@happyvertical/smrt-app-runtime 0.53.2 → 0.53.4

package/dist/chunks/src-DZGOVGsU.js

@@ -0,0 +1,2258 @@
+import { execFile } from "node:child_process";
+import { createHash, createHmac, randomBytes, randomUUID } from "node:crypto";
+import { constants, link, lstat, mkdir, open, readdir, realpath, rmdir, unlink } from "node:fs/promises";
+import { homedir, platform } from "node:os";
+import { dirname, isAbsolute, join, parse, relative, resolve, sep } from "node:path";
+import { promisify } from "node:util";
+import { Worker } from "node:worker_threads";
+import { resolveApplicationRuntime } from "@happyvertical/smrt-config";
+import { ScheduleRunner, TaskRunner } from "@happyvertical/smrt-jobs";
+import { Person, ProfileTypeCollection } from "@happyvertical/smrt-profiles";
+import { withSystemContext } from "@happyvertical/smrt-tenancy";
+import { DEFAULT_ROLE_SLUGS, MembershipCollection, MembershipStatus, RoleCollection, SessionCollection, SessionService, TenantService, UserCollection, UserStatus } from "@happyvertical/smrt-users";
+import { getDatabase } from "@happyvertical/sql";
+import { chmodSync, closeSync, constants as constants$1, existsSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { DatabaseSync } from "node:sqlite";
+import { registerHooks } from "node:module";
+import { fileURLToPath, pathToFileURL } from "node:url";
+//#region src/application-identity.ts
+function resolveApplicationId(options = {}) {
+	if (options.explicitId) return validateApplicationId(options.explicitId);
+	let packageName = options.packageName;
+	if (packageName === void 0) {
+		const sourceRoot = options.sourceRoot ?? process.cwd();
+		packageName = JSON.parse(readFileSync(join(sourceRoot, "package.json"), "utf8")).name;
+	}
+	if (typeof packageName !== "string" || packageName.trim() === "") throw new Error("package.json must declare a non-empty package name.");
+	return encodeApplicationId(packageName);
+}
+function databaseTargetIdentity(value) {
+	if (!value) return null;
+	try {
+		const target = new URL(value);
+		const sslMode = target.searchParams.get("sslmode");
+		target.username = "";
+		target.password = "";
+		target.search = "";
+		target.hash = "";
+		if (sslMode) target.searchParams.set("sslmode", sslMode);
+		return target.toString();
+	} catch {
+		return resolve(value);
+	}
+}
+function runtimeConfigurationFingerprint(runtime, environment = process.env) {
+	return createHash("sha256").update(JSON.stringify({
+		profile: runtime.profile,
+		providers: runtime.providers,
+		databaseTarget: databaseTargetIdentity(environment.DATABASE_URL),
+		host: environment.HOST || null,
+		port: environment.PORT || null,
+		origin: environment.ORIGIN || null,
+		backgroundJobs: environment.SMRT_BACKGROUND_JOBS === "true",
+		readinessModules: {
+			authentication: environment.SMRT_AUTH_READINESS_MODULE || null,
+			assets: environment.SMRT_ASSETS_READINESS_MODULE || null,
+			secrets: environment.SMRT_SECRETS_READINESS_MODULE || null
+		},
+		mcpAuthorization: {
+			resource: environment.SMRT_MCP_RESOURCE || null,
+			issuer: environment.SMRT_MCP_ISSUER || null,
+			jwksUri: environment.SMRT_MCP_JWKS_URI || null,
+			scopes: environment.SMRT_MCP_SCOPES || null
+		}
+	})).digest("hex");
+}
+//#endregion
+//#region src/deployed-runtime.ts
+var DeployedRuntimeError = class extends Error {
+	constructor(code, message, component) {
+		super(message);
+		this.code = code;
+		this.component = component;
+		this.name = "DeployedRuntimeError";
+	}
+	code;
+	component;
+};
+var DeployedRuntimeCleanupError = class extends DeployedRuntimeError {
+	constructor(cleanup) {
+		super("provider_unavailable", "The database connection could not be closed after startup failed; retry cleanup and inspect the provider's private logs.", "database");
+		this.cleanup = cleanup;
+		this.name = "DeployedRuntimeCleanupError";
+	}
+	cleanup;
+	cleaned = false;
+	cleanupAttempt;
+	async retryCleanup() {
+		if (this.cleaned) return;
+		if (!this.cleanupAttempt) this.cleanupAttempt = Promise.resolve().then(() => this.cleanup()).then(() => {
+			this.cleaned = true;
+		}).catch(() => {
+			throw this;
+		}).finally(() => {
+			this.cleanupAttempt = void 0;
+		});
+		return this.cleanupAttempt;
+	}
+};
+function isSessionTenantAuthorized(context) {
+	const membership = context.membership;
+	const authorization = context.tenantAuthorization;
+	const membershipId = authorization?.membershipId;
+	const validMembershipId = typeof membershipId === "string" && membershipId.trim().length > 0;
+	if (membership?.isActive() === true) return validMembershipId && membership.id === membershipId && authorization?.inheritedFromTenantId === null;
+	if (membership === null) return validMembershipId && typeof authorization?.inheritedFromTenantId === "string" && authorization.inheritedFromTenantId.trim().length > 0;
+	return false;
+}
+async function initializeDeployedApplicationRuntime(options) {
+	const resolvedRuntime = resolveDeployedRuntime(options);
+	const bindings = validateBindings(options, resolvedRuntime);
+	const prepareDatabase = snapshotPrepareDatabase(options);
+	await checkProvider("authentication", () => bindings.authentication.readiness());
+	await checkProvider("assets", () => bindings.assets.readiness());
+	await checkProvider("secrets", () => bindings.secrets.readiness());
+	let db;
+	try {
+		db = await bindings.database.connect();
+	} catch {
+		throw unavailable("database");
+	}
+	let validDatabase = false;
+	try {
+		validDatabase = isDatabaseInterface(db);
+	} catch {}
+	if (!validDatabase) await cleanupAfterStartupFailure(bindings.database, db, new DeployedRuntimeError("invalid_configuration", "The database adapter did not return a valid database connection.", "database"));
+	try {
+		await checkDatabase(bindings.database, db);
+	} catch (error) {
+		await cleanupAfterStartupFailure(bindings.database, db, error);
+	}
+	try {
+		await prepareDatabase?.(db);
+	} catch {
+		await cleanupAfterStartupFailure(bindings.database, db, new DeployedRuntimeError("provider_unavailable", "The PostgreSQL migration step failed; inspect the application migration logs.", "database"));
+	}
+	return new InitializedDeployedApplicationRuntime(db, resolvedRuntime, bindings);
+}
+function resolveDeployedRuntime(options) {
+	let plainOptions = false;
+	try {
+		plainOptions = isPlainRecord(options);
+	} catch {}
+	if (!plainOptions) throw new DeployedRuntimeError("invalid_configuration", "Deployed runtime options must be an object.");
+	let profile;
+	let providers;
+	try {
+		profile = options.profile;
+		providers = options.providers;
+	} catch {
+		throw new DeployedRuntimeError("invalid_configuration", "Deployed runtime options could not be read safely.");
+	}
+	if (profile !== "self-hosted" && profile !== "cloud") throw new DeployedRuntimeError("invalid_configuration", "Deployed runtime initialization requires the self-hosted or cloud profile.");
+	try {
+		return resolveApplicationRuntime({
+			profile,
+			providers
+		});
+	} catch {
+		throw new DeployedRuntimeError("invalid_configuration", "Deployed runtime provider options could not be read safely.");
+	}
+}
+function validateBindings(options, runtime) {
+	const database = requireObjectBinding(readBindingOption(options, "database", "database"), "database");
+	let engine;
+	let connect;
+	let readiness;
+	let close;
+	try {
+		engine = database.engine;
+		connect = database.connect;
+		readiness = database.readiness;
+		close = database.close;
+	} catch {
+		throw invalidBinding("database");
+	}
+	requireFunction(connect, "database", "connect");
+	requireOptionalFunction(readiness, "database", "readiness");
+	requireFunction(close, "database", "close");
+	if (engine !== runtime.providers.database.engine) throw mismatch("database", runtime.providers.database.engine);
+	return {
+		database: Object.freeze({
+			engine,
+			connect: bindCallback(connect, database, "database"),
+			readiness: typeof readiness === "function" ? bindCallback(readiness, database, "database") : void 0,
+			close: bindCallback(close, database, "database")
+		}),
+		authentication: requireProviderBinding(readBindingOption(options, "authentication", "authentication"), "authentication", runtime.providers.authentication.provider),
+		assets: requireProviderBinding(readBindingOption(options, "assets", "assets"), "assets", runtime.providers.assets.provider),
+		secrets: requireProviderBinding(readBindingOption(options, "secrets", "secrets"), "secrets", runtime.providers.secrets.provider)
+	};
+}
+function snapshotPrepareDatabase(options) {
+	let prepareDatabase;
+	try {
+		prepareDatabase = options.prepareDatabase;
+	} catch {
+		throw invalidBinding("database");
+	}
+	requireOptionalFunction(prepareDatabase, "database", "prepareDatabase");
+	return typeof prepareDatabase === "function" ? bindCallback(prepareDatabase, options, "database") : void 0;
+}
+function readBindingOption(options, field, component) {
+	try {
+		return options[field];
+	} catch {
+		throw invalidBinding(component);
+	}
+}
+function requireProviderBinding(value, component, expectedProvider) {
+	const binding = requireObjectBinding(value, component);
+	let provider;
+	let readiness;
+	try {
+		provider = binding.provider;
+		readiness = binding.readiness;
+	} catch {
+		throw invalidBinding(component);
+	}
+	if (provider !== expectedProvider) throw mismatch(component, expectedProvider);
+	requireFunction(readiness, component, "readiness");
+	return Object.freeze({
+		provider,
+		readiness: bindCallback(readiness, binding, component)
+	});
+}
+function requireObjectBinding(value, component) {
+	let valid = false;
+	try {
+		valid = typeof value === "object" && value !== null && !Array.isArray(value);
+	} catch {}
+	if (!valid) throw new DeployedRuntimeError("invalid_configuration", `The ${component} provider binding is required.`, component);
+	return value;
+}
+function invalidBinding(component) {
+	return new DeployedRuntimeError("invalid_configuration", `The ${component} provider binding could not be read safely.`, component);
+}
+function bindCallback(callback, receiver, component) {
+	try {
+		return Reflect.apply(Function.prototype.bind, callback, [receiver]);
+	} catch {
+		throw invalidBinding(component);
+	}
+}
+function requireFunction(value, component, field) {
+	if (typeof value !== "function") throw new DeployedRuntimeError("invalid_configuration", `The ${component} provider requires a ${field} callback.`, component);
+}
+function requireOptionalFunction(value, component, field) {
+	if (value !== void 0) requireFunction(value, component, field);
+}
+function mismatch(component, expectedProvider) {
+	return new DeployedRuntimeError("provider_mismatch", `The ${component} binding does not match the selected ${expectedProvider} provider.`, component);
+}
+function unavailable(component) {
+	return new DeployedRuntimeError("provider_unavailable", `The ${component} provider is not ready; inspect that provider's private logs.`, component);
+}
+async function checkProvider(component, check) {
+	try {
+		await check();
+	} catch {
+		throw unavailable(component);
+	}
+}
+async function checkDatabase(binding, db) {
+	try {
+		await binding.readiness?.(db);
+		if (!isValidPostgresProbe(await db.query("SELECT current_setting('server_version_num') AS smrt_postgres_version"))) throw new Error("invalid probe");
+	} catch {
+		throw unavailable("database");
+	}
+}
