@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/generators/post-generation-install.js

@@ -0,0 +1,3308 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.postGenerationInstallFeaturePrerequisite = postGenerationInstallFeaturePrerequisite;
+exports.postGenerationInstallMarkerPath = postGenerationInstallMarkerPath;
+exports.capturePostGenerationInstallState = capturePostGenerationInstallState;
+exports.postGenerationInstallPnpmInvocation = postGenerationInstallPnpmInvocation;
+exports.assertPostGenerationInstallWorkspaceAvailable = assertPostGenerationInstallWorkspaceAvailable;
+exports.resumePendingPostGenerationInstall = resumePendingPostGenerationInstall;
+exports.createPostGenerationInstallCallback = createPostGenerationInstallCallback;
+const canonical_json_1 = require("@empire-builder-kit/runtime/canonical-json");
+const node_child_process_1 = require("node:child_process");
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const semver_1 = require("semver");
+const yaml_1 = require("yaml");
+const pnpm_toolchain_authority_js_1 = require("../supply-chain/pnpm-toolchain-authority.js");
+const INSTALL_RECORD_KIND = 'ebk-post-generation-install';
+const INSTALL_RECORD_SCHEMA_VERSION = 4;
+const INSTALL_RECORD_DIRECTORY = '.ebk/agent/post-generation-installs';
+const INSTALL_LEASE_PATH = '.ebk/agent/post-generation-install-lease.json';
+const INSTALL_BATCH_CONFLICT_PATH = '.ebk/agent/post-generation-install-batch-conflict.json';
+const INSTALL_COMPLETION_PATH = '.ebk/agent/post-generation-install-completion.json';
+const INSTALL_ACTIVE_PATH = '.ebk/agent/post-generation-install-active.json';
+const POST_GENERATION_STORE_DIRECTORY = '.ebk/cache/pnpm-store';
+const INSTALL_BATCH_CONFLICT_KIND = 'ebk-post-generation-install-batch-conflict';
+const INSTALL_LEASE_KIND = 'ebk-post-generation-install-lease';
+const INSTALL_LEASE_SCHEMA_VERSION = 1;
+const INSTALL_RESERVATION_KIND = 'ebk-post-generation-install-reservation';
+const INSTALL_RESERVATION_SCHEMA_VERSION = 1;
+const INSTALL_ACTIVE_KIND = 'ebk-post-generation-install-active';
+const INSTALL_ACTIVE_SCHEMA_VERSION = 1;
+const LOCKFILE_PATH = 'pnpm-lock.yaml';
+const MAX_NON_FROZEN_ATTEMPTS = 2;
+const MAX_FROZEN_ATTEMPTS = 2;
+const MAX_RECORD_BYTES = 256 * 1024;
+const MAX_LEASE_BYTES = 16 * 1024;
+const INSTALL_TIMEOUT_MS = 10 * 60 * 1000;
+const DIGEST_PATTERN = /^sha256:[a-f0-9]{64}$/;
+const GENERATION_PATTERN = /^[0-9a-f]{8}-[0-9a-f-]{27,}$/;
+const ALLOWED_NPM_CREDENTIAL_ENVIRONMENT = new Set([
+    'CODEARTIFACT_AUTH_TOKEN',
+    'GITHUB_TOKEN',
+    'NODE_AUTH_TOKEN',
+    'NPM_TOKEN',
+]);
+const PHASE_CONTROLLED_PNPM_SETTINGS = new Set([
+    'blockexoticsubdeps',
+    'cachedir',
+    'configdir',
+    'dev',
+    'deployallfiles',
+    'dir',
+    'enablemodulesdir',
+    'enableglobalvirtualstore',
+    'enableprepostscripts',
+    'filter',
+    'filterprod',
+    'fixlockfile',
+    'frozenlockfile',
+    'gitbranchlockfile',
+    'gitbranchlockfilepattern',
+    'global',
+    'globaldir',
+    'globalvirtualstoredir',
+    'include',
+    'injectworkspacepackages',
+    'ignoredepscripts',
+    'ignorepnpmfile',
+    'ignorescripts',
+    'ignoreworkspace',
+    'ignoredbuiltdependencies',
+    'ignoredoptionaldependencies',
+    'lockfile',
+    'lockfiledir',
+    'lockfileonly',
+    'mergegitbranchlockfiles',
+    'modulesdir',
+    'neverbuiltdependencies',
+    'nodelinker',
+    'nodeoptions',
+    'nolockfile',
+    'omit',
+    'only',
+    'optimisticrepeatinstall',
+    'optional',
+    'packagelock',
+    'packagelockonly',
+    'packageimportmethod',
+    'preferfrozenlockfile',
+    'production',
+    'recursiveinstall',
+    'resolutiononly',
+    'scriptshell',
+    'sharedworkspacelockfile',
+    'sideeffectscache',
+    'sideeffectscachereadonly',
+    'shrinkwrap',
+    'shrinkwraponly',
+    'symlink',
+    'storedir',
+    'statedir',
+    'usestoreserver',
+    'uselockfile',
+    'verifystoreintegrity',
+    'virtualstoredir',
+    'virtualstoredirmaxlength',
+]);
+const UNSUPPORTED_EXECUTABLE_PNPM_SETTINGS = new Set([
+    'configdependencies',
+    'globalpnpmfile',
+    'onlybuiltdependenciesfile',
+    'pnpmfile',
+]);
+const ALLOWED_STRUCTURED_PNPM_SETTINGS = new Set([
+    'allowbuilds',
+    'alloweddeprecatedversions',
+    'autoinstallpeers',
+    'catalog',
+    'catalogmode',
+    'catalogs',
+    'cleanupunusedcatalogs',
+    'dedupedirectdeps',
+    'dedupeinjecteddeps',
+    'enginestrict',
+    'excludelinksfromlockfile',
+    'ignoredbuiltdependencies',
+    'linkworkspacepackages',
+    'minimumreleaseage',
+    'minimumreleaseageexclude',
+    'neverbuiltdependencies',
+    'onlybuiltdependencies',
+    'overrides',
+    'packageextensions',
+    'packages',
+    'patcheddependencies',
+    'peerdependencyrules',
+    'preferworkspacepackages',
+    'resolutionmode',
+    'resolvepeersfromworkspaceroot',
+    'saveworkspaceprotocol',
+    'strictdepbuilds',
+    'strictpeerdependencies',
+    'supportedarchitectures',
+    'trustpolicy',
+    'trustpolicyexclude',
+    'trustpolicyignoreafter',
+]);
+const ALLOWED_NPMRC_RESOLUTION_SETTINGS = new Set([
+    'alwaysauth',
+    'autoinstallpeers',
+    'cafile',
+    'certfile',
+    'dedupeinjecteddeps',
+    'dedupepeerdependents',
+    'fetchretries',
+    'fetchretryfactor',
+    'fetchretrymaxtimeout',
+    'fetchretrymintimeout',
+    'fetchtimeout',
+    'httpsproxy',
+    'keyfile',
+    'linkworkspacepackages',
+    'maxsockets',
+    'minimumreleaseage',
+    'minimumreleaseageexclude',
+    'networkconcurrency',
+    'noproxy',
+    'preferworkspacepackages',
+    'proxy',
+    'registry',
+    'resolutionmode',
+    'resolvepeersfromworkspaceroot',
+    'saveworkspaceprotocol',
+    'strictpeerdependencies',
+    'strictssl',
+    'trustpolicy',
+    'trustpolicyexclude',
+    'trustpolicyignoreafter',
+]);
+class SimulatedProtocolCrash extends Error {
+    constructor(checkpoint) {
+        super(`Simulated post-generation install crash ${checkpoint}.`);
+        this.name = 'SimulatedProtocolCrash';
+    }
+}
+function sha256(contents) {
+    return `sha256:${(0, node_crypto_1.createHash)('sha256').update(contents).digest('hex')}`;
+}
+function literalCompare(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function normalizedWorkspacePath(path, label) {
+    if (path.length === 0 ||
+        path.startsWith('/') ||
+        path.includes('\\') ||
+        path.includes('\0') ||
+        path.split('/').some((part) => part === '' || part === '.' || part === '..')) {
+        throw new Error(`${label} must be a canonical workspace-relative path.`);
+    }
+    return path;
+}
+function postGenerationInstallFeaturePrerequisite(path, selectedFeature) {
+    normalizedWorkspacePath(path, 'Feature-registry prerequisite path');
+    if (!/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/.test(selectedFeature)) {
+        throw new Error('Post-generation install prerequisite feature must be lowercase kebab-case.');
+    }
+    return { kind: 'registered-slice-feature', path, selectedFeature };
+}
+function semanticPrerequisiteKey(prerequisite) {
+    return `${prerequisite.kind}:${prerequisite.path}:${prerequisite.selectedFeature}`;
+}
+function assertOperation(operation) {
+    if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(operation.key)) {
+        throw new Error('Post-generation install key must be lowercase kebab-case.');
+    }
+    if (!/^[a-z0-9]+(?::[a-z0-9-]+)+$/.test(operation.id)) {
+        throw new Error('Post-generation install operation id is invalid.');
+    }
+    normalizedWorkspacePath(operation.sourceRoot, 'Install source root');
+    if (operation.resumeArguments.length === 0 ||
+        operation.resumeArguments.length > 32 ||
+        operation.resumeArguments.some((argument) => typeof argument !== 'string' ||
+            argument.length === 0 ||
+            argument.length > 16 * 1024)) {
+        throw new Error('Post-generation resume arguments are invalid or unbounded.');
+    }
+    if (Buffer.byteLength((0, canonical_json_1.canonicalJson)(operation.request)) > 48 * 1024) {
+        throw new Error('Post-generation install request exceeds 48 KiB.');
+    }
+    const prerequisites = operation.semanticPrerequisites ?? [];
+    if (prerequisites.length > 16) {
+        throw new Error('Post-generation install has too many semantic prerequisites.');
+    }
+    let previous = '';
+    for (const prerequisite of prerequisites) {
+        if (!isRecord(prerequisite) ||
+            prerequisite.kind !== 'registered-slice-feature' ||
+            Object.keys(prerequisite).sort().join(',') !== 'kind,path,selectedFeature') {
+            throw new Error('Post-generation install semantic prerequisite is invalid.');
+        }
+        postGenerationInstallFeaturePrerequisite(prerequisite.path, prerequisite.selectedFeature);
+        const key = semanticPrerequisiteKey(prerequisite);
+        if (key <= previous) {
+            throw new Error('Post-generation install semantic prerequisites must be unique and sorted.');
+        }
+        previous = key;
+    }
+}
+function operationFingerprint(operation) {
+    return sha256((0, canonical_json_1.canonicalJson)(operation));
+}
+function expectedFingerprint(operation) {
+    return operationFingerprint({
+        generator: operation.generator,
+        id: operation.id,
+        request: operation.request,
+        resumeArguments: operation.resumeArguments,
+        semanticPrerequisites: operation.semanticPrerequisites ?? [],
+        sourceRoot: operation.sourceRoot,
+    });
+}
+function postGenerationInstallMarkerPath(key) {
+    if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(key)) {
+        throw new Error('Post-generation install key must be lowercase kebab-case.');
+    }
+    return `${INSTALL_RECORD_DIRECTORY}/${key}.json`;
+}
+function workspaceRealRoot(workspaceRoot) {
+    const absolute = (0, node_path_1.resolve)(workspaceRoot);
+    const metadata = (0, node_fs_1.lstatSync)(absolute);
+    if (!metadata.isDirectory() || metadata.isSymbolicLink()) {
+        throw new Error('Post-generation install workspace must be a real directory.');
+    }
+    return (0, node_fs_1.realpathSync)(absolute);
+}
+function assertSafeExistingDirectoryChain(workspaceRoot, relativeDirectory) {
+    // Threat boundary: this rejects aliases that exist when the operation is
+    // planned. It does not claim kernel-level swap resistance against a
+    // same-user process that can replace path components afterward.
+    const root = workspaceRealRoot(workspaceRoot);
+    let current = root;
+    for (const part of normalizedWorkspacePath(relativeDirectory, 'Post-generation install directory').split('/')) {
+        current = (0, node_path_1.join)(current, part);
+        let metadata;
+        try {
+            metadata = (0, node_fs_1.lstatSync)(current);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return;
+            throw error;
+        }
+        if (!metadata.isDirectory() || metadata.isSymbolicLink()) {
+            throw new Error(`Post-generation install directory is not a real directory at ${relativeDirectory}.`);
+        }
+        const target = (0, node_fs_1.realpathSync)(current);
+        const fromRoot = (0, node_path_1.relative)(root, target);
+        if (target !== current ||
+            fromRoot === '..' ||
+            fromRoot.startsWith(`..${node_path_1.sep}`)) {
+            throw new Error(`Post-generation install directory escapes the workspace at ${relativeDirectory}.`);
+        }
+    }
+}
+function ensureSafeDirectory(workspaceRoot, relativeDirectory) {
+    // Recovery repeats the pre-existing-alias checks while materializing the
+    // private state path; the same-user post-check swap limitation still applies.
+    const root = workspaceRealRoot(workspaceRoot);
+    let current = root;
+    for (const part of normalizedWorkspacePath(relativeDirectory, 'Post-generation install directory').split('/')) {
+        current = (0, node_path_1.join)(current, part);
+        try {
+            (0, node_fs_1.mkdirSync)(current, { mode: 0o700 });
+            (0, node_fs_1.chmodSync)(current, 0o700);
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+        }
+        const metadata = (0, node_fs_1.lstatSync)(current);
+        if (!metadata.isDirectory() || metadata.isSymbolicLink()) {
+            throw new Error(`Post-generation install directory is not a real directory at ${relativeDirectory}.`);
+        }
+        const target = (0, node_fs_1.realpathSync)(current);
+        const fromRoot = (0, node_path_1.relative)(root, target);
+        if (target !== current ||
+            fromRoot === '..' ||
+            fromRoot.startsWith(`..${node_path_1.sep}`)) {
+            throw new Error(`Post-generation install directory escapes the workspace at ${relativeDirectory}.`);
+        }
+    }
+    return current;
+}
+function confinedAbsolutePath(workspaceRoot, relativePath) {
+    const root = workspaceRealRoot(workspaceRoot);
+    const absolute = (0, node_path_1.resolve)(root, normalizedWorkspacePath(relativePath, 'Post-generation install path'));
+    const fromRoot = (0, node_path_1.relative)(root, absolute);
+    if (fromRoot === '' || fromRoot === '..' || fromRoot.startsWith(`..${node_path_1.sep}`)) {
+        throw new Error('Post-generation install path escapes the workspace.');
+    }
+    return absolute;
+}
+function assertSafeRegularFile(absolute, label) {
+    const metadata = (0, node_fs_1.lstatSync)(absolute);
+    if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.nlink !== 1) {
+        throw new Error(`${label} must be one regular, non-linked file.`);
+    }
+    if ((0, node_fs_1.realpathSync)(absolute) !== absolute) {
+        throw new Error(`${label} must not traverse an aliased path.`);
+    }
+}
+function writeExclusiveFile(absolute, contents) {
+    const noFollow = typeof node_fs_1.constants.O_NOFOLLOW === 'number' ? node_fs_1.constants.O_NOFOLLOW : 0;
+    const descriptor = (0, node_fs_1.openSync)(absolute, node_fs_1.constants.O_CREAT | node_fs_1.constants.O_EXCL | node_fs_1.constants.O_WRONLY | noFollow, 0o600);
+    try {
+        (0, node_fs_1.writeFileSync)(descriptor, contents, 'utf8');
+    }
+    finally {
+        (0, node_fs_1.closeSync)(descriptor);
+    }
+}
+function treeInstallAuthorityReader(tree) {
+    const mode = (path) => {
+        const absolute = (0, node_path_1.resolve)(tree.root, path);
+        try {
+            const observed = (0, node_fs_1.lstatSync)(absolute);
+            if (observed.isFile() && !observed.isSymbolicLink()) {
+                return observed.mode & 0o777;
+            }
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        return tree.read(path) === null ? null : 0o666 & ~process.umask();
+    };
+    return {
+        children: (path) => tree.children(path).sort(literalCompare),
+        kind(path) {
+            if (tree.read(path) !== null)
+                return 'file';
+            return tree.children(path).length > 0 ? 'directory' : 'missing';
+        },
+        mode,
+        read: (path) => tree.read(path),
+    };
+}
+function diskInstallAuthorityReader(workspaceRoot) {
+    const root = workspaceRealRoot(workspaceRoot);
+    const absolute = (path) => {
+        if (path === '')
+            return root;
+        const candidate = (0, node_path_1.resolve)(root, normalizedWorkspacePath(path, 'Install-authority path'));
+        const fromRoot = (0, node_path_1.relative)(root, candidate);
+        if (fromRoot === '..' || fromRoot.startsWith(`..${node_path_1.sep}`)) {
+            throw new Error('Install-authority path escapes the workspace.');
+        }
+        return candidate;
+    };
+    const metadata = (path) => {
+        const candidate = absolute(path);
+        try {
+            const observed = (0, node_fs_1.lstatSync)(candidate);
+            if (observed.isSymbolicLink()) {
+                throw new Error(`Install-authority path is a symlink at ${path}.`);
+            }
+            if ((0, node_fs_1.realpathSync)(candidate) !== candidate) {
+                throw new Error(`Install-authority path is aliased at ${path}.`);
+            }
+            return observed;
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return undefined;
+            throw error;
+        }
+    };
+    return {
+        children(path) {
+            const observed = metadata(path);
+            if (!observed)
+                return [];
+            if (!observed.isDirectory())
+                return [];
+            return (0, node_fs_1.readdirSync)(absolute(path), { withFileTypes: true })
+                .map((entry) => {
+                if (entry.isSymbolicLink()) {
+                    throw new Error(`Install-authority directory contains a symlink at ${node_path_1.posix.join(path, entry.name)}.`);
+                }
+                return entry.name;
+            })
+                .sort(literalCompare);
+        },
+        kind(path) {
+            const observed = metadata(path);
+            if (!observed)
+                return 'missing';
+            if (observed.isDirectory())
+                return 'directory';
+            if (observed.isFile() && observed.nlink === 1)
+                return 'file';
+            throw new Error(`Install-authority path must be one regular file or real directory at ${path}.`);
+        },
+        mode(path) {
+            const observed = metadata(path);
+            if (!observed || !observed.isFile() || observed.nlink !== 1)
+                return null;
+            return observed.mode & 0o777;
+        },
+        read(path) {
+            const observed = metadata(path);
+            if (!observed)
+                return null;
+            if (observed.isDirectory())
+                return null;
+            if (!observed.isFile() || observed.nlink !== 1) {
+                throw new Error(`Install-authority path must be one regular file at ${path}.`);
+            }
+            return (0, node_fs_1.readFileSync)(absolute(path));
+        },
+    };
+}
+function parseBoundedJson(source, label) {
+    try {
+        return JSON.parse(source.toString('utf8'));
+    }
+    catch {
+        throw new Error(`${label} must be valid JSON.`);
+    }
+}
+function parseBoundedYaml(source, label) {
+    try {
+        const document = (0, yaml_1.parseDocument)(source.toString('utf8'), {
+            prettyErrors: false,
+            uniqueKeys: true,
+        });
+        if (document.errors.length > 0)
+            throw document.errors[0];
+        const pending = [document.contents];
+        const visited = new Set();
+        while (pending.length > 0) {
+            const node = pending.pop();
+            if (!node || typeof node !== 'object' || visited.has(node))
+                continue;
+            visited.add(node);
+            if ((0, yaml_1.isAlias)(node) ||
+                ('anchor' in node &&
+                    typeof node.anchor === 'string')) {
+                throw new Error(`${label} cannot contain YAML aliases or anchors.`);
+            }
+            if ((0, yaml_1.isPair)(node)) {
+                if ((0, yaml_1.isScalar)(node.key) && node.key.value === '<<') {
+                    throw new Error(`${label} cannot contain YAML merge keys.`);
+                }
+                pending.push(node.key, node.value);
+                continue;
+            }
+            if ('items' in node && Array.isArray(node.items)) {
+                pending.push(...node.items);
+            }
+        }
+        return document.toJS({ maxAliasCount: 0 });
+    }
+    catch {
+        throw new Error(`${label} must be valid, explicit YAML without aliases, anchors, or merge keys.`);
+    }
+}
+function workspacePatternSegments(pattern) {
+    let normalized = pattern.trim();
+    if (normalized.startsWith('./'))
+        normalized = normalized.slice(2);
+    while (normalized.endsWith('/'))
+        normalized = normalized.slice(0, -1);
+    if (normalized.length === 0 ||
+        normalized.startsWith('/') ||
+        normalized.includes('\\') ||
+        ['[', ']', '{', '}', '(', ')'].some((character) => normalized.includes(character)) ||
+        normalized.split('/').some((part) => part === '' || part === '..')) {
+        throw new Error(`Post-generation install does not support unsafe pnpm workspace pattern ${pattern}.`);
+    }
+    return normalized.split('/');
+}
+function workspaceSegmentMatches(pattern, candidate) {
+    if (pattern === '**')
+        return true;
+    const expression = pattern
+        .split('')
+        .map((character) => {
+        if (character === '*')
+            return '[^/]*';
+        if (character === '?')
