openmeld 0.3.96 → 0.3.97

package/dist/{add-me-membership-CWKBMx0m.js → add-me-membership-TYETVUMZ.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { r as runSpaceAddMembers } from "./command-cWXoKcwr.js";
+import { r as runSpaceAddMembers } from "./command-DgODFDCr.js";
 //#region src/space/add-me-membership.ts
 async function runSpaceAddMeMembership(input) {
 	return await runSpaceAddMembers(input);
@@ -8,4 +8,4 @@ async function runSpaceAddMeMembership(input) {
 //#endregion
 export { runSpaceAddMeMembership };
 
-//# sourceMappingURL=add-me-membership-CWKBMx0m.js.map
+//# sourceMappingURL=add-me-membership-TYETVUMZ.js.map

package/dist/{add-me-membership-CWKBMx0m.js.map → add-me-membership-TYETVUMZ.js.map}

@@ -1 +1 @@
-{"version":3,"file":"add-me-membership-CWKBMx0m.js","names":[],"sources":["../src/space/add-me-membership.ts"],"sourcesContent":["import { runSpaceAddMembers } from \"./command\";\nimport type { SpaceCommandNavigationStatus } from \"./navigation-status\";\n\nexport type SpaceAddMeMembershipInput = Parameters<\n  typeof runSpaceAddMembers\n>[0];\nexport type SpaceAddMeMembershipRunner = (\n  input: SpaceAddMeMembershipInput\n) => Promise<SpaceCommandNavigationStatus>;\n\nexport async function runSpaceAddMeMembership(\n  input: SpaceAddMeMembershipInput\n): Promise<SpaceCommandNavigationStatus> {\n  return await runSpaceAddMembers(input);\n}\n"],"mappings":";;;;AAUA,eAAsB,wBACpB,OACuC;CACvC,OAAO,MAAM,mBAAmB,KAAK;AACvC"}
+{"version":3,"file":"add-me-membership-TYETVUMZ.js","names":[],"sources":["../src/space/add-me-membership.ts"],"sourcesContent":["import { runSpaceAddMembers } from \"./command\";\nimport type { SpaceCommandNavigationStatus } from \"./navigation-status\";\n\nexport type SpaceAddMeMembershipInput = Parameters<\n  typeof runSpaceAddMembers\n>[0];\nexport type SpaceAddMeMembershipRunner = (\n  input: SpaceAddMeMembershipInput\n) => Promise<SpaceCommandNavigationStatus>;\n\nexport async function runSpaceAddMeMembership(\n  input: SpaceAddMeMembershipInput\n): Promise<SpaceCommandNavigationStatus> {\n  return await runSpaceAddMembers(input);\n}\n"],"mappings":";;;;AAUA,eAAsB,wBACpB,OACuC;CACvC,OAAO,MAAM,mBAAmB,KAAK;AACvC"}

package/dist/{api-client-foundation-BJIJ540D.js → api-client-foundation-BCbhO6xe.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 import { T as normalizeBaseUrl, _n as __exportAll } from "./base-url-Cv9x5Es9.js";
-import { I as OPENMELD_HEADER_REQUESTED_ORGANIZATION_ID, R as buildOpenMeldRequestContextHeaders, h as createOpenMeldApiClient } from "./dist-BBWU3O-I.js";
+import { I as OPENMELD_HEADER_REQUESTED_ORGANIZATION_ID, R as buildOpenMeldRequestContextHeaders, h as createOpenMeldApiClient } from "./dist-BH4D3j09.js";
 import { E as MIN_SPACE_REQUEST_TIMEOUT_MS, a as getAuthSessionState, w as MAX_SPACE_REQUEST_TIMEOUT_MS, x as DEFAULT_SPACE_REQUEST_TIMEOUT_MS } from "./auth-session-BcT7IOfJ.js";
 import crypto from "node:crypto";
 //#region src/config/auth-request-compatibility.ts
@@ -381,4 +381,4 @@ function createCliApiClientFoundation(baseUrl, options = {}) {
 //#endregion
 export { buildOpenMeldProfileIdentityRequestHeadersWithAuth as a, buildRequestAuthHeaders as c, buildOpenMeldRequestContextFromProfile as d, buildOpenMeldRequestContextFromProfileIdentity as f, resolveSpaceRequestTimeoutMsForDiagnostics as i, canAttachAuthTokenToRequest as l, resolveAuthRequestCompatibility as m, createCliApiClientFoundation as n, buildOpenMeldProfileRequestHeadersWithAuth as o, deriveAuthBaseUrlFromGatewayUrl as p, fetchSpaceRequestWithTimeout as r, buildOpenMeldRequestContextHeadersWithAuth as s, api_client_foundation_exports as t, resolveAuthTokenAttachment as u };
 
-//# sourceMappingURL=api-client-foundation-BJIJ540D.js.map
+//# sourceMappingURL=api-client-foundation-BCbhO6xe.js.map

package/dist/{api-client-foundation-BJIJ540D.js.map → api-client-foundation-BCbhO6xe.js.map}

@@ -1 +1 @@
-{"version":3,"file":"api-client-foundation-BJIJ540D.js","names":["resolveSpaceRequestTimeoutMsForDiagnostics","resolveSpaceRequestTimeoutMsForCliDiagnostics"],"sources":["../src/config/auth-request-compatibility.ts","../src/config/openmeld-request-context.ts","../src/config/request-headers.ts","../src/space/request-timeout.ts","../src/space/fetch-with-timeout.ts","../src/space/api-client-foundation.ts"],"sourcesContent":["import { normalizeBaseUrl } from \"../protocol/urls\";\nimport type { StoredAuthSession } from \"./auth-session\";\n\nexport type AuthRequestCompatibilityReason =\n  | \"invalid_request_url\"\n  | \"invalid_auth_url\"\n  | \"insecure_transport\"\n  | \"host_mismatch\"\n  | \"loopback\"\n  | \"same_host\"\n  | \"gateway_sibling\";\n\nexport type AuthRequestCompatibility = {\n  compatible: boolean;\n  reason: AuthRequestCompatibilityReason;\n  requestHost: string | null;\n  authHost: string | null;\n  expectedGatewayHost: string | null;\n};\n\nexport function resolveAuthRequestCompatibility(input: {\n  session: StoredAuthSession;\n  requestUrl: string;\n}): AuthRequestCompatibility {\n  const requestUrl = parseUrlOrNull(input.requestUrl);\n  if (!requestUrl) {\n    return {\n      compatible: false,\n      reason: \"invalid_request_url\",\n      requestHost: null,\n      authHost: null,\n      expectedGatewayHost: null,\n    };\n  }\n\n  const authBaseUrl = parseUrlOrNull(input.session.authBaseUrl);\n  if (!authBaseUrl) {\n    return {\n      compatible: false,\n      reason: \"invalid_auth_url\",\n      requestHost: requestUrl.host,\n      authHost: null,\n      expectedGatewayHost: null,\n    };\n  }\n\n  const expectedGatewayHost = deriveGatewayHost(authBaseUrl);\n  const requestHost = requestUrl.host;\n  const authHost = authBaseUrl.host;\n\n  if (\n    isLoopbackHostname(requestUrl.hostname) &&\n    isLoopbackHostname(authBaseUrl.hostname)\n  ) {\n    return {\n      compatible: true,\n      reason: \"loopback\",\n      requestHost,\n      authHost,\n      expectedGatewayHost,\n    };\n  }\n\n  if (!isSecureTransportProtocol(requestUrl.protocol)) {\n    return {\n      compatible: false,\n      reason: \"insecure_transport\",\n      requestHost,\n      authHost,\n      expectedGatewayHost,\n    };\n  }\n\n  if (requestHost === authHost) {\n    return {\n      compatible: true,\n      reason: \"same_host\",\n      requestHost,\n      authHost,\n      expectedGatewayHost,\n    };\n  }\n\n  if (expectedGatewayHost && requestHost === expectedGatewayHost) {\n    return {\n      compatible: true,\n      reason: \"gateway_sibling\",\n      requestHost,\n      authHost,\n      expectedGatewayHost,\n    };\n  }\n\n  return {\n    compatible: false,\n    reason: \"host_mismatch\",\n    requestHost,\n    authHost,\n    expectedGatewayHost,\n  };\n}\n\nexport function canUseAuthSessionForRequest(input: {\n  session: StoredAuthSession;\n  requestUrl: string;\n}): boolean {\n  return resolveAuthRequestCompatibility(input).compatible;\n}\n\nexport function deriveAuthBaseUrlFromGatewayUrl(\n  gatewayUrl: string\n): string | null {\n  const parsed = parseUrlOrNull(gatewayUrl);\n  if (!parsed) {\n    return null;\n  }\n  if (!isHttpTransportProtocol(parsed.protocol)) {\n    return null;\n  }\n  if (!parsed.hostname.startsWith(\"gateway.\")) {\n    return null;\n  }\n\n  const authUrl = new URL(parsed.toString());\n  authUrl.hostname = `auth.${parsed.hostname.slice(\"gateway.\".length)}`;\n  authUrl.pathname = \"/\";\n  authUrl.search = \"\";\n  authUrl.hash = \"\";\n  return normalizeBaseUrl(authUrl.toString());\n}\n\nfunction deriveGatewayHost(authBaseUrl: URL): string | null {\n  if (!authBaseUrl.hostname.startsWith(\"auth.\")) {\n    return null;\n  }\n\n  const gatewayUrl = new URL(authBaseUrl.toString());\n  gatewayUrl.hostname = `gateway.${authBaseUrl.hostname.slice(\"auth.\".length)}`;\n  return gatewayUrl.host;\n}\n\nfunction parseUrlOrNull(value: string): URL | null {\n  try {\n    return new URL(value);\n  } catch {\n    return null;\n  }\n}\n\nfunction isLoopbackHostname(hostname: string): boolean {\n  return (\n    hostname === \"localhost\" || hostname === \"127.0.0.1\" || hostname === \"::1\"\n  );\n}\n\nfunction isSecureTransportProtocol(protocol: string): boolean {\n  return protocol === \"https:\" || protocol === \"wss:\";\n}\n\nfunction isHttpTransportProtocol(protocol: string): boolean {\n  return protocol === \"http:\" || protocol === \"https:\";\n}\n","import crypto from \"node:crypto\";\nimport type { OpenMeldRequestContext } from \"@openmeld/schemas/types\";\nimport type { OpenMeldProfile } from \"./openmeld-profiles-api\";\n\nexport type OpenMeldRequestContextProfileIdentity = {\n  openMeldProfileId: string;\n  profileKind?: \"human\" | \"agent\" | \"system\";\n  kind?: \"human\" | \"agent\";\n  profileHandle?: string;\n  profileName: string;\n  ownerUserId?: string;\n  ownerName?: string;\n  agentControllerConversationId?: string;\n};\n\nexport function buildOpenMeldRequestContextFromProfile(input: {\n  openMeldProfile: OpenMeldProfile;\n  requestId?: string;\n  agentControllerConversationId?: string;\n}): OpenMeldRequestContext {\n  const requestId =\n    normalizeOptionalText(input.requestId) ?? crypto.randomUUID();\n  const agentControllerConversationId = normalizeOptionalText(\n    input.agentControllerConversationId\n  );\n  const ownerName = normalizeOptionalText(input.openMeldProfile.ownerName);\n\n  return {\n    actorContext: {\n      requestId,\n      openMeldProfileId: input.openMeldProfile.openMeldProfileId,\n      profileKind: input.openMeldProfile.profileKind,\n      profileHandle: input.openMeldProfile.profileHandle,\n      profileName: input.openMeldProfile.profileName,\n      ownerUserId: input.openMeldProfile.ownerUserId,\n      ...(ownerName ? { ownerName } : {}),\n    },\n    ...(agentControllerConversationId ? { agentControllerConversationId } : {}),\n  };\n}\n\nexport function buildOpenMeldRequestContextFromProfileIdentity(input: {\n  profileIdentity: OpenMeldRequestContextProfileIdentity;\n  requestId?: string;\n}): OpenMeldRequestContext {\n  const requestId =\n    normalizeOptionalText(input.requestId) ?? crypto.randomUUID();\n  const profileHandle = normalizeOptionalText(\n    input.profileIdentity.profileHandle\n  );\n  const ownerUserId = normalizeOptionalText(input.profileIdentity.ownerUserId);\n  const ownerName = normalizeOptionalText(input.profileIdentity.ownerName);\n  const agentControllerConversationId = normalizeOptionalText(\n    input.profileIdentity.agentControllerConversationId\n  );\n  const profileKind =\n    input.profileIdentity.profileKind ??\n    (input.profileIdentity.kind === \"human\" ||\n    input.profileIdentity.kind === \"agent\"\n      ? input.profileIdentity.kind\n      : \"system\");\n\n  return {\n    actorContext: {\n      requestId,\n      openMeldProfileId: input.profileIdentity.openMeldProfileId,\n      profileKind,\n      ...(profileHandle ? { profileHandle } : {}),\n      profileName: input.profileIdentity.profileName,\n      ...(ownerUserId ? { ownerUserId } : {}),\n      ...(ownerName ? { ownerName } : {}),\n    },\n    ...(agentControllerConversationId ? { agentControllerConversationId } : {}),\n  };\n}\n\nfunction normalizeOptionalText(value: unknown): string | null {\n  const normalized = String(value ?? \"\").trim();\n  return normalized.length > 0 ? normalized : null;\n}\n","import {\n  buildOpenMeldRequestContextHeaders,\n  type OpenMeldRequestContextHeadersInput,\n} from \"@openmeld/gateway-contract\";\nimport type { OpenMeldRequestContext } from \"@openmeld/schemas/types\";\nimport {\n  type AuthRequestCompatibilityReason,\n  canUseAuthSessionForRequest,\n  resolveAuthRequestCompatibility,\n} from \"./auth-request-compatibility\";\nimport { getAuthSessionState, type StoredAuthSession } from \"./auth-session\";\nimport type { OpenMeldProfile } from \"./openmeld-profiles-api\";\nimport {\n  buildOpenMeldRequestContextFromProfile,\n  buildOpenMeldRequestContextFromProfileIdentity,\n  type OpenMeldRequestContextProfileIdentity,\n} from \"./openmeld-request-context\";\n\nconst DEFAULT_TOKEN_TYPE = \"Bearer\";\nconst AUTHORIZATION_HEADER = \"Authorization\";\n\ntype RequestAuthHeadersInput = {\n  authSession?: StoredAuthSession | null;\n  requestUrl: string;\n};\n\ntype OpenMeldRequestContextHeadersWithAuthInput =\n  OpenMeldRequestContextHeadersInput & {\n    authSession?: StoredAuthSession | null;\n    requestUrl: string;\n  };\n\nexport type AuthTokenAttachment =\n  | {\n      status: \"attachable\";\n      token: string;\n      tokenType: string;\n    }\n  | {\n      status: \"dropped\";\n      reason: \"empty_token\" | AuthRequestCompatibilityReason;\n      requestHost: string | null;\n      authHost: string | null;\n      expectedGatewayHost: string | null;\n    };\n\nexport type DroppedAuthTokenAttachment = Extract<\n  AuthTokenAttachment,\n  { status: \"dropped\" }\n>;\n\nexport async function buildRequestAuthHeaders(\n  input: RequestAuthHeadersInput\n): Promise<Record<string, string>> {\n  const headers: Record<string, string> = {};\n  await attachAuthHeader(headers, input);\n  return headers;\n}\n\nexport async function buildOpenMeldRequestContextHeadersWithAuth(\n  input: OpenMeldRequestContextHeadersWithAuthInput\n): Promise<Record<string, string>> {\n  const headers = buildOpenMeldRequestContextHeaders(input);\n  await attachAuthHeader(headers, input);\n  return headers;\n}\n\nexport async function buildOpenMeldProfileRequestHeadersWithAuth(input: {\n  openMeldProfile: OpenMeldProfile;\n  requestUrl: string;\n  authSession?: StoredAuthSession | null;\n  agentControllerConversationId?: string;\n  spacePassword?: string;\n}): Promise<Record<string, string>> {\n  return await buildOpenMeldRequestContextHeadersWithAuth({\n    requestContext: buildOpenMeldRequestContextFromProfile({\n      openMeldProfile: input.openMeldProfile,\n      agentControllerConversationId: input.agentControllerConversationId,\n    }),\n    requestUrl: input.requestUrl,\n    ...