+var InitializedDeployedApplicationRuntime = class {
+	constructor(db, resolvedRuntime, bindings) {
+		this.db = db;
+		this.resolvedRuntime = resolvedRuntime;
+		this.bindings = bindings;
+		this.snapshot = createDiagnostics(resolvedRuntime);
+		this.sessionService = new SessionService({ db });
+	}
+	db;
+	resolvedRuntime;
+	bindings;
+	state = "running";
+	closeAttempt;
+	pendingReadinessChecks = /* @__PURE__ */ new Set();
+	pendingSessionRestorations = /* @__PURE__ */ new Set();
+	pendingWorkerInitializations = /* @__PURE__ */ new Set();
+	pendingWorkerOperations = /* @__PURE__ */ new Set();
+	lifecycleOperationContext = new AsyncLocalStorage();
+	activeLifecycleOperations = /* @__PURE__ */ new Set();
+	workerCleanups = /* @__PURE__ */ new Set();
+	sessionService;
+	sessionServiceReady;
+	snapshot;
+	async restoreSession(sessionId) {
+		this.assertRunning();
+		const operation = this.beginLifecycleOperation(() => this.restoreSessionWhileRunning(sessionId));
+		this.pendingSessionRestorations.add(operation);
+		try {
+			return await operation;
+		} finally {
+			this.pendingSessionRestorations.delete(operation);
+		}
+	}
+	async restoreSessionWhileRunning(sessionId) {
+		let context;
+		try {
+			await this.initializeSessionService();
+			context = await this.sessionService.loadSessionContext(sessionId);
+		} catch {
+			throw unavailable("authentication");
+		}
+		this.assertRunning();
+		if (context && this.resolvedRuntime.providers.tenancy.context === "required") {
+			let tenantId;
+			try {
+				tenantId = context.tenantId;
+			} catch {
+				throw unavailable("authentication");
+			}
+			if (typeof tenantId !== "string" || tenantId.trim().length === 0) throw new DeployedRuntimeError("tenant_context_required", "The authenticated session does not include the required tenant context.", "authentication");
+			let tenantAuthorized = false;
+			try {
+				tenantAuthorized = isSessionTenantAuthorized(context);
+			} catch {
+				throw unavailable("authentication");
+			}
+			if (!tenantAuthorized) throw new DeployedRuntimeError("tenant_context_unauthorized", "The authenticated session is not authorized for its tenant context.", "authentication");
+		}
+		return context;
+	}
+	async createTaskWorker(config = {}) {
+		this.assertRunning();
+		const operation = this.beginLifecycleOperation(() => this.initializeTaskWorker(config));
+		this.pendingWorkerInitializations.add(operation);
+		try {
+			const runner = await operation;
+			return this.retainWorker(runner);
+		} finally {
+			this.pendingWorkerInitializations.delete(operation);
+		}
+	}
+	async createScheduleWorker(config = {}) {
+		this.assertRunning();
+		const operation = this.beginLifecycleOperation(() => this.initializeScheduleWorker(config));
+		this.pendingWorkerInitializations.add(operation);
+		try {
+			const runner = await operation;
+			return this.retainWorker(runner);
+		} finally {
+			this.pendingWorkerInitializations.delete(operation);
+		}
+	}
+	diagnostics() {
+		return this.snapshot;
+	}
+	health() {
+		return Object.freeze({
+			schemaVersion: 1,
+			profile: this.resolvedRuntime.profile,
+			status: this.state === "running" ? "healthy" : "stopped"
+		});
+	}
+	async readiness() {
+		if (this.state !== "running") return createStoppedReadiness(this.resolvedRuntime.profile);
+		const operation = this.beginLifecycleOperation(() => this.checkReadinessWhileRunning());
+		this.pendingReadinessChecks.add(operation);
+		try {
+			return await operation;
+		} finally {
+			this.pendingReadinessChecks.delete(operation);
+		}
+	}
+	async checkReadinessWhileRunning() {
+		const results = await Promise.all([
+			probe(() => checkDatabase(this.bindings.database, this.db)),
+			probe(() => this.bindings.authentication.readiness()),
+			probe(() => this.bindings.assets.readiness()),
+			probe(() => this.bindings.secrets.readiness())
+		]);
+		if (this.state !== "running") return createStoppedReadiness(this.resolvedRuntime.profile);
+		const [database, authentication, assets, secrets] = results;
+		return freezeReadiness(this.resolvedRuntime.profile, {
+			database,
+			authentication,
+			assets,
+			secrets
+		}, results.every((result) => result.status === "ready"));
+	}
+	async close() {
+		const operationToken = this.lifecycleOperationContext.getStore();
+		const requestedFromLifecycleOperation = operationToken !== void 0 && this.activeLifecycleOperations.has(operationToken);
+		if (this.state === "stopped") return;
+		if (this.closeAttempt) {
+			if (requestedFromLifecycleOperation) return;
+			return this.closeAttempt;
+		}
+		this.state = "closing";
+		const pendingOperations = [
+			...this.pendingReadinessChecks,
+			...this.pendingSessionRestorations,
+			...this.pendingWorkerInitializations,
+			...this.pendingWorkerOperations
+		];
+		const shutdownToken = /* @__PURE__ */ Symbol("deployed-runtime-shutdown");
+		this.activeLifecycleOperations.add(shutdownToken);
+		const attempt = Promise.resolve().then(() => this.lifecycleOperationContext.run(shutdownToken, async () => {
+			await Promise.allSettled(pendingOperations);
+			await this.cleanupWorkers();
+			await this.closeConnection();
+		})).finally(() => {
+			this.activeLifecycleOperations.delete(shutdownToken);
+		});
+		this.closeAttempt = attempt.finally(() => {
+			this.closeAttempt = void 0;
+		});
+		if (requestedFromLifecycleOperation) {
+			this.closeAttempt.catch(() => void 0);
+			return;
+		}
+		return this.closeAttempt;
+	}
+	async initializeTaskWorker(config) {
+		let runner;
+		try {
+			runner = new TaskRunner(config);
+			await runner.initialize(this.db);
+		} catch {
+			if (runner) await this.stopOrRetainUnreturnedWorker(runner);
+			throw unavailable("database");
+		}
+		if (this.state !== "running") {
+			await this.stopOrRetainUnreturnedWorker(runner);
+			this.assertRunning();
+		}
+		return runner;
+	}
+	async initializeScheduleWorker(config) {
+		let runner;
+		try {
+			runner = new ScheduleRunner(config);
+			await runner.initialize(this.db);
+		} catch {
+			if (runner) await this.stopOrRetainUnreturnedWorker(runner);
+			throw unavailable("database");
+		}
+		if (this.state !== "running") {
+			await this.stopOrRetainUnreturnedWorker(runner);
+			this.assertRunning();
+		}
+		return runner;
+	}
+	async stopOrRetainUnreturnedWorker(runner) {
+		const cleanup = () => runner.stop();
+		try {
+			await cleanup();
+		} catch {
+			this.workerCleanups.add(cleanup);
+		}
+	}
+	retainWorker(runner) {
+		const start = runner.start.bind(runner);
+		const stop = runner.stop.bind(runner);
+		let operationTail = Promise.resolve();
+		const queueOperation = (callback) => {
+			const previous = operationTail;
+			const operation = this.beginLifecycleOperation(async () => {
+				await previous;
+				await callback();
+			});
+			operationTail = operation.catch(() => void 0);
+			this.pendingWorkerOperations.add(operation);
+			operation.then(() => {
+				this.pendingWorkerOperations.delete(operation);
+			}, () => {
+				this.pendingWorkerOperations.delete(operation);
+			});
+			return operation;
+		};
+		const ownedStart = async () => {
+			this.assertRunning();
+			return queueOperation(async () => {
+				this.assertRunning();
+				try {
+					await start();
+					this.assertRunning();
+				} catch {
+					if (this.state === "running") try {
+						await stop();
+					} catch {}
+					if (this.state !== "running") this.assertRunning();
+					throw unavailable("database");
+				}
+			});
+		};
+		const ownedStop = () => queueOperation(async () => {
+			try {
+				await stop();
+			} catch {
+				throw unavailable("database");
+			}
+		});
+		Object.defineProperties(runner, {
+			start: {
+				configurable: false,
+				enumerable: false,
+				value: ownedStart,
+				writable: false
+			},
+			stop: {
+				configurable: false,
+				enumerable: false,
+				value: ownedStop,
+				writable: false
+			}
+		});
+		this.workerCleanups.add(ownedStop);
+		return runner;
+	}
+	async cleanupWorkers() {
+		const cleanups = [...this.workerCleanups];
+		const results = await Promise.allSettled(cleanups.map((cleanup) => Promise.resolve().then(cleanup)));
+		let cleanupFailed = false;
+		for (const [index, result] of results.entries()) if (result.status === "fulfilled") {
+			const cleanup = cleanups[index];
+			if (cleanup) this.workerCleanups.delete(cleanup);
+		} else cleanupFailed = true;
+		if (cleanupFailed) {
+			this.state = "close-failed";
+			throw unavailable("database");
+		}
+	}
+	initializeSessionService() {
+		if (!this.sessionServiceReady) this.sessionServiceReady = this.sessionService.initialize().catch((error) => {
+			this.sessionServiceReady = void 0;
+			throw error;
+		});
+		return this.sessionServiceReady;
+	}
+	beginLifecycleOperation(operation) {
+		const token = /* @__PURE__ */ Symbol("deployed-runtime-operation");
+		this.activeLifecycleOperations.add(token);
+		return Promise.resolve().then(() => this.lifecycleOperationContext.run(token, operation)).finally(() => {
+			this.activeLifecycleOperations.delete(token);
+		});
+	}
+	async closeConnection() {
+		try {
+			await this.bindings.database.close(this.db);
+			this.state = "stopped";
+		} catch {
+			this.state = "close-failed";
+			throw new DeployedRuntimeError("provider_unavailable", "The database connection could not be closed; inspect the provider's private logs.", "database");
+		}
+	}
+	assertRunning() {
+		if (this.state !== "running") throw new DeployedRuntimeError("runtime_stopped", "The deployed application runtime has already stopped.");
+	}
+};
+function createDiagnostics(runtime) {
+	const provider = (value) => Object.freeze({
+		provider: value,
+		configured: true
+	});
+	return deepFreeze$1({
+		schemaVersion: 1,
+		runtime,
+		providers: {
+			database: provider(runtime.providers.database.engine),
+			authentication: provider(runtime.providers.authentication.provider),
+			assets: provider(runtime.providers.assets.provider),
+			secrets: provider(runtime.providers.secrets.provider)
+		},
+		tenancy: {
+			mode: runtime.providers.tenancy.mode,
+			context: runtime.providers.tenancy.context,
+			isolation: runtime.providers.tenancy.isolation,
+			rootTenantFallback: "disabled"
+		},
+		workers: {
+			topology: runtime.providers.jobs.topology,
+			taskProcess: "separate",
+			scheduleProcess: "separate",
+			replicas: runtime.providers.jobs.topology === "scalable" ? "horizontal" : "operator-managed"
+		},
+		secretValuesIncluded: false
+	});
+}
+async function probe(check) {
+	try {
+		await check();
+		return Object.freeze({ status: "ready" });
+	} catch {
+		return Object.freeze({ status: "not-ready" });
+	}
+}
+function createStoppedReadiness(profile) {
+	const stopped = Object.freeze({ status: "not-ready" });
+	return freezeReadiness(profile, {
+		database: stopped,
+		authentication: stopped,
+		assets: stopped,
+		secrets: stopped
+	}, false);
+}
+function freezeReadiness(profile, components, ready) {
+	return deepFreeze$1({
+		schemaVersion: 1,
+		profile,
+		status: ready ? "ready" : "not-ready",
+		components,
+		secretValuesIncluded: false
+	});
+}
+function isPlainRecord(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+	const prototype = Object.getPrototypeOf(value);
+	return prototype === Object.prototype || prototype === null;
+}
+function isDatabaseInterface(value) {
+	return typeof value === "object" && value !== null && typeof value.query === "function";
+}
