very-happy-cli 0.2.191 → 0.2.192

package/dist/accountService-Bddy0zwL.cjs

@@ -0,0 +1,571 @@
+'use strict';
+
+var node_crypto = require('node:crypto');
+var node_fs = require('node:fs');
+var path = require('node:path');
+var index = require('./index-BzAYnYct.cjs');
+var node_child_process = require('node:child_process');
+var claudeAccountEnv = require('./claudeAccountEnv-BOBpJ3k8.cjs');
+var store = require('./store-DV__wCvP.cjs');
+
+const CHECK_TIMEOUT_MS = 2e4;
+const DEFAULT_CHECK_MODEL = "claude-haiku-4-5";
+function classifyHttpCheck(kind, status, bodySnippet, now) {
+  if (status >= 200 && status < 300) return { status: "ok", at: now };
+  if (status === 401 || status === 403) {
+    return { status: kind === "claude-subscription" ? "expired" : "invalid", at: now, detail: `HTTP ${status}` };
+  }
+  return { status: "unverified", at: now, detail: `HTTP ${status}${bodySnippet ? `: ${sanitizeDetail(bodySnippet)}` : ""}` };
+}
+function classifyClaudeCheck(exitCode, output, now) {
+  if (exitCode === 0) return { status: "ok", at: now };
+  if (/\b401\b|OAuth access token is invalid|invalid.*token|token.*(expired|revoked)/i.test(output)) {
+    return { status: "expired", at: now, detail: sanitizeDetail(lastLine(output)) };
+  }
+  return { status: "unverified", at: now, detail: sanitizeDetail(lastLine(output) || `exit ${exitCode}`) };
+}
+function lastLine(text) {
+  return text.trim().split("\n").filter(Boolean).pop() ?? "";
+}
+function sanitizeDetail(text) {
+  return text.replace(/sk-ant-[A-Za-z0-9_-]+/g, "sk-ant-\u2026").replace(/\s+/g, " ").trim().slice(0, 200);
+}
+async function checkApiAccount(record, key, now = Date.now) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), CHECK_TIMEOUT_MS);
+  try {
+    const res = await fetch(`${record.baseUrl}/v1/messages`, {
+      method: "POST",
+      signal: controller.signal,
+      headers: {
+        "content-type": "application/json",
+        "anthropic-version": "2023-06-01",
+        "x-api-key": key,
+        authorization: `Bearer ${key}`
+      },
+      body: JSON.stringify({
+        model: record.models?.[0] ?? DEFAULT_CHECK_MODEL,
+        max_tokens: 1,
+        messages: [{ role: "user", content: "ping" }]
+      })
+    });
+    const text = res.ok ? "" : (await res.text().catch(() => "")).slice(0, 400);
+    return classifyHttpCheck(record.kind, res.status, text, now());
+  } catch (error) {
+    return { status: "unverified", at: now(), detail: sanitizeDetail(error instanceof Error ? error.message : String(error)) };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function checkSubscriptionAccount(token, scratchDir, now = Date.now) {
+  node_fs.mkdirSync(scratchDir, { recursive: true });
+  const settingsPath = path.join(scratchDir, "check-settings.json");
+  node_fs.writeFileSync(settingsPath, JSON.stringify({ disableAllHooks: true }));
+  const env = { ...process.env };
+  for (const key of claudeAccountEnv.ACCOUNT_STRIPPED_ENV_KEYS) delete env[key];
+  env.CLAUDE_CODE_OAUTH_TOKEN = token;
+  return new Promise((resolve) => {
+    let output = "";
+    const child = node_child_process.spawn("claude", ["-p", "ping", "--model", "haiku", "--no-session-persistence", "--strict-mcp-config", "--settings", settingsPath], {
+      cwd: scratchDir,
+      env,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    const timer = setTimeout(() => child.kill("SIGKILL"), CHECK_TIMEOUT_MS);
+    child.stdout.on("data", (d) => {
+      output += d;
+    });
+    child.stderr.on("data", (d) => {
+      output += d;
+    });
+    child.on("error", (error) => {
+      clearTimeout(timer);
+      resolve({ status: "unverified", at: now(), detail: sanitizeDetail(error.message) });
