@knowzai/cli 0.1.0 → 0.3.0

package/dist/lib/platform-frontdoor.js

@@ -4,13 +4,17 @@ import { registerSecret, getPlatformDefaultProvider, setPlatformDefaultProvider,
 import { applyPlatform, resolvePackagedAssetsDir, } from './platform-lifecycle.js';
 import { parseEnv, redactPlatformSecrets, } from './platform-runtime.js';
 import { resolveProviderSelection, } from './platform-provider-prompt.js';
-import { acquireGhcrLogin, resolveImageSource } from './platform-image-source.js';
+import { acquireGhcrLogin, detectRepoCheckout, resolveImageSource } from './platform-image-source.js';
+import { resolveEditionIntent, shouldUseSelfHostedEdition } from './platform-edition.js';
+import { STABLE_SELFHOSTED_RELEASE, applySelfHosted, resolvePackagedSelfHostedAssetsDir, selfHostedToPlatformResult, } from './selfhosted-lifecycle.js';
 import { runOnboarding, runOnboardingProviderProbe, waitForOnboardingReady, DEFAULT_LOCAL_PROFILE, } from './platform-onboarding.js';
 import { ensureEngineReady as ensureContainerEngineReady, } from './container-engine.js';
 import { withSpinner } from './ui.js';
 import { buildRegistryLoginInvocation } from './platform-image-source.js';
-import { parsePlatformReleaseManifest, PlatformReleaseCatalogHttpError, resolvePlatformRelease, SelfServeResolutionError, } from './platform-release-manifest.js';
+import { parsePlatformReleaseManifest, PlatformReleaseCatalogHttpError, releaseFreshnessNotice, resolvePlatformRelease, SelfServeResolutionError, } from './platform-release-manifest.js';
 import { normalizeMothershipOrigin, } from './activate.js';
+import { AGE_ELIGIBILITY_TEXT, AGE_ELIGIBILITY_UNDER_13_MESSAGE } from './login.js';
+import { KnowzError, ExitCode } from '@knowzai/core';
 /**
  * `knowz up` front-door orchestration — the opinionated one-command onboarding
  * that composes the AI-provider picker (N1) → image-source resolution (N2) →
@@ -26,9 +30,28 @@ import { normalizeMothershipOrigin, } from './activate.js';
  * `platform up` (which fails closed without `--version`), `knowz up` supplies a
  * concrete, deliberately-bumped version so a first-time user gets a working
  * stack — NEVER a floating tag like `latest`. Override with `--version`.
+ *
+ * §2026-08-31 R3: this pin MUST equal the newest entry in the packaged
+ * `assets/portable/releases.json` (exact semver equality — enforced by the
+ * up.test.ts anti-rot tripwire). The /release-platform skill bumps BOTH in the
+ * same release commit; bump one without the other and the tripwire goes red.
  */
-export const STABLE_PORTABLE_RELEASE = '0.35.2';
+export const STABLE_PORTABLE_RELEASE = '0.41.0';
 export const DEFAULT_PORTABLE_VERSION = STABLE_PORTABLE_RELEASE;
+const DEFAULT_INSTANCE_NAME = 'knowz';
+/**
+ * Per-instance CLI profile derivation (smoke gap 1, lead ruling): the default
+ * instance keeps the back-compat `local` profile; a named instance gets
+ * `local-<name>` so a second instance's `up` can never silently repoint the
+ * first instance's profile. Shared by terminal `up` and the setup console
+ * (`setupPlanToFrontDoorInput`) so both front-ends derive identically.