+function isValidPostgresProbe(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const rows = value.rows;
+	if (!Array.isArray(rows) || rows.length !== 1) return false;
+	const row = rows[0];
+	if (typeof row !== "object" || row === null) return false;
+	const version = row.smrt_postgres_version;
+	return typeof version === "string" && /^\d+$/.test(version);
+}
+async function cleanupAfterStartupFailure(binding, db, startupError) {
+	const cleanup = () => binding.close(db);
+	try {
+		await cleanup();
+	} catch {
+		throw new DeployedRuntimeCleanupError(cleanup);
+	}
+	throw startupError;
+}
+function deepFreeze$1(value, seen = /* @__PURE__ */ new WeakSet()) {
+	if (value && typeof value === "object") {
+		if (seen.has(value)) return value;
+		seen.add(value);
+		if (!Object.isFrozen(value)) Object.freeze(value);
+		for (const child of Object.values(value)) deepFreeze$1(child, seen);
+	}
+	return value;
+}
+//#endregion
+//#region src/error-code.ts
+function errorCode(error) {
+	return error && typeof error === "object" && "code" in error && typeof error.code === "string" ? error.code : void 0;
+}
+//#endregion
+//#region src/stale-reclaim.ts
+var RECLAIM_MUTEX_FILE = ".smrt-lock-reclaim.sqlite";
+var RECLAIM_WAIT_MS = 2e3;
+function withReclaimMutex(stateRoot, callback) {
+	const mutexPath = join(stateRoot, RECLAIM_MUTEX_FILE);
+	try {
+		const details = lstatSync(mutexPath);
+		if (details.isSymbolicLink() || !details.isFile()) throw new Error("The application lock reclaim mutex is unsafe.");
+	} catch (error) {
+		if (errorCode(error) !== "ENOENT") throw error;
+	}
+	const database = new DatabaseSync(mutexPath, { timeout: RECLAIM_WAIT_MS });
+	try {
+		try {
+			chmodSync(mutexPath, 384);
+		} catch {}
+		try {
+			database.exec("BEGIN EXCLUSIVE");
+		} catch {
+			throw new Error("Another process is reclaiming a stale application lock; retry the operation.");
+		}
+		try {
+			return callback();
+		} finally {
+			database.exec("ROLLBACK");
+		}
+	} finally {
+		database.close();
+	}
+}
+function reclaimStaleRecord(path, observed, isStale) {
+	return withReclaimMutex(dirname(path), () => {
+		let current;
+		try {
+			current = readFileSync(path, "utf8");
+		} catch (error) {
+			if (errorCode(error) === "ENOENT") return "gone";
+			throw error;
+		}
+		if (current !== observed || !isStale(current)) return "changed";
+		rmSync(path);
+		return "removed";
+	});
+}
+//#endregion
+//#region src/operation-lock.ts
+function processExists(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (error) {
+		const code = errorCode(error);
+		return code === "EPERM" || code === "EACCES";
+	}
+}
+function lockOwnerPid(contents) {
+	try {
+		const pid = JSON.parse(contents)?.pid;
+		return Number.isSafeInteger(pid) && pid >= 1 ? pid : null;
+	} catch {
+		return null;
+	}
+}
+function isStaleOperationLock(contents) {
+	const pid = lockOwnerPid(contents);
+	return pid !== null && !processExists(pid);
+}
+async function withOperationLock(stateRoot, operation, callback) {
+	mkdirSync(stateRoot, {
+		recursive: true,
+		mode: 448
+	});
+	const path = join(stateRoot, "operation.lock");
+	const instance = randomBytes(16).toString("hex");
+	let descriptor;
+	for (let attempt = 0; attempt < 2; attempt += 1) try {
+		descriptor = openSync(path, "wx", 384);
+		try {
+			writeFileSync(descriptor, `${JSON.stringify({
+				schemaVersion: 1,
+				pid: process.pid,
+				operation,
+				instance
+			})}
+`);
+		} catch (error) {
+			closeSync(descriptor);
+			descriptor = void 0;
+			rmSync(path, { force: true });
+			throw error;
+		}
+		break;
+	} catch (error) {
+		if (errorCode(error) !== "EEXIST") throw error;
+		let observed = null;
+		try {
+			observed = readFileSync(path, "utf8");
+		} catch {}
+		const ownerPid = observed === null ? null : lockOwnerPid(observed);
+		if (ownerPid === null) throw new Error("An application operation lock exists but cannot be verified; inspect the private state directory.");
+		if (processExists(ownerPid)) throw new Error(`Another application operation is active (process ${ownerPid}).`);
+		reclaimStaleRecord(path, observed, isStaleOperationLock);
+	}
+	if (descriptor === void 0) throw new Error("The application operation lock could not be acquired.");
+	try {
+		return await callback({
+			instance,
+			path
+		});
+	} finally {
+		closeSync(descriptor);
+		try {
+			const current = JSON.parse(readFileSync(path, "utf8"));
+			if (current.pid === process.pid && current.instance === instance) rmSync(path, { force: true });
+		} catch {}
+	}
+}
+//#endregion
+//#region src/provider-readiness.ts
+var PROVIDER_READINESS_SETTINGS = Object.freeze({
+	authentication: "SMRT_AUTH_READINESS_MODULE",
+	assets: "SMRT_ASSETS_READINESS_MODULE",
+	secrets: "SMRT_SECRETS_READINESS_MODULE"
+});
+function findInstalledPackage(sourceRoot, packageName) {
+	let directory = resolve(sourceRoot);
+	for (;;) {
+		const candidate = join(directory, "node_modules", packageName);
+		if (existsSync(join(candidate, "package.json"))) return candidate;
+		const parent = dirname(directory);
+		if (parent === directory) return null;
+		directory = parent;
+	}
+}
+function packageNameOf(specifier) {
+	const parts = specifier.split("/");
+	return specifier.startsWith("@") ? parts.slice(0, 2).join("/") : parts[0];
+}
+var RESOLVER_MODULE = "data:text/javascript,export default (s) => import.meta.resolve(s)";
+async function resolveFromApplication(specifier, sourceRoot) {
+	const parentURL = pathToFileURL(join(resolve(sourceRoot), "package.json")).href;
+	const token = `smrt-app-readiness-${randomUUID()}`;
+	const hooks = registerHooks({ resolve(requested, context, nextResolve) {
+		return requested === token ? nextResolve(specifier, {
+			...context,
+			parentURL
+		}) : nextResolve(requested, context);
+	} });
+	try {
+		return (await import(
+			/* @vite-ignore */
+			RESOLVER_MODULE
+)).default(token);
+	} finally {
+		hooks.deregister();
+	}
+}
+async function resolveReadinessModule(specifier, sourceRoot) {
+	if (/^[a-z][a-z0-9+.-]*:/i.test(specifier) && !isAbsolute(specifier)) return specifier;
+	if (isAbsolute(specifier)) return pathToFileURL(specifier).href;
+	if (specifier.startsWith("./") || specifier.startsWith("../")) return pathToFileURL(resolve(sourceRoot, specifier)).href;
+	const installed = findInstalledPackage(sourceRoot, packageNameOf(specifier));
+	if (!installed) throw new Error(`${specifier} is not installed in the application.`);
+	const packageRoot = realpathSync(installed);
+	const resolvedPath = realpathSync(fileURLToPath(await resolveFromApplication(specifier, sourceRoot)));
+	if (resolvedPath !== packageRoot && !resolvedPath.startsWith(`${packageRoot}${sep}`)) throw new Error(`${specifier} resolved outside its installed package; refusing to load it.`);
+	return pathToFileURL(resolvedPath).href;
+}
+function createProviderReadinessProbe(component, context, options = {}) {
+	return async () => {
+		const setting = PROVIDER_READINESS_SETTINGS[component];
+		const specifier = (options.environment ?? process.env)[setting];
+		if (!specifier) throw new Error(`${setting} must name an installed provider readiness module.`);
+		const module = await import(
+			/* @vite-ignore */
+			await resolveReadinessModule(specifier, options.sourceRoot ?? process.cwd())
+);
+		const probe = module.checkReadiness || module.default;
+		if (typeof probe !== "function") throw new Error(`${setting} does not export a readiness probe.`);
+		const result = await probe({
+			component,
+			...context
+		});
+		if (result !== true && (typeof result !== "object" || result === null || result.ready !== true)) throw new Error(`${component} provider readiness check failed.`);
+	};
+}
+//#endregion
+//#region src/runtime-diagnostics.ts
+var RUNTIME_DIAGNOSTICS_SCHEMA_VERSION = 1;
+var MAX_RUNTIME_DIAGNOSTIC_TOOLS = 64;
+var MAX_RUNTIME_DIAGNOSTIC_ERRORS = 8;
+var RUNTIME_WORKER_FRESHNESS_SECONDS = 120;
+var CAPABILITY_IDS = [
+	"asset-storage",
+	"authentication",
+	"background-jobs",
+	"database",
+	"paid-capabilities",
+	"secret-storage"
+];
+var ERROR_CODES = [
+	"authentication_unavailable",
+	"database_unavailable",
+	"migration_required",
+	"provider_unavailable",
+	"runtime_stopped",
+	"worker_stale"
+];
+var PROHIBITED_IDENTIFIER_PARTS = /* @__PURE__ */ new Set([
+	"authorization",
+	"cookie",
+	"constructor",
+	"credential",
+	"email",
+	"hash",
+	"key",
+	"log",
+	"logs",
+	"password",
+	"path",
+	"record",
+	"prototype",
+	"secret",
+	"session",
+	"stack",
+	"tenant",
+	"token",
+	"url",
+	"user"
+]);
+function projectRuntimeDiagnostics(input) {
+	const source = plainRecord(input);
+	const observedAtValue = read(source, "observedAt");
+	const observedAtMilliseconds = timestampMilliseconds(observedAtValue);
+	const observedAt = coarseTimestamp(observedAtValue) ?? EPOCH;
+	const profile = runtimeProfile(read(source, "profile"));
+	const worker = projectWorker(read(source, "worker"), observedAt, observedAtMilliseconds);
+	const capabilities = projectCapabilities(read(source, "capabilities"));
+	const tools = canonicalTools(read(source, "toolNames"));
+	return deepFreeze({
+		schemaVersion: 1,
+		profile,
+		health: oneOf(read(source, "health"), HEALTH_VALUES, "unknown"),
+		schema: projectSchema(read(source, "schema")),
+		capabilities,
+		tools: {
+			names: tools,
+			count: tools.length,
+			digest: createHash("sha256").update(tools.join("\n")).digest("hex")
+		},
+		operationalDifferences: {
+			backgroundJobs: capabilityStatus(capabilities, "background-jobs") === "available" ? "enabled" : "disabled",
+			workerTopology: worker.topology
+		},
+		worker,
+		recentErrors: projectErrors(read(source, "recentErrors"))
+	});
+}
+var EPOCH = "1970-01-01T00:00:00.000Z";
+var PROFILES = [
+	"local",
+	"self-hosted",
+	"cloud",
+	"unknown"
+];
+var HEALTH_VALUES = [
+	"healthy",
+	"degraded",
+	"stopped",
+	"unknown"
+];
+var SCHEMA_VALUES = [
+	"ready",
+	"not-ready",
+	"unknown"
+];
+var MIGRATION_VALUES = [
+	"current",
+	"failed",
+	"pending",
+	"unknown"
+];
+var CAPABILITY_VALUES = [
+	"available",
+	"disabled",
+	"unavailable",
+	"unknown"
+];
+var WORKER_TOPOLOGIES = [
+	"embedded",
+	"external",
+	"inline",
+	"scalable"
+];
+function runtimeProfile(value) {
+	return oneOf(value, PROFILES, "unknown");
+}
+function projectSchema(value) {
+	const source = plainRecord(value);
+	return {
+		status: oneOf(read(source, "status"), SCHEMA_VALUES, "unknown"),
+		migrations: oneOf(read(source, "migrations"), MIGRATION_VALUES, "unknown")
+	};
+}
+function projectCapabilities(value) {
+	const source = plainRecord(value);
+	return CAPABILITY_IDS.map((id) => ({
+		id,
+		status: oneOf(read(source, id), CAPABILITY_VALUES, "unknown")
+	}));
+}
+function canonicalTools(value) {
+	const names = /* @__PURE__ */ new Set();
+	for (const candidate of safeArrayItems(value, 256)) {
+		if (typeof candidate !== "string" || !isPublicIdentifier(candidate)) continue;
+		names.add(candidate);
+	}
+	return [...names].sort().slice(0, 64);
+}
+function isPublicIdentifier(value) {
+	if (value.length < 1 || value.length > 80 || !/^[a-z][a-z0-9]*(?:[._-][a-z0-9]+)*$/.test(value)) return false;
+	return !value.split(/[._-]/).some((part) => PROHIBITED_IDENTIFIER_PARTS.has(part));
+}
+function projectWorker(value, observedAt, observedAtMilliseconds) {
+	const source = plainRecord(value);
+	const topology = oneOf(read(source, "topology"), WORKER_TOPOLOGIES, "inline");