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      resolve(classifyClaudeCheck(code, output.slice(-2e3), now()));
+    });
+  });
+}
+
+const LOGIN_CODE_TIMEOUT_MS = 10 * 6e4;
+const LOGIN_URL_TIMEOUT_MS = 2e4;
+const LOGIN_EXCHANGE_TIMEOUT_MS = 6e4;
+const LOGIN_RETAIN_MS = 10 * 6e4;
+function stripAnsi(text) {
+  return text.replace(/\x1b\][^\x07\x1b]*(\x07|\x1b\\)/g, "").replace(/\x1b\[[0-9;?<>=]*[ -/]*[@-~]/g, " ").replace(/\x1b[()][A-Za-z0-9]/g, "").replace(/\x1b[=>78]/g, "");
+}
+function findAuthorizeUrl(clean) {
+  const m = clean.match(/https:\/\/[^\s]*\/oauth\/authorize\?[^\s]+/);
+  return m ? m[0] : null;
+}
+function findSetupToken(clean) {
+  const m = clean.match(/sk-ant-oat01-[A-Za-z0-9_-]{20,}/);
+  return m ? m[0] : null;
+}
+function findLoginError(clean) {
+  const m = clean.match(/(OAuth error:[^\n]*?)(?:\s{2,}|Press|$)/) ?? clean.match(/(Login failed[^\n]*)/);
+  return m ? m[1].replace(/\s+/g, " ").trim().slice(0, 200) : null;
+}
+function setupTokenEnv(base) {
+  const env = {};
+  for (const [k, v] of Object.entries(base)) if (typeof v === "string") env[k] = v;
+  for (const key of claudeAccountEnv.ACCOUNT_STRIPPED_ENV_KEYS) delete env[key];
+  env.BROWSER = "true";
+  env.TERM = "xterm-256color";
+  return env;
+}
+class SetupTokenLoginManager {
+  constructor(deps) {
+    this.deps = deps;
+    this.now = deps.now ?? Date.now;
+  }
+  logins = /* @__PURE__ */ new Map();
+  now;
+  /** One login at a time per machine: a second start cancels nothing and is refused. */
+  activeLoginId() {
+    for (const [id, e] of this.logins) if (e.status.state === "waiting-code" || e.status.state === "exchanging") return id;
+    return null;
+  }
+  async start() {
+    const busy = this.activeLoginId();
+    if (busy) throw Object.assign(new Error("another login is in progress"), { code: "login-busy", loginId: busy });
+    const loginId = this.deps.newId();
+    const entry = {
+      status: { loginId, state: "starting" },
+      pty: null,
+      output: "",
+      timers: []
+    };
+    this.logins.set(loginId, entry);
+    const urlReady = new Promise((resolve) => {
+      entry.resolveUrl = resolve;
+    });
+    try {
+      entry.pty = this.deps.spawnPty(setupTokenEnv(this.deps.env));
+    } catch (error) {
+      this.finish(entry, "failed", `could not start claude setup-token: ${error instanceof Error ? error.message : String(error)}`);
+      return { ...entry.status };
+    }
+    entry.pty.onData((data) => this.onData(entry, data));
+    entry.pty.onExit(({ exitCode }) => {
+      entry.pty = null;
+      if (entry.tokenSeen) return;
+      if (entry.status.state === "starting" || entry.status.state === "waiting-code" || entry.status.state === "exchanging") {
+        this.finish(entry, "failed", findLoginError(stripAnsi(entry.output)) ?? `claude setup-token exited (${exitCode})`);
+      }
+    });
+    entry.timers.push(setTimeout(() => {
+      if (entry.status.state === "starting") this.finish(entry, "failed", "claude setup-token printed no sign-in URL");
+    }, LOGIN_URL_TIMEOUT_MS));
+    await Promise.race([urlReady, new Promise((r) => entry.timers.push(setTimeout(r, LOGIN_URL_TIMEOUT_MS + 50)))]);
+    return { ...entry.status };
+  }
+  submit(loginId, code) {
+    const entry = this.get(loginId);
+    if (entry.status.state !== "waiting-code" || !entry.pty) return { ...entry.status };
+    entry.status = { ...entry.status, state: "exchanging" };
+    entry.output = "";
+    entry.pty.write(code.trim().replace(/[\r\n]/g, "") + "\r");
+    entry.timers.push(setTimeout(() => {
+      if (entry.status.state === "exchanging" && !entry.tokenSeen) this.finish(entry, "failed", "timed out waiting for Claude to issue the token");
+    }, LOGIN_EXCHANGE_TIMEOUT_MS));
+    return { ...entry.status };
