@apilift/cli 1.4.33 → 1.4.35

package/dist/apilift.js

@@ -4529,7 +4529,7 @@ function isRef(value) {
 function cloneIssues(issues) {
   return issues.map((iss) => iss.path ? { ...iss, path: iss.path.slice() } : { ...iss });
 }
-function isRecursive(inst, stack, resolve6) {
+function isRecursive(inst, stack, resolve10) {
   const cached2 = recursive.get(inst);
   if (cached2 !== void 0)
     return cached2 ? PROVEN : NONE;
@@ -4539,7 +4539,7 @@ function isRecursive(inst, stack, resolve6) {
   let result3 = NONE;
   const check2 = (child) => {
     if (result3 !== PROVEN && child?._zod) {
-      const answer = isRecursive(child, stack, resolve6);
+      const answer = isRecursive(child, stack, resolve10);
       if (answer > result3)
         result3 = answer;
     }
@@ -4550,7 +4550,7 @@ function isRecursive(inst, stack, resolve6) {
       const desc = Object.getOwnPropertyDescriptor(sh, key);
       if (spread && !desc.enumerable)
         continue;
-      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve6) : NONE;
+      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve10) : NONE;
       if (child > answer)
         answer = child;
     }
@@ -4614,7 +4614,7 @@ function isRecursive(inst, stack, resolve6) {
       break;
     // `$ZodLazy` caches its inner on the def, so a resolved edge is followed exactly
     case "lazy": {
-      const inner = def._cachedInner ?? (resolve6 ? inst._zod.innerType : void 0);
+      const inner = def._cachedInner ?? (resolve10 ? inst._zod.innerType : void 0);
       merge2(inner ? isRecursive(inner, stack, false) : ASSUMED);
       break;
     }
@@ -20861,11 +20861,11 @@ var require_codegen = __commonJS({
         const rhs = this.rhs === void 0 ? "" : ` = ${this.rhs}`;
         return `${varKind} ${this.name}${rhs};` + _n;
       }
-      optimizeNames(names2, constants) {
+      optimizeNames(names2, constants2) {
         if (!names2[this.name.str])
           return;
         if (this.rhs)
-          this.rhs = optimizeExpr(this.rhs, names2, constants);
+          this.rhs = optimizeExpr(this.rhs, names2, constants2);
         return this;
       }
       get names() {
@@ -20882,10 +20882,10 @@ var require_codegen = __commonJS({
       render({ _n }) {
         return `${this.lhs} = ${this.rhs};` + _n;
       }
-      optimizeNames(names2, constants) {
+      optimizeNames(names2, constants2) {
         if (this.lhs instanceof code_1.Name && !names2[this.lhs.str] && !this.sideEffects)
           return;
-        this.rhs = optimizeExpr(this.rhs, names2, constants);
+        this.rhs = optimizeExpr(this.rhs, names2, constants2);
         return this;
       }
       get names() {
@@ -20946,8 +20946,8 @@ var require_codegen = __commonJS({
       optimizeNodes() {
         return `${this.code}` ? this : void 0;
       }
-      optimizeNames(names2, constants) {
-        this.code = optimizeExpr(this.code, names2, constants);
+      optimizeNames(names2, constants2) {
+        this.code = optimizeExpr(this.code, names2, constants2);
         return this;
       }
       get names() {
@@ -20976,12 +20976,12 @@ var require_codegen = __commonJS({
         }
         return nodes.length > 0 ? this : void 0;
       }
-      optimizeNames(names2, constants) {
+      optimizeNames(names2, constants2) {
         const { nodes } = this;
         let i = nodes.length;
         while (i--) {
           const n = nodes[i];
-          if (n.optimizeNames(names2, constants))
+          if (n.optimizeNames(names2, constants2))
             continue;
           subtractNames(names2, n.names);
           nodes.splice(i, 1);
@@ -21034,12 +21034,12 @@ var require_codegen = __commonJS({
           return void 0;
         return this;
       }
-      optimizeNames(names2, constants) {
+      optimizeNames(names2, constants2) {
         var _a3;
-        this.else = (_a3 = this.else) === null || _a3 === void 0 ? void 0 : _a3.optimizeNames(names2, constants);
-        if (!(super.optimizeNames(names2, constants) || this.else))
+        this.else = (_a3 = this.else) === null || _a3 === void 0 ? void 0 : _a3.optimizeNames(names2, constants2);
+        if (!(super.optimizeNames(names2, constants2) || this.else))
           return;
-        this.condition = optimizeExpr(this.condition, names2, constants);
+        this.condition = optimizeExpr(this.condition, names2, constants2);
         return this;
       }
       get names() {
@@ -21062,10 +21062,10 @@ var require_codegen = __commonJS({
       render(opts) {
         return `for(${this.iteration})` + super.render(opts);
       }
-      optimizeNames(names2, constants) {
-        if (!super.optimizeNames(names2, constants))
+      optimizeNames(names2, constants2) {
+        if (!super.optimizeNames(names2, constants2))
           return;
-        this.iteration = optimizeExpr(this.iteration, names2, constants);
+        this.iteration = optimizeExpr(this.iteration, names2, constants2);
         return this;
       }
       get names() {
@@ -21101,10 +21101,10 @@ var require_codegen = __commonJS({
       render(opts) {
         return `for(${this.varKind} ${this.name} ${this.loop} ${this.iterable})` + super.render(opts);
       }
-      optimizeNames(names2, constants) {
-        if (!super.optimizeNames(names2, constants))
+      optimizeNames(names2, constants2) {
+        if (!super.optimizeNames(names2, constants2))
           return;
-        this.iterable = optimizeExpr(this.iterable, names2, constants);
+        this.iterable = optimizeExpr(this.iterable, names2, constants2);
         return this;
       }
       get names() {
@@ -21146,11 +21146,11 @@ var require_codegen = __commonJS({
         (_b = this.finally) === null || _b === void 0 ? void 0 : _b.optimizeNodes();
         return this;
       }
-      optimizeNames(names2, constants) {
+      optimizeNames(names2, constants2) {
         var _a3, _b;
-        super.optimizeNames(names2, constants);
-        (_a3 = this.catch) === null || _a3 === void 0 ? void 0 : _a3.optimizeNames(names2, constants);
-        (_b = this.finally) === null || _b === void 0 ? void 0 : _b.optimizeNames(names2, constants);
+        super.optimizeNames(names2, constants2);
+        (_a3 = this.catch) === null || _a3 === void 0 ? void 0 : _a3.optimizeNames(names2, constants2);
+        (_b = this.finally) === null || _b === void 0 ? void 0 : _b.optimizeNames(names2, constants2);
         return this;
       }
       get names() {
@@ -21451,7 +21451,7 @@ var require_codegen = __commonJS({
     function addExprNames(names2, from) {
       return from instanceof code_1._CodeOrName ? addNames(names2, from.names) : names2;
     }
-    function optimizeExpr(expr, names2, constants) {
+    function optimizeExpr(expr, names2, constants2) {
       if (expr instanceof code_1.Name)
         return replaceName(expr);
       if (!canOptimize(expr))
@@ -21466,14 +21466,14 @@ var require_codegen = __commonJS({
         return items;
       }, []));
       function replaceName(n) {
-        const c = constants[n.str];
+        const c = constants2[n.str];
         if (c === void 0 || names2[n.str] !== 1)
           return n;
         delete names2[n.str];
         return c;
       }
       function canOptimize(e) {
-        return e instanceof code_1._Code && e._items.some((c) => c instanceof code_1.Name && names2[c.str] === 1 && constants[c.str] !== void 0);
+        return e instanceof code_1._Code && e._items.some((c) => c instanceof code_1.Name && names2[c.str] === 1 && constants2[c.str] !== void 0);
       }
     }
     function subtractNames(names2, from) {
@@ -23435,7 +23435,7 @@ var require_compile = __commonJS({
       const schOrFunc = root.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve6.call(this, root, ref);
+      let _sch = resolve10.call(this, root, ref);
       if (_sch === void 0) {
         const schema = (_a3 = root.localRefs) === null || _a3 === void 0 ? void 0 : _a3[ref];
         const { schemaId } = this.opts;
@@ -23462,7 +23462,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s2) {
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
-    function resolve6(root, ref) {
+    function resolve10(root, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -24093,7 +24093,7 @@ var require_fast_uri = __commonJS({
       }
       return uri;
     }
-    function resolve6(baseURI, relativeURI, options2) {
+    function resolve10(baseURI, relativeURI, options2) {
       const schemelessOptions = options2 ? Object.assign({ scheme: "null" }, options2) : { scheme: "null" };
       const { parsed: baseParsed, malformedAuthorityOrPort: baseMalformed } = parseWithStatus(baseURI, schemelessOptions);
       const { parsed: relativeParsed, malformedAuthorityOrPort: relativeMalformed } = parseWithStatus(relativeURI, schemelessOptions);
@@ -24377,7 +24377,7 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize: normalize2,
-      resolve: resolve6,
+      resolve: resolve10,
       resolveComponent,
       equal,
       serialize,
@@ -28418,7 +28418,7 @@ function retryDelay(response, attempt) {
   return 250 * 2 ** attempt;
 }
 function sleep(ms) {
-  return new Promise((resolve6) => setTimeout(resolve6, ms));
+  return new Promise((resolve10) => setTimeout(resolve10, ms));
 }
 function createCliApi(baseUrl, fetcher = fetch, token, sessionId) {
   const transport = async (input2, init) => {
@@ -28600,10 +28600,92 @@ var init_registry = __esm({
   }
 });
 
+// src/timings.ts
+import { appendFileSync } from "node:fs";
+import { resolve } from "node:path";
+function executionTimings() {
+  return { brokerMs: 0, bridgeMs: 0, registryMs: 0, bindingMs: 0, replayMs: 0, appMs: 0, proofMs: 0, reportingMs: 0 };
+}
+async function timed(timings, stage, work) {
+  const started = performance.now();
+  try {
+    return await work();
+  } finally {
+    if (timings) timings[stage] += performance.now() - started;
+  }
+}
+function saveTimings(timings, commandMs) {
+  if (!process.env.APILIFT_TIMING_FILE) return;
+  try {
+    appendFileSync(resolve(process.env.APILIFT_TIMING_FILE), JSON.stringify({ ...Object.fromEntries(Object.entries(timings).map(([key, value]) => [key, Math.round(value * 100) / 100])), commandMs: Math.round(commandMs * 100) / 100 }) + "\n", { mode: 384 });
+  } catch {
+  }
+}
+var init_timings = __esm({
+  "src/timings.ts"() {
+    "use strict";
+  }
+});
+
+// src/files.ts
+import { randomUUID } from "node:crypto";
+import { accessSync, constants, existsSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { dirname, join, resolve as resolve2 } from "node:path";
+function outputDestination(file2) {
+  const target = resolve2(file2);
+  if (existsSync(target)) {
+    if (!statSync(target).isFile()) throw new Error("Output destination must be a regular file");
+    accessSync(target, constants.W_OK);
+  }
+  const probe = join(dirname(target), `.apilift-output-check-${randomUUID()}`);
+  try {
+    writeFileSync(probe, "", { flag: "wx", mode: 384 });
+  } finally {
+    try {
+      unlinkSync(probe);
+    } catch {
+    }
+  }
+  return target;
+}
+var init_files = __esm({
+  "src/files.ts"() {
+    "use strict";
+  }
+});
+
+// src/execution-reports.ts
+async function flushExecutionReports(api, state, budgetMs = 1e4) {
+  const pending = state.pendingExecutionReports();
+  if (!pending.length) return;
+  const controller = new AbortController();
+  let timer;
+  try {
+    const acknowledgment = await Promise.race([
+      api.call("postExecutions", { body: { reports: pending.map((item) => item.report) }, signal: controller.signal }),
+      new Promise((_, reject) => {
+        timer = setTimeout(() => {
+          controller.abort();
+          reject(new Error("Report delivery deferred"));
+        }, budgetMs);
+      })
+    ]);
+    state.acknowledgeExecutionReports(acknowledgment.results.map((item) => item.id));
+  } catch {
+  } finally {
+    clearTimeout(timer);
+  }
+}
+var init_execution_reports = __esm({
+  "src/execution-reports.ts"() {
+    "use strict";
+  }
+});
+
 // src/usage/ledger.ts
-import { createHmac, randomBytes, randomUUID } from "node:crypto";
-import { chmodSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
+import { createHmac, randomBytes, randomUUID as randomUUID2 } from "node:crypto";
+import { chmodSync, mkdirSync, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { join as join2 } from "node:path";
 import { DatabaseSync } from "node:sqlite";
 function purposeFor(key) {
   return key.startsWith("discover") || key === "appsNew" || key === "appsUpdate" ? "discovery" : key.startsWith("setup") ? "setup" : "unknown";
@@ -28612,7 +28694,7 @@ function countedCommand(key) {
   return !["root", "version", "helpCommands", "appsSearch", "actionsList", "actionsSearch", "actionsShow", "transportsShow", "appsHistory", "contextShow"].includes(key);
 }
 function newInvocationId() {
-  return randomUUID();
+  return randomUUID2();
 }
 var UsageLedger;
 var init_ledger = __esm({
@@ -28622,10 +28704,10 @@ var init_ledger = __esm({
       db;
       root;
       constructor(dataRoot2) {
-        this.root = join(dataRoot2, "usage");
+        this.root = join2(dataRoot2, "usage");
         mkdirSync(this.root, { recursive: true, mode: 448 });
         chmodSync(this.root, 448);
-        const file2 = join(this.root, "ledger.sqlite");
+        const file2 = join2(this.root, "ledger.sqlite");
         this.db = new DatabaseSync(file2);
         chmodSync(file2, 384);
         this.db.exec("PRAGMA busy_timeout=5000; PRAGMA journal_mode=WAL");
@@ -28649,8 +28731,8 @@ var init_ledger = __esm({
         return createHmac("sha256", this.secret()).update(JSON.stringify([runtime, nativeId])).digest("hex");
       }
       save(value) {
-        const path2 = join(this.root, `pending-${value.id}.json`);
-        writeFileSync(path2, JSON.stringify({ argv: value.argv, stdout: value.stdout, stderr: value.stderr }), { mode: 384, flag: "wx" });
+        const path2 = join2(this.root, `pending-${value.id}.json`);
+        writeFileSync2(path2, JSON.stringify({ argv: value.argv, stdout: value.stdout, stderr: value.stderr }), { mode: 384, flag: "wx" });
         this.db.prepare("INSERT INTO invocation (id,command_key,session_id,agent,started_at,finished_at,duration_ms,argv_json,output_path,purpose,execution_id) VALUES (?,?,?,?,?,?,?,?,?,?,?)").run(value.id, value.commandKey, value.session.id, value.session.agent, value.startedAt, value.finishedAt, value.durationMs, JSON.stringify(value.argv), path2, purposeFor(value.commandKey), value.executionId ?? null);
       }
       attachExecution(invocationId, executionId) {
@@ -28681,7 +28763,7 @@ var init_ledger = __esm({
         this.db.prepare("INSERT INTO usage_meta (key,value) VALUES ('account_id',?) ON CONFLICT(key) DO UPDATE SET value=excluded.value").run(accountId);
       }
       clearForRevocation() {
-        this.clearForAccountChange(`revoked:${randomUUID()}`);
+        this.clearForAccountChange(`revoked:${randomUUID2()}`);
         this.db.prepare("DELETE FROM usage_meta WHERE key='account_id'").run();
       }
       prune() {
@@ -28703,9 +28785,9 @@ var init_ledger = __esm({
 });
 