+	const required = read(source, "required") === true;
+	const heartbeatValue = read(source, "heartbeatAt");
+	const heartbeatMilliseconds = timestampMilliseconds(heartbeatValue);
+	const heartbeatAt = coarseTimestamp(heartbeatValue);
+	let liveness = "not-required";
+	if (required) {
+		liveness = "unknown";
+		if (heartbeatMilliseconds !== null && observedAtMilliseconds !== null) {
+			const ageSeconds = (observedAtMilliseconds - heartbeatMilliseconds) / 1e3;
+			if (ageSeconds >= 0) liveness = ageSeconds <= 120 ? "alive" : "stale";
+		}
+	}
+	return {
+		topology,
+		liveness,
+		heartbeatAt,
+		observedAt
+	};
+}
+function projectErrors(value) {
+	const errors = [];
+	for (const candidate of safeArrayItems(value, 32)) {
+		const source = plainRecord(candidate);
+		const at = coarseTimestamp(read(source, "at"));
+		if (!at) continue;
+		const rawCode = read(source, "code");
+		const code = ERROR_CODES.includes(rawCode) ? rawCode : "runtime_error";
+		errors.push({
+			code,
+			at
+		});
+	}
+	return errors.sort((left, right) => left.at === right.at ? left.code.localeCompare(right.code) : right.at.localeCompare(left.at)).slice(0, 8);
+}
+function capabilityStatus(capabilities, id) {
+	return capabilities.find((capability) => capability.id === id)?.status ?? "unknown";
+}
+function coarseTimestamp(value) {
+	const milliseconds = timestampMilliseconds(value);
+	if (milliseconds === null) return null;
+	const minute = Math.floor(milliseconds / 6e4) * 6e4;
+	return new Date(minute).toISOString();
+}
+function timestampMilliseconds(value) {
+	try {
+		if (!(typeof value === "string" || value instanceof Date)) return null;
+		const milliseconds = value instanceof Date ? value.getTime() : Date.parse(value);
+		return Number.isFinite(milliseconds) ? milliseconds : null;
+	} catch {
+		return null;
+	}
+}
+function oneOf(value, values, fallback) {
+	return typeof value === "string" && values.includes(value) ? value : fallback;
+}
+function plainRecord(value) {
+	try {
+		if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+		const prototype = Object.getPrototypeOf(value);
+		return prototype === Object.prototype || prototype === null ? value : null;
+	} catch {
+		return null;
+	}
+}
+function read(source, key) {
+	try {
+		if (!source || !Object.hasOwn(source, key)) return;
+		return source[key];
+	} catch {
+		return;
+	}
+}
+function safeArrayItems(value, maximum) {
+	try {
+		if (!Array.isArray(value)) return [];
+		const length = Math.min(value.length, maximum);
+		if (!Number.isSafeInteger(length) || length < 0) return [];
+		const items = [];
+		for (let index = 0; index < length; index += 1) try {
+			items.push(value[index]);
+		} catch {
+			items.push(void 0);
+		}
+		return items;
+	} catch {
+		return [];
+	}
+}
+function deepFreeze(value) {
+	if (value && typeof value === "object") {
+		Object.freeze(value);
+		for (const child of Object.values(value)) if (child && typeof child === "object" && !Object.isFrozen(child)) deepFreeze(child);
+	}
+	return value;
+}
+//#endregion
+//#region src/state-root.ts
+function resolveApplicationStateRoot(options) {
+	const paths = resolveLocalRuntimePaths({
+		appId: options.appId,
+		dataDirectory: options.dataDirectory,
+		sourceRoot: options.sourceRoot
+	});
+	const platformName = options.platformName || platform();
+	const homeDirectory = options.homeDirectory || homedir();
+	const environment = options.environment || process.env;
+	const stateBase = platformName === "darwin" ? join(homeDirectory, "Library", "Application Support") : platformName === "win32" ? environment.LOCALAPPDATA || homeDirectory : environment.XDG_STATE_HOME || join(homeDirectory, ".local", "state");
+	const dataIdentity = createHash("sha256").update(resolve(paths.root)).digest("hex").slice(0, 12);
+	return resolve(stateBase, `.${options.appId}-${dataIdentity}-state`);
+}
+function isInside$1(parent, child) {
+	const relative = child.slice(parent.length);
+	return child === parent || child.startsWith(parent) && (relative.startsWith("/") || relative.startsWith("\\"));
+}
+function prepareApplicationStateRoot(options) {
+	const sourceRoot = realpathSync(resolve(options.sourceRoot || process.cwd()));
+	const stateRoot = resolveApplicationStateRoot(options);
+	if (isInside$1(sourceRoot, stateRoot) || isInside$1(stateRoot, sourceRoot)) throw new Error("Application state must remain outside the source tree.");
+	const currentUid = options.currentUid ?? process.getuid?.();
+	let component = parse(stateRoot).root;
+	for (const part of stateRoot.slice(component.length).split(/[\\/]+/).filter(Boolean)) {
+		component = join(component, part);
+		try {
+			const details = lstatSync(component);
+			if (details.isSymbolicLink() || !details.isDirectory()) throw new Error(`Application state path component is unsafe: ${component}`);
+			const sharedStickyRoot = details.uid === 0 && (details.mode & 512) !== 0;
+			if (currentUid !== void 0 && (details.uid !== currentUid && details.uid !== 0 || (details.mode & 18) !== 0 && !sharedStickyRoot)) throw new Error(`Application state path lacks trusted custody: ${component}`);
+		} catch (error) {
+			if (errorCode(error) !== "ENOENT") throw error;
+			try {
+				mkdirSync(component, { mode: 448 });
+			} catch (mkdirError) {
+				if (errorCode(mkdirError) !== "EEXIST") throw mkdirError;
+			}
+			const created = lstatSync(component);
+			if (created.isSymbolicLink() || !created.isDirectory() || currentUid !== void 0 && created.uid !== currentUid || (created.mode & 511) !== 448) throw new Error(`Application state path component is unsafe: ${component}`);
+		}
+	}
+	const rootDetails = lstatSync(stateRoot);
+	if (rootDetails.isSymbolicLink() || !rootDetails.isDirectory() || currentUid !== void 0 && rootDetails.uid !== currentUid || (rootDetails.mode & 511) !== 448) throw new Error("Application state root must be current-user-owned mode 0700.");
+	const markerPath = join(stateRoot, `.smrt-state-${validateApplicationId(options.appId)}`);
+	let descriptor;
+	try {
+		descriptor = openSync(markerPath, constants$1.O_WRONLY | constants$1.O_CREAT | constants$1.O_EXCL, 384);
+	} catch (error) {
+		if (errorCode(error) !== "EEXIST") throw error;
+		const marker = lstatSync(markerPath);
+		if (marker.isSymbolicLink() || !marker.isFile() || marker.size !== 0 || currentUid !== void 0 && marker.uid !== currentUid || (marker.mode & 511) !== 384) throw new Error("Application state marker is unsafe.");
+	} finally {
+		if (descriptor !== void 0) closeSync(descriptor);
+	}
+	return stateRoot;
+}
+//#endregion
+//#region src/writer-lease.ts
+function validateRecord(record) {
+	const candidate = record;
+	if (candidate?.schemaVersion !== 1 || !Number.isSafeInteger(candidate.pid) || candidate.pid < 1 || typeof candidate.instance !== "string" || !/^[a-f0-9]{32}$/.test(candidate.instance)) throw new Error("The application writer lease is malformed.");
+	return candidate;
+}
+function readRecord(pathOrDescriptor) {
+	return validateRecord(JSON.parse(readFileSync(pathOrDescriptor, "utf8")));
+}
+function isStaleWriterLease(contents) {
+	try {
+		return !processExists(validateRecord(JSON.parse(contents)).pid);
+	} catch {
+		return false;
+	}
+}
+function readActiveWriterLease(stateRoot) {
+	const path = join(stateRoot, "writer.lease");
+	for (let attempt = 0; attempt < 4; attempt += 1) {
+		let observed;
+		let record;
+		try {
+			observed = readFileSync(path, "utf8");
+			record = validateRecord(JSON.parse(observed));
+		} catch (error) {
+			if (errorCode(error) === "ENOENT") return null;
+			throw new Error("The application writer lease cannot be verified; inspect the private state directory.");
+		}
+		if (processExists(record.pid)) return record;
+		if (reclaimStaleRecord(path, observed, isStaleWriterLease) !== "changed") return null;
+	}
+	throw new Error("The application writer lease changed repeatedly and cannot be verified.");
+}
+function acquireWriterLease(stateRoot, options = {}) {
+	mkdirSync(stateRoot, {
+		recursive: true,
+		mode: 448
+	});
+	const path = join(stateRoot, "writer.lease");
+	const active = readActiveWriterLease(stateRoot);
+	if (active?.pid === process.pid) return { release() {} };
+	if (active) throw new Error(`Another application writer is active (process ${active.pid}).`);
+	const instance = randomBytes(16).toString("hex");
+	let descriptor;
+	for (let attempt = 0; attempt < 2; attempt += 1) try {
+		descriptor = openSync(path, "wx", 384);
+		writeFileSync(descriptor, `${JSON.stringify({
+			schemaVersion: 1,
+			pid: process.pid,
+			instance
+		})}
+`);
+		break;
+	} catch (error) {
+		if (descriptor !== void 0) {
+			closeSync(descriptor);
+			descriptor = void 0;
+		}
+		if (errorCode(error) === "EEXIST") {
+			const owner = readActiveWriterLease(stateRoot);
+			if (!owner && attempt === 0) continue;
+			throw new Error(`Another application writer is active${owner ? ` (process ${owner.pid})` : ""}.`);
+		}
+		rmSync(path, { force: true });
+		throw error;
+	}
+	if (descriptor === void 0) throw new Error("The application writer lease could not be acquired.");
+	closeSync(descriptor);
+	let released = false;
+	const release = () => {
+		if (released) return;
+		released = true;
+		process.removeListener("exit", release);
+		try {
+			const current = readRecord(path);
+			if (current.pid === process.pid && current.instance === instance) rmSync(path, { force: true });
+		} catch {}
+	};
+	const operationPath = join(stateRoot, "operation.lock");
+	let observedOperation = null;
+	try {
+		observedOperation = readFileSync(operationPath, "utf8");
+	} catch (error) {
+		if (errorCode(error) !== "ENOENT") {
+			release();
+			throw error;
+		}
+	}
+	if (observedOperation !== null) {
+		let operation;
+		try {
+			operation = JSON.parse(observedOperation);
+		} catch {
+			operation = null;
+		}
+		if (!operation || !Number.isSafeInteger(operation.pid) || operation.pid < 1 || typeof operation.instance !== "string") {
+			release();
+			throw new Error("The application operation lock cannot be verified.");
+		}
+		if (!processExists(operation.pid)) {
+			let outcome;
+			try {
+				outcome = reclaimStaleRecord(operationPath, observedOperation, isStaleOperationLock);
+			} catch (error) {
+				release();
+				throw error;
+			}
+			if (outcome === "changed") {
+				release();
+				throw new Error("The application operation lock changed unexpectedly.");
+			}
+		} else if (operation.instance !== options.operationInstance) {
+			release();
+			throw new Error("An application operation is active; wait for it to finish before starting a writer.");
+		}
+	}
+	process.once("exit", release);
+	return { release };
+}
+//#endregion
+//#region src/index.ts
+var DEFAULT_BIND_HOST = "127.0.0.1";
+var DEFAULT_BOOTSTRAP_TTL_SECONDS = 600;
+var MAX_BOOTSTRAP_TTL_SECONDS = 900;
+var DEFAULT_SESSION_TTL_SECONDS = 10080 * 60;
+var BOOTSTRAP_TABLE = "_smrt_local_owner_bootstrap";
+var SECRET_FILE_NAME = "application.secret";
+var DATABASE_FILE_NAME = "application.sqlite";
+var ROOT_MARKER_PREFIX = ".smrt-local-runtime-";
+var PREFLIGHT_RETRY_LIMIT = 4;
+var INITIALIZATION_LOCK_TIMEOUT_MS = 12e4;
+var INITIALIZATION_LOCK_WORKER = `
+  const { parentPort, workerData } = require('node:worker_threads');
+  let database;
+  let transaction;
+  (async () => {
+    try {
+      const { getDatabase } = await import(workerData.sqlModuleUrl);
+      database = await getDatabase({
+        type: 'sqlite',
+        url: workerData.path,
