openmeld 0.3.254 → 0.3.255

package/dist/{computer-connection-review-CcOpaXuG.js → computer-connection-review-CCjlShNF.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 
-import { UA as computerConnectionReviewSchema } from "./dist-BvGnlYhy.js";
-import { d as getAuthSessionState, o as buildStoredAuthSessionIdentity, u as getAuthSessionMetadata } from "./auth-session-C1QlGOT-.js";
-import { i as readDaemonServiceContract } from "./daemon-service-contract-Ab9x7DQh.js";
-import { n as resolveServiceAccountIdentity } from "./service-account-authorization-CmN8zEW6.js";
-import { t as readServiceControlCapabilities } from "./service-control-capabilities-0rXZMj_g.js";
+import { WA as computerConnectionReviewSchema } from "./dist-Bn5dP-sF.js";
+import { d as getAuthSessionState, o as buildStoredAuthSessionIdentity, u as getAuthSessionMetadata } from "./auth-session-BdAItAyB.js";
+import { i as readDaemonServiceContract } from "./daemon-service-contract-C-UUgJPA.js";
+import { n as resolveServiceAccountIdentity } from "./service-account-authorization-BCNKSqgz.js";
+import { t as readServiceControlCapabilities } from "./service-control-capabilities-yE6nD91T.js";
 //#region src/commands/computer-connection-review.ts
 /** Display evidence only. Auth and Service owners validate an existing connection. */
 async function readComputerConnectionReview() {
@@ -36,4 +36,4 @@ async function readComputerConnectionReview() {
 //#endregion
 export { readComputerConnectionReview };
 
-//# sourceMappingURL=computer-connection-review-CcOpaXuG.js.map
+//# sourceMappingURL=computer-connection-review-CCjlShNF.js.map

package/dist/{computer-connection-review-CcOpaXuG.js.map → computer-connection-review-CCjlShNF.js.map}

@@ -1 +1 @@
-{"version":3,"file":"computer-connection-review-CcOpaXuG.js","names":[],"sources":["../src/commands/computer-connection-review.ts"],"sourcesContent":["import { computerConnectionReviewSchema } from \"@openmeld/schemas\";\nimport {\n  buildStoredAuthSessionIdentity,\n  getAuthSessionMetadata,\n  getAuthSessionState,\n} from \"../config/auth-session\";\nimport { readDaemonServiceContract } from \"../config/daemon-service-contract\";\nimport { resolveServiceAccountIdentity } from \"../local-service/lifecycle/service-account-authorization\";\nimport { readServiceControlCapabilities } from \"./service-control-capabilities\";\n\n/** Display evidence only. Auth and Service owners validate an existing connection. */\nexport async function readComputerConnectionReview() {\n  const session = await getAuthSessionMetadata();\n  if (session && !session.user?.id) {\n    throw new Error(\n      \"The computer account cannot be identified. Review its sign-in before connecting.\"\n    );\n  }\n  let existingConnection: ReturnType<\n    typeof computerConnectionReviewSchema.parse\n  >[\"existingConnection\"] = null;\n  const contract = await readDaemonServiceContract();\n  if (session && contract && contract.ownerUserId === session.user?.id) {\n    const auth = await getAuthSessionState({ validateRemote: true });\n    if (auth.state === \"valid\" && auth.session) {\n      const identity = await resolveServiceAccountIdentity(\n        auth.session,\n        contract\n      );\n      const capabilities = await readServiceControlCapabilities();\n      if (capabilities.stop && capabilities.deviceId === identity.deviceId) {\n        existingConnection = {\n          deviceId: identity.deviceId,\n          runtimeLane: identity.lane,\n        };\n      }\n    }\n  }\n  return computerConnectionReviewSchema.parse({\n    protocol: \"computer-connection-v1\",\n    previousSessionIdentity: buildStoredAuthSessionIdentity(session),\n    account: session\n      ? { id: session.user?.id, email: session.user?.email ?? null }\n      : null,\n    existingConnection,\n  });\n}\n"],"mappings":";;;;;;;;;AAWA,eAAsB,+BAA+B;CACnD,MAAM,UAAU,MAAM,uBAAuB;CAC7C,IAAI,WAAW,CAAC,QAAQ,MAAM,IAC5B,MAAM,IAAI,MACR,kFACF;CAEF,IAAI,qBAEsB;CAC1B,MAAM,WAAW,MAAM,0BAA0B;CACjD,IAAI,WAAW,YAAY,SAAS,gBAAgB,QAAQ,MAAM,IAAI;EACpE,MAAM,OAAO,MAAM,oBAAoB,EAAE,gBAAgB,KAAK,CAAC;EAC/D,IAAI,KAAK,UAAU,WAAW,KAAK,SAAS;GAC1C,MAAM,WAAW,MAAM,8BACrB,KAAK,SACL,QACF;GACA,MAAM,eAAe,MAAM,+BAA+B;GAC1D,IAAI,aAAa,QAAQ,aAAa,aAAa,SAAS,UAC1D,qBAAqB;IACnB,UAAU,SAAS;IACnB,aAAa,SAAS;GACxB;EAEJ;CACF;CACA,OAAO,+BAA+B,MAAM;EAC1C,UAAU;EACV,yBAAyB,+BAA+B,OAAO;EAC/D,SAAS,UACL;GAAE,IAAI,QAAQ,MAAM;GAAI,OAAO,QAAQ,MAAM,SAAS;EAAK,IAC3D;EACJ;CACF,CAAC;AACH"}