(input.authSession === undefined\n      ? {}\n      : { authSession: input.authSession }),\n    ...(input.spacePassword === undefined\n      ? {}\n      : { spacePassword: input.spacePassword }),\n  });\n}\n\nexport async function buildOpenMeldProfileIdentityRequestHeadersWithAuth(input: {\n  profileIdentity: OpenMeldRequestContextProfileIdentity;\n  requestUrl: string;\n  authSession?: StoredAuthSession | null;\n  spacePassword?: string;\n}): Promise<Record<string, string>> {\n  return await buildOpenMeldRequestContextHeadersWithAuth({\n    requestContext: buildOpenMeldRequestContextFromProfileIdentity({\n      profileIdentity: input.profileIdentity,\n    }),\n    requestUrl: input.requestUrl,\n    ...(input.authSession === undefined\n      ? {}\n      : { authSession: input.authSession }),\n    ...(input.spacePassword === undefined\n      ? {}\n      : { spacePassword: input.spacePassword }),\n  });\n}\n\nexport function withSpacePassword(\n  requestContext: OpenMeldRequestContext,\n  spacePassword?: string\n): OpenMeldRequestContextHeadersInput {\n  return {\n    requestContext,\n    ...(spacePassword === undefined ? {} : { spacePassword }),\n  };\n}\n\n// One decision for \"can this stored session authenticate this request\", with\n// the drop reason preserved. Header building and the daemon stream connect\n// gate must share this so they cannot drift apart.\nexport function resolveAuthTokenAttachment(input: {\n  session: StoredAuthSession;\n  requestUrl: string;\n}): AuthTokenAttachment {\n  const compatibility = resolveAuthRequestCompatibility({\n    session: input.session,\n    requestUrl: input.requestUrl,\n  });\n  const token = normalizeAccessToken(input.session);\n  if (!token) {\n    return {\n      status: \"dropped\",\n      reason: \"empty_token\",\n      requestHost: compatibility.requestHost,\n      authHost: compatibility.authHost,\n      expectedGatewayHost: compatibility.expectedGatewayHost,\n    };\n  }\n  if (!compatibility.compatible) {\n    return {\n      status: \"dropped\",\n      reason: compatibility.reason,\n      requestHost: compatibility.requestHost,\n      authHost: compatibility.authHost,\n      expectedGatewayHost: compatibility.expectedGatewayHost,\n    };\n  }\n  return {\n    status: \"attachable\",\n    token,\n    tokenType: normalizeTokenType(input.session.tokenType),\n  };\n}\n\nasync function attachAuthHeader(\n  headers: Record<string, string>,\n  input: RequestAuthHeadersInput\n): Promise<void> {\n  const session = await resolveAuthSessionForHeaders(input);\n  if (session === null) {\n    // No stored credentials exist, so there is nothing to strip: the caller\n    // is knowingly sending an unauthenticated request.\n    return;\n  }\n\n  const attachment = resolveAuthTokenAttachment({\n    session,\n    requestUrl: input.requestUrl,\n  });\n  if (attachment.status === \"dropped\") {\n    // The caller holds a session it believes is usable. Dropping the token is\n    // still the safe outcome (never leak credentials to an incompatible\n    // host), but it must stay visible in diagnostics instead of silently\n    // dialing bare and surfacing as a remote 401.\n    warnDroppedAuthToken(attachment);\n    return;\n  }\n  headers[AUTHORIZATION_HEADER] = `${attachment.tokenType} ${attachment.token}`;\n}\n\nfunction warnDroppedAuthToken(attachment: DroppedAuthTokenAttachment): void {\n  console.warn(\"[openmeld.auth.request_token_dropped]\", {\n    authHost: attachment.authHost,\n    expectedGatewayHost: attachment.expectedGatewayHost,\n    reason: attachment.reason,\n    requestHost: attachment.requestHost,\n  });\n}\n\nasync function resolveAuthSessionForHeaders(\n  input: RequestAuthHeadersInput\n): Promise<StoredAuthSession | null> {\n  if (input.authSession !== undefined) {\n    return input.authSession;\n  }\n\n  const sessionState = await getAuthSessionState();\n  if (sessionState.state !== \"valid\" || sessionState.session === null) {\n    return null;\n  }\n\n  return sessionState.session;\n}\n\nfunction normalizeAccessToken(session: StoredAuthSession): string {\n  return String(session.accessToken ?? \"\").trim();\n}\n\nfunction normalizeTokenType(tokenType: string | undefined): string {\n  const normalized = String(tokenType ?? \"\").trim();\n  return normalized.length > 0 ? normalized : DEFAULT_TOKEN_TYPE;\n}\n\nexport function canAttachAuthTokenToRequest(\n  session: StoredAuthSession,\n  requestUrl: string\n): boolean {\n  return canUseAuthSessionForRequest({\n    session,\n    requestUrl,\n  });\n}\n","import {\n  DEFAULT_SPACE_CONVERSATION_VALIDATE_TIMEOUT_MS,\n  DEFAULT_SPACE_REQUEST_TIMEOUT_MS,\n  MAX_SPACE_REQUEST_TIMEOUT_MS,\n  MIN_SPACE_REQUEST_TIMEOUT_MS,\n} from \"../strategy-constants\";\n\nconst SPACE_REQUEST_TIMEOUT_ENV_KEY = \"OPENMELD_SPACE_REQUEST_TIMEOUT_MS\";\n\nexport function resolveSpaceRequestTimeoutMs(override?: number): number {\n  if (isFinitePositiveNumber(override)) {\n    return clampSpaceRequestTimeoutMs(override);\n  }\n\n  const fromEnv = Number.parseInt(\n    String(process.env[SPACE_REQUEST_TIMEOUT_ENV_KEY] ?? \"\"),\n    10\n  );\n  if (isFinitePositiveNumber(fromEnv)) {\n    return clampSpaceRequestTimeoutMs(fromEnv);\n  }\n\n  return DEFAULT_SPACE_REQUEST_TIMEOUT_MS;\n}\n\nexport function resolveSpaceRequestTimeoutMsForDiagnostics(): number {\n  return resolveSpaceRequestTimeoutMs(undefined);\n}\n\nexport function resolveSpaceConversationValidateTimeoutMs(): number {\n  return Math.max(\n    resolveSpaceRequestTimeoutMs(undefined),\n    DEFAULT_SPACE_CONVERSATION_VALIDATE_TIMEOUT_MS\n  );\n}\n\nfunction clampSpaceRequestTimeoutMs(value: number): number {\n  const normalized = Math.trunc(value);\n  return Math.max(\n    MIN_SPACE_REQUEST_TIMEOUT_MS,\n    Math.min(MAX_SPACE_REQUEST_TIMEOUT_MS, normalized)\n  );\n}\n\nfunction isFinitePositiveNumber(value: unknown): value is number {\n  return typeof value === \"number\" && Number.isFinite(value) && value > 0;\n}\n","import {\n  resolveSpaceRequestTimeoutMs,\n  resolveSpaceRequestTimeoutMsForDiagnostics as resolveSpaceRequestTimeoutMsForCliDiagnostics,\n} from \"./request-timeout\";\n\nexport async function fetchSpaceRequestWithTimeout(input: {\n  url: string;\n  operation: string;\n  init?: RequestInit;\n  timeoutMs?: number;\n}): Promise<Response> {\n  const timeoutMs = resolveSpaceRequestTimeoutMs(input.timeoutMs);\n  const timeoutSignal = AbortSignal.timeout(timeoutMs);\n  const composed = composeAbortSignals(input.init?.signal, timeoutSignal);\n\n  try {\n    try {\n      return await fetch(input.url, {\n        ...input.init,\n        signal: composed.signal,\n      });\n    } catch (error) {\n      // A keep-alive connection that a proxy silently dropped fails exactly\n      // once and undici evicts it; the retry rides a fresh connection. This\n      // is what keeps a long-lived service working behind flaky proxies\n      // without asking users to touch their network config.\n      if (\n        timeoutSignal.aborted ||\n        composed.signal.aborted ||\n        !shouldWrapNetworkRequestError(error)\n      ) {\n        throw error;\n      }\n      return await fetch(input.url, {\n        ...input.init,\n        signal: composed.signal,\n      });\n    }\n  } catch (error) {\n    if (timeoutSignal.aborted) {\n      throw createSpaceRequestTimeoutError({\n        operation: input.operation,\n        timeoutMs,\n        cause: error,\n      });\n    }\n    if (shouldWrapNetworkRequestError(error)) {\n      throw createSpaceRequestNetworkError({\n        operation: input.operation,\n        url: input.url,\n        cause: error,\n      });\n    }\n    throw error;\n  } finally {\n    composed.cleanup();\n  }\n}\n\nexport function resolveSpaceRequestTimeoutMsForDiagnostics(): number {\n  return resolveSpaceRequestTimeoutMsForCliDiagnostics();\n}\n\nfunction createSpaceRequestTimeoutError(input: {\n  operation: string;\n  timeoutMs: number;\n  cause: unknown;\n}): Error {\n  const error = new Error(\n    `${input.operation} request timed out after ${input.timeoutMs}ms`,\n    { cause: input.cause }\n  ) as Error & { code?: string };\n  error.code = \"network.timeout\";\n  return error;\n}\n\nfunction createSpaceRequestNetworkError(input: {\n  operation: string;\n  url: string;\n  cause: unknown;\n}): Error {\n  const error = new Error(\n    `${input.operation} request could not reach ${describeRequestTarget(input.url)} (${toErrorMessage(input.cause)})`,\n    { cause: input.cause }\n  ) as Error & { code?: string };\n  error.code = \"network.request_failed\";\n  return error;\n}\n\nfunction composeAbortSignals(\n  parent: AbortSignal | null | undefined,\n  timeout: AbortSignal\n): { signal: AbortSignal; cleanup: () => void } {\n  if (!parent) {\n    return {\n      signal: timeout,\n      cleanup: () => undefined,\n    };\n  }\n\n  if (parent.aborted || timeout.aborted) {\n    const controller = new AbortController();\n    controller.abort();\n    return {\n      signal: controller.signal,\n      cleanup: () => undefined,\n    };\n  }\n\n  const controller = new AbortController();\n  const abort = () => {\n    controller.abort();\n  };\n\n  parent.addEventListener(\"abort\", abort, { once: true });\n  timeout.addEventListener(\"abort\", abort, { once: true });\n\n  return {\n    signal: controller.signal,\n    cleanup: () => {\n      parent.removeEventListener(\"abort\", abort);\n      timeout.removeEventListener(\"abort\", abort);\n    },\n  };\n}\n\nfunction describeRequestTarget(url: string): string {\n  try {\n    return new URL(url).origin;\n  } catch {\n    return url;\n  }\n}\n\nfunction toErrorMessage(error: unknown): string {\n  if (error instanceof Error) {\n    const message = error.message.trim();\n    return message.length > 0 ? message : \"request failed\";\n  }\n  const message = String(error ?? \"\").trim();\n  return message.length > 0 ? message : \"request failed\";\n}\n\nfunction shouldWrapNetworkRequestError(error: unknown): boolean {\n  if (error instanceof TypeError) {\n    return true;\n  }\n  if (\n    typeof error === \"object\" &&\n    error !== null &&\n    \"code\" in error &&\n    typeof error.code === \"string\" &&\n    error.code.startsWith(\"ERR_SSL_\")\n  ) {\n    return true;\n  }\n  const message = toErrorMessage(error).toLowerCase();\n  return (\n    message.includes(\"fetch failed\") ||\n    message.includes(\"failed to fetch\") ||\n    message.includes(\"network request failed\") ||\n    message.includes(\"ssl_decryption_failed_or_bad_record_mac\")\n  );\n}\n","import {\n  createOpenMeldApiClient,\n  type OpenMeldApiClientFoundation,\n} from \"@openmeld/api-client\";\nimport {\n  buildOpenMeldRequestContextHeaders,\n  OPENMELD_HEADER_REQUESTED_ORGANIZATION_ID,\n} from \"@openmeld/gateway-contract\";\nimport { buildRequestAuthHeaders } from \"../config/request-headers\";\nimport { fetchSpaceRequestWithTimeout } from \"./fetch-with-timeout\";\n\nexport function createCliApiClientFoundation(\n  baseUrl: string,\n  options: {\n    onAuthHeadersResolved?: (headers: Record<string, string>) => void;\n    organizationId?: string;\n  } = {}\n): OpenMeldApiClientFoundation {\n  return createOpenMeldApiClient({\n    baseUrl,\n    transport: async (request) =>\n      await fetchSpaceRequestWithTimeout({\n        url: request.url,\n        operation: request.operation,\n        init: request.init,\n        timeoutMs: request.timeoutMs,\n      }),\n    getAuthHeaders: async ({ requestUrl }) => {\n      const headers = await buildRequestAuthHeaders({\n        requestUrl,\n      });\n      if (options.organizationId) {\n        headers[OPENMELD_HEADER_REQUESTED_ORGANIZATION_ID] =\n          options.organizationId;\n      }\n      options.onAuthHeadersResolved?.(headers);\n      return headers;\n    },\n    getRequestContextHeaders: async ({ requestContext, spacePassword }) =>\n      buildOpenMeldRequestContextHeaders({\n        requestContext,\n        ...