 // src/usage/baselines.ts
-import { randomUUID as randomUUID2 } from "node:crypto";
-import { chmodSync as chmodSync2, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "node:fs";
-import { join as join2 } from "node:path";
+import { randomUUID as randomUUID3 } from "node:crypto";
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { join as join3 } from "node:path";
 function withBaselines(root, work) {
   try {
     const ledger = new UsageLedger(root);
@@ -28739,10 +28821,10 @@ var init_baselines = __esm({
       finishPreparation(sessionId, appSlug, appId, method, at = /* @__PURE__ */ new Date()) {
         const row = this.ledger.db.prepare("SELECT started_at FROM baseline_preparation_start WHERE session_id=? AND app_slug=?").get(sessionId, appSlug);
         if (!row || this.ledger.db.prepare("SELECT 1 FROM baseline_candidate WHERE draft_id=?").get(`preparation:${sessionId}:${appId}:${method}`)) return;
-        this.ledger.db.prepare("INSERT INTO baseline_candidate (id,draft_id,app_id,session_id,method,started_at,stopped_at) VALUES (?,?,?,?,?,?,?)").run(randomUUID2(), `preparation:${sessionId}:${appId}:${method}`, appId, sessionId, method, row.started_at, at.toISOString());
+        this.ledger.db.prepare("INSERT INTO baseline_candidate (id,draft_id,app_id,session_id,method,started_at,stopped_at) VALUES (?,?,?,?,?,?,?)").run(randomUUID3(), `preparation:${sessionId}:${appId}:${method}`, appId, sessionId, method, row.started_at, at.toISOString());
       }
       startCapture(draftId, appId, sessionId, at = /* @__PURE__ */ new Date()) {
-        const id2 = randomUUID2();
+        const id2 = randomUUID3();
         this.ledger.db.prepare("UPDATE baseline_candidate SET observation_finished_at=?,observation_reason='next-capture' WHERE session_id=? AND observation_version=1 AND observation_finished_at IS NULL").run(at.toISOString(), sessionId);
         this.ledger.db.prepare("INSERT INTO baseline_candidate (id,draft_id,app_id,session_id,method,started_at,observation_version) VALUES (?,?,?,?,?,?,1)").run(id2, draftId, appId, sessionId, "browser", at.toISOString());
         return id2;
@@ -28757,12 +28839,12 @@ var init_baselines = __esm({
         this.ledger.db.prepare("UPDATE baseline_candidate SET observation_finished_at=?,observation_reason=CASE WHEN stopped_at IS NULL THEN 'cancelled' ELSE 'released' END WHERE draft_id=? AND method='browser' AND observation_version=1 AND observation_finished_at IS NULL").run(at.toISOString(), draftId);
       }
       recordDirect(input2) {
-        const id2 = randomUUID2(), at = input2.at ?? /* @__PURE__ */ new Date();
-        const dir = join2(this.ledger.root, "pending-baselines");
+        const id2 = randomUUID3(), at = input2.at ?? /* @__PURE__ */ new Date();
+        const dir = join3(this.ledger.root, "pending-baselines");
         mkdirSync2(dir, { recursive: true, mode: 448 });
         chmodSync2(dir, 448);
-        const path2 = join2(dir, `${id2}.json`);
-        writeFileSync2(path2, JSON.stringify({ request: input2.request, response: input2.response }), { mode: 384, flag: "wx" });
+        const path2 = join3(dir, `${id2}.json`);
+        writeFileSync3(path2, JSON.stringify({ request: input2.request, response: input2.response }), { mode: 384, flag: "wx" });
         this.ledger.db.prepare("INSERT INTO baseline_candidate (id,draft_id,app_id,session_id,method,started_at,stopped_at,duration_ms,payload_path,coverage,time_coverage) VALUES (?,?,?,?,?,?,?,?,?,'final','final')").run(id2, input2.draftId, input2.appId, input2.sessionId, "direct", at.toISOString(), at.toISOString(), Math.max(0, Math.round(input2.durationMs)), path2);
         if (input2.invocationId) this.ledger.db.prepare("UPDATE baseline_candidate SET invocation_id=?,http_started_at=?,http_finished_at=? WHERE id=?").run(input2.invocationId, input2.startedAt ?? null, input2.finishedAt ?? null, id2);
         return id2;
@@ -30304,13 +30386,13 @@ var init_envelope = __esm({
 });
 
 // src/discovery/drafts.ts
-import { randomUUID as randomUUID3 } from "node:crypto";
-import { chmodSync as chmodSync3, existsSync, mkdirSync as mkdirSync3, readFileSync as readFileSync2, unlinkSync, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname, join as join3 } from "node:path";
+import { randomUUID as randomUUID4 } from "node:crypto";
+import { chmodSync as chmodSync3, existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname2, join as join4 } from "node:path";
 function pathFor(root, appSlug, kind, name) {
   if (!slugPattern.test(appSlug)) throw new Error("App slug is invalid");
   if (kind === "action" ? !actionPattern.test(name) : kind !== "app" && !resourcePattern.test(name)) throw new Error("Resource name is invalid");
-  return kind === "app" ? join3(root, "drafts", diskName(appSlug), "app.jsonc") : join3(root, "drafts", diskName(appSlug), paths[kind], `${diskName(name)}.jsonc`);
+  return kind === "app" ? join4(root, "drafts", diskName(appSlug), "app.jsonc") : join4(root, "drafts", diskName(appSlug), paths[kind], `${diskName(name)}.jsonc`);
 }
 function record2(row) {
   return { id: String(row.id), appSlug: String(row.app_slug), appId: row.app_id === null ? null : String(row.app_id), kind: String(row.kind), name: String(row.name), ownerSessionId: row.owner_session_id === null ? null : String(row.owner_session_id), filePath: String(row.file_path), intent: row.intent === "remove" ? "remove" : "edit", baseVersion: row.base_version === null ? null : Number(row.base_version) };
@@ -30387,7 +30469,7 @@ var init_drafts = __esm({
         const serialized = JSON.stringify(body);
         const existing = this.publication(draftId);
         if (existing) return existing;
-        const intent = { requestId: randomUUID3(), requestBody: serialized };
+        const intent = { requestId: randomUUID4(), requestBody: serialized };
         this.state.db.prepare("INSERT INTO discovery_publication (draft_id,request_id,request_body) VALUES (?,?,?)").run(draftId, intent.requestId, serialized);
         return intent;
       }
@@ -30422,7 +30504,7 @@ var init_drafts = __esm({
           this.state.db.prepare("DELETE FROM discovery_draft WHERE id=? AND owner_session_id=?").run(draft.id, sessionId);
           this.state.db.exec("COMMIT");
           try {
-            unlinkSync(draft.filePath);
+            unlinkSync2(draft.filePath);
           } catch {
           }
           return draft;
@@ -30461,12 +30543,12 @@ var init_drafts = __esm({
           const existing = this.state.db.prepare("SELECT * FROM discovery_draft WHERE app_slug=? AND kind=? AND name=?").get(input2.appSlug, input2.kind, name);
           if (existing?.owner_session_id && existing.owner_session_id !== input2.sessionId) throw new DraftConflict("owned-draft", `${input2.kind} ${name} is owned by another agent session; its file was preserved`);
           if (existing) filePath = String(existing.file_path);
-          const id2 = existing ? String(existing.id) : randomUUID3();
+          const id2 = existing ? String(existing.id) : randomUUID4();
           if (!existing) this.state.db.prepare("INSERT INTO discovery_draft (id,app_slug,app_id,kind,name,owner_session_id,file_path,base_version) VALUES (?,?,?,?,?,?,?,?)").run(id2, input2.appSlug, input2.appId ?? null, input2.kind, name, input2.sessionId, filePath, input2.baseVersion ?? null);
           else this.state.db.prepare("UPDATE discovery_draft SET owner_session_id=? WHERE id=?").run(input2.sessionId, id2);
           this.state.db.prepare("INSERT INTO selected_discovery_draft (session_id,draft_id) VALUES (?,?) ON CONFLICT(session_id) DO UPDATE SET draft_id=excluded.draft_id").run(input2.sessionId, id2);
-          mkdirSync3(dirname(filePath), { recursive: true, mode: 448 });
-          if (!existsSync(filePath) && existing?.intent !== "remove") writeFileSync3(filePath, draftTemplate(input2.kind), { flag: "wx", mode: 384 });
+          mkdirSync3(dirname2(filePath), { recursive: true, mode: 448 });
+          if (!existsSync2(filePath) && existing?.intent !== "remove") writeFileSync4(filePath, draftTemplate(input2.kind), { flag: "wx", mode: 384 });
           chmodSync3(filePath, 384);
           const result3 = this.selected(input2.sessionId);
           this.state.db.exec("COMMIT");
@@ -30491,11 +30573,11 @@ var init_drafts = __esm({
             this.state.db.exec("COMMIT");
             return this.selected(input2.sessionId);
           }
-          const id2 = randomUUID3();
+          const id2 = randomUUID4();
           this.state.db.prepare("INSERT INTO discovery_draft (id,app_slug,app_id,kind,name,owner_session_id,file_path,base_version,intent) VALUES (?,?,?,?,?,?,?,?,'remove')").run(id2, input2.appSlug, input2.appId, input2.kind, input2.name, input2.sessionId, filePath, input2.baseVersion);
           this.state.db.prepare("INSERT INTO selected_discovery_draft (session_id,draft_id) VALUES (?,?)").run(input2.sessionId, id2);
-          mkdirSync3(dirname(filePath), { recursive: true, mode: 448 });
-          writeFileSync3(filePath, `// Publish to remove this resource. No records inside the app are changed.
+          mkdirSync3(dirname2(filePath), { recursive: true, mode: 448 });
+          writeFileSync4(filePath, `// Publish to remove this resource. No records inside the app are changed.
 ${JSON.stringify({ remove: true, expectedVersion: input2.baseVersion }, null, 2)}
 `, { flag: "wx", mode: 384 });
           this.state.db.exec("COMMIT");
@@ -31122,8 +31204,8 @@ import { spawn } from "node:child_process";
 function backgroundOptions(env) {
   return { detached: true, windowsHide: true, stdio: "ignore", env };
 }
-function startBackground(script, env, onError) {
-  const child = spawn(process.execPath, [script], backgroundOptions(env));
+function startBackground(script2, env, onError) {
+  const child = spawn(process.execPath, [script2], backgroundOptions(env));
   child.once("error", onError);
   child.unref();
   return child;
@@ -31136,8 +31218,8 @@ var init_process = __esm({
 
 // src/capture-server/client.ts
 import { createHash as createHash2 } from "node:crypto";
-import { chmodSync as chmodSync4, existsSync as existsSync2, mkdirSync as mkdirSync4, readFileSync as readFileSync4, rmSync as rmSync2 } from "node:fs";
-import { dirname as dirname2, join as join4 } from "node:path";
+import { chmodSync as chmodSync4, existsSync as existsSync3, mkdirSync as mkdirSync4, readFileSync as readFileSync4, rmSync as rmSync2 } from "node:fs";
+import { dirname as dirname3, join as join5 } from "node:path";
 import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
 function knownLegacyBroker(version2) {
   const match = /^1\.4\.(\d+)$/.exec(version2);
@@ -31157,7 +31239,7 @@ function reusableBroker(client, health, requestedVersion) {
 }
 function receiptAt(root) {
   try {
-    const raw = JSON.parse(readFileSync4(join4(root, "server.json"), "utf8"));
+    const raw = JSON.parse(readFileSync4(join5(root, "server.json"), "utf8"));
     if (!Number.isInteger(raw.port) || raw.port <= 0 || typeof raw.token !== "string" || typeof raw.version !== "string") return null;
     return raw;
   } catch {
@@ -31166,24 +31248,24 @@ function receiptAt(root) {
 }
 function nativeRestartVersion(root) {
   try {
-    const version2 = JSON.parse(readFileSync4(join4(root, "native-host", "restart-required.json"), "utf8")).version;
+    const version2 = JSON.parse(readFileSync4(join5(root, "native-host", "restart-required.json"), "utf8")).version;
     return typeof version2 === "string" && /^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/u.test(version2) ? version2 : null;
   } catch {
     return null;
   }
 }
-function installedCaptureVersion(script) {
+function installedCaptureVersion(script2) {
   try {
-    const pkg = JSON.parse(readFileSync4(join4(dirname2(script), "..", "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync4(join5(dirname3(script2), "..", "package.json"), "utf8"));
     return ["apilift", "@apilift/cli"].includes(String(pkg.name)) && typeof pkg.version === "string" && /^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/u.test(pkg.version) ? pkg.version : null;
   } catch {
     return null;
   }
 }
 async function ensureCaptureServer(options2) {
-  const locks = join4(options2.root, "locks");
+  const locks = join5(options2.root, "locks");
   mkdirSync4(locks, { recursive: true, mode: 448 });
-  const updateLock = new DatabaseSync2(join4(locks, "self-update.sqlite"));
+  const updateLock = new DatabaseSync2(join5(locks, "self-update.sqlite"));
   let acquired = false;
   try {
     updateLock.exec("PRAGMA busy_timeout=10000; BEGIN EXCLUSIVE");
@@ -31206,9 +31288,9 @@ async function ensureCaptureServerUnderUpdateLock(options2) {
     } catch {
     }
   }
-  const locks = join4(root, "locks");
+  const locks = join5(root, "locks");
   mkdirSync4(locks, { recursive: true, mode: 448 });
-  const lockFile = join4(locks, "capture-server.sqlite");
+  const lockFile = join5(locks, "capture-server.sqlite");
   const lock2 = new DatabaseSync2(lockFile);
   chmodSync4(lockFile, 384);
   lock2.exec("PRAGMA busy_timeout=10000; CREATE TABLE IF NOT EXISTS owner (name TEXT PRIMARY KEY)");
@@ -31226,11 +31308,11 @@ async function ensureCaptureServerUnderUpdateLock(options2) {
         if (error62.code === "capture-server-busy") throw error62;
       }
       try {
-        rmSync2(join4(root, "server.json"));
+        rmSync2(join5(root, "server.json"));
       } catch {
       }
     }
-    if (!existsSync2(options2.script)) throw new Error(`Capture server entry point is missing: ${options2.script}`);
+    if (!existsSync3(options2.script)) throw new Error(`Capture server entry point is missing: ${options2.script}`);
     let startupError;
     const child = startBackground(options2.script, { ...process.env, ...options2.env, APILIFT_HOME: root }, (error62) => {
       startupError = error62;
@@ -31246,7 +31328,7 @@ async function ensureCaptureServerUnderUpdateLock(options2) {
         } catch {
         }
       }
-      await new Promise((resolve6) => setTimeout(resolve6, 50));
+      await new Promise((resolve10) => setTimeout(resolve10, 50));
     }
     throw new Error("Capture server did not become ready within 10 seconds");
   } finally {
@@ -31284,12 +31366,19 @@ var init_client2 = __esm({
       scopes() {
         return this.call("GET", "/scopes");
       }
+      async bridgeDemand() {
+        try {
+          await this.call("POST", "/bridge/demand", {});
+        } catch (error62) {
+          if (error62.code !== "not-found") throw error62;
+        }
+      }
       bridgeReady(version2, capabilities = []) {
         return this.call("POST", "/bridge/ready", { version: version2, capabilities }).then(() => {
         });
       }
-      candidates(id2) {
-        return this.call("GET", `/scope/candidates?id=${encodeURIComponent(id2)}`);
+      candidates(id2, waitMs = 0) {
+        return this.call("GET", `/scope/candidates?id=${encodeURIComponent(id2)}&waitMs=${waitMs}`);
       }
       entries(id2, after = 0, limit = 100) {
         return this.call("GET", `/scope/entries?id=${encodeURIComponent(id2)}&after=${after}&limit=${limit}`);
@@ -31322,8 +31411,8 @@ var init_client2 = __esm({
       enqueueJob(scopeId, envelope) {
         return this.call("POST", "/job/enqueue", { scopeId, envelope });
       }
-      jobResult(id2) {
-        return this.call("GET", `/job/result?id=${encodeURIComponent(id2)}`);
+      jobResult(id2, waitMs = 0) {
+        return this.call("GET", `/job/result?id=${encodeURIComponent(id2)}&waitMs=${waitMs}`);
       }
       acknowledgeJob(id2) {
         return this.call("POST", "/job/ack", { id: id2 }).then(() => {
@@ -31344,25 +31433,37 @@ var init_client2 = __esm({
 });
 
 // src/capture-server/demand.ts
-import { randomUUID as randomUUID4 } from "node:crypto";
-import { join as join5 } from "node:path";
+import { randomUUID as randomUUID5 } from "node:crypto";
+import { join as join6 } from "node:path";
 import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
-async function waitForBridge(root, version2, timeoutMs = 9e4) {
+async function waitForBridge(root, version2, timeoutMs = 9e4, wake, compatibleBrokerVersion) {
   const db = open2(root);
   db.exec("PRAGMA busy_timeout=1000");
-  const id2 = randomUUID4(), now = Date.now(), ownerStartedAt = now - process.uptime() * 1e3;
+  const id2 = randomUUID5(), now = Date.now(), ownerStartedAt = now - process.uptime() * 1e3;
   const expiry = now + timeoutMs;
-  db.prepare("INSERT INTO bridge_demands(id,owner_pid,owner_started_at,expires_at) VALUES(?,?,?,?)").run(id2, process.pid, ownerStartedAt, expiry);
+  const sequenced = db.prepare("PRAGMA table_info(bridge_status)").all().some((column) => column.name === "sequence");
+  let priorSequence = -1;
+  db.exec("BEGIN IMMEDIATE");
+  try {
+    if (sequenced) priorSequence = Number(db.prepare("SELECT sequence FROM bridge_status WHERE id=1").get()?.sequence ?? -1);
+    db.prepare("INSERT INTO bridge_demands(id,owner_pid,owner_started_at,expires_at) VALUES(?,?,?,?)").run(id2, process.pid, ownerStartedAt, expiry);
+    db.exec("COMMIT");
+  } catch (error62) {
+    db.exec("ROLLBACK");
+    db.close();
+    throw error62;
+  }
   let announced = false;
   try {
+    await wake?.();
     while (Date.now() < expiry) {
-      const ready = db.prepare("SELECT version,updated_at FROM bridge_status WHERE id=1").get();
-      if (ready?.version === version2 && ready.updated_at >= now && Date.now() - ready.updated_at < 15e3) return;
+      const ready = db.prepare(`SELECT version,updated_at${sequenced ? ",sequence" : ""} FROM bridge_status WHERE id=1`).get();
+      if (ready && (ready.version === version2 || ready.version === compatibleBrokerVersion) && ready.updated_at >= now && (!sequenced || Number(ready.sequence) > priorSequence) && Date.now() - ready.updated_at < 15e3) return;
       if (!announced && Date.now() - now >= 5e3) {
         process.stderr.write("Waiting for the Apilift browser connection.\n");
         announced = true;
       }
-      await new Promise((resolve6) => setTimeout(resolve6, 250));
+      await new Promise((resolve10) => setTimeout(resolve10, 20));
     }
     throw Object.assign(new Error("The Apilift browser did not respond within 90 seconds. Verify that Chrome is running with the extension enabled, then retry this command. No app action was sent."), { code: "extension-unavailable" });
   } finally {
@@ -31377,14 +31478,14 @@ var databasePath, open2;
 var init_demand = __esm({
   "src/capture-server/demand.ts"() {
     "use strict";
-    databasePath = (root) => join5(root, "capture.sqlite");
+    databasePath = (root) => join6(root, "capture.sqlite");
     open2 = (root, readOnly = false) => new DatabaseSync3(databasePath(root), { readOnly });
   }
 });
 