+{"version":3,"file":"computer-connection-review-CCjlShNF.js","names":[],"sources":["../src/commands/computer-connection-review.ts"],"sourcesContent":["import { computerConnectionReviewSchema } from \"@openmeld/schemas\";\nimport {\n  buildStoredAuthSessionIdentity,\n  getAuthSessionMetadata,\n  getAuthSessionState,\n} from \"../config/auth-session\";\nimport { readDaemonServiceContract } from \"../config/daemon-service-contract\";\nimport { resolveServiceAccountIdentity } from \"../local-service/lifecycle/service-account-authorization\";\nimport { readServiceControlCapabilities } from \"./service-control-capabilities\";\n\n/** Display evidence only. Auth and Service owners validate an existing connection. */\nexport async function readComputerConnectionReview() {\n  const session = await getAuthSessionMetadata();\n  if (session && !session.user?.id) {\n    throw new Error(\n      \"The computer account cannot be identified. Review its sign-in before connecting.\"\n    );\n  }\n  let existingConnection: ReturnType<\n    typeof computerConnectionReviewSchema.parse\n  >[\"existingConnection\"] = null;\n  const contract = await readDaemonServiceContract();\n  if (session && contract && contract.ownerUserId === session.user?.id) {\n    const auth = await getAuthSessionState({ validateRemote: true });\n    if (auth.state === \"valid\" && auth.session) {\n      const identity = await resolveServiceAccountIdentity(\n        auth.session,\n        contract\n      );\n      const capabilities = await readServiceControlCapabilities();\n      if (capabilities.stop && capabilities.deviceId === identity.deviceId) {\n        existingConnection = {\n          deviceId: identity.deviceId,\n          runtimeLane: identity.lane,\n        };\n      }\n    }\n  }\n  return computerConnectionReviewSchema.parse({\n    protocol: \"computer-connection-v1\",\n    previousSessionIdentity: buildStoredAuthSessionIdentity(session),\n    account: session\n      ? { id: session.user?.id, email: session.user?.email ?? null }\n      : null,\n    existingConnection,\n  });\n}\n"],"mappings":";;;;;;;;;AAWA,eAAsB,+BAA+B;CACnD,MAAM,UAAU,MAAM,uBAAuB;CAC7C,IAAI,WAAW,CAAC,QAAQ,MAAM,IAC5B,MAAM,IAAI,MACR,kFACF;CAEF,IAAI,qBAEsB;CAC1B,MAAM,WAAW,MAAM,0BAA0B;CACjD,IAAI,WAAW,YAAY,SAAS,gBAAgB,QAAQ,MAAM,IAAI;EACpE,MAAM,OAAO,MAAM,oBAAoB,EAAE,gBAAgB,KAAK,CAAC;EAC/D,IAAI,KAAK,UAAU,WAAW,KAAK,SAAS;GAC1C,MAAM,WAAW,MAAM,8BACrB,KAAK,SACL,QACF;GACA,MAAM,eAAe,MAAM,+BAA+B;GAC1D,IAAI,aAAa,QAAQ,aAAa,aAAa,SAAS,UAC1D,qBAAqB;IACnB,UAAU,SAAS;IACnB,aAAa,SAAS;GACxB;EAEJ;CACF;CACA,OAAO,+BAA+B,MAAM;EAC1C,UAAU;EACV,yBAAyB,+BAA+B,OAAO;EAC/D,SAAS,UACL;GAAE,IAAI,QAAQ,MAAM;GAAI,OAAO,QAAQ,MAAM,SAAS;EAAK,IAC3D;EACJ;CACF,CAAC;AACH"}

package/dist/{computer-disconnect-DhUhwPXH.js → computer-disconnect-C7GiBynE.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 
-import { HA as computerConnectionIntentSchema, XA as desktopComputerDisconnectRequestSchema } from "./dist-BvGnlYhy.js";
-import { n as resolveRuntimeContext } from "./context-CuCerz9H.js";
-import { l as getAuthSession, o as buildStoredAuthSessionIdentity, s as clearAuthSession, u as getAuthSessionMetadata } from "./auth-session-C1QlGOT-.js";
-import { q as withDaemonServiceRunLock } from "./daemon-state-BHmahVmK.js";
+import { UA as computerConnectionIntentSchema, ZA as desktopComputerDisconnectRequestSchema } from "./dist-Bn5dP-sF.js";
+import { n as resolveRuntimeContext } from "./context-BEC44g6x.js";
+import { l as getAuthSession, o as buildStoredAuthSessionIdentity, s as clearAuthSession, u as getAuthSessionMetadata } from "./auth-session-BdAItAyB.js";
+import { q as withDaemonServiceRunLock } from "./daemon-state-CpJ1iJF9.js";
 import { t as createPresenter } from "./presenter-DiP7Yh2y.js";
-import { i as readDaemonServiceContract } from "./daemon-service-contract-Ab9x7DQh.js";