+  }
+  status(loginId) {
+    return { ...this.get(loginId).status };
+  }
+  cancel(loginId) {
+    const entry = this.get(loginId);
+    if (entry.status.state === "starting" || entry.status.state === "waiting-code" || entry.status.state === "exchanging") {
+      this.finish(entry, "canceled");
+    }
+    return { ...entry.status };
+  }
+  dispose() {
+    for (const entry of this.logins.values()) this.finish(entry, entry.status.state === "succeeded" ? "succeeded" : "canceled");
+    this.logins.clear();
+  }
+  get(loginId) {
+    const entry = this.logins.get(loginId);
+    if (!entry) throw Object.assign(new Error("unknown or expired login"), { code: "login-not-found" });
+    return entry;
+  }
+  onData(entry, data) {
+    entry.output = (entry.output + data).slice(-64e3);
+    const clean = stripAnsi(entry.output);
+    if (entry.status.state === "starting") {
+      const url = findAuthorizeUrl(clean);
+      if (url) {
+        const expiresAt = this.now() + LOGIN_CODE_TIMEOUT_MS;
+        entry.status = { ...entry.status, state: "waiting-code", url, expiresAt };
+        entry.timers.push(setTimeout(() => {
+          if (entry.status.state === "waiting-code") this.finish(entry, "expired");
+        }, LOGIN_CODE_TIMEOUT_MS));
+        entry.resolveUrl?.();
+      }
+      return;
+    }
+    if (entry.status.state !== "exchanging" || entry.tokenSeen) return;
+    const token = findSetupToken(clean);
+    if (token) {
+      entry.tokenSeen = true;
+      entry.output = "";
+      this.deps.onToken(entry.status.loginId, token).then(
+        (account) => this.finish(entry, "succeeded", void 0, account),
+        (error2) => this.finish(entry, "failed", error2 instanceof Error ? error2.message : String(error2))
+      );
+      return;
+    }
+    const error = findLoginError(clean);
+    if (error) this.finish(entry, "failed", error);
+  }
+  finish(entry, state, error, account) {
+    for (const t2 of entry.timers) clearTimeout(t2);
+    entry.timers = [];
+    const { loginId, url, expiresAt } = entry.status;
+    entry.status = { loginId, state, ...url && state !== "succeeded" ? { url } : {}, ...expiresAt ? { expiresAt } : {}, ...account ? { account } : {}, ...error ? { error } : {} };
+    entry.resolveUrl?.();
+    const pty = entry.pty;
+    entry.pty = null;
+    try {
+      pty?.kill();
+    } catch {
+    }
+    entry.output = "";
+    const loginId_ = loginId;
+    const t = setTimeout(() => this.logins.delete(loginId_), LOGIN_RETAIN_MS);
+    t.unref?.();
+  }
+}
+
+class AccountError extends Error {
+  constructor(code, message, sessions) {
+    super(message);
+    this.code = code;
+    this.sessions = sessions;
+  }
+}
+const DAEMON_DOWN = /^(No daemon running|Daemon is not running)/;
+function localRestartFailure(error, stillRunning) {
+  return { ok: false, stillRunning, notRunning: !stillRunning && (error.startsWith("restart-precheck:not-tracked") || DAEMON_DOWN.test(error)), error };
+}
+function bindResultMessages(result, sessionId, target, noun) {
+  const bound = `Bound ${sessionId} \u2192 ${target}.`;
+  if (result.restart === "done") return { out: [bound, "Restarted in place (history kept)."], err: [], exitCode: 0 };
+  if (result.restart === "pending") return { out: [bound, "Restart in progress."], err: [], exitCode: 0 };
+  if (result.restart === "skipped") return { out: [bound, `Not restarted${result.error ? ` (${result.error})` : ""}; applies when the session next starts.`], err: [], exitCode: 0 };
+  if (result.rolledBack) return { out: [], err: [`Not switched: the restart failed (${result.error}). The session keeps running on its previous ${noun}; the binding was not changed.`], exitCode: 1 };