+ */
+export function localProfileNameFor(instanceName) {
+    const name = instanceName?.trim();
+    return !name || name === DEFAULT_INSTANCE_NAME
+        ? DEFAULT_LOCAL_PROFILE
+        : `${DEFAULT_LOCAL_PROFILE}-${name}`;
+}
 export function resolveDefaultPortableVersion(env) {
     const value = env.KNOWZ_PLATFORM_VERSION?.trim();
     if (!value)
@@ -72,6 +95,31 @@ function e5() {
 function activationRequired() {
     return new SelfServeResolutionError("This device is not linked to a Knowz account. Run 'knowz activate' in an interactive terminal, then retry 'knowz up --json'.", 'ACTIVATION_REQUIRED');
 }
+const LICENSE_REQUIRED_FALLBACK = 'This installation does not have an active platform license. Complete registration and your commercial agreement to enable image pulls.';
+const LICENSE_REQUIRED_REMEDIATION = 'Request a portable license from Settings → Installations on your Knowz account, or see https://knowz.io/pricing.';
+const PROBLEM_DETAIL_MAX_LENGTH = 500;
+function licenseRequiredError(preflight) {
+    const detail = sanitizeProblemDetail(preflight.detail);
+    return new SelfServeResolutionError(`${detail ?? LICENSE_REQUIRED_FALLBACK} ${LICENSE_REQUIRED_REMEDIATION}`, 'LICENSE_REQUIRED');
+}
+function sanitizeProblemDetail(detail) {
+    if (typeof detail !== 'string' || detail.length === 0)
+        return undefined;
+    const stripped = stripC0AndCsi(detail).trim();
+    if (!stripped)
+        return undefined;
+    return stripped.length > PROBLEM_DETAIL_MAX_LENGTH
+        ? stripped.slice(0, PROBLEM_DETAIL_MAX_LENGTH)
+        : stripped;
+}
+function stripC0AndCsi(value) {
+    return value
+        .replace(/\u001b\[[0-9;?]*[ -/]*[@-~]/g, '')
+        .replace(/\u009b[0-9;?]*[ -/]*[@-~]/g, '')
+        .replace(/\u001b\][^\u0007\u001b]*(?:\u0007|\u001b\\)/g, '')
+        .replace(/\u001b[@-Z\\-_]/g, '')
+        .replace(/[\u0000-\u001f\u007f-\u009f]/g, '');
+}
 async function defaultFetchReleaseManifest(url) {
     const response = await fetch(url, {
         headers: { accept: 'application/json' },
@@ -81,6 +129,63 @@ async function defaultFetchReleaseManifest(url) {
         throw new PlatformReleaseCatalogHttpError(response.status);
     return response.json();
 }
+/** §2026-08-31 R4 (lead ruling): the advisory fetch is bounded to 2s — never slower. */
+const ADVISORY_MANIFEST_TIMEOUT_MS = 2_000;
+async function withAdvisoryTimeout(work) {
+    let timer;
+    try {
+        return await Promise.race([
+            work,
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new Error('Advisory release-manifest fetch timed out.')), ADVISORY_MANIFEST_TIMEOUT_MS);
+            }),
+        ]);
+    }
+    finally {
+        if (timer !== undefined)
+            clearTimeout(timer);
+    }
+}
+/**
+ * §2026-08-31 R4: ADVISORY manifest load for the ghcr-token / preloaded paths —
+ * bounded fetch, packaged-copy fallback, and ANY failure returns undefined.
+ * Freshness must never block, slow (beyond the bound), or error an air-gapped
+ * boot. Requires the injected `fetchReleaseManifest` (the real runtime always
+ * binds it); when absent the advisory silently does not run, keeping legacy
+ * injected embedders/tests byte-identical and network-free.
+ */
+async function loadAdvisoryReleaseManifest(input) {
+    try {
+        const raw = await withAdvisoryTimeout(input.fetchReleaseManifest(input.manifestUrl));
+        return parsePlatformReleaseManifest(raw);
+    }
+    catch {
+        // Fall through to the packaged copy — advisory failures are silent by contract.
+    }
+    try {
+        const fallback = input.loadPackagedReleaseManifest
+            ? await input.loadPackagedReleaseManifest(input.packagedManifestPath)
+            : JSON.parse(readFileSync(input.packagedManifestPath, 'utf8'));
+        return parsePlatformReleaseManifest(fallback);
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * §2026-08-31 R-N2: static reference-only next-steps epilogue after a fresh
+ * successful `knowz up`. Copy mirrors the setup-console success panel (R-N1);
+ * the commands are defined by CLI_PortabilityTransfer / CLI_InstanceTransfer.