-import { n as resolveServiceAccountIdentity } from "./service-account-authorization-CmN8zEW6.js";
-import { r as readCurrentDaemonRuntimeContext } from "./daemon-service-runtime-DDfld-8y.js";
-import { t as runServiceAccountControl } from "./service-account-control-Ddu-GY7r.js";
+import { i as readDaemonServiceContract } from "./daemon-service-contract-C-UUgJPA.js";
+import { n as resolveServiceAccountIdentity } from "./service-account-authorization-BCNKSqgz.js";
+import { r as readCurrentDaemonRuntimeContext } from "./daemon-service-runtime-n-aqN9OF.js";
+import { t as runServiceAccountControl } from "./service-account-control-BpQRqap6.js";
 //#region src/commands/computer-disconnect.ts
 async function runComputerDisconnect(request, view, target) {
 	const presenter = createPresenter(await resolveRuntimeContext({ view }));
@@ -55,4 +55,4 @@ async function disconnectComputer(request, target) {
 //#endregion
 export { runComputerDisconnect, runComputerDisconnectTarget };
 
-//# sourceMappingURL=computer-disconnect-DhUhwPXH.js.map
+//# sourceMappingURL=computer-disconnect-C7GiBynE.js.map

package/dist/{computer-disconnect-DhUhwPXH.js.map → computer-disconnect-C7GiBynE.js.map}

@@ -1 +1 @@
-{"version":3,"file":"computer-disconnect-DhUhwPXH.js","names":[],"sources":["../src/commands/computer-disconnect.ts"],"sourcesContent":["import {\n  type ComputerConnectionIntent,\n  computerConnectionIntentSchema,\n  type DesktopComputerDisconnectRequest,\n  desktopComputerDisconnectRequestSchema,\n} from \"@openmeld/schemas\";\nimport {\n  buildStoredAuthSessionIdentity,\n  clearAuthSession,\n  getAuthSession,\n  getAuthSessionMetadata,\n} from \"../config/auth-session\";\nimport { readDaemonServiceContract } from \"../config/daemon-service-contract\";\nimport { withDaemonServiceRunLock } from \"../config/daemon-state\";\nimport { readCurrentDaemonRuntimeContext } from \"../local-service/lifecycle/daemon-service-runtime\";\nimport { resolveServiceAccountIdentity } from \"../local-service/lifecycle/service-account-authorization\";\nimport { resolveRuntimeContext } from \"../runtime/context\";\nimport { createPresenter } from \"../runtime/presenter/index\";\nimport { runServiceAccountControl } from \"./service-account-control\";\n\nexport async function runComputerDisconnect(\n  request: ComputerConnectionIntent,\n  view?: string,\n  target?: DesktopComputerDisconnectRequest[\"expectedConnection\"]\n) {\n  const presenter = createPresenter(await resolveRuntimeContext({ view }));\n  presenter.line({\n    code: \"computer.disconnect.started\",\n    text: \"Stopping OpenMeld Service…\",\n    data: { state: \"started\" },\n  });\n  await disconnectComputer(request, target);\n  presenter.line({\n    code: \"computer.disconnected\",\n    text: \"This computer is disconnected. Its record is still in your account.\",\n  });\n}\n\nexport async function runComputerDisconnectTarget(\n  request: DesktopComputerDisconnectRequest,\n  view?: string\n) {\n  const target = desktopComputerDisconnectRequestSchema.parse(request);\n  if (!target.expectedConnection) {\n    throw new Error(\n      \"Specify the Computer device and runtime lane to disconnect.\"\n    );\n  }\n  const session = await getAuthSessionMetadata();\n  await runComputerDisconnect(\n    {\n      expectedAccount: target.expectedAccount,\n      previousSessionIdentity: buildStoredAuthSessionIdentity(session),\n    },\n    view,\n    target.expectedConnection\n  );\n}\n\n// Disconnect ends this Mac's local account connection. Forget remains the\n// separate cloud operation that removes the account's Computer record.\nexport async function disconnectComputer(\n  request: ComputerConnectionIntent,\n  target?: DesktopComputerDisconnectRequest[\"expectedConnection\"]\n): Promise<void> {\n  const intent = computerConnectionIntentSchema.parse(request);\n  const session = await getAuthSessionMetadata();\n  if (\n    !session ||\n    session.user?.id !== intent.expectedAccount ||\n    buildStoredAuthSessionIdentity(session) !