 // src/commands/browser.ts
 import { realpathSync } from "node:fs";
-import { dirname as dirname3, join as join6 } from "node:path";
+import { dirname as dirname4, join as join7 } from "node:path";
 async function checkTabOwnership(client, origin, tab, app2, prefix) {
   const state = await client.scopes();
   const active2 = state.scopes.filter((scope2) => scope2.pageOrigin === origin && scope2.kind !== "inspect");
@@ -31417,13 +31518,13 @@ async function browserContext(api, appId) {
   return null;
 }
 function captureServerScript(entry2 = process.argv[1]) {
-  return join6(dirname3(realpathSync(entry2)), "apilift-capture-server.js");
+  return join7(dirname4(realpathSync(entry2)), "apilift-capture-server.js");
 }
-async function captureClient(root, requireBridge = true) {
+async function captureClient(root, requireBridge = true, timings) {
   const startedAt = Date.now();
-  const script = process.env.APILIFT_CAPTURE_SERVER_SCRIPT ?? captureServerScript();
-  const client = await ensureCaptureServer({ root, script, version: cliVersion });
-  if (requireBridge && !client.legacyBridge) await waitForBridge(root, cliVersion, Math.max(0, 9e4 - (Date.now() - startedAt)));
+  const script2 = process.env.APILIFT_CAPTURE_SERVER_SCRIPT ?? captureServerScript();
+  const client = await timed(timings, "brokerMs", () => ensureCaptureServer({ root, script: script2, version: cliVersion }));
+  if (requireBridge && !client.legacyBridge) await timed(timings, "bridgeMs", () => waitForBridge(root, cliVersion, Math.max(0, 9e4 - (Date.now() - startedAt)), () => client.bridgeDemand(), client.receipt.version));
   return client;
 }
 async function inspectTabs(client, appId, contextId, pageOrigin) {
@@ -31433,7 +31534,7 @@ async function inspectTabs(client, appId, contextId, pageOrigin) {
     do {
       const candidates = (await client.candidates(scope2.id)).candidates;
       if (candidates.length) return candidates;
-      await new Promise((resolve6) => setTimeout(resolve6, 250));
+      await new Promise((resolve10) => setTimeout(resolve10, 250));
     } while (Date.now() < deadline);
     return [];
   } finally {
@@ -31490,6 +31591,7 @@ var ok, fail, command, BrowserControlError;
 var init_browser = __esm({
   "src/commands/browser.ts"() {
     "use strict";
+    init_timings();
     init_version();
     init_client2();
     init_demand();
@@ -31509,14 +31611,14 @@ var init_browser = __esm({
 // src/state.ts
 import { chmodSync as chmodSync5, mkdirSync as mkdirSync5 } from "node:fs";
 import { homedir, platform } from "node:os";
-import { isAbsolute, join as join7, resolve } from "node:path";
+import { isAbsolute, join as join8, resolve as resolve3 } from "node:path";
 import { DatabaseSync as DatabaseSync4 } from "node:sqlite";
 function dataRoot(env) {
-  if (env.APILIFT_HOME) return resolve(env.APILIFT_HOME);
+  if (env.APILIFT_HOME) return resolve3(env.APILIFT_HOME);
   const home = homedir();
-  if (platform() === "darwin") return join7(home, "Library", "Application Support", "apilift");
-  if (platform() === "win32") return join7(env.LOCALAPPDATA || join7(home, "AppData", "Local"), "apilift");
-  return join7(env.XDG_DATA_HOME && isAbsolute(env.XDG_DATA_HOME) ? env.XDG_DATA_HOME : join7(home, ".local", "share"), "apilift");
+  if (platform() === "darwin") return join8(home, "Library", "Application Support", "apilift");
+  if (platform() === "win32") return join8(env.LOCALAPPDATA || join8(home, "AppData", "Local"), "apilift");
+  return join8(env.XDG_DATA_HOME && isAbsolute(env.XDG_DATA_HOME) ? env.XDG_DATA_HOME : join8(home, ".local", "share"), "apilift");
 }
 var LocalState;
 var init_state = __esm({
@@ -31528,7 +31630,7 @@ var init_state = __esm({
         if (!isAbsolute(root)) throw new Error("State root must be absolute");
         mkdirSync5(root, { recursive: true, mode: 448 });
         chmodSync5(root, 448);
-        const file2 = join7(root, "state.sqlite");
+        const file2 = join8(root, "state.sqlite");
         this.db = new DatabaseSync4(file2);
         chmodSync5(file2, 384);
         this.db.exec("PRAGMA busy_timeout=5000; PRAGMA journal_mode=WAL");
@@ -31614,7 +31716,7 @@ var init_state = __esm({
 });
 
 // src/native-host/credentials.ts
-import { createCipheriv, createDecipheriv, randomBytes as randomBytes2, randomUUID as randomUUID5 } from "node:crypto";
+import { createCipheriv, createDecipheriv, randomBytes as randomBytes2, randomUUID as randomUUID6 } from "node:crypto";
 var CredentialError, sameNames, sameRequirements, CredentialStore;
 var init_credentials = __esm({
   "src/native-host/credentials.ts"() {
@@ -31690,7 +31792,7 @@ var init_credentials = __esm({
         if (!name || name.length > 80) throw new CredentialError("credential-label-invalid", "Credential label must be 1\u201380 characters");
         const names2 = binding2.requirements.map((item) => item.name);
         if (!sameNames(Object.keys(binding2.fields), names2) || Object.values(binding2.fields).some((value) => !value)) throw new CredentialError("credential-fields-invalid", "Credential fields do not match the current transport requirements");
-        const id2 = randomUUID5(), key = randomBytes2(32), iv = randomBytes2(12), cipher = createCipheriv("aes-256-gcm", key, iv);
+        const id2 = randomUUID6(), key = randomBytes2(32), iv = randomBytes2(12), cipher = createCipheriv("aes-256-gcm", key, iv);
         const ciphertext = Buffer.concat([cipher.update(JSON.stringify(binding2.fields), "utf8"), cipher.final()]), tag = cipher.getAuthTag();
         await this.vault.put(id2, key.toString("base64"));
         try {
@@ -31846,9 +31948,9 @@ var init_vault = __esm({
 });
 