+            return '[^/]';
+        return character.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    })
+        .join('');
+    return new RegExp(`^${expression}$`, 'u').test(candidate);
+}
+function workspaceDirectoriesForPattern(reader, pattern) {
+    const segments = workspacePatternSegments(pattern);
+    const results = new Set();
+    const visited = new Set();
+    const walk = (directory, index) => {
+        const visitKey = `${index}:${directory}`;
+        if (visited.has(visitKey))
+            return;
+        visited.add(visitKey);
+        if (visited.size > pnpm_toolchain_authority_js_1.PNPM_TOOLCHAIN_AUTHORITY_MAX_ENTRIES * 8) {
+            throw new Error('Post-generation install workspace-pattern traversal is unbounded.');
+        }
+        if (index === segments.length) {
+            results.add(directory);
+            return;
+        }
+        const segment = segments[index];
+        if (segment === '**') {
+            walk(directory, index + 1);
+            for (const child of reader.children(directory)) {
+                if (['.ebk', '.git', 'node_modules'].includes(child))
+                    continue;
+                const path = directory ? `${directory}/${child}` : child;
+                if (reader.kind(path) === 'directory')
+                    walk(path, index);
+            }
+            return;
+        }
+        for (const child of reader.children(directory)) {
+            if (['.ebk', '.git', 'node_modules'].includes(child) ||
+                !workspaceSegmentMatches(segment, child)) {
+                continue;
+            }
+            const path = directory ? `${directory}/${child}` : child;
+            if (reader.kind(path) === 'directory')
+                walk(path, index + 1);
+        }
+    };
+    walk('', 0);
+    return results;
+}
+function exactWorkspaceManifestPaths(reader, workspace) {
+    const patterns = isRecord(workspace) ? workspace.packages : undefined;
+    if (!Array.isArray(patterns) ||
+        patterns.length > 256 ||
+        patterns.some((pattern) => typeof pattern !== 'string')) {
+        throw new Error('Post-generation install requires bounded pnpm workspace package patterns.');
+    }
+    const included = new Set();
+    const excluded = new Set();
+    for (const pattern of patterns) {
+        const negative = pattern.startsWith('!');
+        const directories = workspaceDirectoriesForPattern(reader, negative ? pattern.slice(1) : pattern);
+        for (const directory of directories) {
+            if (!directory)
+                continue;
+            if (reader.kind(`${directory}/.npmrc`) !== 'missing') {
+                throw new Error(`Post-generation install does not accept package-local .npmrc at ${directory}/.npmrc.`);
+            }
+            for (const alternate of ['package.json5', 'package.yaml']) {
+                const alternatePath = `${directory}/${alternate}`;
+                if (reader.kind(alternatePath) !== 'missing') {
+                    throw new Error(`Post-generation install accepts only package.json workspace manifests; found ${alternatePath}.`);
+                }
+            }
+            const manifest = `${directory}/package.json`;
+            if (reader.kind(manifest) !== 'file')
+                continue;
+            (negative ? excluded : included).add(manifest);
+        }
+    }
+    return [...included]
+        .filter((path) => !excluded.has(path))
+        .sort(literalCompare);
+}
+function normalizedLiteralReferencedPath(baseDirectory, reference, label) {
+    if (reference.includes('%') ||
+        reference.startsWith('~') ||
+        /^[A-Za-z]:/u.test(reference)) {
+        throw new Error(`${label} contains an ambiguous encoded or home-relative path.`);
+    }
+    const normalized = node_path_1.posix.normalize(node_path_1.posix.join(baseDirectory, reference));
+    if (node_path_1.posix.isAbsolute(reference) ||
+        reference.includes('\\') ||
+        normalized === '.' ||
+        normalized === '.ebk' ||
+        normalized.startsWith('.ebk/') ||
+        normalized === '..' ||
+        normalized.startsWith('../') ||
+        normalized.includes('/../')) {
+        throw new Error(`${label} must remain inside the workspace.`);
+    }
+    return normalizedWorkspacePath(normalized, label);
+}
+function dependencyReferences(manifest, baseDirectory) {
+    if (!isRecord(manifest))
+        return [];
+    const references = new Set();
+    for (const key of [
+        'dependencies',
+        'devDependencies',
+        'optionalDependencies',
+        'peerDependencies',
+    ]) {
+        const dependencies = manifest[key];
+        if (!isRecord(dependencies))
+            continue;
+        for (const specification of Object.values(dependencies)) {
+            if (typeof specification !== 'string')
+                continue;
+            assertSupportedDependencySpecification(specification, `Dependency specification in ${key}`);
+            const prefix = specification.startsWith('file:')
+                ? 'file:'
+                : specification.startsWith('link:')
+                    ? 'link:'
+                    : undefined;
+            if (!prefix)
+                continue;
+            references.add(normalizedLiteralReferencedPath(baseDirectory, specification.slice(prefix.length), 'Local dependency input'));
+        }
+    }
+    return [...references].sort(literalCompare);
+}
+function collectNestedLocalReferences(value, baseDirectory, references) {
+    if (typeof value === 'string') {
+        assertSupportedDependencySpecification(value, 'Nested pnpm resolution specification');
+        const prefix = value.startsWith('file:')
+            ? 'file:'
+            : value.startsWith('link:')
+                ? 'link:'
+                : undefined;
+        if (prefix) {
+            references.add(normalizedLiteralReferencedPath(baseDirectory, value.slice(prefix.length), 'Local pnpm configuration input'));
+        }
+        return;
+    }
+    if (Array.isArray(value)) {
+        for (const nested of value) {
+            collectNestedLocalReferences(nested, baseDirectory, references);
+        }
+        return;
+    }
+    if (isRecord(value)) {
+        for (const nested of Object.values(value)) {
+            collectNestedLocalReferences(nested, baseDirectory, references);
+        }
+    }
+}
+function assertNoExternalDependencyAuthority(specification, label) {
+    if (/^(?:bitbucket:|git(?:\+|:|@)|github:|gitlab:|https?:|ssh:)/iu.test(specification) ||
+        /\.git(?:#|$)/iu.test(specification)) {
+        throw new Error(`${label} cannot use VCS, URL, or other external executable resolution authority.`);
+    }
+}
+function assertSupportedDependencySpecification(specification, label) {
+    assertNoExternalDependencyAuthority(specification, label);
+    if (/^(?:file:|link:)/u.test(specification)) {
+        return;
+    }
+    if (specification.startsWith('workspace:')) {
+        const selector = specification.slice('workspace:'.length);
+        if (!['*', '^', '~'].includes(selector) &&
+            (0, semver_1.validRange)(selector, { loose: false }) === null) {
+            throw new Error(`${label} cannot use path or alias forms of the workspace protocol.`);
+        }
+        return;
+    }
+    if (/^catalog:[a-z0-9._-]*$/iu.test(specification))
+        return;
+    if (specification.startsWith('npm:')) {
+        const alias = specification.slice('npm:'.length);
+        if (!/^(?:@[^/\s]+\/[^@\s]+|[^@/\s]+)@[^\s/]+$/u.test(alias)) {
+            throw new Error(`${label} contains an unsupported npm alias.`);
+        }
+        return;
+    }
+    if (/^(?:\.{1,2}[\\/]|~[\\/]|[\\/]|[A-Za-z]:[\\/])/u.test(specification) ||
+        /^[A-Za-z]:/u.test(specification) ||
+        specification.includes('\\') ||
+        /\.(?:tar|tar\.gz|tgz)(?:#.*)?$/iu.test(specification) ||
+        specification.includes('/')) {
+        throw new Error(`${label} must use a registry, workspace, catalog, or explicitly bound file/link specification.`);
+    }
+}
+function localReferencesInLockValue(value, baseDirectory, label) {
+    const references = new Set();
+    for (const match of value.matchAll(/(?:^|[@(])(?:file|link):([^),\s'"}]+)/gu)) {
+        references.add(normalizedLiteralReferencedPath(baseDirectory, match[1] ?? '', `${label} local target`));
+    }
+    return [...references].sort(literalCompare);
+}
+function importerBaseDirectory(importer) {
+    if (importer === '.')
+        return '';
+    return normalizedLiteralReferencedPath('', importer, 'Lockfile importer path');
+}
+function manifestDependencySpecifications(manifest, label) {
+    const specifications = new Map();
+    if (!isRecord(manifest))
+        return specifications;
+    for (const section of [
+        'dependencies',
+        'devDependencies',
+        'optionalDependencies',
+    ]) {
+        const dependencies = manifest[section];
+        if (!isRecord(dependencies))
+            continue;
+        for (const [name, specification] of Object.entries(dependencies)) {
+            if (typeof specification !== 'string') {
+                throw new Error(`Post-generation install ${label} dependency ${name} must use one string specification.`);
+            }
+            assertSupportedDependencySpecification(specification, `${label} dependency ${name}`);
+            const previous = specifications.get(name);
+            if (previous !== undefined && previous !== specification) {
+                throw new Error(`Post-generation install ${label} dependency ${name} has ambiguous specifications.`);
+            }
+            specifications.set(name, specification);
+        }
+    }
+    return specifications;
+}
+function assertWorkspaceDependencyTargets(reader, manifestPaths) {
+    const workspaceTargets = new Map();
+    const manifests = new Map();
+    for (const manifestPath of manifestPaths) {
+        const source = reader.read(manifestPath);
+        if (source === null) {
+            throw new Error(`Install-authority manifest vanished at ${manifestPath}.`);
+        }
+        const manifest = parseBoundedJson(source, `Install-authority manifest ${manifestPath}`);
+        manifests.set(manifestPath, manifest);
+        if (manifestPath === 'package.json' || !isRecord(manifest))
+            continue;
+        if (typeof manifest.name !== 'string' || manifest.name.length === 0) {
+            continue;
+        }
+        const targets = workspaceTargets.get(manifest.name) ?? [];
+        targets.push(manifestPath);
+        workspaceTargets.set(manifest.name, targets);
+    }
+    for (const [manifestPath, manifest] of manifests) {
+        for (const [dependency, specification] of manifestDependencySpecifications(manifest, manifestPath)) {
+            if (!specification.startsWith('workspace:'))
+                continue;
+            const targets = workspaceTargets.get(dependency) ?? [];
+            if (targets.length !== 1) {
+                throw new Error(`Post-generation install workspace dependency ${dependency} in ${manifestPath} must resolve to exactly one declared workspace package.`);
+            }
+        }
+    }
+}
+function assertLockfileImporterSemantics(lockfile, reader, workspaceManifestPaths, references, workspaceLockEntries, workspaceResolutionEntries) {
+    const importers = lockfile.importers;
+    if (importers === undefined)
+        return;
+    if (!isRecord(importers)) {
+        throw new Error('Post-generation install lockfile importers are invalid.');
+    }
+    for (const [importer, importerValue] of Object.entries(importers)) {
+        const baseDirectory = importerBaseDirectory(importer);
+        const manifestPath = baseDirectory
+            ? `${baseDirectory}/package.json`
+            : 'package.json';
+        const manifestSource = reader.read(manifestPath);
+        if (manifestSource === null || reader.kind(manifestPath) !== 'file') {
+            throw new Error(`Post-generation install lockfile importer ${importer} has no bound package.json.`);
+        }
+        const manifest = parseBoundedJson(manifestSource, `Post-generation install lockfile importer ${manifestPath}`);
+        const manifestSpecifications = manifestDependencySpecifications(manifest, manifestPath);
+        if (!isRecord(importerValue)) {
+            throw new Error(`Post-generation install lockfile importer ${importer} is invalid.`);
+        }
+        for (const section of [
+            'dependencies',
+            'devDependencies',
+            'optionalDependencies',
+        ]) {
+            const dependencies = importerValue[section];
+            if (dependencies === undefined)
+                continue;
+            if (!isRecord(dependencies)) {
+                throw new Error(`Post-generation install lockfile importer ${importer} ${section} is invalid.`);
+            }
+            for (const [name, lockEntry] of Object.entries(dependencies)) {
+                if (!isRecord(lockEntry) || typeof lockEntry.specifier !== 'string') {
+                    throw new Error(`Post-generation install lockfile importer ${importer} dependency ${name} is invalid.`);
+                }
+                const manifestSpecification = manifestSpecifications.get(name);
+                if (manifestSpecification === undefined ||
+                    lockEntry.specifier !== manifestSpecification) {
+                    throw new Error(`Post-generation install lockfile importer ${importer} dependency ${name} does not match its manifest authority.`);
+                }
+                const resolvedReferences = new Set();
+                if (typeof lockEntry.version === 'string') {
+                    for (const reference of localReferencesInLockValue(lockEntry.version, baseDirectory, `Lockfile importer ${importer} dependency ${name} version`)) {
+                        resolvedReferences.add(reference);
+                    }
+                }
+                if (isRecord(lockEntry.resolution)) {
+                    if (typeof lockEntry.resolution.directory === 'string') {
+                        resolvedReferences.add(normalizedLiteralReferencedPath('', lockEntry.resolution.directory, `Lockfile importer ${importer} dependency ${name} directory`));
+                    }
+                }
+                if (/^(?:file:|link:)/u.test(manifestSpecification)) {
+                    const expected = normalizedLiteralReferencedPath(baseDirectory, manifestSpecification.slice(manifestSpecification.indexOf(':') + 1), `Manifest dependency ${name}`);
+                    if (resolvedReferences.size === 0 ||
+                        [...resolvedReferences].some((reference) => reference !== expected)) {
+                        throw new Error(`Post-generation install lockfile redirects local dependency ${name} away from its manifest target.`);
+                    }
+                    for (const reference of resolvedReferences) {
+                        references.add(reference);
+                    }
+                    continue;
+                }
+                if (manifestSpecification.startsWith('workspace:')) {
+                    if (Object.prototype.hasOwnProperty.call(lockEntry, 'version') &&
+                        typeof lockEntry.version !== 'string') {
+                        throw new Error(`Post-generation install lockfile workspace dependency ${name} version is invalid.`);
+                    }
+                    if (lockEntry.resolution !== undefined &&
+                        !isRecord(lockEntry.resolution)) {
+                        throw new Error(`Post-generation install lockfile workspace dependency ${name} resolution is invalid.`);
+                    }
+                    if (isRecord(lockEntry.resolution) &&
+                        Object.prototype.hasOwnProperty.call(lockEntry.resolution, 'directory') &&
+                        typeof lockEntry.resolution.directory !== 'string') {
+                        throw new Error(`Post-generation install lockfile workspace dependency ${name} resolution directory is invalid.`);
+                    }
+                    if (resolvedReferences.size !== 1) {
+                        throw new Error(`Post-generation install lockfile workspace dependency ${name} lacks one exact local target.`);
+                    }
+                    const [target] = resolvedReferences;
+                    const targetManifestPath = `${target}/package.json`;
+                    if (!workspaceManifestPaths.has(targetManifestPath)) {
+                        throw new Error(`Post-generation install lockfile workspace dependency ${name} targets an undeclared workspace package.`);
+                    }
+                    const targetManifestSource = reader.read(targetManifestPath);
+                    const targetManifest = targetManifestSource
+                        ? parseBoundedJson(targetManifestSource, `Post-generation install workspace target ${targetManifestPath}`)
+                        : undefined;
+                    if (!isRecord(targetManifest) || targetManifest.name !== name) {
+                        throw new Error(`Post-generation install lockfile workspace dependency ${name} targets a different package identity.`);
+                    }
+                    // Workspace links bind the already-digested target manifest. They
+                    // are not file/tarball inputs and must not recursively absorb source,
+                    // generated ownership, or local agent state into install authority.
