openmeld 0.3.91 → 0.3.95

package/dist/{auth-session-73FalW41.js → auth-session-yymO5FGR.js}

@@ -2,9 +2,66 @@
 
 import { Nt as openMeldRootDir, _n as __exportAll } from "./base-url-Cv9x5Es9.js";
 import { t as CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH } from "./runtime-transport-J50KvRbm.js";
+import { createRequire } from "node:module";
+import { z } from "zod/v4";
 import { join, resolve } from "node:path";
 import { createHash, randomUUID } from "node:crypto";
-import { mkdir, open, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { chmod, mkdir, open, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { spawn } from "node:child_process";
+import { fileURLToPath } from "node:url";
+//#region ../../packages/schemas/dist/schemas/local-machine/macos-keychain-helper.js
+const macOsKeychainServiceSchema = z.string().trim().min(1).max(512);
+const macOsKeychainAccountSchema = z.string().trim().min(1).max(512);
+const macOsKeychainAccessTokenSchema = z.string().min(1).max(65536);
+const macOsKeychainHelperOperationSchema = z.enum([
+	"store",
+	"read",
+	"delete"
+]);
+const macOsKeychainHelperRequestSchema = z.discriminatedUnion("operation", [
+	z.strictObject({
+		schemaVersion: z.literal(1),
+		operation: z.literal("store"),
+		service: macOsKeychainServiceSchema,
+		account: macOsKeychainAccountSchema,
+		accessToken: macOsKeychainAccessTokenSchema
+	}),
+	z.strictObject({
+		schemaVersion: z.literal(1),
+		operation: z.literal("read"),
+		service: macOsKeychainServiceSchema,
+		account: macOsKeychainAccountSchema
+	}),
+	z.strictObject({
+		schemaVersion: z.literal(1),
+		operation: z.literal("delete"),
+		service: macOsKeychainServiceSchema,
+		account: macOsKeychainAccountSchema
+	})
+]);
+const macOsKeychainHelperMutationSuccessSchema = z.strictObject({
+	schemaVersion: z.literal(1),
+	ok: z.literal(true),
+	operation: z.enum(["store", "delete"])
+});
+const macOsKeychainHelperReadSuccessSchema = z.strictObject({
+	schemaVersion: z.literal(1),
+	ok: z.literal(true),
+	operation: z.literal("read"),
+	accessToken: z.union([macOsKeychainAccessTokenSchema, z.null()])
+});
+const macOsKeychainHelperErrorSchema = z.strictObject({
+	schemaVersion: z.literal(1),
+	ok: z.literal(false),
+	operation: macOsKeychainHelperOperationSchema,
+	errorMessage: z.string().trim().min(1).max(2048)
+});
+const macOsKeychainHelperResponseSchema = z.union([
+	macOsKeychainHelperMutationSuccessSchema,
+	macOsKeychainHelperReadSuccessSchema,
+	macOsKeychainHelperErrorSchema
+]);
+//#endregion
 //#region src/strategy-constants.ts
 const DEFAULT_GATEWAY_CHAIN_TIMEOUT_MS = 3e4;
 const DEFAULT_REMOTE_SESSION_TIMEOUT_MS = 8e3;
@@ -31,6 +88,234 @@ const HEARTBEAT_RESPONSE_TIMEOUT_MS = 15e3;
 const DAEMON_RUNTIME_CONTRACT_EPOCH = CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH;
 const OPENCLAW_CLI_TIMEOUT_MS = 3e4;
 //#endregion
+//#region src/runtime/distribution.ts
+const BINARY_DISTRIBUTION = "binary";
+const NPM_DISTRIBUTION = "npm";
+/**
+* The distribution form this CLI build was compiled for. Falls back to `npm`
+* when the marker is absent (e.g. under Vitest, where no build-time define
+* runs), which keeps the safe, path-independent default.