 // src/commands/run.ts
-import { randomUUID as randomUUID6 } from "node:crypto";
-import { readFileSync as readFileSync5, renameSync, unlinkSync as unlinkSync2, writeFileSync as writeFileSync4 } from "node:fs";
-import { dirname as dirname4, isAbsolute as isAbsolute2, join as join8 } from "node:path";
+import { randomUUID as randomUUID7 } from "node:crypto";
+import { readFileSync as readFileSync5, renameSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync5, mkdirSync as mkdirSync6 } from "node:fs";
+import { dirname as dirname5, resolve as resolve4, join as join9 } from "node:path";
 function pointer2(value, path2) {
   if (path2 === "") return value;
   if (!path2.startsWith("/") || /~(?![01])/u.test(path2)) throw new Error(`Invalid JSON Pointer ${path2}`);
@@ -32060,14 +32162,14 @@ function selectPointers(full, paths2) {
   return selection;
 }
 function writeOutput(path2, content) {
-  if (!isAbsolute2(path2)) throw new Error("--output requires an absolute path");
-  const pending = join8(dirname4(path2), `.apilift-output-${randomUUID6()}`);
+  path2 = resolve4(path2);
+  const pending = join9(dirname5(path2), `.apilift-output-${randomUUID7()}`);
   try {
-    writeFileSync4(pending, content, { flag: "wx", mode: 384 });
+    writeFileSync5(pending, content, { flag: "wx", mode: 384 });
     renameSync(pending, path2);
   } catch (error62) {
     try {
-      unlinkSync2(pending);
+      unlinkSync3(pending);
     } catch {
     }
     throw error62;
@@ -32101,25 +32203,32 @@ async function send(fetcher, prepared, allowNonJsonProbe = false) {
   return { response, body };
 }
 async function sendBrowser(root, appId, contextName, pageOrigin, effect2, transportName, transport, prepared, dispatched, credentialId, credentialDraftId, allowNonJsonProbe = false, dispatchBefore, selection = {}) {
-  const client = await captureClient(root);
-  const inspect = await client.openScope({ kind: "inspect", appId, contextId: contextName, pageOrigin, ownerPid: process.pid, ownerStartedAt: Date.now() - process.uptime() * 1e3 });
-  let candidates = [];
-  try {
-    const deadline = Date.now() + (client.legacyBridge ? 9e4 : 1e4);
-    do {
-      candidates = (await client.candidates(inspect.id)).candidates;
-      if (candidates.length) break;
-      await new Promise((resolve6) => setTimeout(resolve6, 200));
-    } while (Date.now() < deadline);
-  } finally {
-    await client.closeScope(inspect.id);
-  }
+  const client = selection.client ?? await captureClient(root, true, selection.timings);
   const app2 = selection.appSlug ?? appId, prefix = selection.prefix ?? "apilift";
-  const tab = selection.tab ? candidates.find((candidate2) => candidate2.selector === selection.tab) : candidates.length === 1 ? candidates[0] : void 0;
-  if (!tab) throw new BrowserControlError(selection.tab ? `Configured capture.tab is not present. Inspect ${prefix} browser tabs ${app2} and select a reported tab in the current draft` : candidates.length ? `Several matching Chrome tabs were reported. Use ${prefix} browser tabs ${app2} and set capture.tab in the current draft for both capture and execution; leave other sessions' tabs open` : "No matching Chrome tab was reported within 10 seconds", "tab-unselected");
-  await checkTabOwnership(client, pageOrigin, tab.selector, app2, prefix);
-  const scope2 = await client.openScope({ kind: "execute", appId, contextId: contextName, pageOrigin, tabSelector: tab.selector, ownerPid: process.pid, ownerStartedAt: Date.now() - process.uptime() * 1e3, ownerSession: selection.ownerSession });
-  const id2 = randomUUID6();
+  let scope2 = selection.execution?.scope;
+  if (!scope2) {
+    const bindingStarted = performance.now();
+    const inspect = await client.openScope({ kind: "inspect", appId, contextId: contextName, pageOrigin, ownerPid: process.pid, ownerStartedAt: Date.now() - process.uptime() * 1e3 });
+    let candidates = [];
+    try {
+      const deadline = Date.now() + (client.legacyBridge ? 9e4 : 1e4);
+      do {
+        candidates = (await client.candidates(inspect.id, client.legacyBridge ? 0 : 1e3)).candidates;
+        if (candidates.length) break;
+        await new Promise((resolve10) => setTimeout(resolve10, client.legacyBridge ? 200 : 10));
+      } while (Date.now() < deadline);
+    } finally {
+      await client.closeScope(inspect.id);
+    }
+    const tab = selection.tab ? candidates.find((candidate2) => candidate2.selector === selection.tab) : candidates.length === 1 ? candidates[0] : void 0;
+    if (!tab) throw new BrowserControlError(selection.tab ? `Configured capture.tab is not present. Inspect ${prefix} browser tabs ${app2} and select a reported tab in the current draft` : candidates.length ? `Several matching Chrome tabs were reported. Use ${prefix} browser tabs ${app2} and set capture.tab in the current draft for both capture and execution; leave other sessions' tabs open` : "No matching Chrome tab was reported within 10 seconds", "tab-unselected");
+    await checkTabOwnership(client, pageOrigin, tab.selector, app2, prefix);
+    scope2 = await client.openScope({ kind: "execute", appId, contextId: contextName, pageOrigin, tabSelector: tab.selector, ownerPid: process.pid, ownerStartedAt: Date.now() - process.uptime() * 1e3, ownerSession: selection.ownerSession });
+    if (selection.execution) selection.execution.scope = scope2;
+    if (selection.timings) selection.timings.bindingMs += performance.now() - bindingStarted;
+  }
+  const replayStarted = performance.now();
+  const id2 = randomUUID7();
   try {
     const headers = Object.fromEntries(new Headers(prepared.init.headers).entries());
     const authRecipeDefinition = transport.inject?.length ? { inject: transport.inject } : void 0;
@@ -32129,7 +32238,7 @@ async function sendBrowser(root, appId, contextName, pageOrigin, effect2, transp
     await client.enqueueJob(scope2.id, envelope);
     const deadline = Date.now() + 45e3;
     do {
-      const held = await client.jobResult(id2);
+      const held = await client.jobResult(id2, client.legacyBridge ? 0 : 1e3);
       if (held.status === "delivered") {
         await client.acknowledgeJob(id2);
         const value = held.result;
@@ -32145,16 +32254,18 @@ async function sendBrowser(root, appId, contextName, pageOrigin, effect2, transp
           throw new Error(value.transportError);
         }
         if (!Number.isInteger(value.status) || value.bodyState && value.bodyState !== "complete") throw new Error("Chrome did not return complete response evidence");
+        if (selection.timings && Number.isFinite(value.ms) && value.ms >= 0) selection.timings.appMs += value.ms;
         const body = [204, 205, 304].includes(value.status) ? null : value.body ?? null;
         const response = new Response(body, { status: value.status });
         return { response, body: !response.ok ? null : decodedBody(value.body ?? "", response.status, allowNonJsonProbe) };
       }
       if (held.status === "uncertain") throw new Error("Chrome execution outcome is uncertain");
-      await new Promise((resolve6) => setTimeout(resolve6, 200));
+      await new Promise((resolve10) => setTimeout(resolve10, client.legacyBridge ? 200 : 10));
     } while (Date.now() < deadline);
     throw new Error("Chrome did not return a result within 45 seconds");
   } finally {
-    await client.closeScope(scope2.id);
+    if (selection.timings) selection.timings.replayMs += performance.now() - replayStarted;
+    if (!selection.execution) await client.closeScope(scope2.id);
   }
 }
 function proofPassed(proof, body, primary, inputs, status) {
@@ -32171,8 +32282,22 @@ async function handleRun(invocation, api, state, session, fetcher, root, stdin =
   const prefix = (suffix) => `apilift${invocation.sessionLabel ? ` --session ${invocation.sessionLabel}` : ""} ${suffix}`;
   if (!session) return fail2(`No stable agent identity is available. No app request was sent. Use apilift --session <worker-label> run ${appName} ${actionName} and keep the same label.
 `);
+  const commandStarted = performance.now(), timings = executionTimings();
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
-  const documentation = await api.call("getAction", { params: { app: appName, action: actionName } });
+  let outputPath, recoveryPath;
+  try {
+    for (const path2 of invocation.repeats.select ?? []) if (path2 !== "" && (!path2.startsWith("/") || /~(?![01])/u.test(path2))) throw new Error(`Invalid JSON Pointer ${path2}`);
+    if (invocation.options.output) outputPath = outputDestination(invocation.options.output);
+    if (outputPath || invocation.repeats.select?.length) {
+      const directory = join9(root, "results");
+      mkdirSync6(directory, { recursive: true, mode: 448 });
+      recoveryPath = outputDestination(join9(directory, `${randomUUID7()}.json`));
+    }
+  } catch (error62) {
+    return fail2(`invalid-output \u2014 ${error62 instanceof Error ? error62.message : "Output destination is unusable"}. No app request was sent.
+`);
+  }
+  const documentation = await timed(timings, "registryMs", () => api.call("getAction", { params: { app: appName, action: actionName } }));
   if (documentation.availability !== "executable") return fail2(`action-unavailable \u2014 ${actionName} cannot run. ${documentation.unavailable?.reason ?? "Inspect its documentation."}
 `, 3);
   let explicit;
@@ -32198,15 +32323,17 @@ ${lines.length ? lines.join("\n") : "  (none)"}
 No app request was sent.
 `);
   }
+  const browserExecution = {};
+  let liveBrowser;
   if (documentation.transport?.mode === "browser") {
     try {
-      await captureClient(root);
+      liveBrowser = await captureClient(root, true, timings);
     } catch (error62) {
       return fail2(`extension-unavailable \u2014 ${error62 instanceof Error ? error62.message : "Chrome did not respond"}. No app request was sent.
 `, 5);
     }
   }
-  const bundle2 = await api.call("getBundle", { params: { app: appName, action: actionName } });
+  const bundle2 = await timed(timings, "registryMs", () => api.call("getBundle", { params: { app: appName, action: actionName } }));
   const actionVersion = bundle2.closure.versions.find((item) => item.kind === "action" && item.name === actionName);
   const action = actionVersion?.definition;
   const transportVersion = bundle2.closure.versions.find((item) => item.kind === "transport" && item.name === (action && "transport" in action ? action.transport : ""));
@@ -32221,6 +32348,14 @@ No app request was sent.
     const page2 = bundle2.closure.versions.find((item) => item.kind === "browser-context" && item.name === transport.browserContext);
     if (!page2) return fail2("browser-page-missing \u2014 The selected browser page is unavailable. No app request was sent.\n", 5);
     browserPage = page2.definition;
+    if (!liveBrowser) {
+      try {
+        liveBrowser = await captureClient(root, true, timings);
+      } catch (error62) {
+        return fail2(`extension-unavailable \u2014 ${error62 instanceof Error ? error62.message : "Chrome did not respond"}. No app request was sent.
+`, 5);
+      }
+    }
   }
   try {
     inputs = effectiveInputs(action.inputs ?? { type: "object", properties: {}, additionalProperties: false }, explicit, state.useSession(session.id, bundle2.app.id)?.context ?? {}, invocation.flags.includes("no-context"));
@@ -32229,7 +32364,7 @@ No app request was sent.
 Inspect current action documentation: ${prefix(`actions show ${appName} ${actionName}`)}
 `);
   }
-  const generated = Object.fromEntries(Object.entries(action.generated ?? {}).map(([name, spec]) => [name, `${spec.prefix ?? ""}${randomUUID6()}`]));
+  const generated = Object.fromEntries(Object.entries(action.generated ?? {}).map(([name, spec]) => [name, `${spec.prefix ?? ""}${randomUUID7()}`]));
   let prepared;
   try {
     prepared = prepareRequest(action.request, transport, inputs.values, generated);
@@ -32246,7 +32381,7 @@ Inspect current action documentation: ${prefix(`actions show ${appName} ${action
     if (transport.mode === "browser") {
       const prior = dispatchedAt;
       try {
-        return await sendBrowser(root, bundle2.app.id, transport.browserContext, browserPage.pageOrigin, effect2, action.transport, transport, request2, markDispatched, selectedCredential, void 0, false, bundle2.receipt?.dispatchBefore, { tab: state.browserTab(session.id, bundle2.app.id), appSlug: bundle2.app.slug, prefix: prefix("").trim(), ownerSession: session.id });
+        return await sendBrowser(root, bundle2.app.id, transport.browserContext, browserPage.pageOrigin, effect2, action.transport, transport, request2, markDispatched, selectedCredential, void 0, false, bundle2.receipt?.dispatchBefore, { tab: state.browserTab(session.id, bundle2.app.id), appSlug: bundle2.app.slug, prefix: prefix("").trim(), ownerSession: session.id, client: liveBrowser, timings, execution: browserExecution });
       } catch (error62) {
         if (error62 instanceof BrowserControlError && !error62.dispatched) {
           if (prior) throw new BrowserControlError("The mutation was already dispatched; its browser readback could not run. Inspect app state instead of rerunning the mutation", error62.code, true);
@@ -32270,9 +32405,9 @@ Inspect current action documentation: ${prefix(`actions show ${appName} ${action
       }
     }
     markDispatched();
-    return send(fetcher, request2);
+    return timed(timings, "appMs", () => send(fetcher, request2));
   };
-  const reportId = randomUUID6();
+  const reportId = randomUUID7();
   let outcome = "network-error";
   let diagnostic;
   let output2;
@@ -32286,7 +32421,7 @@ Inspect current action documentation: ${prefix(`actions show ${appName} ${action
       const value = projected(primary.body, action, generated);
       if (action.effect !== "read" && action.proof) {
         const preparedProof = prepareRequest(action.proof.request, transport, inputs.values, generated, value);
-        const proof = await sendRequest(preparedProof, "read");
+        const proof = await timed(timings, "proofMs", () => sendRequest(preparedProof, "read"));
         let passed = false;
         try {
           passed = proofPassed(action.proof, proof.body, value, inputs.values, proof.response.status);
@@ -32324,36 +32459,47 @@ Inspect saved entries: ${prefix(`credentials list ${appName} ${action.transport}
 `, 5, !!dispatchedAt);
     }
   }
+  if (browserExecution.scope) await liveBrowser?.closeScope(browserExecution.scope.id).catch(() => {
+  });
   const report = { id: reportId, connectionFingerprint: await hashJson({ transport: transportVersion.executableHash, credential: selectedCredential ?? null, browser: browserPage?.pageOrigin ?? null }), ...bundle2.receipt ? { receiptId: bundle2.receipt.id } : {}, ...outcome === "success" && action.effect !== "read" ? { proof: "passed" } : {}, appId: bundle2.app.id, actionName, actionVersion: actionVersion.version, closureHash: bundle2.closure.hash, purpose: "run", clientFamily: "cli", agent: session.agent, outcome, ...diagnostic ? { diagnostic } : {}, startedAt, ...dispatchedAt ? { dispatchedAt } : {}, finishedAt: (/* @__PURE__ */ new Date()).toISOString() };
-  state.queueExecutionReport(reportId, report);
-  onReport?.(reportId);
   try {
-    const pending = state.pendingExecutionReports();
-    if (pending.length) {
-      const acknowledgment = await api.call("postExecutions", { body: { reports: pending.map((item) => item.report) } });
-      state.acknowledgeExecutionReports(acknowledgment.results.map((item) => item.id));
-    }
+    state.queueExecutionReport(reportId, report);
+    onReport?.(reportId);
   } catch {
   }
+  await timed(timings, "reportingMs", () => flushExecutionReports(api, state, 100));
   if (output2.exitCode === 0 && (invocation.repeats.select?.length || invocation.options.output)) {
+    const completeResult = output2.stdout;
     try {
-      const full = JSON.parse(output2.stdout);
+      writeOutput(recoveryPath, completeResult);
+      const full = JSON.parse(completeResult);
       const selected = invocation.repeats.select?.length ? selectPointers(full, invocation.repeats.select) : full;
       if (typeof selected === "object" && selected !== null && !Array.isArray(selected) && typeof full === "object" && full !== null && "nextCursor" in full && !("nextCursor" in selected)) selected.nextCursor = full.nextCursor;
       const serialized = `${JSON.stringify(selected, null, 2)}
 `;
       if (invocation.options.output) {
-        writeOutput(invocation.options.output, serialized);
-        output2 = result(`Saved the fetched result to ${invocation.options.output}. It contains only this invocation's page.
+        writeOutput(outputPath, serialized);
+        output2 = result(`Saved the fetched result to ${outputPath}.${typeof full === "object" && full !== null && "nextCursor" in full ? " It contains only this invocation's page." : ""}
 `);
       } else output2 = result(serialized, true);
+      try {
+        unlinkSync3(recoveryPath);
+      } catch {
+      }
     } catch (error62) {
-      output2 = fail2(`output-failed \u2014 The app request completed, but the result could not be saved or selected: ${error62 instanceof Error ? error62.message : "unknown error"}. Do not repeat a mutation to recover output.
-`, 12, true);
+      let saved = false;
+      try {
+        saved = readFileSync5(recoveryPath, "utf8") === completeResult;
+      } catch {
+      }
+      output2 = { ...fail2(`output-failed \u2014 The app request completed, but the result could not be saved or selected: ${error62 instanceof Error ? error62.message : "unknown error"}. ${saved ? `Complete result: ${recoveryPath}. Read that local JSON file to recover the returned identifiers` : "The complete result is on stdout"}. Do not repeat the app mutation.
+`, 12, true), ...saved ? {} : { stdout: completeResult, stdoutJson: true } };
     }
   }
   if (bundle2.selection.fallback && !["prefer-verified", "pinned-selection"].includes(bundle2.selection.replaced?.reason ?? "")) output2.stderr += `Using a previously working revision (${bundle2.selection.replaced?.reason ?? "compatible-fallback"}). Selection recovers automatically when an eligible revision is available.${bundle2.selection.replaced?.until ? ` Protective pause ends ${bundle2.selection.replaced.until}.` : ""} Inspect distribution with ${prefix(`apps history ${appName}`)}.
 `;
+  output2.dispatched = Boolean(dispatchedAt);
+  saveTimings(timings, performance.now() - commandStarted);
   return output2;
 }
 async function executeDraftVerification(input2) {
@@ -32365,7 +32511,7 @@ async function executeDraftVerification(input2) {
   const schema = input2.kind === "action" ? action.inputs ?? { type: "object", properties: {}, additionalProperties: false } : probe.inputs ?? { type: "object", properties: {}, additionalProperties: false };
   let values;
   let prepared;
-  const generated = input2.kind === "action" && action && "generated" in action ? Object.fromEntries(Object.entries(action.generated ?? {}).map(([name, spec]) => [name, `${spec.prefix ?? ""}${randomUUID6()}`])) : {};
+  const generated = input2.kind === "action" && action && "generated" in action ? Object.fromEntries(Object.entries(action.generated ?? {}).map(([name, spec]) => [name, `${spec.prefix ?? ""}${randomUUID7()}`])) : {};
   try {
     values = effectiveInputs(schema, input2.sampleInputs, {}, true).values;
     const request2 = input2.kind === "action" ? action.request : probe.request;
@@ -32388,6 +32534,8 @@ async function executeDraftVerification(input2) {
   let dispatched = false;
   let dispatchStarted = 0;
   let dispatchAt = null;
+  const browserExecution = {};
+  let liveBrowser;
   const sendConfigured = async (request2, effect2) => {
     const allowNonJsonProbe = input2.kind === "transport" && probe?.response.schema === void 0 && probe?.response.path === void 0;
     let credentialDraftId;
@@ -32399,7 +32547,7 @@ async function executeDraftVerification(input2) {
       const installation = input2.state.installation();
       const store = new CredentialStore(input2.root, new KeyringVault());
       try {
-        credentialDraftId = randomUUID6();
+        credentialDraftId = randomUUID7();
         store.registerDraft({ workspaceId: installation.workspaceId, appId: input2.appId, appTitle: input2.appSlug, transportName: input2.name, requirements: transport.credentials ?? [], credentialContract: credentialContractKey(transport), destinations: transport.allowedOrigins, draftId: credentialDraftId, expiresAt: new Date(Date.now() + 30 * 6e4).toISOString(), source: { draftId: selected.id, sessionId: input2.session.id, fingerprint: current.fingerprint } });
       } finally {
         store.close();
@@ -32408,10 +32556,11 @@ async function executeDraftVerification(input2) {
     if (transport.mode === "browser") {
       const prior = dispatched;
       try {
+        liveBrowser ??= await captureClient(input2.root);
         return await sendBrowser(input2.root, input2.appId, transport.browserContext, browserPage.pageOrigin, effect2, input2.kind === "action" && action && "transport" in action ? action.transport : input2.name, transport, request2, () => {
           if (!dispatched) input2.onDispatch?.();
           dispatched = true;
-        }, credential2, credentialDraftId, allowNonJsonProbe, void 0, { tab: input2.browserTab || input2.state.browserTab(input2.session.id, input2.appId), appSlug: input2.appSlug, prefix: input2.commandPrefix, ownerSession: input2.session.id });
+        }, credential2, credentialDraftId, allowNonJsonProbe, void 0, { tab: input2.browserTab || input2.state.browserTab(input2.session.id, input2.appId), appSlug: input2.appSlug, prefix: input2.commandPrefix, ownerSession: input2.session.id, client: liveBrowser, execution: browserExecution });
       } catch (error62) {
         if (error62 instanceof BrowserControlError && !error62.dispatched) {
           if (prior) throw new BrowserControlError("The mutation was already dispatched; its browser readback could not run. Inspect app state instead of rerunning the mutation", error62.code, true);
@@ -32459,6 +32608,9 @@ async function executeDraftVerification(input2) {
     return { ok: true, output: value, proof: "not-applicable", dispatched: true };
   } catch (error62) {
     return { ok: false, message: `${(error62 instanceof Error ? error62.message : "The test did not return").replace(/[.\s]+$/u, "")}. ${dispatched ? input2.kind === "transport" || action && "effect" in action && action.effect === "read" ? "The read did not return complete evidence" : "The request may have reached the app; inspect its state before another mutation" : "No app request was sent"}`, exitCode: dispatched || error62 instanceof BrowserControlError || ["extension-unavailable", "capture-server-unavailable", "native-host-upgrade-required"].includes(error62?.code ?? "") ? 5 : 2, dispatched };
+  } finally {
+    if (browserExecution.scope) await liveBrowser?.closeScope(browserExecution.scope.id).catch(() => {
+    });
   }
 }
 var import__3, import_ajv_formats, ajv3, result, fail2, ResponseContractFailure, omit2;
@@ -32467,6 +32619,9 @@ var init_run = __esm({
     "use strict";
     init_definitions();
     init_json();
+    init_timings();
+    init_files();
+    init_execution_reports();
     init_drafts();
     init_credential_draft();
     import__3 = __toESM(require__(), 1);
@@ -32487,9 +32642,9 @@ var init_run = __esm({
 });
 
 // src/commands/catalog.ts
-import { mkdtempSync, writeFileSync as writeFileSync5 } from "node:fs";
+import { mkdtempSync, writeFileSync as writeFileSync6 } from "node:fs";
 import { tmpdir } from "node:os";
-import { isAbsolute as isAbsolute3, join as join9 } from "node:path";
+import { resolve as resolve5, join as join10 } from "node:path";
 function numberOption(value, fallback, max) {
   if (!value) return fallback;
   const number4 = Number(value);
@@ -32798,8 +32953,8 @@ Or address it explicitly: ${prefix("context set <name> <value> --app <app>")}
 `);
     if (search && !second?.trim()) return fail3("Enter an action name or title to search.\n");
     if (!search && invocation.flags.includes("all")) {
-      const directory = mkdtempSync(join9(tmpdir(), "apilift-action-index-"));
-      const file2 = join9(directory, "actions.txt");
+      const directory = mkdtempSync(join10(tmpdir(), "apilift-action-index-"));
+      const file2 = join10(directory, "actions.txt");
       const rows = [];
       let cursor;
       let complete = false;
@@ -32815,7 +32970,7 @@ Or address it explicitly: ${prefix("context set <name> <value> --app <app>")}
         complete = true;
       } catch {
       }
-      writeFileSync5(file2, `${rows.join("\n")}${rows.length ? "\n" : ""}`, { mode: 384 });
+      writeFileSync6(file2, `${rows.join("\n")}${rows.length ? "\n" : ""}`, { mode: 384 });
       return complete ? ok2(`Saved the complete accessible action index (${rows.length} actions) to ${file2}.
 Search this file with ordinary file tools. No app request was sent.
 `) : { stdout: "", stderr: `Action index collection is incomplete. ${rows.length} actions were saved to ${file2}.
@@ -32887,9 +33042,8 @@ If the interface needs an operation: ${prefix(`apps update ${appName}`)}
     if (invocation.flags.includes("schema")) return ok2(`${JSON.stringify(docs.map((doc) => ({ name: doc.name, inputs: doc.inputs, output: doc.output ?? null })), null, 2)}
 `, true);
     if (invocation.options["input-template"]) {
-      const path2 = invocation.options["input-template"];
-      if (!isAbsolute3(path2)) return fail3("--input-template needs an absolute file path.\n");
-      writeFileSync5(path2, inputTemplate(docs[0].inputs), { flag: "wx", mode: 384 });
+      const path2 = resolve5(invocation.options["input-template"]);
+      writeFileSync6(path2, inputTemplate(docs[0].inputs), { flag: "wx", mode: 384 });
       return ok2(`Wrote an editable input template to ${path2}. Replace examples with real values before running:
   ${prefix(`run ${appName} ${names2[0]} --input @${path2} --check`)}
 `);
@@ -32922,7 +33076,7 @@ If the app has gained this operation, investigate: ${prefix(`apps update ${appNa
   ${prefix(`run ${appName} ${doc.name}${requiredFlags.replace(` --${contextName.replaceAll("_", "-")} <chosen-value>`, "")}`)}
 
 ` : ""}Other ways to supply inputs and handle results:
-${inputExample(properties)}  --input @/absolute/input.json reads JSON/JSONC; --input - reads JSON from stdin.
+${inputExample(properties)}  --input @./input.json reads JSON/JSONC; --input - reads JSON from stdin.
   Do not supply the same input in both JSON and flags. Booleans take true/false;
   null is a value only when the displayed schema allows it, not a request to omit.
   --check prints effective inputs and their sources without sending an app request.
@@ -32945,10 +33099,10 @@ ${outputLines(doc.output)}
 ${requiredFlags ? "Run after choosing real required values:" : "Run:"}
   ${prefix(`run ${appName} ${doc.name}${requiredFlags}`)}
 
-${inputGuidance}  --output /absolute/result.json saves the fetched result${Object.hasOwn(outputProperties, "nextCursor") ? ", not unfetched pages" : ""}.
+${inputGuidance}  --output ./result.json saves the fetched result${Object.hasOwn(outputProperties, "nextCursor") ? ", not unfetched pages" : ""}.
 ${selection}
 ${hasInputs ? `Generate an editable input file, including types and field instructions:
-  ${prefix(`actions show ${appName} ${doc.name} --input-template /absolute/input.jsonc`)}
+  ${prefix(`actions show ${appName} ${doc.name} --input-template ./input.jsonc`)}
 ` : ""}Read the machine-readable input and output contracts:
   ${prefix(`actions show ${appName} ${doc.name} --schema`)}
 
@@ -32974,7 +33128,7 @@ var init_catalog = __esm({
 });
 