(spacePassword === undefined ? {} : { spacePassword }),\n      }),\n  });\n}\n"],"mappings":";;;;;;;AAoBA,SAAgB,gCAAgC,OAGnB;CAC3B,MAAM,aAAa,eAAe,MAAM,UAAU;CAClD,IAAI,CAAC,YACH,OAAO;EACL,YAAY;EACZ,QAAQ;EACR,aAAa;EACb,UAAU;EACV,qBAAqB;CACvB;CAGF,MAAM,cAAc,eAAe,MAAM,QAAQ,WAAW;CAC5D,IAAI,CAAC,aACH,OAAO;EACL,YAAY;EACZ,QAAQ;EACR,aAAa,WAAW;EACxB,UAAU;EACV,qBAAqB;CACvB;CAGF,MAAM,sBAAsB,kBAAkB,WAAW;CACzD,MAAM,cAAc,WAAW;CAC/B,MAAM,WAAW,YAAY;CAE7B,IACE,mBAAmB,WAAW,QAAQ,KACtC,mBAAmB,YAAY,QAAQ,GAEvC,OAAO;EACL,YAAY;EACZ,QAAQ;EACR;EACA;EACA;CACF;CAGF,IAAI,CAAC,0BAA0B,WAAW,QAAQ,GAChD,OAAO;EACL,YAAY;EACZ,QAAQ;EACR;EACA;EACA;CACF;CAGF,IAAI,gBAAgB,UAClB,OAAO;EACL,YAAY;EACZ,QAAQ;EACR;EACA;EACA;CACF;CAGF,IAAI,uBAAuB,gBAAgB,qBACzC,OAAO;EACL,YAAY;EACZ,QAAQ;EACR;EACA;EACA;CACF;CAGF,OAAO;EACL,YAAY;EACZ,QAAQ;EACR;EACA;EACA;CACF;AACF;AAEA,SAAgB,4BAA4B,OAGhC;CACV,OAAO,gCAAgC,KAAK,CAAC,CAAC;AAChD;AAEA,SAAgB,gCACd,YACe;CACf,MAAM,SAAS,eAAe,UAAU;CACxC,IAAI,CAAC,QACH,OAAO;CAET,IAAI,CAAC,wBAAwB,OAAO,QAAQ,GAC1C,OAAO;CAET,IAAI,CAAC,OAAO,SAAS,WAAW,UAAU,GACxC,OAAO;CAGT,MAAM,UAAU,IAAI,IAAI,OAAO,SAAS,CAAC;CACzC,QAAQ,WAAW,QAAQ,OAAO,SAAS,MAAM,CAAiB;CAClE,QAAQ,WAAW;CACnB,QAAQ,SAAS;CACjB,QAAQ,OAAO;CACf,OAAO,iBAAiB,QAAQ,SAAS,CAAC;AAC5C;AAEA,SAAS,kBAAkB,aAAiC;CAC1D,IAAI,CAAC,YAAY,SAAS,WAAW,OAAO,GAC1C,OAAO;CAGT,MAAM,aAAa,IAAI,IAAI,YAAY,SAAS,CAAC;CACjD,WAAW,WAAW,WAAW,YAAY,SAAS,MAAM,CAAc;CAC1E,OAAO,WAAW;AACpB;AAEA,SAAS,eAAe,OAA2B;CACjD,IAAI;EACF,OAAO,IAAI,IAAI,KAAK;CACtB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,mBAAmB,UAA2B;CACrD,OACE,aAAa,eAAe,aAAa,eAAe,aAAa;AAEzE;AAEA,SAAS,0BAA0B,UAA2B;CAC5D,OAAO,aAAa,YAAY,aAAa;AAC/C;AAEA,SAAS,wBAAwB,UAA2B;CAC1D,OAAO,aAAa,WAAW,aAAa;AAC9C;;;AClJA,SAAgB,uCAAuC,OAI5B;CACzB,MAAM,YACJ,sBAAsB,MAAM,SAAS,KAAK,OAAO,WAAW;CAC9D,MAAM,gCAAgC,sBACpC,MAAM,6BACR;CACA,MAAM,YAAY,sBAAsB,MAAM,gBAAgB,SAAS;CAEvE,OAAO;EACL,cAAc;GACZ;GACA,mBAAmB,MAAM,gBAAgB;GACzC,aAAa,MAAM,gBAAgB;GACnC,eAAe,MAAM,gBAAgB;GACrC,aAAa,MAAM,gBAAgB;GACnC,aAAa,MAAM,gBAAgB;GACnC,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;EACnC;EACA,GAAI,gCAAgC,EAAE,8BAA8B,IAAI,CAAC;CAC3E;AACF;AAEA,SAAgB,+CAA+C,OAGpC;CACzB,MAAM,YACJ,sBAAsB,MAAM,SAAS,KAAK,OAAO,WAAW;CAC9D,MAAM,gBAAgB,sBACpB,MAAM,gBAAgB,aACxB;CACA,MAAM,cAAc,sBAAsB,MAAM,gBAAgB,WAAW;CAC3E,MAAM,YAAY,sBAAsB,MAAM,gBAAgB,SAAS;CACvE,MAAM,gCAAgC,sBACpC,MAAM,gBAAgB,6BACxB;CACA,MAAM,cACJ,MAAM,gBAAgB,gBACrB,MAAM,gBAAgB,SAAS,WAChC,MAAM,gBAAgB,SAAS,UAC3B,MAAM,gBAAgB,OACtB;CAEN,OAAO;EACL,cAAc;GACZ;GACA,mBAAmB,MAAM,gBAAgB;GACzC;GACA,GAAI,gBAAgB,EAAE,cAAc,IAAI,CAAC;GACzC,aAAa,MAAM,gBAAgB;GACnC,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;GACrC,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;EACnC;EACA,GAAI,gCAAgC,EAAE,8BAA8B,IAAI,CAAC;CAC3E;AACF;AAEA,SAAS,sBAAsB,OAA+B;CAC5D,MAAM,aAAa,OAAO,SAAS,EAAE,CAAC,CAAC,KAAK;CAC5C,OAAO,WAAW,SAAS,IAAI,aAAa;AAC9C;;;AC7DA,MAAM,qBAAqB;AAC3B,MAAM,uBAAuB;AAgC7B,eAAsB,wBACpB,OACiC;CACjC,MAAM,UAAkC,CAAC;CACzC,MAAM,iBAAiB,SAAS,KAAK;CACrC,OAAO;AACT;AAEA,eAAsB,2CACpB,OACiC;CACjC,MAAM,UAAU,mCAAmC,KAAK;CACxD,MAAM,iBAAiB,SAAS,KAAK;CACrC,OAAO;AACT;AAEA,eAAsB,2CAA2C,OAM7B;CAClC,OAAO,MAAM,2CAA2C;EACtD,gBAAgB,uCAAuC;GACrD,iBAAiB,MAAM;GACvB,+BAA+B,MAAM;EACvC,CAAC;EACD,YAAY,MAAM;EAClB,GAAI,MAAM,gBAAgB,KAAA,IACtB,CAAC,IACD,EAAE,aAAa,MAAM,YAAY;EACrC,GAAI,MAAM,kBAAkB,KAAA,IACxB,CAAC,IACD,EAAE,eAAe,MAAM,cAAc;CAC3C,CAAC;AACH;AAEA,eAAsB,mDAAmD,OAKrC;CAClC,OAAO,MAAM,2CAA2C;EACtD,gBAAgB,+CAA+C,EAC7D,iBAAiB,MAAM,gBACzB,CAAC;EACD,YAAY,MAAM;EAClB,GAAI,MAAM,gBAAgB,KAAA,IACtB,CAAC,IACD,EAAE,aAAa,MAAM,YAAY;EACrC,GAAI,MAAM,kBAAkB,KAAA,IACxB,CAAC,IACD,EAAE,eAAe,MAAM,cAAc;CAC3C,CAAC;AACH;AAeA,SAAgB,2BAA2B,OAGnB;CACtB,MAAM,gBAAgB,gCAAgC;EACpD,SAAS,MAAM;EACf,YAAY,MAAM;CACpB,CAAC;CACD,MAAM,QAAQ,qBAAqB,MAAM,OAAO;CAChD,IAAI,CAAC,OACH,OAAO;EACL,QAAQ;EACR,QAAQ;EACR,aAAa,cAAc;EAC3B,UAAU,cAAc;EACxB,qBAAqB,cAAc;CACrC;CAEF,IAAI,CAAC,cAAc,YACjB,OAAO;EACL,QAAQ;EACR,QAAQ,cAAc;EACtB,aAAa,cAAc;EAC3B,UAAU,cAAc;EACxB,qBAAqB,cAAc;CACrC;CAEF,OAAO;EACL,QAAQ;EACR;EACA,WAAW,mBAAmB,MAAM,QAAQ,SAAS;CACvD;AACF;AAEA,eAAe,iBACb,SACA,OACe;CACf,MAAM,UAAU,MAAM,6BAA6B,KAAK;CACxD,IAAI,YAAY,MAGd;CAGF,MAAM,aAAa,2BAA2B;EAC5C;EACA,YAAY,MAAM;CACpB,CAAC;CACD,IAAI,WAAW,WAAW,WAAW;EAKnC,qBAAqB,UAAU;EAC/B;CACF;CACA,QAAQ,wBAAwB,GAAG,WAAW,UAAU,GAAG,WAAW;AACxE;AAEA,SAAS,qBAAqB,YAA8C;CAC1E,QAAQ,KAAK,yCAAyC;EACpD,UAAU,WAAW;EACrB,qBAAqB,WAAW;EAChC,QAAQ,WAAW;EACnB,aAAa,WAAW;CAC1B,CAAC;AACH;AAEA,eAAe,6BACb,OACmC;CACnC,IAAI,MAAM,gBAAgB,KAAA,GACxB,OAAO,MAAM;CAGf,MAAM,eAAe,MAAM,oBAAoB;CAC/C,IAAI,aAAa,UAAU,WAAW,aAAa,YAAY,MAC7D,OAAO;CAGT,OAAO,aAAa;AACtB;AAEA,SAAS,qBAAqB,SAAoC;CAChE,OAAO,OAAO,QAAQ,eAAe,EAAE,CAAC,CAAC,KAAK;AAChD;AAEA,SAAS,mBAAmB,WAAuC;CACjE,MAAM,aAAa,OAAO,aAAa,EAAE,CAAC,CAAC,KAAK;CAChD,OAAO,WAAW,SAAS,IAAI,aAAa;AAC9C;AAEA,SAAgB,4BACd,SACA,YACS;CACT,OAAO,4BAA4B;EACjC;EACA;CACF,CAAC;AACH;;;ACxNA,MAAM,gCAAgC;AAEtC,SAAgB,6BAA6B,UAA2B;CACtE,IAAI,uBAAuB,QAAQ,GACjC,OAAO,2BAA2B,QAAQ;CAG5C,MAAM,UAAU,OAAO,SACrB,OAAO,QAAQ,IAAI,kCAAkC,EAAE,GACvD,EACF;CACA,IAAI,uBAAuB,OAAO,GAChC,OAAO,2BAA2B,OAAO;CAG3C,OAAO;AACT;AAEA,SAAgBA,+CAAqD;CACnE,OAAO,6BAA6B,KAAA,CAAS;AAC/C;AASA,SAAS,2BAA2B,OAAuB;CAEzD,OAAO,KAAK,IACV,8BACA,KAAK,IAAI,8BAHQ,KAAK,MAAM,KAGoB,CAAC,CACnD;AACF;AAEA,SAAS,uBAAuB,OAAiC;CAC/D,OAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,KAAK,QAAQ;AACxE;;;ACzCA,eAAsB,6BAA6B,OAK7B;CACpB,MAAM,YAAY,6BAA6B,MAAM,SAAS;CAC9D,MAAM,gBAAgB,YAAY,QAAQ,SAAS;CACnD,MAAM,WAAW,oBAAoB,MAAM,MAAM,QAAQ,aAAa;CAEtE,IAAI;EACF,IAAI;GACF,OAAO,MAAM,MAAM,MAAM,KAAK;IAC5B,GAAG,MAAM;IACT,QAAQ,SAAS;GACnB,CAAC;EACH,SAAS,OAAO;GAKd,IACE,cAAc,WACd,SAAS,OAAO,WAChB,CAAC,8BAA8B,KAAK,GAEpC,MAAM;GAER,OAAO,MAAM,MAAM,MAAM,KAAK;IAC5B,GAAG,MAAM;IACT,QAAQ,SAAS;GACnB,CAAC;EACH;CACF,SAAS,OAAO;EACd,IAAI,cAAc,SAChB,MAAM,+BAA+B;GACnC,WAAW,MAAM;GACjB;GACA,OAAO;EACT,CAAC;EAEH,IAAI,8BAA8B,KAAK,GACrC,MAAM,+BAA+B;GACnC,WAAW,MAAM;GACjB,KAAK,MAAM;GACX,OAAO;EACT,CAAC;EAEH,MAAM;CACR,UAAU;EACR,SAAS,QAAQ;CACnB;AACF;AAEA,SAAgB,6CAAqD;CACnE,OAAOC,6CAA8C;AACvD;AAEA,SAAS,+BAA+B,OAI9B;CACR,MAAM,QAAQ,IAAI,MAChB,GAAG,MAAM,UAAU,2BAA2B,MAAM,UAAU,KAC9D,EAAE,OAAO,MAAM,MAAM,CACvB;CACA,MAAM,OAAO;CACb,OAAO;AACT;AAEA,SAAS,+BAA+B,OAI9B;CACR,MAAM,QAAQ,IAAI,MAChB,GAAG,MAAM,UAAU,2BAA2B,sBAAsB,MAAM,GAAG,EAAE,IAAI,eAAe,MAAM,KAAK,EAAE,IAC/G,EAAE,OAAO,MAAM,MAAM,CACvB;CACA,MAAM,OAAO;CACb,OAAO;AACT;AAEA,SAAS,oBACP,QACA,SAC8C;CAC9C,IAAI,CAAC,QACH,OAAO;EACL,QAAQ;EACR,eAAe,KAAA;CACjB;CAGF,IAAI,OAAO,WAAW,QAAQ,SAAS;EACrC,MAAM,aAAa,IAAI,gBAAgB;EACvC,WAAW,MAAM;EACjB,OAAO;GACL,QAAQ,WAAW;GACnB,eAAe,KAAA;EACjB;CACF;CAEA,MAAM,aAAa,IAAI,gBAAgB;CACvC,MAAM,cAAc;EAClB,WAAW,MAAM;CACnB;CAEA,OAAO,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;CACtD,QAAQ,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;CAEvD,OAAO;EACL,QAAQ,WAAW;EACnB,eAAe;GACb,OAAO,oBAAoB,SAAS,KAAK;GACzC,QAAQ,oBAAoB,SAAS,KAAK;EAC5C;CACF;AACF;AAEA,SAAS,sBAAsB,KAAqB;CAClD,IAAI;EACF,OAAO,IAAI,IAAI,GAAG,CAAC,CAAC;CACtB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,eAAe,OAAwB;CAC9C,IAAI,iBAAiB,OAAO;EAC1B,MAAM,UAAU,MAAM,QAAQ,KAAK;EACnC,OAAO,QAAQ,SAAS,IAAI,UAAU;CACxC;CACA,MAAM,UAAU,OAAO,SAAS,EAAE,CAAC,CAAC,KAAK;CACzC,OAAO,QAAQ,SAAS,IAAI,UAAU;AACxC;AAEA,SAAS,8BAA8B,OAAyB;CAC9D,IAAI,iBAAiB,WACnB,OAAO;CAET,IACE,OAAO,UAAU,YACjB,UAAU,QACV,UAAU,SACV,OAAO,MAAM,SAAS,YACtB,MAAM,KAAK,WAAW,UAAU,GAEhC,OAAO;CAET,MAAM,UAAU,eAAe,KAAK,CAAC,CAAC,YAAY;CAClD,OACE,QAAQ,SAAS,cAAc,KAC/B,QAAQ,SAAS,iBAAiB,KAClC,QAAQ,SAAS,wBAAwB,KACzC,QAAQ,SAAS,yCAAyC;AAE9D;;;;ACxJA,SAAgB,6BACd,SACA,UAGI,CAAC,GACwB;CAC7B,OAAO,wBAAwB;EAC7B;EACA,WAAW,OAAO,YAChB,MAAM,6BAA6B;GACjC,KAAK,QAAQ;GACb,WAAW,QAAQ;GACnB,MAAM,QAAQ;GACd,WAAW,QAAQ;EACrB,CAAC;EACH,gBAAgB,OAAO,EAAE,iBAAiB;GACxC,MAAM,UAAU,MAAM,wBAAwB,EAC5C,WACF,CAAC;GACD,IAAI,QAAQ,gBACV,QAAQ,6CACN,QAAQ;GAEZ,QAAQ,wBAAwB,OAAO;GACvC,OAAO;EACT;EACA,0BAA0B,OAAO,EAAE,gBAAgB,oBACjD,mCAAmC;GACjC;GACA,GAAI,kBAAkB,KAAA,IAAY,CAAC,IAAI,EAAE,cAAc;EACzD,CAAC;CACL,CAAC;AACH"}
+{"version":3,"file":"api-client-foundation-BCbhO6xe.js","names":["resolveSpaceRequestTimeoutMsForDiagnostics","resolveSpaceRequestTimeoutMsForCliDiagnostics"],"sources":["../src/config/auth-request-compatibility.ts","../src/config/openmeld-request-context.ts","../src/config/request-headers.ts","../src/space/request-timeout.ts","../src/space/fetch-with-timeout.ts","../src/space/api-client-foundation.ts"],"sourcesContent":["import { normalizeBaseUrl } from \"../protocol/urls\";\nimport type { StoredAuthSession } from \"./auth-session\";\n\nexport type AuthRequestCompatibilityReason =\n  | \"invalid_request_url\"\n  | \"invalid_auth_url\"\n  | \"insecure_transport\"\n  | \"host_mismatch\"\n  | \"loopback\"\n  | \"same_host\"\n  | \"gateway_sibling\";\n\nexport type AuthRequestCompatibility = {\n  compatible: boolean;\n  reason: AuthRequestCompatibilityReason;\n  requestHost: string | null;\n  authHost: string | null;\n  expectedGatewayHost: string | null;\n};\n\nexport function resolveAuthRequestCompatibility(input: {\n  session: StoredAuthSession;\n  requestUrl: string;\n}): AuthRequestCompatibility {\n  const requestUrl = parseUrlOrNull(input.requestUrl);\n  if (!requestUrl) {\n    return {\n      compatible: false,\n      reason: \"invalid_request_url\",\n      requestHost: null,\n      authHost: null,\n      expectedGatewayHost: null,\n    };\n  }\n\n  const authBaseUrl = parseUrlOrNull(input.session.authBaseUrl);\n  if (!authBaseUrl) {\n    return {\n      compatible: false,\n      reason: \"invalid_auth_url\",\n      requestHost: requestUrl.host,\n      authHost: null,\n      expectedGatewayHost: null,\n    };\n  }\n\n  const expectedGatewayHost = deriveGatewayHost(authBaseUrl);\n  const requestHost = requestUrl.host;\n  const authHost = authBaseUrl.host;\n\n  if (\n    isLoopbackHostname(requestUrl.hostname) &&\n    isLoopbackHostname(authBaseUrl.hostname)\n  ) {\n    return {\n      compatible: true,\n      reason: \"loopback\",\n      requestHost,\n      authHost,\n      expectedGatewayHost,\n    };\n  }\n\n  if (!isSecureTransportProtocol(requestUrl.protocol)) {\n    return {\n      compatible: false,\n      reason: \"insecure_transport\",\n      requestHost,\n      authHost,\n      expectedGatewayHost,\n    };\n  }\n\n  if (requestHost === authHost) {\n    return {\n      compatible: true,\n      reason: \"same_host\",\n      requestHost,\n      authHost,\n      expectedGatewayHost,\n    };\n  }\n\n  if (expectedGatewayHost && requestHost === expectedGatewayHost) {\n    return {\n      compatible: true,\n      reason: \"gateway_sibling\",\n      requestHost,\n      authHost,\n      expectedGatewayHost,\n    };\n  }\n\n  return {\n    compatible: false,\n    reason: \"host_mismatch\",\n    requestHost,\n    authHost,\n    expectedGatewayHost,\n  };\n}\n\nexport function canUseAuthSessionForRequest(input: {\n  session: StoredAuthSession;\n  requestUrl: string;\n}): boolean {\n  return resolveAuthRequestCompatibility(input).compatible;\n}\n\nexport function deriveAuthBaseUrlFromGatewayUrl(\n  gatewayUrl: string\n): string | null {\n  const parsed = parseUrlOrNull(gatewayUrl);\n  if (!parsed) {\n    return null;\n  }\n  if (!isHttpTransportProtocol(parsed.protocol)) {\n    return null;\n  }\n  if (!parsed.hostname.startsWith(\"gateway.\")) {\n    return null;\n  }\n\n  const authUrl = new URL(parsed.toString());\n  authUrl.hostname = `auth.${parsed.hostname.slice(\"gateway.\".length)}`;\n  authUrl.pathname = \"/\";\n  authUrl.search = \"\";\n  authUrl.hash = \"\";\n  return normalizeBaseUrl(authUrl.toString());\n}\n\nfunction deriveGatewayHost(authBaseUrl: URL): string | null {\n  if (!authBaseUrl.hostname.startsWith(\"auth.\")) {\n    return null;\n  }\n\n  const gatewayUrl = new URL(authBaseUrl.toString());\n  gatewayUrl.hostname = `gateway.${authBaseUrl.hostname.slice(\"auth.\".length)}`;\n  return gatewayUrl.host;\n}\n\nfunction parseUrlOrNull(value: string): URL | null {\n  try {\n    return new URL(value);\n  } catch {\n    return null;\n  }\n}\n\nfunction isLoopbackHostname(hostname: string): boolean {\n  return (\n    hostname === \"localhost\" || hostname === \"127.0.0.1\" || hostname === \"::1\"\n  );\n}\n\nfunction isSecureTransportProtocol(protocol: string): boolean {\n  return protocol === \"https:\" || protocol === \"wss:\";\n}\n\nfunction isHttpTransportProtocol(protocol: string): boolean {\n  return protocol === \"http:\" || protocol === \"https:\";\n}\n","import crypto from \"node:crypto\";\nimport type { OpenMeldRequestContext } from \"@openmeld/schemas/types\";\nimport type { OpenMeldProfile } from \"./openmeld-profiles-api\";\n\nexport type OpenMeldRequestContextProfileIdentity = {\n  openMeldProfileId: string;\n  profileKind?: \"human\" | \"agent\" | \"system\";\n  kind?: \"human\" | \"agent\";\n  profileHandle?: string;\n  profileName: string;\n  ownerUserId?: string;\n  ownerName?: string;\n  agentControllerConversationId?: string;\n};\n\nexport function buildOpenMeldRequestContextFromProfile(input: {\n  openMeldProfile: OpenMeldProfile;\n  requestId?: string;\n  agentControllerConversationId?: string;\n}): OpenMeldRequestContext {\n  const requestId =\n    normalizeOptionalText(input.requestId) ?? crypto.randomUUID();\n  const agentControllerConversationId = normalizeOptionalText(\n    input.agentControllerConversationId\n  );\n  const ownerName = normalizeOptionalText(input.openMeldProfile.ownerName);\n\n  return {\n    actorContext: {\n      requestId,\n      openMeldProfileId: input.openMeldProfile.openMeldProfileId,\n      profileKind: input.openMeldProfile.profileKind,\n      profileHandle: input.openMeldProfile.profileHandle,\n      profileName: input.openMeldProfile.profileName,\n      ownerUserId: input.openMeldProfile.ownerUserId,\n      ...