+ * Routed through the injectable sink — `--json` runs and the setup console
+ * (which forces `input.json`) never see these lines, and `loginMode:'existing'`
+ * re-ups skip the call entirely.
+ */
+function emitNextSteps(log) {
+    log('Next steps:');
+    log('  Connect this instance to Knowz Cloud:  knowz login --profile cloud');
+    log('  Move data between instances:           knowz transfer --from <profile> --to <profile>');
+    log('  Snapshot / restore:                    knowz export / knowz import');
+}
 export async function runFrontDoor(input, deps) {
     const log = input.json
         ? (_line) => { }
@@ -142,14 +247,29 @@ export async function runFrontDoor(input, deps) {
     if (requestedSuperAdminPassphrase)
         registerSecret(requestedSuperAdminPassphrase);
     let identity = input.identity;
-    if (!identity && interactivePromptOccurred) {
-        const name = (await deps.prompt.text({ message: 'First account name:', default: 'Local' })).trim();
-        const email = (await deps.prompt.text({ message: 'First account email:', default: 'local@knowz.local' })).trim();
-        identity = {
+    const collectRegistrationIdentity = async () => {
+        if (identity?.ageAttested === true)
+            return identity;
+        if (!canPrompt) {
+            if (identity) {
+                throw new KnowzError('Age eligibility is never assumed. Pass --age-13-plus to confirm eligibility before registration.', ExitCode.Usage);
+            }
+            return identity;
+        }
+        const ageAttested = await deps.prompt.confirm?.({ message: AGE_ELIGIBILITY_TEXT, default: false }) ?? false;
+        if (!ageAttested)
+            throw new KnowzError(AGE_ELIGIBILITY_UNDER_13_MESSAGE, ExitCode.Usage);
+        const name = identity?.name ?? (await deps.prompt.text({ message: 'First account name:', default: 'Local' })).trim();
+        const email = identity?.email ?? (await deps.prompt.text({ message: 'First account email:', default: 'local@knowz.local' })).trim();
+        return {
             name: name || 'Local',
             email: email || 'local@knowz.local',
+            // `as const` so the literal is not widened to `boolean`: `identity` is
+            // typed `ageAttested?: true`, and attestation is deliberately a one-way
+            // flag — there is no "attested: false" state, only an absent one.
+            ageAttested: true,
         };
-    }
+    };
     // Discoverability: when a saved default was silently reused (no --offline/--ai/--provider,
     // where --provider folds into providerFlags.ai), explain why no prompt appeared.
     if (cfgDefault && !interactivePromptOccurred && !input.providerFlags.offline && !input.providerFlags.ai) {
@@ -164,23 +284,76 @@ export async function runFrontDoor(input, deps) {
         axes: selection.axes ?? input.base.axes,
         superAdminPassphrase: requestedSuperAdminPassphrase,
     };
-    // 2) Image source: build-from-checkout runs in place at the repo root; pull keeps
-    //    the byte-identical copy-into-runtime-dir seam (so we only override the plan).
-    const source = resolveImageSource({
-        cwd: deps.cwd,
-        flags: input.imageFlags,
-        canPrompt: deps.isTty && Boolean(deps.ghcrPrompt),
-        pathExists: deps.pathExists,
-        packagedAssetsDir: deps.packagedAssetsDir,
-        env: input.ghcrToken
-            ? { ...deps.env, GHCR_PULL_TOKEN: input.ghcrToken }
-            : deps.env,
+    // 2) Edition then image source. Unentitled `knowz up` uses public selfhosted
+    //    images; the portable resolver is unchanged when edition is portable.
