@koed-labs/server 0.0.0-bootstrap.0 → 0.10.3

package/vendor/chunk-NM5NXCVM.js

@@ -0,0 +1,2404 @@
+import { createRequire as createKoedRequire } from "node:module"; const require = createKoedRequire(import.meta.url);
+import {
+  isRuntimeGenerationState
+} from "./chunk-G4IIVVJO.js";
+import {
+  lookupManifestPin,
+  productionComponentManifestCatalog,
+  validateManifestCatalog
+} from "./chunk-QIIKMG3M.js";
+import {
+  canonicalArtifactBytes,
+  canonicalArtifactJson,
+  extractVerifiedPackageArchive,
+  isVersionDowngrade
+} from "./chunk-2DA7EFZV.js";
+
+// packages/koed-server/dist/component-runtime-identity.js
+import process2 from "node:process";
+var isVersion = (value) => typeof value === "string" && /^(?:0|[1-9]\d*)(?:\.(?:0|[1-9]\d*)){1,2}$/.test(value) && value.split(".").every((part) => Number.isSafeInteger(Number(part)));
+function discoverRuntimeIdentityFromProcess(source) {
+  const platform = source.platform === "darwin" ? "macos" : source.platform === "linux" ? "linux" : void 0;
+  const architecture = source.arch === "arm64" || source.arch === "x64" ? source.arch : void 0;
+  const runtimeVersion = source.versions.electron ?? source.versions.node;
+  const nodeVersion = source.versions.node;
+  const modulesAbi = source.versions.modules;
+  const napiVersion = Number(source.versions.napi ?? "0");
+  let libcVersion;
+  if (platform === "linux") {
+    try {
+      libcVersion = source.report?.getReport().header?.glibcVersionRuntime;
+    } catch {
+      throw new Error("actual runtime identity is unsupported or incomplete");
+    }
+  }
+  if (!platform || !architecture || !isVersion(runtimeVersion) || !isVersion(nodeVersion) || typeof modulesAbi !== "string" || !/^\d+$/.test(modulesAbi) || !Number.isSafeInteger(napiVersion) || napiVersion < 0 || platform === "linux" && !isVersion(libcVersion))
+    throw new Error("actual runtime identity is unsupported or incomplete");
+  return {
+    kind: source.versions.electron === void 0 ? "node" : "electron",
+    version: runtimeVersion,
+    nodeVersion,
+    modulesAbi,
+    napiVersion,
+    platform,
+    architecture,
+    ...libcVersion === void 0 ? {} : { libcVersion }
+  };
+}
+function discoverActualRuntimeIdentity() {
+  return discoverRuntimeIdentityFromProcess(process2);
+}
+
+// packages/koed-server/dist/config.js
+import { existsSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { dirname } from "node:path";
+import { mkdirSync } from "node:fs";
+var defaultKoedServerConfig = {
+  runtimeMode: "local-personal",
+  dependencyMode: "bundled-local",
+  codexTranscriptWatcherEnabled: true,
+  claudeTranscriptWatcherEnabled: true,
+  piTranscriptWatcherEnabled: true,
+  codexGlobalMemoryGuidanceEnabled: true,
+  hardwareAcceleration: "auto"
+};
+var trim = (value) => {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : void 0;
+};
+var runtimeMode = (value) => value === "local-personal" || value === "external" || value === "developer" ? value : void 0;
+var dependencyMode = (value) => value === "external" || value === "bundled-local" ? value : void 0;
+var codexTranscriptWatcherSetting = (value) => {
+  if (value === true || value === "true")
+    return true;
+  if (value === false || value === "false")
+    return false;
+  return void 0;
+};
+var claudeTranscriptWatcherSetting = codexTranscriptWatcherSetting;
+var piTranscriptWatcherSetting = codexTranscriptWatcherSetting;
+var booleanSetting = codexTranscriptWatcherSetting;
+var hardwareAccelerationPreference = (value, source) => value === void 0 ? void 0 : value === "auto" || value === "cpu" ? value : (() => {
+  throw new Error(`${source} must be auto or cpu`);
+})();
+var readConfig = (paths, deps) => {
+  if (!deps.existsSync(paths.serverConfigPath)) {
+    return {};
+  }
+  try {
+    const parsed = JSON.parse(deps.readFileSync(paths.serverConfigPath, "utf8"));
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new Error("expected a JSON object");
+    }
+    const record = parsed;
+    if (!deps.strict)
+      return record;
+    const stringFields = ["runtimeMode", "dependencyMode"];
+    const booleanFields = [
+      "codexTranscriptWatcherEnabled",
+      "claudeTranscriptWatcherEnabled",
+      "piTranscriptWatcherEnabled",
+      "codexGlobalMemoryGuidanceEnabled"
+    ];
+    for (const field of stringFields) {
+      if (record[field] !== void 0 && typeof record[field] !== "string") {
+        throw new Error(`${field} must be a string`);
+      }
+    }
+    if (record.runtimeMode !== void 0 && !runtimeMode(record.runtimeMode)) {
+      throw new Error("runtimeMode must be local-personal, external, or developer");
+    }
+    if (record.dependencyMode !== void 0 && !dependencyMode(record.dependencyMode)) {
+      throw new Error("dependencyMode must be bundled-local or external");
+    }
+    for (const field of booleanFields) {
+      if (record[field] !== void 0 && typeof record[field] !== "boolean") {
+        throw new Error(`${field} must be a boolean`);
+      }
+    }
+    if (record.hardwareAcceleration !== void 0) {
+      hardwareAccelerationPreference(record.hardwareAcceleration, "server.json hardwareAcceleration");
+    }
+    if (record.external !== void 0 && (!record.external || typeof record.external !== "object" || Array.isArray(record.external))) {
+      throw new Error("external must be an object");
+    }
+    if (record.external && typeof record.external === "object") {
+      const external = record.external;
+      const supportedExternalFields = [
+        "databaseUrl",
+        "redisUrl",
+        "embeddingServiceUrl",
+        "privacyServiceUrl"
+      ];
+      for (const [field, value] of Object.entries(external)) {
+        if (!supportedExternalFields.includes(field)) {
+          throw new Error(`external.${field} is not supported`);
+        }
+        if (value !== void 0 && typeof value !== "string") {
+          throw new Error(`external.${field} must be a string`);
+        }
+      }
+    }
+    return record;
+  } catch (error) {
+    if (!deps.strict)
+      return {};
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`Cannot read ${paths.serverConfigPath}: ${message}`, {
+      cause: error
+    });
+  }
+};
+var resolveKoedServerConfig = (paths, environment = process.env, deps = {}) => {
+  const file = readConfig(paths, {
+    existsSync: deps.existsSync ?? existsSync,
+    readFileSync: deps.readFileSync ?? readFileSync,
+    strict: deps.strict
+  });
+  if (deps.strict) {
+    if (environment.KOED_RUNTIME_MODE !== void 0 && !runtimeMode(environment.KOED_RUNTIME_MODE)) {
+      throw new Error("KOED_RUNTIME_MODE must be local-personal, external, or developer");
+    }
+    if (environment.KOED_DEPENDENCY_MODE !== void 0 && !dependencyMode(environment.KOED_DEPENDENCY_MODE)) {
+      throw new Error("KOED_DEPENDENCY_MODE must be bundled-local or external");
+    }
+  }
+  const resolvedRuntimeMode = runtimeMode(environment.KOED_RUNTIME_MODE) ?? runtimeMode(file.runtimeMode) ?? defaultKoedServerConfig.runtimeMode;
+  const resolvedTranscriptWatcherSetting = codexTranscriptWatcherSetting(environment.MEMORY_CODEX_TRANSCRIPT_WATCHER_ENABLED) ?? codexTranscriptWatcherSetting(file.codexTranscriptWatcherEnabled);
+  const resolvedClaudeTranscriptWatcherSetting = claudeTranscriptWatcherSetting(environment.MEMORY_CLAUDE_TRANSCRIPT_WATCHER_ENABLED) ?? claudeTranscriptWatcherSetting(file.claudeTranscriptWatcherEnabled);
+  const resolvedPiTranscriptWatcherSetting = piTranscriptWatcherSetting(environment.MEMORY_PI_TRANSCRIPT_WATCHER_ENABLED) ?? piTranscriptWatcherSetting(file.piTranscriptWatcherEnabled);
+  if (resolvedRuntimeMode === "external" && (resolvedTranscriptWatcherSetting === true || resolvedClaudeTranscriptWatcherSetting === true || resolvedPiTranscriptWatcherSetting === true)) {
+    throw new Error("Transcript Watchers cannot run in external runtime mode; run capture through a local-personal koed-server.");
+  }
+  return {
+    runtimeMode: resolvedRuntimeMode,
+    dependencyMode: dependencyMode(environment.KOED_DEPENDENCY_MODE) ?? dependencyMode(file.dependencyMode) ?? (resolvedRuntimeMode === "local-personal" ? "bundled-local" : "external"),
+    codexTranscriptWatcherEnabled: resolvedTranscriptWatcherSetting ?? resolvedRuntimeMode !== "external",
+    claudeTranscriptWatcherEnabled: resolvedClaudeTranscriptWatcherSetting ?? resolvedRuntimeMode !== "external",
+    piTranscriptWatcherEnabled: resolvedPiTranscriptWatcherSetting ?? resolvedRuntimeMode !== "external",
+    codexGlobalMemoryGuidanceEnabled: booleanSetting(environment.KOED_CODEX_GLOBAL_MEMORY_GUIDANCE_ENABLED) ?? booleanSetting(file.codexGlobalMemoryGuidanceEnabled) ?? defaultKoedServerConfig.codexGlobalMemoryGuidanceEnabled,
+    hardwareAcceleration: hardwareAccelerationPreference(environment.KOED_HARDWARE_ACCELERATION, "KOED_HARDWARE_ACCELERATION") ?? hardwareAccelerationPreference(file.hardwareAcceleration, "server.json hardwareAcceleration") ?? defaultKoedServerConfig.hardwareAcceleration,
+    external: {
+      databaseUrl: trim(environment.KOED_EXTERNAL_DATABASE_URL) ?? trim(environment.DATABASE_URL) ?? trim(file.external?.databaseUrl),
+      redisUrl: trim(environment.KOED_EXTERNAL_REDIS_URL) ?? trim(environment.REDIS_URL) ?? trim(file.external?.redisUrl),
+      embeddingServiceUrl: trim(environment.KOED_EXTERNAL_EMBEDDING_SERVICE_URL) ?? trim(environment.EMBEDDING_SERVICE_URL) ?? trim(file.external?.embeddingServiceUrl),
+      privacyServiceUrl: trim(environment.KOED_EXTERNAL_PRIVACY_SERVICE_URL) ?? trim(environment.PRIVACY_SERVICE_URL) ?? trim(file.external?.privacyServiceUrl)
+    }
+  };
+};
+var writeServerConfigAtomically = (paths, config, deps = {}) => {
+  mkdirSync(dirname(paths.serverConfigPath), { recursive: true, mode: 448 });
+  const temporary = `${paths.serverConfigPath}.${process.pid}.${randomUUID()}.tmp`;
+  try {
+    (deps.writeFileSync ?? writeFileSync)(temporary, `${JSON.stringify(config, null, 2)}
+`, { mode: 384 });
+    (deps.renameSync ?? renameSync)(temporary, paths.serverConfigPath);
+  } catch (error) {
+    (deps.rmSync ?? rmSync)(temporary, { force: true });
+    throw error;
+  }
+};
+var writeCodexGlobalMemoryGuidancePreference = (paths, enabled, deps = {}) => {
+  const fileExists = deps.existsSync ?? existsSync;
+  const read = deps.readFileSync ?? readFileSync;
+  let existing = {};
+  if (fileExists(paths.serverConfigPath)) {
+    try {
+      const parsed = JSON.parse(read(paths.serverConfigPath, "utf8"));
+      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new Error("expected a JSON object");
+      }
+      existing = parsed;
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      throw new Error(`Cannot update Codex memory guidance preference because ${paths.serverConfigPath} is malformed: ${message}.`, { cause: error });
+    }
+  }
+  writeServerConfigAtomically(paths, { ...existing, codexGlobalMemoryGuidanceEnabled: enabled }, deps);
+};
+
+// packages/koed-server/dist/component-store.js