(ownerName ? { ownerName } : {}),\n    },\n    ...(agentControllerConversationId ? { agentControllerConversationId } : {}),\n  };\n}\n\nexport function buildOpenMeldRequestContextFromProfileIdentity(input: {\n  profileIdentity: OpenMeldRequestContextProfileIdentity;\n  requestId?: string;\n}): OpenMeldRequestContext {\n  const requestId =\n    normalizeOptionalText(input.requestId) ?? crypto.randomUUID();\n  const profileHandle = normalizeOptionalText(\n    input.profileIdentity.profileHandle\n  );\n  const ownerUserId = normalizeOptionalText(input.profileIdentity.ownerUserId);\n  const ownerName = normalizeOptionalText(input.profileIdentity.ownerName);\n  const agentControllerConversationId = normalizeOptionalText(\n    input.profileIdentity.agentControllerConversationId\n  );\n  const profileKind =\n    input.profileIdentity.profileKind ??\n    (input.profileIdentity.kind === \"human\" ||\n    input.profileIdentity.kind === \"agent\"\n      ? input.profileIdentity.kind\n      : \"system\");\n\n  return {\n    actorContext: {\n      requestId,\n      openMeldProfileId: input.profileIdentity.openMeldProfileId,\n      profileKind,\n      ...(profileHandle ? { profileHandle } : {}),\n      profileName: input.profileIdentity.profileName,\n      ...(ownerUserId ? { ownerUserId } : {}),\n      ...(ownerName ? { ownerName } : {}),\n    },\n    ...(agentControllerConversationId ? { agentControllerConversationId } : {}),\n  };\n}\n\nfunction normalizeOptionalText(value: unknown): string | null {\n  const normalized = String(value ?? \"\").trim();\n  return normalized.length > 0 ? normalized : null;\n}\n","import {\n  buildOpenMeldRequestContextHeaders,\n  type OpenMeldRequestContextHeadersInput,\n} from \"@openmeld/gateway-contract\";\nimport type { OpenMeldRequestContext } from \"@openmeld/schemas/types\";\nimport {\n  type AuthRequestCompatibilityReason,\n  canUseAuthSessionForRequest,\n  resolveAuthRequestCompatibility,\n} from \"./auth-request-compatibility\";\nimport { getAuthSessionState, type StoredAuthSession } from \"./auth-session\";\nimport type { OpenMeldProfile } from \"./openmeld-profiles-api\";\nimport {\n  buildOpenMeldRequestContextFromProfile,\n  buildOpenMeldRequestContextFromProfileIdentity,\n  type OpenMeldRequestContextProfileIdentity,\n} from \"./openmeld-request-context\";\n\nconst DEFAULT_TOKEN_TYPE = \"Bearer\";\nconst AUTHORIZATION_HEADER = \"Authorization\";\n\ntype RequestAuthHeadersInput = {\n  authSession?: StoredAuthSession | null;\n  requestUrl: string;\n};\n\ntype OpenMeldRequestContextHeadersWithAuthInput =\n  OpenMeldRequestContextHeadersInput & {\n    authSession?: StoredAuthSession | null;\n    requestUrl: string;\n  };\n\nexport type AuthTokenAttachment =\n  | {\n      status: \"attachable\";\n      token: string;\n      tokenType: string;\n    }\n  | {\n      status: \"dropped\";\n      reason: \"empty_token\" | AuthRequestCompatibilityReason;\n      requestHost: string | null;\n      authHost: string | null;\n      expectedGatewayHost: string | null;\n    };\n\nexport type DroppedAuthTokenAttachment = Extract<\n  AuthTokenAttachment,\n  { status: \"dropped\" }\n>;\n\nexport async function buildRequestAuthHeaders(\n  input: RequestAuthHeadersInput\n): Promise<Record<string, string>> {\n  const headers: Record<string, string> = {};\n  await attachAuthHeader(headers, input);\n  return headers;\n}\n\nexport async function buildOpenMeldRequestContextHeadersWithAuth(\n  input: OpenMeldRequestContextHeadersWithAuthInput\n): Promise<Record<string, string>> {\n  const headers = buildOpenMeldRequestContextHeaders(input);\n  await attachAuthHeader(headers, input);\n  return headers;\n}\n\nexport async function buildOpenMeldProfileRequestHeadersWithAuth(input: {\n  openMeldProfile: OpenMeldProfile;\n  requestUrl: string;\n  authSession?: StoredAuthSession | null;\n  agentControllerConversationId?: string;\n  spacePassword?: string;\n}): Promise<Record<string, string>> {\n  return await buildOpenMeldRequestContextHeadersWithAuth({\n    requestContext: buildOpenMeldRequestContextFromProfile({\n      openMeldProfile: input.openMeldProfile,\n      agentControllerConversationId: input.agentControllerConversationId,\n    }),\n    requestUrl: input.requestUrl,\n    ...(input.authSession === undefined\n      ? {}\n      : { authSession: input.authSession }),\n    ...(input.spacePassword === undefined\n      ? {}\n      : { spacePassword: input.spacePassword }),\n  });\n}\n\nexport async function buildOpenMeldProfileIdentityRequestHeadersWithAuth(input: {\n  profileIdentity: OpenMeldRequestContextProfileIdentity;\n  requestUrl: string;\n  authSession?: StoredAuthSession | null;\n  spacePassword?: string;\n}): Promise<Record<string, string>> {\n  return await buildOpenMeldRequestContextHeadersWithAuth({\n    requestContext: buildOpenMeldRequestContextFromProfileIdentity({\n      profileIdentity: input.profileIdentity,\n    }),\n    requestUrl: input.requestUrl,\n    ...(input.authSession === undefined\n      ? {}\n      : { authSession: input.authSession }),\n    ...(input.spacePassword === undefined\n      ? {}\n      : { spacePassword: input.spacePassword }),\n  });\n}\n\nexport function withSpacePassword(\n  requestContext: OpenMeldRequestContext,\n  spacePassword?: string\n): OpenMeldRequestContextHeadersInput {\n  return {\n    requestContext,\n    ...(spacePassword === undefined ? {} : { spacePassword }),\n  };\n}\n\n// One decision for \"can this stored session authenticate this request\", with\n// the drop reason preserved. Header building and the daemon stream connect\n// gate must share this so they cannot drift apart.\nexport function resolveAuthTokenAttachment(input: {\n  session: StoredAuthSession;\n  requestUrl: string;\n}): AuthTokenAttachment {\n  const compatibility = resolveAuthRequestCompatibility({\n    session: input.session,\n    requestUrl: input.requestUrl,\n  });\n  const token = normalizeAccessToken(input.session);\n  if (!token) {\n    return {\n      status: \"dropped\",\n      reason: \"empty_token\",\n      requestHost: compatibility.requestHost,\n      authHost: compatibility.authHost,\n      expectedGatewayHost: compatibility.expectedGatewayHost,\n    };\n  }\n  if (!compatibility.compatible) {\n    return {\n      status: \"dropped\",\n      reason: compatibility.reason,\n      requestHost: compatibility.requestHost,\n      authHost: compatibility.authHost,\n      expectedGatewayHost: compatibility.expectedGatewayHost,\n    };\n  }\n  return {\n    status: \"attachable\",\n    token,\n    tokenType: normalizeTokenType(input.session.tokenType),\n  };\n}\n\nasync function attachAuthHeader(\n  headers: Record<string, string>,\n  input: RequestAuthHeadersInput\n): Promise<void> {\n  const session = await resolveAuthSessionForHeaders(input);\n  if (session === null) {\n    // No stored credentials exist, so there is nothing to strip: the caller\n    // is knowingly sending an unauthenticated request.\n    return;\n  }\n\n  const attachment = resolveAuthTokenAttachment({\n    session,\n    requestUrl: input.requestUrl,\n  });\n  if (attachment.status === \"dropped\") {\n    // The caller holds a session it believes is usable. Dropping the token is\n    // still the safe outcome (never leak credentials to an incompatible\n    // host), but it must stay visible in diagnostics instead of silently\n    // dialing bare and surfacing as a remote 401.\n    warnDroppedAuthToken(attachment);\n    return;\n  }\n  headers[AUTHORIZATION_HEADER] = `${attachment.tokenType} ${attachment.token}`;\n}\n\nfunction warnDroppedAuthToken(attachment: DroppedAuthTokenAttachment): void {\n  console.warn(\"[openmeld.auth.request_token_dropped]\", {\n    authHost: attachment.authHost,\n    expectedGatewayHost: attachment.expectedGatewayHost,\n    reason: attachment.reason,\n    requestHost: attachment.requestHost,\n  });\n}\n\nasync function resolveAuthSessionForHeaders(\n  input: RequestAuthHeadersInput\n): Promise<StoredAuthSession | null> {\n  if (input.authSession !== undefined) {\n    return input.authSession;\n  }\n\n  const sessionState = await getAuthSessionState();\n  if (sessionState.state !== \"valid\" || sessionState.session === null) {\n    return null;\n  }\n\n  return sessionState.session;\n}\n\nfunction normalizeAccessToken(session: StoredAuthSession): string {\n  return String(session.accessToken ?? \"\").trim();\n}\n\nfunction normalizeTokenType(tokenType: string | undefined): string {\n  const normalized = String(tokenType ?? \"\").trim();\n  return normalized.length > 0 ? normalized : DEFAULT_TOKEN_TYPE;\n}\n\nexport function canAttachAuthTokenToRequest(\n  session: StoredAuthSession,\n  requestUrl: string\n): boolean {\n  return canUseAuthSessionForRequest({\n    session,\n    requestUrl,\n  });\n}\n","import {\n  DEFAULT_SPACE_CONVERSATION_VALIDATE_TIMEOUT_MS,\n  DEFAULT_SPACE_REQUEST_TIMEOUT_MS,\n  MAX_SPACE_REQUEST_TIMEOUT_MS,\n  MIN_SPACE_REQUEST_TIMEOUT_MS,\n} from \"../strategy-constants\";\n\nconst SPACE_REQUEST_TIMEOUT_ENV_KEY = \"OPENMELD_SPACE_REQUEST_TIMEOUT_MS\";\n\nexport function resolveSpaceRequestTimeoutMs(override?: number): number {\n  if (isFinitePositiveNumber(override)) {\n    return clampSpaceRequestTimeoutMs(override);\n  }\n\n  const fromEnv = Number.parseInt(\n    String(process.env[SPACE_REQUEST_TIMEOUT_ENV_KEY] ?? \"\"),\n    10\n  );\n  if (isFinitePositiveNumber(fromEnv)) {\n    return clampSpaceRequestTimeoutMs(fromEnv);\n  }\n\n  return DEFAULT_SPACE_REQUEST_TIMEOUT_MS;\n}\n\nexport function resolveSpaceRequestTimeoutMsForDiagnostics(): number {\n  return resolveSpaceRequestTimeoutMs(undefined);\n}\n\nexport function resolveSpaceConversationValidateTimeoutMs(): number {\n  return Math.max(\n    resolveSpaceRequestTimeoutMs(undefined),\n    DEFAULT_SPACE_CONVERSATION_VALIDATE_TIMEOUT_MS\n  );\n}\n\nfunction clampSpaceRequestTimeoutMs(value: number): number {\n  const normalized = Math.trunc(value);\n  return Math.max(\n    MIN_SPACE_REQUEST_TIMEOUT_MS,\n    Math.min(MAX_SPACE_REQUEST_TIMEOUT_MS, normalized)\n  );\n}\n\nfunction isFinitePositiveNumber(value: unknown): value is number {\n  return typeof value === \"number\" && Number.isFinite(value) && value > 0;\n}\n","import {\n  resolveSpaceRequestTimeoutMs,\n  resolveSpaceRequestTimeoutMsForDiagnostics as resolveSpaceRequestTimeoutMsForCliDiagnostics,\n} from \"./request-timeout\";\n\nexport async function fetchSpaceRequestWithTimeout(input: {\n  url: string;\n  operation: string;\n  init?: RequestInit;\n  timeoutMs?: number;\n}): Promise<Response> {\n  const timeoutMs = resolveSpaceRequestTimeoutMs(input.timeoutMs);\n  const timeoutSignal = AbortSignal.timeout(timeoutMs);\n  const composed = composeAbortSignals(input.init?.signal, timeoutSignal);\n\n  try {\n    try {\n      return await fetch(input.url, {\n        ...input.init,\n        signal: composed.signal,\n      });\n    } catch (error) {\n      // A keep-alive connection that a proxy silently dropped fails exactly\n      // once and undici evicts it; the retry rides a fresh connection. This\n      // is what keeps a long-lived service working behind flaky proxies\n      // without asking users to touch their network config.\n      if (\n        timeoutSignal.aborted ||\n        composed.signal.aborted ||\n        !shouldWrapNetworkRequestError(error)\n      ) {\n        throw error;\n      }\n      return await fetch(input.url, {\n        ...input.init,\n        signal: composed.signal,\n      });\n    }\n  } catch (error) {\n    if (timeoutSignal.aborted) {\n      throw createSpaceRequestTimeoutError({\n        operation: input.operation,\n        timeoutMs,\n        cause: error,\n      });\n    }\n    if (shouldWrapNetworkRequestError(error)) {\n      throw createSpaceRequestNetworkError({\n        operation: input.operation,\n        url: input.url,\n        cause: error,\n      });\n    }\n    throw error;\n  } finally {\n    composed.cleanup();\n  }\n}\n\nexport function resolveSpaceRequestTimeoutMsForDiagnostics(): number {\n  return resolveSpaceRequestTimeoutMsForCliDiagnostics();\n}\n\nfunction createSpaceRequestTimeoutError(input: {\n  operation: string;\n  timeoutMs: number;\n  cause: unknown;\n}): Error {\n  const error = new Error(\n    `${input.operation} request timed out after ${input.timeoutMs}ms`,\n    { cause: input.cause }\n  ) as Error & { code?: string };\n  error.code = \"network.timeout\";\n  return error;\n}\n\nfunction createSpaceRequestNetworkError(input: {\n  operation: string;\n  url: string;\n  cause: unknown;\n}): Error {\n  const error = new Error(\n    `${input.operation} request could not reach ${describeRequestTarget(input.url)} (${toErrorMessage(input.cause)})`,\n    { cause: input.cause }\n  ) as Error & { code?: string };\n  error.code = \"network.request_failed\";\n  return error;\n}\n\nfunction composeAbortSignals(\n  parent: AbortSignal | null | undefined,\n  timeout: AbortSignal\n): { signal: AbortSignal; cleanup: () => void } {\n  if (!parent) {\n    return {\n      signal: timeout,\n      cleanup: () => undefined,\n    };\n  }\n\n  if (parent.aborted || timeout.aborted) {\n    const controller = new AbortController();\n    controller.abort();\n    return {\n      signal: controller.signal,\n      cleanup: () => undefined,\n    };\n  }\n\n  const controller = new AbortController();\n  const abort = () => {\n    controller.abort();\n  };\n\n  parent.addEventListener(\"abort\", abort, { once: true });\n  timeout.addEventListener(\"abort\", abort, { once: true });\n\n  return {\n    signal: controller.signal,\n    cleanup: () => {\n      parent.removeEventListener(\"abort\", abort);\n      timeout.removeEventListener(\"abort\", abort);\n    },\n  };\n}\n\nfunction describeRequestTarget(url: string): string {\n  try {\n    return new URL(url).origin;\n  } catch {\n    return url;\n  }\n}\n\nfunction toErrorMessage(error: unknown): string {\n  if (error instanceof Error) {\n    const message = error.message.trim();\n    return message.length > 0 ? message : \"request failed\";\n  }\n  const message = String(error ?? \"\").trim();\n  return message.length > 0 ? message : \"request failed\";\n}\n\nfunction shouldWrapNetworkRequestError(error: unknown): boolean {\n  if (error instanceof TypeError) {\n    return true;\n  }\n  if (\n    typeof error === \"object\" &&\n    error !