+    const envForEdition = input.ghcrToken
+        ? { ...deps.env, GHCR_PULL_TOKEN: input.ghcrToken }
+        : deps.env;
+    const editionIntent = resolveEditionIntent({
+        flags: { edition: input.edition },
+        env: envForEdition,
+    });
+    const checkoutDetected = Boolean(detectRepoCheckout(deps.cwd, deps.pathExists));
+    let useSelfHosted = shouldUseSelfHostedEdition({
+        intent: editionIntent,
+        imageFlags: input.imageFlags,
+        checkoutDetected,
     });
+    // R-ED3: omitted edition + stored kzin_ may promote to portable after a 200
+    // preflight. 403/401/410/transport stay selfhosted and MUST NOT reactivate.
+    if (useSelfHosted &&
+        !editionIntent.explicit &&
+        deps.loadStoredActivation &&
+        deps.preflightRegistryCredential) {
+        const mothershipUrl = normalizeMothershipOrigin(deps.env.KNOWZ_LICENSING_MOTHERSHIP_URL?.trim() || DEFAULT_MOTHERSHIP_URL);
+        try {
+            const stored = await deps.loadStoredActivation({
+                projectName: input.base.name,
+                configDir: input.base.configDir,
+                engine: engine ?? LEGACY_DOCKER_ENGINE,
+            });
+            if (stored) {
+                const preflight = await deps.preflightRegistryCredential({
+                    mothershipUrl,
+                    activation: stored,
+                });
+                if (preflight.kind === 'http-response' && preflight.status === 200) {
+                    useSelfHosted = false;
+                }
+                else {
+                    log('Stored installation is not entitled for portable images; using public selfhosted.');
+                }
+            }
+        }
+        catch {
+            // Default knowz up must not fail because a mothership probe threw.
+        }
+    }
+    const source = useSelfHosted
+        ? {
+            mode: 'pull',
+            composeFile: 'selfhosted',
+            projectDir: 'selfhosted',
+            composePlan: 'config-pull-up',
+        }
+        : resolveImageSource({
+            cwd: deps.cwd,
+            flags: input.imageFlags,
+            canPrompt: deps.isTty && Boolean(deps.ghcrPrompt),
+            pathExists: deps.pathExists,
+            packagedAssetsDir: deps.packagedAssetsDir,
+            env: envForEdition,
+        });
     const seam = source.mode === 'build'
         ? { composeFile: source.composeFile, projectDir: source.projectDir, composePlan: source.composePlan }
         : source.mode === 'pull'
-            ? { composePlan: source.composePlan, registry: source.registry ?? null }
+            ? { composePlan: source.composePlan, registry: 'registry' in source ? source.registry ?? null : null }
             : { composePlan: source.composePlan };
+    // §2026-08-31 R7: portable images are linux/amd64-only. Selfhosted GHCR is multi-arch.
+    const hostArch = deps.hostArch ?? process.arch;
+    if (!useSelfHosted && hostArch === 'arm64' && (source.mode === 'pull' || source.mode === 'preloaded')) {
+        log('Note: knowz images run under amd64 emulation on this Mac; native arm64 images are not yet published.');
+    }
     const selfServePlan = source.loginPlan?.kind === 'self-serve' ? source.loginPlan : undefined;
     if (selfServePlan) {
         const mothershipUrl = normalizeMothershipOrigin(deps.env.KNOWZ_LICENSING_MOTHERSHIP_URL?.trim() || DEFAULT_MOTHERSHIP_URL);
@@ -235,6 +408,41 @@ export async function runFrontDoor(input, deps) {
         if (resolved.note)
             log(resolved.note);
         log(`✓ Knowz Platform ${resolved.release.version} (${flavor}) — released ${resolved.release.releasedAt.slice(0, 10)}`);
+        // §2026-08-31 R4 (self-serve): zero new network — reuse the fetched manifest.
+        // Fires only for an explicit older pin; a minCliVersion skip already emitted
+        // its own note above, and the freshness notice must never duplicate it.