+import { createHash as createHash3 } from "node:crypto";
+import { chmodSync, closeSync as closeSync3, constants as constants3, copyFileSync, createWriteStream, existsSync as existsSync2, fstatSync as fstatSync2, lstatSync as lstatSync3, openSync as openSync3, mkdirSync as mkdirSync3, mkdtempSync, readFileSync as readFileSync3, readdirSync as readdirSync3, renameSync as renameSync2, rmSync as rmSync3, writeFileSync as writeFileSync2 } from "node:fs";
+import { basename as basename2, dirname as dirname2, isAbsolute as isAbsolute3, parse, relative as relative3, resolve as resolve3, sep as sep3 } from "node:path";
+import { Readable as Readable2, Transform } from "node:stream";
+import { pipeline } from "node:stream/promises";
+
+// packages/koed-server/dist/directory-lock.js
+import { mkdirSync as mkdirSync2, rmSync as rmSync2 } from "node:fs";
+var acquireDirectoryLock = (path) => {
+  try {
+    mkdirSync2(path, { mode: 448 });
+  } catch (error) {
+    if (error.code !== "EEXIST")
+      throw error;
+    throw Object.assign(new Error("lock is already held"), { code: "ELOCKED" });
+  }
+  let released = false;
+  return () => {
+    if (released)
+      return;
+    released = true;
+    rmSync2(path, { recursive: true, force: true });
+  };
+};
+
+// packages/koed-server/dist/desktop-runtime-capability.js
+import { createHash } from "node:crypto";
+import { closeSync, constants, lstatSync, openSync, readFileSync as readFileSync2, readlinkSync, readdirSync, realpathSync } from "node:fs";
+import { isAbsolute, relative, resolve, sep } from "node:path";
+var issuedCapabilities = /* @__PURE__ */ new WeakSet();
+var hash = (bytes) => createHash("sha256").update(bytes).digest("hex");
+function validateDesktopRuntimeManifest(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("Desktop runtime bundle manifest is invalid");
+  const record = value;
+  const target = record.target;
+  if (record.schemaVersion !== 1 || record.component !== "base" || typeof record.productVersion !== "string" || !target || typeof target !== "object" || Array.isArray(target) || target.platform !== "macos" && target.platform !== "linux" || target.architecture !== "arm64" && target.architecture !== "x64" || !Array.isArray(record.files))
+    throw new Error("Desktop runtime bundle manifest is invalid");
+  for (const item of record.files) {
+    if (!item || typeof item !== "object" || Array.isArray(item))
+      throw new Error("Desktop runtime bundle manifest is invalid");
+    const entry = item;
+    if (typeof entry.path !== "string" || typeof entry.sha256 !== "string" || entry.kind !== "file" && entry.kind !== "symlink")
+      throw new Error("Desktop runtime bundle manifest is invalid");
+  }
+}
+var regularFile = (path) => {
+  if (constants.O_NOFOLLOW === void 0)
+    throw new Error("Desktop bundle no-follow access is unavailable");
+  const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+  try {
+    if (!lstatSync(path).isFile())
+      throw new Error("Desktop runtime bundle entry is not a regular file");
+    return readFileSync2(fd);
+  } finally {
+    closeSync(fd);
+  }
+};
+function verifyDesktopRuntimeBundle(resourcesPath) {
+  const actualResources = realpathSync.native(resolve(resourcesPath));
+  const runtimeRoot = resolve(actualResources, "koed-runtime");
+  const manifestPath = resolve(runtimeRoot, "desktop-bundle-manifest.json");
+  const manifestBytes = regularFile(manifestPath);
+  const manifest = JSON.parse(manifestBytes.toString("utf8"));
+  validateDesktopRuntimeManifest(manifest);
+  const record = manifest;
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry of record.files) {
+    const path = entry.path;
+    const absolute = resolve(runtimeRoot, path);
+    const rel = relative(runtimeRoot, absolute);
+    if (!path || !/^[a-f0-9]{64}$/.test(entry.sha256) || path.split("/").some((part) => !part || part === "." || part === "..") || path.startsWith("privacy-service/") || isAbsolute(path) || rel === ".." || rel.startsWith(`..${sep}`) || seen.has(path)) {
+      throw new Error("Desktop runtime bundle manifest path is invalid");
+    }
+    seen.add(path);
+    const actualDigest = entry.kind === "file" ? hash(regularFile(absolute)) : hash(readlinkSync(absolute));
+    if (actualDigest !== entry.sha256) {
+      throw new Error("Desktop runtime bundle file digest mismatch");
+    }
+    if (entry.kind === "symlink") {
+      const target = realpathSync.native(absolute);
+      const targetRelative = relative(runtimeRoot, target);
+      if (targetRelative === ".." || targetRelative.startsWith(`..${sep}`) || isAbsolute(targetRelative)) {
+        throw new Error("Desktop runtime bundle symlink escaped resources");
+      }
+    }
+  }
+  const actualFiles = [];
+  const collectFiles = (directory, prefix = "") => {
+    for (const entry of readdirSync(directory, { withFileTypes: true })) {
+      const path = prefix ? `${prefix}/${entry.name}` : entry.name;
+      if (entry.isDirectory())
+        collectFiles(resolve(directory, entry.name), path);
+      else if (entry.isFile() || entry.isSymbolicLink()) {
+        if (path !== "desktop-bundle-manifest.json")
+          actualFiles.push(path);
+      } else
+        throw new Error("Desktop runtime bundle contains an unsupported entry");
+    }
+  };
+  collectFiles(runtimeRoot);
+  if (actualFiles.some((path) => !seen.has(path)) || actualFiles.length !== seen.size) {
+    throw new Error("Desktop runtime bundle contains an unlisted file");
+  }
+  const verifiedManifest = Object.freeze({
+    ...record,
+    target: Object.freeze({ ...record.target }),
+    files: Object.freeze(record.files.map((entry) => Object.freeze({ ...entry })))
+  });
+  const capability = Object.freeze({
+    resourcesPath: actualResources,
+    productVersion: record.productVersion,
+    bundleDigest: hash(canonicalArtifactJson(record)),
+    manifest: verifiedManifest,
+    target: verifiedManifest.target
+  });
+  issuedCapabilities.add(capability);
+  return capability;
+}
+function validateDesktopRuntimeCapability(capability) {
+  return typeof capability === "object" && capability !== null && issuedCapabilities.has(capability);
+}
+function deriveDesktopRuntimeOwner(koedHome, stableInstallationIdentity) {
+  return {
+    kind: "desktop",
+    installationId: hash(`${resolve(koedHome)}
+${resolve(stableInstallationIdentity)}`).slice(0, 32)
+  };
+}
+function resolveDesktopRuntimeOwner(capability, koedHome) {
+  if (!validateDesktopRuntimeCapability(capability)) {
+    throw new Error("validated private Desktop runtime capability is required");
+  }
+  return deriveDesktopRuntimeOwner(koedHome, capability.resourcesPath);
+}
+
+// packages/koed-server/dist/component-verification.js
+import { createHash as createHash2 } from "node:crypto";
+import { closeSync as closeSync2, constants as constants2, fstatSync, lstatSync as lstatSync2, openSync as openSync2, readdirSync as readdirSync2, readSync } from "node:fs";
+import { Readable } from "node:stream";
+import { basename, isAbsolute as isAbsolute2, relative as relative2, resolve as resolve2, sep as sep2 } from "node:path";
+import { createGunzip } from "node:zlib";
+
+// packages/koed-server/dist/component-artifact-identity.mjs
+var componentArchiveName = ({ component, productVersion, target, variant }) => `koed-${component}-${productVersion}-${target.platform}-${target.architecture}${variant === void 0 ? "" : `-${variant}`}.tar.gz`;
+var validateComponentVariantIdentity = (value) => {
+  if (value.schemaVersion === 1 && !Object.hasOwn(value, "variant"))
+    return;
+  if (value.schemaVersion === 2 && value.component === "privacy" && value.target?.platform === "linux" && value.target.architecture === "x64" && ["cpu", "cuda"].includes(value.variant))
+    return;
+  throw new Error("Unsupported component variant identity; update to a compatible control plane.");
+};
+
+// packages/koed-server/dist/component-verification.js
+var MAX_ARCHIVE_BYTES = 2 * 1024 * 1024 * 1024;
+var MAX_MANIFEST_BYTES = 64 * 1024 * 1024;
+var MAX_EXPANDED_BYTES = 4 * 1024 * 1024 * 1024;
+var MAX_FILE_BYTES = 1024 * 1024 * 1024;
+var MAX_FILES = 1e5;
+var MAX_DEPTH = 128;
+var MAX_DIRECTORIES = 1e5;
+var MAX_TAR_BYTES = MAX_EXPANDED_BYTES + MAX_FILES * 1024 + 1024;
+var canonicalComponentManifestBytes = (manifest) => canonicalArtifactBytes(manifest);
+function assertRecord(value, name, keys) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error(`${name} must be an object`);
+  const actual = Object.keys(value);
+  if (actual.length !== keys.length || keys.some((key) => !actual.includes(key)))
+    throw new Error(`${name} has invalid fields`);
+}
+function safeRelativePath(path, label) {
+  if (typeof path !== "string" || !path || path.includes("\\") || path.includes("\0") || isAbsolute2(path) || path.split("/").some((part) => part === ".." || part === "." || !part)) {
+    throw new Error(`${label} is unsafe`);
+  }
+}
+function validateComponentManifest(value) {
+  assertRecord(value, "component manifest", [
+    "schemaVersion",
+    "productVersion",
+    "component",
+    "target",
+    "runtimes",
+    "archive",
+    "requiredFiles",
+    "files",
+    ...value && typeof value === "object" && Object.hasOwn(value, "variant") ? ["variant"] : []
+  ]);
+  const manifest = value;
+  if (![1, 2].includes(manifest.schemaVersion) || !/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(manifest.productVersion) || !["base", "privacy"].includes(manifest.component))
+    throw new Error("component manifest identity is invalid");
+  validateComponentVariantIdentity(manifest);
+  assertRecord(manifest.target, "component target", manifest.target.libc ? ["platform", "architecture", "libc"] : ["platform", "architecture"]);
+  if (!["macos", "linux"].includes(manifest.target.platform) || !["arm64", "x64"].includes(manifest.target.architecture))
+    throw new Error("unsupported component target");
+  if (manifest.target.libc) {
+    assertRecord(manifest.target.libc, "component libc target", [
+      "family",
+      "minimumVersion"
+    ]);
+    if (manifest.target.platform !== "linux" || manifest.target.libc.family !== "glibc" || !isVersion2(manifest.target.libc.minimumVersion))
+      throw new Error("component libc target is invalid");
+  }
+  assertRecord(manifest.archive, "component archive", [
+    "name",
+    "bytes",
+    "sha256"
+  ]);
+  if (typeof manifest.archive.name !== "string" || basename(manifest.archive.name) !== manifest.archive.name || !Number.isSafeInteger(manifest.archive.bytes) || manifest.archive.bytes < 1 || !isHash(manifest.archive.sha256))
+    throw new Error("component archive metadata is invalid");
+  if (manifest.variant !== void 0 && manifest.archive.name !== componentArchiveName(manifest))
+    throw new Error("Component archive variant identity mismatch.");
+  if (!Array.isArray(manifest.runtimes) || manifest.runtimes.length === 0 || !Array.isArray(manifest.requiredFiles) || manifest.requiredFiles.length > MAX_FILES || !Array.isArray(manifest.files) || manifest.files.length > MAX_FILES)