+        secureFile: {
+          driver: 'node:sqlite',
+          custody: 'trusted-parent',
+          root: workerData.custodyRoot,
+        },
+        transactionQueueTimeout: workerData.timeout,
+      });
+      if (!database.beginTransaction) {
+        throw new Error('Secure SQLite does not expose beginTransaction().');
+      }
+      await database.query('PRAGMA busy_timeout = ' + workerData.timeout);
+      transaction = await database.beginTransaction();
+      parentPort.postMessage({ type: 'acquired' });
+    } catch (error) {
+      try { await database?.close?.(); } catch {}
+      parentPort.postMessage({ type: 'error', message: String(error) });
+      parentPort.close();
+      return;
+    }
+    parentPort.once('message', async (message) => {
+      if (message?.type !== 'release') return;
+      let releaseError;
+      try { await transaction.rollback(); } catch (error) { releaseError = String(error); }
+      try { await database.close?.(); } catch (error) { releaseError ??= String(error); }
+      parentPort.postMessage({ type: 'released', error: releaseError });
+      parentPort.close();
+    });
+  })().catch((error) => {
+    parentPort.postMessage({ type: 'error', message: String(error) });
+    parentPort.close();
+  });
+`;
+var execFileAsync = promisify(execFile);
+async function prepareLocalDatabaseStorage(options) {
+	const paths = resolveLocalRuntimePaths(options);
+	const sourceRoot = resolve(options.sourceRoot ?? process.cwd());
+	const appId = validateApplicationId(options.appId);
+	await preflightLocalApplicationRoot(paths.root, sourceRoot, appId);
+	const initializationLock = await acquireInitializationLock(paths.root);
+	let db;
+	let failure;
+	try {
+		await preflightLocalApplicationRoot(paths.root, sourceRoot, appId);
+		db = (await acquireLocalDatabase(paths, sourceRoot, appId)).db;
+		await db.close?.();
+		db = void 0;
+	} catch (error) {
+		failure = db ? await closeDatabaseAfterFailure(db, error) : error;
+		db = void 0;
+	}
+	try {
+		await initializationLock.release();
+	} catch (releaseError) {
+		failure = failure ? preservePrimaryFailure(failure, releaseError, "initializationLockReleaseError", "Local database storage preparation and initialization-lock release both failed.") : releaseError;
+	}
+	if (failure) throw failure;
+	return paths;
+}
+async function validateLocalDatabaseStorage(options) {
+	const paths = resolveLocalRuntimePaths(options);
+	const sourceRoot = resolve(options.sourceRoot ?? process.cwd());
+	const appId = validateApplicationId(options.appId);
+	await preflightLocalApplicationRoot(paths.root, sourceRoot, appId);
+	const canonicalSourceRoot = await realpath(sourceRoot);
+	await validateRootMarker(resolve(paths.root, `${ROOT_MARKER_PREFIX}${appId}`), canonicalSourceRoot);
+	await validateExistingPathChain(paths.database, canonicalSourceRoot, "file");
+	const database = await lstat(paths.database);
+	const currentUid = process.getuid?.();
+	if (database.isSymbolicLink() || !database.isFile() || currentUid !== void 0 && database.uid !== currentUid || (database.mode & 511) !== 384) throw unsafeFilesystemEntry(`Local application database must be a current-user-owned mode-0600 file: ${paths.database}`);
+	return paths;
+}
+var MIGRATION_FAILED_MESSAGE = "The application migration step failed; run pnpm app:setup and inspect the private migration logs.";
+var LocalRuntimeError = class extends Error {
+	constructor(code, message) {
+		super(message);
+		this.code = code;
+		this.name = "LocalRuntimeError";
+	}
+	code;
+};
+function resolveLocalRuntimePaths(options) {
+	const appId = validateApplicationId(options.appId);
+	const runtimePlatform = options.platform ?? platform();
+	const runtimeHome = options.homeDirectory ?? homedir();
+	const defaultRoot = defaultApplicationDataRoot(runtimePlatform, runtimeHome, options.env ?? process.env);
+	const root = resolve(options.dataDirectory ?? resolve(defaultRoot, appId));
+	const sourceRoot = resolve(options.sourceRoot ?? process.cwd());
+	if (sameFilesystemPath(root, runtimeHome, runtimePlatform) || sameFilesystemPath(root, parse(root).root, runtimePlatform) || isInside(sourceRoot, root, runtimePlatform) || isInside(root, sourceRoot, runtimePlatform)) throw new LocalRuntimeError("invalid_configuration", "Local application data must be a dedicated directory that does not overlap the source tree.");
+	return Object.freeze({
+		root,
+		database: resolve(root, DATABASE_FILE_NAME),
+		assets: resolve(root, "assets"),
+		secrets: resolve(root, "secrets"),
+		applicationSecret: resolve(root, "secrets", SECRET_FILE_NAME)
+	});
+}
+async function initializeLocalApplicationRuntime(options) {
+	const bindHost = normalizeLoopbackHost(options.bindHost ?? DEFAULT_BIND_HOST);
+	const bootstrapTtlSeconds = validateBootstrapTtl(options.bootstrapTtlSeconds ?? DEFAULT_BOOTSTRAP_TTL_SECONDS);
+	const sessionTtlSeconds = validateSessionTtl(options.sessionTtlSeconds ?? DEFAULT_SESSION_TTL_SECONDS);
+	const resolvedRuntime = resolveApplicationRuntime({
+		profile: "local",
+		providers: options.providers
+	});
+	const paths = resolveLocalRuntimePaths(options);
+	const sourceRoot = resolve(options.sourceRoot ?? process.cwd());
+	const appId = validateApplicationId(options.appId);
+	await preflightLocalApplicationRoot(paths.root, sourceRoot, appId);
+	const initializationLock = await acquireInitializationLock(paths.root);
+	let db;
+	let initialization;
+	let initializationFailure;
+	let initializationFailed = false;
+	try {
+		await preflightLocalApplicationRoot(paths.root, sourceRoot, appId);
+		const acquired = await acquireLocalDatabase(paths, sourceRoot, appId);
+		db = acquired.db;
+		const { canonicalSourceRoot } = acquired;
+		await prepareLocalFilesystem(paths, canonicalSourceRoot);
+		await tuneLocalSqlite(db);
+		try {
+			await options.prepareDatabase?.(db);
+		} catch (migrationFailure) {
+			throw migrationFailed(migrationFailure);
+		}
+		await ensureBootstrapTable(db);
+		const runtime = new InitializedLocalApplicationRuntime({
+			db,
+			paths,
+			bindHost,
+			resolvedRuntime,
+			bootstrapTtlSeconds,
+			sessionTtlSeconds,
+			backgroundJobs: options.backgroundJobs === true,
+			paidCapabilities: options.paidCapabilities === true,
+			now: options.now ?? (() => /* @__PURE__ */ new Date()),
+			canonicalSourceRoot
+		});
+		initialization = {
+			runtime,
+			bootstrap: await runtime.ensureBootstrapInvitation(),
+			diagnostics: await runtime.diagnostics()
+		};
+	} catch (error) {
+		initializationFailed = true;
+		initializationFailure = db ? await closeDatabaseAfterFailure(db, error) : error;
+		db = void 0;
+	}
+	try {
+		await initializationLock.release();
+	} catch (releaseError) {
+		if (initializationFailed) initializationFailure = preservePrimaryFailure(initializationFailure, releaseError, "initializationLockReleaseError", "Local runtime initialization and initialization-lock release both failed.");
+		else if (db) {
+			initializationFailed = true;
+			initializationFailure = await closeDatabaseAfterFailure(db, releaseError);
+			db = void 0;
+		} else {
+			initializationFailed = true;
+			initializationFailure = releaseError;
+		}
+	}
+	if (initializationFailed) throw initializationFailure;
+	if (!initialization) throw new Error("Local runtime initialization completed without a result.");
+	return initialization;
+}
+var InitializedLocalApplicationRuntime = class {
+	db;
+	paths;
+	bindHost;
+	resolvedRuntime;
+	backgroundJobsEnabled;
+	paidCapabilitiesEnabled;
+	bootstrapTtlSeconds;
+	sessionTtlSeconds;
+	now;
+	canonicalSourceRoot;
+	constructor(state) {
+		this.db = state.db;
+		this.paths = state.paths;
+		this.bindHost = state.bindHost;
+		this.resolvedRuntime = state.resolvedRuntime;
+		this.bootstrapTtlSeconds = state.bootstrapTtlSeconds;
+		this.sessionTtlSeconds = state.sessionTtlSeconds;
+		this.backgroundJobsEnabled = state.backgroundJobs;
+		this.paidCapabilitiesEnabled = state.paidCapabilities;
+		this.now = state.now;
+		this.canonicalSourceRoot = state.canonicalSourceRoot;
+	}
+	/**
+	* Issue the first short-lived owner invitation when none is active.
+	* Repeated startup never rotates an unexpired token or duplicates an owner.
+	*/
+	async ensureBootstrapInvitation() {
+		if (await findExistingOwner(this.db)) return null;
+		const current = await readBootstrapRow(this.db);
+		if (current?.consumed_at != null) return null;
+		const now = this.now();
+		const currentExpiry = parseStoredDate(current?.expires_at);
+		if (current && current.consumed_at == null && currentExpiry !== null && currentExpiry.getTime() > now.getTime()) return null;
+		return this.issueBootstrapInvitation(false);
+	}
+	/** Explicit recovery when an installer lost the one-time plaintext token. */
+	async rotateBootstrapInvitation() {
+		if (await findExistingOwner(this.db)) throw new LocalRuntimeError("bootstrap_claimed", "The local owner has already been claimed.");
+		if ((await readBootstrapRow(this.db))?.consumed_at != null) throw new LocalRuntimeError("bootstrap_claimed", "The local owner bootstrap invitation has already been consumed.");
+		const invitation = await this.issueBootstrapInvitation(true);
+		if (!invitation) {
+			if ((await readBootstrapRow(this.db))?.consumed_at != null) throw new LocalRuntimeError("bootstrap_claimed", "The local owner bootstrap invitation has already been consumed.");
+			throw new LocalRuntimeError("bootstrap_unavailable", "A local owner bootstrap invitation could not be issued.");
+		}
+		return invitation;
+	}
+	/**
+	* Consume a bootstrap token and atomically create normal identity/RBAC/session
+	* records. The token transition and every record write share one transaction.
+	*/
+	async claimOwner(input) {
+		validateOwnerInput(input);
+		if (await findExistingOwner(this.db)) throw new LocalRuntimeError("bootstrap_claimed", "The local owner has already been claimed.");
+		if (typeof this.db.transaction !== "function") throw new LocalRuntimeError("bootstrap_unavailable", "Owner bootstrap requires a database adapter with transaction support.");
+		const tokenHash = await this.hashBootstrapToken(input.token);
+		const now = this.now();
+		const nowIso = now.toISOString();
+		if (!await isBootstrapTokenClaimable(this.db, tokenHash, nowIso)) await throwBootstrapClaimFailure(this.db, now);
+		await (await RoleCollection.create({ db: this.db })).seedSystemRoles({ seedPermissions: true });
+		return this.db.transaction(async (tx) => {
+			if ((await tx.query(`UPDATE ${BOOTSTRAP_TABLE}
+         SET consumed_at = ?
+         WHERE slot = 1
+           AND token_hash = ?
+           AND consumed_at IS NULL
+           AND expires_at > ?
+         RETURNING expires_at`, nowIso, tokenHash, nowIso)).rows.length === 0) await throwBootstrapClaimFailure(tx, now);
+			if (await findExistingOwner(tx)) throw new LocalRuntimeError("bootstrap_claimed", "The local owner has already been claimed.");
+			return createLocalOwnerRecords(tx, input, this.sessionTtlSeconds);
+		});
+	}
+	/** Restore the normal server-side session created by owner bootstrap. */
+	async restoreSession(sessionId) {
+		const service = new SessionService({ db: this.db });
+		await service.initialize();
+		return service.loadSessionContext(sessionId);
+	}
+	/**
+	* Create an in-process persisted-job runner. Background work is default-off
+	* and must be explicitly enabled by runtime configuration.