== intent.previousSessionIdentity\n  ) {\n    throw new Error(\n      \"The computer sign-in changed. Review its connection before disconnecting.\"\n    );\n  }\n  // The existing admission owner rechecks account, process and generation,\n  // drains active work, and disables automatic startup. Never use an unscoped Stop.\n  await withDaemonServiceRunLock(async () => {\n    const contract = await readDaemonServiceContract();\n    if (target || contract?.desiredState === \"stopped\") {\n      const current = await getAuthSession();\n      if (!(current && contract)) {\n        throw new Error(\n          \"Review this computer's connection before disconnecting.\"\n        );\n      }\n      const identity = await resolveServiceAccountIdentity(current, contract);\n      if (\n        target &&\n        (identity.accountId !== intent.expectedAccount ||\n          identity.deviceId !== target.deviceId ||\n          identity.lane !== target.runtimeLane)\n      ) {\n        throw new Error(\n          \"This command is for a different Computer or environment. Run it on the Computer shown in OpenMeld.\"\n        );\n      }\n    }\n    const runtime = await readCurrentDaemonRuntimeContext();\n    // A retry may follow an acknowledged Stop and a failed credential cleanup.\n    // Only the owner's explicit stopped intent can skip another Stop.\n    if (\n      !(\n        contract?.ownerUserId === intent.expectedAccount &&\n        contract.desiredState === \"stopped\" &&\n        runtime.effectiveRuntimeStatus === \"not_running\"\n      )\n    ) {\n      await runServiceAccountControl(\n        {\n          operation: \"stop\",\n          expectedAccount: intent.expectedAccount,\n        },\n        intent.previousSessionIdentity\n      );\n    }\n    // Hold the existing lifecycle lock through cleanup so Start cannot race it.\n    // A concurrent sign-in after Stop must never be cleared by this operation.\n    await clearAuthSession(session);\n  });\n}\n"],"mappings":";;;;;;;;;;;;AAoBA,eAAsB,sBACpB,SACA,MACA,QACA;CACA,MAAM,YAAY,gBAAgB,MAAM,sBAAsB,EAAE,KAAK,CAAC,CAAC;CACvE,UAAU,KAAK;EACb,MAAM;EACN,MAAM;EACN,MAAM,EAAE,OAAO,UAAU;CAC3B,CAAC;CACD,MAAM,mBAAmB,SAAS,MAAM;CACxC,UAAU,KAAK;EACb,MAAM;EACN,MAAM;CACR,CAAC;AACH;AAEA,eAAsB,4BACpB,SACA,MACA;CACA,MAAM,SAAS,uCAAuC,MAAM,OAAO;CACnE,IAAI,CAAC,OAAO,oBACV,MAAM,IAAI,MACR,6DACF;CAEF,MAAM,UAAU,MAAM,uBAAuB;CAC7C,MAAM,sBACJ;EACE,iBAAiB,OAAO;EACxB,yBAAyB,+BAA+B,OAAO;CACjE,GACA,MACA,OAAO,kBACT;AACF;AAIA,eAAsB,mBACpB,SACA,QACe;CACf,MAAM,SAAS,+BAA+B,MAAM,OAAO;CAC3D,MAAM,UAAU,MAAM,uBAAuB;CAC7C,IACE,CAAC,WACD,QAAQ,MAAM,OAAO,OAAO,mBAC5B,+BAA+B,OAAO,MAAM,OAAO,yBAEnD,MAAM,IAAI,MACR,2EACF;CAIF,MAAM,yBAAyB,YAAY;EACzC,MAAM,WAAW,MAAM,0BAA0B;EACjD,IAAI,UAAU,UAAU,iBAAiB,WAAW;GAClD,MAAM,UAAU,MAAM,eAAe;GACrC,IAAI,EAAE,WAAW,WACf,MAAM,IAAI,MACR,yDACF;GAEF,MAAM,WAAW,MAAM,8BAA8B,SAAS,QAAQ;GACtE,IACE,WACC,SAAS,cAAc,OAAO,mBAC7B,SAAS,aAAa,OAAO,YAC7B,SAAS,SAAS,OAAO,cAE3B,MAAM,IAAI,MACR,oGACF;EAEJ;EACA,MAAM,UAAU,MAAM,gCAAgC;EAGtD,IACE,EACE,UAAU,gBAAgB,OAAO,mBACjC,SAAS,iBAAiB,aAC1B,QAAQ,2BAA2B,gBAGrC,MAAM,yBACJ;GACE,WAAW;GACX,iBAAiB,OAAO;EAC1B,GACA,OAAO,uBACT;EAIF,MAAM,iBAAiB,OAAO;CAChC,CAAC;AACH"}
+{"version":3,"file":"computer-disconnect-C7GiBynE.js","names":[],"sources":["../src/commands/computer-disconnect.ts"],"sourcesContent":["import {\n  type ComputerConnectionIntent,\n  computerConnectionIntentSchema,\n  type DesktopComputerDisconnectRequest,\n  desktopComputerDisconnectRequestSchema,\n} from \"@openmeld/schemas\";\nimport {\n  buildStoredAuthSessionIdentity,\n  clearAuthSession,\n  getAuthSession,\n  getAuthSessionMetadata,\n} from \"../config/auth-session\";\nimport { readDaemonServiceContract } from \"../config/daemon-service-contract\";\nimport { withDaemonServiceRunLock } from \"../config/daemon-state\";\nimport { readCurrentDaemonRuntimeContext } from \"../local-service/lifecycle/daemon-service-runtime\";\nimport { resolveServiceAccountIdentity } from \"../local-service/lifecycle/service-account-authorization\";\nimport { resolveRuntimeContext } from \"../runtime/context\";\nimport { createPresenter } from \"../runtime/presenter/index\";\nimport { runServiceAccountControl } from \"./service-account-control\";\n\nexport async function runComputerDisconnect(\n  request: ComputerConnectionIntent,\n  view?: string,\n  target?: DesktopComputerDisconnectRequest[\"expectedConnection\"]\n) {\n  const presenter = createPresenter(await resolveRuntimeContext({ view }));\n  presenter.line({\n    code: \"computer.disconnect.started\",\n    text: \"Stopping OpenMeld Service…\",\n    data: { state: \"started\" },\n  });\n  await disconnectComputer(request, target);\n  presenter.line({\n    code: \"computer.disconnected\",\n    text: \"This computer is disconnected. Its record is still in your account.\",\n  });\n}\n\nexport async function runComputerDisconnectTarget(\n  request: DesktopComputerDisconnectRequest,\n  view?: string\n) {\n  const target = desktopComputerDisconnectRequestSchema.parse(request);\n  if (!target.expectedConnection) {\n    throw new Error(\n      \"Specify the Computer device and runtime lane to disconnect.\"\n    );\n  }\n  const session = await getAuthSessionMetadata();\n  await runComputerDisconnect(\n    {\n      expectedAccount: target.expectedAccount,\n      previousSessionIdentity: buildStoredAuthSessionIdentity(session),\n    },\n    view,\n    target.expectedConnection\n  );\n}\n\n// Disconnect ends this Mac's local account connection. Forget remains the\n// separate cloud operation that removes the account's Computer record.\nexport async function disconnectComputer(\n  request: ComputerConnectionIntent,\n  target?: DesktopComputerDisconnectRequest[\"expectedConnection\"]\n): Promise<void> {\n  const intent = computerConnectionIntentSchema.parse(request);\n  const session = await getAuthSessionMetadata();\n  if (\n    !session ||\n    session.user?.id !== intent.expectedAccount ||\n    buildStoredAuthSessionIdentity(session) !== intent.previousSessionIdentity\n  ) {\n    throw new Error(\n      \"The computer sign-in changed. Review its connection before disconnecting.\"\n    );\n  }\n  // The existing admission owner rechecks account, process and generation,\n  // drains active work, and disables automatic startup. Never use an unscoped Stop.\n  await withDaemonServiceRunLock(async () => {\n    const contract = await readDaemonServiceContract();\n    if (target || contract?.desiredState === \"stopped\") {\n      const current = await getAuthSession();\n      if (!(current && contract)) {\n        throw new Error(\n          \"Review this computer's connection before disconnecting.\"\n        );\n      }\n      const identity = await resolveServiceAccountIdentity(current, contract);\n      if (\n        target &&\n        (identity.accountId !== intent.expectedAccount ||\n          identity.deviceId !== target.deviceId ||\n          identity.lane !== target.runtimeLane)\n      ) {\n        throw new Error(\n          \"This command is for a different Computer or environment. Run it on the Computer shown in OpenMeld.\"\n        );\n      }\n    }\n    const runtime = await readCurrentDaemonRuntimeContext();\n    // A retry may follow an acknowledged Stop and a failed credential cleanup.\n    // Only the owner's explicit stopped intent can skip another Stop.\n    if (\n      !(\n        contract?.ownerUserId === intent.expectedAccount &&\n        contract.desiredState === \"stopped\" &&\n        runtime.effectiveRuntimeStatus === \"not_running\"\n      )\n    ) {\n      await runServiceAccountControl(\n        {\n          operation: \"stop\",\n          expectedAccount: intent.expectedAccount,\n        },\n        intent.previousSessionIdentity\n      );\n    }\n    // Hold the existing lifecycle lock through cleanup so Start cannot race it.\n    // A concurrent sign-in after Stop must never be cleared by this operation.