+    throw new Error("component manifest lists are invalid");
+  for (const runtime of manifest.runtimes) {
+    if (!runtime || typeof runtime !== "object" || Array.isArray(runtime))
+      throw new Error("component runtime compatibility is invalid");
+    const runtimeRecord = runtime;
+    const runtimeKeys = [
+      "kind",
+      "runtimeRange",
+      "nodeRange",
+      ...runtimeRecord.modulesAbi === void 0 ? [] : ["modulesAbi"],
+      ...runtimeRecord.minimumNapi === void 0 ? [] : ["minimumNapi"]
+    ];
+    assertRecord(runtime, "component runtime compatibility", runtimeKeys);
+    if (typeof runtimeRecord.kind !== "string" || !["node", "electron"].includes(runtimeRecord.kind) || !validRange(runtime.runtimeRange) || !validRange(runtime.nodeRange) || runtimeRecord.modulesAbi !== void 0 && (typeof runtimeRecord.modulesAbi !== "string" || !/^\d+$/.test(runtimeRecord.modulesAbi)) || runtimeRecord.minimumNapi !== void 0 && (typeof runtimeRecord.minimumNapi !== "number" || !Number.isSafeInteger(runtimeRecord.minimumNapi) || runtimeRecord.minimumNapi < 1))
+      throw new Error("component runtime compatibility is invalid");
+    if (runtime.modulesAbi === void 0 && runtime.minimumNapi === void 0)
+      throw new Error("component runtime compatibility must bind ABI or N-API");
+  }
+  const paths = /* @__PURE__ */ new Set();
+  for (const item of manifest.files) {
+    assertRecord(item, "component file entry", ["path", "sha256"]);
+    safeRelativePath(item.path, "component file path");
+    if (!isHash(item.sha256) || paths.has(item.path))
+      throw new Error("component file inventory is invalid or duplicate");
+    paths.add(item.path);
+  }
+  const required = /* @__PURE__ */ new Set();
+  for (const path of manifest.requiredFiles) {
+    safeRelativePath(path, "required component path");
+    if (required.has(path) || !paths.has(path))
+      throw new Error("required component file is duplicate or missing from inventory");
+    required.add(path);
+  }
+}
+var isHash = (value) => typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
+var isVersion2 = (value) => typeof value === "string" && /^(?:0|[1-9]\d*)(?:\.(?:0|[1-9]\d*)){1,2}$/.test(value) && value.split(".").every((part) => Number.isSafeInteger(Number(part)));
+function versionParts(value) {
+  if (typeof value !== "string" || !/^(?:0|[1-9]\d*)(?:\.(?:0|[1-9]\d*)){0,2}$/.test(value))
+    return;
+  const parts = value.split(".").map(Number);
+  if (parts.some((part) => !Number.isSafeInteger(part)))
+    return;
+  return [...parts, 0, 0].slice(0, 3);
+}
+function compareVersions(a, b) {
+  const left = versionParts(a);
+  const right = versionParts(b);
+  if (!left || !right)
+    return;
+  for (let i = 0; i < 3; i++)
+    if (left[i] !== right[i])
+      return left[i] - right[i];
+  return 0;
+}
+function validRange(range) {
+  return typeof range === "string" && range.trim().length > 0 && range.split(/\s+/).every((part) => {
+    const match = /^(?:>=|>|<=|<|=)?((?:0|[1-9]\d*)(?:\.(?:0|[1-9]\d*)){0,2})$/.exec(part);
+    return Boolean(match && versionParts(match[1]));
+  });
+}
+function satisfies(version, range) {
+  return range.split(/\s+/).every((part) => {
+    const match = /^(>=|>|<=|<|=)?((?:0|[1-9]\d*)(?:\.(?:0|[1-9]\d*)){0,2})$/.exec(part);
+    if (!match)
+      return false;
+    const comparison = compareVersions(version, match[2]);
+    if (comparison === void 0)
+      return false;
+    switch (match[1]) {
+      case ">=":
+        return comparison >= 0;
+      case ">":
+        return comparison > 0;
+      case "<=":
+        return comparison <= 0;
+      case "<":
+        return comparison < 0;
+      default:
+        return comparison === 0;
+    }
+  });
+}
+function verifyCompatibility(manifest, input) {
+  if (manifest.component !== input.expectedComponent)
+    throw new Error("component mismatch");
+  if (manifest.variant !== input.expectedVariant)
+    throw new Error("component variant mismatch");
+  if (manifest.productVersion !== input.expectedVersion)
+    throw new Error("product version mismatch");
+  if (canonicalArtifactJson(manifest.target) !== canonicalArtifactJson(input.target))
+    throw new Error("component target mismatch");
+  if (manifest.target.platform !== input.runtime.platform || manifest.target.architecture !== input.runtime.architecture)
+    throw new Error("runtime target mismatch");
+  if (!isVersion2(input.runtime.version) || !isVersion2(input.runtime.nodeVersion) || typeof input.runtime.modulesAbi !== "string" || !/^\d+$/.test(input.runtime.modulesAbi) || !Number.isSafeInteger(input.runtime.napiVersion) || input.runtime.napiVersion < 0)
+    throw new Error("runtime identity is invalid");
+  const versionMatches = manifest.runtimes.filter((item) => item.kind === input.runtime.kind && satisfies(input.runtime.version, item.runtimeRange) && satisfies(input.runtime.nodeVersion, item.nodeRange));
+  if (!versionMatches.length)
+    throw new Error("runtime version is incompatible");
+  const abiMatches = versionMatches.filter((item) => item.modulesAbi === void 0 || item.modulesAbi === input.runtime.modulesAbi);
+  if (!abiMatches.length)
+    throw new Error("runtime ABI mismatch");
+  const compatibility = abiMatches.find((item) => item.minimumNapi === void 0 || input.runtime.napiVersion >= item.minimumNapi);
+  if (!compatibility)
+    throw new Error("runtime N-API version is incompatible");
+  if (manifest.target.libc) {
+    const comparison = isVersion2(input.runtime.libcVersion) ? compareVersions(input.runtime.libcVersion, manifest.target.libc.minimumVersion) : void 0;
+    if (comparison === void 0 || comparison < 0)
+      throw new Error("runtime libc version is incompatible");
+  }
+}
+function tarString(header, offset, length) {
+  const value = header.subarray(offset, offset + length);
+  const end = value.indexOf(0);
+  return value.subarray(0, end < 0 ? value.length : end).toString("utf8");
+}
+function tarNumber(header, offset, length) {
+  const text = tarString(header, offset, length).trim();
+  if (!/^[0-7]+$/.test(text))
+    throw new Error("malformed component tar numeric field");
+  const number = Number.parseInt(text, 8);
+  if (!Number.isSafeInteger(number))
+    throw new Error("component tar field exceeds safe integer range");
+  return number;
+}
+function* archiveChunks(archiveFd) {
+  let position = 0;
+  while (true) {
+    const buffer = Buffer.allocUnsafe(64 * 1024);
+    const bytesRead = readSync(archiveFd, buffer, 0, buffer.length, position);
+    if (bytesRead === 0)
+      return;
+    position += bytesRead;
+    yield buffer.subarray(0, bytesRead);
+  }
+}
+async function* tarBlocks(stream) {
+  let pending = Buffer.alloc(0);
+  let totalBytes = 0;
+  for await (const chunk of stream) {
+    pending = pending.length ? Buffer.concat([pending, chunk]) : chunk;
+    while (pending.length >= 512) {
+      totalBytes += 512;
+      if (totalBytes > MAX_TAR_BYTES)
+        throw new Error("component archive exceeds expanded size limit");
+      yield pending.subarray(0, 512);
+      pending = pending.subarray(512);
+    }
+  }
+  if (pending.length)
+    throw new Error("component archive has partial tar block");
+}
+async function verifyTarArchive(archiveFd, manifest) {
+  const contents = /* @__PURE__ */ new Map();
+  const seenPaths = /* @__PURE__ */ new Set();
+  let expandedBytes = 0;
+  let zeroBlocks = 0;
+  let ended = false;
+  const gunzip = createGunzip();
+  const archiveSource = Readable.from(archiveChunks(archiveFd));
+  const blocks = tarBlocks(archiveSource.pipe(gunzip));
+  try {
+    for await (const header of blocks) {
+      if (ended) {
+        if (!header.every((byte) => byte === 0))
+          throw new Error("component archive contains data after tar terminator");
+        continue;
+      }
+      if (header.every((byte) => byte === 0)) {
+        zeroBlocks++;
+        if (zeroBlocks === 2)
+          ended = true;
+        continue;
+      }
+      if (zeroBlocks)
+        throw new Error("component archive has incomplete tar terminator");
+      const storedChecksum = tarNumber(header, 148, 8);
+      const check = Buffer.from(header);
+      check.fill(32, 148, 156);
+      if (storedChecksum !== check.reduce((sum, byte) => sum + byte, 0))
+        throw new Error("malformed component tar header checksum");
+      const type = tarString(header, 156, 1) || "0";
+      if (type === "1")
+        throw new Error("component archives must not contain hard links");
+      if (type === "2")
+        throw new Error("component archives must not contain symbolic links");
+      if (type !== "0" && type !== "5")
+        throw new Error(`unsupported component tar entry type: ${type}`);
+      const name = tarString(header, 0, 100);
+      const prefix = tarString(header, 345, 155);
+      const rawPath = prefix ? `${prefix}/${name}` : name;
+      const path = rawPath.replace(/\/$/, "");
+      safeRelativePath(path, "component archive path");
+      const size = tarNumber(header, 124, 12);
+      if (type === "5" && size !== 0)
+        throw new Error("component directory tar entry must be empty");
+      if (size > MAX_FILE_BYTES)
+        throw new Error("component archive entry exceeds individual file limit");
+      expandedBytes += size;
+      if (expandedBytes > MAX_EXPANDED_BYTES)
+        throw new Error("component archive exceeds expanded size limit");
+      if (seenPaths.has(path))
+        throw new Error(`duplicate component archive path: ${path}`);
+      seenPaths.add(path);
+      if (seenPaths.size > MAX_FILES)
+        throw new Error("component archive exceeds file count limit");
+      if (type === "5")
+        continue;
+      const digest = createHash2("sha256");
+      let remaining = size;
+      while (remaining > 0) {
+        const data = await blocks.next();
+        if (data.done)
+          throw new Error("component archive is truncated");
+        const count = Math.min(remaining, 512);
+        digest.update(data.value.subarray(0, count));
+        remaining -= count;
+      }
+      contents.set(path, digest.digest("hex"));
+    }
+  } finally {
+    archiveSource.destroy();
+    gunzip.destroy();
+  }
+  if (!ended)
+    throw new Error("component archive is missing tar terminator");
+  for (const path of contents.keys()) {
+    const parents = path.split("/").slice(0, -1);
+    for (let index = 1; index <= parents.length; index++) {
+      const parentPath = parents.slice(0, index).join("/");
+      if (contents.has(parentPath))
+        throw new Error(`component archive file path conflict: ${parentPath}`);
+    }
+  }
+  const expected = new Map(manifest.files.map((file) => [file.path, file.sha256]));
+  if (contents.size !== expected.size)
+    throw new Error("component archive file inventory mismatch");
+  for (const [path, digest] of contents)
