} from \"./openmeld-request-context\";\n\nconst DEFAULT_TOKEN_TYPE = \"Bearer\";\nconst AUTHORIZATION_HEADER = \"Authorization\";\n\n// Ephemeral correlation for the exact credential attached to a request/socket.\n// Never include this fingerprint in persisted or uploaded diagnostics.\nexport function fingerprintRequestAuthorization(authorization: string): string {\n  return createHash(\"sha256\").update(authorization).digest(\"hex\");\n}\n\ntype RequestAuthHeadersInput = {\n  authSession?: StoredAuthSession | null;\n  expectedOwnerUserId?: string;\n  requestUrl: string;\n};\n\ntype OpenMeldRequestContextHeadersWithAuthInput =\n  OpenMeldRequestContextHeadersInput & {\n    authSession?: StoredAuthSession | null;\n    requestUrl: string;\n  };\n\nexport type AuthTokenAttachment =\n  | {\n      status: \"attachable\";\n      token: string;\n      tokenType: string;\n    }\n  | {\n      status: \"dropped\";\n      reason:\n        | \"empty_token\"\n        | \"session_expired\"\n        | \"session_expiry_invalid\"\n        | AuthRequestCompatibilityReason;\n      requestHost: string | null;\n      authHost: string | null;\n      expectedGatewayHost: string | null;\n    };\n\nexport type DroppedAuthTokenAttachment = Extract<\n  AuthTokenAttachment,\n  { status: \"dropped\" }\n>;\n\nexport type AuthRequestCredentialFailureReason =\n  | DroppedAuthTokenAttachment[\"reason\"]\n  | AuthSessionStateReasonCode\n  | \"session_invalid\"\n  | \"session_revoked\";\n\nexport class AuthRequestCredentialError extends Error {\n  readonly retryAfterMs?: number;\n  readonly authHost: string | null;\n  readonly expectedGatewayHost: string | null;\n  readonly reason: AuthRequestCredentialFailureReason;\n  readonly requestHost: string | null;\n  readonly droppedAttachment?: DroppedAuthTokenAttachment;\n\n  constructor(input: {\n    retryAfterMs?: number;\n    authHost: string | null;\n    expectedGatewayHost: string | null;\n    reason: AuthRequestCredentialFailureReason;\n    requestHost: string | null;\n    droppedAttachment?: DroppedAuthTokenAttachment;\n  }) {\n    super(\n      `OpenMeld refused to send a request with unusable stored credentials (${input.reason}).`\n    );\n    this.name = \"AuthRequestCredentialError\";\n    this.authHost = input.authHost;\n    this.expectedGatewayHost = input.expectedGatewayHost;\n    this.reason = input.reason;\n    this.requestHost = input.requestHost;\n    this.droppedAttachment = input.droppedAttachment;\n    this.retryAfterMs = input.retryAfterMs;\n  }\n}\n\nexport async function buildRequestAuthHeaders(\n  input: RequestAuthHeadersInput\n): Promise<Record<string, string>> {\n  const headers: Record<string, string> = {};\n  await attachAuthHeader(headers, input);\n  return headers;\n}\n\nexport async function buildOpenMeldRequestContextHeadersWithAuth(\n  input: OpenMeldRequestContextHeadersWithAuthInput\n): Promise<Record<string, string>> {\n  const headers = buildOpenMeldRequestContextHeaders(input);\n  await attachAuthHeader(headers, input);\n  return headers;\n}\n\nexport async function buildOpenMeldProfileRequestHeadersWithAuth(input: {\n  openMeldProfile: OpenMeldProfile;\n  requestUrl: string;\n  authSession?: StoredAuthSession | null;\n  agentControllerConversationId?: string;\n  spacePassword?: string;\n}): Promise<Record<string, string>> {\n  return await buildOpenMeldRequestContextHeadersWithAuth({\n    requestContext: buildOpenMeldRequestContextFromProfile({\n      openMeldProfile: input.openMeldProfile,\n      agentControllerConversationId: input.agentControllerConversationId,\n    }),\n    requestUrl: input.requestUrl,\n    ...