 // src/commands/credentials.ts
-import { randomUUID as randomUUID7 } from "node:crypto";
+import { randomUUID as randomUUID8 } from "node:crypto";
 async function app(api, ref) {
   return api.call("getApp", { params: { app: ref } });
 }
@@ -33095,7 +33249,7 @@ List current entries: ${command3(invocation, `credentials list ${selectedApp.slu
 ${current.instructions}
 `);
       const expiresAt = new Date(Date.now() + 30 * 6e4).toISOString();
-      const draftId = ownedDraft && draftContract ? randomUUID7() : void 0;
+      const draftId = ownedDraft && draftContract ? randomUUID8() : void 0;
       if (draftId && ownedDraft && draftContract) store.registerDraft({ ...current, draftId, expiresAt, source: { draftId: ownedDraft.id, sessionId: session.id, fingerprint: draftContract.fingerprint } });
       const link = { ...draftId ? { draftId } : {}, appId: selectedApp.id, appTitle: selectedApp.title, transportName, instructions: current.instructions, requirements: current.requirements, sessionId: session.id, expiresAt };
       const url3 = `${siteUrl2}/dashboard/credentials/setup#${Buffer.from(canonicalJson(link)).toString("base64url")}`;
@@ -33294,6 +33448,59 @@ var init_capture_derivation = __esm({
   }
 });
 
+// src/capture-server/windows-owner.ts
+import { Worker } from "node:worker_threads";
+function windowsProcessStart(pid) {
+  if (!worker) {
+    memory = new SharedArrayBuffer(24);
+    worker = new Worker(workerSource, { eval: true, workerData: { memory, script } });
+    worker.on("error", () => {
+    });
+    worker.unref();
+  }
+  const state = new Int32Array(memory, 0, 4), value = new Float64Array(memory, 16, 1);
+  const id2 = ++sequence;
+  Atomics.store(state, 1, id2);
+  Atomics.store(state, 0, 1);
+  worker.postMessage({ id: id2, pid });
+  Atomics.wait(state, 0, 1, 4e3);
+  if (Atomics.load(state, 0) === 2 && value[0] > 0) return value[0];
+  if (Atomics.load(state, 0) !== 2) {
+    void worker.terminate();
+    worker = void 0;
+  }
+  return null;
+}
+var script, workerSource, worker, memory, sequence;
+var init_windows_owner = __esm({
+  "src/capture-server/windows-owner.ts"() {
+    "use strict";
+    script = `$ErrorActionPreference='Stop'; while ($null -ne ($line=[Console]::ReadLine())) { $parts=$line.Split('|'); try { $p=[System.Diagnostics.Process]::GetProcessById([int]$parts[1]); $stamp=([DateTimeOffset]$p.StartTime.ToUniversalTime()).ToUnixTimeMilliseconds(); $p.Dispose() } catch { $stamp=0 }; [Console]::WriteLine($parts[0]+'|'+$stamp); [Console]::Out.Flush() }`;
+    workerSource = `
+const {workerData}=require('node:worker_threads');
+const {spawn}=require('node:child_process');
+const state=new Int32Array(workerData.memory,0,4), value=new Float64Array(workerData.memory,16,1);
+const child=spawn('powershell.exe',['-NoLogo','-NoProfile','-NonInteractive','-Command',workerData.script],{windowsHide:true,stdio:['pipe','pipe','ignore']});
+const fail=()=>{Atomics.store(state,0,3);Atomics.notify(state,0);};
+child.on('error',fail);child.on('exit',fail);
+let text='';
+child.stdout.on('data',chunk=>{
+  text+=chunk.toString();
+  let end;
+  while((end=text.indexOf('\\n'))>=0){
+    const [id,stamp]=text.slice(0,end).trim().split('|').map(Number);text=text.slice(end+1);
+    if(id!==Atomics.load(state,1)||Atomics.load(state,0)!==1)continue;
+    value[0]=Number.isFinite(stamp)?stamp:0;Atomics.store(state,0,2);Atomics.notify(state,0);
+  }
+  if(text.length>1024){child.kill();fail();}
+});
+const {parentPort}=require('node:worker_threads');
+parentPort.on('message',({id,pid})=>{try{child.stdin.write(id+'|'+pid+'\\n');}catch{fail();}});
+`;
+    sequence = 0;
+  }
+});
+
 // ../../packages/protocol/dist/native.js
 function validateNativeFrameLength(byteLength, direction) {
   return Number.isInteger(byteLength) && byteLength >= 0 && byteLength <= (direction === "request" ? 512 * 1024 : 1024 * 1024);
@@ -33494,7 +33701,7 @@ var init_dist = __esm({
 });
 
 // src/capture-server/store.ts
-import { mkdirSync as mkdirSync6, chmodSync as chmodSync6, readFileSync as readFileSync6 } from "node:fs";
+import { mkdirSync as mkdirSync7, chmodSync as chmodSync6, readFileSync as readFileSync6 } from "node:fs";
 import { execFileSync } from "node:child_process";
 import { DatabaseSync as DatabaseSync5 } from "node:sqlite";
 function createOwnerVerifier(probe = {}) {
@@ -33539,6 +33746,10 @@ function inspectOwner(pid, expectedStartedAt, probe) {
       return false;
     }
   }
+  if (windows && !probe.inspect) {
+    const observed = windowsProcessStart(pid);
+    return observed !== null && Math.abs(observed - expectedStartedAt) <= 5e3;
+  }
   for (let attempt = 0; attempt < (windows ? 2 : 1); attempt++) {
     if (!alive(pid)) return false;
     const remaining = windows ? 8e3 - (now() - started) : 2e3;
@@ -33557,6 +33768,7 @@ var pidAlive, inspectProcess, linuxClockTicks, defaultOwnerVerifier;
 var init_store = __esm({
   "src/capture-server/store.ts"() {
     "use strict";
+    init_windows_owner();
     init_dist();
     pidAlive = (candidate2) => {
       try {
@@ -33573,17 +33785,17 @@ var init_store = __esm({
 
 // src/discovery/lock.ts
 import { createHash as createHash3 } from "node:crypto";
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync7, rmSync as rmSync3, writeFileSync as writeFileSync6 } from "node:fs";
-import { join as join10 } from "node:path";
+import { mkdirSync as mkdirSync8, readFileSync as readFileSync7, rmSync as rmSync3, writeFileSync as writeFileSync7 } from "node:fs";
+import { join as join11 } from "node:path";
 function lockDiscovery(root, sessionId) {
   const name = createHash3("sha256").update(sessionId).digest("hex");
-  const directory = join10(root, "locks", `discovery-${name}`);
-  mkdirSync7(join10(root, "locks"), { recursive: true, mode: 448 });
+  const directory = join11(root, "locks", `discovery-${name}`);
+  mkdirSync8(join11(root, "locks"), { recursive: true, mode: 448 });
   const owner = { pid: process.pid, startedAt: Date.now() - process.uptime() * 1e3 };
   for (let attempt = 0; attempt < 2; attempt++) {
     try {
-      mkdirSync7(directory, { mode: 448 });
-      writeFileSync6(join10(directory, "owner.json"), JSON.stringify(owner), { flag: "wx", mode: 384 });
+      mkdirSync8(directory, { mode: 448 });
+      writeFileSync7(join11(directory, "owner.json"), JSON.stringify(owner), { flag: "wx", mode: 384 });
       return () => {
         rmSync3(directory, { recursive: true, force: true });
       };
@@ -33591,7 +33803,7 @@ function lockDiscovery(root, sessionId) {
       if (error62.code !== "EEXIST") throw error62;
       let held = null;
       try {
-        held = JSON.parse(readFileSync7(join10(directory, "owner.json"), "utf8"));
+        held = JSON.parse(readFileSync7(join11(directory, "owner.json"), "utf8"));
       } catch {
       }
       if (!held || ownerProcessAlive(held.pid, held.startedAt)) throw new Error("discovery-command-busy \u2014 This agent already has a discovery command running; wait for it to finish, then retry");
@@ -33635,10 +33847,10 @@ var init_session = __esm({
 });
 
 // src/commands/discover.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync8, mkdtempSync as mkdtempSync2, readFileSync as readFileSync8, renameSync as renameSync2, writeFileSync as writeFileSync7 } from "node:fs";
-import { randomUUID as randomUUID8 } from "node:crypto";
+import { existsSync as existsSync4, mkdirSync as mkdirSync9, mkdtempSync as mkdtempSync2, readFileSync as readFileSync8, renameSync as renameSync2, writeFileSync as writeFileSync8 } from "node:fs";
+import { randomUUID as randomUUID9 } from "node:crypto";
 import { tmpdir as tmpdir2 } from "node:os";
-import { dirname as dirname5, join as join11 } from "node:path";
+import { dirname as dirname6, join as join12 } from "node:path";
 async function currentResource(api, appId, kind, name) {
   try {
     const resource = await api.call("getResource", { params: { app: appId, kind: backendKind(kind), name } });
@@ -33842,7 +34054,7 @@ File: ${draft.filePath}
     const definition2 = resource.definition;
     const dependencies = kind === "action" && !("unavailable" in definition2) ? { transport: String(definition2.transport ?? "") } : kind === "transport" && definition2.browserContext ? { browserPage: String(definition2.browserContext) } : void 0;
     const editable = { definition: definition2, ...dependencies ? { dependencies } : {}, ...kind === "action" && !("unavailable" in definition2) || kind === "transport" ? { verification: { inputs: {}, review: "pending", notes: "" } } : {} };
-    writeFileSync7(draft.filePath, `${JSON.stringify(editable, null, 2)}
+    writeFileSync8(draft.filePath, `${JSON.stringify(editable, null, 2)}
 `, { mode: 384 });
   }
   void root;
@@ -33858,7 +34070,7 @@ function researchTables(state) {
 }
 function researchPath(root, appSlug, scope2) {
   if (!/^(app|[a-z][a-z0-9_-]{0,79}\.[a-z][a-z0-9_-]{0,79})$/.test(scope2)) throw new Error("Research scope must be app or entity.verb, for example ticket.get");
-  return join11(root, "drafts", appSlug, "api", `${scope2}.jsonc`);
+  return join12(root, "drafts", appSlug, "api", `${scope2}.jsonc`);
 }
 function handleResearch(invocation, state, store, session, root) {
   const current = requireDiscovery(store, session, invocation);
@@ -33873,8 +34085,8 @@ function handleResearch(invocation, state, store, session, root) {
       return fail5(`${error62 instanceof Error ? error62.message : "Invalid research scope"}.
 `);
     }
-    mkdirSync8(dirname5(path2), { recursive: true, mode: 448 });
-    if (!existsSync3(path2)) writeFileSync7(path2, `// Record a focused check of official operation and access documentation.
+    mkdirSync9(dirname6(path2), { recursive: true, mode: 448 });
+    if (!existsSync4(path2)) writeFileSync8(path2, `// Record a focused check of official operation and access documentation.
 ${JSON.stringify({ scope: scope2, conclusion: "pending", findings: "", sources: [{ kind: "operation", url: "", finding: "" }, { kind: "access", url: "", finding: "" }] }, null, 2)}
 `, { flag: "wx", mode: 384 });
     state.db.prepare("INSERT INTO discovery_research (app_slug,scope,file_path) VALUES (?,?,?) ON CONFLICT(app_slug,scope) DO NOTHING").run(current.appSlug, scope2, path2);
@@ -34331,15 +34543,15 @@ async function rebaseDraft(invocation, api, store, session) {
   if (current.version === draft.baseVersion) return ok4(`The published ${draft.kind} ${draft.name} is still at version ${current.version}; no rebase is needed.
 `);
   const comparisonPath = `${draft.filePath}.current.json`;
-  writeFileSync7(comparisonPath, `${JSON.stringify({ version: current.version, definition: current.definition }, null, 2)}
+  writeFileSync8(comparisonPath, `${JSON.stringify({ version: current.version, definition: current.definition }, null, 2)}
 `, { mode: 384 });
   if (draft.intent === "remove") {
     const checked = await checkDraft(store, session.id, api);
     if (checked.issues.length) return checkResponse(checked, invocation);
     const source = readFileSync8(draft.filePath, "utf8");
     const updated = applyEdits(source, modify(source, ["expectedVersion"], current.version, { formattingOptions: { insertSpaces: true, tabSize: 2 } }));
-    const temporary = `${draft.filePath}.${randomUUID8()}.tmp`;
-    writeFileSync7(temporary, updated, { flag: "wx", mode: 384 });
+    const temporary = `${draft.filePath}.${randomUUID9()}.tmp`;
+    writeFileSync8(temporary, updated, { flag: "wx", mode: 384 });
     renameSync2(temporary, draft.filePath);
     store.setBaseVersion(draft.id, current.version);
     return ok4(`The published ${label(draft.kind)} ${draft.name} changed. The removal now targets version ${current.version}.
@@ -34403,9 +34615,9 @@ File: ${draft.filePath}
   }
   withBaselines(root, (baselines) => baselines.finishPreparation(session.id, draft.appSlug, draft.appId, transport.mode));
   if (write) store.saveAttempt(draft.id, identity2.fingerprint, "success");
-  const dir = mkdtempSync2(join11(tmpdir2(), "apilift-discover-"));
-  const resultPath = join11(dir, "verification.json");
-  writeFileSync7(resultPath, `${JSON.stringify(executed.output, null, 2)}
+  const dir = mkdtempSync2(join12(tmpdir2(), "apilift-discover-"));
+  const resultPath = join12(dir, "verification.json");
+  writeFileSync8(resultPath, `${JSON.stringify(executed.output, null, 2)}
 `, { flag: "wx", mode: 384 });
   const prior = store.evidence(draft.id);
   const probes = draft.kind === "transport" ? [...((prior?.fingerprint === identity2.fingerprint ? prior.data.probes : []) ?? []).filter((item) => item.origin !== envelope.verification?.probeOrigin), { origin: envelope.verification.probeOrigin, verifiedAt: (/* @__PURE__ */ new Date()).toISOString() }] : void 0;
@@ -34459,7 +34671,7 @@ async function awaitCaptureJob(client, id2) {
   do {
     const job = await client.jobResult(id2);
     if (job.status === "delivered" || job.status === "uncertain") return job;
-    await new Promise((resolve6) => setTimeout(resolve6, 200));
+    await new Promise((resolve10) => setTimeout(resolve10, 200));
   } while (Date.now() < deadline);
   return { status: "pending" };
 }
@@ -34531,7 +34743,7 @@ async function refreshCandidate(item, scopeId, root, deadline, waitForResponse)
     }
     if (latest) item = latest;
     if (!waitForResponse || !item.entry.pending) return item;
-    await new Promise((resolve6) => setTimeout(resolve6, 100));
+    await new Promise((resolve10) => setTimeout(resolve10, 100));
   } while (Date.now() < deadline);
   return item;
 }
@@ -34555,7 +34767,7 @@ async function selectedBody(item, part, scopeId, root, deadline = Date.now() + 5
       if (bytes.length !== artifact.bytes) throw new Error("Selected body length does not match its artifact");
       return bytes.toString("utf8");
     }
-    await new Promise((resolve6) => setTimeout(resolve6, 100));
+    await new Promise((resolve10) => setTimeout(resolve10, 100));
   } while (Date.now() < deadline);
   return null;
 }
@@ -34636,7 +34848,7 @@ function selectCapture(invocation, draft, source, item) {
     }
   }
   updated = applyEdits(updated, modify(updated, ["verification", "review"], "pending", { formattingOptions: { insertSpaces: true, tabSize: 2 } }));
-  writeFileSync7(draft.filePath, updated, { mode: 384 });
+  writeFileSync8(draft.filePath, updated, { mode: 384 });
   const candidates = authFieldPointers(entry2);
   const authHint = candidates.length ? `Authentication field candidates (names only): ${candidates.join(", ")}. Probe bounded local/session storage without guessing a field or location: ${command4(invocation, `discover capture auth c${item.seq}`)}. Optionally narrow capture.authField and capture.authScope in the draft after reviewing the value-free result. A locator is only a hypothesis until a safe read verifies the selected connection.
 ` : browserCookiePresent(entry2) ? "Browser-managed cookie was present; browser replay sends cookies automatically. No source locator is needed for that cookie. Verify the selected connection with a safe read.\n" : "";
@@ -34712,7 +34924,7 @@ ${detail}
     const scope2 = await client.openScope({ kind: "capture", appId: draft.appId, contextId: transport.browserContext, pageOrigin: context.pageOrigin, tabSelector: tab.selector, ownerPid: client.receipt.pid, ownerStartedAt: Date.parse(client.receipt.startedAt), ownerSession: session.id });
     const previousEvidence = row?.evidence_scope_id ?? row?.scope_id;
     if (previousEvidence) await client.closeScope(previousEvidence);
-    const id2 = randomUUID8();
+    const id2 = randomUUID9();
     state.db.prepare("INSERT INTO discovery_capture (draft_id,scope_id,job_id,phase,entries_json) VALUES (?,?,?,?,NULL) ON CONFLICT(draft_id) DO UPDATE SET scope_id=excluded.scope_id,job_id=excluded.job_id,phase=excluded.phase,entries_json=NULL,evidence_scope_id=excluded.scope_id").run(draft.id, scope2.id, id2, "starting");
     state.db.prepare("UPDATE discovery_capture SET evidence_scope_id=? WHERE draft_id=?").run(scope2.id, draft.id);
     await client.enqueueJob(scope2.id, { job: { id: id2, kind: "begin", label: draft.name, entity: nameParts[0], operation: nameParts[1], effect: effect2, inputs: envelope.verification.inputs } });
@@ -34763,7 +34975,7 @@ Review: ${command4(invocation, "discover status")}
 `, 12);
     }
     client = await captureClient(root);
-    let stopId = row.phase === "stopping" && row.job_id ? row.job_id : randomUUID8();
+    let stopId = row.phase === "stopping" && row.job_id ? row.job_id : randomUUID9();
     if (row.phase !== "stopping") {
       state.db.prepare("UPDATE discovery_capture SET phase='stopping',job_id=? WHERE draft_id=?").run(stopId, draft.id);
       await client.enqueueJob(row.scope_id, { job: { id: stopId, kind: "stop" } });
@@ -34771,7 +34983,7 @@ Review: ${command4(invocation, "discover status")}
       const previous = await client.jobResult(stopId);
       if (previous.status === "delivered" && previous.result?.boundaryConfirmed !== true) {
         const failedId = stopId;
-        stopId = randomUUID8();
+        stopId = randomUUID9();
         state.db.prepare("UPDATE discovery_capture SET job_id=? WHERE draft_id=?").run(stopId, draft.id);
         await client.enqueueJob(row.scope_id, { job: { id: stopId, kind: "stop" } });
         await client.acknowledgeJob(failedId);
@@ -34866,14 +35078,14 @@ Inspect a returned candidate: ${command4(invocation, `discover capture show c${p
     const [location, keyName] = capture?.authScope?.split(":", 2) ?? [];
     if (location && !["localStorage", "sessionStorage", "global", "cookie", "meta"].includes(location)) return fail5(`capture.authScope must be localStorage, sessionStorage, global, cookie or meta, optionally followed by :<key>. Edit ${draft.filePath}.
 `);
-    const client = await captureClient(root), id2 = randomUUID8();
+    const client = await captureClient(root), id2 = randomUUID9();
     try {
       await client.enqueueJob(row.scope_id, { job: { id: id2, kind: "auth-probe", captureId: String(item.entry.captureId), ...capture?.authField ? { field: capture.authField } : {}, ...location ? { scope: { in: location, ...keyName ? { key: keyName } : {} } } : {} } });
       const result3 = await awaitCaptureJob(client, id2);
       if (result3.status !== "delivered") return fail5(`Auth source probe is ${result3.status}; no source was confirmed. Retry only this probe while evidence is live.
 `, 12);
-      const path2 = join11(mkdtempSync2(join11(tmpdir2(), "apilift-auth-source-")), "source.json");
-      writeFileSync7(path2, `${JSON.stringify(result3.result, null, 2)}
+      const path2 = join12(mkdtempSync2(join12(tmpdir2(), "apilift-auth-source-")), "source.json");
+      writeFileSync8(path2, `${JSON.stringify(result3.result, null, 2)}
 `, { mode: 384 });
       await client.acknowledgeJob(id2);
       const connection = parsed.envelope?.dependencies?.transport;
@@ -34928,13 +35140,13 @@ var init_discover = __esm({
 });
 