+    if (!expected.has(path) || digest !== expected.get(path))
+      throw new Error(`component archive file hash mismatch: ${path}`);
+  for (const required of manifest.requiredFiles)
+    if (!contents.has(required))
+      throw new Error(`required component file is missing: ${required}`);
+}
+function verifyComponentManifestPin(input) {
+  if (input.manifestBytes.length > MAX_MANIFEST_BYTES)
+    throw new Error("component manifest exceeds size limit");
+  let parsed;
+  try {
+    parsed = JSON.parse(input.manifestBytes.toString("utf8"));
+  } catch {
+    throw new Error("component manifest JSON is invalid");
+  }
+  validateComponentManifest(parsed);
+  const manifest = parsed;
+  const canonical = canonicalComponentManifestBytes(manifest);
+  if (!canonical.equals(input.manifestBytes))
+    throw new Error("component manifest is not canonical");
+  const pinnedDigest = lookupManifestPin(input.manifestCatalog, {
+    component: input.expectedComponent,
+    ...input.expectedVariant === void 0 ? {} : { variant: input.expectedVariant },
+    productVersion: input.expectedVersion,
+    target: input.target
+  });
+  if (createHash2("sha256").update(canonical).digest("hex") !== pinnedDigest)
+    throw new Error("component manifest pin mismatch");
+  if (manifest.component !== input.expectedComponent)
+    throw new Error("component mismatch");
+  if (manifest.variant !== input.expectedVariant)
+    throw new Error("component variant mismatch");
+  if (manifest.productVersion !== input.expectedVersion)
+    throw new Error("product version mismatch");
+  if (canonicalArtifactJson(manifest.target) !== canonicalArtifactJson(input.target))
+    throw new Error("component target mismatch");
+  return manifest;
+}
+async function verifyComponentSync(input) {
+  const manifest = verifyComponentManifestPin(input);
+  verifyCompatibility(manifest, input);
+  const stat = lstatSync2(input.archivePath);
+  if (!stat.isFile() || stat.isSymbolicLink() || stat.size > MAX_ARCHIVE_BYTES)
+    throw new Error("component archive is not a bounded regular file");
+  if (basename(input.archivePath) !== manifest.archive.name)
+    throw new Error("component archive name mismatch");
+  if (stat.size !== manifest.archive.bytes)
+    throw new Error("component archive size mismatch");
+  if (constants2.O_NOFOLLOW === void 0)
+    throw new Error("component archive no-follow access is unavailable");
+  const archiveFd = openSync2(input.archivePath, constants2.O_RDONLY | constants2.O_NOFOLLOW);
+  try {
+    const opened = fstatSync(archiveFd);
+    if (!opened.isFile() || !sameObject(stat, opened))
+      throw new Error("component archive changed during verification");
+    const archiveHash = createHash2("sha256");
+    for (const chunk of archiveChunks(archiveFd))
+      archiveHash.update(chunk);
+    if (!sameArchiveState(opened, fstatSync(archiveFd)))
+      throw new Error("component archive changed during verification");
+    if (archiveHash.digest("hex") !== manifest.archive.sha256)
+      throw new Error("component archive SHA-256 mismatch");
+    await verifyTarArchive(archiveFd, manifest);
+    if (!sameArchiveState(opened, fstatSync(archiveFd)))
+      throw new Error("component archive changed during verification");
+  } finally {
+    closeSync2(archiveFd);
+  }
+  return manifest;
+}
+var verifyComponent = (input) => verifyComponentSync(input);
+function hashFileDescriptor(fd) {
+  const digest = createHash2("sha256");
+  let position = 0;
+  while (true) {
+    const buffer = Buffer.allocUnsafe(64 * 1024);
+    const bytesRead = readSync(fd, buffer, 0, buffer.length, position);
+    if (bytesRead === 0)
+      return digest.digest("hex");
+    digest.update(buffer.subarray(0, bytesRead));
+    position += bytesRead;
+  }
+}
+function sameObject(left, right) {
+  return left.dev === right.dev && left.ino === right.ino;
+}
+function sameArchiveState(left, right) {
+  return sameObject(left, right) && left.size === right.size && left.mtimeMs === right.mtimeMs && left.ctimeMs === right.ctimeMs;
+}
+var EXTRACTED_TREE_LIMITS = {
+  maxFileBytes: MAX_FILE_BYTES,
+  maxExpandedBytes: MAX_EXPANDED_BYTES,
+  maxFiles: MAX_FILES,
+  maxDirectories: MAX_DIRECTORIES,
+  maxDepth: MAX_DEPTH,
+  maxEntries: MAX_FILES + MAX_DIRECTORIES
+};
+function verifyExtractedComponentSync(root, manifest, seams = {}) {
+  validateComponentManifest(manifest);
+  const canonicalRoot = resolve2(root);
+  const rootStat = lstatSync2(canonicalRoot);
+  if (rootStat.isSymbolicLink() || !rootStat.isDirectory())
+    throw new Error("component root is not a regular directory");
+  const observed = /* @__PURE__ */ new Set();
+  const expectedFiles = new Map(manifest.files.map((file) => [file.path, file.sha256]));
+  const limits = { ...EXTRACTED_TREE_LIMITS, ...seams.limits };
+  const stack = [canonicalRoot];
+  let directories = 0;
+  let entries = 0;
+  let totalBytes = 0;
+  while (stack.length) {
+    const current = stack.pop();
+    const beforeDirectory = lstatSync2(current);
+    if (!beforeDirectory.isDirectory() || beforeDirectory.isSymbolicLink())
+      throw new Error("component directory ancestry changed during verification");
+    seams.beforeReadDirectory?.(current);
+    const directoryEntries = readdirSync2(current, { withFileTypes: true });
+    for (const entry of directoryEntries) {
+      if (++entries > limits.maxEntries)
+        throw new Error("component tree exceeds entry count limit");
+      const path = resolve2(current, entry.name);
+      const relativePath = relative2(canonicalRoot, path).split(sep2).join("/");
+      safeRelativePath(relativePath, "extracted component path");
+      const stat = lstatSync2(path);
+      if (stat.isSymbolicLink() || !stat.isFile() && !stat.isDirectory())
+        throw new Error("component files must not contain links or special files");
+      if (stat.isDirectory()) {
+        if (++directories > limits.maxDirectories)
+          throw new Error("component tree exceeds directory count limit");
+        const depth = relativePath.split("/").length;
+        if (depth > limits.maxDepth)
+          throw new Error("component tree exceeds directory depth limit");
+        stack.push(path);
+        continue;
+      }
+      if (stat.nlink > 1)
+        throw new Error("component files must not contain links or special files");
+      if (stat.size > limits.maxFileBytes)
+        throw new Error("component file exceeds individual file limit");
+      totalBytes += stat.size;
+      if (totalBytes > limits.maxExpandedBytes)
+        throw new Error("component tree exceeds expanded size limit");
+      if (observed.size >= limits.maxFiles)
+        throw new Error("component tree exceeds file count limit");
+      observed.add(relativePath);
+      const expectedHash = expectedFiles.get(relativePath);
+      seams.beforeOpenFile?.(path);
+      if (constants2.O_NOFOLLOW === void 0)
+        throw new Error("component file no-follow access is unavailable");
+      const fd = openSync2(path, constants2.O_RDONLY | constants2.O_NOFOLLOW);
+      try {
+        const opened = fstatSync(fd);
+        if (!opened.isFile() || !sameObject(stat, opened))
+          throw new Error("component file changed during verification");
+        const fileHash = hashFileDescriptor(fd);
+        const after = fstatSync(fd);
+        const afterPath = lstatSync2(path);
+        if (!sameArchiveState(opened, after) || !sameArchiveState(after, afterPath))
+          throw new Error("component file changed during verification");
+        if (!expectedHash || fileHash !== expectedHash)
+          throw new Error(`component file hash mismatch: ${relativePath}`);
+      } finally {
+        closeSync2(fd);
+      }
+    }
+    if (!sameObject(beforeDirectory, lstatSync2(current)))
+      throw new Error("component directory ancestry changed during verification");
+  }
+  for (const file of manifest.files)
+    if (!observed.has(file.path))
+      throw new Error(`required component file is missing or incomplete: ${file.path}`);
+  for (const file of manifest.requiredFiles)
+    if (!observed.has(file))
+      throw new Error(`required component file is missing: ${file}`);
+}
+var verifyExtractedComponent = (root, manifest) => Promise.resolve().then(() => verifyExtractedComponentSync(root, manifest));
+
+// packages/koed-server/dist/component-store.js
+var MAX_MANIFEST_BYTES2 = 64 * 1024 * 1024;
+var MAX_ARCHIVE_BYTES2 = 2 * 1024 * 1024 * 1024;
+var MAX_REDIRECTS = 5;
+var MAX_GENERATION_RECORD_BYTES = 2 * MAX_MANIFEST_BYTES2 + 1024 * 1024;
+var REQUEST_TIMEOUT_MS = 3e4;
+var hash2 = (value) => createHash3("sha256").update(value).digest("hex");
+var isPlainRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var aborted = (signal) => {
+  if (signal?.aborted)
+    throw new Error("component installation cancelled");
+};
+var cancelBody = async (response) => {
+  try {
+    await response.body?.cancel();
+  } catch {
+  }
+};
+var exactKeys = (value, keys) => Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+var assertInside = (base, path) => {
+  const rel = relative3(resolve3(base), resolve3(path));
+  if (rel.startsWith("..") || isAbsolute3(rel))
+    throw new Error("component store path escaped KOED_HOME");
+};
+var assertDirectoryChain = (base, path) => {
+  assertInside(base, path);
+  const absolute = resolve3(path);
+  let cursor = parse(absolute).root;
+  for (const part of absolute.slice(cursor.length).split(sep3).filter(Boolean)) {
+    cursor = resolve3(cursor, part);
+    let stat;
+    try {
+      stat = lstatSync3(cursor);
+    } catch (error) {
+      if (error.code === "ENOENT")
+        return;
+      throw error;
+    }
+    if (stat.isSymbolicLink() || !stat.isDirectory())
+      throw new Error("component store path contains a non-directory or symbolic link");
+  }
+};
+var ensureSecureDirectory = (home, directory) => {
+  assertDirectoryChain(home, directory);
+  mkdirSync3(directory, { recursive: true, mode: 448 });
+  assertDirectoryChain(home, directory);
+};
+var privateDirectory = (path) => {
+  mkdirSync3(path, { recursive: true, mode: 448 });
+  const stat = lstatSync3(path);
+  if (!stat.isDirectory() || stat.isSymbolicLink())
+    throw new Error("component store directory is not a regular directory");
+  chmodSync(path, 448);
+};
+var runtimeMatches = (given, actual) => canonicalArtifactJson(given) === canonicalArtifactJson(actual);
+var readProductionManifestPinCatalog = () => productionComponentManifestCatalog === null ? null : validateManifestCatalog(productionComponentManifestCatalog);
+var compareNumericVersions = (left, right) => {
+  const parse3 = (value) => {
+    if (!/^(?:0|[1-9]\d*)(?:\.(?:0|[1-9]\d*)){0,2}$/.test(value))
+      return void 0;
+    const parts = value.split(".").map(Number);
+    if (parts.some((part) => !Number.isSafeInteger(part)))
+      return void 0;
+    return [...parts, 0, 0].slice(0, 3);
+  };
+  const leftParts = parse3(left);
+  const rightParts = parse3(right);