+	*/
+	async createEmbeddedJobRunner(config = {}) {
+		if (!this.backgroundJobsEnabled) throw new LocalRuntimeError("capability_disabled", "Background jobs are disabled; enable them explicitly for this local application.");
+		if (this.resolvedRuntime.providers.jobs.topology !== "embedded") throw new LocalRuntimeError("invalid_configuration", "An embedded runner requires the local embedded job topology.");
+		const runner = new TaskRunner({
+			concurrency: 1,
+			retention: false,
+			...config
+		});
+		await runner.initialize(this.db);
+		return runner;
+	}
+	/** Return a deterministic snapshot that never reads secret file contents. */
+	async diagnostics() {
+		const owner = await findExistingOwner(this.db);
+		const bootstrap = await readBootstrapRow(this.db);
+		const now = this.now();
+		const expiresAt = parseStoredDate(bootstrap?.expires_at);
+		let status = "unavailable";
+		if (owner || bootstrap?.consumed_at != null) status = "claimed";
+		else if (expiresAt && expiresAt.getTime() > now.getTime()) status = "available";
+		else if (expiresAt) status = "expired";
+		return Object.freeze({
+			schemaVersion: 1,
+			runtime: this.resolvedRuntime,
+			bind: Object.freeze({
+				host: this.bindHost,
+				loopback: true
+			}),
+			paths: this.paths,
+			storage: Object.freeze({
+				database: "sqlite-file",
+				assets: "user-owned-directory",
+				secrets: "mode-0600-local-file"
+			}),
+			bootstrap: Object.freeze({
+				status,
+				expiresAt: expiresAt?.toISOString() ?? null,
+				tokenValuesIncluded: false,
+				tokenHashesIncluded: false
+			}),
+			tenancy: Object.freeze({
+				mode: "real-default-tenant",
+				ui: "hidden"
+			}),
+			jobs: Object.freeze({
+				topology: this.resolvedRuntime.providers.jobs.topology,
+				backgroundEnabled: this.backgroundJobsEnabled
+			}),
+			paidCapabilitiesEnabled: this.paidCapabilitiesEnabled,
+			secretValuesIncluded: false
+		});
+	}
+	async issueBootstrapInvitation(replaceActive) {
+		const token = randomBytes(32).toString("base64url");
+		const tokenHash = await this.hashBootstrapToken(token);
+		const now = this.now();
+		const expiresAt = new Date(now.getTime() + this.bootstrapTtlSeconds * 1e3);
+		if ((await this.db.query(`INSERT INTO ${BOOTSTRAP_TABLE}
+        (slot, token_hash, expires_at, consumed_at, created_at)
+       VALUES (1, ?, ?, NULL, ?)
+       ON CONFLICT(slot) DO UPDATE SET
+         token_hash = excluded.token_hash,
+         expires_at = excluded.expires_at,
+         consumed_at = NULL,
+         created_at = excluded.created_at
+       WHERE ${BOOTSTRAP_TABLE}.consumed_at IS NULL
+         AND (? = 1 OR ${BOOTSTRAP_TABLE}.expires_at <= ?)
+       RETURNING token_hash`, tokenHash, expiresAt.toISOString(), now.toISOString(), replaceActive ? 1 : 0, now.toISOString())).rows[0]?.token_hash !== tokenHash) return null;
+		return Object.freeze({
+			token,
+			expiresAt: expiresAt.toISOString()
+		});
+	}
+	async hashBootstrapToken(token) {
+		return createHmac("sha256", (await validateApplicationSecret(this.paths.applicationSecret, this.canonicalSourceRoot)).trim()).update(token).digest("hex");
+	}
+};
+async function createLocalOwnerRecords(db, input, sessionTtlSeconds) {
+	const profileTypes = await ProfileTypeCollection.create({ db });
+	const person = new Person({
+		db,
+		typeId: requireId((await withSystemContext(() => profileTypes.getOrCreateGlobalBySlug("person", {
+			name: "Person",
+			description: "An individual person"
+		}))).id, "Person profile type"),
+		tenantId: null,
+		name: input.name.trim(),
+		email: input.email.trim()
+	});
+	await person.initialize();
+	await person.save();
+	const user = await (await UserCollection.create({ db })).create({
+		profileId: requireId(person.id, "Person"),
+		email: input.email.trim(),
+		status: UserStatus.ACTIVE,
+		lastLoginAt: /* @__PURE__ */ new Date()
+	});
+	await user.save();
+	const tenantService = new TenantService({ db }, {
+		mode: "required",
+		maxTenants: 1,
+		defaultName: input.tenantName?.trim() || "My Workspace"
+	});
+	await tenantService.initialize();
+	const { tenant, membership } = await tenantService.createTenantWithOwnership(requireId(user.id, "User"), input.tenantName?.trim() || "My Workspace", { slug: "default" });
+	const session = await (await SessionCollection.create({ db })).createSession({
+		userId: requireId(user.id, "User"),
+		tenantId: requireId(tenant.id, "Tenant"),
+		ttl: sessionTtlSeconds,
+		userAgent: input.userAgent,
+		ipAddress: input.ipAddress,
+		data: { localOwner: true }
+	});
+	return Object.freeze({
+		profileId: requireId(person.id, "Person"),
+		userId: requireId(user.id, "User"),
+		tenantId: requireId(tenant.id, "Tenant"),
+		membershipId: requireId(membership.id, "Membership"),
+		sessionId: requireId(session.id, "Session")
+	});
+}
+async function findExistingOwner(db) {
+	const ownerRole = await (await RoleCollection.create({ db })).findSystemRoleBySlug(DEFAULT_ROLE_SLUGS.OWNER);
+	if (!ownerRole?.id) return null;
+	const active = (await (await MembershipCollection.create({ db })).findByRole(ownerRole.id)).find((membership) => membership.status === MembershipStatus.ACTIVE && typeof membership.userId === "string" && typeof membership.tenantId === "string");
+	return active ? {
+		userId: active.userId,
+		tenantId: active.tenantId
+	} : null;
+}
+async function throwBootstrapClaimFailure(db, now) {
+	const row = await readBootstrapRow(db);
+	if (!row) throw new LocalRuntimeError("bootstrap_unavailable", "No local owner bootstrap invitation is available.");
+	if (row.consumed_at != null) throw new LocalRuntimeError("bootstrap_claimed", "The local owner bootstrap invitation has already been consumed.");
+	const expiresAt = parseStoredDate(row.expires_at);
+	if (!expiresAt || expiresAt.getTime() <= now.getTime()) throw new LocalRuntimeError("bootstrap_expired", "The local owner bootstrap invitation has expired.");
+	throw new LocalRuntimeError("bootstrap_invalid", "The local owner bootstrap token is invalid.");
+}
+async function isBootstrapTokenClaimable(db, tokenHash, nowIso) {
+	return (await db.query(`SELECT 1 AS claimable
+     FROM ${BOOTSTRAP_TABLE}
+     WHERE slot = 1
+       AND token_hash = ?
+       AND consumed_at IS NULL
+       AND expires_at > ?
+     LIMIT 1`, tokenHash, nowIso)).rows.length > 0;
+}
+async function readBootstrapRow(db) {
+	return (await db.query(`SELECT expires_at, consumed_at
+     FROM ${BOOTSTRAP_TABLE}
+     WHERE slot = 1
+     LIMIT 1`)).rows[0] ?? null;
+}
+async function ensureBootstrapTable(db) {
+	await db.query(`CREATE TABLE IF NOT EXISTS ${BOOTSTRAP_TABLE} (
+      slot INTEGER PRIMARY KEY CHECK (slot = 1),
+      token_hash TEXT NOT NULL,
+      expires_at TEXT NOT NULL,
+      consumed_at TEXT NULL,
+      created_at TEXT NOT NULL
+    )`);
+}
+async function tuneLocalSqlite(db) {
+	await db.query("PRAGMA foreign_keys = ON");
+	await db.query("PRAGMA journal_mode = WAL");
+	await db.query("PRAGMA synchronous = FULL");
+	await db.query("PRAGMA busy_timeout = 5000");
+}
+async function preflightLocalApplicationRoot(root, sourceRoot, appId) {
+	for (let attempt = 0; attempt < PREFLIGHT_RETRY_LIMIT; attempt += 1) try {
+		await preflightLocalApplicationRootOnce(root, sourceRoot, appId);
+		return;
+	} catch (error) {
+		if (!isMissingFile(error) && !hasMissingFileCause(error)) throw error;
+		if (attempt === PREFLIGHT_RETRY_LIMIT - 1) throw unsafeFilesystemEntry("Local application data changed repeatedly during read-only preflight.", error);
+		await new Promise((resolveRetry) => setImmediate(resolveRetry));
+	}
+}
+async function preflightLocalApplicationRootOnce(root, sourceRoot, appId) {
+	requireNoFollowSupport();
+	const canonicalSourceRoot = await realpath(sourceRoot);
+	const currentUid = process.getuid?.();
+	if (currentUid === void 0) throw unsafeFilesystemEntry("Local runtime storage requires a numeric current-user identity.");
+	if (isInside(canonicalSourceRoot, root) || isInside(root, canonicalSourceRoot)) throw unsafeFilesystemEntry("Local application data must remain outside the canonical source tree.");
+	let rootExists = true;
+	for (const component of absolutePathComponents(root)) {
+		let details;
+		try {
+			details = await lstat(component);
+		} catch (error) {
+			if (!isMissingFile(error)) throw error;
+			rootExists = false;
+			break;
+		}
+		if (details.isSymbolicLink() || !details.isDirectory()) throw unsafeFilesystemEntry(`Local runtime path component must be a real directory: ${component}`);
+		await assertCanonicalEntry(component, canonicalSourceRoot);
+		const sharedStickyRoot = details.uid === 0 && (details.mode & 512) !== 0;
+		if (details.uid !== currentUid && details.uid !== 0 || (details.mode & 18) !== 0 && !sharedStickyRoot) throw unsafeFilesystemEntry(`Local runtime path ancestry does not have trusted-parent custody: ${component}`);
+		await assertNoPermissiveDarwinAcl(component);
+	}
+	if (!rootExists) return;
+	const rootDetails = await lstat(root);
+	if (rootDetails.uid !== currentUid || (rootDetails.mode & 511) !== 448) throw unsafeFilesystemEntry(`Existing local application data root must already be owned by the current user with mode 0700: ${root}`);
+	await preflightDedicatedRoot(root, canonicalSourceRoot, appId);
+}
+async function preflightDedicatedRoot(root, canonicalSourceRoot, appId) {
+	const finalMarker = resolve(root, `${ROOT_MARKER_PREFIX}${appId}`);
+	const pendingMarker = resolve(root, `${ROOT_MARKER_PREFIX}${appId}.pending`);
+	const entries = await readdir(root);
+	const finalMarkerName = finalMarker.slice(root.length + 1);
+	const pendingMarkerName = pendingMarker.slice(root.length + 1);
+	const hasFinalMarker = entries.includes(finalMarkerName);
+	const hasPendingMarker = entries.includes(pendingMarkerName);
+	if (hasFinalMarker) {
+		await validateRootMarker(finalMarker, canonicalSourceRoot);
+		if (hasPendingMarker) await validateRootMarker(pendingMarker, canonicalSourceRoot);
+		return;
+	}
+	if (hasPendingMarker) {
+		await validateRootMarker(pendingMarker, canonicalSourceRoot);
+		const permittedInterruptedEntries = /* @__PURE__ */ new Set([
+			pendingMarkerName,
+			DATABASE_FILE_NAME,
+			`${DATABASE_FILE_NAME}-shm`,
+			`${DATABASE_FILE_NAME}-wal`
+		]);
+		if (entries.some((entry) => !permittedInterruptedEntries.has(entry))) throw unsafeFilesystemEntry("Interrupted local application root contains unexpected artifacts.");
+		return;
+	}
+	if (entries.length > 0) throw unsafeFilesystemEntry("Existing local application data root is populated but has no valid ownership marker.");
+}
+async function assertNoPermissiveDarwinAcl(path) {
+	if (platform() !== "darwin") return;
+	let listing;
+	try {
+		listing = (await execFileAsync("/bin/ls", [
+			"-lde",
+			"--",
+			path
+		], {
+			encoding: "utf8",
+			env: {
+				...process.env,
+				LC_ALL: "C"
+			}
+		})).stdout;
+	} catch (error) {
+		throw unsafeFilesystemEntry(`Local runtime could not inspect macOS access controls: ${path}`, error);
+	}
+	for (const line of listing.split("\n")) {
+		if (!/^\s*\d+:/.test(line)) continue;
+		if (line.match(/^\s*\d+:\s+.+\s+(allow|deny)\s+\S.*$/)?.[1] !== "deny") throw unsafeFilesystemEntry(`Local runtime path contains a permissive macOS access control list: ${path}`);