+*/
+function resolveOpenMeldDistribution() {
+	return NPM_DISTRIBUTION;
+}
+function isBinaryDistribution() {
+	return resolveOpenMeldDistribution() === BINARY_DISTRIBUTION;
+}
+//#endregion
+//#region src/config/macos-native-keychain.ts
+const MAC_OS_KEYCHAIN_HELPER_ARG = "__openmeld_macos_keychain_helper";
+const HELPER_OUTPUT_MAX_BYTES = 128 * 1024;
+let loadedAddon = null;
+let unresponsiveKeychainError = null;
+async function storeMacOsNativeKeychainToken(input) {
+	if (isBinaryDistribution()) {
+		await runBoundedMacOsNativeKeychainRequest({
+			operation: "store",
+			service: input.service,
+			account: input.account,
+			accessToken: input.accessToken
+		});
+		return;
+	}
+	(await loadAddon()).store(input.service, input.account, input.accessToken);
+}
+async function readMacOsNativeKeychainToken(input) {
+	if (isBinaryDistribution()) return await runBoundedMacOsNativeKeychainRequest({
+		operation: "read",
+		service: input.service,
+		account: input.account
+	});
+	return (await loadAddon()).read(input.service, input.account);
+}
+async function deleteMacOsNativeKeychainToken(input) {
+	if (isBinaryDistribution()) {
+		await runBoundedMacOsNativeKeychainRequest({
+			operation: "delete",
+			service: input.service,
+			account: input.account
+		});
+		return;
+	}
+	(await loadAddon()).remove(input.service, input.account);
+}
+async function runMacOsNativeKeychainRequestInChild(input, options = {}) {
+	const request = macOsKeychainHelperRequestSchema.parse({
+		schemaVersion: 1,
+		...input
+	});
+	const timeoutMs = options.timeoutMs ?? 5e3;
+	if (!(Number.isSafeInteger(timeoutMs) && timeoutMs > 0)) throw new Error("macOS Keychain helper timeout must be a positive integer");
+	return await new Promise((resolve, reject) => {
+		const child = spawn(process.execPath, [MAC_OS_KEYCHAIN_HELPER_ARG], {
+			env: process.env,
+			shell: false,
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			],
+			windowsHide: true
+		});
+		let settled = false;
+		let stdout = "";
+		let stderr = "";
+		const clearDeadline = () => {
+			clearTimeout(deadline);
+		};
+		const rejectOnce = (error) => {
+			if (settled) return;
+			settled = true;
+			clearDeadline();
+			reject(error);
+		};
+		const deadline = setTimeout(() => {
+			if (settled) return;
+			settled = true;
+			child.kill("SIGKILL");
+			reject(new MacOsNativeKeychainTimeoutError(`macOS Keychain did not respond within ${formatTimeout(timeoutMs)}`));
+		}, timeoutMs);
+		child.stdout.setEncoding("utf8");
+		child.stderr.setEncoding("utf8");
+		child.stdout.on("data", (chunk) => {
+			stdout += String(chunk);
+			if (Buffer.byteLength(stdout, "utf8") > HELPER_OUTPUT_MAX_BYTES) {
+				child.kill("SIGKILL");
+				rejectOnce(/* @__PURE__ */ new Error("macOS Keychain helper output was too large"));
+			}
+		});
+		child.stderr.on("data", (chunk) => {
+			stderr += String(chunk);
+			if (Buffer.byteLength(stderr, "utf8") > HELPER_OUTPUT_MAX_BYTES) stderr = stderr.slice(-131072);
+		});
+		child.once("error", (error) => {
+			rejectOnce(/* @__PURE__ */ new Error(`macOS Keychain helper could not start: ${toErrorMessage$1(error)}`));
+		});
+		child.stdin.once("error", (error) => {
+			rejectOnce(/* @__PURE__ */ new Error(`macOS Keychain helper input failed: ${toErrorMessage$1(error)}`));
+		});
+		child.once("close", (code) => {
+			if (settled) return;
+			clearDeadline();
+			settled = true;
+			try {
+				resolve(parseMacOsKeychainHelperResult({
+					code,
+					operation: request.operation,
+					stderr,
+					stdout
+				}));
+			} catch (error) {
+				reject(toError(error));
+			}
+		});
+		child.stdin.end(JSON.stringify(request), "utf8");
+	});
+}