+  if (!leftParts || !rightParts)
+    return void 0;
+  for (let index = 0; index < 3; index++)
+    if (leftParts[index] !== rightParts[index])
+      return leftParts[index] - rightParts[index];
+  return 0;
+};
+var resolvePinnedTarget = (catalog, component, productVersion, target, libcVersion, variant) => {
+  if (!catalog) {
+    lookupManifestPin(null, { component, productVersion, target, variant });
+    throw new Error("Component manifest pin catalog is unavailable");
+  }
+  if (catalog.productVersion !== productVersion)
+    lookupManifestPin(catalog, { component, productVersion, target, variant });
+  if (target.libc)
+    return target;
+  const matches = catalog.entries.filter((entry) => entry.component === component && entry.variant === variant && entry.target.platform === target.platform && entry.target.architecture === target.architecture);
+  if (matches.length === 1)
+    return matches[0].target;
+  const compatibleLibcTargets = matches.filter((entry) => libcVersion !== void 0 && entry.target.libc !== void 0 && (compareNumericVersions(libcVersion, entry.target.libc.minimumVersion) ?? -1) >= 0).sort((left, right) => compareNumericVersions(right.target.libc.minimumVersion, left.target.libc.minimumVersion) ?? 0);
+  if (compatibleLibcTargets.length > 0)
+    return compatibleLibcTargets[0].target;
+  const platformTargets = matches.filter((entry) => !entry.target.libc);
+  if (platformTargets.length === 1)
+    return platformTargets[0].target;
+  if (matches.length > 1)
+    throw new Error("Component manifest pin target is ambiguous; exact libc target is required.");
+  lookupManifestPin(catalog, { component, productVersion, target, variant });
+  throw new Error("Required component manifest pin is missing.");
+};
+var resolveComponentManifestPinTarget = (catalog, input) => {
+  const target = resolvePinnedTarget(catalog, input.component, input.productVersion, input.target, input.runtime.libcVersion, input.variant);
+  lookupManifestPin(catalog, {
+    component: input.component,
+    variant: input.variant,
+    productVersion: input.productVersion,
+    target
+  });
+  return target;
+};
+var parseJsonFile = (path, maxBytes, requireCanonical = false) => {
+  if (constants3.O_NOFOLLOW === void 0)
+    throw new Error("component metadata no-follow access is unavailable");
+  const descriptor = openSync3(path, constants3.O_RDONLY | constants3.O_NOFOLLOW);
+  try {
+    const stat = fstatSync2(descriptor);
+    if (!stat.isFile() || stat.size > maxBytes)
+      throw new Error("component metadata is not a bounded regular file");
+    const bytes = readFileSync3(descriptor, "utf8");
+    const value = JSON.parse(bytes);
+    if (requireCanonical && canonicalArtifactJson(value) !== bytes)
+      throw new Error("component metadata is not canonical JSON");
+    return value;
+  } finally {
+    closeSync3(descriptor);
+  }
+};
+var readOfflineSource = (source) => {
+  const archivePath = resolve3(source.archivePath);
+  const archiveStat = lstatSync3(archivePath);
+  if (!archiveStat.isFile() || archiveStat.isSymbolicLink() || archiveStat.size > MAX_ARCHIVE_BYTES2)
+    throw new Error("component archive is not a bounded regular file");
+  return {
+    archivePath,
+    manifestBytes: readBoundedFile(source.manifestPath, MAX_MANIFEST_BYTES2)
+  };
+};
+var readBoundedFile = (path, limit) => {
+  const stat = lstatSync3(path);
+  if (!stat.isFile() || stat.isSymbolicLink() || stat.size > limit)
+    throw new Error("component metadata is not a bounded regular file");
+  return readFileSync3(path);
+};
+async function fetchBounded(urlText, destination, limit, signal, progress, collectBytes = true, attempt = 0) {
+  let url;
+  try {
+    url = new URL(urlText);
+  } catch {
+    throw new Error("component source URL is invalid");
+  }
+  if (url.protocol !== "https:" || url.username || url.password)
+    throw new Error("component downloads require safe HTTPS URLs");
+  for (let redirects = 0; ; redirects++) {
+    aborted(signal);
+    let response;
+    const timeoutController = new AbortController();
+    const requestSignal = signal ? AbortSignal.any([signal, timeoutController.signal]) : timeoutController.signal;
+    let timeout = setTimeout(() => timeoutController.abort(), REQUEST_TIMEOUT_MS);
+    const resetIdleTimeout = () => {
+      clearTimeout(timeout);
+      timeout = setTimeout(() => timeoutController.abort(), REQUEST_TIMEOUT_MS);
+    };
+    try {
+      response = await fetch(url, {
+        redirect: "manual",
+        signal: requestSignal
+      });
+    } catch (error) {
+      if (signal?.aborted)
+        throw new Error("component installation cancelled", { cause: error });
+      if (attempt < 2 && error instanceof TypeError) {
+        await new Promise((resolveRetry) => setTimeout(resolveRetry, 100 * (attempt + 1)));
+        return fetchBounded(url.href, destination, limit, signal, progress, collectBytes, attempt + 1);
+      }
+      throw error;
+    } finally {
+      clearTimeout(timeout);
+    }
+    if (response.status >= 500 && attempt < 2) {
+      await cancelBody(response);
+      await new Promise((resolveRetry) => setTimeout(resolveRetry, 100 * (attempt + 1)));
+      return fetchBounded(url.href, destination, limit, signal, progress, collectBytes, attempt + 1);
+    }
+    if ([301, 302, 303, 307, 308].includes(response.status)) {
+      if (redirects >= MAX_REDIRECTS) {
+        await cancelBody(response);
+        throw new Error("too many component redirects");
+      }
+      const location = response.headers.get("location");
+      if (!location) {
+        await cancelBody(response);
+        throw new Error("component redirect has no location");
+      }
+      try {
+        url = new URL(location, url);
+      } catch {
+        await cancelBody(response);
+        throw new Error("component redirect URL is invalid");
+      }
+      if (url.protocol !== "https:" || url.username || url.password) {
+        await cancelBody(response);
+        throw new Error("component redirect requires safe HTTPS");
+      }
+      await cancelBody(response);
+      continue;
+    }
+    if (!response.ok || !response.body) {
+      await cancelBody(response);
+      throw new Error(`component download failed with HTTP ${response.status}`);
+    }
+    const length = Number(response.headers.get("content-length"));
+    if (Number.isFinite(length) && length > limit) {
+      await cancelBody(response);
+      throw new Error("component download exceeds size limit");
+    }
+    let transferredBytes = 0;
+    const chunks = [];
+    const limiter = new Transform({
+      transform(chunk, _encoding, callback) {
+        resetIdleTimeout();
+        transferredBytes += chunk.length;
+        if (transferredBytes > limit) {
+          callback(new Error("component download exceeds size limit"));
+          return;
+        }
+        progress?.({
+          phase: basename2(destination),
+          transferredBytes,
+          ...Number.isFinite(length) && length > 0 ? { totalBytes: length } : {}
+        });
+        if (collectBytes)
+          chunks.push(Buffer.from(chunk));
+        callback(null, chunk);
+      }
+    });
+    const output = createWriteStream(destination, { flags: "wx", mode: 384 });
+    resetIdleTimeout();
+    try {
+      await pipeline(Readable2.fromWeb(response.body), limiter, output, { signal: requestSignal });
+    } catch (error) {
+      rmSync3(destination, { force: true });
+      if (signal?.aborted)
+        throw new Error("component installation cancelled", { cause: error });
+      if (attempt < 2 && error instanceof TypeError) {
+        await new Promise((resolveRetry) => setTimeout(resolveRetry, 100 * (attempt + 1)));
+        return fetchBounded(url.href, destination, limit, signal, progress, collectBytes, attempt + 1);
+      }
+      throw error;
+    } finally {
+      clearTimeout(timeout);
+    }
+    return collectBytes ? Buffer.concat(chunks) : void 0;
+  }
+}
+async function acquireLock(home, root, signal, fn) {
+  ensureSecureDirectory(home, root);
+  let release;
+  for (let attempt = 0; !release; attempt++) {
+    aborted(signal);
+    assertDirectoryChain(home, root);
+    try {
+      release = acquireDirectoryLock(`${root}.lock`);
+    } catch (error) {
+      if (error.code !== "ELOCKED" || attempt >= 20)
+        throw error;
+      await new Promise((resolveDelay, reject) => {
+        const cleanup = () => signal?.removeEventListener("abort", cancel);
+        const timer = setTimeout(() => {
+          cleanup();
+          resolveDelay();
+        }, 25);
+        const cancel = () => {
+          clearTimeout(timer);
+          cleanup();
+          reject(new Error("component installation cancelled"));
+        };
+        signal?.addEventListener("abort", cancel, { once: true });
+        if (signal?.aborted)
+          cancel();
+      });
+    }
+  }
+  try {
+    aborted(signal);
+    assertDirectoryChain(home, root);
+    return await fn();
+  } finally {
+    release();
+  }
+}
+function targetKey(manifest) {
+  return hash2(canonicalArtifactJson({
+    component: manifest.component,
+    ...manifest.variant === void 0 ? {} : { variant: manifest.variant },
+    productVersion: manifest.productVersion,
+    target: manifest.target
+  })).slice(0, 24);
+}
+function validateOwner(owner) {
+  if (!isPlainRecord(owner) || !exactKeys(owner, ["kind", "installationId"]) || !["cli", "desktop", "standalone"].includes(String(owner.kind)) || typeof owner.installationId !== "string" || !/^[A-Za-z0-9._-]{1,128}$/.test(owner.installationId))
+    throw new Error("runtime owner is invalid");
+}
+function writeIndex(home, indexPath, manifestDigest, tempRoot, signal) {
+  const temporaryIndex = resolve3(tempRoot, `index-${manifestDigest}.json`);
+  writeFileSync2(temporaryIndex, JSON.stringify({ manifestDigest }), {
+    flag: "wx",
+    mode: 384
+  });
+  aborted(signal);
+  assertDirectoryChain(home, dirname2(indexPath));
+  renameSync2(temporaryIndex, indexPath);
+}
+function componentRecordPath(root) {
+  return resolve3(root, "component.json");
+}
+function componentPayloadPath(root) {
+  return resolve3(root, "payload");
+}
+function readComponentRecord(path) {
+  const value = parseJsonFile(path, MAX_MANIFEST_BYTES2 + 32768);
+  if (isPlainRecord(value) && value.schemaVersion === 1)
+    throw new Error("Stored component predates manifest pin admission; reinstall components using a trusted versioned control plane.");
+  if (!isPlainRecord(value) || !exactKeys(value, [
+    "schemaVersion",
+    "manifest",
+    "manifestDigest",
+    "archivePath"
+  ]) || value.schemaVersion !== 2 || !isPlainRecord(value.manifest) || typeof value.manifestDigest !== "string" || typeof value.archivePath !== "string")
+    throw new Error("stored component record is invalid");
+  return {
+    schemaVersion: 2,
+    manifest: value.manifest,
+    manifestDigest: value.manifestDigest,
+    archivePath: value.archivePath