+	}
+}
+async function acquireLocalDatabase(paths, sourceRoot, appId) {
+	requireNoFollowSupport();
+	const canonicalSourceRoot = await realpath(sourceRoot);
+	const createdDirectories = await ensureSafeDirectoryTree(paths.root, canonicalSourceRoot, true);
+	const prepared = await prepareDedicatedRoot(paths.root, canonicalSourceRoot, appId, createdDirectories);
+	let db;
+	try {
+		db = await getDatabase({
+			type: "sqlite",
+			url: paths.database,
+			secureFile: {
+				driver: "node:sqlite",
+				custody: "trusted-parent",
+				root: paths.root
+			}
+		});
+		await enforcePrivateDatabaseMode(paths.database, canonicalSourceRoot);
+	} catch (error) {
+		if (db) throw await closeDatabaseAfterFailure(db, error);
+		if (prepared.pendingMarkerCreatedByAttempt) {
+			await removeMarkerIfPresent(prepared.pendingMarker, canonicalSourceRoot);
+			await removeCreatedDirectories(createdDirectories);
+		}
+		throw error;
+	}
+	if (!db) throw new Error("Local runtime database acquisition returned no database.");
+	try {
+		await publishRootMarker(prepared.finalMarker, canonicalSourceRoot);
+		await removeMarkerIfPresent(prepared.pendingMarker, canonicalSourceRoot);
+	} catch (error) {
+		throw await closeDatabaseAfterFailure(db, error);
+	}
+	return {
+		canonicalSourceRoot,
+		db
+	};
+}
+async function enforcePrivateDatabaseMode(path, canonicalSourceRoot) {
+	const database = await openSafeFile(path, constants.O_RDWR, 384, "Local application database", canonicalSourceRoot);
+	try {
+		await database.chmod(384);
+		await database.sync();
+	} finally {
+		await database.close();
+	}
+}
+async function closeDatabaseAfterFailure(db, primaryFailure) {
+	try {
+		await db.close?.();
+	} catch (cleanupFailure) {
+		return preservePrimaryFailure(primaryFailure, cleanupFailure, "databaseCleanupError", "Local runtime initialization and database cleanup both failed.");
+	}
+	return primaryFailure;
+}
+function migrationFailed(cause) {
+	const failure = new LocalRuntimeError("migration_failed", MIGRATION_FAILED_MESSAGE);
+	Object.defineProperty(failure, "cause", {
+		value: cause,
+		configurable: true
+	});
+	return failure;
+}
+function preservePrimaryFailure(primaryFailure, secondaryFailure, secondaryProperty, aggregateMessage) {
+	if (primaryFailure instanceof Error) {
+		try {
+			Object.defineProperty(primaryFailure, secondaryProperty, {
+				value: secondaryFailure,
+				configurable: true
+			});
+		} catch {}
+		return primaryFailure;
+	}
+	return new AggregateError([primaryFailure, secondaryFailure], aggregateMessage);
+}
+async function prepareLocalFilesystem(paths, canonicalSourceRoot) {
+	await ensureSafeDirectoryTree(paths.assets, canonicalSourceRoot);
+	await ensureSafeDirectoryTree(paths.secrets, canonicalSourceRoot);
+	await ensureApplicationSecret(paths.applicationSecret, canonicalSourceRoot);
+}
+async function prepareDedicatedRoot(path, canonicalSourceRoot, appId, createdDirectories) {
+	const finalMarker = resolve(path, `${ROOT_MARKER_PREFIX}${appId}`);
+	const pendingMarker = resolve(path, `${ROOT_MARKER_PREFIX}${appId}.pending`);
+	const entries = await readdir(path);
+	const hasFinalMarker = entries.includes(finalMarker.slice(path.length + 1));
+	const hasPendingMarker = entries.includes(pendingMarker.slice(path.length + 1));
+	if (hasFinalMarker) {
+		await validateRootMarker(finalMarker, canonicalSourceRoot);
+		if (hasPendingMarker) await validateRootMarker(pendingMarker, canonicalSourceRoot);
+		return {
+			createdDirectories,
+			pendingMarker: hasPendingMarker ? pendingMarker : null,
+			pendingMarkerCreatedByAttempt: false,
+			finalMarker
+		};
+	}
+	if (hasPendingMarker) {
+		await validateRootMarker(pendingMarker, canonicalSourceRoot);
+		const permittedInterruptedEntries = /* @__PURE__ */ new Set([
+			pendingMarker.slice(path.length + 1),
+			DATABASE_FILE_NAME,
+			`${DATABASE_FILE_NAME}-shm`,
+			`${DATABASE_FILE_NAME}-wal`
+		]);
+		if (entries.some((entry) => !permittedInterruptedEntries.has(entry))) throw unsafeFilesystemEntry("Interrupted local application root contains unexpected artifacts.");
+		return {
+			createdDirectories,
+			pendingMarker,
+			pendingMarkerCreatedByAttempt: false,
+			finalMarker
+		};
+	}
+	if (entries.length > 0) throw unsafeFilesystemEntry("Existing local application data root is populated but has no valid ownership marker.");
+	return {
+		createdDirectories,
+		pendingMarker,
+		pendingMarkerCreatedByAttempt: await publishRootMarker(pendingMarker, canonicalSourceRoot),
+		finalMarker
+	};
+}
+async function acquireInitializationLock(root) {
+	const currentUid = process.getuid?.();
+	if (currentUid === void 0) throw unsafeFilesystemEntry("Local runtime initialization locks require a numeric current-user identity.");
+	const lockRoot = resolve(await realpath("/tmp"), `.smrt-${currentUid}`);
+	try {
+		await mkdir(lockRoot, { mode: 448 });
+	} catch (error) {
+		if (!isFileAlreadyExists(error)) throw error;
+	}
+	const lockRootDetails = await lstat(lockRoot);
+	if (!lockRootDetails.isDirectory() || lockRootDetails.isSymbolicLink() || lockRootDetails.uid !== currentUid || (lockRootDetails.mode & 511) !== 448) throw unsafeFilesystemEntry(`Local runtime lock directory must be current-user-owned with mode 0700: ${lockRoot}`);
+	const custodyRoot = resolve(lockRoot, createHash("sha256").update(normalizeFilesystemIdentity(root)).digest("hex").slice(0, 32));
+	try {
+		await mkdir(custodyRoot, { mode: 448 });
+	} catch (error) {
+		if (!isFileAlreadyExists(error)) throw error;
+	}
+	return acquireInitializationDatabaseLease(resolve(custodyRoot, "initialization.sqlite"), custodyRoot);
+}
+async function acquireInitializationDatabaseLease(path, custodyRoot) {
+	const worker = new Worker(INITIALIZATION_LOCK_WORKER, {
+		eval: true,
+		workerData: {
+			path,
+			custodyRoot,
+			timeout: INITIALIZATION_LOCK_TIMEOUT_MS,
+			sqlModuleUrl: import.meta.resolve("@happyvertical/sql")
+		}
+	});
+	const acquisitionFailure = (cause) => {
+		const failure = new LocalRuntimeError("invalid_configuration", "Could not acquire the local runtime initialization lease within two minutes.");
+		Object.defineProperty(failure, "cause", { value: cause });
+		return failure;
+	};
+	let workerError;
+	const exited = new Promise((_resolve, reject) => {
+		worker.once("error", (error) => {
+			workerError = error;
+		});
+		worker.once("exit", (code) => {
+			reject(acquisitionFailure(workerError ?? /* @__PURE__ */ new Error(`Initialization lock worker exited ${code}.`)));
+		});
+	});
+	const acquired = new Promise((resolvePromise, reject) => {
+		const onMessage = (message) => {
+			if (message.type === "acquired") {
+				worker.off("message", onMessage);
+				resolvePromise();
+			} else if (message.type === "error") {
+				worker.off("message", onMessage);
+				reject(acquisitionFailure(new Error(message.message)));
+			}
+		};
+		worker.on("message", onMessage);
+	});
+	await Promise.race([acquired, exited]);
+	let released = false;
+	return { release: async () => {
+		if (released) return;
+		released = true;
+		const releaseCompleted = new Promise((resolvePromise, reject) => {
+			const onMessage = (message) => {
+				if (message.type !== "released") return;
+				worker.off("message", onMessage);
+				if (message.error) reject(new Error(message.error));
+				else resolvePromise();
+			};
+			worker.on("message", onMessage);
+			worker.postMessage({ type: "release" });
+		});
+		try {
+			await Promise.race([releaseCompleted, exited]);
+		} finally {
+			await worker.terminate();
+		}
+	} };
+}
+async function ensureSafeDirectoryTree(path, canonicalSourceRoot, dedicatedRoot = false) {
+	const components = absolutePathComponents(path);
+	const createdDirectories = [];
+	for (const component of components) {
+		let created = false;
+		try {
+			const details = await lstat(component);
+			if (details.isSymbolicLink() || !details.isDirectory()) throw unsafeFilesystemEntry(`Local runtime path component must be a real directory: ${component}`);
+		} catch (error) {
+			if (!isMissingFile(error)) throw error;
+			try {
+				await mkdir(component, { mode: 448 });
+				created = true;
+				createdDirectories.push(component);
+			} catch (mkdirError) {
+				if (!isFileAlreadyExists(mkdirError)) throw mkdirError;
+			}
+		}
+		const directory = await openSafeDirectory(component, canonicalSourceRoot);
+		try {
+			await assertCanonicalEntry(component, canonicalSourceRoot);
+			if (component === path && dedicatedRoot && !created) await assertExistingDedicatedRoot(directory, component, canonicalSourceRoot);
+			if (created || component === path && !dedicatedRoot) await directory.chmod(448);
+		} finally {
+			await directory.close();
+		}
+	}
+	await validateExistingPathChain(path, canonicalSourceRoot, "directory");
+	return createdDirectories;
+}
+async function assertExistingDedicatedRoot(directory, path, canonicalSourceRoot) {
+	const canonical = await realpath(path);
+	if (isInside(canonicalSourceRoot, canonical) || isInside(canonical, canonicalSourceRoot)) throw unsafeFilesystemEntry("Local application data must be a dedicated directory that does not overlap the canonical source tree.");
+	const details = await directory.stat();
+	const currentUid = process.getuid?.();
+	if (currentUid === void 0 || details.uid !== currentUid || (details.mode & 511) !== 448) throw unsafeFilesystemEntry(`Existing local application data root must already be owned by the current user with mode 0700: ${path}`);
+}
+async function publishRootMarker(path, canonicalSourceRoot) {
+	let marker;
+	let created = false;
+	try {
+		marker = await openSafeFile(path, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 384, "Local application root marker", canonicalSourceRoot);
+		created = true;
+		await marker.sync();
+	} catch (error) {
+		if (!isFileAlreadyExists(error)) throw error;
+	} finally {
+		await marker?.close();
+	}
+	await validateRootMarker(path, canonicalSourceRoot);
+	await syncDirectory(resolve(path, ".."), canonicalSourceRoot);
+	return created;
+}
+async function validateRootMarker(path, canonicalSourceRoot) {
+	await validateExistingPathChain(path, canonicalSourceRoot, "file");
+	const marker = await openSafeFile(path, constants.O_RDONLY, 384, "Local application root marker", canonicalSourceRoot);
+	try {
+		const details = await marker.stat();
+		const currentUid = process.getuid?.();
+		if (currentUid === void 0 || details.uid !== currentUid || (details.mode & 511) !== 384 || details.size !== 0) throw unsafeFilesystemEntry(`Local application root marker must be an empty current-user-owned mode-0600 file: ${path}`);
+	} finally {
+		await marker.close();
+	}
+}
+async function removeMarkerIfPresent(path, canonicalSourceRoot) {
+	if (path === null) return;
+	try {
+		await validateRootMarker(path, canonicalSourceRoot);
+		await unlink(path);
+		await syncDirectory(resolve(path, ".."), canonicalSourceRoot);
+	} catch (error) {
+		if (!isMissingFile(error) && !hasMissingFileCause(error)) throw error;
+	}
+}
+async function removeCreatedDirectories(paths) {
+	for (const path of paths.toReversed()) try {
+		await rmdir(path);
+	} catch (error) {
+		if (!isMissingFile(error) && !isDirectoryNotEmpty(error)) throw error;
+	}
+}