+                    workspaceLockEntries.add(lockEntry);
+                    if (isRecord(lockEntry.resolution)) {
+                        workspaceResolutionEntries.add(lockEntry.resolution);
+                    }
+                    continue;
+                }
+                if (resolvedReferences.size > 0) {
+                    throw new Error(`Post-generation install lockfile redirects registry dependency ${name} to local input.`);
+                }
+            }
+        }
+    }
+}
+function lockfileLocalReferences(source, reader, workspaceManifestPaths = new Set()) {
+    const lockfile = parseBoundedYaml(source, 'Post-generation install pnpm-lock.yaml');
+    if (!isRecord(lockfile) ||
+        !['9', '9.0', 9].includes(lockfile.lockfileVersion)) {
+        throw new Error('Post-generation install requires pnpm lockfile schema 9 authority.');
+    }
+    const references = new Set();
+    const workspaceLockEntries = new WeakSet();
+    const workspaceResolutionEntries = new WeakSet();
+    if (reader) {
+        assertLockfileImporterSemantics(lockfile, reader, workspaceManifestPaths, references, workspaceLockEntries, workspaceResolutionEntries);
+    }
+    const inspectString = (value, label, baseDirectory, suppressLocalReference = false) => {
+        if (/(?:^|[@(])(?:bitbucket:|git(?:\+|:)|github:|gitlab:|ssh:)/iu.test(value) ||
+            /https?:\/\/[^\s'"}]*\.git(?:[#?\s'"}]|$)/iu.test(value)) {
+            throw new Error('Post-generation install lockfile contains unsupported VCS or external executable authority.');
+        }
+        if (!suppressLocalReference) {
+            for (const reference of localReferencesInLockValue(value, baseDirectory, label)) {
+                references.add(reference);
+            }
+        }
+    };
+    const visit = (value, label, baseDirectory, suppressLocalReference = false) => {
+        if (typeof value === 'string') {
+            inspectString(value, label, baseDirectory, suppressLocalReference);
+            return;
+        }
+        if (Array.isArray(value)) {
+            value.forEach((nested, index) => visit(nested, `${label}[${index}]`, baseDirectory, suppressLocalReference));
+            return;
+        }
+        if (!isRecord(value))
+            return;
+        for (const [key, nested] of Object.entries(value)) {
+            const normalizedKey = key.toLowerCase().replace(/[^a-z0-9]/gu, '');
+            const resolutionMetadata = /(?:^|\.)resolution$/u.test(label);
+            const suppressNestedLocalReference = typeof nested === 'string' &&
+                ((key === 'version' && workspaceLockEntries.has(value)) ||
+                    (key === 'directory' && workspaceResolutionEntries.has(value)));
+            inspectString(key, `${label} key`, baseDirectory);
+            if (resolutionMetadata &&
+                (['commit', 'gitcommittish', 'gitrange', 'repo', 'repository'].includes(normalizedKey) ||
+                    (normalizedKey === 'type' &&
+                        typeof nested === 'string' &&
+                        /^(?:git|ssh|vcs)$/iu.test(nested)))) {
+                throw new Error('Post-generation install lockfile contains unsupported VCS authority fields.');
+            }
+            if (resolutionMetadata &&
+                normalizedKey === 'directory' &&
+                !suppressNestedLocalReference) {
+                if (typeof nested !== 'string') {
+                    throw new Error('Post-generation install lockfile local directory target is invalid.');
+                }
+                references.add(normalizedLiteralReferencedPath('', nested, 'Lockfile local directory target'));
+            }
+            if (normalizedKey === 'specifier' && typeof nested === 'string') {
+                assertSupportedDependencySpecification(nested, 'Lockfile dependency specification');
+            }
+            if (label === 'pnpm-lock.yaml' && key === 'importers') {
+                if (!isRecord(nested)) {
+                    throw new Error('Post-generation install lockfile importers are invalid.');
+                }
+                for (const [importer, importerValue] of Object.entries(nested)) {
+                    visit(importerValue, `${label}.importers.${importer}`, importerBaseDirectory(importer));
+                }
+                continue;
+            }
+            visit(nested, `${label}.${key}`, baseDirectory, suppressNestedLocalReference);
+        }
+    };
+    visit(lockfile, 'pnpm-lock.yaml', '');
+    return [...references].sort(literalCompare);
+}
+function assertNoExoticLockfileAuthority(source, reader, workspaceManifestPaths) {
+    lockfileLocalReferences(source, reader, workspaceManifestPaths);
+}
+function assertNoInjectedWorkspaceDependencies(manifest, label) {
+    if (!isRecord(manifest) || !isRecord(manifest.dependenciesMeta))
+        return;
+    for (const [dependency, metadata] of Object.entries(manifest.dependenciesMeta)) {
+        if (isRecord(metadata) && metadata.injected === true) {
+            throw new Error(`Post-generation install does not accept injected workspace dependency ${dependency} in ${label}.`);
+        }
+    }
+}
+function npmrcResolutionSemantics(source) {
+    const semantics = {};
+    const referencedFiles = new Set();
+    const secretKey = /(?:^|:)(?:_auth|_authtoken|_password|username|password|token|otp|email)$/iu;
+    for (const sourceLine of source.toString('utf8').split(/\r?\n/u)) {
+        const line = sourceLine.trim();
+        if (!line || line.startsWith('#') || line.startsWith(';'))
+            continue;
+        const separator = line.indexOf('=');
+        if (separator <= 0) {
+            throw new Error('Post-generation install .npmrc must use bounded key=value semantics.');
+        }
+        const key = line.slice(0, separator).trim().toLowerCase();
+        let value = line.slice(separator + 1).trim();
+        if (/\$\{[^}]+\}/u.test(key)) {
+            throw new Error('Post-generation install .npmrc keys cannot interpolate ambient environment variables.');
+        }
+        if (secretKey.test(key)) {
+            const credential = /^\$\{([A-Z][A-Z0-9_]*)\}$/u.exec(value);
+            if (!credential) {
+                throw new Error('Post-generation install .npmrc credentials must use one explicit credential environment reference.');
+            }
+            const environmentName = credential[1] ?? '';
+            if (!ALLOWED_NPM_CREDENTIAL_ENVIRONMENT.has(environmentName)) {
+                throw new Error('Post-generation install .npmrc credentials may interpolate only the explicit credential environment allowlist.');
+            }
+            // Only the allowlisted placeholder shape and normalized registry/auth
+            // target enter the authority digest. Credential values never do.
+            semantics[key] = `credential-environment:${environmentName}`;
+            continue;
+        }
+        if (/^(?:globalconfig|userconfig)$/u.test(key)) {
+            throw new Error('Post-generation install .npmrc cannot redirect user or global configuration.');
+        }
+        if (/\$\{[^}]+\}/u.test(value)) {
+            throw new Error('Post-generation install non-secret .npmrc resolution semantics cannot interpolate ambient environment variables.');
+        }
+        const normalizedKey = key.replace(/[^a-z0-9]/gu, '');
+        if (UNSUPPORTED_EXECUTABLE_PNPM_SETTINGS.has(normalizedKey)) {
+            throw new Error(`Post-generation install does not accept executable or externally loaded pnpm setting ${key}.`);
+        }
+        if (PHASE_CONTROLLED_PNPM_SETTINGS.has(normalizedKey)) {
+            throw new Error(`Post-generation install controls pnpm ${key} per protocol phase; .npmrc cannot override it.`);
+        }
+        if (!ALLOWED_NPMRC_RESOLUTION_SETTINGS.has(normalizedKey) &&
+            !key.endsWith(':registry') &&
+            !/(?:^|:)always-auth$/u.test(key)) {
+            throw new Error(`Post-generation install .npmrc setting ${key} is outside the explicit resolution-setting allowlist.`);
+        }
+        if (/^(?:cafile|certfile|keyfile|pnpmfile)$/u.test(key) && value) {
+            referencedFiles.add(value);
+        }
+        try {
+            const url = new URL(value);
+            url.username = '';
+            url.password = '';
+            for (const parameter of [...url.searchParams.keys()]) {
+                if (/(?:auth|key|password|secret|token)/iu.test(parameter)) {
+                    url.searchParams.delete(parameter);
+                }
+            }
+            value = url.toString();
+        }
+        catch {
+            // Non-URL npm configuration is retained only in the canonical digest.
+        }
+        semantics[key] = value;
+    }
+    return {
+        referencedFiles: [...referencedFiles].sort(literalCompare),
+        semantics,
+    };
+}
+function assertPhaseControlledPnpmSettings(value, label) {
+    if (!isRecord(value))
+        return;
+    for (const key of Object.keys(value)) {
+        const normalizedKey = key.toLowerCase().replace(/[^a-z0-9]/gu, '');
+        if (key === 'storeDir' &&
+            normalizedKey === 'storedir' &&
+            label === 'pnpm-workspace.yaml settings' &&
+            value[key] === POST_GENERATION_STORE_DIRECTORY) {
+            continue;
+        }
+        if (PHASE_CONTROLLED_PNPM_SETTINGS.has(normalizedKey)) {
+            throw new Error(`Post-generation install controls pnpm ${key} per protocol phase; ${label} cannot override it.`);
+        }
+    }
+}
+function assertRetainedPnpmStore(value) {
+    if (!isRecord(value) ||
+        !Object.prototype.hasOwnProperty.call(value, 'storeDir') ||
+        value.storeDir !== POST_GENERATION_STORE_DIRECTORY) {
+        throw new Error(`Post-generation install requires pnpm storeDir ${POST_GENERATION_STORE_DIRECTORY}.`);
+    }
+}
+function assertSupportedPnpmSettings(value, label) {
+    if (!isRecord(value))
+        return;
+    for (const key of Object.keys(value)) {
+        const normalizedKey = key.toLowerCase().replace(/[^a-z0-9]/gu, '');
+        if (UNSUPPORTED_EXECUTABLE_PNPM_SETTINGS.has(normalizedKey)) {
+            throw new Error(`Post-generation install does not accept executable or externally loaded pnpm setting ${key} in ${label}.`);
+        }
+        if (!PHASE_CONTROLLED_PNPM_SETTINGS.has(normalizedKey) &&
+            !ALLOWED_STRUCTURED_PNPM_SETTINGS.has(normalizedKey)) {
+            throw new Error(`Post-generation install pnpm setting ${key} in ${label} is outside the explicit declarative allowlist.`);
+        }
+    }
+}
+function assertNoAmbientInterpolation(value, label) {
+    if (typeof value === 'string') {
+        if (/\$\{[^}]+\}/u.test(value)) {
+            throw new Error(`Post-generation install ${label} cannot interpolate ambient environment variables.`);
+        }
+        return;
+    }
+    if (Array.isArray(value)) {
+        for (const nested of value)
+            assertNoAmbientInterpolation(nested, label);
+        return;
+    }
+    if (isRecord(value)) {
+        for (const [key, nested] of Object.entries(value)) {
+            if (/\$\{[^}]+\}/u.test(key)) {
+                throw new Error(`Post-generation install ${label} keys cannot interpolate ambient environment variables.`);
+            }
+            assertNoAmbientInterpolation(nested, label);
+        }
+    }
+}
+function buildInstallAuthority(reader) {
+    const entries = new Map();
+    let observedBytes = 0;
+    const addDigest = (kind, path, contents, mode = null) => {
+        const bytes = Buffer.byteLength(contents);
+        if (bytes > pnpm_toolchain_authority_js_1.PNPM_TOOLCHAIN_AUTHORITY_MAX_FILE_BYTES) {
+            throw new Error(`Install-authority input exceeds 8 MiB at ${path}.`);
+        }
+        observedBytes += bytes;
+        if (observedBytes > pnpm_toolchain_authority_js_1.PNPM_TOOLCHAIN_AUTHORITY_MAX_TOTAL_BYTES) {
+            throw new Error('Post-generation install authority exceeds 64 MiB.');
+        }
+        if (mode !== null &&
+            (!Number.isInteger(mode) || mode < 0 || mode > 0o777)) {
+            throw new Error(`Install-authority input has invalid mode at ${path}.`);
+        }
+        const entry = { digest: sha256(contents), kind, mode, path };
+        const key = `${kind}:${path}`;
+        const previous = entries.get(key);
+        if (previous && previous.digest !== entry.digest) {
+            throw new Error(`Install-authority input is ambiguous at ${path}.`);
+        }
+        entries.set(key, entry);
+        if (entries.size > pnpm_toolchain_authority_js_1.PNPM_TOOLCHAIN_AUTHORITY_MAX_ENTRIES) {
+            throw new Error('Post-generation install authority exceeds 4096 entries.');
+        }
+    };
+    const addFile = (kind, path) => {
+        normalizedWorkspacePath(path, 'Install-authority input');
+        const contents = reader.read(path);
+        if (contents === null || reader.kind(path) !== 'file') {
+            throw new Error(`Install-authority input is missing at ${path}.`);
+        }
+        const mode = reader.mode(path);
+        if (mode === null) {
+            throw new Error(`Install-authority input mode is missing at ${path}.`);
+        }
+        addDigest(kind, path, contents, mode);
+        return contents;
+    };
+    const rootManifestSource = addFile('root-manifest', 'package.json');
+    for (const alternate of ['package.json5', 'package.yaml']) {
+        if (reader.kind(alternate) !== 'missing') {
+            throw new Error(`Post-generation install accepts only package.json root manifests; found ${alternate}.`);
+        }
+    }
+    const rootManifest = parseBoundedJson(rootManifestSource, 'Post-generation install root package.json');
+    (0, pnpm_toolchain_authority_js_1.parsePnpmPackageManagerAuthority)(rootManifestSource.toString('utf8'));
+    const workspaceSource = addFile('workspace-config', 'pnpm-workspace.yaml');
+    const workspace = parseBoundedYaml(workspaceSource, 'Post-generation install pnpm-workspace.yaml');
+    assertPhaseControlledPnpmSettings(isRecord(rootManifest) ? rootManifest.pnpm : undefined, 'root package.json pnpm settings');
+    assertPhaseControlledPnpmSettings(workspace, 'pnpm-workspace.yaml settings');
+    assertNoAmbientInterpolation(isRecord(rootManifest) ? rootManifest.pnpm : undefined, 'root package.json pnpm settings');
+    assertNoAmbientInterpolation(workspace, 'pnpm-workspace.yaml settings');
+    assertSupportedPnpmSettings(isRecord(rootManifest) ? rootManifest.pnpm : undefined, 'root package.json pnpm settings');
+    assertSupportedPnpmSettings(workspace, 'pnpm-workspace.yaml settings');
+    assertRetainedPnpmStore(workspace);
+    const manifests = ['package.json'];
+    for (const manifestPath of exactWorkspaceManifestPaths(reader, workspace)) {
+        addFile('workspace-manifest', manifestPath);
+        manifests.push(manifestPath);
+    }
+    assertWorkspaceDependencyTargets(reader, manifests);
+    const localReferences = new Set();
+    const lockfileSource = reader.read(LOCKFILE_PATH);
+    if (lockfileSource === null || reader.kind(LOCKFILE_PATH) !== 'file') {
+        throw new Error('Install-authority lockfile is missing.');
+    }
+    for (const reference of lockfileLocalReferences(lockfileSource, reader, new Set(manifests))) {
+        localReferences.add(reference);
+    }
+    for (const manifestPath of manifests) {
+        const source = reader.read(manifestPath);
+        if (source === null) {
+            throw new Error(`Install-authority manifest vanished at ${manifestPath}.`);
+        }
+        const manifest = parseBoundedJson(source, `Install-authority manifest ${manifestPath}`);
+        assertNoInjectedWorkspaceDependencies(manifest, manifestPath);
+        for (const reference of dependencyReferences(manifest, node_path_1.posix.dirname(manifestPath) === '.' ? '' : node_path_1.posix.dirname(manifestPath))) {
+            localReferences.add(reference);
+        }
+        if (manifestPath === 'package.json' && isRecord(manifest)) {
+            if (isRecord(manifest.pnpm)) {
+                for (const key of [
+                    'catalog',
+                    'catalogs',
+                    'overrides',
+                    'packageExtensions',
+                ]) {
+                    collectNestedLocalReferences(manifest.pnpm[key], '', localReferences);
+                }
+            }
+            collectNestedLocalReferences(manifest.resolutions, '', localReferences);
+        }
+    }
+    if (isRecord(workspace)) {
+        for (const key of [
+            'catalog',
+            'catalogs',
+            'overrides',
+            'packageExtensions',
+        ]) {
+            collectNestedLocalReferences(workspace[key], '', localReferences);
+        }
+    }
+    for (const candidate of ['.pnpmfile.cjs', '.pnpmfile.mjs']) {
+        if (reader.kind(candidate) !== 'missing') {
+            throw new Error(`Post-generation install does not accept executable pnpm hooks at ${candidate}; use declarative, bound resolution configuration.`);
+        }
+    }
+    if (isRecord(workspace) && typeof workspace.pnpmfile === 'string') {
+        throw new Error('Post-generation install does not accept executable pnpmfile hooks in pnpm-workspace.yaml.');
+    }
+    const npmrcSource = reader.read('.npmrc');
+    if (npmrcSource !== null) {
+        const npmrc = npmrcResolutionSemantics(npmrcSource);
+        addDigest('npmrc-resolution', '.npmrc', (0, canonical_json_1.canonicalJson)(npmrc.semantics));
+        for (const referenced of npmrc.referencedFiles) {
+            const path = normalizedLiteralReferencedPath('', referenced, '.npmrc referenced input');
+            addFile('npmrc-input', path);
+        }
+    }
+    const patches = new Set();
+    const collectPatchValues = (value) => {
+        if (!isRecord(value))
+            return;
+        for (const patch of Object.values(value)) {
+            if (typeof patch === 'string')
+                patches.add(patch);
+            else if (isRecord(patch) && typeof patch.path === 'string') {
+                patches.add(patch.path);
+            }
+        }
+    };
+    if (isRecord(rootManifest) && isRecord(rootManifest.pnpm)) {
+        collectPatchValues(rootManifest.pnpm.patchedDependencies);
+    }
+    if (isRecord(workspace))
+        collectPatchValues(workspace.patchedDependencies);
+    for (const patch of [...patches].sort(literalCompare)) {
+        addFile('patch', normalizedLiteralReferencedPath('', patch, 'Referenced patch path'));
+    }
+    const localVisited = new Set();
+    const queuedLocalReferences = new Set(localReferences);
+    const pendingLocalReferences = [...localReferences].sort(literalCompare);
+    const enqueueLocalReference = (reference) => {
+        if (queuedLocalReferences.has(reference))
+            return;
+        queuedLocalReferences.add(reference);
+        pendingLocalReferences.push(reference);
+        if (pendingLocalReferences.length > pnpm_toolchain_authority_js_1.PNPM_TOOLCHAIN_AUTHORITY_MAX_ENTRIES) {
+            throw new Error('Local install-authority dependency graph is unbounded.');
+        }
+    };
+    const addLocalInput = (path, depth) => {
+        if (depth > 64 || localVisited.size > pnpm_toolchain_authority_js_1.PNPM_TOOLCHAIN_AUTHORITY_MAX_ENTRIES * 4) {
+            throw new Error('Local install-authority input traversal is unbounded.');
+        }
+        if (localVisited.has(path))
+            return;
+        localVisited.add(path);
+        const kind = reader.kind(path);
+        if (kind === 'missing') {
+            throw new Error(`Local install-authority input is missing at ${path}.`);
+        }
+        if (kind === 'file') {
+            addFile('local-input', path);
+            return;
+        }
+        if (depth === 0) {
+            for (const unsupported of ['.npmrc', 'package.json5', 'package.yaml']) {
+                if (reader.kind(`${path}/${unsupported}`) !== 'missing') {
+                    throw new Error(`Local install-authority input ${path} contains unsupported ${unsupported} authority.`);
+                }
+            }
+            const manifestPath = `${path}/package.json`;
+            const manifestSource = reader.read(manifestPath);
+            if (manifestSource !== null && reader.kind(manifestPath) === 'file') {
+                const manifest = parseBoundedJson(manifestSource, `Local install-authority manifest ${manifestPath}`);
+                assertNoInjectedWorkspaceDependencies(manifest, manifestPath);
+                for (const reference of dependencyReferences(manifest, path)) {
+                    enqueueLocalReference(reference);
+                }
+            }
+        }
+        for (const child of reader.children(path)) {
+            if (child === '.ebk') {
+                throw new Error(`Local install-authority input ${path || '.'} contains reserved .ebk state.`);
+            }
+            if (['.git', 'node_modules'].includes(child))
+                continue;
+            addLocalInput(`${path}/${child}`, depth + 1);
+        }
+    };
+    for (let index = 0; index < pendingLocalReferences.length; index += 1) {
+        const reference = pendingLocalReferences[index];
+        if (reference)
+            addLocalInput(reference, 0);
+    }
+    const canonicalEntries = [...entries.values()].sort((left, right) => literalCompare(`${left.kind}:${left.path}`, `${right.kind}:${right.path}`));
+    return {
+        digest: sha256((0, canonical_json_1.canonicalJson)(canonicalEntries)),
+        entries: canonicalEntries,
+    };
+}
+function bindSemanticPrerequisites(reader, prerequisites) {
+    return prerequisites.map((prerequisite) => {
+        const source = reader.read(prerequisite.path);
+        if (source === null || reader.kind(prerequisite.path) !== 'file') {
+            throw new Error(`Post-generation install semantic prerequisite is missing at ${prerequisite.path}.`);
+        }
+        const registry = parseBoundedJson(source, `Post-generation install feature registry ${prerequisite.path}`);
+        const features = isRecord(registry) ? registry.features : undefined;
+        if (!isRecord(registry) ||
+            registry.schemaVersion !== 1 ||
+            !Array.isArray(features) ||
+            !features.some((feature) => isRecord(feature) && feature.id === prerequisite.selectedFeature)) {
+            throw new Error(`Post-generation install feature ${prerequisite.selectedFeature} is not registered at ${prerequisite.path}.`);
+        }
+        return { ...prerequisite, digest: sha256(source) };
+    });
+}
+function installAuthorityMatches(workspaceRoot, expected) {
+    try {
+        const observed = buildInstallAuthority(diskInstallAuthorityReader(workspaceRoot));
+        return (0, canonical_json_1.canonicalJson)(observed) === (0, canonical_json_1.canonicalJson)(expected);
+    }
+    catch {
+        return false;
+    }
+}
+function semanticPrerequisitesMatch(workspaceRoot, record) {
+    try {
+        const descriptors = record.semanticPrerequisites.map(({ kind, path, selectedFeature }) => ({ kind, path, selectedFeature }));
+        const observed = bindSemanticPrerequisites(diskInstallAuthorityReader(workspaceRoot), descriptors);
+        return ((0, canonical_json_1.canonicalJson)(observed) === (0, canonical_json_1.canonicalJson)(record.semanticPrerequisites));
+    }
+    catch {
+        return false;
+    }
+}
+function treeChangeSnapshot(tree) {
+    return new Map(tree
+        .listChanges()
+        .filter((change) => !change.path.startsWith(`${INSTALL_RECORD_DIRECTORY}/`) &&
+        change.path !== INSTALL_LEASE_PATH &&
+        change.path !== INSTALL_ACTIVE_PATH &&
+        change.path !== INSTALL_COMPLETION_PATH &&
+        change.path !== INSTALL_BATCH_CONFLICT_PATH)
+        .map((change) => [
+        change.path,
+        `${change.type}:${change.content === null ? 'null' : sha256(change.content)}`,
+    ]));
+}
+function collectTreeFiles(tree, path, files) {
+    const contents = tree.read(path);
+    if (contents !== null) {
+        files.set(path, contents);
+        return;
+    }
+    for (const child of tree.children(path)) {
+        collectTreeFiles(tree, path ? `${path}/${child}` : child, files);
+    }
+}
+function capturePostGenerationInstallState(tree, scope, operation) {
+    assertOperation(operation);
+    const markerPath = postGenerationInstallMarkerPath(operation.key);
+    reconcilePostGenerationInstallWorkspaceState(tree);
+    if ((0, node_fs_1.existsSync)((0, node_path_1.resolve)(tree.root))) {
+        assertNoRetainedBatchConflict(tree.root);
+    }
+    const existing = pendingMarkerPaths(tree);
+    if (existing.length > 0 || tree.exists(markerPath)) {
+        throw new Error(`Post-generation install is already pending at ${existing[0] ?? markerPath}.`);
+    }
+    const lockfile = tree.read(LOCKFILE_PATH);
+    if (lockfile === null) {
+        throw new Error(`${LOCKFILE_PATH} is required for resumable post-generation installation.`);
+    }
+    const authorityReader = treeInstallAuthorityReader(tree);
+    const workspaceSource = authorityReader.read('pnpm-workspace.yaml');
+    const workspaceManifestPaths = workspaceSource
+        ? new Set(exactWorkspaceManifestPaths(authorityReader, parseBoundedYaml(workspaceSource, 'Post-generation install pnpm-workspace.yaml')))
+        : new Set();
+    assertNoExoticLockfileAuthority(lockfile, authorityReader, workspaceManifestPaths);
+    const packageSource = tree.read('package.json', 'utf8');
+    if (packageSource === null) {
+        throw new Error('Post-generation install requires a root package.json with an exact pnpm packageManager authority.');
+    }
+    const packageManagerDescriptor = (0, pnpm_toolchain_authority_js_1.parsePnpmPackageManagerAuthority)(packageSource);
+    const packageManager = {
+        ...packageManagerDescriptor,
+        toolchain: (0, pnpm_toolchain_authority_js_1.resolvePnpmToolchainAuthority)(packageManagerDescriptor),
+    };
+    const contents = new Map();
+    for (const path of [
+        ...new Set([...(scope.exactPaths ?? []), ...scope.roots]),
+    ]) {
+        collectTreeFiles(tree, normalizedWorkspacePath(path, 'Install-planned path'), contents);
+    }
+    for (const path of scope.requiredPaths) {
+        normalizedWorkspacePath(path, 'Required install-planned path');
+    }
+    const reservation = {
+        generation: (0, node_crypto_1.randomUUID)(),
+        kind: INSTALL_RESERVATION_KIND,
+        operationFingerprint: expectedFingerprint(operation),
+        operationId: operation.id,
+        schemaVersion: INSTALL_RESERVATION_SCHEMA_VERSION,
+    };
+    // Queue the marker before any operation-owned source. Nx retains the first
+    // insertion position when the reservation is finalized below, so every
+    // possible flush prefix that contains generated source already contains the
+    // exact, parseable recovery record.