+        if (!resolved.note) {
+            const freshness = releaseFreshnessNotice({
+                currentVersion: resolved.release.version,
+                manifest,
+                flavor,
+            });
+            if (freshness)
+                log(freshness);
+        }
+    }
+    else if (selection.provider !== 'offline' &&
+        (source.mode === 'preloaded' || source.loginPlan?.kind === 'ghcr') &&
+        deps.fetchReleaseManifest) {
+        // §2026-08-31 R4 (ghcr-token / preloaded): no manifest resolution runs on these
+        // paths, so the version about to boot is the pin/explicit choice. Advisory-only
+        // freshness check — bounded, fail-silent, and skipped entirely for the offline
+        // provider (declared no-network intent, lead ruling on OQ-2).
+        const advisoryManifest = await loadAdvisoryReleaseManifest({
+            manifestUrl: `${normalizeMothershipOrigin(deps.env.KNOWZ_LICENSING_MOTHERSHIP_URL?.trim() || DEFAULT_MOTHERSHIP_URL)}${RELEASE_MANIFEST_PATH}`,
+            packagedManifestPath: join(source.projectDir, 'releases.json'),
+            fetchReleaseManifest: deps.fetchReleaseManifest,
+            loadPackagedReleaseManifest: deps.loadPackagedReleaseManifest,
+        });
+        if (advisoryManifest) {
+            const freshness = releaseFreshnessNotice({
+                currentVersion: applyInput.version ?? DEFAULT_PORTABLE_VERSION,
+                manifest: advisoryManifest,
+                flavor: selection.provider === 'gcp' ? 'portable-gcp' : 'portable',
+            });
+            if (freshness)
+                log(freshness);
+        }
     }
     // Advisory credential reachability check. Failure is intentionally warn-only.
     if (input.validate === true && deps.probeProvider) {
@@ -275,123 +483,146 @@ export async function runFrontDoor(input, deps) {
     };
     // 3) Bring the stack up; anonymous pull first, authenticate + retry once on auth failure.
     let applied;
-    if (selfServePlan)
-        log(`◇ Pulling images from ${selfServePlan.registry}…`);
-    try {
-        applied = await (deps.applyPlatform ?? applyPlatform)(applyInput, applyDeps, seam);
-        if (selfServePlan)
-            log(`◇ Pulling images from ${selfServePlan.registry}… ✓`);
+    if (useSelfHosted) {
+        log('Using public selfhosted images. Portable platform requires --edition=portable and an entitled key.');
+        const selfhostedVersion = input.versionExplicit && applyInput.version
+            ? applyInput.version
+            : (deps.env.KNOWZ_SELFHOSTED_VERSION?.trim() || STABLE_SELFHOSTED_RELEASE);
+        const selfhosted = applySelfHosted({
+            name: input.base.name,
+            version: selfhostedVersion,
+            configDir: input.base.configDir,
+            ports,
+        }, {
+            runner: deps.runner,
+            randomBytes: deps.randomBytes,
+            packagedAssetsDir: deps.selfHostedAssetsDir ?? resolvePackagedSelfHostedAssetsDir(),
+        });
+        applied = selfHostedToPlatformResult(selfhosted, selection.provider, deps.now);
     }
-    catch (error) {
-        if (source.mode === 'pull' &&
-            source.loginPlan?.kind === 'ghcr' &&
-            isRegistryAuthError(error)) {
-            const loginEnv = input.ghcrToken
-                ? { ...deps.env, GHCR_PULL_TOKEN: input.ghcrToken }
-                : deps.env;
-            const login = await acquireGhcrLogin(source.loginPlan, deps.ghcrPrompt, loginEnv);
-            if (!login)
-                throw error;
-            log('Registry rejected an anonymous pull; authenticating and retrying…');
-            applied = await (deps.applyPlatform ?? applyPlatform)(applyInput, applyDeps, { ...seam, login });
+    else {
+        if (selfServePlan)
+            log(`◇ Pulling images from ${selfServePlan.registry}…`);
+        try {
+            applied = await (deps.applyPlatform ?? applyPlatform)(applyInput, applyDeps, seam);
+            if (selfServePlan)
+                log(`◇ Pulling images from ${selfServePlan.registry}… ✓`);
         }
-        else if (source.mode === 'pull' && selfServePlan && isRegistryAuthError(error)) {
-            const activeEngine = engine ?? LEGACY_DOCKER_ENGINE;
-            const mothershipUrl = normalizeMothershipOrigin(deps.env.KNOWZ_LICENSING_MOTHERSHIP_URL?.trim() || DEFAULT_MOTHERSHIP_URL);
-            if (!deps.loadStoredActivation ||
-                !deps.activateInstallation ||