+async function runMacOsNativeKeychainHelperIfRequested(argv = process.argv) {
+	if (!argv.includes(MAC_OS_KEYCHAIN_HELPER_ARG)) return false;
+	if (!(isBinaryDistribution() && process.platform === "darwin")) throw new Error("the internal macOS Keychain helper is only available in the macOS binary");
+	const rawRequest = await readHelperStdin();
+	let json;
+	try {
+		json = JSON.parse(rawRequest);
+	} catch {
+		throw new Error("invalid macOS Keychain helper request");
+	}
+	const request = macOsKeychainHelperRequestSchema.safeParse(json);
+	if (!request.success) throw new Error("invalid macOS Keychain helper request");
+	const response = await executeHelperRequest(request.data).catch((error) => ({
+		schemaVersion: 1,
+		ok: false,
+		operation: request.data.operation,
+		errorMessage: truncateErrorMessage(toErrorMessage$1(error))
+	}));
+	process.stdout.write(JSON.stringify(response));
+	return true;
+}
+async function runBoundedMacOsNativeKeychainRequest(input) {
+	if (unresponsiveKeychainError) throw unresponsiveKeychainError;
+	try {
+		if (input.operation === "read") return await runMacOsNativeKeychainRequestInChild(input);
+		await runMacOsNativeKeychainRequestInChild(input);
+	} catch (error) {
+		if (error instanceof MacOsNativeKeychainTimeoutError) unresponsiveKeychainError = error;
+		throw error;
+	}
+}
+function parseMacOsKeychainHelperResult(input) {
+	if (input.code !== 0) throw new Error(`macOS Keychain helper exited with code ${input.code ?? "unknown"}${input.stderr.trim() ? `: ${input.stderr.trim()}` : ""}`);
+	let rawResponse;
+	try {
+		rawResponse = JSON.parse(input.stdout);
+	} catch {
+		throw new Error("macOS Keychain helper returned an invalid response");
+	}
+	const parsed = macOsKeychainHelperResponseSchema.safeParse(rawResponse);
+	if (!(parsed.success && parsed.data.operation === input.operation)) throw new Error("macOS Keychain helper returned an invalid response");
+	if (!parsed.data.ok) throw new Error(parsed.data.errorMessage);
+	return parsed.data.operation === "read" ? parsed.data.accessToken : void 0;
+}
+async function executeHelperRequest(input) {
+	const addon = await loadAddon();
+	if (input.operation === "store") {
+		addon.store(input.service, input.account, input.accessToken);
+		return {
+			schemaVersion: 1,
+			ok: true,
+			operation: "store"
+		};
+	}
+	if (input.operation === "delete") {
+		addon.remove(input.service, input.account);
+		return {
+			schemaVersion: 1,
+			ok: true,
+			operation: "delete"
+		};
+	}
+	return {
+		schemaVersion: 1,
+		ok: true,
+		operation: "read",
+		accessToken: addon.read(input.service, input.account)
+	};
+}
+async function readHelperStdin() {
+	let raw = "";
+	process.stdin.setEncoding("utf8");
+	for await (const chunk of process.stdin) {
+		raw += String(chunk);
+		if (Buffer.byteLength(raw, "utf8") > HELPER_OUTPUT_MAX_BYTES) throw new Error("macOS Keychain helper request was too large");
+	}
+	return raw;
+}
+function truncateErrorMessage(message) {
+	return (message.trim() || "macOS Keychain operation failed").slice(0, 2048);
+}
+function formatTimeout(timeoutMs) {
+	return timeoutMs % 1e3 === 0 ? `${timeoutMs / 1e3} seconds` : `${timeoutMs} ms`;
+}
+function toErrorMessage$1(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+function toError(error) {
+	return error instanceof Error ? error : new Error(String(error));
+}
+var MacOsNativeKeychainTimeoutError = class extends Error {
+	name = "MacOsNativeKeychainTimeoutError";
+};
+async function loadAddon() {
+	if (loadedAddon) return loadedAddon;
+	if (process.platform !== "darwin") throw new Error("macOS Keychain is only available on macOS");
+	if (isBinaryDistribution()) {