 // src/output.ts
-import { randomUUID as randomUUID9 } from "node:crypto";
+import { randomUUID as randomUUID10 } from "node:crypto";
 import { chmod, mkdtemp, open as open3, rename } from "node:fs/promises";
 import { tmpdir as tmpdir3 } from "node:os";
-import { join as join12 } from "node:path";
+import { join as join13 } from "node:path";
 async function completedFile(directory, name, content) {
-  const target = join12(directory, name);
-  const pending = join12(directory, `.${name}-${randomUUID9()}`);
+  const target = join13(directory, name);
+  const pending = join13(directory, `.${name}-${randomUUID10()}`);
   const handle2 = await open3(pending, "wx", 384);
   try {
     await handle2.writeFile(content, "utf8");
@@ -34952,7 +35164,7 @@ async function finalizeOutput(output2, sink, directory = tmpdir3()) {
   const size = () => Buffer.byteLength(stdout) + Buffer.byteLength(stderr);
   try {
     if (size() > displayBudget) {
-      const root = await mkdtemp(join12(directory, "apilift-output-"));
+      const root = await mkdtemp(join13(directory, "apilift-output-"));
       await chmod(root, 448);
       const streams = ["stdout", "stderr"];
       streams.sort((left, right) => Buffer.byteLength(output2[right]) - Buffer.byteLength(output2[left]));
@@ -34992,12 +35204,12 @@ var init_output = __esm({
 // ../../node_modules/.pnpm/tinyexec@1.3.1/node_modules/tinyexec/dist/main.mjs
 import { spawn as spawn2, spawnSync } from "node:child_process";
 import { cwd } from "node:process";
-import { basename, delimiter, dirname as dirname6, normalize, resolve as resolve2 } from "node:path";
+import { basename, delimiter, dirname as dirname7, normalize, resolve as resolve6 } from "node:path";
 import { fileURLToPath } from "node:url";
 import { pipeline } from "node:stream/promises";
 import { PassThrough } from "node:stream";
 import readline from "node:readline";
-import { closeSync, openSync, readSync, statSync } from "node:fs";
+import { closeSync, openSync, readSync, statSync as statSync2 } from "node:fs";
 function getPathFromEnv(env) {
   for (const key in env) {
     if (!Object.prototype.hasOwnProperty.call(env, key) || !isPathLikePattern.test(key)) continue;
@@ -35016,11 +35228,11 @@ function addNodeBinToPath(cwd2, path2) {
   let currentPath = typeof cwd2 === "string" ? cwd2 : fileURLToPath(cwd2, { windows: false });
   let lastPath;
   do {
-    nodeBinPaths.push(resolve2(currentPath, "node_modules", ".bin"));
+    nodeBinPaths.push(resolve6(currentPath, "node_modules", ".bin"));
     lastPath = currentPath;
-    currentPath = dirname6(currentPath);
+    currentPath = dirname7(currentPath);
   } while (currentPath !== lastPath);
-  nodeBinPaths.push(dirname6(process.execPath));
+  nodeBinPaths.push(dirname7(process.execPath));
   const newPath = nodeBinPaths.concat(parts).join(delimiter);
   return {
     key: path2.key,
@@ -35110,11 +35322,11 @@ function resolveCommand(command6, options2) {
   if (command6.includes(".") && pathExt[0] !== "") pathExt = ["", ...pathExt];
   for (const extensions of [pathExt, noPathExt]) for (const path2 of pathEnv) {
     const unquoted = path2.startsWith('"') && path2.endsWith('"') && path2.length > 1 ? path2.slice(1, -1) : path2;
-    const dest = resolve2(cwd$3, unquoted, command6);
+    const dest = resolve6(cwd$3, unquoted, command6);
     for (const ext of extensions) {
       const destWithExt = dest + ext;
       try {
-        if (statSync(destWithExt).isFile()) return destWithExt;
+        if (statSync2(destWithExt).isFile()) return destWithExt;
       } catch {
       }
     }
@@ -35280,8 +35492,8 @@ var init_main2 = __esm({
         };
         this._command = command6;
         this._args = args ?? [];
-        this._processClosed = new Promise((resolve6) => {
-          this._resolveClose = resolve6;
+        this._processClosed = new Promise((resolve10) => {
+          this._resolveClose = resolve10;
         });
       }
       kill(signal) {
@@ -35364,8 +35576,8 @@ var init_main2 = __esm({
       }
       _resetState() {
         this._aborted = false;
-        this._processClosed = new Promise((resolve6) => {
-          this._resolveClose = resolve6;
+        this._processClosed = new Promise((resolve10) => {
+          this._resolveClose = resolve10;
         });
         this._thrownError = void 0;
       }
@@ -35391,30 +35603,30 @@ var init_main2 = __esm({
 
 // src/plugin.ts
 import { createHash as createHash5 } from "node:crypto";
-import { cpSync, existsSync as existsSync4, mkdirSync as mkdirSync9, readFileSync as readFileSync9, readdirSync, renameSync as renameSync3, rmSync as rmSync4, writeFileSync as writeFileSync8 } from "node:fs";
+import { cpSync, existsSync as existsSync5, mkdirSync as mkdirSync10, readFileSync as readFileSync9, readdirSync, renameSync as renameSync3, rmSync as rmSync4, writeFileSync as writeFileSync9 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { dirname as dirname7, join as join13, resolve as resolve3 } from "node:path";
+import { dirname as dirname8, join as join14, resolve as resolve7 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function missingSkill(root) {
-  return skillNames.find((name) => !existsSync4(join13(root, "skills", name, "SKILL.md")));
+  return skillNames.find((name) => !existsSync5(join14(root, "skills", name, "SKILL.md")));
 }
 function completeCopy(source, target) {
-  return files(source).every((path2) => existsSync4(join13(target, path2)));
+  return files(source).every((path2) => existsSync5(join14(target, path2)));
 }
 function files(root, relative = "") {
-  return readdirSync(join13(root, relative), { withFileTypes: true }).flatMap((entry2) => {
-    const path2 = join13(relative, entry2.name);
+  return readdirSync(join14(root, relative), { withFileTypes: true }).flatMap((entry2) => {
+    const path2 = join14(relative, entry2.name);
     return entry2.isDirectory() ? files(root, path2) : [path2];
   }).sort();
 }
 function digest(root) {
   const hash4 = createHash5("sha256");
-  for (const path2 of files(root)) hash4.update(path2).update("\0").update(readFileSync9(join13(root, path2))).update("\0");
+  for (const path2 of files(root)) hash4.update(path2).update("\0").update(readFileSync9(join14(root, path2))).update("\0");
   return hash4.digest("hex");
 }
 function writeJson(path2, value) {
-  mkdirSync9(dirname7(path2), { recursive: true });
-  writeFileSync8(path2, `${JSON.stringify(value, null, 2)}
+  mkdirSync10(dirname8(path2), { recursive: true });
+  writeFileSync9(path2, `${JSON.stringify(value, null, 2)}
 `, { mode: 384 });
 }
 function readJson(path2) {
@@ -35452,16 +35664,16 @@ function active(agent2, expected) {
 }
 function inspectAgentPlugin(agent2, env, sourceOverride) {
   if (env.APILIFT_DEV_PLUGIN_ROOT) return { ready: false, version: "development", detail: "Development plugin activation has not been verified" };
-  const source = resolve3(sourceOverride || join13(dirname7(fileURLToPath2(import.meta.url)), "plugin"));
+  const source = resolve7(sourceOverride || join14(dirname8(fileURLToPath2(import.meta.url)), "plugin"));
   const missing = missingSkill(source);
   if (missing) return { ready: false, version: "unknown", detail: `CLI package is missing its ${missing} skill` };
-  const version2 = readJson(join13(source, `.${agent2}-plugin`, "plugin.json"))?.version;
+  const version2 = readJson(join14(source, `.${agent2}-plugin`, "plugin.json"))?.version;
   if (typeof version2 !== "string" || !/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/.test(version2)) throw new Error("Plugin package version is invalid");
   const bundleDigest = digest(source);
   const expected = agent2 === "codex" ? `${version2}+codex.${bundleDigest.slice(0, 12)}` : version2;
-  const home = resolve3(env.APILIFT_AGENT_HOME || homedir2());
-  const plugin = agent2 === "codex" ? join13(home, "plugins", "apilift") : join13(home, ".agents", "plugins", "plugins", "apilift");
-  const marker = readJson(join13(plugin, markerName));
+  const home = resolve7(env.APILIFT_AGENT_HOME || homedir2());
+  const plugin = agent2 === "codex" ? join14(home, "plugins", "apilift") : join14(home, ".agents", "plugins", "plugins", "apilift");
+  const marker = readJson(join14(plugin, markerName));
   const staged = marker?.package === "apilift" && marker.bundleDigest === bundleDigest && marker.version === version2 && completeCopy(source, plugin);
   if (!staged) return { ready: false, version: expected, detail: "Apilift plugin files are missing or stale" };
   if (env.APILIFT_AGENT_HOME || env.APILIFT_AGENT_NO_ACTIVATE === "1") return { ready: false, version: expected, detail: "Apilift skills are staged; activation is unverified" };
@@ -35470,54 +35682,54 @@ function inspectAgentPlugin(agent2, env, sourceOverride) {
 }
 function ensureAgentPlugin(agent2, env, sourceOverride) {
   if (env.APILIFT_DEV_PLUGIN_ROOT) {
-    const source2 = resolve3(env.APILIFT_DEV_PLUGIN_ROOT);
+    const source2 = resolve7(env.APILIFT_DEV_PLUGIN_ROOT);
     const missing2 = missingSkill(source2);
     if (missing2) throw new Error(`Development plugin ${missing2} skill is missing`);
     const bundleDigest2 = digest(source2);
-    const root = resolve3(env.APILIFT_HOME || join13(homedir2(), ".local", "share", "apilift"));
-    writeJson(join13(root, "agent-plugins", `${agent2}.json`), { root: source2, digest: bundleDigest2 });
+    const root = resolve7(env.APILIFT_HOME || join14(homedir2(), ".local", "share", "apilift"));
+    writeJson(join14(root, "agent-plugins", `${agent2}.json`), { root: source2, digest: bundleDigest2 });
     return { ready: false, version: `dev+${bundleDigest2.slice(0, 12)}`, detail: "Development plugin source recorded; activation was not verified" };
   }
-  const source = resolve3(sourceOverride || join13(dirname7(fileURLToPath2(import.meta.url)), "plugin"));
+  const source = resolve7(sourceOverride || join14(dirname8(fileURLToPath2(import.meta.url)), "plugin"));
   const missing = missingSkill(source);
   if (missing) throw new Error(`CLI package is missing its ${missing} skill`);
-  const version2 = readJson(join13(source, `.${agent2}-plugin`, "plugin.json"))?.version;
+  const version2 = readJson(join14(source, `.${agent2}-plugin`, "plugin.json"))?.version;
   if (typeof version2 !== "string" || !/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/.test(version2)) throw new Error("Plugin package version is invalid");
   const bundleDigest = digest(source);
-  const home = resolve3(env.APILIFT_AGENT_HOME || homedir2());
-  const marketplace = join13(home, ".agents", "plugins");
-  const plugin = agent2 === "codex" ? join13(home, "plugins", "apilift") : join13(marketplace, "plugins", "apilift");
-  const marker = readJson(join13(plugin, markerName));
-  if (existsSync4(plugin) && marker?.package !== "apilift") throw new Error(`Refusing to replace unmanaged plugin ${plugin}`);
+  const home = resolve7(env.APILIFT_AGENT_HOME || homedir2());
+  const marketplace = join14(home, ".agents", "plugins");
+  const plugin = agent2 === "codex" ? join14(home, "plugins", "apilift") : join14(marketplace, "plugins", "apilift");
+  const marker = readJson(join14(plugin, markerName));
+  if (existsSync5(plugin) && marker?.package !== "apilift") throw new Error(`Refusing to replace unmanaged plugin ${plugin}`);
   const expected = agent2 === "codex" ? `${version2}+codex.${bundleDigest.slice(0, 12)}` : version2;
   const current = marker?.bundleDigest === bundleDigest && marker.version === version2 && completeCopy(source, plugin);
   if (!current) {
     const staging = `${plugin}.stage-${process.pid}`;
     rmSync4(staging, { recursive: true, force: true });
-    mkdirSync9(dirname7(staging), { recursive: true });
+    mkdirSync10(dirname8(staging), { recursive: true });
     cpSync(source, staging, { recursive: true });
-    const manifestPath = join13(staging, `.${agent2}-plugin`, "plugin.json");
+    const manifestPath = join14(staging, `.${agent2}-plugin`, "plugin.json");
     const manifest = readJson(manifestPath);
     if (!manifest) throw new Error("Plugin manifest is invalid");
     manifest.version = expected;
     writeJson(manifestPath, manifest);
-    writeJson(join13(staging, markerName), { schema: "apilift.plugin-install/v1", package: "apilift", version: version2, bundleDigest });
+    writeJson(join14(staging, markerName), { schema: "apilift.plugin-install/v1", package: "apilift", version: version2, bundleDigest });
     const backup = `${plugin}.backup-${process.pid}`;
-    if (existsSync4(plugin)) renameSync3(plugin, backup);
+    if (existsSync5(plugin)) renameSync3(plugin, backup);
     try {
       renameSync3(staging, plugin);
     } catch (error62) {
-      if (existsSync4(backup)) renameSync3(backup, plugin);
+      if (existsSync5(backup)) renameSync3(backup, plugin);
       throw error62;
     }
     rmSync4(backup, { recursive: true, force: true });
   }
-  const marketplacePath = join13(marketplace, "marketplace.json");
+  const marketplacePath = join14(marketplace, "marketplace.json");
   const document = readJson(marketplacePath) ?? { name: "personal", interface: { displayName: "Personal" }, plugins: [] };
   if (document.name !== "personal" || !Array.isArray(document.plugins)) throw new Error("Unsupported personal plugin marketplace");
   document.plugins = [...document.plugins.filter((item) => typeof item === "object" && item !== null && item.name !== "apilift"), { name: "apilift", source: { source: "local", path: "./plugins/apilift" }, policy: { installation: "AVAILABLE", authentication: "ON_INSTALL" }, category: "Developer Tools" }];
   writeJson(marketplacePath, document);
-  writeJson(join13(marketplace, ".claude-plugin", "marketplace.json"), { "$schema": "https://anthropic.com/claude-code/marketplace.schema.json", name: "personal", description: "Personal agent plugins", owner: { name: "Local" }, plugins: [{ name: "apilift", description: "Use logged-in apps and discover missing actions with Apilift", source: "./plugins/apilift", category: "development" }] });
+  writeJson(join14(marketplace, ".claude-plugin", "marketplace.json"), { "$schema": "https://anthropic.com/claude-code/marketplace.schema.json", name: "personal", description: "Personal agent plugins", owner: { name: "Local" }, plugins: [{ name: "apilift", description: "Use logged-in apps and discover missing actions with Apilift", source: "./plugins/apilift", category: "development" }] });
   if (env.APILIFT_AGENT_HOME || env.APILIFT_AGENT_NO_ACTIVATE === "1") return { ready: false, version: expected, detail: `Plugin staged at ${plugin}; activation is disabled` };
   const initial = active(agent2, expected);
   if (!initial.known) return { ready: false, version: expected, detail: initial.detail, checkFailed: true };
@@ -35642,7 +35854,7 @@ var init_analytics = __esm({
 });
 