-                !deps.preflightRegistryCredential) {
-                throw new Error('Self-serve registry authentication dependencies are not configured.');
+        catch (error) {
+            if (source.mode === 'pull' &&
+                source.loginPlan?.kind === 'ghcr' &&
+                isRegistryAuthError(error)) {
+                const loginEnv = input.ghcrToken
+                    ? { ...deps.env, GHCR_PULL_TOKEN: input.ghcrToken }
+                    : deps.env;
+                const login = await acquireGhcrLogin(source.loginPlan, deps.ghcrPrompt, loginEnv);
+                if (!login)
+                    throw error;
+                log('Registry rejected an anonymous pull; authenticating and retrying…');
+                applied = await (deps.applyPlatform ?? applyPlatform)(applyInput, applyDeps, { ...seam, login });
             }
-            let activation = await deps.loadStoredActivation({
-                projectName: input.base.name,
-                configDir: input.base.configDir,
-                engine: activeEngine,
-            });
-            let activatedNow = false;
-            if (!activation) {
-                if (input.json)
-                    throw activationRequired();
-                log("This device isn't linked to a Knowz account yet.");
-                log('Linking is free and takes about a minute — your browser will open so you can approve this device.');
-                log('');
-                try {
-                    activation = await deps.activateInstallation({
-                        projectName: input.base.name,
-                        configDir: input.base.configDir,
-                        mothershipUrl,
-                        engine: activeEngine,
-                    });
-                    activatedNow = true;
+            else if (source.mode === 'pull' && selfServePlan && isRegistryAuthError(error)) {
+                const activeEngine = engine ?? LEGACY_DOCKER_ENGINE;
+                const mothershipUrl = normalizeMothershipOrigin(deps.env.KNOWZ_LICENSING_MOTHERSHIP_URL?.trim() || DEFAULT_MOTHERSHIP_URL);
+                if (!deps.loadStoredActivation ||
+                    !deps.activateInstallation ||
+                    !deps.preflightRegistryCredential) {
+                    throw new Error('Self-serve registry authentication dependencies are not configured.');
                 }
-                catch {
-                    throw e5();
-                }
-            }
-            let preflight = await deps.preflightRegistryCredential({ mothershipUrl, activation });
-            if (preflight.kind === 'transport-failure') {
-                throw new SelfServeResolutionError(`Could not reach the Knowz image authorization service at ${mothershipUrl}/api/v1/registry/token. ` +
-                    'Check your network connection, then retry.', 'REGISTRY_AUTH_UNREACHABLE');
-            }
-            let preflightStatus = preflight.status;
-            if (preflightStatus === 410)
-                throw e4(activation.installationId);
-            if (preflightStatus === 401) {
-                if (activatedNow || !canPrompt || !deps.confirmReactivation) {
-                    throw new SelfServeResolutionError(`Stored installation ${activation.installationId} is no longer valid. Run 'knowz activate' to link this device again.`, 'INSTALLATION_INVALID');
-                }
-                const accepted = await deps.confirmReactivation(activation.installationId);
-                if (!accepted)
-                    throw e5();
-                try {
-                    activation = await deps.activateInstallation({
-                        projectName: input.base.name,
-                        configDir: input.base.configDir,
-                        mothershipUrl,
-                        engine: activeEngine,
-                    });
-                    activatedNow = true;
-                }
-                catch {
-                    throw e5();
+                let activation = await deps.loadStoredActivation({
+                    projectName: input.base.name,
+                    configDir: input.base.configDir,
+                    engine: activeEngine,
+                });
+                let activatedNow = false;
+                if (!activation) {
+                    if (input.json)
+                        throw activationRequired();
+                    log("This device isn't linked to a Knowz account yet.");