+  return { out: [], err: [`Binding to ${target} saved, but the restart failed (${result.error}); the session is not running and starts on ${target} next time.`], exitCode: 1 };
+}
+const BIND_RESTART_BUDGET_MS = 22e3;
+class AccountService {
+  constructor(deps) {
+    this.deps = deps;
+    this.home = deps.home;
+    this.env = deps.env ?? process.env;
+    this.now = deps.now ?? Date.now;
+  }
+  home;
+  env;
+  now;
+  logins = null;
+  /** loginId → account to (re)write when its token arrives. */
+  loginTargets = /* @__PURE__ */ new Map();
+  state() {
+    return store.buildAgentProfilesState(this.home, store.readAccounts(this.home), store.defaultSecretProbe(this.env), this.now(), this.deps.daemonPid ?? process.pid);
+  }
+  summary(id) {
+    const record = store.readAccounts(this.home).accounts[id];
+    if (!record) throw new AccountError("not-found", `no account "${id}"`);
+    return store.summarizeAccount(this.home, id, record, store.defaultSecretProbe(this.env), this.now());
+  }
+  changed() {
+    try {
+      this.deps.onChanged?.();
+    } catch {
+    }
+  }
+  editable(id) {
+    const file = store.readAccountsFileV2(this.home);
+    const record = file.accounts[id];
+    if (!record) {
+      if (store.readAccounts(this.home).accounts[id]?.legacy) throw new AccountError("legacy-readonly", `"${id}" comes from providers.json; edit or remove it there`);
+      throw new AccountError("not-found", `no account "${id}"`);
+    }
+    return { file, record };
+  }
+  // ---- add / edit -----------------------------------------------------------
+  async add(params) {
+    const parsed = index.AgentProfileAddRequestSchema.safeParse(params);
+    if (!parsed.success) throw new AccountError("invalid-params", parsed.error.issues[0]?.message ?? "invalid params");
+    const req = parsed.data;
+    const file = store.readAccountsFileV2(this.home);
+    const id = store.newAccountId(req.label, "claude-api", Object.keys(store.readAccounts(this.home).accounts));
+    const models = [];
+    const contextWindows = {};
+    for (const m of req.models ?? []) {
+      if (typeof m === "string") models.push(m);
+      else {
+        models.push(m.id);
+        if (m.contextWindow) contextWindows[m.id] = m.contextWindow;
+      }
+    }
+    const record = {
+      label: req.label,
+      agent: "claude",
+      kind: "claude-api",
+      createdAt: this.now(),
+      baseUrl: req.baseUrl.replace(/\/+$/, ""),
+      key: req.key.source === "paste" ? { source: "stored" } : req.key.source === "file" ? { source: "file", path: req.key.path } : { source: "env", name: req.key.name },
+      ...models.length > 0 ? { models } : {},
+      ...Object.keys(contextWindows).length > 0 ? { contextWindows } : {}
+    };
+    if (req.key.source === "paste") store.writeAccountSecret(this.home, id, req.key.value);
+    file.accounts[id] = record;
+    store.writeAccountsFile(this.home, file);
+    this.changed();
+    return this.test(id);
+  }
+  rename(accountId, label) {
+    if (typeof accountId !== "string" || typeof label !== "string" || !label.trim() || label.trim().length > 60) {
+      throw new AccountError("invalid-params", "accountId and a 1\u201360 character label are required");
+    }
+    const { file, record } = this.editable(accountId);
+    record.label = label.trim();
+    store.writeAccountsFile(this.home, file);
+    this.changed();
+    return this.summary(accountId);
+  }
+  /**
+   * `force` with bound sessions: the credential is gone, so each of those
+   * sessions restarts in place right away and comes back `unavailable`
+   * (refusing turns, Q3) instead of running on the deleted credential until
+   * its next start. Restarts run in parallel within the bind budget; one
+   * still going reports 'pending'.