+    tree.write(markerPath, `${JSON.stringify(reservation, null, 2)}\n`, {
+        mode: 0o600,
+    });
+    return {
+        changes: treeChangeSnapshot(tree),
+        contents,
+        lockfileDigest: sha256(lockfile),
+        packageManager,
+        reservation,
+    };
+}
+function pathAllowed(path, scope) {
+    return ((scope.exactPaths ?? []).includes(path) ||
+        scope.roots.some((root) => path === root || path.startsWith(`${root}/`)));
+}
+function plannedFiles(tree, before, scope) {
+    const afterChanges = treeChangeSnapshot(tree);
+    const changedPaths = [
+        ...new Set([...before.changes.keys(), ...afterChanges.keys()]),
+    ]
+        .filter((path) => before.changes.get(path) !== afterChanges.get(path))
+        .sort(literalCompare);
+    for (const path of changedPaths) {
+        if (!pathAllowed(path, scope)) {
+            throw new Error(`Post-generation install planning escaped its declared surface at ${path}.`);
+        }
+    }
+    const files = changedPaths.map((path) => {
+        const contents = tree.read(path);
+        if (contents === null) {
+            throw new Error(`Post-generation install planning cannot retain deleted path ${path}.`);
+        }
+        const previous = before.contents.get(path);
+        return {
+            afterDigest: sha256(contents),
+            beforeDigest: previous ? sha256(previous) : null,
+            mode: previous ? 'modified' : 'created',
+            path,
+        };
+    });
+    for (const required of scope.requiredPaths) {
+        if (!files.some(({ path }) => path === required)) {
+            throw new Error(`Post-generation install planning omitted required path ${required}.`);
+        }
+    }
+    if (files.length === 0) {
+        throw new Error('Post-generation install planning produced no source files.');
+    }
+    return files;
+}
+function serializeRecord(record) {
+    const serialized = `${JSON.stringify(record, null, 2)}\n`;
+    if (Buffer.byteLength(serialized) > MAX_RECORD_BYTES) {
+        throw new Error('Post-generation install record exceeds 256 KiB.');
+    }
+    return serialized;
+}
+function parseReservation(source) {
+    let value;
+    try {
+        value = JSON.parse(source);
+    }
+    catch {
+        throw new Error('Post-generation install reservation is not valid JSON.');
+    }
+    if (!isRecord(value)) {
+        throw new Error('Post-generation install reservation must be an object.');
+    }
+    const reservation = value;
+    if (reservation.kind !== INSTALL_RESERVATION_KIND ||
+        reservation.schemaVersion !== INSTALL_RESERVATION_SCHEMA_VERSION ||
+        !validGeneration(reservation.generation) ||
+        !DIGEST_PATTERN.test(reservation.operationFingerprint) ||
+        typeof reservation.operationId !== 'string') {
+        throw new Error('Post-generation install reservation is invalid.');
+    }
+    return reservation;
+}
+function createRecord(operation, before, files, installAuthority, semanticPrerequisites) {
+    const retainedOperation = {
+        generator: operation.generator,
+        id: operation.id,
+        request: operation.request,
+        resumeArguments: operation.resumeArguments,
+        semanticPrerequisites: operation.semanticPrerequisites ?? [],
+        sourceRoot: operation.sourceRoot,
+    };
+    return {
+        attempts: {
+            frozen: 0,
+            initial: 0,
+            maxFrozen: MAX_FROZEN_ATTEMPTS,
+            maxInitial: MAX_NON_FROZEN_ATTEMPTS,
+        },
+        classification: 'generated-source-complete-install-pending',
+        cleanup: {
+            createdPaths: files
+                .filter(({ mode }) => mode === 'created')
+                .map(({ path }) => path),
+            modifiedPaths: files
+                .filter(({ mode }) => mode === 'modified')
+                .map(({ path }) => path),
+            owner: `@empire-builder-kit/nx:${operation.generator}`,
+            strategy: 'retain-generated-source',
+        },
+        execution: {
+            generation: null,
+            ownerPid: null,
+            phase: 'non-frozen-checkpoint',
+        },
+        kind: INSTALL_RECORD_KIND,
+        installAuthority,
+        lockfile: {
+            beforeDigest: before.lockfileDigest,
+            currentDigest: before.lockfileDigest,
+            path: LOCKFILE_PATH,
+        },
+        operation: {
+            ...retainedOperation,
+            fingerprint: operationFingerprint(retainedOperation),
+        },
+        packageManager: before.packageManager,
+        plannedSurface: {
+            digest: sha256((0, canonical_json_1.canonicalJson)(files)),
+            files,
+        },
+        revision: 0,
+        schemaVersion: INSTALL_RECORD_SCHEMA_VERSION,
+        semanticPrerequisites,
+    };
+}
+function isRecord(value) {
+    return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+}
+function stringArray(value) {
+    return (Array.isArray(value) &&
+        value.length <= 1024 &&
+        value.every((entry) => typeof entry === 'string'));
+}
+function validGeneration(value) {
+    return typeof value === 'string' && GENERATION_PATTERN.test(value);
+}
+function parseRecord(source) {
+    if (Buffer.byteLength(source) > MAX_RECORD_BYTES) {
+        throw new Error('Post-generation install record exceeds 256 KiB.');
+    }
+    let value;
+    try {
+        value = JSON.parse(source);
+    }
+    catch {
+        throw new Error('Post-generation install record is not valid JSON.');
+    }
+    if (!isRecord(value)) {
+        throw new Error('Post-generation install record must be an object.');
+    }
+    const record = value;
+    const operation = record.operation;
+    const files = record.plannedSurface?.files;
+    const authorityEntries = record.installAuthority?.entries;
+    const operationPrerequisites = operation?.semanticPrerequisites;
+    const boundPrerequisites = record.semanticPrerequisites;
+    const packageManager = record.packageManager;
+    const toolchain = isRecord(packageManager)
+        ? packageManager.toolchain
+        : undefined;
+    const node = isRecord(toolchain) ? toolchain.node : undefined;
+    const retainedPackageManagerMatch = isRecord(packageManager) &&
+        typeof packageManager.packageManager === 'string'
+        ? pnpm_toolchain_authority_js_1.EXACT_PNPM_PACKAGE_MANAGER_PATTERN.exec(packageManager.packageManager)
+        : null;
+    const running = record.execution?.phase === 'non-frozen-running' ||
+        record.execution?.phase === 'frozen-running';
+    if (record.schemaVersion !== INSTALL_RECORD_SCHEMA_VERSION ||
+        record.kind !== INSTALL_RECORD_KIND ||
+        ![
+            'generated-source-complete-install-pending',
+            'install-pending-semantic-prerequisite-blocked',
+            'install-pending-source-integrity-blocked',
+            'install-pending-reviewed-recovery-required',
+        ].includes(record.classification) ||
+        !(record.blocker === undefined ||
+            [
+                'active-marker-missing',
+                'frozen-retry-exhausted',
+                'install-authority-drift',
+                'install-execution-ambiguous',
+                'lockfile-drift',
+                'lockfile-missing',
+                'non-frozen-retry-exhausted',
+                'planned-surface-drift',
+                'semantic-prerequisite-drift',
+                'workspace-batch-ambiguous',
+            ].includes(record.blocker)) ||
+        (record.classification === 'generated-source-complete-install-pending' &&
+            record.blocker !== undefined) ||
+        (record.classification === 'install-pending-source-integrity-blocked' &&
+            ![
+                'install-authority-drift',
+                'lockfile-drift',
+                'lockfile-missing',
+                'planned-surface-drift',
+                'workspace-batch-ambiguous',
+            ].includes(record.blocker ?? '')) ||
+        (record.classification ===
+            'install-pending-semantic-prerequisite-blocked' &&
+            record.blocker !== 'semantic-prerequisite-drift') ||
+        (record.classification === 'install-pending-reviewed-recovery-required' &&
+            ![
+                'active-marker-missing',
+                'frozen-retry-exhausted',
+                'install-execution-ambiguous',
+                'non-frozen-retry-exhausted',
+            ].includes(record.blocker ?? '')) ||
+        !Number.isInteger(record.revision) ||
+        record.revision < 0 ||
+        !isRecord(operation) ||
+        !['slice', 'workload'].includes(operation.generator) ||
+        typeof operation.id !== 'string' ||
+        !isRecord(operation.request) ||
+        !stringArray(operation.resumeArguments) ||
+        !Array.isArray(operationPrerequisites) ||
+        operationPrerequisites.length > 16 ||
+        typeof operation.sourceRoot !== 'string' ||
+        typeof operation.fingerprint !== 'string' ||
+        !DIGEST_PATTERN.test(operation.fingerprint) ||
+        !isRecord(record.installAuthority) ||
+        !DIGEST_PATTERN.test(record.installAuthority.digest) ||
+        !Array.isArray(authorityEntries) ||
+        authorityEntries.length < 2 ||
+        authorityEntries.length > pnpm_toolchain_authority_js_1.PNPM_TOOLCHAIN_AUTHORITY_MAX_ENTRIES ||
+        !Array.isArray(boundPrerequisites) ||
+        boundPrerequisites.length !== operationPrerequisites.length ||
+        !isRecord(packageManager) ||
+        Object.keys(packageManager).sort().join(',') !==
+            'packageManager,toolchain,version' ||
+        !retainedPackageManagerMatch?.[1] ||
+        packageManager.version !== retainedPackageManagerMatch[1] ||
+        !isRecord(toolchain) ||
+        Object.keys(toolchain).sort().join(',') !==
+            'digest,entryCount,entryPoint,home,node,totalBytes' ||
+        !DIGEST_PATTERN.test(toolchain.digest) ||
+        typeof toolchain.home !== 'string' ||
+        !(0, node_path_1.isAbsolute)(toolchain.home) ||
+        /[\0\r\n"]/u.test(toolchain.home) ||
+        typeof toolchain.entryPoint !== 'string' ||
+        !(0, node_path_1.isAbsolute)(toolchain.entryPoint) ||
+        /[\0\r\n"]/u.test(toolchain.entryPoint) ||
+        !isRecord(node) ||
+        Object.keys(node).sort().join(',') !== 'digest,path,version' ||
+        !DIGEST_PATTERN.test(node.digest) ||
+        typeof node.path !== 'string' ||
+        !(0, node_path_1.isAbsolute)(node.path) ||
+        /[\0\r\n"]/u.test(node.path) ||
+        typeof node.version !== 'string' ||
+        !/^v\d+\.\d+\.\d+/u.test(node.version) ||
+        !Number.isInteger(toolchain.entryCount) ||
+        toolchain.entryCount <= 0 ||
+        toolchain.entryCount > pnpm_toolchain_authority_js_1.PNPM_TOOLCHAIN_AUTHORITY_MAX_ENTRIES ||
+        !Number.isInteger(toolchain.totalBytes) ||
+        toolchain.totalBytes <= 0 ||
+        toolchain.totalBytes > pnpm_toolchain_authority_js_1.PNPM_TOOLCHAIN_AUTHORITY_MAX_TOTAL_BYTES ||
+        !isRecord(record.attempts) ||
+        !Number.isInteger(record.attempts.initial) ||
+        !Number.isInteger(record.attempts.frozen) ||
+        record.attempts.initial < 0 ||
+        record.attempts.initial > MAX_NON_FROZEN_ATTEMPTS ||
+        record.attempts.frozen < 0 ||
+        record.attempts.frozen > MAX_FROZEN_ATTEMPTS ||
+        record.attempts.maxInitial !== MAX_NON_FROZEN_ATTEMPTS ||
+        record.attempts.maxFrozen !== MAX_FROZEN_ATTEMPTS ||
+        !isRecord(record.execution) ||
+        ![
+            'complete-checkpoint',
+            'frozen-checkpoint',
+            'frozen-running',
+            'non-frozen-checkpoint',
+            'non-frozen-running',
+            'reviewed-recovery-required',
+        ].includes(record.execution.phase) ||
+        !(record.execution.generation === null ||
+            validGeneration(record.execution.generation)) ||
+        !(record.execution.ownerPid === null ||
+            (Number.isInteger(record.execution.ownerPid) &&
+                record.execution.ownerPid > 0)) ||
+        (running &&
+            (!validGeneration(record.execution.generation) ||
+                record.execution.ownerPid === null)) ||
+        !isRecord(record.lockfile) ||
+        record.lockfile.path !== LOCKFILE_PATH ||
+        !DIGEST_PATTERN.test(record.lockfile.beforeDigest) ||
+        !DIGEST_PATTERN.test(record.lockfile.currentDigest) ||
+        !(record.lockfile.candidateDigest === undefined ||
+            DIGEST_PATTERN.test(record.lockfile.candidateDigest)) ||
+        !(record.lockfile.candidateGeneration === undefined ||
+            validGeneration(record.lockfile.candidateGeneration)) ||
+        (record.lockfile.candidateDigest === undefined) !==
+            (record.lockfile.candidateGeneration === undefined) ||
+        ((record.execution.phase === 'frozen-checkpoint' ||
+            record.execution.phase === 'frozen-running') &&
+            (!record.lockfile.candidateDigest ||
+                !record.lockfile.candidateGeneration)) ||
+        ((record.execution.phase === 'non-frozen-checkpoint' ||
+            record.execution.phase === 'non-frozen-running' ||
+            record.execution.phase === 'complete-checkpoint') &&
+            (record.lockfile.candidateDigest !== undefined ||
+                record.lockfile.candidateGeneration !== undefined)) ||
+        !isRecord(record.plannedSurface) ||
+        !DIGEST_PATTERN.test(record.plannedSurface.digest) ||
+        !Array.isArray(files) ||
+        files.length === 0 ||
+        files.length > 1024 ||
+        !isRecord(record.cleanup) ||
+        record.cleanup.owner !== `@empire-builder-kit/nx:${operation.generator}` ||
+        record.cleanup.strategy !== 'retain-generated-source' ||
+        !stringArray(record.cleanup.createdPaths) ||
+        !stringArray(record.cleanup.modifiedPaths)) {
+        throw new Error('Post-generation install record is invalid.');
+    }
+    const retainedOperation = {
+        generator: operation.generator,
+        id: operation.id,
+        request: operation.request,
+        resumeArguments: operation.resumeArguments,
+        semanticPrerequisites: operationPrerequisites,
+        sourceRoot: operation.sourceRoot,
+    };
+    normalizedWorkspacePath(operation.sourceRoot, 'Install source root');
+    if (operation.fingerprint !== operationFingerprint(retainedOperation)) {
+        throw new Error('Post-generation install operation binding is invalid.');
+    }
+    let previousPrerequisite = '';
+    for (let index = 0; index < operationPrerequisites.length; index += 1) {
+        const prerequisite = operationPrerequisites[index];
+        const bound = boundPrerequisites[index];
+        if (!isRecord(prerequisite) ||
+            prerequisite.kind !== 'registered-slice-feature' ||
+            Object.keys(prerequisite).sort().join(',') !==
+                'kind,path,selectedFeature' ||
+            typeof prerequisite.path !== 'string' ||
+            typeof prerequisite.selectedFeature !== 'string' ||
+            !isRecord(bound) ||
+            Object.keys(bound).sort().join(',') !==
+                'digest,kind,path,selectedFeature' ||
+            bound.kind !== prerequisite.kind ||
+            bound.path !== prerequisite.path ||
+            bound.selectedFeature !== prerequisite.selectedFeature ||
+            typeof bound.digest !== 'string' ||
+            !DIGEST_PATTERN.test(bound.digest)) {
+            throw new Error('Post-generation install semantic prerequisite binding is invalid.');
+        }
+        postGenerationInstallFeaturePrerequisite(prerequisite.path, prerequisite.selectedFeature);
+        const key = semanticPrerequisiteKey(prerequisite);
+        if (key <= previousPrerequisite) {
+            throw new Error('Post-generation install semantic prerequisite binding is not canonical.');
+        }
+        previousPrerequisite = key;
+    }
+    let previousAuthority = '';
+    const validAuthorityKinds = [
+        'local-input',
+        'npmrc-input',
+        'npmrc-resolution',
+        'patch',
+        'root-manifest',
+        'workspace-config',
+        'workspace-manifest',
+    ];
+    for (const entry of authorityEntries) {
+        if (!isRecord(entry) ||
+            Object.keys(entry).sort().join(',') !== 'digest,kind,mode,path' ||
+            typeof entry.kind !== 'string' ||
+            !validAuthorityKinds.includes(entry.kind) ||
+            typeof entry.path !== 'string' ||
+            typeof entry.digest !== 'string' ||
+            !DIGEST_PATTERN.test(entry.digest) ||
+            !(entry.mode === null ||
+                (typeof entry.mode === 'number' &&
+                    Number.isInteger(entry.mode) &&
+                    entry.mode >= 0 &&
+                    entry.mode <= 0o777)) ||
+            (entry.kind === 'npmrc-resolution' && entry.mode !== null) ||
+            (entry.kind !== 'npmrc-resolution' && entry.mode === null)) {
+            throw new Error('Post-generation install authority entry is invalid.');
+        }
+        normalizedWorkspacePath(entry.path, 'Install-authority entry path');
+        const key = `${entry.kind}:${entry.path}`;
+        if (key <= previousAuthority) {
+            throw new Error('Post-generation install authority is not canonical.');
+        }
+        previousAuthority = key;
+    }
+    if (record.installAuthority.digest !== sha256((0, canonical_json_1.canonicalJson)(authorityEntries))) {
+        throw new Error('Post-generation install authority digest is invalid.');
+    }
+    let previous = '';
+    for (const file of files) {
+        if (!isRecord(file) ||
+            typeof file.path !== 'string' ||
+            file.path <= previous ||
+            !['created', 'modified'].includes(file.mode) ||
+            !DIGEST_PATTERN.test(file.afterDigest) ||
+            !(file.beforeDigest === null ||
+                (typeof file.beforeDigest === 'string' &&
+                    DIGEST_PATTERN.test(file.beforeDigest))) ||
+            (file.mode === 'created' && file.beforeDigest !== null) ||
+            (file.mode === 'modified' && file.beforeDigest === null)) {
+            throw new Error('Post-generation install planned surface is invalid.');
+        }
+        normalizedWorkspacePath(file.path, 'Install-planned file');
+        previous = file.path;
+    }
+    if (record.plannedSurface.digest !== sha256((0, canonical_json_1.canonicalJson)(files))) {
+        throw new Error('Post-generation install planned surface digest is invalid.');
+    }
+    const created = files
+        .filter(({ mode }) => mode === 'created')
+        .map(({ path }) => path);
+    const modified = files
+        .filter(({ mode }) => mode === 'modified')
+        .map(({ path }) => path);
+    if ((0, canonical_json_1.canonicalJson)(record.cleanup.createdPaths) !== (0, canonical_json_1.canonicalJson)(created) ||
+        (0, canonical_json_1.canonicalJson)(record.cleanup.modifiedPaths) !== (0, canonical_json_1.canonicalJson)(modified)) {
+        throw new Error('Post-generation install cleanup ownership is invalid.');
+    }
+    return record;
+}
+function parseLease(source) {
+    if (Buffer.byteLength(source) > MAX_LEASE_BYTES) {
+        throw new Error('Post-generation install lease exceeds 16 KiB.');
+    }
+    let value;
+    try {
+        value = JSON.parse(source);
+    }
+    catch {
+        throw new Error('Post-generation install lease is not valid JSON.');