+                    log('Linking is free and takes about a minute — your browser will open so you can approve this device.');
+                    log('');
+                    try {
+                        activation = await deps.activateInstallation({
+                            projectName: input.base.name,
+                            configDir: input.base.configDir,
+                            mothershipUrl,
+                            engine: activeEngine,
+                        });
+                        activatedNow = true;
+                    }
+                    catch {
+                        throw e5();
+                    }
                 }
-                preflight = await deps.preflightRegistryCredential({ mothershipUrl, activation });
+                let preflight = await deps.preflightRegistryCredential({ mothershipUrl, activation });
                 if (preflight.kind === 'transport-failure') {
                     throw new SelfServeResolutionError(`Could not reach the Knowz image authorization service at ${mothershipUrl}/api/v1/registry/token. ` +
                         'Check your network connection, then retry.', 'REGISTRY_AUTH_UNREACHABLE');
                 }
-                preflightStatus = preflight.status;
+                let preflightStatus = preflight.status;
+                if (preflightStatus === 403)
+                    throw licenseRequiredError(preflight);
                 if (preflightStatus === 410)
                     throw e4(activation.installationId);
+                if (preflightStatus === 401) {
+                    if (activatedNow || !canPrompt || !deps.confirmReactivation) {
+                        throw new SelfServeResolutionError(`Stored installation ${activation.installationId} is no longer valid. Run 'knowz activate' to link this device again.`, 'INSTALLATION_INVALID');
+                    }
+                    const accepted = await deps.confirmReactivation(activation.installationId);
+                    if (!accepted)
+                        throw e5();
+                    try {
+                        activation = await deps.activateInstallation({
+                            projectName: input.base.name,
+                            configDir: input.base.configDir,
+                            mothershipUrl,
+                            engine: activeEngine,
+                        });
+                        activatedNow = true;
+                    }
+                    catch {
+                        throw e5();
+                    }
+                    preflight = await deps.preflightRegistryCredential({ mothershipUrl, activation });
+                    if (preflight.kind === 'transport-failure') {
+                        throw new SelfServeResolutionError(`Could not reach the Knowz image authorization service at ${mothershipUrl}/api/v1/registry/token. ` +
+                            'Check your network connection, then retry.', 'REGISTRY_AUTH_UNREACHABLE');
+                    }
+                    preflightStatus = preflight.status;
+                    if (preflightStatus === 403)
+                        throw licenseRequiredError(preflight);
+                    if (preflightStatus === 410)
+                        throw e4(activation.installationId);
+                }
+                if (preflightStatus !== 200) {
+                    throw new SelfServeResolutionError(`Knowz could not authorize installation ${activation.installationId} for image pulls (HTTP ${preflightStatus}).`, 'INSTALLATION_INVALID');
+                }
+                registerSecret(activation.credential);
+                if (activatedNow)
+                    log(`✓ Linked — installation "${input.base.name}"`);
+                const login = buildRegistryLoginInvocation(selfServePlan.registry, activation.installationId, activation.credential);
+                try {
+                    applied = await (deps.applyPlatform ?? applyPlatform)(applyInput, applyDeps, {
+                        ...seam,
+                        login,
+                    });
+                }
+                catch (retryError) {
+                    throw new SelfServeResolutionError('Knowz could not pull the published platform images after signing in. The container engine reported: ' +
+                        redactPlatformSecrets(errorMessage(retryError), [activation.credential]), 'REGISTRY_PULL_FAILED');
+                }