+		loadedAddon = (await import("./config/macos-native-keychain-embedded")).loadEmbeddedMacOsKeychainAddon();
+		return loadedAddon;
+	}
+	loadedAddon = createRequire(import.meta.url)(fileURLToPath(new URL("./native/openmeld-keychain.node", import.meta.url)));
+	return loadedAddon;
+}
+//#endregion
 //#region src/config/token-store.ts
 const TOKEN_STORE_KEYCHAIN_SERVICE = "sh.openmeld.auth.token";
 const INSECURE_FALLBACK_ENV_KEY = "OPENMELD_AUTH_ALLOW_INSECURE_FILE_TOKEN";
@@ -44,6 +329,7 @@ const EXEC_FILE_BASE_OPTIONS = {
 	timeout: COMMAND_TIMEOUT_MS
 };
 let insecureFallbackWarningShown = false;
+let macOsPrivateStorageWarningShown = false;
 async function storeAccessToken(input) {
 	const key = buildTokenKey({
 		authBaseUrl: input.authBaseUrl,
@@ -60,8 +346,13 @@ async function storeAccessToken(input) {
 		};
 	}
 	if (process.platform === "darwin") try {
-		const account = buildMacOsAccount(key);
-		await setMacOsKeychainToken({
+		const account = buildUniqueMacOsAccount(key);
+		if (shouldUseNativeMacOsKeychain()) await storeMacOsNativeKeychainToken({
+			account,
+			service: TOKEN_STORE_KEYCHAIN_SERVICE,
+			accessToken: input.accessToken
+		});
+		else await setMacOsKeychainToken({
 			service: TOKEN_STORE_KEYCHAIN_SERVICE,
 			account,
 			accessToken: input.accessToken
@@ -82,7 +373,16 @@ async function storeAccessToken(input) {
 				key
 			};
 		}
-		throw new Error(`failed to store access token in macOS Keychain: ${toErrorMessage(error)}`);
+		const privateKey = buildUniqueTokenFileKey(key);
+		await setInsecureFileToken({
+			key: privateKey,
+			accessToken: input.accessToken
+		});
+		warnMacOsPrivateStorageFallback(error);
+		return {
+			provider: "insecure-file",
+			key: privateKey
+		};
 	}
 	if (process.platform === "win32") try {
 		await setWindowsDpapiToken({
@@ -120,7 +420,7 @@ async function storeAccessToken(input) {
 }
 async function readAccessToken(ref) {
 	try {
-		if (ref.provider === "macos-keychain") return toAccessTokenReadResult(await getMacOsKeychainToken(ref));
+		if (ref.provider === "macos-keychain") return toAccessTokenReadResult(shouldUseNativeMacOsKeychain() ? await readMacOsNativeKeychainToken(ref) : await getMacOsKeychainToken(ref));
 		if (ref.provider === "windows-dpapi") return toAccessTokenReadResult(await getWindowsDpapiToken(ref));
 		if (ref.provider === "insecure-file") return toAccessTokenReadResult(await getInsecureFileToken(ref));
 		return { status: "missing" };
@@ -133,7 +433,7 @@ async function readAccessToken(ref) {
 }
 async function deleteAccessToken(ref) {
 	if (ref.provider === "macos-keychain") {
-		await deleteMacOsKeychainToken(ref).catch(() => void 0);
+		await (shouldUseNativeMacOsKeychain() ? deleteMacOsNativeKeychainToken(ref) : deleteMacOsKeychainToken(ref)).catch(() => void 0);
 		return;
 	}
 	if (ref.provider === "windows-dpapi") {
@@ -146,7 +446,7 @@ function isStoredTokenRef(value) {
 	if (!(value && typeof value === "object")) return false;
 	const record = value;
 	const provider = normalizeString(record.provider);
-	if (provider === "macos-keychain") return Boolean(normalizeString(record.service) && normalizeString(record.account));
+	if (provider === "macos-keychain") return Boolean(normalizeString(record.service) && normalizeString(record.account) && record.accessGroup === void 0);
 	if (provider === "windows-dpapi" || provider === "insecure-file") return normalizeTokenFileKey(record.key) !== null;
 	return false;
 }
@@ -154,8 +454,14 @@ function buildTokenKey(input) {
 	const rootDir = resolve(openMeldRootDir());
 	return createHash("sha256").update(`${input.clientId}\n${input.authBaseUrl}\n${rootDir}`).digest("hex");