(input.authSession === undefined\n      ? {}\n      : { authSession: input.authSession }),\n    ...(input.spacePassword === undefined\n      ? {}\n      : { spacePassword: input.spacePassword }),\n  });\n}\n\nexport async function buildOpenMeldProfileIdentityRequestHeadersWithAuth(input: {\n  profileIdentity: OpenMeldRequestContextProfileIdentity;\n  requestUrl: string;\n  authSession?: StoredAuthSession | null;\n  spacePassword?: string;\n}): Promise<Record<string, string>> {\n  return await buildOpenMeldRequestContextHeadersWithAuth({\n    requestContext: buildOpenMeldRequestContextFromProfileIdentity({\n      profileIdentity: input.profileIdentity,\n    }),\n    requestUrl: input.requestUrl,\n    ...(input.authSession === undefined\n      ? {}\n      : { authSession: input.authSession }),\n    ...(input.spacePassword === undefined\n      ? {}\n      : { spacePassword: input.spacePassword }),\n  });\n}\n\nexport function withSpacePassword(\n  requestContext: OpenMeldRequestContext,\n  spacePassword?: string\n): OpenMeldRequestContextHeadersInput {\n  return {\n    requestContext,\n    ...(spacePassword === undefined ? {} : { spacePassword }),\n  };\n}\n\n// One decision for \"can this stored session authenticate this request\", with\n// the drop reason preserved. Header building and the daemon stream connect\n// gate must share this so they cannot drift apart.\nexport function resolveAuthTokenAttachment(input: {\n  session: StoredAuthSession;\n  requestUrl: string;\n}): AuthTokenAttachment {\n  const compatibility = resolveAuthRequestCompatibility({\n    session: input.session,\n    requestUrl: input.requestUrl,\n  });\n  const token = normalizeAccessToken(input.session);\n  if (!token) {\n    return {\n      status: \"dropped\",\n      reason: \"empty_token\",\n      requestHost: compatibility.requestHost,\n      authHost: compatibility.authHost,\n      expectedGatewayHost: compatibility.expectedGatewayHost,\n    };\n  }\n  if (!compatibility.compatible) {\n    return {\n      status: \"dropped\",\n      reason: compatibility.reason,\n      requestHost: compatibility.requestHost,\n      authHost: compatibility.authHost,\n      expectedGatewayHost: compatibility.expectedGatewayHost,\n    };\n  }\n  const expiryReason = resolveSessionExpiryReason(input.session);\n  if (expiryReason) {\n    return {\n      status: \"dropped\",\n      reason: expiryReason,\n      requestHost: compatibility.requestHost,\n      authHost: compatibility.authHost,\n      expectedGatewayHost: compatibility.expectedGatewayHost,\n    };\n  }\n  return {\n    status: \"attachable\",\n    token,\n    tokenType: normalizeTokenType(input.session.tokenType),\n  };\n}\n\nexport function requireAuthTokenAttachment(input: {\n  session: StoredAuthSession;\n  requestUrl: string;\n}): Extract<AuthTokenAttachment, { status: \"attachable\" }> {\n  const attachment = resolveAuthTokenAttachment(input);\n  if (attachment.status === \"dropped\") {\n    throw createAuthRequestCredentialError(attachment);\n  }\n  return attachment;\n}\n\nasync function attachAuthHeader(\n  headers: Record<string, string>,\n  input: RequestAuthHeadersInput\n): Promise<void> {\n  const session = await resolveAuthSessionForHeaders(input);\n  if (\n    input.expectedOwnerUserId &&\n    session?.user?.id !