+    }
+    if (!isRecord(value)) {
+        throw new Error('Post-generation install lease must be an object.');
+    }
+    const lease = value;
+    if (lease.kind !== INSTALL_LEASE_KIND ||
+        lease.schemaVersion !== INSTALL_LEASE_SCHEMA_VERSION ||
+        !validGeneration(lease.generation) ||
+        !DIGEST_PATTERN.test(lease.operationFingerprint) ||
+        !Number.isInteger(lease.ownerPid) ||
+        lease.ownerPid <= 0 ||
+        typeof lease.acquiredAt !== 'string' ||
+        Number.isNaN(Date.parse(lease.acquiredAt))) {
+        throw new Error('Post-generation install lease is invalid.');
+    }
+    return lease;
+}
+function parseBatchConflict(source) {
+    if (Buffer.byteLength(source) > MAX_LEASE_BYTES) {
+        throw new Error('Post-generation install batch conflict exceeds 16 KiB.');
+    }
+    let value;
+    try {
+        value = JSON.parse(source);
+    }
+    catch {
+        throw new Error('Post-generation install batch conflict is not valid JSON.');
+    }
+    if (!isRecord(value)) {
+        throw new Error('Post-generation install batch conflict is invalid.');
+    }
+    const conflict = value;
+    if (conflict.kind !== INSTALL_BATCH_CONFLICT_KIND ||
+        conflict.schemaVersion !== 1 ||
+        typeof conflict.observedAt !== 'string' ||
+        Number.isNaN(Date.parse(conflict.observedAt)) ||
+        !Array.isArray(conflict.markers) ||
+        conflict.markers.length < 2 ||
+        conflict.markers.length > 1024) {
+        throw new Error('Post-generation install batch conflict is invalid.');
+    }
+    let previous = '';
+    for (const marker of conflict.markers) {
+        if (!isRecord(marker) ||
+            typeof marker.path !== 'string' ||
+            marker.path <= previous ||
+            !marker.path.startsWith(`${INSTALL_RECORD_DIRECTORY}/`) ||
+            !DIGEST_PATTERN.test(marker.digest)) {
+            throw new Error('Post-generation install batch conflict is invalid.');
+        }
+        normalizedWorkspacePath(marker.path, 'Batch-conflict marker path');
+        previous = marker.path;
+    }
+    return conflict;
+}
+function batchConflictPath(workspaceRoot) {
+    return confinedAbsolutePath(workspaceRoot, INSTALL_BATCH_CONFLICT_PATH);
+}
+function assertNoRetainedBatchConflict(workspaceRoot) {
+    const absolute = batchConflictPath(workspaceRoot);
+    if (!(0, node_fs_1.existsSync)(absolute))
+        return;
+    assertSafeRegularFile(absolute, 'Post-generation install batch conflict');
+    parseBatchConflict((0, node_fs_1.readFileSync)(absolute, 'utf8'));
+    throw new Error(`Post-generation install batch is ambiguous and requires reviewed reconciliation at ${INSTALL_BATCH_CONFLICT_PATH}; no automatic install was started.`);
+}
+function retainBatchConflict(workspaceRoot, markerPaths) {
+    const markers = markerPaths.sort(literalCompare).map((path) => ({
+        digest: recordIdentity(readDiskRecord(workspaceRoot, path)),
+        path,
+    }));
+    const conflict = {
+        kind: INSTALL_BATCH_CONFLICT_KIND,
+        markers,
+        observedAt: new Date().toISOString(),
+        schemaVersion: 1,
+    };
+    ensureSafeDirectory(workspaceRoot, (0, node_path_1.dirname)(INSTALL_BATCH_CONFLICT_PATH));
+    const absolute = batchConflictPath(workspaceRoot);
+    try {
+        writeExclusiveFile(absolute, `${JSON.stringify(conflict, null, 2)}\n`);
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST')
+            throw error;
+        assertSafeRegularFile(absolute, 'Post-generation install batch conflict');
+        parseBatchConflict((0, node_fs_1.readFileSync)(absolute, 'utf8'));
+    }
+}
+function readDiskRecord(workspaceRoot, markerPath) {
+    ensureSafeDirectory(workspaceRoot, INSTALL_RECORD_DIRECTORY);
+    const absolute = confinedAbsolutePath(workspaceRoot, markerPath);
+    assertSafeRegularFile(absolute, 'Post-generation install marker');
+    return parseRecord((0, node_fs_1.readFileSync)(absolute, 'utf8'));
+}
+function readDiskLease(workspaceRoot) {
+    ensureSafeDirectory(workspaceRoot, (0, node_path_1.dirname)(INSTALL_LEASE_PATH));
+    const absolute = confinedAbsolutePath(workspaceRoot, INSTALL_LEASE_PATH);
+    assertSafeRegularFile(absolute, 'Post-generation install lease');
+    return parseLease((0, node_fs_1.readFileSync)(absolute, 'utf8'));
+}
+function processIsAbsent(pid) {
+    try {
+        process.kill(pid, 0);
+        return false;
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === 'ESRCH')
+            return true;
+        if (code === 'EPERM')
+            return false;
+        throw error;
+    }
+}
+function createLease(workspaceRoot, operationFingerprint) {
+    const lease = {
+        acquiredAt: new Date().toISOString(),
+        generation: (0, node_crypto_1.randomUUID)(),
+        kind: INSTALL_LEASE_KIND,
+        operationFingerprint,
+        ownerPid: process.pid,
+        schemaVersion: INSTALL_LEASE_SCHEMA_VERSION,
+    };
+    ensureSafeDirectory(workspaceRoot, (0, node_path_1.dirname)(INSTALL_LEASE_PATH));
+    writeExclusiveFile(confinedAbsolutePath(workspaceRoot, INSTALL_LEASE_PATH), `${JSON.stringify(lease, null, 2)}\n`);
+    return lease;
+}
+function leaseIdentity(lease) {
+    return sha256((0, canonical_json_1.canonicalJson)(lease));
+}
+function staleLeaseClaims(workspaceRoot) {
+    const directory = ensureSafeDirectory(workspaceRoot, (0, node_path_1.dirname)(INSTALL_LEASE_PATH));
+    const prefix = `${INSTALL_LEASE_PATH.slice(INSTALL_LEASE_PATH.lastIndexOf('/') + 1)}.stale-`;
+    return (0, node_fs_1.readdirSync)(directory, { withFileTypes: true })
+        .filter((entry) => entry.name.startsWith(prefix))
+        .map((entry) => {
+        if (!entry.isFile() ||
+            entry.isSymbolicLink() ||
+            !/^post-generation-install-lease\.json\.stale-[0-9a-f-]+-[0-9a-f-]+$/.test(entry.name)) {
+            throw new Error(`Post-generation install lease directory contains unsafe takeover claim ${entry.name}.`);
+        }
+        const absolute = (0, node_path_1.join)(directory, entry.name);
+        assertSafeRegularFile(absolute, 'Claimed stale post-generation install lease');
+        return {
+            lease: parseLease((0, node_fs_1.readFileSync)(absolute, 'utf8')),
+            path: absolute,
+        };
+    })
+        .sort((left, right) => literalCompare(left.path, right.path));
+}
+function recordIsBoundToAnyLease(record, leases) {
+    if (!record.execution.generation)
+        return false;
+    const running = record.execution.phase === 'non-frozen-running' ||
+        record.execution.phase === 'frozen-running';
+    return leases.some((lease) => lease.operationFingerprint === record.operation.fingerprint &&
+        lease.generation === record.execution.generation &&
+        (!running || lease.ownerPid === record.execution.ownerPid));
+}
+function recordIsPristineForInitialLease(workspaceRoot, record) {
+    return (record.revision === 0 &&
+        record.classification === 'generated-source-complete-install-pending' &&
+        record.blocker === undefined &&
+        record.attempts.initial === 0 &&
+        record.attempts.frozen === 0 &&
+        record.execution.generation === null &&
+        record.execution.ownerPid === null &&
+        record.execution.phase === 'non-frozen-checkpoint' &&
+        record.lockfile.beforeDigest === record.lockfile.currentDigest &&
+        record.lockfile.candidateDigest === undefined &&
+        record.lockfile.candidateGeneration === undefined &&
+        installAuthorityMatches(workspaceRoot, record.installAuthority) &&
+        semanticPrerequisitesMatch(workspaceRoot, record) &&
+        plannedSurfaceMatches(workspaceRoot, record) &&
+        lockfileDigest(workspaceRoot) === record.lockfile.currentDigest);
+}
+function assertDeadTakeoverAuthority(workspaceRoot, markerPath, expectedOperationFingerprint, leases) {
+    if (leases.length === 0) {
+        throw new Error('Post-generation install takeover has no stale lease.');
+    }
+    for (const lease of leases) {
+        if (lease.operationFingerprint !== expectedOperationFingerprint) {
+            throw new Error('Post-generation install dead lease belongs to a different generator request; takeover was refused.');
+        }
+        if (!processIsAbsent(lease.ownerPid)) {
+            throw new Error(`Post-generation install lease is active for PID ${lease.ownerPid}; another agent must finish or stop before recovery.`);
+        }
+    }
+    const record = readDiskRecord(workspaceRoot, markerPath);
+    if (record.operation.fingerprint !== expectedOperationFingerprint ||
+        (!recordIsBoundToAnyLease(record, leases) &&
+            !recordIsPristineForInitialLease(workspaceRoot, record))) {
+        throw new Error('Post-generation install dead lease is not bound to the exact retained record; takeover was refused.');
+    }
+}
+function triggerProtocolCheckpoint(dependencies, checkpoint) {
+    if (dependencies.protocolCheckpoint?.(checkpoint) === 'simulate-crash') {
+        throw new SimulatedProtocolCrash(checkpoint);
+    }
+}
+function acquireLease(workspaceRoot, markerPath, operationFingerprint, dependencies) {
+    const leasePath = confinedAbsolutePath(workspaceRoot, INSTALL_LEASE_PATH);
+    const existingClaims = staleLeaseClaims(workspaceRoot);
+    const staleLeases = existingClaims.map(({ lease }) => lease);
+    if ((0, node_fs_1.existsSync)(leasePath)) {
+        const current = readDiskLease(workspaceRoot);
+        if (!processIsAbsent(current.ownerPid)) {
+            throw new Error(`Post-generation install lease is active for PID ${current.ownerPid}; another agent must finish or stop before recovery.`);
+        }
+        assertDeadTakeoverAuthority(workspaceRoot, markerPath, operationFingerprint, [...staleLeases, current]);
+        const claimPath = `${leasePath}.stale-${current.generation}-${(0, node_crypto_1.randomUUID)()}`;
+        (0, node_fs_1.renameSync)(leasePath, claimPath);
+        assertSafeRegularFile(claimPath, 'Claimed stale post-generation install lease');
+        const claimed = parseLease((0, node_fs_1.readFileSync)(claimPath, 'utf8'));
+        if (leaseIdentity(claimed) !== leaseIdentity(current)) {
+            throw new Error('Post-generation install stale lease changed during atomic claim.');
+        }
+        staleLeases.push(claimed);
+        existingClaims.push({ lease: claimed, path: claimPath });
+        triggerProtocolCheckpoint(dependencies, 'after-stale-lease-rename');
+    }
+    else if (staleLeases.length > 0) {
+        assertDeadTakeoverAuthority(workspaceRoot, markerPath, operationFingerprint, staleLeases);
+    }
+    else {
+        const lease = createLease(workspaceRoot, operationFingerprint);
+        triggerProtocolCheckpoint(dependencies, 'after-initial-lease-create');
+        return {
+            claims: [],
+            lease,
+            staleLeases: [],
+        };
+    }
+    const lease = createLease(workspaceRoot, operationFingerprint);
+    triggerProtocolCheckpoint(dependencies, 'after-replacement-lease-create');
+    return { claims: existingClaims, lease, staleLeases };
+}
+function clearStaleLeaseClaims(acquired) {
+    for (const claim of acquired.claims) {
+        assertSafeRegularFile(claim.path, 'Claimed stale post-generation install lease');
+        const current = parseLease((0, node_fs_1.readFileSync)(claim.path, 'utf8'));
+        if (leaseIdentity(current) !== leaseIdentity(claim.lease)) {
+            throw new Error('Post-generation install stale claim changed before completion.');
+        }
+        (0, node_fs_1.unlinkSync)(claim.path);
+    }
+}
+function assertLeaseOwned(workspaceRoot, lease, operationFingerprint) {
+    const current = readDiskLease(workspaceRoot);
+    if (current.generation !== lease.generation ||
+        current.ownerPid !== process.pid ||
+        current.operationFingerprint !== operationFingerprint) {
+        throw new Error('Post-generation install lease ownership changed.');
+    }
+}
+function releaseLease(workspaceRoot, lease, operationFingerprint) {
+    assertLeaseOwned(workspaceRoot, lease, operationFingerprint);
+    (0, node_fs_1.unlinkSync)(confinedAbsolutePath(workspaceRoot, INSTALL_LEASE_PATH));
+}
+function recordIdentity(record) {
+    return sha256(serializeRecord(record));
+}
+function activeJournalAbsolutePath(workspaceRoot) {
+    return confinedAbsolutePath(workspaceRoot, INSTALL_ACTIVE_PATH);
+}
+function parseActiveJournal(source) {
+    if (Buffer.byteLength(source) > MAX_RECORD_BYTES + MAX_LEASE_BYTES) {
+        throw new Error('Post-generation install active journal is too large.');
+    }
+    let value;
+    try {
+        value = JSON.parse(source);
+    }
+    catch {
+        throw new Error('Post-generation install active journal is not valid JSON.');
+    }
+    if (!isRecord(value) || !isRecord(value.record)) {
+        throw new Error('Post-generation install active journal is invalid.');
+    }
+    const journal = value;
+    const record = parseRecord(`${JSON.stringify(journal.record)}\n`);
+    if (journal.kind !== INSTALL_ACTIVE_KIND ||
+        journal.schemaVersion !== INSTALL_ACTIVE_SCHEMA_VERSION ||
+        typeof journal.markerPath !== 'string' ||
+        !journal.markerPath.startsWith(`${INSTALL_RECORD_DIRECTORY}/`) ||
+        typeof journal.leaseIdentity !== 'string' ||
+        !DIGEST_PATTERN.test(journal.leaseIdentity) ||
+        typeof journal.recordIdentity !== 'string' ||
+        !DIGEST_PATTERN.test(journal.recordIdentity) ||
+        journal.recordIdentity !== recordIdentity(record) ||
+        !validGeneration(record.execution.generation) ||
+        record.execution.ownerPid === null ||
+        !['frozen-running', 'non-frozen-running'].includes(record.execution.phase)) {
+        throw new Error('Post-generation install active journal is invalid.');
+    }
+    normalizedWorkspacePath(journal.markerPath, 'Active-journal marker path');
+    return { ...journal, record };
+}
+function readActiveJournal(workspaceRoot) {
+    const absolute = activeJournalAbsolutePath(workspaceRoot);
+    if (!(0, node_fs_1.existsSync)(absolute))
+        return undefined;
+    assertSafeRegularFile(absolute, 'Post-generation install active journal');
+    return parseActiveJournal((0, node_fs_1.readFileSync)(absolute, 'utf8'));
+}
+function createActiveJournal(workspaceRoot, markerPath, record, lease) {
+    assertLeaseOwned(workspaceRoot, lease, record.operation.fingerprint);
+    if (record.execution.generation !== lease.generation ||
+        record.execution.ownerPid !== process.pid ||
+        !['frozen-running', 'non-frozen-running'].includes(record.execution.phase)) {
+        throw new Error('Post-generation install active journal requires an exact running checkpoint.');
+    }
+    const journal = {
+        kind: INSTALL_ACTIVE_KIND,
+        leaseIdentity: leaseIdentity(lease),
+        markerPath,
+        record,
+        recordIdentity: recordIdentity(record),
+        schemaVersion: INSTALL_ACTIVE_SCHEMA_VERSION,
+    };
+    ensureSafeDirectory(workspaceRoot, (0, node_path_1.dirname)(INSTALL_ACTIVE_PATH));
+    writeExclusiveFile(activeJournalAbsolutePath(workspaceRoot), `${JSON.stringify(journal, null, 2)}\n`);
+}
+function clearActiveJournalAfterTransition(workspaceRoot, expected) {
+    const journal = readActiveJournal(workspaceRoot);
+    if (!journal)
+        return;
+    const exactRunning = journal.recordIdentity === recordIdentity(expected);
+    const durableSuccessor = expected.revision === journal.record.revision + 1 &&
+        expected.operation.fingerprint === journal.record.operation.fingerprint &&
+        expected.execution.generation === journal.record.execution.generation &&
+        expected.execution.ownerPid === null &&
+        !['frozen-running', 'non-frozen-running'].includes(expected.execution.phase);
+    if (!exactRunning && !durableSuccessor) {
+        throw new Error('Post-generation install active journal is not bound to the transitioned record.');
+    }
+    (0, node_fs_1.unlinkSync)(activeJournalAbsolutePath(workspaceRoot));
+}
+function retainMissingActiveMarker(workspaceRoot, markerPath, record, lease) {
+    assertLeaseOwned(workspaceRoot, lease, record.operation.fingerprint);
+    const journal = readActiveJournal(workspaceRoot);
+    if (!journal ||
+        journal.markerPath !== markerPath ||
+        journal.leaseIdentity !== leaseIdentity(lease) ||
+        journal.recordIdentity !== recordIdentity(record)) {
+        throw new Error('Post-generation install marker disappeared without an exact active journal.');
+    }
+    const reviewed = nextRecord(record, {
+        blocker: 'active-marker-missing',
+        classification: 'install-pending-reviewed-recovery-required',
+        execution: {
+            generation: lease.generation,
+            ownerPid: null,
+            phase: 'reviewed-recovery-required',
+        },
+    });
+    ensureSafeDirectory(workspaceRoot, INSTALL_RECORD_DIRECTORY);
+    writeExclusiveFile(confinedAbsolutePath(workspaceRoot, markerPath), serializeRecord(reviewed));
+    assertLeaseOwned(workspaceRoot, lease, record.operation.fingerprint);
+    clearActiveJournalAfterTransition(workspaceRoot, reviewed);
+    const pending = diskPendingMarkerPaths(workspaceRoot);
+    if (pending.length > 1)
+        retainBatchConflict(workspaceRoot, pending);
+    return reviewed;
+}
+function reconcileMissingActiveMarker(workspaceRoot, expectedMarkerPath, expectedOperationFingerprint) {
+    const journal = readActiveJournal(workspaceRoot);
+    if (!journal)
+        return;
+    if ((expectedMarkerPath && journal.markerPath !== expectedMarkerPath) ||
+        (expectedOperationFingerprint &&
+            journal.record.operation.fingerprint !== expectedOperationFingerprint)) {
+        throw new Error('Post-generation install active journal belongs to a different generator request.');
+    }
+    const marker = confinedAbsolutePath(workspaceRoot, journal.markerPath);
+    if ((0, node_fs_1.existsSync)(marker))
+        return;
+    const leasePath = confinedAbsolutePath(workspaceRoot, INSTALL_LEASE_PATH);
+    const leases = [
+        ...staleLeaseClaims(workspaceRoot).map(({ lease }) => lease),
+        ...((0, node_fs_1.existsSync)(leasePath) ? [readDiskLease(workspaceRoot)] : []),
+    ];
+    const activeLease = leases.find((lease) => leaseIdentity(lease) === journal.leaseIdentity);
+    if (!activeLease) {
+        throw new Error('Post-generation install active journal has no exact lease absence proof.');
+    }
+    if (!processIsAbsent(activeLease.ownerPid)) {
+        throw new Error(`Post-generation install active journal is owned by live PID ${activeLease.ownerPid}; recovery was refused.`);
+    }
+    if (activeLease.generation !== journal.record.execution.generation ||
+        activeLease.ownerPid !== journal.record.execution.ownerPid ||
+        activeLease.operationFingerprint !== journal.record.operation.fingerprint) {
+        throw new Error('Post-generation install active journal lease binding is invalid.');
+    }
+    const reviewed = nextRecord(journal.record, {
+        blocker: 'active-marker-missing',
+        classification: 'install-pending-reviewed-recovery-required',
+        execution: {
+            generation: activeLease.generation,
+            ownerPid: null,
+            phase: 'reviewed-recovery-required',
+        },