\n    await clearAuthSession(session);\n  });\n}\n"],"mappings":";;;;;;;;;;;;AAoBA,eAAsB,sBACpB,SACA,MACA,QACA;CACA,MAAM,YAAY,gBAAgB,MAAM,sBAAsB,EAAE,KAAK,CAAC,CAAC;CACvE,UAAU,KAAK;EACb,MAAM;EACN,MAAM;EACN,MAAM,EAAE,OAAO,UAAU;CAC3B,CAAC;CACD,MAAM,mBAAmB,SAAS,MAAM;CACxC,UAAU,KAAK;EACb,MAAM;EACN,MAAM;CACR,CAAC;AACH;AAEA,eAAsB,4BACpB,SACA,MACA;CACA,MAAM,SAAS,uCAAuC,MAAM,OAAO;CACnE,IAAI,CAAC,OAAO,oBACV,MAAM,IAAI,MACR,6DACF;CAEF,MAAM,UAAU,MAAM,uBAAuB;CAC7C,MAAM,sBACJ;EACE,iBAAiB,OAAO;EACxB,yBAAyB,+BAA+B,OAAO;CACjE,GACA,MACA,OAAO,kBACT;AACF;AAIA,eAAsB,mBACpB,SACA,QACe;CACf,MAAM,SAAS,+BAA+B,MAAM,OAAO;CAC3D,MAAM,UAAU,MAAM,uBAAuB;CAC7C,IACE,CAAC,WACD,QAAQ,MAAM,OAAO,OAAO,mBAC5B,+BAA+B,OAAO,MAAM,OAAO,yBAEnD,MAAM,IAAI,MACR,2EACF;CAIF,MAAM,yBAAyB,YAAY;EACzC,MAAM,WAAW,MAAM,0BAA0B;EACjD,IAAI,UAAU,UAAU,iBAAiB,WAAW;GAClD,MAAM,UAAU,MAAM,eAAe;GACrC,IAAI,EAAE,WAAW,WACf,MAAM,IAAI,MACR,yDACF;GAEF,MAAM,WAAW,MAAM,8BAA8B,SAAS,QAAQ;GACtE,IACE,WACC,SAAS,cAAc,OAAO,mBAC7B,SAAS,aAAa,OAAO,YAC7B,SAAS,SAAS,OAAO,cAE3B,MAAM,IAAI,MACR,oGACF;EAEJ;EACA,MAAM,UAAU,MAAM,gCAAgC;EAGtD,IACE,EACE,UAAU,gBAAgB,OAAO,mBACjC,SAAS,iBAAiB,aAC1B,QAAQ,2BAA2B,gBAGrC,MAAM,yBACJ;GACE,WAAW;GACX,iBAAiB,OAAO;EAC1B,GACA,OAAO,uBACT;EAIF,MAAM,iBAAiB,OAAO;CAChC,CAAC;AACH"}

package/dist/{computer-setup-continuation-DdbcZczm.js → computer-setup-continuation-ri4gskwX.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
-import { S as resumeInterruptedComputerSetup, m as hasPendingComputerSetupContinuation } from "./auth-session-C1QlGOT-.js";
+import { S as resumeInterruptedComputerSetup, m as hasPendingComputerSetupContinuation } from "./auth-session-BdAItAyB.js";
 import { t as createPresenter } from "./presenter-DiP7Yh2y.js";
-import { A as mintPrepareSessionReconnectToken, D as recoverInterruptedComputerAuthHandoff, i as runPrepareSessionExecutor } from "./prepare-session-executor-TS55wAl6.js";
+import { A as mintPrepareSessionReconnectToken, D as recoverInterruptedComputerAuthHandoff, i as runPrepareSessionExecutor } from "./prepare-session-executor-B2LKxCSD.js";
 import { setTimeout } from "node:timers/promises";
 //#region src/commands/computer-setup-continuation.ts
 const runtime = {
@@ -39,4 +39,4 @@ async function recoverComputerSetupAfterBackgroundUpdate() {
 //#endregion
 export { finishComputerSetupAfterBackgroundUpdate, recoverComputerSetupAfterBackgroundUpdate };
 
-//# sourceMappingURL=computer-setup-continuation-DdbcZczm.js.map
+//# sourceMappingURL=computer-setup-continuation-ri4gskwX.js.map

package/dist/{computer-setup-continuation-DdbcZczm.js.map → computer-setup-continuation-ri4gskwX.js.map}

@@ -1 +1 @@
-{"version":3,"file":"computer-setup-continuation-DdbcZczm.js","names":["sleep"],"sources":["../src/commands/computer-setup-continuation.ts"],"sourcesContent":["import { setTimeout as sleep } from \"node:timers/promises\";\nimport {\n  hasPendingComputerSetupContinuation,\n  resumeInterruptedComputerSetup,\n} from \"../config/auth-session\";\nimport { mintPrepareSessionReconnectToken } from \"../config/prepare-session-api\";\nimport { createPresenter } from \"../runtime/presenter/index\";\nimport type { RuntimeContext } from \"../runtime/types\";\nimport { recoverInterruptedComputerAuthHandoff } from \"./computer-auth-handoff-recovery\";\nimport { runPrepareSessionExecutor } from \"./prepare-session-executor\";\n\nconst runtime: RuntimeContext = {\n  interactive: false,\n  resolvedView: \"agent\",\n  viewMode: \"agent\",\n};\n\n// Called only by the existing OS-owned maintenance worker after its update.\n// The live Terminal keeps ownership. If it exits, continue the same Core\n// Prepare session using the existing auth journal, not a second setup plan.\nexport async function finishComputerSetupAfterBackgroundUpdate(): Promise<void> {\n  while (await hasPendingComputerSetupContinuation()) {\n    const resumed = await resumeInterruptedComputerSetup(\n      async (continuation) => {\n        const { snapshot, opaqueToken } =\n          await mintPrepareSessionReconnectToken({\n            baseUrl: continuation.gatewayUrl,\n            prepareSessionId: continuation.prepareSessionId,\n          });\n        if (\n          snapshot.lifecycleStatus !== \"active\" &&\n          snapshot.lifecycleStatus !