+   */
+  async remove(accountId, force) {
+    if (typeof accountId !== "string") throw new AccountError("invalid-params", "accountId is required");
+    const { file } = this.editable(accountId);
+    const sessions = store.sessionsBoundTo(store.readSessionBindings(this.home), accountId);
+    if (sessions.length > 0 && force !== true) {
+      throw new AccountError("in-use", `${sessions.length} session(s) use this account; switch them first or remove with force`, sessions);
+    }
+    delete file.accounts[accountId];
+    for (const [agent, id] of Object.entries(file.defaults)) if (id === accountId) delete file.defaults[agent];
+    store.writeAccountsFile(this.home, file);
+    store.removeAccountSecret(this.home, accountId);
+    this.changed();
+    if (sessions.length === 0 || !this.deps.restartSession) return { removed: true, sessions };
+    const restarts = {};
+    await Promise.all(sessions.map(async (sessionId) => {
+      restarts[sessionId] = await this.restartWithinBudget(sessionId);
+    }));
+    return { removed: true, sessions, restarts };
+  }
+  /** 'done' | 'skipped' (not running here) | 'pending' (still going after the budget) | 'failed' */
+  async restartWithinBudget(sessionId) {
+    const outcome = await Promise.race([
+      this.deps.restartSession(sessionId),
+      new Promise((r) => setTimeout(() => r("pending"), BIND_RESTART_BUDGET_MS).unref?.())
+    ]);
+    if (outcome === "pending") return "pending";
+    if (outcome.ok) return "done";
+    return outcome.notRunning ? "skipped" : "failed";
+  }
+  setDefault(agent, accountId) {
+    if (agent !== "claude") throw new AccountError("invalid-params", 'agent must be "claude"');
+    if (accountId !== null && typeof accountId !== "string") throw new AccountError("invalid-params", "accountId must be a string or null");
+    if (typeof accountId === "string") {
+      const record = store.readAccounts(this.home).accounts[accountId];
+      if (!record) throw new AccountError("not-found", `no account "${accountId}"`);
+      if (record.agent !== agent) throw new AccountError("invalid-params", `"${accountId}" is not a ${agent} account`);
+    }
+    const file = store.readAccountsFileV2(this.home);
+    if (accountId === null) delete file.defaults[agent];
+    else file.defaults[agent] = accountId;
+    store.writeAccountsFile(this.home, file);
+    this.changed();
+    return this.state();
+  }
+  // ---- check ---------------------------------------------------------------
+  readSecretFor(id, record) {
+    try {
+      if (record.kind === "claude-subscription" || record.key?.source === "stored") return node_fs.readFileSync(store.accountSecretPath(this.home, id), "utf8").trim() || null;
+      if (record.key?.source === "file") return node_fs.readFileSync(store.expandHome(record.key.path), "utf8").trim() || null;
+      if (record.key?.source === "env") return this.env[record.key.name]?.trim() || null;
+    } catch {
+      return null;
+    }
+    return null;
+  }
+  async test(accountId) {
+    if (typeof accountId !== "string") throw new AccountError("invalid-params", "accountId is required");
+    const record = store.readAccounts(this.home).accounts[accountId];
+    if (!record) throw new AccountError("not-found", `no account "${accountId}"`);
+    const secret = this.readSecretFor(accountId, record);
+    if (!secret) return this.summary(accountId);
+    const check = this.deps.check ? await this.deps.check(record, secret) : record.kind === "claude-subscription" ? await checkSubscriptionAccount(secret, path.join(this.home, "tmp", "account-check"), this.now) : await checkApiAccount(record, secret, this.now);
+    if (!record.legacy) {
+      const file = store.readAccountsFileV2(this.home);
+      if (file.accounts[accountId]) {
+        file.accounts[accountId].check = check;
+        store.writeAccountsFile(this.home, file);
+        this.changed();