== null &&\n    \"code\" in error &&\n    typeof error.code === \"string\" &&\n    error.code.startsWith(\"ERR_SSL_\")\n  ) {\n    return true;\n  }\n  const message = toErrorMessage(error).toLowerCase();\n  return (\n    message.includes(\"fetch failed\") ||\n    message.includes(\"failed to fetch\") ||\n    message.includes(\"network request failed\") ||\n    message.includes(\"ssl_decryption_failed_or_bad_record_mac\")\n  );\n}\n","import {\n  createOpenMeldApiClient,\n  type OpenMeldApiClientFoundation,\n} from \"@openmeld/api-client\";\nimport {\n  buildOpenMeldRequestContextHeaders,\n  OPENMELD_HEADER_REQUESTED_ORGANIZATION_ID,\n} from \"@openmeld/gateway-contract\";\nimport { buildRequestAuthHeaders } from \"../config/request-headers\";\nimport { fetchSpaceRequestWithTimeout } from \"./fetch-with-timeout\";\n\nexport function createCliApiClientFoundation(\n  baseUrl: string,\n  options: {\n    onAuthHeadersResolved?: (headers: Record<string, string>) => void;\n    organizationId?: string;\n  } = {}\n): OpenMeldApiClientFoundation {\n  return createOpenMeldApiClient({\n    baseUrl,\n    transport: async (request) =>\n      await fetchSpaceRequestWithTimeout({\n        url: request.url,\n        operation: request.operation,\n        init: request.init,\n        timeoutMs: request.timeoutMs,\n      }),\n    getAuthHeaders: async ({ requestUrl }) => {\n      const headers = await buildRequestAuthHeaders({\n        requestUrl,\n      });\n      if (options.organizationId) {\n        headers[OPENMELD_HEADER_REQUESTED_ORGANIZATION_ID] =\n          options.organizationId;\n      }\n      options.onAuthHeadersResolved?.(headers);\n      return headers;\n    },\n    getRequestContextHeaders: async ({ requestContext, spacePassword }) =>\n      buildOpenMeldRequestContextHeaders({\n        requestContext,\n        ...(spacePassword === undefined ? {} : { spacePassword }),\n      }),\n  });\n}\n"],"mappings":";;;;;;;AAoBA,SAAgB,gCAAgC,OAGnB;CAC3B,MAAM,aAAa,eAAe,MAAM,UAAU;CAClD,IAAI,CAAC,YACH,OAAO;EACL,YAAY;EACZ,QAAQ;EACR,aAAa;EACb,UAAU;EACV,qBAAqB;CACvB;CAGF,MAAM,cAAc,eAAe,MAAM,QAAQ,WAAW;CAC5D,IAAI,CAAC,aACH,OAAO;EACL,YAAY;EACZ,QAAQ;EACR,aAAa,WAAW;EACxB,UAAU;EACV,qBAAqB;CACvB;CAGF,MAAM,sBAAsB,kBAAkB,WAAW;CACzD,MAAM,cAAc,WAAW;CAC/B,MAAM,WAAW,YAAY;CAE7B,IACE,mBAAmB,WAAW,QAAQ,KACtC,mBAAmB,YAAY,QAAQ,GAEvC,OAAO;EACL,YAAY;EACZ,QAAQ;EACR;EACA;EACA;CACF;CAGF,IAAI,CAAC,0BAA0B,WAAW,QAAQ,GAChD,OAAO;EACL,YAAY;EACZ,QAAQ;EACR;EACA;EACA;CACF;CAGF,IAAI,gBAAgB,UAClB,OAAO;EACL,YAAY;EACZ,QAAQ;EACR;EACA;EACA;CACF;CAGF,IAAI,uBAAuB,gBAAgB,qBACzC,OAAO;EACL,YAAY;EACZ,QAAQ;EACR;EACA;EACA;CACF;CAGF,OAAO;EACL,YAAY;EACZ,QAAQ;EACR;EACA;EACA;CACF;AACF;AAEA,SAAgB,4BAA4B,OAGhC;CACV,OAAO,gCAAgC,KAAK,CAAC,CAAC;AAChD;AAEA,SAAgB,gCACd,YACe;CACf,MAAM,SAAS,eAAe,UAAU;CACxC,IAAI,CAAC,QACH,OAAO;CAET,IAAI,CAAC,wBAAwB,OAAO,QAAQ,GAC1C,OAAO;CAET,IAAI,CAAC,OAAO,SAAS,WAAW,UAAU,GACxC,OAAO;CAGT,MAAM,UAAU,IAAI,IAAI,OAAO,SAAS,CAAC;CACzC,QAAQ,WAAW,QAAQ,OAAO,SAAS,MAAM,CAAiB;CAClE,QAAQ,WAAW;CACnB,QAAQ,SAAS;CACjB,QAAQ,OAAO;CACf,OAAO,iBAAiB,QAAQ,SAAS,CAAC;AAC5C;AAEA,SAAS,kBAAkB,aAAiC;CAC1D,IAAI,CAAC,YAAY,SAAS,WAAW,OAAO,GAC1C,OAAO;CAGT,MAAM,aAAa,IAAI,IAAI,YAAY,SAAS,CAAC;CACjD,WAAW,WAAW,WAAW,YAAY,SAAS,MAAM,CAAc;CAC1E,OAAO,WAAW;AACpB;AAEA,SAAS,eAAe,OAA2B;CACjD,IAAI;EACF,OAAO,IAAI,IAAI,KAAK;CACtB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,mBAAmB,UAA2B;CACrD,OACE,aAAa,eAAe,aAAa,eAAe,aAAa;AAEzE;AAEA,SAAS,0BAA0B,UAA2B;CAC5D,OAAO,aAAa,YAAY,aAAa;AAC/C;AAEA,SAAS,wBAAwB,UAA2B;CAC1D,OAAO,aAAa,WAAW,aAAa;AAC9C;;;AClJA,SAAgB,uCAAuC,OAI5B;CACzB,MAAM,YACJ,sBAAsB,MAAM,SAAS,KAAK,OAAO,WAAW;CAC9D,MAAM,gCAAgC,sBACpC,MAAM,6BACR;CACA,MAAM,YAAY,sBAAsB,MAAM,gBAAgB,SAAS;CAEvE,OAAO;EACL,cAAc;GACZ;GACA,mBAAmB,MAAM,gBAAgB;GACzC,aAAa,MAAM,gBAAgB;GACnC,eAAe,MAAM,gBAAgB;GACrC,aAAa,MAAM,gBAAgB;GACnC,aAAa,MAAM,gBAAgB;GACnC,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;EACnC;EACA,GAAI,gCAAgC,EAAE,8BAA8B,IAAI,CAAC;CAC3E;AACF;AAEA,SAAgB,+CAA+C,OAGpC;CACzB,MAAM,YACJ,sBAAsB,MAAM,SAAS,KAAK,OAAO,WAAW;CAC9D,MAAM,gBAAgB,sBACpB,MAAM,gBAAgB,aACxB;CACA,MAAM,cAAc,sBAAsB,MAAM,gBAAgB,WAAW;CAC3E,MAAM,YAAY,sBAAsB,MAAM,gBAAgB,SAAS;CACvE,MAAM,gCAAgC,sBACpC,MAAM,gBAAgB,6BACxB;CACA,MAAM,cACJ,MAAM,gBAAgB,gBACrB,MAAM,gBAAgB,SAAS,WAChC,MAAM,gBAAgB,SAAS,UAC3B,MAAM,gBAAgB,OACtB;CAEN,OAAO;EACL,cAAc;GACZ;GACA,mBAAmB,MAAM,gBAAgB;GACzC;GACA,GAAI,gBAAgB,EAAE,cAAc,IAAI,CAAC;GACzC,aAAa,MAAM,gBAAgB;GACnC,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;GACrC,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;EACnC;EACA,GAAI,gCAAgC,EAAE,8BAA8B,IAAI,CAAC;CAC3E;AACF;AAEA,SAAS,sBAAsB,OAA+B;CAC5D,MAAM,aAAa,OAAO,SAAS,EAAE,CAAC,CAAC,KAAK;CAC5C,OAAO,WAAW,SAAS,IAAI,aAAa;AAC9C;;;AC7DA,MAAM,qBAAqB;AAC3B,MAAM,uBAAuB;AAgC7B,eAAsB,wBACpB,OACiC;CACjC,MAAM,UAAkC,CAAC;CACzC,MAAM,iBAAiB,SAAS,KAAK;CACrC,OAAO;AACT;AAEA,eAAsB,2CACpB,OACiC;CACjC,MAAM,UAAU,mCAAmC,KAAK;CACxD,MAAM,iBAAiB,SAAS,KAAK;CACrC,OAAO;AACT;AAEA,eAAsB,2CAA2C,OAM7B;CAClC,OAAO,MAAM,2CAA2C;EACtD,gBAAgB,uCAAuC;GACrD,iBAAiB,MAAM;GACvB,+BAA+B,MAAM;EACvC,CAAC;EACD,YAAY,MAAM;EAClB,GAAI,MAAM,gBAAgB,KAAA,IACtB,CAAC,IACD,EAAE,aAAa,MAAM,YAAY;EACrC,GAAI,MAAM,kBAAkB,KAAA,IACxB,CAAC,IACD,EAAE,eAAe,MAAM,cAAc;CAC3C,CAAC;AACH;AAEA,eAAsB,mDAAmD,OAKrC;CAClC,OAAO,MAAM,2CAA2C;EACtD,gBAAgB,+CAA+C,EAC7D,iBAAiB,MAAM,gBACzB,CAAC;EACD,YAAY,MAAM;EAClB,GAAI,MAAM,gBAAgB,KAAA,IACtB,CAAC,IACD,EAAE,aAAa,MAAM,YAAY;EACrC,GAAI,MAAM,kBAAkB,KAAA,IACxB,CAAC,IACD,EAAE,eAAe,MAAM,cAAc;CAC3C,CAAC;AACH;AAeA,SAAgB,2BAA2B,OAGnB;CACtB,MAAM,gBAAgB,gCAAgC;EACpD,SAAS,MAAM;EACf,YAAY,MAAM;CACpB,CAAC;CACD,MAAM,QAAQ,qBAAqB,MAAM,OAAO;CAChD,IAAI,CAAC,OACH,OAAO;EACL,QAAQ;EACR,QAAQ;EACR,aAAa,cAAc;EAC3B,UAAU,cAAc;EACxB,qBAAqB,cAAc;CACrC;CAEF,IAAI,CAAC,cAAc,YACjB,OAAO;EACL,QAAQ;EACR,QAAQ,cAAc;EACtB,aAAa,cAAc;EAC3B,UAAU,cAAc;EACxB,qBAAqB,cAAc;CACrC;CAEF,OAAO;EACL,QAAQ;EACR;EACA,WAAW,mBAAmB,MAAM,QAAQ,SAAS;CACvD;AACF;AAEA,eAAe,iBACb,SACA,OACe;CACf,MAAM,UAAU,MAAM,6BAA6B,KAAK;CACxD,IAAI,YAAY,MAGd;CAGF,MAAM,aAAa,2BAA2B;EAC5C;EACA,YAAY,MAAM;CACpB,CAAC;CACD,IAAI,WAAW,WAAW,WAAW;EAKnC,qBAAqB,UAAU;EAC/B;CACF;CACA,QAAQ,wBAAwB,GAAG,WAAW,UAAU,GAAG,WAAW;AACxE;AAEA,SAAS,qBAAqB,YAA8C;CAC1E,QAAQ,KAAK,yCAAyC;EACpD,UAAU,WAAW;EACrB,qBAAqB,WAAW;EAChC,QAAQ,WAAW;EACnB,aAAa,WAAW;CAC1B,CAAC;AACH;AAEA,eAAe,6BACb,OACmC;CACnC,IAAI,MAAM,gBAAgB,KAAA,GACxB,OAAO,MAAM;CAGf,MAAM,eAAe,MAAM,oBAAoB;CAC/C,IAAI,aAAa,UAAU,WAAW,aAAa,YAAY,MAC7D,OAAO;CAGT,OAAO,aAAa;AACtB;AAEA,SAAS,qBAAqB,SAAoC;CAChE,OAAO,OAAO,QAAQ,eAAe,EAAE,CAAC,CAAC,KAAK;AAChD;AAEA,SAAS,mBAAmB,WAAuC;CACjE,MAAM,aAAa,OAAO,aAAa,EAAE,CAAC,CAAC,KAAK;CAChD,OAAO,WAAW,SAAS,IAAI,aAAa;AAC9C;AAEA,SAAgB,4BACd,SACA,YACS;CACT,OAAO,4BAA4B;EACjC;EACA;CACF,CAAC;AACH;;;ACxNA,MAAM,gCAAgC;AAEtC,SAAgB,6BAA6B,UAA2B;CACtE,IAAI,uBAAuB,QAAQ,GACjC,OAAO,2BAA2B,QAAQ;CAG5C,MAAM,UAAU,OAAO,SACrB,OAAO,QAAQ,IAAI,kCAAkC,EAAE,GACvD,EACF;CACA,IAAI,uBAAuB,OAAO,GAChC,OAAO,2BAA2B,OAAO;CAG3C,OAAO;AACT;AAEA,SAAgBA,+CAAqD;CACnE,OAAO,6BAA6B,KAAA,CAAS;AAC/C;AASA,SAAS,2BAA2B,OAAuB;CAEzD,OAAO,KAAK,IACV,8BACA,KAAK,IAAI,8BAHQ,KAAK,MAAM,KAGoB,CAAC,CACnD;AACF;AAEA,SAAS,uBAAuB,OAAiC;CAC/D,OAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,KAAK,QAAQ;AACxE;;;ACzCA,eAAsB,6BAA6B,OAK7B;CACpB,MAAM,YAAY,6BAA6B,MAAM,SAAS;CAC9D,MAAM,gBAAgB,YAAY,QAAQ,SAAS;CACnD,MAAM,WAAW,oBAAoB,MAAM,MAAM,QAAQ,aAAa;CAEtE,IAAI;EACF,IAAI;GACF,OAAO,MAAM,MAAM,MAAM,KAAK;IAC5B,GAAG,MAAM;IACT,QAAQ,SAAS;GACnB,CAAC;EACH,SAAS,OAAO;GAKd,IACE,cAAc,WACd,SAAS,OAAO,WAChB,CAAC,8BAA8B,KAAK,GAEpC,MAAM;GAER,OAAO,MAAM,MAAM,MAAM,KAAK;IAC5B,GAAG,MAAM;IACT,QAAQ,SAAS;GACnB,CAAC;EACH;CACF,SAAS,OAAO;EACd,IAAI,cAAc,SAChB,MAAM,+BAA+B;GACnC,WAAW,MAAM;GACjB;GACA,OAAO;EACT,CAAC;EAEH,IAAI,8BAA8B,KAAK,GACrC,MAAM,+BAA+B;GACnC,WAAW,MAAM;GACjB,KAAK,MAAM;GACX,OAAO;EACT,CAAC;EAEH,MAAM;CACR,UAAU;EACR,SAAS,QAAQ;CACnB;AACF;AAEA,SAAgB,6CAAqD;CACnE,OAAOC,6CAA8C;AACvD;AAEA,SAAS,+BAA+B,OAI9B;CACR,MAAM,QAAQ,IAAI,MAChB,GAAG,MAAM,UAAU,2BAA2B,MAAM,UAAU,KAC9D,EAAE,OAAO,MAAM,MAAM,CACvB;CACA,MAAM,OAAO;CACb,OAAO;AACT;AAEA,SAAS,+BAA+B,OAI9B;CACR,MAAM,QAAQ,IAAI,MAChB,GAAG,MAAM,UAAU,2BAA2B,sBAAsB,MAAM,GAAG,EAAE,IAAI,eAAe,MAAM,KAAK,EAAE,IAC/G,EAAE,OAAO,MAAM,MAAM,CACvB;CACA,MAAM,OAAO;CACb,OAAO;AACT;AAEA,SAAS,oBACP,QACA,SAC8C;CAC9C,IAAI,CAAC,QACH,OAAO;EACL,QAAQ;EACR,eAAe,KAAA;CACjB;CAGF,IAAI,OAAO,WAAW,QAAQ,SAAS;EACrC,MAAM,aAAa,IAAI,gBAAgB;EACvC,WAAW,MAAM;EACjB,OAAO;GACL,QAAQ,WAAW;GACnB,eAAe,KAAA;EACjB;CACF;CAEA,MAAM,aAAa,IAAI,gBAAgB;CACvC,MAAM,cAAc;EAClB,WAAW,MAAM;CACnB;CAEA,OAAO,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;CACtD,QAAQ,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;CAEvD,OAAO;EACL,QAAQ,WAAW;EACnB,eAAe;GACb,OAAO,oBAAoB,SAAS,KAAK;GACzC,QAAQ,oBAAoB,SAAS,KAAK;EAC5C;CACF;AACF;AAEA,SAAS,sBAAsB,KAAqB;CAClD,IAAI;EACF,OAAO,IAAI,IAAI,GAAG,CAAC,CAAC;CACtB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,eAAe,OAAwB;CAC9C,IAAI,iBAAiB,OAAO;EAC1B,MAAM,UAAU,MAAM,QAAQ,KAAK;EACnC,OAAO,QAAQ,SAAS,IAAI,UAAU;CACxC;CACA,MAAM,UAAU,OAAO,SAAS,EAAE,CAAC,CAAC,KAAK;CACzC,OAAO,QAAQ,SAAS,IAAI,UAAU;AACxC;AAEA,SAAS,8BAA8B,OAAyB;CAC9D,IAAI,iBAAiB,WACnB,OAAO;CAET,IACE,OAAO,UAAU,YACjB,UAAU,QACV,UAAU,SACV,OAAO,MAAM,SAAS,YACtB,MAAM,KAAK,WAAW,UAAU,GAEhC,OAAO;CAET,MAAM,UAAU,eAAe,KAAK,CAAC,CAAC,YAAY;CAClD,OACE,QAAQ,SAAS,cAAc,KAC/B,QAAQ,SAAS,iBAAiB,KAClC,QAAQ,SAAS,wBAAwB,KACzC,QAAQ,SAAS,yCAAyC;AAE9D;;;;ACxJA,SAAgB,6BACd,SACA,UAGI,CAAC,GACwB;CAC7B,OAAO,wBAAwB;EAC7B;EACA,WAAW,OAAO,YAChB,MAAM,6BAA6B;GACjC,KAAK,QAAQ;GACb,WAAW,QAAQ;GACnB,MAAM,QAAQ;GACd,WAAW,QAAQ;EACrB,CAAC;EACH,gBAAgB,OAAO,EAAE,iBAAiB;GACxC,MAAM,UAAU,MAAM,wBAAwB,EAC5C,WACF,CAAC;GACD,IAAI,QAAQ,gBACV,QAAQ,6CACN,QAAQ;GAEZ,QAAQ,wBAAwB,OAAO;GACvC,OAAO;EACT;EACA,0BAA0B,OAAO,EAAE,gBAAgB,oBACjD,mCAAmC;GACjC;GACA,GAAI,kBAAkB,KAAA,IAAY,CAAC,IAAI,EAAE,cAAc;EACzD,CAAC;CACL,CAAC;AACH"}

package/dist/{command-cWXoKcwr.js → command-DgODFDCr.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 
 import { A as toSpaceCursorUrl, At as openMeldManagedBinaryPath, B as toSpaceUpdatesUrl, C as updateConfiguredSkillsConfig, Ct as deviceOpenClawProfileWorkspaceDir, Dt as normalizeOpenMeldProfileId, E as toDaemonRouteObservationUrl, Et as normalizeAccountKey, F as toSpaceMembersUrl, G as isOpenMeldOrphanedLockError, Gt as runtimeLogsDir, H as acquireLock, Ht as resolveOpenMeldPresetOwnedPathInput, I as toSpaceMetaUrl, Jt as systemDir, Kt as skillsDir, L as toSpacePasswordUrl, Mt as openMeldManagedVersionDir, Nt as openMeldRootDir, Ot as openMeldBackupsDir, P as toSpaceLeaveUrl, Pt as openMeldVersionsDir, Qt as runtimeAgentControllerLaunchContractSchema, R as toSpaceRemoveMembersUrl, Rt as resolveDefaultOpenMeldHomeDirname, St as deviceOpenClawProfileDir, T as normalizeBaseUrl, Tt as legacyAccountProfileSpacesDir, Ut as resolveOpenMeldRootDir, V as toSpaceWsUrl, Vt as resolveOpenMeldEnvPreset, W as isOpenMeldLockError, Wt as runtimeDir, X as resolveOpenMeldOrphanedLockIssue, Yt as formatLocalMachineIssueMessage, Z as runWithHeldLock, Zt as runtimeAgentControllerConversationIdMappingSpecSchema, _ as getRuntimeConfigReadHealth, _t as accountProfileSpaceCacheDir, a as resolveBaseUrl, an as resolveBuiltinAgentControllerConversationKind, at as writeCliContextState, b as setConfiguredSkillsConfig, bt as accountsDir, c as resolveExplicitGatewayUrlOrThrow, d as createDefaultRuntimeAgentControllerSettings, dn as canonicalizeBuiltinAgentControllerRef, dt as createBackgroundExecutionBlockedIssue, en as runtimeStreamingModeSchema, f as getConfiguredDaemonDispatchLimits, fn as normalizeBuiltinAgentControllerId, g as getConfiguredViewCustomization, gt as accountProfileLocalMetaPath, h as getConfiguredSkillsConfig, ht as OPENMELD_HOME_ENV_KEY, i as normalizeGatewayBaseUrlOrNull, in as conversationPolicySchema, it as resolveCliContextId, j as toSpaceDeleteUrl, jt as openMeldManagedVersionBinaryPath, k as toSpaceCreateUrl, kt as openMeldBinDir, l as DEFAULT_RUNTIME_AGENT_TRANSPORT_MODE, ln as buildAgentControllerRoutingKey, lt as assessLocalMachineFailure, mn as parseAgentControllerRef$1, nt as readCliContextState, o as resolveBaseUrlOrNull, on as HOSTED_CENTER_AGENT_CONTROLLER_REF, p as getConfiguredDeviceRuntimeState, pn as normalizeKnownBuiltinAgentControllerId, r as normalizeGatewayBaseUrl, rn as buildAgentControllerConversationRef, rt as resolveCliContext, s as resolveDefaultGatewayBaseUrl, sn as HOSTED_CENTER_AGENT_CONTROLLER_REF_ID, st as resolveOpenMeldLaneDescriptor, tn as runtimeTransportModeSchema, tt as listCliContextStates, un as canonicalizeAgentControllerRef, v as resolveRuntimeSkillsCustomTargetId, vt as accountProfileViewPath, wt as isPublishedOpenMeldHome, x as updateConfiguredDeviceRuntimeState, xt as deviceOpenClawProfileBootstrapPath, yt as accountProfileWorkspacePath, zt as resolveExplicitOpenMeldEnvPreset } from "./base-url-Cv9x5Es9.js";