+                log(`◇ Signing in to ${selfServePlan.registry}… ✓`);
+                log(`◇ Pulling images from ${selfServePlan.registry}… ✓`);
             }
-            if (preflightStatus !== 200) {
-                throw new SelfServeResolutionError(`Knowz could not authorize installation ${activation.installationId} for image pulls (HTTP ${preflightStatus}).`, 'INSTALLATION_INVALID');
-            }
-            registerSecret(activation.credential);
-            if (activatedNow)
-                log(`✓ Linked — installation "${input.base.name}"`);
-            const login = buildRegistryLoginInvocation(selfServePlan.registry, activation.installationId, activation.credential);
-            try {
-                applied = await (deps.applyPlatform ?? applyPlatform)(applyInput, applyDeps, {
-                    ...seam,
-                    login,
-                });
+            else if (source.mode === 'pull' &&
+                source.registry &&
+                !source.loginPlan &&
+                isRegistryAuthError(error)) {
+                throw new Error(`Registry override ${source.registry} refused image access: ${errorMessage(error)}`);
             }
-            catch (retryError) {
-                throw new SelfServeResolutionError('Knowz could not pull the published platform images after signing in. The container engine reported: ' +
-                    redactPlatformSecrets(errorMessage(retryError), [activation.credential]), 'REGISTRY_PULL_FAILED');
+            else {
+                throw error;
             }
-            log(`◇ Signing in to ${selfServePlan.registry}… ✓`);
-            log(`◇ Pulling images from ${selfServePlan.registry}… ✓`);
-        }
-        else if (source.mode === 'pull' &&
-            source.registry &&
-            !source.loginPlan &&
-            isRegistryAuthError(error)) {
-            throw new Error(`Registry override ${source.registry} refused image access: ${errorMessage(error)}`);
-        }
-        else {
-            throw error;
         }
     }
     for (const line of applied.output.split('\n'))
@@ -421,7 +652,9 @@ export async function runFrontDoor(input, deps) {
     //     profile reuse. Passing the result into onboarding avoids a second poll.
     const apiReady = await waitForOnboardingReady({}, onboardingDeps);
     if (!apiReady) {
-        const onboarding = await runOnboarding({ ...onboardingInput, apiReady }, onboardingDeps);
+        identity = await collectRegistrationIdentity();
+        const onboarding = await runOnboarding({ ...onboardingInput, register: identity, apiReady }, onboardingDeps);
+        emitNextSteps(log);
         return {
             state: applied.state,
             imageMode: source.mode,
@@ -429,6 +662,7 @@ export async function runFrontDoor(input, deps) {
             profile: onboarding.profile ?? null,
             loginMode: onboarding.loginMode,
             seeded: onboarding.seeded,
+            edition: useSelfHosted ? 'selfhosted' : 'portable',
         };
     }
     // 4b) If a prior `up` already signed the CLI profile in and its key still authenticates,
@@ -442,10 +676,12 @@ export async function runFrontDoor(input, deps) {
         log(`  API:    ${apiUrl}`);
         if (input.open)
             onboardingDeps.openBrowser(webUrl);
-        return { state: applied.state, imageMode: source.mode, provider: selection.provider, profile: profileName, loginMode: 'existing', seeded: false };
+        return { state: applied.state, imageMode: source.mode, provider: selection.provider, profile: profileName, loginMode: 'existing', seeded: false, edition: useSelfHosted ? 'selfhosted' : 'portable' };
     }
     // 4c) Onboarding: bootstrap → register fallback → manual degrade.
-    const onboarding = await runOnboarding({ ...onboardingInput, apiReady }, onboardingDeps);
+    identity = await collectRegistrationIdentity();
+    const onboarding = await runOnboarding({ ...onboardingInput, register: identity, apiReady }, onboardingDeps);
+    emitNextSteps(log);
     return {
         state: applied.state,
         imageMode: source.mode,
@@ -453,6 +689,7 @@ export async function runFrontDoor(input, deps) {
         profile: onboarding.profile ?? null,
         loginMode: onboarding.loginMode,
         seeded: onboarding.seeded,
+        edition: useSelfHosted ? 'selfhosted' : 'portable',
     };
 }
 /** Read the packaged runtime contract's `providerPresets.{preset}.requiredEnvironment` map (drift-fenced source). */