+      }
+      return this.summary(accountId);
+    }
+    return { ...this.summary(accountId), status: check.status, checkedAt: check.at, ...check.detail ? { statusDetail: check.detail } : {} };
+  }
+  // ---- remote login (claude setup-token) -------------------------------------
+  loginManager() {
+    if (this.logins) return this.logins;
+    const spawnPty = this.deps.spawnPty;
+    if (!spawnPty) throw new AccountError("internal", "remote login is not available in this process");
+    this.logins = new SetupTokenLoginManager({
+      spawnPty,
+      env: this.env,
+      newId: () => node_crypto.randomUUID(),
+      now: this.now,
+      onToken: async (loginId, token) => {
+        const target = this.loginTargets.get(loginId) ?? {};
+        this.loginTargets.delete(loginId);
+        return this.storeSubscriptionToken(token, target);
+      }
+    });
+    return this.logins;
+  }
+  /** Also the terminal path (`very-happy account login`). */
+  storeSubscriptionToken(token, target) {
+    const file = store.readAccountsFileV2(this.home);
+    const now = this.now();
+    let id = target.accountId;
+    if (id) {
+      const record = file.accounts[id];
+      if (!record || record.kind !== "claude-subscription") throw new AccountError("not-found", `no subscription account "${id}"`);
+      record.expiresAt = now + store.SUBSCRIPTION_TOKEN_TTL_MS;
+      record.check = { status: "ok", at: now };
+    } else {
+      const label = target.label?.trim() || "Claude";
+      id = store.newAccountId(label, "claude-subscription", Object.keys(store.readAccounts(this.home).accounts));
+      file.accounts[id] = { label, agent: "claude", kind: "claude-subscription", createdAt: now, expiresAt: now + store.SUBSCRIPTION_TOKEN_TTL_MS, check: { status: "ok", at: now } };
+    }
+    store.writeAccountSecret(this.home, id, token);
+    store.writeAccountsFile(this.home, file);
+    this.changed();
+    return this.summary(id);
+  }
+  async loginStart(params) {
+    const parsed = index.AgentProfileLoginStartRequestSchema.safeParse(params);
+    if (!parsed.success) throw new AccountError("invalid-params", parsed.error.issues[0]?.message ?? "invalid params");
+    const { accountId, label } = parsed.data;
+    if (accountId) {
+      const record = store.readAccounts(this.home).accounts[accountId];
+      if (!record || record.kind !== "claude-subscription") throw new AccountError("not-found", `no subscription account "${accountId}"`);
+    } else if (!label) {
+      throw new AccountError("invalid-params", "label is required for a new account");
+    }
+    let status;
+    try {
+      status = await this.loginManager().start();
+    } catch (error) {
+      const code = error.code ?? "setup-token-failed";
+      throw new AccountError(code, error instanceof Error ? error.message : String(error));
+    }
+    this.loginTargets.set(status.loginId, { accountId, label });
+    return status;
+  }
+  loginOp(fn) {
+    try {
+      return fn(this.loginManager());
+    } catch (error) {
+      const code = error.code ?? "internal";
+      throw new AccountError(code, error instanceof Error ? error.message : String(error));
+    }
+  }
+  loginSubmit(params) {
+    const parsed = index.AgentProfileLoginSubmitRequestSchema.safeParse(params);
+    if (!parsed.success) throw new AccountError("invalid-params", "loginId and code are required");
+    return this.loginOp((m) => m.submit(parsed.data.loginId, parsed.data.code));
+  }
+  loginStatus(loginId) {
+    if (typeof loginId !== "string") throw new AccountError("invalid-params", "loginId is required");
+    return this.loginOp((m) => m.status(loginId));
+  }
+  loginCancel(loginId) {
+    if (typeof loginId !== "string") throw new AccountError("invalid-params", "loginId is required");
+    const status = this.loginOp((m) => m.cancel(loginId));
+    this.loginTargets.delete(loginId);
+    return status;