-import { A as MAX_TEXT_LENGTH, At as createCenterAgentRoutineResponseSchema, B as sleep, C as createSpaceApi, D as toStructuredApiClientFailure, Dt as organizationComputersResponseSchema, E as resolveProfileSpaceHistoryGatewayHost, Et as profileErrorResponseSchema, F as OPENMELD_HEADER_PROFILE_ID, Ft as resumeCenterAgentRoutineResponseSchema, Gt as localProjectControlDaemonFrameSchema, H as getSpaceUpdatesResponseSchema, It as updateCenterAgentRoutineResponseSchema, Jt as postSpaceMembersResponseSchema, Kt as localProjectControlDiscoverProjectsResponseSchema, L as OPENMELD_HEADER_REQUEST_ID, M as parseIncoming$1, Mt as listCenterAgentRoutineRunsResponseSchema, N as parseServerErrorFrame$1, Nt as listCenterAgentRoutinesResponseSchema, O as DAEMON_STREAM_KEEPALIVE_PING, Ot as submitFeedbackIssueRequestSchema, P as resolveCustomMentionAliasOverride, Pt as pauseCenterAgentRoutineResponseSchema, Q as submitAgentControllerTaskLifecycleEventItemSchema, Rt as AGENT_ACTIVITY_PRESENCE_TTL_MAX_MS, S as createRuntimeReportingApi, St as ADDITIONAL_HUMAN_PROFILE_CREATION_DISABLED_MESSAGE, T as resolveAccountSpaceIndexGatewayHost, Tt as profileCapabilitiesResponseSchema, U as SPACE_DISPATCH_TRACE_PROMPT_PREVIEW_MAX_CHARS, Ut as agentActivitySnapshotResponseSchema, V as toErrorMessage$41, Wt as localProjectControlConnectionSchema, Xt as spaceMemberDirectoryEntrySchema, Yt as removeSpaceMembersResponseSchema, Zt as spaceMemberDirectorySchema, _n as agentControllerPermissionModeSchema, _t as organizationSkillReleaseSummarySchema, a as buildSpaceAttachmentDownloadPath, an as createProjectResponseSchema, at as COMPUTER_FILE_ACCESS_RUNTIME_CAPABILITY, bt as organizationDirectoryResponseSchema, c as createAgentProfileBindingApi, cn as updateProjectResponseSchema, ct as computerFileAccessPolicyInputSchema, d as createCurrentDeviceApi, dt as organizationSpaceDirectoryWithMemberCountsResponseSchema, ft as spaceCreatorSchema, g as createOrganizationApi, h as createOpenMeldApiClient, ht as listOrganizationSkillsResponseSchema, i as buildProfileSpaceHistoryUpsertPath, in as archiveProjectResponseSchema, it as gatewayErrorEnvelopeSchema, j as parseEnvelope$1, jt as deleteCenterAgentRoutineResponseSchema, kt as submitFeedbackIssueResponseSchema, ln as centerAgentToolSpeakerSchema, lt as computerFileAccessPolicySchema, m as createLocalRuntimeExpectedRoutesApi, mt as getOrganizationSkillResponseSchema, n as OpenMeldApiClientInvalidResponseError, o as createAccountSpaceIndexApi, on as listProjectsResponseSchema, ot as OPENMELD_RUNTIME_CAPABILITIES_HEADER, p as createFetchTransport, pt as spaceMetaSchema, qt as leaveSpaceResponseSchema, r as buildProfileSpaceHistoryStatusPath, rn as observedLocalAgentSessionSchema, s as createAgentActivityApi, sn as projectSchema, st as computerFileAccessDaemonFrameSchema, t as OpenMeldApiClientHttpError, tn as agentActivitySessionInventoryResponseSchema, un as openCodePermissionConfigSchema, ut as modelCatalogSchema, vn as agentControllerCollaborationModeSchema, vt as organizationSkillSummarySchema, wt as authProfileManagedRoleSchema, xt as ADDITIONAL_HUMAN_PROFILE_CREATION_DISABLED_CODE, y as createProfileSpaceHistoryApi, yn as toLegacySpaceAddressingWireValue, z as toErrorMessage$42, zt as agentActivityEventSchema } from "./dist-BBWU3O-I.js";
+import { A as MAX_TEXT_LENGTH, At as createCenterAgentRoutineResponseSchema, B as sleep, C as createSpaceApi, D as toStructuredApiClientFailure, Dt as organizationComputersResponseSchema, E as resolveProfileSpaceHistoryGatewayHost, Et as profileErrorResponseSchema, F as OPENMELD_HEADER_PROFILE_ID, Ft as resumeCenterAgentRoutineResponseSchema, Gt as localProjectControlDaemonFrameSchema, H as getSpaceUpdatesResponseSchema, It as updateCenterAgentRoutineResponseSchema, Jt as postSpaceMembersResponseSchema, Kt as localProjectControlDiscoverProjectsResponseSchema, L as OPENMELD_HEADER_REQUEST_ID, M as parseIncoming$1, Mt as listCenterAgentRoutineRunsResponseSchema, N as parseServerErrorFrame$1, Nt as listCenterAgentRoutinesResponseSchema, O as DAEMON_STREAM_KEEPALIVE_PING, Ot as submitFeedbackIssueRequestSchema, P as resolveCustomMentionAliasOverride, Pt as pauseCenterAgentRoutineResponseSchema, Q as submitAgentControllerTaskLifecycleEventItemSchema, Rt as AGENT_ACTIVITY_PRESENCE_TTL_MAX_MS, S as createRuntimeReportingApi, St as ADDITIONAL_HUMAN_PROFILE_CREATION_DISABLED_MESSAGE, T as resolveAccountSpaceIndexGatewayHost, Tt as profileCapabilitiesResponseSchema, U as SPACE_DISPATCH_TRACE_PROMPT_PREVIEW_MAX_CHARS, Ut as agentActivitySnapshotResponseSchema, V as toErrorMessage$41, Wt as localProjectControlConnectionSchema, Xt as spaceMemberDirectoryEntrySchema, Yt as removeSpaceMembersResponseSchema, Zt as spaceMemberDirectorySchema, _n as agentControllerPermissionModeSchema, _t as organizationSkillReleaseSummarySchema, a as buildSpaceAttachmentDownloadPath, an as createProjectResponseSchema, at as COMPUTER_FILE_ACCESS_RUNTIME_CAPABILITY, bt as organizationDirectoryResponseSchema, c as createAgentProfileBindingApi, cn as updateProjectResponseSchema, ct as computerFileAccessPolicyInputSchema, d as createCurrentDeviceApi, dt as organizationSpaceDirectoryWithMemberCountsResponseSchema, ft as spaceCreatorSchema, g as createOrganizationApi, h as createOpenMeldApiClient, ht as listOrganizationSkillsResponseSchema, i as buildProfileSpaceHistoryUpsertPath, in as archiveProjectResponseSchema, it as gatewayErrorEnvelopeSchema, j as parseEnvelope$1, jt as deleteCenterAgentRoutineResponseSchema, kt as submitFeedbackIssueResponseSchema, ln as centerAgentToolSpeakerSchema, lt as computerFileAccessPolicySchema, m as createLocalRuntimeExpectedRoutesApi, mt as getOrganizationSkillResponseSchema, n as OpenMeldApiClientInvalidResponseError, o as createAccountSpaceIndexApi, on as listProjectsResponseSchema, ot as OPENMELD_RUNTIME_CAPABILITIES_HEADER, p as createFetchTransport, pt as spaceMetaSchema, qt as leaveSpaceResponseSchema, r as buildProfileSpaceHistoryStatusPath, rn as observedLocalAgentSessionSchema, s as createAgentActivityApi, sn as projectSchema, st as computerFileAccessDaemonFrameSchema, t as OpenMeldApiClientHttpError, tn as agentActivitySessionInventoryResponseSchema, un as openCodePermissionConfigSchema, ut as modelCatalogSchema, vn as agentControllerCollaborationModeSchema, vt as organizationSkillSummarySchema, wt as authProfileManagedRoleSchema, xt as ADDITIONAL_HUMAN_PROFILE_CREATION_DISABLED_CODE, y as createProfileSpaceHistoryApi, yn as toLegacySpaceAddressingWireValue, z as toErrorMessage$42, zt as agentActivityEventSchema } from "./dist-BH4D3j09.js";
 import { $t as conversationExecutionStateSchema, A as runtimeTransportResumeControllerConversationFramePayloadSchema, An as agentInteractionRequestSchema, Ar as resolvePublicAgentAvailabilityCopy, B as openMeldSpaceEgressActionSchema, C as runtimeTransportLocalAgentControlRefreshCatalogFramePayloadSchema, D as runtimeTransportRegisterSessionRequestSchema, Dr as MAX_TEXT_LENGTH$1, E as runtimeTransportLookupRouteOwnerServiceEvidenceSchema, Er as trimmedStringFromUnknown, Fn as formatLocalSetupActionDescription, G as localFolderPickerHelperResultSchema, H as OPENMELD_LOCAL_FOLDER_PICKER_CAPABILITY_HEADER, Hn as localServiceComponentUpdateProjectionSchema, Ht as spaceFileNameSchema, I as openMeldDaemonTaskResultEnvelopeWriteSchema, In as formatLocalSetupActionLabel, Ir as resolveCommandAgentWorkActivity, Jt as openMeldDaemonControlPlaneRequestSchema, Kn as parseOptionalClientMessageId, L as openMeldDaemonTaskResultOpenClawGatewayVisibilityStatusSchema, Ln as installedLocalComponentsSnapshotSchema, M as runtimeTransportRouteCatalogChangedFramePayloadSchema, Mr as shouldPreferMappedPublicAgentFailureReason, Mt as SPACE_FILE_MAX_SIZE_BYTES, Nn as formatLocalComponentsSummaryDescription, O as runtimeTransportRegisterSessionResponseSchema, On as AGENT_INTERACTION_DEFAULT_TIMEOUT_MS, Or as resolveDetailedPublicAgentFailureReason$1, P as runtimeTransportSubmitTaskResultRequestSchema, Pn as formatLocalComponentsSummaryLabel, Qt as providerDispatchRuntimeContextSchema, R as openMeldDaemonTaskResultPayloadSchema, Rn as localCliComponentUpdateProjectionSchema, Rt as resolveSpaceFileMimeType, S as runtimeTransportLocalAgentControlManageInstallationFramePayloadSchema, T as runtimeTransportLocalAgentControlSetProfileWorkspaceFramePayloadSchema, U as localFolderPickerDaemonFrameSchema, V as LOCAL_FOLDER_PICKER_RUNTIME_CAPABILITY, W as localFolderPickerHelperProtocolResultSchema, Xn as runtimeCoordinatorExecutionTokenEnvelopeSchema, Yt as openMeldDaemonControlPlaneResponseSchema, Zn as runtimeTransportDeliveryExecutionIdentitySchema, Zt as skippedDaemonProfileSchema, _ as runtimeTransportHeartbeatRequestSchema, _n as getSpaceMessageAddressingRelationSupportForTargetKind, _r as openMeldRuntimeProfileIdSchema, a as runtimeTransportCapabilitiesSchema, b as runtimeTransportLocalAgentControlForkSessionFramePayloadSchema, bn as resolveMessageEnvelopeTargetField, c as runtimeTransportDispatchInteractionRequestSchema, ct as CONVERSATION_CONTINUITY_WARNING_PURPOSE, d as runtimeTransportDispatchPreviewEndRequestSchema, er as normalizeSpacePasswordText, f as runtimeTransportDispatchPreviewRequestSchema, ft as SPACE_MEMBER_JOIN_NOTICE_PURPOSE, g as runtimeTransportForkAgentSessionResultSchema, gn as formatCanonicalMentionLiteral, gr as normalizeOptionalWorkingDirectory, gt as sanitizeSignalTextPreview, h as runtimeTransportErrorCodeSchema, hn as collectCanonicalMentionTextFragments, hr as agentProfileIdSchema, i as localWakeRouteReportSchema, j as runtimeTransportResumeControllerConversationResultFramePayloadSchema, jn as agentInteractionResolutionSchema, jr as resolvePublicAgentFailureRecovery, k as runtimeTransportRejectedProfileRegistrationSchema, kr as resolveMappedPublicAgentFailureReason, l as runtimeTransportDispatchInteractionResponseFramePayloadSchema, m as runtimeTransportDispatchToolActivityRequestSchema, mn as MESSAGE_MENTION_TYPE_VALUES, mr as MAX_PROFILE_WORKING_DIRECTORY_LENGTH, mt as SPACE_MENTION_REJECT_NOTICE_PURPOSE, n as daemonExecutionCompatibilitySchema, nr as resolveSingleSpaceMentionLabels, o as runtimeTransportDeliverDispatchRequestSchema, p as runtimeTransportDispatchRuntimeEvidenceRequestSchema, pr as openMeldRequestContextSchema, pt as SPACE_MEMBER_REMOVE_NOTICE_PURPOSE, r as daemonStreamFrameSchema, rr as resolveSpaceMentionLabels, s as runtimeTransportDispatchInteractionDeliveredRequestSchema, t as CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH, u as runtimeTransportDispatchLifecycleRequestSchema, v as runtimeTransportHeartbeatResponseSchema, w as runtimeTransportLocalAgentControlSetEnabledFramePayloadSchema, x as runtimeTransportLocalAgentControlInterruptFramePayloadSchema, xr as profileWorkspaceModeSchema, y as runtimeTransportLocalAgentControlCancelFramePayloadSchema, yn as normalizeMessageEnvelope } from "./runtime-transport-J50KvRbm.js";
 import { r as daemonServiceLaneSchema, t as daemonServiceContractSchema } from "./service-contract-DZWQdPz5.js";
 import { A as isDaemonServiceRuntimeHeartbeatStale, B as setDaemonServiceRuntimeState, C as daemonServiceStableExecutableWrapperPath, D as getDaemonRuntimeStatus, E as ensureDaemonControlPlaneToken, F as releaseDaemonServiceLifecycleLock, G as withDaemonServiceStopLock, H as withDaemonServiceReconcileLock, I as resolveDaemonControlPlaneEndpoint, K as readDaemonLocalStateFile, L as resolveDaemonServiceRuntimeMetadata, M as readDaemonServiceLifecycleLockMeta, N as readDaemonServiceLifecycleLockMetaWithCleanup, O as getDaemonStatus, P as readDaemonServiceRuntimeSnapshot, R as restoreDaemonInstallStateSnapshot, S as daemonServiceRepairJournalPath, T as daemonStatePath, U as withDaemonServiceRegistrationMutationLock, V as uninstallDaemon, W as withDaemonServiceRunLock, _ as daemonRuntimeServiceManagerPath, a as DAEMON_SERVICE_RUNTIME_CONTROLLER_ENV, b as daemonServiceLegacyExecutableWrapperPath, c as DAEMON_SERVICE_RUNTIME_STATE_SCHEMA, d as clearDaemonServiceRuntimeState, f as daemonDispatchJournalPath, g as daemonRuntimeRootPath, h as daemonRuntimeDataPath, i as DAEMON_SERVICE_RUNTIME_AUTO_START_ENV, j as readDaemonControlPlaneToken, k as installDaemon, l as DAEMON_SERVICE_RUNTIME_SYSTEM_SERVICE_ENV, m as daemonRuntimeBundlesPath, n as writeDaemonRuntimeLease, o as DAEMON_SERVICE_RUNTIME_DETACHED_ENV, p as daemonLifecycleJournalPath, q as writeDaemonLocalStateFile, r as DAEMON_HEARTBEAT_STALE_MS, s as DAEMON_SERVICE_RUNTIME_MODE_ENV, t as readDaemonRuntimeLease, u as acquireDaemonServiceLifecycleLock, v as daemonRuntimeStateRootPath, w as daemonServiceStableLauncherPath, x as daemonServiceRecognizedExecutableWrapperPaths, y as daemonServiceActiveBundleStatePath, z as rotateDaemonControlPlaneTokenIfExpired } from "./daemon-runtime-lease-DiRoGxhm.js";