== \"completed\"\n        ) {\n          return \"not_completed\";\n        }\n        const result = await runPrepareSessionExecutor({\n          gatewayUrl: continuation.gatewayUrl,\n          initialSnapshot: snapshot,\n          interactive: false,\n          localAgentSelection: continuation.localAgentSelection,\n          presenter: createPresenter(runtime),\n          runtime,\n          startSession: opaqueToken,\n          view: \"agent\",\n        });\n        return result.status;\n      }\n    );\n    if (!resumed) {\n      await sleep(500);\n    }\n  }\n}\n\n// Run after the completed update has released its pending job. Account rollback\n// uses the existing handoff recovery, which itself waits for active updates.\nexport async function recoverComputerSetupAfterBackgroundUpdate(): Promise<void> {\n  await recoverInterruptedComputerAuthHandoff({\n    presenter: createPresenter(runtime),\n    runtime,\n    view: \"agent\",\n  });\n}\n"],"mappings":";;;;;;;AAWA,MAAM,UAA0B;CAC9B,aAAa;CACb,cAAc;CACd,UAAU;AACZ;AAKA,eAAsB,2CAA0D;CAC9E,OAAO,MAAM,oCAAoC,GA2B/C,IAAI,CAAC,MA1BiB,+BACpB,OAAO,iBAAiB;EACtB,MAAM,EAAE,UAAU,gBAChB,MAAM,iCAAiC;GACrC,SAAS,aAAa;GACtB,kBAAkB,aAAa;EACjC,CAAC;EACH,IACE,SAAS,oBAAoB,YAC7B,SAAS,oBAAoB,aAE7B,OAAO;EAYT,QAAO,MAVc,0BAA0B;GAC7C,YAAY,aAAa;GACzB,iBAAiB;GACjB,aAAa;GACb,qBAAqB,aAAa;GAClC,WAAW,gBAAgB,OAAO;GAClC;GACA,cAAc;GACd,MAAM;EACR,CAAC,EAAA,CACa;CAChB,CACF,GAEE,MAAMA,WAAM,GAAG;AAGrB;AAIA,eAAsB,4CAA2D;CAC/E,MAAM,sCAAsC;EAC1C,WAAW,gBAAgB,OAAO;EAClC;EACA,MAAM;CACR,CAAC;AACH"}
+{"version":3,"file":"computer-setup-continuation-ri4gskwX.js","names":["sleep"],"sources":["../src/commands/computer-setup-continuation.ts"],"sourcesContent":["import { setTimeout as sleep } from \"node:timers/promises\";\nimport {\n  hasPendingComputerSetupContinuation,\n  resumeInterruptedComputerSetup,\n} from \"../config/auth-session\";\nimport { mintPrepareSessionReconnectToken } from \"../config/prepare-session-api\";\nimport { createPresenter } from \"../runtime/presenter/index\";\nimport type { RuntimeContext } from \"../runtime/types\";\nimport { recoverInterruptedComputerAuthHandoff } from \"./computer-auth-handoff-recovery\";\nimport { runPrepareSessionExecutor } from \"./prepare-session-executor\";\n\nconst runtime: RuntimeContext = {\n  interactive: false,\n  resolvedView: \"agent\",\n  viewMode: \"agent\",\n};\n\n// Called only by the existing OS-owned maintenance worker after its update.\n// The live Terminal keeps ownership. If it exits, continue the same Core\n// Prepare session using the existing auth journal, not a second setup plan.\nexport async function finishComputerSetupAfterBackgroundUpdate(): Promise<void> {\n  while (await hasPendingComputerSetupContinuation()) {\n    const resumed = await resumeInterruptedComputerSetup(\n      async (continuation) => {\n        const { snapshot, opaqueToken } =\n          await mintPrepareSessionReconnectToken({\n            baseUrl: continuation.gatewayUrl,\n            prepareSessionId: continuation.prepareSessionId,\n          });\n        if (\n          snapshot.lifecycleStatus !== \"active\" &&\n          snapshot.lifecycleStatus !== \"completed\"\n        ) {\n          return \"not_completed\";\n        }\n        const result = await runPrepareSessionExecutor({\n          gatewayUrl: continuation.gatewayUrl,\n          initialSnapshot: snapshot,\n          interactive: false,\n          localAgentSelection: continuation.localAgentSelection,\n          presenter: createPresenter(runtime),\n          runtime,\n          startSession: opaqueToken,\n          view: \"agent\",\n        });\n        return result.status;\n      }\n    );\n    if (!resumed) {\n      await sleep(500);\n    }\n  }\n}\n\n// Run after the completed update has released its pending job. Account rollback\n// uses the existing handoff recovery, which itself waits for active updates.\nexport async function recoverComputerSetupAfterBackgroundUpdate(): Promise<void> {\n  await recoverInterruptedComputerAuthHandoff({\n    presenter: createPresenter(runtime),\n    runtime,\n    view: \"agent\",\n  });\n}\n"],"mappings":";;;;;;;AAWA,MAAM,UAA0B;CAC9B,aAAa;CACb,cAAc;CACd,UAAU;AACZ;AAKA,eAAsB,2CAA0D;CAC9E,OAAO,MAAM,oCAAoC,GA2B/C,IAAI,CAAC,MA1BiB,+BACpB,OAAO,iBAAiB;EACtB,MAAM,EAAE,UAAU,gBAChB,MAAM,iCAAiC;GACrC,SAAS,aAAa;GACtB,kBAAkB,aAAa;EACjC,CAAC;EACH,IACE,SAAS,oBAAoB,YAC7B,SAAS,oBAAoB,aAE7B,OAAO;EAYT,QAAO,MAVc,0BAA0B;GAC7C,YAAY,aAAa;GACzB,iBAAiB;GACjB,aAAa;GACb,qBAAqB,aAAa;GAClC,WAAW,gBAAgB,OAAO;GAClC;GACA,cAAc;GACd,MAAM;EACR,CAAC,EAAA,CACa;CAChB,CACF,GAEE,MAAMA,WAAM,GAAG;AAGrB;AAIA,eAAsB,4CAA2D;CAC/E,MAAM,sCAAsC;EAC1C,WAAW,gBAAgB,OAAO;EAClC;EACA,MAAM;CACR,CAAC;AACH"}