+  };
+}
+async function verifyStoredComponent(home, root, expected) {
+  assertDirectoryChain(home, root);
+  const record = readComponentRecord(componentRecordPath(root));
+  validateComponentManifest(record.manifest);
+  const manifestBytes = Buffer.from(canonicalArtifactJson(record.manifest));
+  if (hash2(manifestBytes) !== record.manifestDigest)
+    throw new Error("stored component manifest digest mismatch");
+  const catalog = readProductionManifestPinCatalog();
+  const productVersion = expected.productVersion ?? catalog?.productVersion;
+  if (!productVersion)
+    throw new Error("Component manifest pin catalog is unavailable");
+  const target = resolveComponentManifestPinTarget(catalog, {
+    component: expected.component,
+    variant: record.manifest.variant,
+    productVersion,
+    target: expected.target ?? {
+      platform: expected.runtime.platform,
+      architecture: expected.runtime.architecture
+    },
+    runtime: expected.runtime
+  });
+  const archivePath = resolve3(root, record.archivePath);
+  assertInside(root, archivePath);
+  const manifest = await verifyComponent({
+    manifestBytes,
+    manifestCatalog: catalog,
+    archivePath,
+    expectedComponent: expected.component,
+    expectedVariant: record.manifest.variant,
+    expectedVersion: productVersion,
+    target,
+    runtime: expected.runtime
+  });
+  if (archivePath !== resolve3(root, manifest.archive.name))
+    throw new Error("stored component archive path is invalid");
+  const archiveStat = lstatSync3(archivePath);
+  if (!archiveStat.isFile() || archiveStat.isSymbolicLink())
+    throw new Error("stored component archive is not a regular file");
+  const payload = componentPayloadPath(root);
+  assertDirectoryChain(root, payload);
+  await verifyExtractedComponent(payload, manifest);
+  return {
+    kind: "manifest-pinned-component",
+    manifest,
+    root: payload,
+    manifestDigest: record.manifestDigest
+  };
+}
+async function stageComponentInternal(paths, source, context, runtime) {
+  aborted(context.signal);
+  const storeRoot = resolve3(paths.componentsDir);
+  assertInside(paths.koedHome, storeRoot);
+  assertDirectoryChain(paths.koedHome, storeRoot);
+  ensureSecureDirectory(paths.koedHome, storeRoot);
+  const tempRoot = mkdtempSync(resolve3(storeRoot, ".stage-"));
+  chmodSync(tempRoot, 448);
+  try {
+    const catalog = readProductionManifestPinCatalog();
+    let manifestBytes;
+    if (source.kind === "offline") {
+      manifestBytes = readOfflineSource(source).manifestBytes;
+    } else {
+      manifestBytes = await fetchBounded(source.manifestUrl, resolve3(tempRoot, "manifest.json"), MAX_MANIFEST_BYTES2, context.signal, context.progress);
+    }
+    if (context.target.platform !== runtime.platform || context.target.architecture !== runtime.architecture)
+      throw new Error("component target does not match actual runtime");
+    const target = resolveComponentManifestPinTarget(catalog, {
+      component: context.expectedComponent,
+      variant: context.expectedVariant,
+      productVersion: context.expectedVersion,
+      target: context.target,
+      runtime
+    });
+    const manifest = verifyComponentManifestPin({
+      manifestBytes,
+      manifestCatalog: catalog,
+      expectedComponent: context.expectedComponent,
+      expectedVariant: context.expectedVariant,
+      expectedVersion: context.expectedVersion,
+      target
+    });
+    const archivePath = resolve3(tempRoot, manifest.archive.name);
+    if (source.kind === "offline") {
+      copyFileSync(resolve3(source.archivePath), archivePath, 1);
+      chmodSync(archivePath, 384);
+    } else {
+      await fetchBounded(source.archiveUrl, archivePath, MAX_ARCHIVE_BYTES2, context.signal, context.progress, false);
+    }
+    aborted(context.signal);
+    context.progress?.({ phase: "verify", transferredBytes: 0 });
+    await verifyComponent({
+      manifestBytes,
+      manifestCatalog: catalog,
+      archivePath,
+      expectedComponent: context.expectedComponent,
+      expectedVariant: context.expectedVariant,
+      expectedVersion: context.expectedVersion,
+      target,
+      runtime
+    });
+    aborted(context.signal);
+    const manifestDigest = hash2(manifestBytes);
+    const componentDir = resolve3(storeRoot, manifest.component);
+    assertDirectoryChain(paths.koedHome, componentDir);
+    const indexPath = resolve3(componentDir, `${targetKey(manifest)}.json`);
+    const versionRoot = resolve3(componentDir, manifest.productVersion, manifestDigest);
+    const stagedRoot = resolve3(tempRoot, "verified");
+    const completeRoot = resolve3(tempRoot, "complete");
+    aborted(context.signal);
+    context.progress?.({ phase: "extract", transferredBytes: 0 });
+    await extractVerifiedPackageArchive(archivePath, stagedRoot);
+    aborted(context.signal);
+    await verifyExtractedComponent(stagedRoot, manifest);
+    aborted(context.signal);
+    privateDirectory(completeRoot);
+    renameSync2(stagedRoot, resolve3(completeRoot, "payload"));
+    renameSync2(archivePath, resolve3(completeRoot, manifest.archive.name));
+    writeFileSync2(componentRecordPath(completeRoot), JSON.stringify({
+      schemaVersion: 2,
+      manifest,
+      manifestDigest,
+      archivePath: resolve3(versionRoot, manifest.archive.name)
+    }), { flag: "wx", mode: 384 });
+    return await acquireLock(paths.koedHome, storeRoot, context.signal, async () => {
+      ensureSecureDirectory(paths.koedHome, componentDir);
+      assertDirectoryChain(paths.koedHome, versionRoot);
+      assertDirectoryChain(paths.koedHome, dirname2(indexPath));
+      if (existsSync2(indexPath)) {
+        const index = parseJsonFile(indexPath, 4096);
+        if (!isPlainRecord(index) || index.manifestDigest !== manifestDigest)
+          throw new Error("component version already installed with different digest");
+      }
+      if (existsSync2(versionRoot)) {
+        const cached = await verifyStoredComponent(paths.koedHome, versionRoot, {
+          component: manifest.component,
+          productVersion: manifest.productVersion,
+          target: manifest.target,
+          runtime
+        });
+        aborted(context.signal);
+        if (cached.manifestDigest !== manifestDigest)
+          throw new Error("component version already installed with different digest");
+        if (!existsSync2(indexPath)) {
+          aborted(context.signal);
+          assertDirectoryChain(paths.koedHome, dirname2(indexPath));
+          writeIndex(paths.koedHome, indexPath, manifestDigest, tempRoot, context.signal);
+        }
+        return cached;
+      }
+      if (existsSync2(indexPath))
+        throw new Error("component cache record is missing");
+      ensureSecureDirectory(paths.koedHome, dirname2(versionRoot));
+      let publishedRoot;
+      let committed = false;
+      try {
+        aborted(context.signal);
+        assertDirectoryChain(paths.koedHome, dirname2(versionRoot));
+        renameSync2(completeRoot, versionRoot);
+        publishedRoot = versionRoot;
+        aborted(context.signal);
+        assertDirectoryChain(paths.koedHome, dirname2(indexPath));
+        writeIndex(paths.koedHome, indexPath, manifestDigest, tempRoot, context.signal);
+        committed = true;
+        return {
+          kind: "manifest-pinned-component",
+          manifest,
+          root: componentPayloadPath(versionRoot),
+          manifestDigest
+        };
+      } finally {
+        if (publishedRoot && !committed)
+          rmSync3(publishedRoot, { recursive: true, force: true });
+      }
+    });
+  } finally {
+    rmSync3(tempRoot, { recursive: true, force: true });
+  }
+}
+async function stageComponent(paths, input, context) {
+  const actualRuntime = discoverActualRuntimeIdentity();
+  if (!runtimeMatches(context.runtime, actualRuntime))
+    throw new Error("caller runtime identity does not match actual runtime");
+  return stageComponentInternal(paths, input, context, actualRuntime);
+}
+async function stageGeneration(paths, input) {
+  const actualRuntime = discoverActualRuntimeIdentity();
+  validateOwner(input.owner);
+  const { base, privacy } = input;
+  assertDirectoryChain(paths.koedHome, paths.componentsDir);
+  assertDirectoryChain(paths.componentsDir, dirname2(base.root));
+  const baseVerified = await verifyStoredComponent(paths.koedHome, dirname2(base.root), {
+    component: "base",
+    runtime: actualRuntime
+  });
+  if (baseVerified.manifestDigest !== base.manifestDigest || resolve3(baseVerified.root) !== resolve3(base.root))
+    throw new Error("base component is not a verified store entry");
+  let privacyVerified;
+  if (privacy) {
+    assertDirectoryChain(paths.componentsDir, dirname2(privacy.root));
+    privacyVerified = await verifyStoredComponent(paths.koedHome, dirname2(privacy.root), {
+      component: "privacy",
+      runtime: actualRuntime
+    });
+    if (privacyVerified.manifestDigest !== privacy.manifestDigest || resolve3(privacyVerified.root) !== resolve3(privacy.root))
+      throw new Error("privacy component is not a verified store entry");
+  }
+  if (privacyVerified && baseVerified.manifest.productVersion !== privacyVerified.manifest.productVersion)
+    throw new Error("mixed component versions");
+  if (privacyVerified && canonicalArtifactJson(baseVerified.manifest.target) !== canonicalArtifactJson(privacyVerified.manifest.target))
+    throw new Error("mixed component targets");
+  const identity = {
+    schemaVersion: 1,
+    productVersion: baseVerified.manifest.productVersion,
+    owner: input.owner,
+    base: {
+      manifestDigest: baseVerified.manifestDigest,
+      root: relative3(paths.koedHome, baseVerified.root)
+    },
+    ...privacyVerified ? {
+      privacy: {
+        manifestDigest: privacyVerified.manifestDigest,
+        root: relative3(paths.koedHome, privacyVerified.root)
+      }
+    } : {}
+  };
+  const id = hash2(canonicalArtifactJson(identity));
+  const generationRoot = resolve3(paths.generationsDir, id);
+  assertDirectoryChain(paths.koedHome, generationRoot);
+  assertDirectoryChain(paths.koedHome, paths.generationsDir);
+  return acquireLock(paths.koedHome, paths.generationsDir, void 0, async () => {
+    if (existsSync2(generationRoot))
+      return readStagedGeneration(paths, id);
+    ensureSecureDirectory(paths.koedHome, paths.generationsDir);
+    const tempRoot = mkdtempSync(resolve3(paths.generationsDir, ".stage-"));
+    chmodSync(tempRoot, 448);
+    try {
+      const freshBase = await verifyStoredComponent(paths.koedHome, dirname2(baseVerified.root), {
+        component: "base",
+        runtime: actualRuntime
+      });
+      const freshPrivacy = privacyVerified ? await verifyStoredComponent(paths.koedHome, dirname2(privacyVerified.root), {
+        component: "privacy",
+        runtime: actualRuntime
+      }) : void 0;
+      const record = {
+        ...identity,
+        id,
+        components: {