+async function ensureApplicationSecret(path, canonicalSourceRoot) {
+	const directoryPath = resolve(path, "..");
+	const temporaryPath = resolve(directoryPath, `.${SECRET_FILE_NAME}.tmp-${randomBytes(16).toString("hex")}`);
+	let temporary;
+	let failure;
+	try {
+		temporary = await openSafeFile(temporaryPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 384, "Temporary application secret", canonicalSourceRoot);
+		await temporary.writeFile(`${randomBytes(32).toString("base64url")}
+`, "utf8");
+		await temporary.sync();
+		await temporary.close();
+		temporary = void 0;
+		try {
+			await link(temporaryPath, path);
+		} catch (error) {
+			if (!isFileAlreadyExists(error)) throw error;
+		}
+		await validateApplicationSecret(path, canonicalSourceRoot);
+		await syncDirectory(directoryPath, canonicalSourceRoot);
+	} catch (error) {
+		failure = error;
+	}
+	try {
+		await temporary?.close();
+	} catch (error) {
+		failure ??= error;
+	}
+	try {
+		await unlink(temporaryPath);
+	} catch (error) {
+		if (!isMissingFile(error)) failure ??= error;
+	}
+	if (failure !== void 0) throw failure;
+	await removeStaleSecretTemps(directoryPath);
+}
+async function validateApplicationSecret(path, canonicalSourceRoot) {
+	await validateExistingPathChain(path, canonicalSourceRoot, "file");
+	const file = await openSafeFile(path, constants.O_RDONLY, 384, "Application secret", canonicalSourceRoot);
+	try {
+		const details = await file.stat();
+		const currentUid = process.getuid?.();
+		const secret = await file.readFile("utf8");
+		await validateExistingPathChain(path, canonicalSourceRoot, "file");
+		if (currentUid === void 0 || details.uid !== currentUid || (details.mode & 511) !== 384 || details.size !== 44 || !/^[A-Za-z0-9_-]{43}\n$/.test(secret)) throw unsafeFilesystemEntry("Application secret must be a complete current-user-owned mode-0600 value in the expected format.");
+		return secret;
+	} finally {
+		await file.close();
+	}
+}
+async function syncDirectory(path, canonicalSourceRoot) {
+	const directory = await openSafeDirectory(path, canonicalSourceRoot);
+	try {
+		await directory.sync();
+	} finally {
+		await directory.close();
+	}
+}
+async function removeStaleSecretTemps(directoryPath) {
+	const prefix = `.${SECRET_FILE_NAME}.tmp-`;
+	for (const entry of await readdir(directoryPath)) {
+		if (!entry.startsWith(prefix)) continue;
+		try {
+			await unlink(resolve(directoryPath, entry));
+		} catch (error) {
+			if (!isMissingFile(error)) throw error;
+		}
+	}
+}
+async function openSafeDirectory(path, canonicalSourceRoot) {
+	let directory;
+	try {
+		directory = await open(path, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+		await validateOpenHandlePath(directory, path, "directory", canonicalSourceRoot);
+		return directory;
+	} catch (error) {
+		await directory?.close();
+		if (error instanceof LocalRuntimeError) throw error;
+		throw unsafeFilesystemEntry(`Could not safely open local runtime directory: ${path}`, error);
+	}
+}
+async function openSafeFile(path, flags, mode, label, canonicalSourceRoot) {
+	let file;
+	try {
+		file = await open(path, flags | constants.O_NOFOLLOW, mode);
+		await validateOpenHandlePath(file, path, "file", canonicalSourceRoot);
+		return file;
+	} catch (error) {
+		await file?.close();
+		if (error instanceof LocalRuntimeError || isFileAlreadyExists(error)) throw error;
+		throw unsafeFilesystemEntry(`${label} could not be opened without following symbolic links.`, error);
+	}
+}
+async function validateOpenHandlePath(handle, path, expectedType, canonicalSourceRoot) {
+	const opened = await handle.stat();
+	const current = await lstat(path);
+	const expectedDirectory = expectedType === "directory";
+	if (current.isSymbolicLink() || (expectedDirectory ? !opened.isDirectory() : !opened.isFile()) || (expectedDirectory ? !current.isDirectory() : !current.isFile()) || opened.dev !== current.dev || opened.ino !== current.ino) throw unsafeFilesystemEntry(`Local runtime ${expectedType} changed while it was being opened: ${path}`);
+	await validateExistingPathChain(path, canonicalSourceRoot, expectedType);
+	const afterValidation = await lstat(path);
+	if (afterValidation.isSymbolicLink() || opened.dev !== afterValidation.dev || opened.ino !== afterValidation.ino) throw unsafeFilesystemEntry(`Local runtime ${expectedType} changed during validation: ${path}`);
+}
+async function validateExistingPathChain(path, canonicalSourceRoot, leafType) {
+	const components = absolutePathComponents(path);
+	for (const [index, component] of components.entries()) {
+		const details = await lstat(component);
+		const expectedFile = index === components.length - 1 && leafType === "file";
+		if (details.isSymbolicLink() || (expectedFile ? !details.isFile() : !details.isDirectory())) throw unsafeFilesystemEntry(`Local runtime path contains an unsafe component: ${component}`);
+		await assertCanonicalEntry(component, canonicalSourceRoot);
+	}
+}
+async function assertCanonicalEntry(path, canonicalSourceRoot) {
+	const canonical = await realpath(path);
+	if (!sameFilesystemPath(canonical, path)) throw unsafeFilesystemEntry(`Local runtime path must not be redirected: ${path}`);
+	if (isInside(canonicalSourceRoot, canonical)) throw unsafeFilesystemEntry("Local application data must remain outside the canonical source tree.");
+}
+function absolutePathComponents(path) {
+	const absolute = resolve(path);
+	const root = parse(absolute).root;
+	const parts = absolute.slice(root.length).split(sep).filter(Boolean);
+	const components = [root];
+	for (const part of parts) components.push(resolve(components.at(-1), part));
+	return components;
+}
+function requireNoFollowSupport() {
+	if (typeof constants.O_NOFOLLOW !== "number" || constants.O_NOFOLLOW === 0 || typeof constants.O_DIRECTORY !== "number" || constants.O_DIRECTORY === 0) throw unsafeFilesystemEntry("This platform cannot safely initialize local storage without no-follow filesystem support.");
+}
+function sameFilesystemPath(left, right, runtimePlatform = platform()) {
+	return normalizeFilesystemIdentity(left, runtimePlatform) === normalizeFilesystemIdentity(right, runtimePlatform);
+}
+function usesCaseInsensitivePathGuards(runtimePlatform) {
+	return runtimePlatform === "win32" || runtimePlatform === "darwin";
+}
+function normalizeFilesystemIdentity(value, runtimePlatform = platform()) {
+	const normalized = resolve(value);
+	return usesCaseInsensitivePathGuards(runtimePlatform) ? normalized.toLowerCase() : normalized;
+}
+function unsafeFilesystemEntry(message, cause) {
+	const error = new LocalRuntimeError("invalid_configuration", message);
+	if (cause !== void 0) Object.defineProperty(error, "cause", { value: cause });
+	return error;
+}
+function validateBootstrapTtl(value) {
+	if (!Number.isInteger(value) || value < 1 || value > MAX_BOOTSTRAP_TTL_SECONDS) throw new LocalRuntimeError("invalid_configuration", `Owner bootstrap TTL must be an integer from 1 to ${MAX_BOOTSTRAP_TTL_SECONDS} seconds.`);
+	return value;
+}
+function validateSessionTtl(value) {
+	if (!Number.isInteger(value) || value < 1) throw new LocalRuntimeError("invalid_configuration", "Session TTL must be a whole number of seconds greater than or equal to 1.");
+	return value;
+}
+function validateOwnerInput(input) {
+	if (!input.token || !input.name.trim() || !input.email.trim()) throw new LocalRuntimeError("bootstrap_invalid", "Owner bootstrap requires a token, name, and email address.");
+}
+function normalizeLoopbackHost(value) {
+	const host = value.trim().toLowerCase().replace(/^\[|\]$/g, "");
+	if (host === "::1") return host;
+	const octets = host.split(".");
+	if (octets.length === 4 && octets.every((part) => /^\d{1,3}$/.test(part) && Number(part) <= 255) && Number(octets[0]) === 127) return host;
+	throw new LocalRuntimeError("unsafe_public_exposure", "Owner bootstrap is restricted to a loopback IP literal. Use ::1 or 127.0.0.0/8.");
+}
+function validateApplicationId(value) {
+	const appId = value.trim().toLowerCase();
+	if (!/^[a-z0-9][a-z0-9.-]{0,62}$/.test(appId)) throw new LocalRuntimeError("invalid_configuration", "appId must contain only lowercase letters, digits, dots, or hyphens.");
+	return appId;
+}
+function encodeApplicationId(value) {
+	const source = value.trim().toLowerCase();
+	if (/^[a-z0-9][a-z0-9.-]{0,62}$/.test(source)) return source;
+	const digest = createHash("sha256").update(value.trim()).digest("hex").slice(0, 10);
+	return validateApplicationId(`${source.replace(/[^a-z0-9.-]+/g, "-").replace(/^[^a-z0-9]+|[^a-z0-9]+$/g, "").slice(0, 52).replace(/[^a-z0-9]+$/g, "") || "app"}-${digest}`);
+}
+function defaultApplicationDataRoot(runtimePlatform, runtimeHome, env) {
+	if (runtimePlatform === "darwin") return resolve(runtimeHome, "Library", "Application Support");
+	if (runtimePlatform === "win32") return resolve(env.LOCALAPPDATA ?? env.APPDATA ?? runtimeHome);
+	return resolve(env.XDG_DATA_HOME ?? resolve(runtimeHome, ".local", "share"));
+}
+function isInside(parent, child, runtimePlatform = platform()) {
+	const path = relative(normalizeFilesystemIdentity(parent, runtimePlatform), normalizeFilesystemIdentity(child, runtimePlatform));
+	return path === "" || !path.startsWith("..") && !isAbsolute(path);
+}
+function parseStoredDate(value) {
+	if (!(typeof value === "string" || value instanceof Date)) return null;
+	const date = value instanceof Date ? value : new Date(value);
+	return Number.isNaN(date.getTime()) ? null : date;
+}
+function requireId(value, label) {
+	if (typeof value !== "string" || value.length === 0) throw new Error(`${label} was not persisted with an id.`);
+	return value;
+}
+function isMissingFile(error) {
+	return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+function hasMissingFileCause(error) {
+	return typeof error === "object" && error !== null && "cause" in error && isMissingFile(error.cause);
+}
+function isFileAlreadyExists(error) {
+	return typeof error === "object" && error !== null && "code" in error && error.code === "EEXIST";
+}
+function isDirectoryNotEmpty(error) {
+	return typeof error === "object" && error !== null && "code" in error && error.code === "ENOTEMPTY";
+}
+//#endregion
+export { initializeDeployedApplicationRuntime as A, lockOwnerPid as C, reclaimStaleRecord as D, RECLAIM_MUTEX_FILE as E, resolveApplicationId as M, runtimeConfigurationFingerprint as N, DeployedRuntimeCleanupError as O, isStaleOperationLock as S, withOperationLock as T, projectRuntimeDiagnostics as _, prepareLocalDatabaseStorage as a, findInstalledPackage as b, validateLocalDatabaseStorage as c, prepareApplicationStateRoot as d, resolveApplicationStateRoot as f, RUNTIME_WORKER_FRESHNESS_SECONDS as g, RUNTIME_DIAGNOSTICS_SCHEMA_VERSION as h, initializeLocalApplicationRuntime as i, isSessionTenantAuthorized as j, DeployedRuntimeError as k, acquireWriterLease as l, MAX_RUNTIME_DIAGNOSTIC_TOOLS as m, MIGRATION_FAILED_MESSAGE as n, resolveLocalRuntimePaths as o, MAX_RUNTIME_DIAGNOSTIC_ERRORS as p, encodeApplicationId as r, validateApplicationId as s, LocalRuntimeError as t, readActiveWriterLease as u, PROVIDER_READINESS_SETTINGS as v, processExists as w, resolveReadinessModule as x, createProviderReadinessProbe as y };
+
+//# sourceMappingURL=src-DZGOVGsU.js.map