package/dist/{context-CuCerz9H.js → context-BEC44g6x.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 
-import { D as isLoopbackHostname, _ as getConfiguredViewCustomization } from "./base-url-BUHbVXb3.js";
+import { D as isLoopbackHostname, _ as getConfiguredViewCustomization } from "./base-url-DRxlYvp_.js";
 import { D as openMeldRootDir, R as runtimeDir, b as normalizeOpenMeldProfileId, i as accountProfileViewPath, t as OPENMELD_HOME_ENV_KEY, y as normalizeAccountKey } from "./paths-De9xdA2h.js";
-import { _M as profileCapabilitiesResponseSchema, aR as openMeldProfileIdSchema, iM as ADDITIONAL_HUMAN_PROFILE_CREATION_DISABLED_MESSAGE, rM as ADDITIONAL_HUMAN_PROFILE_CREATION_DISABLED_CODE, uM as authProfileManagedRoleSchema, vM as profileErrorResponseSchema } from "./dist-BvGnlYhy.js";
-import { _ as resolveCliContext, g as readCliContextState, h as listCliContextStates, y as writeCliContextState } from "./lock-anKblZEb.js";
+import { aM as ADDITIONAL_HUMAN_PROFILE_CREATION_DISABLED_MESSAGE, dM as authProfileManagedRoleSchema, iM as ADDITIONAL_HUMAN_PROFILE_CREATION_DISABLED_CODE, oR as openMeldProfileIdSchema, vM as profileCapabilitiesResponseSchema, yM as profileErrorResponseSchema } from "./dist-Bn5dP-sF.js";
+import { _ as resolveCliContext, g as readCliContextState, h as listCliContextStates, y as writeCliContextState } from "./lock-CTsTGDK5.js";
 import { r as formatOpenMeldCliCommands, t as formatInlineOpenMeldCliCommands } from "./cli-entry-command-CR_9QU1i.js";
-import { d as getAuthSessionState } from "./auth-session-C1QlGOT-.js";
-import { m as daemonRuntimeDataPath } from "./daemon-state-BHmahVmK.js";
+import { d as getAuthSessionState } from "./auth-session-BdAItAyB.js";
+import { m as daemonRuntimeDataPath } from "./daemon-state-CpJ1iJF9.js";
 import { createHash, randomUUID } from "node:crypto";
 import { dirname, join } from "node:path";
 import { mkdir, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
@@ -36,7 +36,7 @@ function resolveOpenMeldAccountContext(input) {
 	};
 }
 async function resolveCurrentOpenMeldAccountContext() {
-	const { getAuthSessionMetadata } = await import("./auth-session-BjkIIzIz.js");
+	const { getAuthSessionMetadata } = await import("./auth-session-BQyoodFm.js");
 	return resolveOpenMeldAccountContext({ session: await getAuthSessionMetadata().catch(() => null) });
 }
 function resolveHostKey(baseUrl) {
@@ -1205,4 +1205,4 @@ function isInteractiveSession() {
 //#endregion
 export { resolveAuthenticationGuidanceFromError as A, buildAgentAuthenticationGuide as C, createAuthenticationError as D, buildHumanAuthenticationCard as E, resolveCurrentOpenMeldAccountContext as F, resolveAuthenticationReasonFromState as M, getProfileDefaultView as N, extractAuthenticationPromptAction as O, setProfileDefaultView as P, setSelectedOpenMeldProfileId as S, buildCommandAuthenticationPromptMessage as T, touchDaemonCatalogSyncSignal as _, requireOpenMeldProfile as a, clearSelectedOpenMeldProfileId as b, createOpenMeldHumanProfile as c, listOpenMeldProfiles as d, primeOpenMeldProfilesSessionCache as f, readDaemonCatalogSyncSignal as g, assertAdditionalHumanProfileCreationEnabled as h, isSelectedOpenMeldProfileRequiredError as i, resolveAuthenticationGuidanceFromMessage as j, resolveAuthenticationGuidance as k, deleteOpenMeldProfile as l, updateOpenMeldProfile as m, resolveRuntimeContext as n, resolveOpenMeldProfileOrNull as o, resolveOpenMeldProfile as p, resolveViewProfileKey as r, createOpenMeldAgentProfile as s, parseCliViewMode as t, getOpenMeldProfileCapabilities as u, alignSelectedOpenMeldProfileStorage as v, buildAuthenticationStatusLabel as w, getSelectedOpenMeldProfileId as x, clearAllSelectedOpenMeldProfileIds as y };
 
-//# sourceMappingURL=context-CuCerz9H.js.map
+//# sourceMappingURL=context-BEC44g6x.js.map