 // src/analytics.ts
-import { randomUUID as randomUUID10 } from "node:crypto";
+import { randomUUID as randomUUID11 } from "node:crypto";
 var EVENT, EU_HOST, CliAnalytics;
 var init_analytics2 = __esm({
   "src/analytics.ts"() {
@@ -35699,6 +35911,7 @@ var init_analytics2 = __esm({
           this.updateIdentity(await createCliApi(site, this.fetcher, installation.token).call("me"), now);
           return "ok";
         } catch (error62) {
+          if (error62 instanceof ApiClientError && error62.status === 401 && error62.response?.error?.code === "unauthenticated") return "unauthorized";
           if (error62 instanceof ApiClientError && error62.response?.error?.code === "installation-revoked") {
             this.state.db.exec("DELETE FROM cli_analytics_queue; DELETE FROM cli_analytics_identity");
             return "revoked";
@@ -35712,7 +35925,7 @@ var init_analytics2 = __esm({
         if (!installation) return;
         const identity2 = this.identity();
         if (identity2 && !identity2.enabled) return;
-        this.state.db.prepare("INSERT INTO cli_analytics_queue (id,account_id,event,properties_json,occurred_at) VALUES (?,?,?,?,?)").run(randomUUID10(), installation.accountId, event, JSON.stringify(scrubEventProperties(event, values)), (/* @__PURE__ */ new Date()).toISOString());
+        this.state.db.prepare("INSERT INTO cli_analytics_queue (id,account_id,event,properties_json,occurred_at) VALUES (?,?,?,?,?)").run(randomUUID11(), installation.accountId, event, JSON.stringify(scrubEventProperties(event, values)), (/* @__PURE__ */ new Date()).toISOString());
         this.state.db.exec("DELETE FROM cli_analytics_queue WHERE id IN (SELECT id FROM cli_analytics_queue ORDER BY occurred_at DESC LIMIT -1 OFFSET 1000)");
       }
       async flush() {
@@ -35735,13 +35948,58 @@ var init_analytics2 = __esm({
   }
 });
 
+// src/usage/ownership.ts
+import { mkdirSync as mkdirSync11, chmodSync as chmodSync7, existsSync as existsSync6, readFileSync as readFileSync10, writeFileSync as writeFileSync10, renameSync as renameSync4, unlinkSync as unlinkSync4 } from "node:fs";
+import { join as join15 } from "node:path";
+import { DatabaseSync as DatabaseSync6 } from "node:sqlite";
+function readOwner(root) {
+  try {
+    const value = JSON.parse(readFileSync10(ownerFile(root), "utf8"));
+    return typeof value.id === "string" && Number.isInteger(value.pid) && value.pid > 0 && Number.isFinite(value.expiresAt) ? value : null;
+  } catch {
+    return null;
+  }
+}
+function collectorActive(root) {
+  const owner = readOwner(root), now = Date.now();
+  if (owner && owner.expiresAt > now && owner.expiresAt <= now + ownerLifetimeMs) {
+    try {
+      process.kill(owner.pid, 0);
+      return true;
+    } catch {
+    }
+  }
+  const file2 = join15(root, "usage", "collector-lock.sqlite");
+  if (!existsSync6(file2)) return false;
+  try {
+    const db = new DatabaseSync6(file2, { readOnly: true });
+    try {
+      db.exec("PRAGMA busy_timeout=0");
+      db.prepare("PRAGMA schema_version").get();
+      return false;
+    } finally {
+      db.close();
+    }
+  } catch {
+    return true;
+  }
+}
+var ownerLifetimeMs, ownerFile;
+var init_ownership = __esm({
+  "src/usage/ownership.ts"() {
+    "use strict";
+    ownerLifetimeMs = 6e4;
+    ownerFile = (root) => join15(root, "usage", "collector-owner.json");
+  }
+});
+
 // src/usage/process.ts
-import { existsSync as existsSync5 } from "node:fs";
+import { existsSync as existsSync7 } from "node:fs";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 function startCollector(env) {
   if (process.env.VITEST || env.VITEST || env.APILIFT_COLLECTOR_DISABLED === "1") return;
   const entry2 = fileURLToPath3(new URL("./apilift-collector.js", import.meta.url));
-  if (!existsSync5(entry2)) return;
+  if (!existsSync7(entry2) || collectorActive(dataRoot(env))) return;
   try {
     startBackground(entry2, env, () => {
     });
@@ -35751,6 +36009,8 @@ function startCollector(env) {
 var init_process2 = __esm({
   "src/usage/process.ts"() {
     "use strict";
+    init_ownership();
+    init_state();
     init_process();
   }
 });
@@ -36605,10 +36865,10 @@ var require_truncate = __commonJS({
   "../../node_modules/.pnpm/semver@7.8.5/node_modules/semver/functions/truncate.js"(exports, module) {
     "use strict";
     var parse5 = require_parse();
-    var constants = require_constants();
+    var constants2 = require_constants();
     var SemVer = require_semver();
     var truncate = (version2, truncation, options2) => {
-      if (!constants.RELEASE_TYPES.includes(truncation)) {
+      if (!constants2.RELEASE_TYPES.includes(truncation)) {
         return null;
       }
       const clonedVersion = cloneInputVersion(version2, options2);
@@ -37657,7 +37917,7 @@ var require_semver2 = __commonJS({
   "../../node_modules/.pnpm/semver@7.8.5/node_modules/semver/index.js"(exports, module) {
     "use strict";
     var internalRe = require_re();
-    var constants = require_constants();
+    var constants2 = require_constants();
     var SemVer = require_semver();
     var identifiers = require_identifiers();
     var parse5 = require_parse();
@@ -37741,8 +38001,8 @@ var require_semver2 = __commonJS({
       re: internalRe.re,
       src: internalRe.src,
       tokens: internalRe.t,
-      SEMVER_SPEC_VERSION: constants.SEMVER_SPEC_VERSION,
-      RELEASE_TYPES: constants.RELEASE_TYPES,
+      SEMVER_SPEC_VERSION: constants2.SEMVER_SPEC_VERSION,
+      RELEASE_TYPES: constants2.RELEASE_TYPES,
       compareIdentifiers: identifiers.compareIdentifiers,
       rcompareIdentifiers: identifiers.rcompareIdentifiers
     };
@@ -37790,11 +38050,11 @@ var init_compat2 = __esm({
 });
 
 // src/native-host/registration.ts
-import { createHash as createHash6, randomUUID as randomUUID11 } from "node:crypto";
+import { createHash as createHash6, randomUUID as randomUUID12 } from "node:crypto";
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync9 } from "node:fs";
+import { mkdirSync as mkdirSync12, writeFileSync as writeFileSync11 } from "node:fs";
 import { homedir as homedir3, platform as platform2 } from "node:os";
-import { dirname as dirname8, isAbsolute as isAbsolute4, join as join14, resolve as resolve4 } from "node:path";
+import { dirname as dirname9, isAbsolute as isAbsolute2, join as join16, resolve as resolve8 } from "node:path";
 import { chmod as chmod2, mkdir, readFile, rename as rename2, writeFile, copyFile, rm, stat } from "node:fs/promises";
 function batchLiteral(value) {
   if (/["\r\n\0]/u.test(value)) throw new Error("Native host launcher values contain unsupported control characters");
@@ -37815,7 +38075,7 @@ ${Object.entries(environment).map(([key, value]) => `${key}=${posixQuote(value)}
 }
 function readWindowsHostValues(hostName, run2 = execFileSync2) {
   if (!/^[a-z0-9_]+(?:\.[a-z0-9_]+)*$/u.test(hostName)) throw new Error("Invalid native host name");
-  const script = `$ErrorActionPreference='Stop'; $results=@(); foreach($view in @('32','64')) {
+  const script2 = `$ErrorActionPreference='Stop'; $results=@(); foreach($view in @('32','64')) {
     $base=[Microsoft.Win32.RegistryKey]::OpenBaseKey([Microsoft.Win32.RegistryHive]::CurrentUser,[Microsoft.Win32.RegistryView]('Registry'+$view));
     try {
       $key=$base.OpenSubKey('Software\\Google\\Chrome\\NativeMessagingHosts\\${hostName}');
@@ -37828,7 +38088,7 @@ function readWindowsHostValues(hostName, run2 = execFileSync2) {
     } finally { $base.Dispose(); }
   }; ConvertTo-Json -InputObject @($results) -Compress`;
   try {
-    const output2 = run2("powershell.exe", ["-NoLogo", "-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")], { encoding: "utf8", timeout: 1e4, windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
+    const output2 = run2("powershell.exe", ["-NoLogo", "-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(script2, "utf16le").toString("base64")], { encoding: "utf8", timeout: 1e4, windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
     const values = JSON.parse(String(output2));
     if (!Array.isArray(values) || values.length !== 2) throw new Error("Invalid registry snapshot");
     return ["32", "64"].map((view) => {
@@ -37858,39 +38118,39 @@ function registerWindowsHost(hostName, manifest, owned, run2 = execFileSync2, wr
   if (write) for (const view of /* @__PURE__ */ new Set(["32", ...present])) run2("reg.exe", ["add", key, "/ve", "/t", "REG_SZ", "/d", manifest, "/f", `/reg:${view}`], options2);
 }
 function manifestDirectory(env = process.env, system = { platform: platform2(), home: homedir3() }) {
-  if (env.APILIFT_NATIVE_MESSAGING_DIR) return resolve4(env.APILIFT_NATIVE_MESSAGING_DIR);
+  if (env.APILIFT_NATIVE_MESSAGING_DIR) return resolve8(env.APILIFT_NATIVE_MESSAGING_DIR);
   const home = system.home;
-  if (system.platform === "darwin") return join14(home, "Library", "Application Support", "Google", "Chrome", "NativeMessagingHosts");
+  if (system.platform === "darwin") return join16(home, "Library", "Application Support", "Google", "Chrome", "NativeMessagingHosts");
   if (system.platform === "win32") throw new Error("Windows native-host registration needs a data-root manifest and HKCU registry entry");
-  return join14(absoluteEnv(env.CHROME_CONFIG_HOME) || absoluteEnv(env.XDG_CONFIG_HOME) || join14(home, ".config"), "google-chrome", "NativeMessagingHosts");
+  return join16(absoluteEnv(env.CHROME_CONFIG_HOME) || absoluteEnv(env.XDG_CONFIG_HOME) || join16(home, ".config"), "google-chrome", "NativeMessagingHosts");
 }
 async function registerNativeHost(options2) {
   const env = options2.env ?? process.env;
   const hostName = options2.hostName ?? "com.apilift.browser";
   if (!hostNames.has(hostName)) throw new Error("Unknown Apilift native host name");
   if (!validId.test(options2.extensionId)) throw new Error("Extension id must be 32 a\u2013p characters");
-  if (![options2.root, options2.hostScript, options2.nodePath ?? process.execPath].every(isAbsolute4)) throw new Error("Native host paths must be absolute");
+  if (![options2.root, options2.hostScript, options2.nodePath ?? process.execPath].every(isAbsolute2)) throw new Error("Native host paths must be absolute");
   const siteUrl2 = options2.siteUrl ? new URL(options2.siteUrl) : null;
   if (siteUrl2 && (!["http:", "https:"].includes(siteUrl2.protocol) || siteUrl2.origin !== options2.siteUrl)) throw new Error("Native host site URL must be an http(s) origin");
-  const root = resolve4(options2.root), hostScript = resolve4(options2.hostScript), nodePath = resolve4(options2.nodePath ?? process.execPath);
-  const nativeRoot = join14(root, "native-host");
-  const manifestRoot = env.APILIFT_NATIVE_MESSAGING_DIR ? resolve4(env.APILIFT_NATIVE_MESSAGING_DIR) : platform2() === "win32" ? nativeRoot : manifestDirectory(env);
-  const launcher = join14(nativeRoot, platform2() === "win32" ? "launcher.cmd" : "launcher.sh");
-  const manifest = join14(manifestRoot, `${hostName}.json`);
+  const root = resolve8(options2.root), hostScript = resolve8(options2.hostScript), nodePath = resolve8(options2.nodePath ?? process.execPath);
+  const nativeRoot = join16(root, "native-host");
+  const manifestRoot = env.APILIFT_NATIVE_MESSAGING_DIR ? resolve8(env.APILIFT_NATIVE_MESSAGING_DIR) : platform2() === "win32" ? nativeRoot : manifestDirectory(env);
+  const launcher = join16(nativeRoot, platform2() === "win32" ? "launcher.cmd" : "launcher.sh");
+  const manifest = join16(manifestRoot, `${hostName}.json`);
   const manifests = [manifest];
   if (platform2() === "linux" && !env.APILIFT_NATIVE_MESSAGING_DIR) {
     for (const browser of ["google-chrome-beta", "google-chrome-unstable", "chromium"]) {
-      const profile = join14(dirname8(dirname8(manifestRoot)), browser);
-      if (await stat(profile).then((value) => value.isDirectory()).catch(() => false)) manifests.push(join14(profile, "NativeMessagingHosts", `${hostName}.json`));
+      const profile = join16(dirname9(dirname9(manifestRoot)), browser);
+      if (await stat(profile).then((value) => value.isDirectory()).catch(() => false)) manifests.push(join16(profile, "NativeMessagingHosts", `${hostName}.json`));
     }
   }
-  const receiptPath = join14(nativeRoot, "registration.json");
+  const receiptPath = join16(nativeRoot, "registration.json");
   const registryBackup = options2.allowReplaceUnowned ? (view, value) => {
-    const directory = join14(nativeRoot, "backup");
-    mkdirSync10(directory, { recursive: true, mode: 448 });
-    const path2 = join14(directory, `${hostName}-registry-${view}-${fingerprint(value)}.json`);
+    const directory = join16(nativeRoot, "backup");
+    mkdirSync12(directory, { recursive: true, mode: 448 });
+    const path2 = join16(directory, `${hostName}-registry-${view}-${fingerprint(value)}.json`);
     try {
-      writeFileSync9(path2, JSON.stringify({ hostName, view, query: value }), { flag: "wx", mode: 384 });
+      writeFileSync11(path2, JSON.stringify({ hostName, view, query: value }), { flag: "wx", mode: 384 });
     } catch (error62) {
       if (error62.code !== "EEXIST") throw error62;
     }
@@ -37900,8 +38160,8 @@ async function registerNativeHost(options2) {
     const bytes = await readFile(path2).catch(() => null);
     if (!bytes || fingerprint(bytes) === previous[path2]) return;
     if (!options2.allowReplaceUnowned) throw new Error(`Native host registration is not owned by Apilift: ${path2}`);
-    await mkdir(join14(nativeRoot, "backup"), { recursive: true, mode: 448 });
-    await copyFile(path2, join14(nativeRoot, "backup", `${fingerprint(bytes)}-${Date.now()}`));
+    await mkdir(join16(nativeRoot, "backup"), { recursive: true, mode: 448 });
+    await copyFile(path2, join16(nativeRoot, "backup", `${fingerprint(bytes)}-${Date.now()}`));
   };
   await guard(launcher);
   for (const path2 of manifests) await guard(path2);
@@ -37914,7 +38174,7 @@ async function registerNativeHost(options2) {
   const launcherText = nativeLauncher({ root, hostName, nodePath, hostScript, manifestRoot, site: siteUrl2?.origin }, platform2() === "win32");
   const manifestText = JSON.stringify({ name: hostName, description: "Apilift browser bridge", path: launcher, type: "stdio", allowed_origins: [`chrome-extension://${options2.extensionId}/`] }, null, 2) + "\n";
   const atomicWrite = async (path2, bytes, mode) => {
-    const temp = join14(dirname8(path2), `.${hostName}-${randomUUID11()}.tmp`);
+    const temp = join16(dirname9(path2), `.${hostName}-${randomUUID12()}.tmp`);
     try {
       await writeFile(temp, bytes, { mode, flag: "wx" });
       await chmod2(temp, mode);
@@ -37925,7 +38185,7 @@ async function registerNativeHost(options2) {
   };
   await atomicWrite(launcher, launcherText, platform2() === "win32" ? 384 : 448);
   for (const path2 of manifests) {
-    await mkdir(dirname8(path2), { recursive: true, mode: 448 });
+    await mkdir(dirname9(path2), { recursive: true, mode: 448 });
     await atomicWrite(path2, manifestText, 384);
   }
   const receipt = { ...previous, [launcher]: fingerprint(launcherText), ...Object.fromEntries(manifests.map((path2) => [path2, fingerprint(manifestText)])) };
@@ -37941,26 +38201,26 @@ var init_registration = __esm({
     hostNames = /* @__PURE__ */ new Set(["com.apilift.browser", "com.apilift.browser.dev"]);
     validId = /^[a-p]{32}$/;
     posixQuote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
-    absoluteEnv = (value) => value && isAbsolute4(value) ? value : void 0;
+    absoluteEnv = (value) => value && isAbsolute2(value) ? value : void 0;
   }
 });
 