== input.expectedOwnerUserId\n  ) {\n    throw new Error(\"auth.session_owner_changed\");\n  }\n  if (session === null) {\n    // No stored credentials exist, so there is nothing to strip: the caller\n    // is knowingly sending an unauthenticated request.\n    return;\n  }\n\n  let attachment: Extract<AuthTokenAttachment, { status: \"attachable\" }>;\n  try {\n    attachment = requireAuthTokenAttachment({\n      session,\n      requestUrl: input.requestUrl,\n    });\n  } catch (error) {\n    if (error instanceof AuthRequestCredentialError) {\n      logRejectedAuthRequestCredential(error);\n    }\n    throw error;\n  }\n  headers[AUTHORIZATION_HEADER] = `${attachment.tokenType} ${attachment.token}`;\n}\n\nfunction logRejectedAuthRequestCredential(\n  error: AuthRequestCredentialError\n): void {\n  console.error(\"[openmeld.auth.request_credential_rejected]\", {\n    authHost: error.authHost,\n    expectedGatewayHost: error.expectedGatewayHost,\n    reason: error.reason,\n    requestHost: error.requestHost,\n  });\n}\n\nasync function resolveAuthSessionForHeaders(\n  input: RequestAuthHeadersInput\n): Promise<StoredAuthSession | null> {\n  if (input.authSession !== undefined) {\n    return input.authSession;\n  }\n\n  const sessionState = await getAuthSessionState({ refreshExpired: true });\n  if (sessionState.state === \"missing\") {\n    return null;\n  }\n  if (sessionState.state !== \"valid\" || sessionState.session === null) {\n    const error = new AuthRequestCredentialError({\n      retryAfterMs: sessionState.retryAfterMs,\n      authHost: null,\n      expectedGatewayHost: null,\n      reason:\n        sessionState.reasonCode ??\n        (sessionState.state === \"revoked\"\n          ? \"session_revoked\"\n          : \"session_invalid\"),\n      requestHost: parseRequestHost(input.requestUrl),\n    });\n    logRejectedAuthRequestCredential(error);\n    throw error;\n  }\n\n  return sessionState.session;\n}\n\nfunction createAuthRequestCredentialError(\n  attachment: DroppedAuthTokenAttachment\n): AuthRequestCredentialError {\n  return new AuthRequestCredentialError({\n    authHost: attachment.authHost,\n    expectedGatewayHost: attachment.expectedGatewayHost,\n    reason: attachment.reason,\n    requestHost: attachment.requestHost,\n    droppedAttachment: attachment,\n  });\n}\n\nfunction parseRequestHost(requestUrl: string): string | null {\n  try {\n    return new URL(requestUrl).host || null;\n  } catch {\n    return null;\n  }\n}\n\nfunction normalizeAccessToken(session: StoredAuthSession): string {\n  return String(session.accessToken ?? \"\").trim();\n}\n\nfunction normalizeTokenType(tokenType: string | undefined): string {\n  const normalized = String(tokenType ?? \"\").trim();\n  return normalized.length > 0 ? normalized : DEFAULT_TOKEN_TYPE;\n}\n\nfunction resolveSessionExpiryReason(\n  session: StoredAuthSession\n): \"session_expired\" | \"session_expiry_invalid\" | null {\n  const eligibility = resolveAuthSessionExpiryEligibility(session.expiresAt);\n  if (eligibility.status === \"invalid\") {\n    return \"session_expiry_invalid\";\n  }\n  return eligibility.status === \"expired\" ? \"session_expired\" : null;\n}\n\nexport function canAttachAuthTokenToRequest(\n  session: StoredAuthSession,\n  requestUrl: string\n): boolean {\n  return (\n    resolveAuthTokenAttachment({\n      session,\n      requestUrl,\n    }).status === \"attachable\"\n  );\n}\n","import {\n  DEFAULT_SPACE_CONVERSATION_VALIDATE_TIMEOUT_MS,\n  DEFAULT_SPACE_REQUEST_TIMEOUT_MS,\n  MAX_SPACE_REQUEST_TIMEOUT_MS,\n  MIN_SPACE_REQUEST_TIMEOUT_MS,\n} from \"../strategy-constants\";\n\nconst SPACE_REQUEST_TIMEOUT_ENV_KEY = \"OPENMELD_SPACE_REQUEST_TIMEOUT_MS\";\n\nexport function resolveSpaceRequestTimeoutMs(override?: number): number {\n  if (isFinitePositiveNumber(override)) {\n    return clampSpaceRequestTimeoutMs(override);\n  }\n\n  const fromEnv = Number.parseInt(\n    String(process.env[SPACE_REQUEST_TIMEOUT_ENV_KEY] ?? \"\"),\n    10\n  );\n  if (isFinitePositiveNumber(fromEnv)) {\n    return clampSpaceRequestTimeoutMs(fromEnv);\n  }\n\n  return DEFAULT_SPACE_REQUEST_TIMEOUT_MS;\n}\n\nexport function resolveSpaceRequestTimeoutMsForDiagnostics(): number {\n  return resolveSpaceRequestTimeoutMs(undefined);\n}\n\nexport function resolveSpaceConversationValidateTimeoutMs(): number {\n  return Math.max(\n    resolveSpaceRequestTimeoutMs(undefined),\n    DEFAULT_SPACE_CONVERSATION_VALIDATE_TIMEOUT_MS\n  );\n}\n\nfunction clampSpaceRequestTimeoutMs(value: number): number {\n  const normalized = Math.trunc(value);\n  return Math.max(\n    MIN_SPACE_REQUEST_TIMEOUT_MS,\n    Math.min(MAX_SPACE_REQUEST_TIMEOUT_MS, normalized)\n  );\n}\n\nfunction isFinitePositiveNumber(value: unknown): value is number {\n  return typeof value === \"number\" && Number.isFinite(value) && value > 0;\n}\n","import {\n  resolveSpaceRequestTimeoutMs,\n  resolveSpaceRequestTimeoutMsForDiagnostics as resolveSpaceRequestTimeoutMsForCliDiagnostics,\n} from \"./request-timeout\";\n\nexport async function fetchSpaceRequestWithTimeout(input: {\n  url: string;\n  operation: string;\n  init?: RequestInit;\n  timeoutMs?: number;\n}): Promise<Response> {\n  const timeoutMs = resolveSpaceRequestTimeoutMs(input.timeoutMs);\n  const timeoutSignal = AbortSignal.timeout(timeoutMs);\n  const composed = composeAbortSignals(input.init?.signal, timeoutSignal);\n\n  try {\n    try {\n      return await fetch(input.url, {\n        ...input.init,\n        signal: composed.signal,\n      });\n    } catch (error) {\n      // A keep-alive connection that a proxy silently dropped fails exactly\n      // once and undici evicts it; the retry rides a fresh connection. This\n      // is what keeps a long-lived service working behind flaky proxies\n      // without asking users to touch their network config.\n      if (\n        timeoutSignal.aborted ||\n        composed.signal.aborted ||\n        !shouldWrapNetworkRequestError(error)\n      ) {\n        throw error;\n      }\n      return await fetch(input.url, {\n        ...input.init,\n        signal: composed.signal,\n      });\n    }\n  } catch (error) {\n    if (timeoutSignal.aborted) {\n      throw createSpaceRequestTimeoutError({\n        operation: input.operation,\n        timeoutMs,\n        cause: error,\n      });\n    }\n    if (shouldWrapNetworkRequestError(error)) {\n      throw createSpaceRequestNetworkError({\n        operation: input.operation,\n        url: input.url,\n        cause: error,\n      });\n    }\n    throw error;\n  } finally {\n    composed.cleanup();\n  }\n}\n\nexport function resolveSpaceRequestTimeoutMsForDiagnostics(): number {\n  return resolveSpaceRequestTimeoutMsForCliDiagnostics();\n}\n\nfunction createSpaceRequestTimeoutError(input: {\n  operation: string;\n  timeoutMs: number;\n  cause: unknown;\n}): Error {\n  const error = new Error(\n    `${input.operation} request timed out after ${input.timeoutMs}ms`,\n    { cause: input.cause }\n  ) as Error & { code?: string };\n  error.code = \"network.timeout\";\n  return error;\n}\n\nfunction createSpaceRequestNetworkError(input: {\n  operation: string;\n  url: string;\n  cause: unknown;\n}): Error {\n  const error = new Error(\n    `${input.operation} request could not reach ${describeRequestTarget(input.url)} (${toErrorMessage(input.cause)})`,\n    { cause: input.cause }\n  ) as Error & { code?: string };\n  error.code = \"network.request_failed\";\n  return error;\n}\n\nfunction composeAbortSignals(\n  parent: AbortSignal | null | undefined,\n  timeout: AbortSignal\n): { signal: AbortSignal; cleanup: () => void } {\n  if (!parent) {\n    return {\n      signal: timeout,\n      cleanup: () => undefined,\n    };\n  }\n\n  if (parent.aborted || timeout.aborted) {\n    const controller = new AbortController();\n    controller.abort();\n    return {\n      signal: controller.signal,\n      cleanup: () => undefined,\n    };\n  }\n\n  const controller = new AbortController();\n  const abort = () => {\n    controller.abort();\n  };\n\n  parent.addEventListener(\"abort\", abort, { once: true });\n  timeout.addEventListener(\"abort\", abort, { once: true });\n\n  return {\n    signal: controller.signal,\n    cleanup: () => {\n      parent.removeEventListener(\"abort\", abort);\n      timeout.removeEventListener(\"abort\", abort);\n    },\n  };\n}\n\nfunction describeRequestTarget(url: string): string {\n  try {\n    return new URL(url).origin;\n  } catch {\n    return url;\n  }\n}\n\nfunction toErrorMessage(error: unknown): string {\n  if (error instanceof Error) {\n    const message = error.message.trim();\n    return message.length > 0 ? message : \"request failed\";\n  }\n  const message = String(error ?? \"\").trim();\n  return message.length > 0 ? message : \"request failed\";\n}\n\nfunction shouldWrapNetworkRequestError(error: unknown): boolean {\n  if (error instanceof TypeError) {\n    return true;\n  }\n  if (\n    typeof error === \"object\" &&\n    error !== null &&\n    \"code\" in error &&\n    typeof error.code === \"string\" &&\n    error.code.startsWith(\"ERR_SSL_\")\n  ) {\n    return true;\n  }\n  const message = toErrorMessage(error).toLowerCase();\n  return (\n    message.includes(\"fetch failed\") ||\n    message.includes(\"failed to fetch\") ||\n    message.includes(\"network request failed\") ||\n    message.includes(\"ssl_decryption_failed_or_bad_record_mac\")\n  );\n}\n","import {\n  createOpenMeldApiClient,\n  type OpenMeldApiClientFoundation,\n} from \"@openmeld/api-client\";\nimport {\n  buildOpenMeldRequestContextHeaders,\n  OPENMELD_HEADER_REQUESTED_ORGANIZATION_ID,\n} from \"@openmeld/gateway-contract\";\nimport { buildRequestAuthHeaders } from \"../config/request-headers\";\nimport { fetchSpaceRequestWithTimeout } from \"./fetch-with-timeout\";\n\nexport function createCliApiClientFoundation(\n  baseUrl: string,\n  options: {\n    onAuthHeadersResolved?: (headers: Record<string, string>) => void;\n    organizationId?: string;\n    expectedOwnerUserId?: string;\n  } = {}\n): OpenMeldApiClientFoundation {\n  return createOpenMeldApiClient({\n    baseUrl,\n    transport: async (request) =>\n      await fetchSpaceRequestWithTimeout({\n        url: request.url,\n        operation: request.operation,\n        init: request.init,\n        timeoutMs: request.timeoutMs,\n      }),\n    getAuthHeaders: async ({ requestUrl }) => {\n      const headers = await buildRequestAuthHeaders({\n        requestUrl,\n        expectedOwnerUserId: options.expectedOwnerUserId,\n      });\n      if (options.organizationId) {\n        headers[OPENMELD_HEADER_REQUESTED_ORGANIZATION_ID] =\n          options.organizationId;\n      }\n      options.onAuthHeadersResolved?.(headers);\n      return headers;\n    },\n    getRequestContextHeaders: async ({ requestContext, spacePassword }) =>\n      buildOpenMeldRequestContextHeaders({\n        requestContext,\n        ...(spacePassword === undefined ? {} : { spacePassword }),\n      }),\n  });\n}\n"],"mappings":";;;;;;;;AAqBA,SAAgB,gCAAgC,OAGnB;CAC3B,MAAM,aAAa,eAAe,MAAM,UAAU;CAClD,IAAI,CAAC,YACH,OAAO;EACL,YAAY;EACZ,QAAQ;EACR,aAAa;EACb,UAAU;EACV,qBAAqB;CACvB;CAGF,MAAM,cAAc,eAAe,MAAM,QAAQ,WAAW;CAC5D,IAAI,CAAC,aACH,OAAO;EACL,YAAY;EACZ,QAAQ;EACR,aAAa,WAAW;EACxB,UAAU;EACV,qBAAqB;CACvB;CAGF,MAAM,sBAAsB,kBAAkB,WAAW;CACzD,MAAM,cAAc,WAAW;CAC/B,MAAM,WAAW,YAAY;CAE7B,IACG,mBAAmB,WAAW,QAAQ,KACrC,mBAAmB,YAAY,QAAQ,KAGxC,WAAW,SAAS,SAAS,YAAY,KACxC,WAAW,aAAa,YAAY,YACpC,wBAAwB,YAAY,QAAQ,KAC5C;EAAC;EAAS;EAAU;EAAO;CAAM,CAAC,CAAC,SAAS,WAAW,QAAQ,GAEjE,OAAO;EACL,YAAY;EACZ,QAAQ;EACR;EACA;EACA;CACF;CAGF,IAAI,CAAC,0BAA0B,WAAW,QAAQ,GAChD,OAAO;EACL,YAAY;EACZ,QAAQ;EACR;EACA;EACA;CACF;CAGF,IAAI,gBAAgB,UAClB,OAAO;EACL,YAAY;EACZ,QAAQ;EACR;EACA;EACA;CACF;CAGF,IAAI,uBAAuB,gBAAgB,qBACzC,OAAO;EACL,YAAY;EACZ,QAAQ;EACR;EACA;EACA;CACF;CAGF,OAAO;EACL,YAAY;EACZ,QAAQ;EACR;EACA;EACA;CACF;AACF;AAEA,SAAgB,gCACd,YACe;CACf,MAAM,SAAS,eAAe,UAAU;CACxC,IAAI,CAAC,QACH,OAAO;CAET,IAAI,CAAC,wBAAwB,OAAO,QAAQ,GAC1C,OAAO;CAET,IAAI,CAAC,OAAO,SAAS,WAAW,UAAU,GACxC,OAAO;CAGT,MAAM,UAAU,IAAI,IAAI,OAAO,SAAS,CAAC;CACzC,QAAQ,WAAW,QAAQ,OAAO,SAAS,MAAM,CAAiB;CAClE,QAAQ,WAAW;CACnB,QAAQ,SAAS;CACjB,QAAQ,OAAO;CACf,OAAO,iBAAiB,QAAQ,SAAS,CAAC;AAC5C;AAEA,SAAS,kBAAkB,aAAiC;CAC1D,IAAI,CAAC,YAAY,SAAS,WAAW,OAAO,GAC1C,OAAO;CAGT,MAAM,aAAa,IAAI,IAAI,YAAY,SAAS,CAAC;CACjD,WAAW,WAAW,WAAW,YAAY,SAAS,MAAM,CAAc;CAC1E,OAAO,WAAW;AACpB;AAEA,SAAS,eAAe,OAA2B;CACjD,IAAI;EACF,OAAO,IAAI,IAAI,KAAK;CACtB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,0BAA0B,UAA2B;CAC5D,OAAO,aAAa,YAAY,aAAa;AAC/C;AAEA,SAAS,wBAAwB,UAA2B;CAC1D,OAAO,aAAa,WAAW,aAAa;AAC9C;;;AC5IA,SAAgB,uCAAuC,OAI5B;CACzB,MAAM,YACJ,sBAAsB,MAAM,SAAS,KAAK,OAAO,WAAW;CAC9D,MAAM,gCAAgC,sBACpC,MAAM,6BACR;CACA,MAAM,YAAY,sBAAsB,MAAM,gBAAgB,SAAS;CAEvE,OAAO;EACL,cAAc;GACZ;GACA,mBAAmB,MAAM,gBAAgB;GACzC,aAAa,MAAM,gBAAgB;GACnC,eAAe,MAAM,gBAAgB;GACrC,aAAa,MAAM,gBAAgB;GACnC,aAAa,MAAM,gBAAgB;GACnC,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;EACnC;EACA,GAAI,gCAAgC,EAAE,8BAA8B,IAAI,CAAC;CAC3E;AACF;AAEA,SAAgB,+CAA+C,OAGpC;CACzB,MAAM,YACJ,sBAAsB,MAAM,SAAS,KAAK,OAAO,WAAW;CAC9D,MAAM,gBAAgB,sBACpB,MAAM,gBAAgB,aACxB;CACA,MAAM,cAAc,sBAAsB,MAAM,gBAAgB,WAAW;CAC3E,MAAM,YAAY,sBAAsB,MAAM,gBAAgB,SAAS;CACvE,MAAM,gCAAgC,sBACpC,MAAM,gBAAgB,6BACxB;CACA,MAAM,cACJ,MAAM,gBAAgB,gBACrB,MAAM,gBAAgB,SAAS,WAChC,MAAM,gBAAgB,SAAS,UAC3B,MAAM,gBAAgB,OACtB;CAEN,OAAO;EACL,cAAc;GACZ;GACA,mBAAmB,MAAM,gBAAgB;GACzC;GACA,GAAI,gBAAgB,EAAE,cAAc,IAAI,CAAC;GACzC,aAAa,MAAM,gBAAgB;GACnC,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;GACrC,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;EACnC;EACA,GAAI,gCAAgC,EAAE,8BAA8B,IAAI,CAAC;CAC3E;AACF;AAEA,SAAS,sBAAsB,OAA+B;CAC5D,MAAM,aAAa,OAAO,SAAS,EAAE,CAAC,CAAC,KAAK;CAC5C,OAAO,WAAW,SAAS,IAAI,aAAa;AAC9C;;;ACxDA,MAAM,qBAAqB;AAC3B,MAAM,uBAAuB;AAI7B,SAAgB,gCAAgC,eAA+B;CAC7E,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,aAAa,CAAC,CAAC,OAAO,KAAK;AAChE;AA2CA,IAAa,6BAAb,cAAgD,MAAM;CACpD;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,OAOT;EACD,MACE,wEAAwE,MAAM,OAAO,GACvF;EACA,KAAK,OAAO;EACZ,KAAK,WAAW,MAAM;EACtB,KAAK,sBAAsB,MAAM;EACjC,KAAK,SAAS,MAAM;EACpB,KAAK,cAAc,MAAM;EACzB,KAAK,oBAAoB,MAAM;EAC/B,KAAK,eAAe,MAAM;CAC5B;AACF;AAEA,eAAsB,wBACpB,OACiC;CACjC,MAAM,UAAkC,CAAC;CACzC,MAAM,iBAAiB,SAAS,KAAK;CACrC,OAAO;AACT;AAEA,eAAsB,2CACpB,OACiC;CACjC,MAAM,UAAU,mCAAmC,KAAK;CACxD,MAAM,iBAAiB,SAAS,KAAK;CACrC,OAAO;AACT;AAEA,eAAsB,2CAA2C,OAM7B;CAClC,OAAO,MAAM,2CAA2C;EACtD,gBAAgB,uCAAuC;GACrD,iBAAiB,MAAM;GACvB,+BAA+B,MAAM;EACvC,CAAC;EACD,YAAY,MAAM;EAClB,GAAI,MAAM,gBAAgB,KAAA,IACtB,CAAC,IACD,EAAE,aAAa,MAAM,YAAY;EACrC,GAAI,MAAM,kBAAkB,KAAA,IACxB,CAAC,IACD,EAAE,eAAe,MAAM,cAAc;CAC3C,CAAC;AACH;AAEA,eAAsB,mDAAmD,OAKrC;CAClC,OAAO,MAAM,2CAA2C;EACtD,gBAAgB,+CAA+C,EAC7D,iBAAiB,MAAM,gBACzB,CAAC;EACD,YAAY,MAAM;EAClB,GAAI,MAAM,gBAAgB,KAAA,IACtB,CAAC,IACD,EAAE,aAAa,MAAM,YAAY;EACrC,GAAI,MAAM,kBAAkB,KAAA,IACxB,CAAC,IACD,EAAE,eAAe,MAAM,cAAc;CAC3C,CAAC;AACH;AAeA,SAAgB,2BAA2B,OAGnB;CACtB,MAAM,gBAAgB,gCAAgC;EACpD,SAAS,MAAM;EACf,YAAY,MAAM;CACpB,CAAC;CACD,MAAM,QAAQ,qBAAqB,MAAM,OAAO;CAChD,IAAI,CAAC,OACH,OAAO;EACL,QAAQ;EACR,QAAQ;EACR,aAAa,cAAc;EAC3B,UAAU,cAAc;EACxB,qBAAqB,cAAc;CACrC;CAEF,IAAI,CAAC,cAAc,YACjB,OAAO;EACL,QAAQ;EACR,QAAQ,cAAc;EACtB,aAAa,cAAc;EAC3B,UAAU,cAAc;EACxB,qBAAqB,cAAc;CACrC;CAEF,MAAM,eAAe,2BAA2B,MAAM,OAAO;CAC7D,IAAI,cACF,OAAO;EACL,QAAQ;EACR,QAAQ;EACR,aAAa,cAAc;EAC3B,UAAU,cAAc;EACxB,qBAAqB,cAAc;CACrC;CAEF,OAAO;EACL,QAAQ;EACR;EACA,WAAW,mBAAmB,MAAM,QAAQ,SAAS;CACvD;AACF;AAEA,SAAgB,2BAA2B,OAGgB;CACzD,MAAM,aAAa,2BAA2B,KAAK;CACnD,IAAI,WAAW,WAAW,WACxB,MAAM,iCAAiC,UAAU;CAEnD,OAAO;AACT;AAEA,eAAe,iBACb,SACA,OACe;CACf,MAAM,UAAU,MAAM,6BAA6B,KAAK;CACxD,IACE,MAAM,uBACN,SAAS,MAAM,OAAO,MAAM,qBAE5B,MAAM,IAAI,MAAM,4BAA4B;CAE9C,IAAI,YAAY,MAGd;CAGF,IAAI;CACJ,IAAI;EACF,aAAa,2BAA2B;GACtC;GACA,YAAY,MAAM;EACpB,CAAC;CACH,SAAS,OAAO;EACd,IAAI,iBAAiB,4BACnB,iCAAiC,KAAK;EAExC,MAAM;CACR;CACA,QAAQ,wBAAwB,GAAG,WAAW,UAAU,GAAG,WAAW;AACxE;AAEA,SAAS,iCACP,OACM;CACN,QAAQ,MAAM,+CAA+C;EAC3D,UAAU,MAAM;EAChB,qBAAqB,MAAM;EAC3B,QAAQ,MAAM;EACd,aAAa,MAAM;CACrB,CAAC;AACH;AAEA,eAAe,6BACb,OACmC;CACnC,IAAI,MAAM,gBAAgB,KAAA,GACxB,OAAO,MAAM;CAGf,MAAM,eAAe,MAAM,oBAAoB,EAAE,gBAAgB,KAAK,CAAC;CACvE,IAAI,aAAa,UAAU,WACzB,OAAO;CAET,IAAI,aAAa,UAAU,WAAW,aAAa,YAAY,MAAM;EACnE,MAAM,QAAQ,IAAI,2BAA2B;GAC3C,cAAc,aAAa;GAC3B,UAAU;GACV,qBAAqB;GACrB,QACE,aAAa,eACZ,aAAa,UAAU,YACpB,oBACA;GACN,aAAa,iBAAiB,MAAM,UAAU;EAChD,CAAC;EACD,iCAAiC,KAAK;EACtC,MAAM;CACR;CAEA,OAAO,aAAa;AACtB;AAEA,SAAS,iCACP,YAC4B;CAC5B,OAAO,IAAI,2BAA2B;EACpC,UAAU,WAAW;EACrB,qBAAqB,WAAW;EAChC,QAAQ,WAAW;EACnB,aAAa,WAAW;EACxB,mBAAmB;CACrB,CAAC;AACH;AAEA,SAAS,iBAAiB,YAAmC;CAC3D,IAAI;EACF,OAAO,IAAI,IAAI,UAAU,CAAC,CAAC,QAAQ;CACrC,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,qBAAqB,SAAoC;CAChE,OAAO,OAAO,QAAQ,eAAe,EAAE,CAAC,CAAC,KAAK;AAChD;AAEA,SAAS,mBAAmB,WAAuC;CACjE,MAAM,aAAa,OAAO,aAAa,EAAE,CAAC,CAAC,KAAK;CAChD,OAAO,WAAW,SAAS,IAAI,aAAa;AAC9C;AAEA,SAAS,2BACP,SACqD;CACrD