 }
-function buildMacOsAccount(key) {
-	return `openmeld-auth-${key}`;
+function buildUniqueMacOsAccount(key) {
+	return `openmeld-auth-${key}-${randomUUID()}`;
+}
+function buildUniqueTokenFileKey(key) {
+	return createHash("sha256").update(`${key}\n${randomUUID()}`).digest("hex");
+}
+function shouldUseNativeMacOsKeychain() {
+	return isBinaryDistribution();
 }
 async function setMacOsKeychainToken(input) {
 	await runCommand("security", [
@@ -218,11 +524,13 @@ async function deleteWindowsDpapiToken(input) {
 	await rm(windowsDpapiTokenPath(input.key), { force: true });
 }
 async function setInsecureFileToken(input) {
-	await mkdir(tokenDirectoryPath(), { recursive: true });
-	await writeFile(insecureTokenPath(input.key), `${input.accessToken}\n`, {
+	await ensurePrivateTokenDirectory();
+	const path = insecureTokenPath(input.key);
+	await writeFile(path, `${input.accessToken}\n`, {
 		encoding: "utf8",
 		mode: 384
 	});
+	if (process.platform !== "win32") await chmod(path, 384);
 }
 async function getInsecureFileToken(input) {
 	const raw = await readFile(insecureTokenPath(input.key), "utf8").catch((error) => {
@@ -252,6 +560,11 @@ function allowInsecureFallback() {
 	if (fallbackEnabled) warnInsecureFallback("platform");
 	return fallbackEnabled;
 }
+function warnMacOsPrivateStorageFallback(error) {
+	if (macOsPrivateStorageWarningShown) return;
+	macOsPrivateStorageWarningShown = true;
+	console.warn(`[openmeld auth] macOS Keychain is unavailable. OpenMeld saved this session in a private file protected for your macOS user account, so setup can continue. A future successful setup or login will move the session back to Keychain. Details: ${toErrorMessage(error)}`);
+}
 function warnInsecureFallback(reason) {
 	if (insecureFallbackWarningShown) return;
 	insecureFallbackWarningShown = true;
@@ -264,6 +577,14 @@ function shouldForceInsecureStore() {
 function isNativeSecureStorePlatform() {
 	return process.platform === "darwin" || process.platform === "win32";
 }
+async function ensurePrivateTokenDirectory() {
+	const directory = tokenDirectoryPath();
+	await mkdir(directory, {
+		recursive: true,
+		mode: 448
+	});
+	if (process.platform !== "win32") await chmod(directory, 448);
+}
 async function runPowerShellScript(script, token, entropy) {
 	const payload = JSON.stringify({
 		token,
@@ -415,6 +736,7 @@ var auth_session_exports = /* @__PURE__ */ __exportAll({
 	updateAuthSessionActiveOrganization: () => updateAuthSessionActiveOrganization
 });
 const TRAILING_SLASHES_RE = /\/+$/u;
+let cachedAuthSession = null;
 async function getAuthSessionState(options = {}) {
 	const localState = await getLocalAuthSessionState();
 	switch (localState.state) {
@@ -445,6 +767,7 @@ async function setAuthSession(input) {
 	if (!authBaseUrl) throw new Error("auth base URL is required");
 	const clientId = String(input.clientId ?? "").trim();
 	if (!clientId) throw new Error("client_id is required");
+	const previousTokenRef = normalizeTokenRef((await readSessionPayload())?.tokenRef);
 	const tokenRef = await storeAccessToken({
 		accessToken,
 		authBaseUrl,
@@ -465,11 +788,23 @@ async function setAuthSession(input) {
 	const path = authSessionPath();
 	await mkdir(join(openMeldRootDir(), "auth"), { recursive: true });
 	try {
+		await assertStoredAccessTokenReloads({
+			accessToken,
+			tokenRef
+		});
 		await writeSessionPayloadAtomically(path, payload);
 	} catch (error) {
 		await deleteAccessToken(tokenRef).catch(() => void 0);
 		throw error;
 	}
+	cacheAuthSession({
+		payload,
+		session: buildStoredAuthSession({
+			accessToken,
+			payload
+		})
+	});