 // src/update.ts
 import { fileURLToPath as fileURLToPath4 } from "node:url";
-import { dirname as dirname9, join as join15, resolve as resolve5, sep, isAbsolute as isAbsolute5 } from "node:path";
-import { mkdirSync as mkdirSync11, realpathSync as realpathSync2, writeFileSync as writeFileSync10, readFileSync as readFileSync10 } from "node:fs";
-import { DatabaseSync as DatabaseSync6 } from "node:sqlite";
-function globalPackage(script, prefix) {
+import { dirname as dirname10, join as join17, resolve as resolve9, sep, isAbsolute as isAbsolute3 } from "node:path";
+import { mkdirSync as mkdirSync13, realpathSync as realpathSync2, writeFileSync as writeFileSync12, readFileSync as readFileSync11 } from "node:fs";
+import { DatabaseSync as DatabaseSync7 } from "node:sqlite";
+function globalPackage(script2, prefix) {
   const canonical = (path2) => {
     try {
       return realpathSync2(path2);
     } catch {
-      return resolve5(path2);
+      return resolve9(path2);
     }
   };
-  const normalized = canonical(script).toLowerCase();
+  const normalized = canonical(script2).toLowerCase();
   const base2 = canonical(prefix).toLowerCase();
-  return [join15(base2, "lib", "node_modules", "@apilift", "cli"), join15(base2, "node_modules", "@apilift", "cli")].some((path2) => normalized.startsWith(`${path2}${sep}`));
+  return [join17(base2, "lib", "node_modules", "@apilift", "cli"), join17(base2, "node_modules", "@apilift", "cli")].some((path2) => normalized.startsWith(`${path2}${sep}`));
 }
 async function pnpmInstallations(runner, env) {
   const listed = await runner("pnpm", ["list", "-g", "@apilift/cli", "--depth", "0", "--json"], 1e4, env).catch(() => null);
@@ -37970,34 +38230,34 @@ async function pnpmInstallations(runner, env) {
     if (!Array.isArray(groups)) return [];
     return groups.flatMap((group) => {
       const pkg = group?.dependencies?.["@apilift/cli"];
-      return pkg && typeof pkg.path === "string" && isAbsolute5(pkg.path) && typeof pkg.version === "string" ? [{ entrypoint: join15(pkg.path, "dist", "apilift.js"), version: pkg.version }] : [];
+      return pkg && typeof pkg.path === "string" && isAbsolute3(pkg.path) && typeof pkg.version === "string" ? [{ entrypoint: join17(pkg.path, "dist", "apilift.js"), version: pkg.version }] : [];
     });
   } catch {
     return [];
   }
 }
-async function installationManager(script, runner, env) {
+async function installationManager(script2, runner, env) {
   const prefix = await runner("npm", ["prefix", "-g"], 1e4, env).catch(() => null);
-  if (prefix?.exitCode === 0 && globalPackage(script, prefix.stdout.trim())) return { manager: "npm", entrypoint: script };
+  if (prefix?.exitCode === 0 && globalPackage(script2, prefix.stdout.trim())) return { manager: "npm", entrypoint: script2 };
   const canonical = (path2) => {
     try {
       return realpathSync2(path2);
     } catch {
-      return resolve5(path2);
+      return resolve9(path2);
     }
   };
-  const selected = (await pnpmInstallations(runner, env)).find((candidate2) => canonical(candidate2.entrypoint) === canonical(script));
+  const selected = (await pnpmInstallations(runner, env)).find((candidate2) => canonical(candidate2.entrypoint) === canonical(script2));
   return selected ? { manager: "pnpm", entrypoint: selected.entrypoint } : null;
 }
 async function maybeAutoUpdate(options2) {
   if (options2.env.APILIFT_AUTO_UPDATE === "0" || options2.env.CI || options2.env.APILIFT_DEV_PLUGIN_ROOT || options2.env.APILIFT_UPDATE_REEXEC === "1") return null;
-  const current = options2.current || CURRENT, runner = options2.runner || run, script = options2.script || fileURLToPath4(import.meta.url);
+  const current = options2.current || CURRENT, runner = options2.runner || run, script2 = options2.script || fileURLToPath4(import.meta.url);
   if (!shouldCheckUpdate(options2.state, current)) return null;
-  const installation = await installationManager(script, runner, options2.env);
-  if (!installation) return null;
   markUpdateChecked(options2.state, current);
+  const installation = await installationManager(script2, runner, options2.env);
+  if (!installation) return null;
   let updatedEntry = installation.entrypoint;
-  const update = await updateCli({ ...options2, current, runner, script, manual: false }, (entrypoint) => {
+  const update = await updateCli({ ...options2, current, runner, script: script2, manual: false }, (entrypoint) => {
     updatedEntry = entrypoint;
   });
   if (update.stderr.startsWith("update-incomplete")) return update;
@@ -38006,9 +38266,9 @@ async function maybeAutoUpdate(options2) {
   return { stdout: result3.stdout, stderr: result3.stderr, exitCode: result3.exitCode ?? 1, dispatched: false };
 }
 function lock(root) {
-  const dir = join15(root, "locks");
-  mkdirSync11(dir, { recursive: true, mode: 448 });
-  const db = new DatabaseSync6(join15(dir, "self-update.sqlite"));
+  const dir = join17(root, "locks");
+  mkdirSync13(dir, { recursive: true, mode: 448 });
+  const db = new DatabaseSync7(join17(dir, "self-update.sqlite"));
   db.exec("PRAGMA busy_timeout=0");
   try {
     db.exec("BEGIN EXCLUSIVE");
@@ -38041,8 +38301,8 @@ async function updateCli(options2, onInstalled) {
   if (compatible2(current, latest)) return message("The installed CLI and its required local components are up to date.\nNo installation changes were made. Continue the app work you were working on.\n");
   if (!options2.manual && (options2.env.APILIFT_AUTO_UPDATE === "0" || options2.env.CI || options2.env.APILIFT_DEV_PLUGIN_ROOT || options2.env.npm_execpath?.includes("npx"))) return message("", 5, `client-upgrade-required \u2014 Install Apilift ${latest} through the supported package installation, then retry.
 `);
-  const script = options2.script || fileURLToPath4(import.meta.url);
-  const installation = await installationManager(script, runner, options2.env);
+  const script2 = options2.script || fileURLToPath4(import.meta.url);
+  const installation = await installationManager(script2, runner, options2.env);
   if (!installation) return message("", 5, `client-upgrade-required \u2014 This CLI is not a global npm or pnpm installation. Install Apilift ${latest} through your installation method, then retry.
 `);
   const { manager } = installation;
@@ -38055,19 +38315,19 @@ async function updateCli(options2, onInstalled) {
 `);
     options2.state.db.exec("CREATE TABLE IF NOT EXISTS cli_update_state (id INTEGER PRIMARY KEY CHECK(id=1), version TEXT NOT NULL, updated_at TEXT NOT NULL)");
     options2.state.db.prepare("INSERT INTO cli_update_state (id,version,updated_at) VALUES (1,?,?) ON CONFLICT(id) DO UPDATE SET version=excluded.version,updated_at=excluded.updated_at").run(latest, (/* @__PURE__ */ new Date()).toISOString());
-    const nativeRoot = join15(options2.root, "native-host");
-    mkdirSync11(nativeRoot, { recursive: true, mode: 448 });
-    writeFileSync10(join15(nativeRoot, "restart-required.json"), `${JSON.stringify({ version: latest })}
+    const nativeRoot = join17(options2.root, "native-host");
+    mkdirSync13(nativeRoot, { recursive: true, mode: 448 });
+    writeFileSync12(join17(nativeRoot, "restart-required.json"), `${JSON.stringify({ version: latest })}
 `, { mode: 384 });
     try {
       if (manager === "pnpm") {
         const candidates = (await pnpmInstallations(runner, options2.env)).filter((candidate2) => candidate2.version === latest);
         if (candidates.length !== 1) throw new Error("Updated pnpm installation is ambiguous or unavailable");
         entrypoint = candidates[0].entrypoint;
-        const pkg = JSON.parse(readFileSync10(join15(dirname9(entrypoint), "..", "package.json"), "utf8"));
+        const pkg = JSON.parse(readFileSync11(join17(dirname10(entrypoint), "..", "package.json"), "utf8"));
         if (pkg.name !== "@apilift/cli" || pkg.version !== latest) throw new Error("Updated pnpm package could not be verified");
       }
-      await registerNativeHost({ root: options2.root, hostScript: join15(dirname9(entrypoint), "apilift-native-host.js"), extensionId: options2.env.APILIFT_DEV_EXTENSION_ID || STORE_EXTENSION_ID, hostName: options2.env.APILIFT_NATIVE_HOST_NAME, siteUrl: options2.site, env: options2.env });
+      await registerNativeHost({ root: options2.root, hostScript: join17(dirname10(entrypoint), "apilift-native-host.js"), extensionId: options2.env.APILIFT_DEV_EXTENSION_ID || STORE_EXTENSION_ID, hostName: options2.env.APILIFT_NATIVE_HOST_NAME, siteUrl: options2.site, env: options2.env });
       for (const agent2 of linkedAgents) {
         if (!ensureAgentPlugin(agent2, options2.env).ready) throw new Error("Updated agent plugin activation is unverified");
       }
@@ -38108,9 +38368,9 @@ var init_update = __esm({
 });
 
 // src/setup-check.ts
-import { createHash as createHash7, randomUUID as randomUUID12 } from "node:crypto";
-import { existsSync as existsSync6, readFileSync as readFileSync11, realpathSync as realpathSync3, writeFileSync as writeFileSync11 } from "node:fs";
-import { dirname as dirname10, join as join16 } from "node:path";
+import { createHash as createHash7, randomUUID as randomUUID13 } from "node:crypto";
+import { existsSync as existsSync8, readFileSync as readFileSync12, realpathSync as realpathSync3, writeFileSync as writeFileSync13 } from "node:fs";
+import { dirname as dirname11, join as join18 } from "node:path";
 async function setupCheckBody(client, scopeId, value) {
   if (typeof value.body === "string") return Buffer.byteLength(value.body, "utf8") <= maxCheckBodyBytes ? value.body : null;
   if (value.body != null) return null;
@@ -38125,30 +38385,30 @@ async function setupCheckBody(client, scopeId, value) {
   }
 }
 async function registerSetupHost(root, site, env) {
-  const script = realpathSync3(process.argv[1]);
-  const hostScript = join16(dirname10(script), "apilift-native-host.js");
-  if (!existsSync6(hostScript)) throw new Error("The native host binary is missing beside the Apilift CLI");
+  const script2 = realpathSync3(process.argv[1]);
+  const hostScript = join18(dirname11(script2), "apilift-native-host.js");
+  if (!existsSync8(hostScript)) throw new Error("The native host binary is missing beside the Apilift CLI");
   await registerNativeHost({ root, hostScript, extensionId: env.APILIFT_DEV_EXTENSION_ID || storeExtensionId, hostName: env.APILIFT_NATIVE_HOST_NAME, siteUrl: site, env });
 }
 function challengeFile(root, agent2) {
-  return join16(root, `setup-check-${agent2}.json`);
+  return join18(root, `setup-check-${agent2}.json`);
 }
 function setupChallenge(root, agent2, site) {
   const file2 = challengeFile(root, agent2);
   try {
-    const saved = JSON.parse(readFileSync11(file2, "utf8"));
+    const saved = JSON.parse(readFileSync12(file2, "utf8"));
     if (new URL(saved.url).origin === site && Number.isFinite(saved.createdAt) && Date.now() - saved.createdAt < 10 * 6e4) return saved;
   } catch {
   }
-  const challenge = { url: `${site}/setup-check?challenge=${randomUUID12()}`, createdAt: Date.now() };
-  writeFileSync11(file2, JSON.stringify(challenge), { mode: 384 });
+  const challenge = { url: `${site}/setup-check?challenge=${randomUUID13()}`, createdAt: Date.now() };
+  writeFileSync13(file2, JSON.stringify(challenge), { mode: 384 });
   return challenge;
 }
 async function setupBridge(root) {
   const startedAt = Date.now();
-  const script = join16(dirname10(realpathSync3(process.argv[1])), "apilift-capture-server.js");
-  const client = await ensureCaptureServer({ root, script, version: cliVersion });
-  if (!client.legacyBridge) await waitForBridge(root, cliVersion, Math.max(0, 9e4 - (Date.now() - startedAt)));
+  const script2 = join18(dirname11(realpathSync3(process.argv[1])), "apilift-capture-server.js");
+  const client = await ensureCaptureServer({ root, script: script2, version: cliVersion });
+  if (!client.legacyBridge) await waitForBridge(root, cliVersion, Math.max(0, 9e4 - (Date.now() - startedAt)), () => client.bridgeDemand(), client.receipt.version);
   return client;
 }
 async function setupReadiness(api, waitForReport, timeoutMs = 1e4) {
@@ -38156,7 +38416,7 @@ async function setupReadiness(api, waitForReport, timeoutMs = 1e4) {
   const signal = AbortSignal.timeout(timeoutMs);
   let readiness2 = await api.call("updateReadiness", { body: {}, ...waitForReport ? { signal } : {} });
   while (waitForReport && (!readiness2.machine.nativeHostReady || !readiness2.machine.extensionReady) && Date.now() < deadline) {
-    await new Promise((resolve6) => setTimeout(resolve6, Math.min(250, Math.max(0, deadline - Date.now()))));
+    await new Promise((resolve10) => setTimeout(resolve10, Math.min(250, Math.max(0, deadline - Date.now()))));
     if (signal.aborted || Date.now() >= deadline) break;
     try {
       readiness2 = await api.call("updateReadiness", { body: {}, signal });
@@ -38179,14 +38439,14 @@ async function verifySetupCheck(root, challenge) {
     do {
       candidates = (await client.candidates(inspect.id)).candidates;
       if (candidates.length) break;
-      await new Promise((resolve6) => setTimeout(resolve6, 200));
+      await new Promise((resolve10) => setTimeout(resolve10, 200));
     } while (Date.now() < deadline);
   } finally {
     await client.closeScope(inspect.id);
   }
   if (candidates.length !== 1) return { ok: false, reason: candidates.length ? "More than one exact check tab matched" : "The extension did not report the exact check tab within 10 seconds" };
   const execute = await client.openScope({ kind: "execute", tabSelector: candidates[0].selector, ...scopeInput });
-  const id2 = randomUUID12();
+  const id2 = randomUUID13();
   try {
     await client.enqueueJob(execute.id, { job: { id: id2, kind: "replay", effect: "read", method: "GET", url: challenge.url, headers: {}, pageOrigin, allowedRequestOrigin: pageOrigin, timeoutMs: 2e4 } });
     const deadline = Date.now() + 3e4;
@@ -38205,7 +38465,7 @@ async function verifySetupCheck(root, challenge) {
         return body.includes("Apilift can reach this tab") ? { ok: true } : { ok: false, reason: "The safe check response did not contain the expected page marker" };
       }
       if (held.status === "uncertain") return { ok: false, reason: "Chrome reported an uncertain check outcome" };
-      await new Promise((resolve6) => setTimeout(resolve6, 200));
+      await new Promise((resolve10) => setTimeout(resolve10, 200));
     } while (Date.now() < deadline);
     return { ok: false, reason: `Chrome did not return the safe check result within 30 seconds (job ${lastStatus})` };
   } finally {
@@ -38457,8 +38717,8 @@ Fix the local Chrome registration and retry:
       const agentState = agent2 ? readiness2.agents[agent2] : void 0;
       const plugin = agent2 ? inspectAgentPlugin(agent2, env) : null;
       const checks = [
-        `Native host: ${readiness2.machine.nativeHostReady ? "recorded ready" : "not verified"}.`,
-        `Chrome extension: ${readiness2.machine.extensionReady ? "recorded ready" : "not verified"}.`,
+        `Native host: ${readiness2.machine.nativeHostReady ? "previously connected; current availability unverified" : "not verified"}.`,
+        `Chrome extension: ${readiness2.machine.extensionReady ? "previously connected; current installation and availability unverified" : "not verified"}.`,
         `Agent setup skill: ${agentState?.skillsReady && plugin?.ready ? "active" : plugin?.detail ?? "stable agent identity needed"}.`,
         `Agent browser control: ${agentState?.browserReady ? "recorded ready" : "not verified"}.`,
         `Stored setup verification: ${agentState?.verified && plugin?.ready ? "verified" : "incomplete"}.`