 import { A as REGISTER_RESPONSE_TIMEOUT_MS$1, C as MAX_HEARTBEAT_INTERVAL_MS$2, D as OPENCLAW_CLI_TIMEOUT_MS$1, M as RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS$1, N as RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS$1, O as PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS$1, P as RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS$1, S as HEARTBEAT_RESPONSE_TIMEOUT_MS$1, T as MIN_HEARTBEAT_INTERVAL_MS$2, _ as DAEMON_STREAM_KEEPALIVE_INTERVAL_MS$1, a as getAuthSessionState, b as DEFAULT_HEARTBEAT_INTERVAL_MS$1, c as setAuthSession, d as isBinaryDistribution, f as resolveOpenMeldDistribution, g as DAEMON_STREAM_CONNECT_TIMEOUT_MS$1, h as DAEMON_RUNTIME_CONTRACT_EPOCH$1, k as PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS$1, m as CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS$1, n as clearAuthSession, p as CATALOG_SYNC_RETRY_INTERVAL_MS$1, r as getAuthSession, v as DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS$1, y as DEFAULT_GATEWAY_CHAIN_TIMEOUT_MS$1 } from "./auth-session-BcT7IOfJ.js";
-import { a as buildOpenMeldProfileIdentityRequestHeadersWithAuth, c as buildRequestAuthHeaders, d as buildOpenMeldRequestContextFromProfile, f as buildOpenMeldRequestContextFromProfileIdentity, i as resolveSpaceRequestTimeoutMsForDiagnostics, l as canAttachAuthTokenToRequest, m as resolveAuthRequestCompatibility, n as createCliApiClientFoundation, o as buildOpenMeldProfileRequestHeadersWithAuth, p as deriveAuthBaseUrlFromGatewayUrl, r as fetchSpaceRequestWithTimeout, s as buildOpenMeldRequestContextHeadersWithAuth, u as resolveAuthTokenAttachment } from "./api-client-foundation-BJIJ540D.js";
+import { a as buildOpenMeldProfileIdentityRequestHeadersWithAuth, c as buildRequestAuthHeaders, d as buildOpenMeldRequestContextFromProfile, f as buildOpenMeldRequestContextFromProfileIdentity, i as resolveSpaceRequestTimeoutMsForDiagnostics, l as canAttachAuthTokenToRequest, m as resolveAuthRequestCompatibility, n as createCliApiClientFoundation, o as buildOpenMeldProfileRequestHeadersWithAuth, p as deriveAuthBaseUrlFromGatewayUrl, r as fetchSpaceRequestWithTimeout, s as buildOpenMeldRequestContextHeadersWithAuth, u as resolveAuthTokenAttachment } from "./api-client-foundation-BCbhO6xe.js";
 import { createRequire } from "node:module";
 import { homedir, tmpdir, userInfo } from "node:os";
 import { z } from "zod/v4";
@@ -34,7 +34,7 @@ import { Box, Container, Editor, Key, ProcessTerminal, TUI, Text, getEditorKeybi
 var package_default = {
 	$schema: "https://www.schemastore.org/package.json",
 	name: "openmeld",
-	version: "0.3.96",
+	version: "0.3.97",
 	openMeldReleaseDate: "2026-08-24",
 	description: "OpenMeld CLI - https://openmeld.ai",
 	license: "MIT",
@@ -21134,6 +21134,9 @@ const LAUNCHD_ENABLED_PATTERN = /enabled\s*=\s*(true|false)/i;
 const LAUNCHD_STATE_PATTERN = /state\s*=\s*running/i;
 const LAUNCHD_DISABLED_SERVICES_ENTRY_PATTERN = /"([^"]+)"\s*=>\s*(enabled|disabled)/i;
 const LAUNCHD_STRING_PATTERN = /<string>([^<]+)<\/string>/g;
+const LAUNCHD_ENVIRONMENT_BLOCK_PATTERN = /<key>EnvironmentVariables<\/key>\s*<dict>([\s\S]*?)<\/dict>/;
+const WINDOWS_LINE_SEPARATOR_PATTERN = /\r?\n/;
+const WINDOWS_ENVIRONMENT_ASSIGNMENT_PATTERN = /^set "([^=]+)=(.*)"$/i;
 const WINDOWS_STATE_PATTERN = /STATE\s*:\s*\d+\s+([A-Za-z_]+)/;
 const WINDOWS_AUTO_START_PATTERN = /auto|auto_start/i;
 const WINDOWS_SERVICE_DOES_NOT_EXIST_CODE_PATTERN = /(?:^|\D)1060(?:\D|$)/u;
@@ -21693,7 +21696,11 @@ function buildSystemdManager(pathInput = {}) {
 				running: readSystemdServiceActiveProbe(activeResult),
 				enabled: readSystemdServiceEnabledProbe(enabledResult),
 				definitionPath: installed ? unitPath : null,
-				commandSummary: installed ? await readSystemServiceCommandSummary(unitPath, "ExecStart=") : null
+				commandSummary: installed ? await readSystemServiceCommandSummary(unitPath, "ExecStart=") : null,
+				environmentTarget: installed ? await readDaemonServiceEnvironmentTargetFromDefinition({
+					controller: SYSTEMD_CONTROLLER,
+					path: unitPath
+				}) : null
 			};
 		},
 		readJobDiagnostics: async () => null,
@@ -21874,7 +21881,11 @@ function buildLaunchdManager(pathInput = {}) {
 				running: LAUNCHD_STATE_PATTERN.test(output),
 				enabled: enabledFromDisabledServices ?? parseLaunchdEnabled(output),
 				definitionPath: installed ? plistPath : null,
-				commandSummary: installed ? await readLaunchdProgramArguments(plistPath) : null
+				commandSummary: installed ? await readLaunchdProgramArguments(plistPath) : null,
+				environmentTarget: installed ? await readDaemonServiceEnvironmentTargetFromDefinition({
+					controller: LAUNCHD_CONTROLLER,
+					path: plistPath
+				}) : null
 			};
 		},
 		readJobDiagnostics: async () => {
@@ -22160,7 +22171,11 @@ function buildWindowsManager(pathInput = {}) {
 				running: state?.toUpperCase() === "RUNNING",
 				enabled: parseWindowsEnabled(startType),
 				definitionPath: scriptPath,
-				commandSummary: await readWindowsRunnerCommandSummary(scriptPath) ?? parseRegexGroup(qc.stdout, WINDOWS_BINARY_PATH_PATTERN) ?? null
+				commandSummary: await readWindowsRunnerCommandSummary(scriptPath) ?? parseRegexGroup(qc.stdout, WINDOWS_BINARY_PATH_PATTERN) ?? null,
+				environmentTarget: await readDaemonServiceEnvironmentTargetFromDefinition({
+					controller: WINDOWS_CONTROLLER,
+					path: scriptPath
+				})
 			};
 		},
 		readJobDiagnostics: async () => null,
@@ -22234,6 +22249,75 @@ async function readLaunchdProgramArguments(path) {
 	if (matches.length === 0) return null;
 	return matches.join(" ");
 }
+const SERVICE_ENVIRONMENT_TARGET_KEYS = {
+	preset: "OPENMELD_ENV_PRESET",
+	gatewayUrl: "OPENMELD_GATEWAY_URL",
+	authBaseUrl: "OPENMELD_AUTH_URL",
+	userFacingCommand: "OPENMELD_USER_FACING_CLI_COMMAND"
+};
+function parseDaemonServiceEnvironmentTargetFromDefinition(input) {
+	let environment;
+	if (input.controller === SYSTEMD_CONTROLLER) environment = parseSystemdEnvironment(input.definition);
+	else if (input.controller === LAUNCHD_CONTROLLER) environment = parseLaunchdEnvironment(input.definition);
+	else environment = parseWindowsEnvironment(input.definition);
+	const preset = environment[SERVICE_ENVIRONMENT_TARGET_KEYS.preset];
+	const gatewayUrl = environment[SERVICE_ENVIRONMENT_TARGET_KEYS.gatewayUrl];
+	const authBaseUrl = environment[SERVICE_ENVIRONMENT_TARGET_KEYS.authBaseUrl];
+	const userFacingCommand = environment[SERVICE_ENVIRONMENT_TARGET_KEYS.userFacingCommand];
+	if (!((preset === "prod" || preset === "canary" || preset === "dev-local") && gatewayUrl && authBaseUrl && userFacingCommand)) return null;
+	return {
+		preset,
+		gatewayUrl,
+		authBaseUrl,
+		userFacingCommand
+	};
+}
+async function readDaemonServiceEnvironmentTargetFromDefinition(input) {
+	const definition = await readFile(input.path, "utf8").catch(() => null);
+	if (!definition) return null;
+	return parseDaemonServiceEnvironmentTargetFromDefinition({
+		controller: input.controller,
+		definition
+	});
+}
+function parseSystemdEnvironment(definition) {
+	const environment = {};
+	for (const rawLine of definition.split("\n")) {
+		const line = rawLine.trim();
+		if (!line.startsWith("Environment=")) continue;
+		const assignment = line.slice(12);
+		const separatorIndex = assignment.indexOf("=");
+		if (separatorIndex <= 0) continue;
+		const key = assignment.slice(0, separatorIndex);
+		let value = assignment.slice(separatorIndex + 1);
+		if (value.startsWith("\"") && value.endsWith("\"")) value = value.slice(1, -1).replace(/\\"/g, "\"").replace(/\\\\/g, "\\");
+		environment[key] = value;
+	}
+	return environment;
+}
+function parseLaunchdEnvironment(definition) {
+	const environmentBlock = definition.match(LAUNCHD_ENVIRONMENT_BLOCK_PATTERN)?.[1];
+	if (!environmentBlock) return {};
+	const environment = {};
+	for (const match of environmentBlock.matchAll(/<key>([^<]+)<\/key>\s*<string>([^<]*)<\/string>/g)) {
+		const key = decodeXmlText(match[1] ?? "");
+		if (!key) continue;
+		environment[key] = decodeXmlText(match[2] ?? "");
+	}
+	return environment;
+}
+function parseWindowsEnvironment(definition) {
+	const environment = {};
+	for (const rawLine of definition.split(WINDOWS_LINE_SEPARATOR_PATTERN)) {
+		const match = rawLine.trim().match(WINDOWS_ENVIRONMENT_ASSIGNMENT_PATTERN);
+		if (!(match?.[1] && match[2] !== void 0)) continue;
+		environment[match[1]] = match[2].replace(/\\"/g, "\"");
+	}
+	return environment;
+}
+function decodeXmlText(value) {
+	return value.replace(/&apos;/g, "'").replace(/&quot;/g, "\"").replace(/&gt;/g, ">").replace(/&lt;/g, "<").replace(/&amp;/g, "&");
+}
 function isSystemdAvailable() {
 	return runCommand$3({
 		command: "systemctl",
@@ -32138,7 +32222,8 @@ const DAEMON_SERVICE_FULL_ALIGNMENT_ANOMALIES = /* @__PURE__ */ new Set([
 	"bundle_strategy_legacy",
 	"bundle_provenance_drift",
 	"bundle_path_invalid",
-	"duplicate_owned_processes"
+	"duplicate_owned_processes",
+	"service_manager_environment_drift"
 ]);
 const DAEMON_SERVICE_AUTO_HEAL_ANOMALIES = /* @__PURE__ */ new Set([
 	"runtime_stale",
@@ -32163,6 +32248,7 @@ const DAEMON_SERVICE_REPAIR_ANOMALIES = /* @__PURE__ */ new Set([
 	"bundle_provenance_drift",
 	"bundle_path_invalid",
 	"service_manager_path_drift",
+	"service_manager_environment_drift",
 	"duplicate_owned_processes"
 ]);
 const DAEMON_SERVICE_RUN_BLOCKING_ANOMALIES = /* @__PURE__ */ new Set([
@@ -32183,6 +32269,7 @@ const DAEMON_SERVICE_RUN_BLOCKING_ANOMALIES = /* @__PURE__ */ new Set([
 		"runtime_contract_unavailable",
 		"runtime_stale",
 		"service_manager_path_drift",
+		"service_manager_environment_drift",
 		"version_outdated"
 	])].filter((code) => code !== "runtime_stale" && code !== "version_outdated" && code !== "bundle_version_drift"),
 	"duplicate_owned_processes",
@@ -32287,7 +32374,8 @@ function buildDaemonServiceTargetSpec(input) {
 	const distribution = input.distribution ?? resolveOpenMeldDistribution();
 	return {
 		daemonVersion: input.daemonVersion,
-		bundleFormat: distribution === "binary" ? "binary_v1" : "self_contained_v1"
+		bundleFormat: distribution === "binary" ? "binary_v1" : "self_contained_v1",
+		environmentTarget: input.environmentTarget ?? resolveOpenMeldEnvironmentTargetFromEnv({ gatewayUrl: input.gatewayUrl })
 	};
 }
 function resolveDaemonServiceAlignmentDecision(input) {
@@ -32344,8 +32432,16 @@ function collectFullAlignmentReasonCodes(input) {
 	});
 	if (input.versionDecision === "already_aligned" && input.inventory.activeBundle && input.inventory.activeBundle.daemonVersion !== resolveExpectedArtifactVersion(input.inventory) && !reasonCodes.includes("bundle_version_drift")) reasonCodes.push("bundle_version_drift");
 	if (input.inventory.activeBundle && input.inventory.activeBundle.bundleFormat !== input.target.bundleFormat && !reasonCodes.includes("bundle_strategy_legacy")) reasonCodes.push("bundle_strategy_legacy");
+	if (hasServiceManagerEnvironmentDrift(input) && !reasonCodes.includes("service_manager_environment_drift")) reasonCodes.push("service_manager_environment_drift");
 	return reasonCodes;
 }
+function hasServiceManagerEnvironmentDrift(input) {
+	const status = input.inventory.serviceManagerStatus;
+	if (!(status?.installed && status.environmentTarget !== void 0)) return false;
+	const observed = status.environmentTarget;
+	const expected = input.target.environmentTarget;
+	return observed === null || observed.preset !== expected.preset || observed.gatewayUrl !== expected.gatewayUrl || observed.authBaseUrl !== expected.authBaseUrl || observed.userFacingCommand !== expected.userFacingCommand;
+}
 function resolveVersionDecision(input) {
 	const configuredVersion = resolveExpectedArtifactVersion(input.inventory);
 	if (!configuredVersion) return "already_aligned";
@@ -35438,7 +35534,19 @@ function canManageRegistryAgentSkillTargets() {
 }
 async function detectInstalledSkillsAgents(registry) {
 	const allowRegistryDefaults = canManageRegistryAgentSkillTargets();
-	return (await mapWithConcurrency(Object.entries(registry).filter(([, config]) => allowRegistryDefaults || config.globalSkillsDirSource === "config-override"), MAX_CONCURRENT_AGENT_DETECTIONS, async ([agentName, config]) => ({
+	return await detectInstalledRegistryAgents({ entries: Object.entries(registry).filter(([, config]) => allowRegistryDefaults || config.globalSkillsDirSource === "config-override") });
+}
+/**
+* Detects local Agent Controllers without granting a lane permission to manage
+* their shared skills directories. Runtime discovery is read-only machine
+* evidence and must remain available in isolated dev and canary lanes.