+	if (previousTokenRef && !areStoredTokenRefsEqual(previousTokenRef, tokenRef)) await deleteAccessToken(previousTokenRef).catch(() => void 0);
 }
 async function getAuthSession() {
 	const localState = await getLocalAuthSessionState();
@@ -515,8 +850,17 @@ async function updateAuthSessionActiveOrganization(activeOrganization) {
 		...buildActiveOrganizationPayload(activeOrganization)
 	};
 	await writeSessionPayloadAtomically(authSessionPath(), nextPayload);
+	const currentCachedSession = readCachedAuthSession(payload);
+	if (currentCachedSession) cacheAuthSession({
+		payload: nextPayload,
+		session: buildStoredAuthSession({
+			accessToken: currentCachedSession.accessToken,
+			payload: nextPayload
+		})
+	});
 }
 async function clearAuthSession() {
+	cachedAuthSession = null;
 	const payload = await readSessionPayload();
 	if (payload?.v === 1 && isStoredTokenRef(payload.tokenRef)) await deleteAccessToken(payload.tokenRef).catch(() => void 0);
 	await removeSessionFileBestEffort();
@@ -543,30 +887,37 @@ async function getLocalAuthSessionState() {
 		state: "invalid",
 		session: null
 	};
-	const accessToken = await readAccessToken(tokenRef);
-	if (accessToken.status === "missing") return {
-		reasonCode: "session_token_missing",
-		state: "invalid",
-		session: null
-	};
-	if (accessToken.status === "unavailable") return {
-		errorMessage: accessToken.errorMessage,
-		reasonCode: "session_token_unavailable",
-		state: "invalid",
-		session: null
-	};
-	const session = {
-		v: 1,
-		accessToken: accessToken.accessToken,
-		tokenType,
-		authBaseUrl,
-		clientId,
-		createdAt,
-		...typeof payload.expiresAt === "string" && payload.expiresAt.trim() ? { expiresAt: payload.expiresAt.trim() } : {},
-		...typeof payload.scope === "string" && payload.scope.trim() ? { scope: payload.scope.trim() } : {},
-		...buildAuthUserPayload(payload.user),
-		...buildActiveOrganizationPayload(payload.activeOrganization)
-	};
+	let session = readCachedAuthSession(payload);
+	if (!session) {
+		const accessToken = await readAccessToken(tokenRef);
+		if (accessToken.status === "missing") return {
+			reasonCode: "session_token_missing",
+			state: "invalid",
+			session: null
+		};
+		if (accessToken.status === "unavailable") return {
+			errorMessage: accessToken.errorMessage,
+			reasonCode: "session_token_unavailable",
+			state: "invalid",
+			session: null
+		};
+		session = buildStoredAuthSession({
+			accessToken: accessToken.accessToken,
+			payload: {
+				...payload,
+				v: 1,
+				tokenRef,
+				tokenType,
+				authBaseUrl,
+				clientId,
+				createdAt
+			}
+		});
+		cacheAuthSession({
+			payload,
+			session
+		});
+	}
 	if (isExpired(session.expiresAt)) return {
 		reasonCode: "session_expired",
 		state: "expired",
@@ -577,6 +928,42 @@ async function getLocalAuthSessionState() {
 		session
 	};
 }
+async function assertStoredAccessTokenReloads(input) {
+	const reloaded = await readAccessToken(input.tokenRef);
+	if (reloaded.status === "found" && reloaded.accessToken === input.accessToken) return;
+	if (reloaded.status === "unavailable") throw new Error(`stored access token could not be reloaded: ${reloaded.errorMessage}`);
+	throw new Error("stored access token could not be reloaded");
+}
+function buildStoredAuthSession(input) {
+	return {
+		v: 1,
+		accessToken: input.accessToken,
+		tokenType: input.payload.tokenType,
+		authBaseUrl: input.payload.authBaseUrl,
+		clientId: input.payload.clientId,
+		createdAt: input.payload.createdAt,
+		...typeof input.payload.expiresAt === "string" && input.payload.expiresAt.trim() ? { expiresAt: input.payload.expiresAt.trim() } : {},
+		...typeof input.payload.scope === "string" && input.payload.scope.trim() ? { scope: input.payload.scope.trim() } : {},