+  }
+  dispose() {
+    this.logins?.dispose();
+  }
+  // ---- sessions --------------------------------------------------------------
+  /** Validates and writes a session binding (no restart). */
+  writeBinding(sessionId, accountId, model) {
+    if (accountId !== null) {
+      const record = store.readAccounts(this.home).accounts[accountId];
+      if (!record) throw new AccountError("not-found", `no account "${accountId}"`);
+      if (model !== void 0) {
+        if (record.kind !== "claude-api") throw new AccountError("invalid-params", "model applies to API accounts only");
+        if (record.models && record.models.length > 0 && !record.models.includes(model)) {
+          throw new AccountError("invalid-params", `model "${model}" is not in ${accountId}'s models (${record.models.join(", ")})`);
+        }
+      }
+    } else if (model !== void 0) {
+      throw new AccountError("invalid-params", "model cannot be set for the machine login");
+    }
+    store.writeSessionBinding(this.home, sessionId, { account: accountId, ...model ? { model } : {} });
+  }
+  async bind(params) {
+    const parsed = index.AgentProfileBindRequestSchema.safeParse(params);
+    if (!parsed.success) throw new AccountError("invalid-params", parsed.error.issues[0]?.message ?? "invalid params");
+    const { sessionId, accountId, model, restart } = parsed.data;
+    const previous = store.readSessionBindingV2(this.home, sessionId);
+    this.writeBinding(sessionId, accountId, model);
+    this.changed();
+    if (restart === false || !this.deps.restartSession) return { bound: true, restart: "skipped" };
+    const outcome = await Promise.race([
+      this.deps.restartSession(sessionId),
+      new Promise((r) => setTimeout(() => r("pending"), BIND_RESTART_BUDGET_MS).unref?.())
+    ]);
+    if (outcome === "pending") return { bound: true, restart: "pending" };
+    if (outcome.ok) return { bound: true, restart: "done" };
+    if (outcome.stillRunning) {
+      store.writeSessionBinding(this.home, sessionId, previous);
+      this.changed();
+      return { bound: false, rolledBack: true, restart: "failed", error: outcome.error };
+    }
+    if (outcome.notRunning) return { bound: true, restart: "skipped", error: outcome.error };
+    return { bound: true, restart: "failed", error: outcome.error };
+  }
+  /**
+   * Spawn-time choice → the account a NEW session starts on.
+   *   undefined → the machine default for this agent (none = machine login)
+   *   null      → machine login
+   *   id        → that account; must exist and be usable (Q3: never fall back)
+   */
+  resolveSpawnAccount(agent, requested) {
+    if (requested !== void 0 && requested !== null && typeof requested !== "string") {
+      throw new AccountError("invalid-params", "agentProfileId must be a string or null");
+    }
+    const file = store.readAccounts(this.home);
+    const id = requested === void 0 ? file.defaults[agent] ?? null : requested;
+    if (id === null || id === "") return null;
+    const record = file.accounts[id];
+    if (!record) throw new AccountError("agent-profile-unavailable", `agent-profile-unavailable:missing: no account "${id}" on this machine`);
+    if (record.agent !== agent) throw new AccountError("agent-profile-unavailable", `agent-profile-unavailable:agent-mismatch: "${id}" is a ${record.agent} account`);
+    const { status } = store.summarizeAccount(this.home, id, record, store.defaultSecretProbe(this.env), this.now());
+    if (status === "missing-secret" || status === "expired" || status === "invalid") {
+      throw new AccountError("agent-profile-unavailable", `agent-profile-unavailable:${status}: account "${record.label}"`);
+    }
+    return id;
+  }
+}
+
+exports.AccountError = AccountError;
+exports.AccountService = AccountService;
+exports.bindResultMessages = bindResultMessages;
+exports.localRestartFailure = localRestartFailure;