+*/
+async function detectInstalledRuntimeAgents(registry) {
+	const allowRegistryDefaults = canManageRegistryAgentSkillTargets();
+	return await detectInstalledRegistryAgents({ entries: Object.entries(registry).filter(([, config]) => config.runtimeSupported || allowRegistryDefaults || config.globalSkillsDirSource === "config-override") });
+}
+async function detectInstalledRegistryAgents(input) {
+	return (await mapWithConcurrency(input.entries, MAX_CONCURRENT_AGENT_DETECTIONS, async ([agentName, config]) => ({
 		agentName,
 		installed: await config.detectInstalled()
 	}))).filter((entry) => entry.installed).map((entry) => entry.agentName).sort((a, b) => a.localeCompare(b));
@@ -35531,7 +35639,7 @@ async function loadAgentCatalog() {
 		throw wrapConfigError(error, "agents.config_read_failed");
 	});
 	const builtins = resolveSkillsAgentRegistry(skillsConfig);
-	const detectedIds = new Set(await detectInstalledSkillsAgents(builtins));
+	const detectedIds = new Set(await detectInstalledRuntimeAgents(builtins));
 	const builtinsById = /* @__PURE__ */ new Map();
 	for (const [agentId, entry] of Object.entries(builtins)) builtinsById.set(agentId, {
 		agentId,
@@ -37265,9 +37373,9 @@ function createModelCatalogReadSession(input) {
 async function readModelCatalogOnce(baseUrl) {
 	try {
 		const [apiClient, baseUrlModule, clientFoundationModule] = await Promise.all([
-			import("./dist-BBWU3O-I.js").then((n) => n.w),
+			import("./dist-BH4D3j09.js").then((n) => n.w),
 			import("./base-url-Cv9x5Es9.js").then((n) => n.n),
-			import("./api-client-foundation-BJIJ540D.js").then((n) => n.t)
+			import("./api-client-foundation-BCbhO6xe.js").then((n) => n.t)
 		]);
 		if (typeof apiClient.createConfigApi !== "function") throw new Error("config api client is unavailable");
 		const resolvedBaseUrl = baseUrl ?? await baseUrlModule.resolveBaseUrl();
@@ -42469,7 +42577,10 @@ async function runDaemonServiceLifecycle(input) {
 		evidencePath: null,
 		failureStage: null
 	};
-	const target = buildDaemonServiceTargetSpec({ daemonVersion: input.expectedVersion });
+	const target = buildDaemonServiceTargetSpec({
+		daemonVersion: input.expectedVersion,
+		gatewayUrl: input.gatewayUrl
+	});
 	const emitPhase = async (phase) => {
 		state.completedPhases.push(phase);
 		await input.onPhase?.(phase);
@@ -77174,7 +77285,8 @@ async function performDaemonReinstall(input) {
 		if (!input.resolved.forceReinstall) {
 			const alreadyHealthy = await input.resolved.withReconcileLock(async () => await resolveAlreadyHealthyDaemonRepair({
 				expectedVersion: input.resolved.daemonVersion,
-				cliScriptPath: input.resolved.cliScriptPath
+				cliScriptPath: input.resolved.cliScriptPath,
+				gatewayUrl: input.gatewayUrl
 			}));
 			if (alreadyHealthy) return alreadyHealthy;
 		}
@@ -77446,7 +77558,10 @@ async function resolveAlreadyHealthyDaemonRepair(input) {
 	});
 	if (resolveDaemonServiceAlignmentDecision({
 		inventory,
-		target: buildDaemonServiceTargetSpec({ daemonVersion: input.expectedVersion })
+		target: buildDaemonServiceTargetSpec({
+			daemonVersion: input.expectedVersion,
+			gatewayUrl: input.gatewayUrl
+		})
 	}).status !== "already_aligned") return null;
 	if (!inventory.serviceContract) return null;
 	const desiredState = inventory.serviceContract.desiredState;
@@ -106512,4 +106627,4 @@ function isHumanInteractiveSpaceRuntime(runtime) {
 //#endregion
 export { runAgentsRepair as $, uninstallAgentActivityIntegrations as $a, performManagedInstall as $i, formatDaemonServiceDowngradeBlockedRecommendation as $n, resolveProfileWorkspaceRuntime as $r, readBundledOpenMeldCliSkillDocumentByPath as $t, assertFullSignalIdArgument as A, getSelectedOpenMeldProfileId as Aa, getAgentControllerPermissionModeDisplayMetadata as Ai, inspectSpaceCacheFile as An, enqueueControllerTaskLifecycleEventWhileLocked as Ao, buildAgentOverviewFromContract as Ar, shouldEmitAgentOverview as At, persistAgentTransportSelection as B, LocalProjectConnectionError as Ba, getCurrentCommandCheckState as Bi, formatRemovedCcRelationMessage as Bn, cliJsonOutputEnvelopeSchema as Bo, runDaemonServiceFullAlignment as Br, parseJsonResponse$1 as Bt, toSpaceMetaUpsertInput as C, deleteOpenMeldProfile as Ca, classifyDaemonServiceWakeability as Ci, submitProfileRuntimeAgentControllerReport as Cn, listProjectConnectionsWithStatus as Co, registerSpaceMemberSelectionOptions as Cr, runDaemonTeardownStrict as Ct, formatHumanReadTargetList as D, updateOpenMeldProfile as Da, resolveOpenMeldEnvironmentTarget as Di, resolveLocalAgentControllerBlockerReasonCodes as Dn, setDefaultProjectConnection as Do, registerDaemonControlTargetOptions as Dr, reconcileCliVersionView as Dt, buildHumanReplyContextSummary as E, resolveOpenMeldProfile as Ea, resolveDaemonDeviceId as Ei, collectLocalAgentControllerInventory as En, runIfAgentActivityBindingGenerationIsCurrent as Eo, getCliVersionInfo as Er, buildProfileWorkspaceRows as Et, emitSpaceAgentOverview as F, resolveAuthenticationGuidance as Fa, resolveAgentExecutionStatus as Fi, buildSignalIndex as Fn, emitCliJsonEnvelope as Fo, OPENMELD_AGENT_MENTAL_MODEL_LINES as Fr, fetchSpaceMeta as Ft, runAgentsCustomList as G, registerAgentActivityRoute as Ga, resolveVersionChangeDirection as Gi, assessCliUpdate as Gn, organizationJoinLinkErrorResponseSchema as Go, formatAgentReplyReadinessLabel as Gr, runDaemonStartDecisionPrompt as Gt, runAgents as H, LocalDaemonControlPlaneClientError as Ha, resetCurrentCommandCheckState as Hi, promptSearchSelect as Hn, cliJsonSkillsLoadEnvelopeSchema as Ho, resolveServiceReadinessFromServiceStatus as Hr, writeInstalledLocalComponentsSnapshot as Ht, emitSpaceCliAgentOverview as I, resolveAuthenticationGuidanceFromError as Ia, resolveAgentProfileEditCapabilities as Ii, buildSignalMessageReadProjection as In, errLine as Io, SPACE_CONTRACT_ALLOWED_ACTION_ORDER as Ir, updateSpaceMeta as It, runAgentsDetect as J, AGENT_ACTIVITY_INTEGRATION_OWNER as Ja, getDaemonSystemServiceLogPath as Ji, readDispatchOwnedRuntimeGuard as Jn, package_default as Jo, mapAgentReplyReadinessToLegacyAutoReply as Jr, runSkillsEnsure as Jt, runAgentsCustomRemove as K, resolveAgentActivityRouteForPath as Ka, readCurrentDaemonRuntimeContext as Ki, isCliUpdateCheckApplicable as Kn, revokeOrganizationJoinLinkResponseSchema as Ko, formatDeviceReplyReadinessLabel as Kr, collectSkillsReadinessSnapshot as Kt, prepareLocalAgentReadiness as L, resolveAuthenticationGuidanceFromMessage as La, resolveEvidenceSyncHealth as Li, buildSpaceRoundReadProjection as Ln, outJsonLine as Lo, areAllowedActionsEquivalent as Lr, readGatewayJsonResponse as Lt, prepareAuthenticatedSpaceCommandContext as M, buildAgentAuthenticationGuide as Ma, listAgentControllerPermissionModeOptions as Mi, assertNoRemovedCcSpaceAddressingSyntax as Mn, renderInfoCard as Mo, formatDualViewGuideForDisplay as Mr, readDaemonStartFailureLogTailLines as Mt, resolveOpenMeldProfileForSpaceCommand as N, buildHumanAuthenticationCard as Na, parseAgentControllerRef as Ni, buildDispatchResultMessageReadProjection as Nn, renderTextInfoCard as No, buildDualViewGuideMessage as Nr, fetchSpaceUpdates as Nt, parseEnvelope as O, alignSelectedOpenMeldProfileStorage as Oa, buildAgentControllerRef as Oi, resolveLocalAgentControllerLaunchability as On, unbindProject as Oo, registerAuthLoginRequestOptions as Or, emitDaemonAgentOverview as Ot, resolveSpaceAccessLabel as P, createAuthenticationError as Pa, resolveAgentControllerPermissionModeForController as Pi, buildDispatchResultReplyWorkflowProjection as Pn, sanitizeTerminalDisplayText as Po, formatAgentOverviewPayload as Pr, createCliSpaceApi as Pt, runAgentsManage as Q, resolveAgentActivityDispatcherCommand as Qa, buildInstallSelfJsonPayload as Qi, resolveElapsedTimeMs as Qn, createModelCatalogReadSession as Qr, ensureLocalSkills as Qt, buildReplyReadinessGuidance as R, getProfileDefaultView as Ra, resolveNativeAgentControllerPermissionModeForController as Ri, buildUpdatesReplyWorkflowProjection as Rn, outLine as Ro, buildAgentFacingPublicationModeGuideLines as Rr, readGatewayTextResponse as Rt, loadSpaceSignalIndexOrNull as S, createOpenMeldHumanProfile as Sa, classifyDaemonServiceRunStartability as Si, computeRetryDelayMs as Sn, listProjectBindings as So, getCommandHintsFromContract as Sr, runDaemonStop as St, buildFormalSignalReadPayload as T, primeOpenMeldProfilesSessionCache as Ta, ensureDaemonRuntimePaths as Ti, submitRuntimeAgentControllerReports as Tn, removeProjectConnection as To, registerSkillsTargetSelectionOptions as Tr, buildProfileWorkspacePresentation as Tt, runAgentsConfig as U, requestLocalAgentActivitySync as Ua, startCurrentCommandCheckScope as Ui, isReturnKeypress as Un, cliJsonSkillsShowEnvelopeSchema as Uo, resolveDaemonServiceFreshnessWarning as Ur, resolveDaemonServiceParticipationStatus as Ut, resolveAgentProfileSetup as V, validateLocalProjectConnectionPath as Va, isCurrentCommandCheckScopeActive as Vi, promptSearchMultiselect as Vn, cliJsonSkillsListEnvelopeSchema as Vo, formatDaemonFailureContextText as Vr, resolveLocalComponentsStatus as Vt, runAgentsCustomAdd as W, isAgentActivityRouteRegistered as Wa, inspectDaemonServiceInventory as Wi, runInteractivePrompt as Wn, getOrganizationJoinLinkResponseSchema as Wo, resolveCurrentReplyReadinessSnapshot as Wr, runDaemonServiceParticipationGate as Wt, runAgentsEnable as X, installAgentActivityIntegrations as Xa, readDaemonServiceJobCrashExitCode as Xi, writeDispatchSpaceActionRecord as Xn, resolveOpenClawLocalDiagnosticsValue as Xr, runSkillsUninstall as Xt, runAgentsDisable as Y, defaultManagedIntegrationPaths as Ya, isDaemonServiceJobNeverSpawned as Yi, readDispatchSpaceActionContextFromEnv as Yn, resolveGatewayChainReadiness as Yr, runSkillsInstall as Yt, runAgentsList as Z, readAgentActivityIntegrationStatus as Za, resolveDaemonServiceManager as Zi, formatElapsedTime as Zn, syncProfileWorkspaceState as Zr, runSkillsUpdate as Zt, runSpaceWriteWithPasswordRetry as _, resolveViewProfileKey as _a, buildDaemonRouteObservationPresentation as _i, promptTextEntry as _n, enqueueAgentActivityHookEvent as _o, createSpaceUpdatesGuideError as _r, runDaemonInterrupt as _t, runSpaceDelete as a, readVersionState as aa, setOpenMeldManagedProfileWorkspace as ai, ensureCommandAuthenticationOrCancel as an, formatProfileAwareOpenMeldCliCommands as ao, createProfileMenuGuideError as ar, printOpenMeldBanner as at, buildIdentityOnlyMembersSnapshotForReadProjection as b, resolveOpenMeldProfileOrNull as ba, buildDaemonServiceTargetSpec as bi, resolveServiceParticipationReadiness as bn, removeProjectOutbox as bo, createUpgradeConfirmationGuideError as br, runDaemonSnapshot as bt, runSpaceLeave as c, toStartBackgroundHelperExecutionCompatibility as ca, syncDeviceRuntimeStateProjection as ci, runAuthLogout as cn, syncLocalAgentActivity as co, createSpaceAliasTargetGuideError as cr, renderOpenMeldLogo as ct, runSpaceRemoveMembers as d, renderHumanErrorCard as da, listAgentTargetStates as di, buildAuthStatusRows as dn, readAgentActivityContextForPath as do, createSpaceMenuGuideError as dr, resolveSpaceSendText as dt, buildNextVersionState as ea, ensureOpenMeldManagedProfileWorkspace as ei, readRuntimeReportingHealthState as en, formatInlineOpenMeldCliCommands as eo, formatDaemonServiceMissingRecommendation as er, runAgentsShow as et, runSpaceSend as f, renderHumanTextErrorCard as fa, reconcileNewRunnableBuiltinAgentsForSetup as fi, buildAuthStatusSnapshot as fn, removeAgentActivityContextCache as fo, createSpacePublicationSetGuideError as fr, runDaemon as ft, runSpaceReadWithPasswordRetry as g, resolveRuntimeContext as ga, PREPARE_SESSION_RECONNECT_GRACE_MS as gi, resolveCreateProfileName as gn, readCodexSessionTitles as go, createSpaceTargetGuideError as gr, runDaemonInstall as gt, uploadPreparedSpaceFiles as h, parseCliViewMode as ha, resolveLocalRegistryAgentIdFromAgentControllerRef as hi, resolveCreateProfileKind as hn, normalizeSharedSessionTitle as ho, createSpaceSubcommandTargetGuideError as hr, runDaemonCancel as ht, runSpaceCreate as i, fetchLatestPackageInfo as ia, setCustomProfileWorkspace as ii, buildCommandAuthenticationPromptMessage as in, formatOpenMeldCliTextBlock as io, createProfileCreateGuideError as ir, colorizeDisplayProfileLabel as it, assertValidSpaceIdTarget as j, setSelectedOpenMeldProfileId as ja, getAgentControllerPermissionModeFieldLabel as ji, upsertSpaceConfig as jn, readControllerTaskLifecycleOutboxHealth as jo, DualViewGuideError as jr, runDaemonStartupPreflight as jt, isSpaceCommandOutputHandledError as k, clearSelectedOpenMeldProfileId as ka, createAgentExecutionStatusDisplayRows as ki, resolveLocalAgentControllerReportDecision as kn, canonicalizeLocalProjectPath as ko, registerBuiltinAgentSelectionOptions as kr, createDelayedSpinner as kt, runSpaceList as l, resolveCurrentDaemonExpectedVersion as la, createPrimaryBindingReadSession as li, runAuthMenu as ln, readDaemonServiceContract as lo, createSpaceContractSetGuideError as lr, renderOpenMeldTagline as lt, prepareRequestedSpaceSendFiles as m, formatMessage as ma, notifyDaemonRouteCatalogChanged as mi, createProfileByKind as mn, resolveObservedAgentActivityBinding as mo, createSpaceResultGuideError as mr, runDaemonBackgroundStartForDecision as mt, promptAndConfirmSpacePassword as n, ensureVersionStateReady as na, readProfileWorkspaceConfig as ni, connectWebSocket as nn, formatOpenMeldCliCommands as no, createDoctorFailedGuideError as nr, postLocalParticipationMutationReconcile as nt, runSpaceHistory as o, writeVersionState as oa, validateCustomProfileWorkspacePath as oi, evaluateCommandAuthentication as on, resolveSetupFollowUpCliEntryCommand as oo, createResetConfirmationGuideError as or, renderOpenMeldBrandBlockLines as ot, runSpaceWatch as p, createPresenter as pa, listBuiltinAgentsRegistryEntries as pi, formatActiveOrganizationLabel as pn, buildAgentActivityEvent as po, createSpaceRemoveMembersGuideError as pr, runDaemonAutostart as pt, runAgentsCustomUpdate as q, unregisterAgentActivityRoute as qa, readCurrentObservedDaemonRuntimeStatus as qi, assertDispatchOwnedRuntimePublicWriteAllowed as qn, compareAgentControllerRefsForDisplay as qo, formatHumanReplyReadinessReason as qr, runSkillsCheck as qt, runSpaceAddMembers as r, fetchLatestCliBinaryRelease as ra, resolveConfiguredProfileWorkspacePath as ri, assessServerRequiredVersion as rn, formatOpenMeldCliLine as ro, createProfileActionGuideError as rr, colorizeAgentLabel as rt, runSpaceJoin as s, resolveDaemonRuntimeContractCompatibility as sa, describeProfileWorkspacePathValidationFailure as si, runAuthLogin as sn, resolveUserFacingCliEntryCommand as so, createSpaceAddMembersGuideError as sr, renderOpenMeldHeader as st, buildCreateSpacePasswordPromptConfig as t, compareSemver as ta, normalizeCustomProfileWorkspacePath as ti, readRecentDaemonDispatchJournalEvents as tn, formatOpenMeldCliCommand as to, canUseInteractivePrompts as tr, formatTransportModeDisplay as tt, runSpacePassword as u, buildHumanErrorCopy as ua, resolveAgentProfilePrimaryAgentControllerReport as ui, runAuthStatus as un, upsertDaemonServiceContract as uo, createSpaceLeaveGuideError as ur, resolveGatewayWebOrigin as ut, buildHumanReadSignalsTranscriptItems as v, isSelectedOpenMeldProfileRequiredError as va, buildOnboardingPlan as vi, ensureAgentProfileRuntimeBinding as vn, removeProjectInbox as vo, createStartAgentIdentityGuideError as vr, runDaemonReinstall as vt, buildFormalDispatchResultReadPayload as w, listOpenMeldProfiles as wa, readRecentDaemonLifecycleEvents as wi, submitRuntimeAgentControllerReport as wn, migrateProjectBindingStore as wo, SPACE_ADD_MEMBERS_PROGRESS_HEARTBEAT_MS as wr, runDaemonUninstall as wt, loadSpaceIdentityDirectoryOrNull as x, createOpenMeldAgentProfile as xa, resolveDaemonServiceAlignmentDecision as xi, assessActionParticipationCandidate as xn, bindProject as xo, getCommandEntryContract as xr, runDaemonStatusFlow as xt, emitHumanReadSignalsTextProjection as y, requireOpenMeldProfile as ya, getSetupFlowCopy as yi, formatServiceParticipationReadinessLabel as yn, readAgentActivityOutboxHealth as yo, createStartAuthenticationGuideError as yr, runDaemonRunAfterEntryChecks as yt, resolveHumanControllerDisplayName as z, setProfileDefaultView as za, finishCurrentCommandCheckScope as zi, createSpaceMemberIdentityIndex as zn, cliBinaryDeltaPatchSchema as zo, canonicalizeAllowedActions as zr, toStructuredGatewayFailure as zt };
 
-//# sourceMappingURL=command-cWXoKcwr.js.map
+//# sourceMappingURL=command-DgODFDCr.js.map