+          base: {
+            manifest: freshBase.manifest,
+            manifestDigest: freshBase.manifestDigest
+          },
+          ...privacyVerified ? {
+            privacy: {
+              manifest: freshPrivacy.manifest,
+              manifestDigest: freshPrivacy.manifestDigest
+            }
+          } : {}
+        }
+      };
+      const recordBytes = Buffer.from(canonicalArtifactJson(record));
+      if (recordBytes.length > MAX_GENERATION_RECORD_BYTES)
+        throw new Error("generation record exceeds size limit");
+      writeFileSync2(resolve3(tempRoot, "generation.json"), recordBytes, {
+        flag: "wx",
+        mode: 384
+      });
+      assertDirectoryChain(paths.koedHome, paths.generationsDir);
+      assertDirectoryChain(paths.generationsDir, generationRoot);
+      renameSync2(tempRoot, generationRoot);
+      return {
+        id,
+        productVersion: identity.productVersion,
+        base: baseVerified,
+        ...privacyVerified ? { privacy: privacyVerified } : {},
+        owner: input.owner
+      };
+    } finally {
+      if (existsSync2(tempRoot))
+        rmSync3(tempRoot, { recursive: true, force: true });
+    }
+  });
+}
+async function readStoredComponents(paths, runtime) {
+  const components = [];
+  for (const component of ["base", "privacy"]) {
+    const componentRoot = resolve3(paths.componentsDir, component);
+    if (!existsSync2(componentRoot))
+      continue;
+    assertDirectoryChain(paths.koedHome, componentRoot);
+    for (const versionEntry of readdirSync3(componentRoot, {
+      withFileTypes: true
+    })) {
+      if (!versionEntry.isDirectory() || !/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:\.(?:0|[1-9]\d*))?(?:-[0-9A-Za-z.-]+)?$/.test(versionEntry.name))
+        continue;
+      const versionRoot = resolve3(componentRoot, versionEntry.name);
+      for (const digestEntry of readdirSync3(versionRoot, {
+        withFileTypes: true
+      })) {
+        if (!digestEntry.isDirectory() || !/^[a-f0-9]{64}$/.test(digestEntry.name))
+          continue;
+        try {
+          components.push(await verifyStoredComponent(paths.koedHome, resolve3(versionRoot, digestEntry.name), {
+            component,
+            productVersion: versionEntry.name,
+            runtime
+          }));
+        } catch (error) {
+          if (error instanceof Error && error.message.startsWith("Stored component predates manifest pin admission;"))
+            throw error;
+        }
+      }
+    }
+  }
+  return components;
+}
+var readDesktopPrivacyGeneration = async (paths, id, record) => {
+  if (!exactKeys(record, [
+    "schemaVersion",
+    "kind",
+    "id",
+    "productVersion",
+    "owner",
+    "resourcesPath",
+    "bundleDigest",
+    "privacy"
+  ]) || record.schemaVersion !== 1 || record.kind !== "desktop-bundle-with-privacy" || record.id !== id || typeof record.productVersion !== "string" || typeof record.resourcesPath !== "string" || typeof record.bundleDigest !== "string" || !/^[a-f0-9]{64}$/.test(record.bundleDigest) || !isPlainRecord(record.privacy) || !exactKeys(record.privacy, ["root", "manifestDigest"]) || typeof record.privacy.root !== "string" || typeof record.privacy.manifestDigest !== "string")
+    throw new Error("stored Desktop privacy generation record is invalid");
+  validateOwner(record.owner);
+  const bundle = verifyDesktopRuntimeBundle(record.resourcesPath);
+  if (bundle.productVersion !== record.productVersion || bundle.bundleDigest !== record.bundleDigest)
+    throw new Error("Desktop runtime bundle changed after generation staging");
+  const runtime = discoverActualRuntimeIdentity();
+  const privacyRoot = resolve3(paths.koedHome, record.privacy.root);
+  assertInside(paths.koedHome, privacyRoot);
+  const privacy = await verifyStoredComponent(paths.koedHome, dirname2(privacyRoot), {
+    component: "privacy",
+    productVersion: bundle.productVersion,
+    target: bundle.target,
+    runtime
+  });
+  if (privacy.root !== privacyRoot || privacy.manifestDigest !== record.privacy.manifestDigest)
+    throw new Error("Desktop privacy generation differs from verified component");
+  const identity = {
+    schemaVersion: 1,
+    kind: "desktop-bundle-with-privacy",
+    productVersion: bundle.productVersion,
+    owner: record.owner,
+    resourcesPath: bundle.resourcesPath,
+    bundleDigest: bundle.bundleDigest,
+    privacy: {
+      root: relative3(paths.koedHome, privacy.root),
+      manifestDigest: privacy.manifestDigest
+    }
+  };
+  if (hash2(canonicalArtifactJson(identity)) !== id)
+    throw new Error("Desktop privacy generation digest mismatch");
+  return {
+    id,
+    productVersion: bundle.productVersion,
+    base: {
+      kind: "desktop-bundle",
+      manifest: bundle.manifest,
+      root: resolve3(bundle.resourcesPath, "koed-runtime"),
+      manifestDigest: bundle.bundleDigest
+    },
+    privacy,
+    owner: record.owner
+  };
+};
+function readGenerationRecord(paths, id) {
+  if (!/^[a-f0-9]{64}$/.test(id))
+    throw new Error("generation id is invalid");
+  assertDirectoryChain(paths.koedHome, paths.generationsDir);
+  const root = resolve3(paths.generationsDir, id);
+  assertDirectoryChain(paths.generationsDir, root);
+  return parseJsonFile(resolve3(root, "generation.json"), MAX_GENERATION_RECORD_BYTES, true);
+}
+function assertOrderingStoreMetadata(root, manifest, digest) {
+  const stored = readComponentRecord(componentRecordPath(root));
+  if (stored.manifestDigest !== digest || canonicalArtifactJson(stored.manifest) !== canonicalArtifactJson(manifest) || stored.archivePath !== resolve3(root, manifest.archive.name))
+    throw new Error("generation component metadata differs from store");
+}
+function readOrderingComponent(paths, component, version, reference, embedded) {
+  if (!isPlainRecord(reference) || !exactKeys(reference, ["root", "manifestDigest"]) || typeof reference.root !== "string" || !isPlainRecord(embedded) || !exactKeys(embedded, ["manifest", "manifestDigest"]))
+    throw new Error("stored generation component reference is invalid");
+  validateComponentManifest(embedded.manifest);
+  const manifest = embedded.manifest;
+  const digest = hash2(canonicalArtifactJson(manifest));
+  if (manifest.component !== component || manifest.productVersion !== version || reference.manifestDigest !== digest || embedded.manifestDigest !== digest)
+    throw new Error("generation component identity mismatch");
+  const componentRoot = resolve3(paths.componentsDir, component, version, digest);
+  const payload = componentPayloadPath(componentRoot);
+  assertInside(paths.koedHome, componentRoot);
+  if (reference.root !== relative3(paths.koedHome, payload))
+    throw new Error("stored generation root is invalid");
+  assertDirectoryChain(paths.koedHome, payload);
+  assertOrderingStoreMetadata(componentRoot, manifest, digest);
+  return manifest;
+}
+function parseOrderingRecord(record, id) {
+  if (!isPlainRecord(record) || !exactKeys(record, [
+    "schemaVersion",
+    "productVersion",
+    "owner",
+    "base",
+    "components",
+    "id",
+    ...Object.hasOwn(record, "privacy") ? ["privacy"] : []
+  ]) || record.schemaVersion !== 1 || record.id !== id || typeof record.productVersion !== "string" || !isPlainRecord(record.components) || !exactKeys(record.components, [
+    "base",
+    ...Object.hasOwn(record, "privacy") ? ["privacy"] : []
+  ]))
+    throw new Error("stored generation record is invalid");
+  validateOwner(record.owner);
+  return {
+    ...record,
+    productVersion: record.productVersion,
+    owner: record.owner,
+    components: record.components
+  };
+}
+function readConsistentOrderingRecord(paths, id) {
+  const record = parseOrderingRecord(readGenerationRecord(paths, id), id);
+  const base = readOrderingComponent(paths, "base", record.productVersion, record.base, record.components.base);
+  if (Object.hasOwn(record, "privacy")) {
+    const privacy = readOrderingComponent(paths, "privacy", record.productVersion, record.privacy, record.components.privacy);
+    if (canonicalArtifactJson(privacy.target) !== canonicalArtifactJson(base.target))
+      throw new Error("generation component target mismatch");
+  }
+  const identity = {
+    schemaVersion: 1,
+    productVersion: record.productVersion,
+    owner: record.owner,
+    base: record.base,
+    ...Object.hasOwn(record, "privacy") ? { privacy: record.privacy } : {}
+  };
+  if (hash2(canonicalArtifactJson(identity)) !== id)
+    throw new Error("generation digest mismatch");
+  return record;
+}
+function readGenerationComponentPresence(paths, id) {
+  const record = readConsistentOrderingRecord(paths, id);
+  return Object.freeze(Object.hasOwn(record, "privacy") ? ["base", "privacy"] : ["base"]);
+}
+function readGenerationOrderingEvidence(paths, id) {
+  const record = readConsistentOrderingRecord(paths, id);
+  return Object.freeze({
+    kind: "generation-ordering-evidence",
+    id,
+    productVersion: record.productVersion,
+    owner: Object.freeze({ ...record.owner })
+  });
+}
+async function readStagedGeneration(paths, id) {
+  const record = readGenerationRecord(paths, id);
+  if (isPlainRecord(record) && record.kind === "desktop-bundle-with-privacy")
+    return readDesktopPrivacyGeneration(paths, id, record);
+  if (!isPlainRecord(record) || !exactKeys(record, [
+    "schemaVersion",
+    "productVersion",
+    "owner",
+    "base",
+    "components",
+    "id",
+    ...Object.hasOwn(record, "privacy") ? ["privacy"] : []
+  ]) || record.schemaVersion !== 1 || record.id !== id || typeof record.productVersion !== "string" || !isPlainRecord(record.base) || !exactKeys(record.base, ["manifestDigest", "root"]) || !isPlainRecord(record.components) || Object.hasOwn(record, "privacy") !== Object.hasOwn(record.components, "privacy") || !exactKeys(record.components, [
+    "base",
+    ...Object.hasOwn(record.components, "privacy") ? ["privacy"] : []
+  ]) || Object.hasOwn(record, "privacy") && !isPlainRecord(record.privacy))
+    throw new Error("stored generation record is invalid");
+  validateOwner(record.owner);
+  const runtime = discoverActualRuntimeIdentity();
+  const baseRelative = record.base.root;
+  if (typeof baseRelative !== "string")
+    throw new Error("stored generation root is invalid");
+  const baseRoot = resolve3(paths.koedHome, baseRelative);
+  assertInside(paths.koedHome, baseRoot);
+  const base = await verifyStoredComponent(paths.koedHome, dirname2(baseRoot), {
+    component: "base",
+    runtime
+  });
+  if (base.root !== baseRoot || base.manifestDigest !== record.base.manifestDigest || !isPlainRecord(record.components.base) || !exactKeys(record.components.base, ["manifest", "manifestDigest"]) || record.components.base.manifestDigest !== base.manifestDigest || canonicalArtifactJson(record.components.base.manifest) !== canonicalArtifactJson(base.manifest))
+    throw new Error("generation base reference differs from verified component");