+		...buildAuthUserPayload(input.payload.user),
+		...buildActiveOrganizationPayload(input.payload.activeOrganization)
+	};
+}
+function cacheAuthSession(input) {
+	cachedAuthSession = {
+		payloadKey: buildAuthSessionPayloadKey(input.payload),
+		session: input.session
+	};
+}
+function readCachedAuthSession(payload) {
+	const payloadKey = buildAuthSessionPayloadKey(payload);
+	return cachedAuthSession?.payloadKey === payloadKey ? cachedAuthSession.session : null;
+}
+function buildAuthSessionPayloadKey(payload) {
+	return `${authSessionPath()}\n${JSON.stringify(payload)}`;
+}
+function areStoredTokenRefsEqual(left, right) {
+	return JSON.stringify(left) === JSON.stringify(right);
+}
 function normalizeTokenRef(input) {
 	if (!isStoredTokenRef(input)) return null;
 	return input;
@@ -741,6 +1128,6 @@ async function removeSessionFileBestEffort() {
 	await rm(authSessionPath(), { force: true }).catch(() => void 0);
 }
 //#endregion
-export { RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS as A, MIN_SPACE_REQUEST_TIMEOUT_MS as C, REGISTER_RESPONSE_TIMEOUT_MS as D, PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS as E, ROUTE_CATALOG_LOAD_TIMEOUT_MS as O, MIN_HEARTBEAT_INTERVAL_MS as S, PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS as T, DEFAULT_HEARTBEAT_INTERVAL_MS as _, getAuthSessionState as a, MAX_HEARTBEAT_INTERVAL_MS as b, setAuthSession as c, CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS as d, DAEMON_RUNTIME_CONTRACT_EPOCH as f, DEFAULT_GATEWAY_CHAIN_TIMEOUT_MS as g, DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS as h, getAuthSessionMetadata as i, RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS as j, RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS as k, updateAuthSessionActiveOrganization as l, DAEMON_STREAM_KEEPALIVE_INTERVAL_MS as m, clearAuthSession as n, getCurrentAuthOwnerUserId as o, DAEMON_STREAM_CONNECT_TIMEOUT_MS as p, getAuthSession as r, normalizeStoredActiveOrganization as s, auth_session_exports as t, CATALOG_SYNC_RETRY_INTERVAL_MS as u, DEFAULT_SPACE_REQUEST_TIMEOUT_MS as v, OPENCLAW_CLI_TIMEOUT_MS as w, MAX_SPACE_REQUEST_TIMEOUT_MS as x, HEARTBEAT_RESPONSE_TIMEOUT_MS as y };
+export { REGISTER_RESPONSE_TIMEOUT_MS as A, MAX_HEARTBEAT_INTERVAL_MS as C, OPENCLAW_CLI_TIMEOUT_MS as D, MIN_SPACE_REQUEST_TIMEOUT_MS as E, RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS as M, RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS as N, PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS as O, RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS as P, HEARTBEAT_RESPONSE_TIMEOUT_MS as S, MIN_HEARTBEAT_INTERVAL_MS as T, DAEMON_STREAM_KEEPALIVE_INTERVAL_MS as _, getAuthSessionState as a, DEFAULT_HEARTBEAT_INTERVAL_MS as b, setAuthSession as c, isBinaryDistribution as d, resolveOpenMeldDistribution as f, DAEMON_STREAM_CONNECT_TIMEOUT_MS as g, DAEMON_RUNTIME_CONTRACT_EPOCH as h, getAuthSessionMetadata as i, ROUTE_CATALOG_LOAD_TIMEOUT_MS as j, PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS as k, updateAuthSessionActiveOrganization as l, CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS as m, clearAuthSession as n, getCurrentAuthOwnerUserId as o, CATALOG_SYNC_RETRY_INTERVAL_MS as p, getAuthSession as r, normalizeStoredActiveOrganization as s, auth_session_exports as t, runMacOsNativeKeychainHelperIfRequested as u, DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS as v, MAX_SPACE_REQUEST_TIMEOUT_MS as w, DEFAULT_SPACE_REQUEST_TIMEOUT_MS as x, DEFAULT_GATEWAY_CHAIN_TIMEOUT_MS as y };
 
-//# sourceMappingURL=auth-session-73FalW41.js.map
+//# sourceMappingURL=auth-session-yymO5FGR.js.map