+    });
+    ensureSafeDirectory(workspaceRoot, INSTALL_RECORD_DIRECTORY);
+    writeExclusiveFile(marker, serializeRecord(reviewed));
+    clearActiveJournalAfterTransition(workspaceRoot, reviewed);
+}
+function casWriteRecord(workspaceRoot, markerPath, expected, next, lease) {
+    assertLeaseOwned(workspaceRoot, lease, expected.operation.fingerprint);
+    if (next.revision !== expected.revision + 1 ||
+        next.operation.fingerprint !== expected.operation.fingerprint ||
+        next.execution.generation !== lease.generation ||
+        !(next.execution.ownerPid === null ||
+            next.execution.ownerPid === process.pid)) {
+        throw new Error('Post-generation install record revision or lease generation is invalid.');
+    }
+    const current = readDiskRecord(workspaceRoot, markerPath);
+    if (current.revision !== expected.revision ||
+        recordIdentity(current) !== recordIdentity(expected)) {
+        throw new Error('Post-generation install record changed concurrently; no attempt was started.');
+    }
+    const directory = ensureSafeDirectory(workspaceRoot, INSTALL_RECORD_DIRECTORY);
+    const absolute = confinedAbsolutePath(workspaceRoot, markerPath);
+    const temporary = (0, node_path_1.join)(directory, `.${operationKeyFromMarker(markerPath)}.tmp-${lease.generation}-${(0, node_crypto_1.randomUUID)()}`);
+    writeExclusiveFile(temporary, serializeRecord(next));
+    try {
+        const beforeRename = readDiskRecord(workspaceRoot, markerPath);
+        if (beforeRename.revision !== expected.revision ||
+            recordIdentity(beforeRename) !== recordIdentity(expected)) {
+            throw new Error('Post-generation install record changed during compare-and-swap.');
+        }
+        assertLeaseOwned(workspaceRoot, lease, expected.operation.fingerprint);
+        (0, node_fs_1.renameSync)(temporary, absolute);
+    }
+    finally {
+        if ((0, node_fs_1.existsSync)(temporary))
+            (0, node_fs_1.unlinkSync)(temporary);
+    }
+    if (next.execution.phase !== 'frozen-running' &&
+        next.execution.phase !== 'non-frozen-running') {
+        clearActiveJournalAfterTransition(workspaceRoot, expected);
+    }
+    return next;
+}
+function operationKeyFromMarker(markerPath) {
+    const filename = markerPath.slice(markerPath.lastIndexOf('/') + 1);
+    return filename.endsWith('.json') ? filename.slice(0, -5) : filename;
+}
+function completionAbsolutePath(workspaceRoot) {
+    return confinedAbsolutePath(workspaceRoot, INSTALL_COMPLETION_PATH);
+}
+function readCompletionRecord(workspaceRoot) {
+    const absolute = completionAbsolutePath(workspaceRoot);
+    assertSafeRegularFile(absolute, 'Post-generation install completion');
+    const record = parseRecord((0, node_fs_1.readFileSync)(absolute, 'utf8'));
+    if (record.classification !== 'generated-source-complete-install-pending' ||
+        record.blocker !== undefined ||
+        !validGeneration(record.execution.generation) ||
+        record.execution.ownerPid !== null ||
+        record.execution.phase !== 'complete-checkpoint') {
+        throw new Error('Post-generation install completion tombstone is not an exact completed checkpoint.');
+    }
+    return record;
+}
+function casRetainCompletion(workspaceRoot, markerPath, expected, lease) {
+    assertLeaseOwned(workspaceRoot, lease, expected.operation.fingerprint);
+    const current = readDiskRecord(workspaceRoot, markerPath);
+    if (expected.execution.generation !== lease.generation ||
+        expected.execution.ownerPid !== null ||
+        current.revision !== expected.revision ||
+        recordIdentity(current) !== recordIdentity(expected)) {
+        throw new Error('Post-generation install record changed before completion removal.');
+    }
+    const completion = completionAbsolutePath(workspaceRoot);
+    if ((0, node_fs_1.existsSync)(completion)) {
+        throw new Error('Post-generation install completion tombstone already exists.');
+    }
+    (0, node_fs_1.renameSync)(confinedAbsolutePath(workspaceRoot, markerPath), completion);
+    const directory = confinedAbsolutePath(workspaceRoot, INSTALL_RECORD_DIRECTORY);
+    if ((0, node_fs_1.existsSync)(directory) && (0, node_fs_1.readdirSync)(directory).length === 0) {
+        (0, node_fs_1.rmdirSync)(directory);
+    }
+}
+function clearCompletionTombstone(workspaceRoot, expected) {
+    const absolute = completionAbsolutePath(workspaceRoot);
+    if (!(0, node_fs_1.existsSync)(absolute))
+        return;
+    const current = readCompletionRecord(workspaceRoot);
+    if (recordIdentity(current) !== recordIdentity(expected)) {
+        throw new Error('Post-generation install completion tombstone changed before cleanup.');
+    }
+    (0, node_fs_1.unlinkSync)(absolute);
+}
+function reconcileCompletionTombstone(workspaceRoot) {
+    const absolute = completionAbsolutePath(workspaceRoot);
+    if (!(0, node_fs_1.existsSync)(absolute))
+        return;
+    const completion = readCompletionRecord(workspaceRoot);
+    const pending = diskPendingMarkerPaths(workspaceRoot);
+    if (pending.length > 0) {
+        throw new Error(`Post-generation install completion tombstone coexists with incomplete record ${pending[0]}; reviewed reconciliation is required.`);
+    }
+    if (!semanticPrerequisitesMatch(workspaceRoot, completion)) {
+        throw new Error('Post-generation install completion tombstone is blocked by semantic-prerequisite-drift.');
+    }
+    if (!installAuthorityMatches(workspaceRoot, completion.installAuthority)) {
+        throw new Error('Post-generation install completion tombstone is blocked by install-authority-drift.');
+    }
+    if (!plannedSurfaceMatches(workspaceRoot, completion) ||
+        lockfileDigest(workspaceRoot) !== completion.lockfile.currentDigest) {
+        throw new Error('Post-generation install completion tombstone no longer matches its completed source and lockfile.');
+    }
+    const leasePath = confinedAbsolutePath(workspaceRoot, INSTALL_LEASE_PATH);
+    const claims = staleLeaseClaims(workspaceRoot);
+    const canonical = (0, node_fs_1.existsSync)(leasePath)
+        ? readDiskLease(workspaceRoot)
+        : undefined;
+    const leases = [
+        ...claims.map(({ lease }) => lease),
+        ...(canonical ? [canonical] : []),
+    ];
+    for (const lease of leases) {
+        if (lease.operationFingerprint !== completion.operation.fingerprint ||
+            lease.generation !== completion.execution.generation) {
+            throw new Error('Post-generation install completion tombstone is paired with a different lease authority.');
+        }
+        if (!processIsAbsent(lease.ownerPid)) {
+            throw new Error(`Post-generation install completion lease is active for PID ${lease.ownerPid}; cleanup was refused.`);
+        }
+    }
+    if (canonical) {
+        const claimPath = `${leasePath}.stale-${canonical.generation}-${(0, node_crypto_1.randomUUID)()}`;
+        (0, node_fs_1.renameSync)(leasePath, claimPath);
+        assertSafeRegularFile(claimPath, 'Claimed completed post-generation install lease');
+        const claimed = parseLease((0, node_fs_1.readFileSync)(claimPath, 'utf8'));
+        if (leaseIdentity(claimed) !== leaseIdentity(canonical)) {
+            throw new Error('Post-generation install completion lease changed during atomic claim.');
+        }
+        claims.push({ lease: claimed, path: claimPath });
+    }
+    for (const claim of claims) {
+        assertSafeRegularFile(claim.path, 'Claimed completed post-generation install lease');
+        const current = parseLease((0, node_fs_1.readFileSync)(claim.path, 'utf8'));
+        if (leaseIdentity(current) !== leaseIdentity(claim.lease)) {
+            throw new Error('Post-generation install completion lease claim changed before cleanup.');
+        }
+        (0, node_fs_1.unlinkSync)(claim.path);
+    }
+    clearCompletionTombstone(workspaceRoot, completion);
+}
+function lockfileDigest(workspaceRoot) {
+    const absolute = confinedAbsolutePath(workspaceRoot, LOCKFILE_PATH);
+    if (!(0, node_fs_1.existsSync)(absolute))
+        return undefined;
+    assertSafeRegularFile(absolute, 'Post-generation install lockfile');
+    const source = (0, node_fs_1.readFileSync)(absolute);
+    const reader = diskInstallAuthorityReader(workspaceRoot);
+    const workspaceSource = reader.read('pnpm-workspace.yaml');
+    const workspaceManifestPaths = workspaceSource
+        ? new Set(exactWorkspaceManifestPaths(reader, parseBoundedYaml(workspaceSource, 'Post-generation install pnpm-workspace.yaml')))
+        : new Set();
+    assertNoExoticLockfileAuthority(source, reader, workspaceManifestPaths);
+    return sha256(source);
+}
+function plannedSurfaceMatches(workspaceRoot, record) {
+    const root = workspaceRealRoot(workspaceRoot);
+    return record.plannedSurface.files.every((file) => {
+        const absolute = (0, node_path_1.resolve)(root, file.path);
+        try {
+            const fromRoot = (0, node_path_1.relative)(root, absolute);
+            if (fromRoot === '..' || fromRoot.startsWith(`..${node_path_1.sep}`))
+                return false;
+            assertSafeRegularFile(absolute, 'Install-planned source');
+            return sha256((0, node_fs_1.readFileSync)(absolute)) === file.afterDigest;
+        }
+        catch {
+            return false;
+        }
+    });
+}
+function nextRecord(record, changes) {
+    return {
+        ...record,
+        ...changes,
+        revision: record.revision + 1,
+    };
+}
+function checkpoint(workspaceRoot, markerPath, record, lease, changes) {
+    return casWriteRecord(workspaceRoot, markerPath, record, nextRecord(record, changes), lease);
+}
+function blockedRecord(workspaceRoot, markerPath, record, lease, blocker, execution = {
+    generation: lease.generation,
+    ownerPid: null,
+    phase: record.execution.phase === 'frozen-running'
+        ? 'frozen-checkpoint'
+        : record.execution.phase === 'non-frozen-running'
+            ? 'non-frozen-checkpoint'
+            : record.execution.phase,
+}) {
+    return checkpoint(workspaceRoot, markerPath, record, lease, {
+        blocker,
+        classification: blocker === 'semantic-prerequisite-drift'
+            ? 'install-pending-semantic-prerequisite-blocked'
+            : 'install-pending-source-integrity-blocked',
+        execution,
+    });
+}
+function reviewedRecord(workspaceRoot, markerPath, record, lease, blocker) {
+    return checkpoint(workspaceRoot, markerPath, record, lease, {
+        blocker,
+        classification: 'install-pending-reviewed-recovery-required',
+        execution: {
+            generation: lease.generation,
+            ownerPid: null,
+            phase: 'reviewed-recovery-required',
+        },
+    });
+}
+function pendingRecord(workspaceRoot, markerPath, record, lease, execution, lockfile = record.lockfile) {
+    return checkpoint(workspaceRoot, markerPath, record, lease, {
+        blocker: undefined,
+        classification: 'generated-source-complete-install-pending',
+        execution,
+        lockfile,
+    });
+}
+function diskPnpmPackageManagerAuthority(workspaceRoot) {
+    const packagePath = confinedAbsolutePath(workspaceRoot, 'package.json');
+    if (!(0, node_fs_1.existsSync)(packagePath)) {
+        throw new Error('Post-generation install requires a root package.json with an exact pnpm packageManager authority.');
+    }
+    assertSafeRegularFile(packagePath, 'Post-generation install package.json');
+    return (0, pnpm_toolchain_authority_js_1.parsePnpmPackageManagerAuthority)((0, node_fs_1.readFileSync)(packagePath, 'utf8'));
+}
+function pathIsInsideWorkspace(workspaceRoot, candidate) {
+    const fromWorkspace = (0, node_path_1.relative)((0, node_path_1.resolve)(workspaceRoot), candidate);
+    return (fromWorkspace === '' ||
+        (fromWorkspace !== '..' &&
+            !fromWorkspace.startsWith(`..${node_path_1.sep}`) &&
+            !(0, node_path_1.isAbsolute)(fromWorkspace)));
+}
+function postGenerationInstallPnpmInvocation(args, options) {
+    if (args.length === 0 ||
+        args.length > 32 ||
+        args.some((argument) => argument.length === 0 ||
+            argument.length > 256 ||
+            /[\0\r\n]/u.test(argument))) {
+        throw new Error('Post-generation install pnpm arguments are unsafe for controlled execution.');
+    }
+    if (!DIGEST_PATTERN.test(options.toolchain.digest) ||
+        !DIGEST_PATTERN.test(options.toolchain.node.digest) ||
+        !(0, node_path_1.isAbsolute)(options.toolchain.node.path) ||
+        /[\0\r\n"]/u.test(options.toolchain.node.path) ||
+        !(0, node_path_1.isAbsolute)(options.toolchain.entryPoint) ||
+        /[\0\r\n"]/u.test(options.toolchain.entryPoint) ||
+        !(0, node_path_1.isAbsolute)(options.isolatedHome) ||
+        /[\0\r\n"]/u.test(options.isolatedHome)) {
+        throw new Error('Post-generation install pnpm execution authority is invalid.');
+    }
+    const userConfig = (0, node_path_1.join)(options.isolatedHome, 'npm-user.rc');
+    const globalConfig = (0, node_path_1.join)(options.isolatedHome, 'npm-global.rc');
+    if ((0, node_fs_1.existsSync)(userConfig) || (0, node_fs_1.existsSync)(globalConfig)) {
+        throw new Error('Post-generation install isolated npm configuration paths must remain absent.');
+    }
+    for (const directory of [
+        'appdata',
+        'cache',
+        'config',
+        'data',
+        'localappdata',
+        'state',
+    ]) {
+        (0, node_fs_1.mkdirSync)((0, node_path_1.join)(options.isolatedHome, directory), { recursive: true });
+    }
+    const inheritedEnvironment = options.environment ?? process.env;
+    const systemRoot = inheritedEnvironment.SystemRoot ?? inheritedEnvironment.SYSTEMROOT;
+    if (process.platform === 'win32' &&
+        (typeof systemRoot !== 'string' ||
+            !(0, node_path_1.isAbsolute)(systemRoot) ||
+            systemRoot.includes(node_path_1.delimiter) ||
+            /[\0\r\n"%]/u.test(systemRoot))) {
+        throw new Error('Post-generation install requires one controlled absolute Windows SystemRoot.');
+    }
+    const controlledPath = [
+        (0, node_path_1.dirname)(options.toolchain.node.path),
+        ...(process.platform === 'win32' && systemRoot
+            ? [(0, node_path_1.join)(systemRoot, 'System32')]
+            : []),
+    ].join(node_path_1.delimiter);
+    const environment = {
+        ...Object.fromEntries(Object.entries(inheritedEnvironment).filter(([key]) => /^EBK_/u.test(key) ||
+            /^LC_/u.test(key) ||
+            ALLOWED_NPM_CREDENTIAL_ENVIRONMENT.has(key) ||
+            /^(?:CI|COMSPEC|FORCE_COLOR|HTTP_PROXY|HTTPS_PROXY|LANG|NO_COLOR|NO_PROXY|PATHEXT|SYSTEMROOT|TEMP|TMP|TMPDIR|WINDIR)$/iu.test(key))),
+        APPDATA: (0, node_path_1.join)(options.isolatedHome, 'appdata'),
+        COREPACK_ENV_FILE: '0',
+        HOME: options.isolatedHome,
+        LOCALAPPDATA: (0, node_path_1.join)(options.isolatedHome, 'localappdata'),
+        PATH: controlledPath,
+        USERPROFILE: options.isolatedHome,
+        XDG_CACHE_HOME: (0, node_path_1.join)(options.isolatedHome, 'cache'),
+        XDG_CONFIG_HOME: (0, node_path_1.join)(options.isolatedHome, 'config'),
+        XDG_DATA_HOME: (0, node_path_1.join)(options.isolatedHome, 'data'),
+        XDG_STATE_HOME: (0, node_path_1.join)(options.isolatedHome, 'state'),
+        npm_config_globalconfig: globalConfig,
+        npm_config_userconfig: userConfig,
+    };
+    return {
+        args: [options.toolchain.entryPoint, ...args],
+        command: options.toolchain.node.path,
+        env: environment,
+    };
+}
+function withIsolatedPnpmHome(workspaceRoot, callback) {
+    const isolatedHome = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'ebk-post-generation-pnpm-'));
+    (0, node_fs_1.chmodSync)(isolatedHome, 0o700);
+    if (pathIsInsideWorkspace(workspaceRoot, isolatedHome)) {
+        (0, node_fs_1.rmSync)(isolatedHome, { force: true, recursive: true });
+        throw new Error('Post-generation install isolated pnpm home must be outside the workspace.');
+    }
+    let retainForAmbiguousTermination = false;
+    try {
+        return callback(isolatedHome);
+    }
+    catch (error) {
+        retainForAmbiguousTermination = installExecutionIsAmbiguous(error);
+        throw error;
+    }
+    finally {
+        if (!retainForAmbiguousTermination) {
+            (0, node_fs_1.rmSync)(isolatedHome, { force: true, recursive: true });
+        }
+    }
+}
+function assertPinnedPnpmAuthority(workspaceRoot, expected) {
+    const current = diskPnpmPackageManagerAuthority(workspaceRoot);
+    if (current.packageManager !== expected.packageManager ||
+        current.version !== expected.version) {
+        throw new Error('Post-generation install root packageManager changed from its retained planning authority.');
+    }
+    let observed;
+    try {
+        const toolchain = (0, pnpm_toolchain_authority_js_1.assertBoundPnpmToolchain)(current, expected.toolchain);
+        observed = withIsolatedPnpmHome(workspaceRoot, (isolatedHome) => {
+            const invocation = postGenerationInstallPnpmInvocation(['--version'], {
+                isolatedHome,
+                toolchain,
+            });
+            return (0, node_child_process_1.execFileSync)(invocation.command, invocation.args, {
+                cwd: workspaceRoot,
+                encoding: 'utf8',
+                env: invocation.env,
+                stdio: ['ignore', 'pipe', 'pipe'],
+                timeout: INSTALL_TIMEOUT_MS,
+                windowsHide: true,
+            }).trim();
+        });
+    }
+    catch (error) {
+        throw new Error(`Post-generation install could not verify the bound pnpm authority: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (observed !== expected.version) {
+        throw new Error(`Post-generation install requires pnpm ${expected.version}, but the bound toolchain reported ${observed || 'no version'}.`);
+    }
+    return expected.version;
+}
+function packageManagerAuthorityMatches(workspaceRoot, expected) {
+    try {
+        const current = diskPnpmPackageManagerAuthority(workspaceRoot);
+        return (current.packageManager === expected.packageManager &&
+            current.version === expected.version &&
+            (0, canonical_json_1.canonicalJson)((0, pnpm_toolchain_authority_js_1.assertBoundPnpmToolchain)(current, expected.toolchain)) ===
+                (0, canonical_json_1.canonicalJson)(expected.toolchain));
+    }
+    catch {
+        return false;
+    }
+}
+function installExecutionIsAmbiguous(error) {
+    if (!isRecord(error))
+        return false;
+    return (error.killed === true ||
+        typeof error.signal === 'string' ||
+        error.code === 'ETIMEDOUT' ||
+        (typeof error.code === 'string' &&
+            (error.status === null || error.status === undefined)));
+}
+function defaultInstall(workspaceRoot, frozen, packageManager) {
+    const toolchain = (0, pnpm_toolchain_authority_js_1.assertBoundPnpmToolchain)(packageManager, packageManager.toolchain);
+    // HOME, configuration, cache, and execution state remain ephemeral. The
+    // content-addressed store is deliberately retained under the ignored
+    // workspace cache so ordinary pinned-pnpm commands can safely continue from
+    // the generated install instead of inheriting a deleted store authority.