,MAAM,cAAc,oCAAoC,QAAQ,SAAS;CACzE,IAAI,YAAY,WAAW,WACzB,OAAO;CAET,OAAO,YAAY,WAAW,YAAY,oBAAoB;AAChE;AAEA,SAAgB,4BACd,SACA,YACS;CACT,OACE,2BAA2B;EACzB;EACA;CACF,CAAC,CAAC,CAAC,WAAW;AAElB;;;ACvVA,MAAM,gCAAgC;AAEtC,SAAgB,6BAA6B,UAA2B;CACtE,IAAI,uBAAuB,QAAQ,GACjC,OAAO,2BAA2B,QAAQ;CAG5C,MAAM,UAAU,OAAO,SACrB,OAAO,QAAQ,IAAI,kCAAkC,EAAE,GACvD,EACF;CACA,IAAI,uBAAuB,OAAO,GAChC,OAAO,2BAA2B,OAAO;CAG3C,OAAO;AACT;AAEA,SAAgBA,+CAAqD;CACnE,OAAO,6BAA6B,KAAA,CAAS;AAC/C;AASA,SAAS,2BAA2B,OAAuB;CAEzD,OAAO,KAAK,IACV,8BACA,KAAK,IAAI,8BAHQ,KAAK,MAAM,KAGoB,CAAC,CACnD;AACF;AAEA,SAAS,uBAAuB,OAAiC;CAC/D,OAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,KAAK,QAAQ;AACxE;;;ACzCA,eAAsB,6BAA6B,OAK7B;CACpB,MAAM,YAAY,6BAA6B,MAAM,SAAS;CAC9D,MAAM,gBAAgB,YAAY,QAAQ,SAAS;CACnD,MAAM,WAAW,oBAAoB,MAAM,MAAM,QAAQ,aAAa;CAEtE,IAAI;EACF,IAAI;GACF,OAAO,MAAM,MAAM,MAAM,KAAK;IAC5B,GAAG,MAAM;IACT,QAAQ,SAAS;GACnB,CAAC;EACH,SAAS,OAAO;GAKd,IACE,cAAc,WACd,SAAS,OAAO,WAChB,CAAC,8BAA8B,KAAK,GAEpC,MAAM;GAER,OAAO,MAAM,MAAM,MAAM,KAAK;IAC5B,GAAG,MAAM;IACT,QAAQ,SAAS;GACnB,CAAC;EACH;CACF,SAAS,OAAO;EACd,IAAI,cAAc,SAChB,MAAM,+BAA+B;GACnC,WAAW,MAAM;GACjB;GACA,OAAO;EACT,CAAC;EAEH,IAAI,8BAA8B,KAAK,GACrC,MAAM,+BAA+B;GACnC,WAAW,MAAM;GACjB,KAAK,MAAM;GACX,OAAO;EACT,CAAC;EAEH,MAAM;CACR,UAAU;EACR,SAAS,QAAQ;CACnB;AACF;AAEA,SAAgB,6CAAqD;CACnE,OAAOC,6CAA8C;AACvD;AAEA,SAAS,+BAA+B,OAI9B;CACR,MAAM,QAAQ,IAAI,MAChB,GAAG,MAAM,UAAU,2BAA2B,MAAM,UAAU,KAC9D,EAAE,OAAO,MAAM,MAAM,CACvB;CACA,MAAM,OAAO;CACb,OAAO;AACT;AAEA,SAAS,+BAA+B,OAI9B;CACR,MAAM,QAAQ,IAAI,MAChB,GAAG,MAAM,UAAU,2BAA2B,sBAAsB,MAAM,GAAG,EAAE,IAAI,eAAe,MAAM,KAAK,EAAE,IAC/G,EAAE,OAAO,MAAM,MAAM,CACvB;CACA,MAAM,OAAO;CACb,OAAO;AACT;AAEA,SAAS,oBACP,QACA,SAC8C;CAC9C,IAAI,CAAC,QACH,OAAO;EACL,QAAQ;EACR,eAAe,KAAA;CACjB;CAGF,IAAI,OAAO,WAAW,QAAQ,SAAS;EACrC,MAAM,aAAa,IAAI,gBAAgB;EACvC,WAAW,MAAM;EACjB,OAAO;GACL,QAAQ,WAAW;GACnB,eAAe,KAAA;EACjB;CACF;CAEA,MAAM,aAAa,IAAI,gBAAgB;CACvC,MAAM,cAAc;EAClB,WAAW,MAAM;CACnB;CAEA,OAAO,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;CACtD,QAAQ,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;CAEvD,OAAO;EACL,QAAQ,WAAW;EACnB,eAAe;GACb,OAAO,oBAAoB,SAAS,KAAK;GACzC,QAAQ,oBAAoB,SAAS,KAAK;EAC5C;CACF;AACF;AAEA,SAAS,sBAAsB,KAAqB;CAClD,IAAI;EACF,OAAO,IAAI,IAAI,GAAG,CAAC,CAAC;CACtB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,eAAe,OAAwB;CAC9C,IAAI,iBAAiB,OAAO;EAC1B,MAAM,UAAU,MAAM,QAAQ,KAAK;EACnC,OAAO,QAAQ,SAAS,IAAI,UAAU;CACxC;CACA,MAAM,UAAU,OAAO,SAAS,EAAE,CAAC,CAAC,KAAK;CACzC,OAAO,QAAQ,SAAS,IAAI,UAAU;AACxC;AAEA,SAAS,8BAA8B,OAAyB;CAC9D,IAAI,iBAAiB,WACnB,OAAO;CAET,IACE,OAAO,UAAU,YACjB,UAAU,QACV,UAAU,SACV,OAAO,MAAM,SAAS,YACtB,MAAM,KAAK,WAAW,UAAU,GAEhC,OAAO;CAET,MAAM,UAAU,eAAe,KAAK,CAAC,CAAC,YAAY;CAClD,OACE,QAAQ,SAAS,cAAc,KAC/B,QAAQ,SAAS,iBAAiB,KAClC,QAAQ,SAAS,wBAAwB,KACzC,QAAQ,SAAS,yCAAyC;AAE9D;;;ACxJA,SAAgB,6BACd,SACA,UAII,CAAC,GACwB;CAC7B,OAAO,wBAAwB;EAC7B;EACA,WAAW,OAAO,YAChB,MAAM,6BAA6B;GACjC,KAAK,QAAQ;GACb,WAAW,QAAQ;GACnB,MAAM,QAAQ;GACd,WAAW,QAAQ;EACrB,CAAC;EACH,gBAAgB,OAAO,EAAE,iBAAiB;GACxC,MAAM,UAAU,MAAM,wBAAwB;IAC5C;IACA,qBAAqB,QAAQ;GAC/B,CAAC;GACD,IAAI,QAAQ,gBACV,QAAQ,6CACN,QAAQ;GAEZ,QAAQ,wBAAwB,OAAO;GACvC,OAAO;EACT;EACA,0BAA0B,OAAO,EAAE,gBAAgB,oBACjD,mCAAmC;GACjC;GACA,GAAI,kBAAkB,KAAA,IAAY,CAAC,IAAI,EAAE,cAAc;EACzD,CAAC;CACL,CAAC;AACH"}

package/dist/auth-session-CUu-vOqn.js

@@ -1,4 +0,0 @@
-#!/usr/bin/env node
-
-import { u as getAuthSessionMetadata } from "./auth-session-CQBxmN9k.js";
-export { getAuthSessionMetadata };