+    ensureSafeDirectory(workspaceRoot, POST_GENERATION_STORE_DIRECTORY);
+    withIsolatedPnpmHome(workspaceRoot, (isolatedHome) => {
+        const invocation = postGenerationInstallPnpmInvocation([
+            'install',
+            frozen ? '--frozen-lockfile' : '--no-frozen-lockfile',
+            '--config.block-exotic-subdeps=true',
+            `--config.cache-dir=${(0, node_path_1.join)(isolatedHome, 'cache')}`,
+            '--config.deploy-all-files=false',
+            '--config.enable-modules-dir=true',
+            '--config.enable-global-virtual-store=false',
+            '--config.git-branch-lockfile=false',
+            '--config.ignore-pnpmfile=true',
+            '--config.ignore-scripts=true',
+            '--config.ignore-workspace=false',
+            '--config.inject-workspace-packages=false',
+            '--config.lockfile=true',
+            '--config.lockfile-only=false',
+            '--config.merge-git-branch-lockfiles=false',
+            '--config.modules-dir=node_modules',
+            '--config.node-linker=isolated',
+            '--config.package-import-method=copy',
+            '--config.resolution-only=false',
+            '--config.shared-workspace-lockfile=true',
+            '--config.side-effects-cache=false',
+            '--config.side-effects-cache-readonly=false',
+            `--config.state-dir=${(0, node_path_1.join)(isolatedHome, 'state')}`,
+            `--config.store-dir=${POST_GENERATION_STORE_DIRECTORY}`,
+            '--config.symlink=true',
+            '--config.use-store-server=false',
+            '--config.verify-store-integrity=true',
+        ], { isolatedHome, toolchain });
+        (0, node_child_process_1.execFileSync)(invocation.command, invocation.args, {
+            cwd: workspaceRoot,
+            env: invocation.env,
+            stdio: process.env.NX_GENERATE_QUIET === 'true' ? 'ignore' : 'inherit',
+            timeout: INSTALL_TIMEOUT_MS,
+            windowsHide: true,
+        });
+    });
+}
+function withAttemptEnvironment(lease, phase, callback) {
+    const keys = {
+        EBK_POST_GENERATION_INSTALL_GENERATION: lease.generation,
+        EBK_POST_GENERATION_INSTALL_OWNER_PID: String(process.pid),
+        EBK_POST_GENERATION_INSTALL_PHASE: phase,
+    };
+    const previous = Object.fromEntries(Object.keys(keys).map((key) => [key, process.env[key]]));
+    Object.assign(process.env, keys);
+    try {
+        return callback();
+    }
+    finally {
+        for (const [key, value] of Object.entries(previous)) {
+            if (value === undefined)
+                delete process.env[key];
+            else
+                process.env[key] = value;
+        }
+    }
+}
+function matchingStaleLease(record, acquired) {
+    return acquired.staleLeases.find((lease) => lease.generation === record.execution.generation &&
+        lease.ownerPid === record.execution.ownerPid &&
+        lease.operationFingerprint === record.operation.fingerprint);
+}
+function expectedCheckpointLock(record) {
+    return record.execution.phase === 'frozen-checkpoint' ||
+        record.execution.phase === 'frozen-running' ||
+        (record.execution.phase === 'reviewed-recovery-required' &&
+            record.lockfile.candidateDigest)
+        ? record.lockfile.candidateDigest
+        : record.lockfile.currentDigest;
+}
+function recoverOrRebindRecord(workspaceRoot, markerPath, record, acquired) {
+    const running = record.execution.phase === 'non-frozen-running' ||
+        record.execution.phase === 'frozen-running';
+    if (!running &&
+        (record.execution.generation === null ||
+            record.execution.generation === acquired.lease.generation)) {
+        return record;
+    }
+    if (running) {
+        const stale = matchingStaleLease(record, acquired);
+        if (!stale || !processIsAbsent(stale.ownerPid)) {
+            throw new Error('Post-generation install interrupted attempt has no matching stale lease absence proof.');
+        }
+    }
+    else if (record.execution.ownerPid !== null) {
+        throw new Error('Post-generation install checkpoint retained an invalid active owner.');
+    }
+    if (record.execution.phase === 'reviewed-recovery-required' ||
+        record.classification === 'install-pending-reviewed-recovery-required') {
+        return checkpoint(workspaceRoot, markerPath, record, acquired.lease, {
+            execution: {
+                generation: acquired.lease.generation,
+                ownerPid: null,
+                phase: 'reviewed-recovery-required',
+            },
+        });
+    }
+    if (!plannedSurfaceMatches(workspaceRoot, record)) {
+        return blockedRecord(workspaceRoot, markerPath, record, acquired.lease, 'planned-surface-drift');
+    }
+    if (!semanticPrerequisitesMatch(workspaceRoot, record)) {
+        return blockedRecord(workspaceRoot, markerPath, record, acquired.lease, 'semantic-prerequisite-drift');
+    }
+    if (!installAuthorityMatches(workspaceRoot, record.installAuthority)) {
+        return blockedRecord(workspaceRoot, markerPath, record, acquired.lease, 'install-authority-drift');
+    }
+    const observedLock = lockfileDigest(workspaceRoot);
+    if (!observedLock) {
+        return blockedRecord(workspaceRoot, markerPath, record, acquired.lease, 'lockfile-missing');
+    }
+    if (record.execution.phase === 'non-frozen-running' &&
+        observedLock !== record.lockfile.currentDigest) {
+        // A dead owner never gets to attest the lock bytes it produced. Even a
+        // syntactically valid lockfile can have been substituted after the crash,
+        // so recovery requires restoration of the pre-attempt bytes followed by a
+        // fresh, leased non-frozen convergence.
+        return blockedRecord(workspaceRoot, markerPath, record, acquired.lease, 'lockfile-drift', {
+            generation: acquired.lease.generation,
+            ownerPid: null,
+            phase: 'non-frozen-checkpoint',
+        });
+    }
+    const expectedLock = expectedCheckpointLock(record);
+    if (!expectedLock || observedLock !== expectedLock) {
+        return blockedRecord(workspaceRoot, markerPath, record, acquired.lease, 'lockfile-drift', {
+            generation: acquired.lease.generation,
+            ownerPid: null,
+            phase: record.execution.phase === 'frozen-running'
+                ? 'frozen-checkpoint'
+                : record.execution.phase === 'non-frozen-running'
+                    ? 'non-frozen-checkpoint'
+                    : record.execution.phase,
+        });
+    }
+    return pendingRecord(workspaceRoot, markerPath, record, acquired.lease, {
+        generation: acquired.lease.generation,
+        ownerPid: null,
+        phase: record.execution.phase === 'frozen-running'
+            ? 'frozen-checkpoint'
+            : record.execution.phase === 'non-frozen-running'
+                ? 'non-frozen-checkpoint'
+                : record.execution.phase,
+    });
+}
+function requireStableIntegrity(workspaceRoot, markerPath, record, lease) {
+    if (!plannedSurfaceMatches(workspaceRoot, record)) {
+        return blockedRecord(workspaceRoot, markerPath, record, lease, 'planned-surface-drift');
+    }
+    if (!semanticPrerequisitesMatch(workspaceRoot, record)) {
+        return blockedRecord(workspaceRoot, markerPath, record, lease, 'semantic-prerequisite-drift');
+    }
+    if (!installAuthorityMatches(workspaceRoot, record.installAuthority)) {
+        return blockedRecord(workspaceRoot, markerPath, record, lease, 'install-authority-drift');
+    }
+    const observedLock = lockfileDigest(workspaceRoot);
+    if (!observedLock) {
+        return blockedRecord(workspaceRoot, markerPath, record, lease, 'lockfile-missing');
+    }
+    const expectedLock = record.execution.phase === 'frozen-checkpoint'
+        ? record.lockfile.candidateDigest
+        : record.lockfile.currentDigest;
+    if (!expectedLock || observedLock !== expectedLock) {
+        return blockedRecord(workspaceRoot, markerPath, record, lease, 'lockfile-drift');
+    }
+    if (record.classification === 'install-pending-source-integrity-blocked' ||
+        record.classification === 'install-pending-semantic-prerequisite-blocked') {
+        return pendingRecord(workspaceRoot, markerPath, record, lease, {
+            generation: lease.generation,
+            ownerPid: null,
+            phase: record.execution.phase,
+        });
+    }
+    return record;
+}
+function completeCheckpoint(workspaceRoot, markerPath, record, lease, currentDigest) {
+    return checkpoint(workspaceRoot, markerPath, record, lease, {
+        blocker: undefined,
+        classification: 'generated-source-complete-install-pending',
+        execution: {
+            generation: lease.generation,
+            ownerPid: null,
+            phase: 'complete-checkpoint',
+        },
+        lockfile: {
+            beforeDigest: record.lockfile.beforeDigest,
+            currentDigest,
+            path: LOCKFILE_PATH,
+        },
+    });
+}
+function runFrozenAttempt(workspaceRoot, markerPath, record, lease, dependencies) {
+    record = requireStableIntegrity(workspaceRoot, markerPath, record, lease);
+    if (record.classification === 'install-pending-source-integrity-blocked' ||
+        record.classification === 'install-pending-semantic-prerequisite-blocked') {
+        throw new Error(`Post-generation install recovery is blocked by ${record.blocker ?? 'invalid state'}.`);
+    }
+    const candidateDigest = record.lockfile.candidateDigest;
+    if (!candidateDigest || !record.lockfile.candidateGeneration) {
+        throw new Error('Post-generation frozen recovery has no lease-produced lock candidate.');
+    }
+    if (record.attempts.frozen >= record.attempts.maxFrozen) {
+        const reviewed = reviewedRecord(workspaceRoot, markerPath, record, lease, 'frozen-retry-exhausted');
+        throw new Error(`Post-generation install requires reviewed cleanup/recovery at ${markerPath} after ${reviewed.attempts.frozen} frozen attempts.`);
+    }
+    const candidateBytes = (0, node_fs_1.readFileSync)(confinedAbsolutePath(workspaceRoot, LOCKFILE_PATH));
+    if (sha256(candidateBytes) !== candidateDigest) {
+        throw new Error('Post-generation frozen recovery candidate changed before execution.');
+    }
+    assertPinnedPnpmAuthority(workspaceRoot, record.packageManager);
+    record = checkpoint(workspaceRoot, markerPath, record, lease, {
+        attempts: {
+            ...record.attempts,
+            frozen: record.attempts.frozen + 1,
+        },
+        blocker: undefined,
+        classification: 'generated-source-complete-install-pending',
+        execution: {
+            generation: lease.generation,
+            ownerPid: process.pid,
+            phase: 'frozen-running',
+        },
+    });
+    createActiveJournal(workspaceRoot, markerPath, record, lease);
+    let failed = false;
+    let failure;
+    try {
+        withAttemptEnvironment(lease, 'frozen', () => (dependencies.frozenInstall ??
+            ((root) => defaultInstall(root, true, record.packageManager)))(workspaceRoot));
+    }
+    catch (error) {
+        failed = true;
+        failure = error;
+    }
+    const stableExecution = {
+        generation: lease.generation,
+        ownerPid: null,
+        phase: 'frozen-checkpoint',
+    };
+    if (!(0, node_fs_1.existsSync)(confinedAbsolutePath(workspaceRoot, markerPath))) {
+        retainMissingActiveMarker(workspaceRoot, markerPath, record, lease);
+        throw new Error('Post-generation install primary marker disappeared during the frozen attempt; reviewed recovery is required (active-marker-missing).');
+    }
+    if (installExecutionIsAmbiguous(failure)) {
+        reviewedRecord(workspaceRoot, markerPath, record, lease, 'install-execution-ambiguous');
+        throw new Error('Post-generation frozen install ended ambiguously; reviewed recovery is required before any retry.');
+    }
+    if (!packageManagerAuthorityMatches(workspaceRoot, record.packageManager)) {
+        blockedRecord(workspaceRoot, markerPath, record, lease, 'install-authority-drift', stableExecution);
+        throw new Error('Post-generation install recovery is blocked by package-manager install-authority-drift.');
+    }
+    const pendingAfterFrozen = diskPendingMarkerPaths(workspaceRoot);
+    if (pendingAfterFrozen.length !== 1 || pendingAfterFrozen[0] !== markerPath) {
+        if (pendingAfterFrozen.length > 1) {
+            retainBatchConflict(workspaceRoot, pendingAfterFrozen);
+        }
+        blockedRecord(workspaceRoot, markerPath, record, lease, 'workspace-batch-ambiguous', stableExecution);
+        throw new Error('Post-generation install batch became ambiguous during the frozen attempt; no completion was attributed.');
+    }
+    if (!plannedSurfaceMatches(workspaceRoot, record)) {
+        blockedRecord(workspaceRoot, markerPath, record, lease, 'planned-surface-drift', stableExecution);
+        throw new Error('Post-generation install recovery is blocked by planned-surface-drift.');
+    }
+    if (!semanticPrerequisitesMatch(workspaceRoot, record)) {
+        blockedRecord(workspaceRoot, markerPath, record, lease, 'semantic-prerequisite-drift', stableExecution);
+        throw new Error('Post-generation install recovery is blocked by semantic-prerequisite-drift.');
+    }
+    if (!installAuthorityMatches(workspaceRoot, record.installAuthority)) {
+        blockedRecord(workspaceRoot, markerPath, record, lease, 'install-authority-drift', stableExecution);
+        throw new Error('Post-generation install recovery is blocked by install-authority-drift.');
+    }
+    const lockfileAbsolute = confinedAbsolutePath(workspaceRoot, LOCKFILE_PATH);
+    if (!(0, node_fs_1.existsSync)(lockfileAbsolute)) {
+        blockedRecord(workspaceRoot, markerPath, record, lease, 'lockfile-missing', stableExecution);
+        throw new Error('Post-generation install recovery is blocked by lockfile-missing.');
+    }
+    assertSafeRegularFile(lockfileAbsolute, 'Post-generation install lockfile');
+    const observedBytes = (0, node_fs_1.readFileSync)(lockfileAbsolute);
+    if (!observedBytes.equals(candidateBytes)) {
+        blockedRecord(workspaceRoot, markerPath, record, lease, 'lockfile-drift', stableExecution);
+        throw new Error('Post-generation install recovery is blocked by lockfile-drift.');
+    }
+    record = pendingRecord(workspaceRoot, markerPath, record, lease, stableExecution);
+    if (!failed) {
+        record = completeCheckpoint(workspaceRoot, markerPath, record, lease, candidateDigest);
+        triggerProtocolCheckpoint(dependencies, 'after-complete-checkpoint');
+        casRetainCompletion(workspaceRoot, markerPath, record, lease);
+        triggerProtocolCheckpoint(dependencies, 'after-marker-clear-before-lease-release');
+        return;
+    }
+    if (record.attempts.frozen >= record.attempts.maxFrozen) {
+        const reviewed = reviewedRecord(workspaceRoot, markerPath, record, lease, 'frozen-retry-exhausted');
+        throw new Error(`Post-generation install requires reviewed cleanup/recovery at ${markerPath} after ${reviewed.attempts.frozen} frozen attempts.`);
+    }
+    throw new Error(`Post-generation install remains generated-source-complete/install-pending; rerun the exact generator request retained at ${markerPath}.`);
+}
+function runNonFrozenAttempt(workspaceRoot, markerPath, record, lease, dependencies) {
+    record = requireStableIntegrity(workspaceRoot, markerPath, record, lease);
+    if (record.classification === 'install-pending-source-integrity-blocked' ||
+        record.classification === 'install-pending-semantic-prerequisite-blocked') {
+        throw new Error(`Post-generation install recovery is blocked by ${record.blocker ?? 'invalid state'}.`);
+    }
+    if (record.attempts.initial >= record.attempts.maxInitial) {
+        const reviewed = reviewedRecord(workspaceRoot, markerPath, record, lease, 'non-frozen-retry-exhausted');
+        throw new Error(`Post-generation install requires reviewed cleanup/recovery at ${markerPath} after ${reviewed.attempts.initial} non-frozen attempts.`);
+    }
+    assertPinnedPnpmAuthority(workspaceRoot, record.packageManager);
+    record = checkpoint(workspaceRoot, markerPath, record, lease, {
+        attempts: {
+            ...record.attempts,
+            initial: record.attempts.initial + 1,
+        },
+        blocker: undefined,
+        classification: 'generated-source-complete-install-pending',
+        execution: {
+            generation: lease.generation,
+            ownerPid: process.pid,
+            phase: 'non-frozen-running',
+        },
+        lockfile: {
+            beforeDigest: record.lockfile.beforeDigest,
+            currentDigest: record.lockfile.currentDigest,
+            path: LOCKFILE_PATH,
+        },
+    });
+    createActiveJournal(workspaceRoot, markerPath, record, lease);
+    let failed = false;
+    let failure;
+    try {
+        withAttemptEnvironment(lease, 'non-frozen', () => (dependencies.initialInstall ??
+            dependencies.resumedInitialInstall ??
+            ((root) => defaultInstall(root, false, record.packageManager)))(workspaceRoot));
+    }
+    catch (error) {
+        failed = true;
+        failure = error;
+    }
+    const stableExecution = {
+        generation: lease.generation,
+        ownerPid: null,
+        phase: 'non-frozen-checkpoint',
+    };
+    if (!(0, node_fs_1.existsSync)(confinedAbsolutePath(workspaceRoot, markerPath))) {
+        retainMissingActiveMarker(workspaceRoot, markerPath, record, lease);
+        throw new Error('Post-generation install primary marker disappeared during the non-frozen attempt; reviewed recovery is required (active-marker-missing).');
+    }
+    if (installExecutionIsAmbiguous(failure)) {
+        reviewedRecord(workspaceRoot, markerPath, record, lease, 'install-execution-ambiguous');
+        throw new Error('Post-generation non-frozen install ended ambiguously; reviewed recovery is required before any retry.');
+    }
+    if (!packageManagerAuthorityMatches(workspaceRoot, record.packageManager)) {
+        blockedRecord(workspaceRoot, markerPath, record, lease, 'install-authority-drift', stableExecution);
+        throw new Error('Post-generation install recovery is blocked by package-manager install-authority-drift.');
+    }
+    const pendingAfterInstall = diskPendingMarkerPaths(workspaceRoot);
+    if (pendingAfterInstall.length !== 1 ||
+        pendingAfterInstall[0] !== markerPath) {
+        if (pendingAfterInstall.length > 1) {
+            retainBatchConflict(workspaceRoot, pendingAfterInstall);
+        }
+        blockedRecord(workspaceRoot, markerPath, record, lease, 'workspace-batch-ambiguous', stableExecution);
+        throw new Error('Post-generation install batch became ambiguous during the non-frozen attempt; no lock candidate was attributed.');
+    }
+    if (!plannedSurfaceMatches(workspaceRoot, record)) {
+        blockedRecord(workspaceRoot, markerPath, record, lease, 'planned-surface-drift', stableExecution);
+        throw new Error('Post-generation install recovery is blocked by planned-surface-drift.');
+    }
+    if (!semanticPrerequisitesMatch(workspaceRoot, record)) {
+        blockedRecord(workspaceRoot, markerPath, record, lease, 'semantic-prerequisite-drift', stableExecution);
+        throw new Error('Post-generation install recovery is blocked by semantic-prerequisite-drift.');
+    }
+    if (!installAuthorityMatches(workspaceRoot, record.installAuthority)) {
+        blockedRecord(workspaceRoot, markerPath, record, lease, 'install-authority-drift', stableExecution);
+        throw new Error('Post-generation install recovery is blocked by install-authority-drift.');
+    }
+    const observedLock = lockfileDigest(workspaceRoot);
+    if (!observedLock) {
+        blockedRecord(workspaceRoot, markerPath, record, lease, 'lockfile-missing', stableExecution);
+        throw new Error('Post-generation install recovery is blocked by lockfile-missing.');
+    }
+    if (observedLock !== record.lockfile.currentDigest) {
+        record = pendingRecord(workspaceRoot, markerPath, record, lease, {
+            generation: lease.generation,
+            ownerPid: null,
+            phase: 'frozen-checkpoint',
+        }, {
+            ...record.lockfile,
+            candidateDigest: observedLock,
+            candidateGeneration: lease.generation,
+        });
+        runFrozenAttempt(workspaceRoot, markerPath, record, lease, dependencies);
+        return;
+    }
+    record = pendingRecord(workspaceRoot, markerPath, record, lease, stableExecution);
+    if (!failed) {
+        record = completeCheckpoint(workspaceRoot, markerPath, record, lease, observedLock);
+        triggerProtocolCheckpoint(dependencies, 'after-complete-checkpoint');
+        casRetainCompletion(workspaceRoot, markerPath, record, lease);
+        triggerProtocolCheckpoint(dependencies, 'after-marker-clear-before-lease-release');
+        return;
+    }
+    if (record.attempts.initial >= record.attempts.maxInitial) {
+        const reviewed = reviewedRecord(workspaceRoot, markerPath, record, lease, 'non-frozen-retry-exhausted');
+        throw new Error(`Post-generation install requires reviewed cleanup/recovery at ${markerPath} after ${reviewed.attempts.initial} non-frozen attempts.`);
+    }
+    throw new Error(`Post-generation install remains generated-source-complete/install-pending before lockfile convergence; rerun the exact generator request retained at ${markerPath}.`);
+}
+function diskPendingMarkerPaths(workspaceRoot) {
+    const directory = ensureSafeDirectory(workspaceRoot, INSTALL_RECORD_DIRECTORY);
+    return (0, node_fs_1.readdirSync)(directory, { withFileTypes: true })
+        .filter((entry) => {
+        if (!/^[a-z0-9]+(?:-[a-z0-9]+)*\.json$/.test(entry.name)) {
+            return false;
+        }
+        if (!entry.isFile() || entry.isSymbolicLink()) {
+            throw new Error(`Post-generation install marker directory contains unsafe entry ${entry.name}.`);
+        }
+        assertSafeRegularFile((0, node_path_1.join)(directory, entry.name), 'Post-generation install marker');
+        return true;
+    })
+        .map((entry) => `${INSTALL_RECORD_DIRECTORY}/${entry.name}`)
+        .sort(literalCompare);
+}
+function finalizeAcquiredLease(workspaceRoot, acquired, expectedOperationFingerprint) {
+    const completion = (0, node_fs_1.existsSync)(completionAbsolutePath(workspaceRoot))
+        ? readCompletionRecord(workspaceRoot)
+        : undefined;
+    if (completion &&
+        (completion.operation.fingerprint !== expectedOperationFingerprint ||
+            completion.execution.generation !== acquired.lease.generation)) {
+        throw new Error('Post-generation install completion tombstone is not bound to the owned lease.');
+    }
+    releaseLease(workspaceRoot, acquired.lease, expectedOperationFingerprint);
+    if (completion) {
+        clearCompletionTombstone(workspaceRoot, completion);
+    }
+}
+function executeRecovery(workspaceRoot, markerPath, expectedOperationFingerprint, dependencies) {
+    reconcileMissingActiveMarker(workspaceRoot, markerPath, expectedOperationFingerprint);
+    assertNoRetainedBatchConflict(workspaceRoot);
+    const beforeLease = diskPendingMarkerPaths(workspaceRoot);
+    if (beforeLease.length !== 1 || beforeLease[0] !== markerPath) {
+        if (beforeLease.length > 1) {
+            retainBatchConflict(workspaceRoot, beforeLease);
+        }
+        throw new Error(beforeLease.length === 0
+            ? `Post-generation install marker disappeared before recovery at ${markerPath}.`
+            : `Post-generation install batch is ambiguous (${beforeLease.join(', ')}); no shared-lockfile install was started. Remove or reconcile every operation as one reviewed batch.`);
+    }
+    const acquired = acquireLease(workspaceRoot, markerPath, expectedOperationFingerprint, dependencies);
+    let simulatedCrash = false;
+    try {
+        const pending = diskPendingMarkerPaths(workspaceRoot);
+        if (pending.length !== 1 || pending[0] !== markerPath) {
+            if (pending.length > 1) {
+                retainBatchConflict(workspaceRoot, pending);
+            }
+            throw new Error(pending.length === 0
+                ? `Post-generation install marker disappeared before recovery at ${markerPath}.`
+                : `Post-generation install batch is ambiguous (${pending.join(', ')}); no shared-lockfile install was started. Remove or reconcile every operation as one reviewed batch.`);
+        }
+        let record = readDiskRecord(workspaceRoot, markerPath);
+        if (record.operation.fingerprint !== expectedOperationFingerprint) {
+            throw new Error('Post-generation install recovery belongs to a different generator request.');
+        }
+        record = recoverOrRebindRecord(workspaceRoot, markerPath, record, acquired);
+        // Keep every renamed stale lease until the marker is CAS-rebound to the
+        // replacement generation. A crash before this point therefore retains the
+        // complete absence-proof chain needed by the next recovery process.
+        clearStaleLeaseClaims(acquired);
+        if (record.classification === 'install-pending-source-integrity-blocked' ||
+            record.classification === 'install-pending-semantic-prerequisite-blocked') {
+            const integrity = requireStableIntegrity(workspaceRoot, markerPath, record, acquired.lease);
+            if (integrity.classification ===
+                'install-pending-source-integrity-blocked' ||
+                integrity.classification ===
+                    'install-pending-semantic-prerequisite-blocked') {
+                throw new Error(`Post-generation install recovery is blocked by ${integrity.blocker ?? 'invalid state'}.`);
+            }
+            record = integrity;
+        }
+        else if (record.execution.phase !== 'complete-checkpoint' &&
+            record.execution.phase !== 'reviewed-recovery-required') {
+            record = requireStableIntegrity(workspaceRoot, markerPath, record, acquired.lease);
+            if (record.classification === 'install-pending-source-integrity-blocked' ||
+                record.classification ===
+                    'install-pending-semantic-prerequisite-blocked') {
+                throw new Error(`Post-generation install recovery is blocked by ${record.blocker ?? 'invalid state'}.`);
+            }
+        }
+        if (record.execution.phase === 'complete-checkpoint') {
+            casRetainCompletion(workspaceRoot, markerPath, record, acquired.lease);
+            triggerProtocolCheckpoint(dependencies, 'after-marker-clear-before-lease-release');
+            return;
+        }
+        if (record.execution.phase === 'reviewed-recovery-required' ||
+            record.classification === 'install-pending-reviewed-recovery-required') {
+            throw new Error(`Post-generation install requires reviewed cleanup/recovery at ${markerPath}; automatic attempts are exhausted or provenance is ambiguous.`);
+        }
+        if (record.execution.phase === 'frozen-checkpoint') {
+            runFrozenAttempt(workspaceRoot, markerPath, record, acquired.lease, dependencies);
+            return;
+        }
+        runNonFrozenAttempt(workspaceRoot, markerPath, record, acquired.lease, dependencies);
+    }
+    catch (error) {
+        simulatedCrash = error instanceof SimulatedProtocolCrash;
+        throw error;
+    }
+    finally {
+        if (!simulatedCrash) {
+            let activeJournalRetained = true;
+            try {
+                activeJournalRetained = readActiveJournal(workspaceRoot) !== undefined;
+            }
+            catch {
+                // An unreadable journal is still durable evidence. Keep the exact lease
+                // so a later process can reconcile it only after proving this PID absent.
+            }
+            if (!activeJournalRetained) {
+                finalizeAcquiredLease(workspaceRoot, acquired, expectedOperationFingerprint);
+            }
+        }
+    }
+}
+function pendingMarkerPaths(tree) {
+    return tree
+        .children(INSTALL_RECORD_DIRECTORY)
+        .filter((entry) => /^[a-z0-9]+(?:-[a-z0-9]+)*\.json$/.test(entry) &&
+        tree.exists(`${INSTALL_RECORD_DIRECTORY}/${entry}`))
+        .map((entry) => `${INSTALL_RECORD_DIRECTORY}/${entry}`)
+        .sort(literalCompare);
+}
+function reconcilePostGenerationInstallWorkspaceState(tree, expectedMarkerPath, expectedOperationFingerprint) {
+    if (!(0, node_fs_1.existsSync)((0, node_path_1.resolve)(tree.root)))
+        return;
+    assertSafeExistingDirectoryChain(tree.root, INSTALL_RECORD_DIRECTORY);
+    reconcileMissingActiveMarker(tree.root, expectedMarkerPath, expectedOperationFingerprint);
+    reconcileCompletionTombstone(tree.root);
+}
+/**
+ * Prevents a non-installing generator from changing workspace bytes while a
+ * Slice or workload install still owns an exact recovery surface.
+ */
+function assertPostGenerationInstallWorkspaceAvailable(tree, operationId) {
+    if (operationId.length > 256 ||
+        !/^[a-z0-9]+(?:[-:][a-z0-9]+)*$/.test(operationId)) {
+        throw new Error('Post-generation install workspace operation id must be bounded lowercase kebab-case segments.');
+    }
+    reconcilePostGenerationInstallWorkspaceState(tree);
+    if ((0, node_fs_1.existsSync)((0, node_path_1.resolve)(tree.root))) {
+        assertNoRetainedBatchConflict(tree.root);
+    }
+    else if (tree.exists(INSTALL_BATCH_CONFLICT_PATH)) {
+        throw new Error(`Post-generation install batch is ambiguous and requires reviewed reconciliation at ${INSTALL_BATCH_CONFLICT_PATH}; no other generator may write workspace source.`);
+    }
+    const markers = pendingMarkerPaths(tree);
+    if (markers.length > 0) {
+        throw new Error(`Another post-generation install is pending at ${markers[0]}; resume it before starting ${operationId}.`);
+    }
+    const retainedPaths = [
+        INSTALL_ACTIVE_PATH,
+        INSTALL_COMPLETION_PATH,
+        INSTALL_LEASE_PATH,
+        ...tree
+            .children((0, node_path_1.dirname)(INSTALL_LEASE_PATH))
+            .filter((entry) => entry.startsWith(`${INSTALL_LEASE_PATH.slice(INSTALL_LEASE_PATH.lastIndexOf('/') + 1)}.stale-`))
+            .map((entry) => `${(0, node_path_1.dirname)(INSTALL_LEASE_PATH)}/${entry}`),
+    ]
+        .filter((path) => tree.exists(path))
+        .sort(literalCompare);
+    if (retainedPaths.length > 0) {
+        throw new Error(`Post-generation install state is retained at ${retainedPaths[0]}; reconcile it before starting ${operationId}.`);
+    }
+}
+function resumePendingPostGenerationInstall(tree, operation, skipInstall, dependencies = {}) {
+    assertOperation(operation);
+    reconcilePostGenerationInstallWorkspaceState(tree, postGenerationInstallMarkerPath(operation.key), expectedFingerprint(operation));
+    const markerPath = postGenerationInstallMarkerPath(operation.key);
+    const markers = pendingMarkerPaths(tree);
+    const source = tree.read(markerPath, 'utf8');
+    if (source === null) {
+        if (markers.length > 0) {
+            throw new Error(`Another post-generation install is pending at ${markers[0]}; resume it before starting ${operation.id}.`);
+        }
+        return undefined;
+    }
+    if (markers[0] !== markerPath) {
+        throw new Error(`Post-generation installs share one lockfile; resume ${markers[0]} before ${markerPath}.`);
+    }
+    if ((0, node_fs_1.existsSync)((0, node_path_1.resolve)(tree.root))) {
+        assertSafeExistingDirectoryChain(tree.root, INSTALL_RECORD_DIRECTORY);
+        const absolute = confinedAbsolutePath(tree.root, markerPath);
+        if ((0, node_fs_1.existsSync)(absolute)) {
+            assertSafeRegularFile(absolute, 'Post-generation install marker');
+        }
+    }
+    const record = parseRecord(source);
+    const fingerprint = expectedFingerprint(operation);
+    if (record.operation.fingerprint !== fingerprint ||
+        record.operation.sourceRoot !== operation.sourceRoot) {
+        throw new Error('Post-generation install recovery belongs to a different generator request.');
+    }
+    if (skipInstall) {
+        throw new Error(`Generated source is complete but installation remains pending at ${markerPath}; rerun without --skipInstall.`);
+    }
+    if (record.execution.phase === 'reviewed-recovery-required' ||
+        record.classification === 'install-pending-reviewed-recovery-required') {
+        if ((0, node_fs_1.existsSync)((0, node_path_1.resolve)(tree.root)) && readActiveJournal(tree.root)) {
+            return () => executeRecovery(tree.root, markerPath, fingerprint, dependencies);
+        }
+        throw new Error(`Post-generation install requires reviewed cleanup/recovery at ${markerPath}; automatic attempts are exhausted.`);
+    }
+    return () => executeRecovery(tree.root, markerPath, fingerprint, dependencies);
+}
+function createPostGenerationInstallCallback(tree, before, scope, operation, dependencies = {}) {
+    assertOperation(operation);
+    const markerPath = postGenerationInstallMarkerPath(operation.key);
+    const reservationSource = tree.read(markerPath, 'utf8');
+    if (reservationSource === null) {
+        throw new Error('Post-generation install planning did not reserve recovery state before generating source.');
+    }
+    const reservation = parseReservation(reservationSource);
+    if (reservation.generation !== before.reservation.generation ||
+        reservation.operationFingerprint !== expectedFingerprint(operation) ||
+        (0, canonical_json_1.canonicalJson)(reservation) !== (0, canonical_json_1.canonicalJson)(before.reservation)) {
+        throw new Error('Post-generation install planning reservation changed before finalization.');
+    }
+    const files = plannedFiles(tree, before, scope);
+    const authorityReader = treeInstallAuthorityReader(tree);
+    const record = createRecord(operation, before, files, buildInstallAuthority(authorityReader), bindSemanticPrerequisites(authorityReader, operation.semanticPrerequisites ?? []));
+    if ((0, node_fs_1.existsSync)((0, node_path_1.resolve)(tree.root))) {
+        assertSafeExistingDirectoryChain(tree.root, INSTALL_RECORD_DIRECTORY);
+    }
+    const existing = pendingMarkerPaths(tree);
+    if (existing.length !== 1 ||
+        existing[0] !== markerPath ||
+        !tree.exists(markerPath)) {
+        throw new Error(`Post-generation install planning reservation is ambiguous at ${existing[0] ?? markerPath}.`);
+    }
+    tree.write(markerPath, serializeRecord(record), { mode: 0o600 });
+    const fingerprint = record.operation.fingerprint;
+    return () => executeRecovery(tree.root, markerPath, fingerprint, dependencies);
+}
+//# sourceMappingURL=post-generation-install.js.map