+  let privacy;
+  if (Object.hasOwn(record, "privacy")) {
+    const reference = record.privacy;
+    if (!isPlainRecord(reference) || !exactKeys(reference, ["manifestDigest", "root"]) || typeof reference.root !== "string")
+      throw new Error("stored generation privacy reference is invalid");
+    const privacyRoot = resolve3(paths.koedHome, reference.root);
+    assertInside(paths.koedHome, privacyRoot);
+    privacy = await verifyStoredComponent(paths.koedHome, dirname2(privacyRoot), {
+      component: "privacy",
+      runtime
+    });
+    if (privacy.root !== privacyRoot || privacy.manifestDigest !== reference.manifestDigest || !isPlainRecord(record.components.privacy) || !exactKeys(record.components.privacy, ["manifest", "manifestDigest"]) || record.components.privacy.manifestDigest !== privacy.manifestDigest || canonicalArtifactJson(record.components.privacy.manifest) !== canonicalArtifactJson(privacy.manifest) || privacy.manifest.productVersion !== base.manifest.productVersion || canonicalArtifactJson(privacy.manifest.target) !== canonicalArtifactJson(base.manifest.target))
+      throw new Error("generation privacy reference differs from verified component");
+  }
+  if (record.productVersion !== base.manifest.productVersion)
+    throw new Error("generation product version differs from verified component");
+  const identity = {
+    schemaVersion: 1,
+    productVersion: base.manifest.productVersion,
+    owner: record.owner,
+    base: {
+      manifestDigest: base.manifestDigest,
+      root: relative3(paths.koedHome, base.root)
+    },
+    ...privacy ? {
+      privacy: {
+        manifestDigest: privacy.manifestDigest,
+        root: relative3(paths.koedHome, privacy.root)
+      }
+    } : {}
+  };
+  if (hash2(canonicalArtifactJson(identity)) !== id)
+    throw new Error("generation digest mismatch");
+  return {
+    id,
+    productVersion: base.manifest.productVersion,
+    base,
+    ...privacy ? { privacy } : {},
+    owner: record.owner
+  };
+}
+
+// packages/koed-server/dist/generation-lifecycle.js
+import { createHash as createHash4, randomBytes } from "node:crypto";
+import { existsSync as existsSync3, closeSync as closeSync5, constants as constants4, fstatSync as fstatSync3, openSync as openSync5, readSync as readSync2, lstatSync as lstatSync4, mkdirSync as mkdirSync5, readFileSync as readFileSync5, readdirSync as readdirSync4, renameSync as renameSync4, rmSync as rmSync5, statSync, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname3, isAbsolute as isAbsolute4, parse as parse2, relative as relative4, resolve as resolve5, sep as sep4 } from "node:path";
+
+// packages/koed-server/dist/supervisor-lock.js
+import { closeSync as closeSync4, mkdirSync as mkdirSync4, openSync as openSync4, readFileSync as readFileSync4, rmSync as rmSync4, writeFileSync as writeFileSync3 } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { hostname } from "node:os";
+import { resolve as resolve4 } from "node:path";
+var processIsRunning = (pid) => {
+  if (!Number.isInteger(pid) || pid <= 0)
+    return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    const code = error.code;
+    return code !== "ESRCH";
+  }
+};
+var resolveProcessIdentity = (pid) => {
+  if (!processIsRunning(pid))
+    return null;
+  try {
+    if (process.platform === "linux") {
+      const stat = readFileSync4(`/proc/${pid}/stat`, "utf8");
+      const commandEnd = stat.lastIndexOf(")");
+      if (commandEnd < 0)
+        return null;
+      const fields = stat.slice(commandEnd + 2).trim().split(/\s+/);
+      const startTime = fields[19];
+      if (!startTime)
+        return null;
+      const bootId = readFileSync4("/proc/sys/kernel/random/boot_id", "utf8").trim();
+      return `${hostname()}:linux:${bootId}:${startTime}`;
+    }
+    if (process.platform === "win32") {
+      const result2 = spawnSync("powershell.exe", [
+        "-NoProfile",
+        "-NonInteractive",
+        "-Command",
+        `(Get-Process -Id ${pid} -ErrorAction Stop).StartTime.ToUniversalTime().Ticks`
+      ], { encoding: "utf8", windowsHide: true, timeout: 2e3 });
+      const startedAt2 = result2.status === 0 ? result2.stdout.trim() : "";
+      return startedAt2 ? `${hostname()}:win32:${startedAt2}` : null;
+    }
+    const result = spawnSync("ps", ["-o", "lstart=", "-p", String(pid)], {
+      encoding: "utf8",
+      timeout: 2e3
+    });
+    const startedAt = result.status === 0 ? result.stdout.trim() : "";
+    return startedAt ? `${hostname()}:${process.platform}:${startedAt}` : null;
+  } catch {
+    return null;
+  }
+};
+var readSupervisorLock = (lockPath2) => {
+  try {
+    const value = JSON.parse(readFileSync4(lockPath2, "utf8"));
+    return Number.isInteger(value.pid) && Number(value.pid) > 0 ? {
+      pid: Number(value.pid),
+      acquiredAt: String(value.acquiredAt ?? "unknown"),
+      ...typeof value.processIdentity === "string" && value.processIdentity.length > 0 ? { processIdentity: value.processIdentity } : {}
+    } : null;
+  } catch {
+    return null;
+  }
+};
+var acquireKoedServerSupervisorLock = (paths, options = {}) => {
+  const pid = options.pid ?? process.pid;
+  const isRunning = options.isProcessRunning ?? processIsRunning;
+  const identify = options.resolveProcessIdentity ?? resolveProcessIdentity;
+  const processIdentity = identify(pid);
+  if (!processIdentity) {
+    throw new Error(`Could not resolve process identity for PID ${pid}.`);
+  }
+  const lockPath2 = resolve4(paths.runDir, "koed-server.lock");
+  mkdirSync4(paths.runDir, { recursive: true, mode: 448 });
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    try {
+      const descriptor = openSync4(lockPath2, "wx", 384);
+      try {
+        writeFileSync3(descriptor, `${JSON.stringify({
+          pid,
+          acquiredAt: (options.now ?? (() => /* @__PURE__ */ new Date()))().toISOString(),
+          processIdentity
+        }, null, 2)}
+`);
+      } finally {
+        closeSync4(descriptor);
+      }
+      return { acquired: true, lockPath: lockPath2, ownerPid: pid, processIdentity };
+    } catch (error) {
+      if (error.code !== "EEXIST")
+        throw error;
+      const owner2 = readSupervisorLock(lockPath2);
+      if (!owner2)
+        return { acquired: false, lockPath: lockPath2 };
+      if (isRunning(owner2.pid)) {
+        const ownerIdentity = identify(owner2.pid);
+        if (!ownerIdentity && isRunning(owner2.pid)) {
+          return { acquired: false, lockPath: lockPath2, ownerPid: owner2.pid };
+        }
+        if (ownerIdentity) {
+          if (!owner2.processIdentity && owner2.pid !== pid) {
+            return { acquired: false, lockPath: lockPath2, ownerPid: owner2.pid };
+          }
+          if (owner2.processIdentity && ownerIdentity === owner2.processIdentity) {
+            return { acquired: false, lockPath: lockPath2, ownerPid: owner2.pid };
+          }
+        }
+      }
+      rmSync4(lockPath2, { force: true });
+    }
+  }
+  const owner = readSupervisorLock(lockPath2);
+  return {
+    acquired: false,
+    lockPath: lockPath2,
+    ...owner ? { ownerPid: owner.pid } : {}
+  };
+};
+var releaseKoedServerSupervisorLock = (lock, pid = process.pid) => {
+  const owner = readSupervisorLock(lock.lockPath);
+  if (!lock.acquired || owner?.pid !== pid || !lock.processIdentity || owner.processIdentity !== lock.processIdentity)
+    return false;
+  rmSync4(lock.lockPath, { force: true });
+  return true;
+};
+
+// packages/koed-server/dist/generation-lifecycle-filesystem.js
+import { renameSync as renameSync3 } from "node:fs";
+var renameAtomically = (source, destination) => renameSync3(source, destination);
+
+// packages/koed-server/dist/generation-lifecycle.js
+var generationStatePath = (paths) => paths.generationStatePath ?? resolve5(paths.runDir, "runtime-generation.json");
+var lockPath = (paths) => resolve5(paths.runDir, "generation-lifecycle.lock");
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isRuntimeOwnerRecord = (value) => isRecord(value) && Object.keys(value).length === 2 && ["cli", "desktop", "standalone"].includes(String(value.kind)) && typeof value.installationId === "string" && /^[A-Za-z0-9._-]{1,128}$/.test(value.installationId);
+var readRegularFile = (path) => {
+  const stat = lstatSync4(path);
+  if (!stat.isFile() || stat.isSymbolicLink())
+    throw new Error("runtime lifecycle state is not a regular file");
+  return readFileSync5(path, "utf8");
+};
+var sameOwner = (left, right) => left.kind === right.kind && left.installationId === right.installationId;
+var assertDirectoryChain2 = (base, target) => {
+  const relativePath = relative4(resolve5(base), resolve5(target));
+  if (relativePath.startsWith("..") || isAbsolute4(relativePath))
+    throw new Error("runtime lifecycle path escaped KOED_HOME");
+  const absolute = resolve5(target);
+  let cursor = parse2(absolute).root;
+  for (const part of absolute.slice(cursor.length).split(sep4).filter(Boolean)) {
+    cursor = resolve5(cursor, part);
+    try {
+      const stat = lstatSync4(cursor);
+      if (stat.isSymbolicLink() || !stat.isDirectory())
+        throw new Error("runtime lifecycle path contains a symbolic link or non-directory");
+    } catch (error) {
+      if (error.code === "ENOENT")
+        return;
+      throw error;
+    }
+  }
+};
+var processIsRunning2 = (pid) => {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code !== "ESRCH";
+  }
+};
+var readLockRecord = (path) => {
+  try {
+    const parsed = JSON.parse(readRegularFile(resolve5(path, "owner.json")));
+    if (!isRecord(parsed))
+      return null;
+    const record = parsed;
+    if (Object.keys(record).length !== 3 || typeof record.pid !== "number" || !Number.isInteger(record.pid) || record.pid <= 0 || typeof record.processIdentity !== "string" || record.processIdentity.length === 0 || typeof record.token !== "string" || !/^[a-f0-9]{64}$/.test(record.token))
+      return null;
+    return {
+      pid: Number(record.pid),
+      processIdentity: record.processIdentity,
+      token: record.token
+    };
+  } catch {
+    return null;
+  }
+};
+var acquireLifecycleLock = (paths) => {
+  assertDirectoryChain2(paths.koedHome, paths.runDir);
+  mkdirSync5(paths.runDir, { recursive: true, mode: 448 });
+  assertDirectoryChain2(paths.koedHome, paths.runDir);
+  const path = lockPath(paths);
+  assertDirectoryChain2(paths.koedHome, path);
+  const identity = resolveProcessIdentity(process.pid);
+  if (!identity)
+    throw new Error("runtime process identity is unavailable");
+  const record = {
+    pid: process.pid,
+    processIdentity: identity,
+    token: randomBytes(32).toString("hex")
+  };
+  try {
+    mkdirSync5(path, { mode: 448 });
+    assertDirectoryChain2(paths.koedHome, path);
+    writeFileSync4(resolve5(path, "owner.json"), `${JSON.stringify(record)}
+`, {
+      flag: "wx",
+      mode: 384
+    });
+    return record;
+  } catch (error) {
+    if (error.code !== "EEXIST")
+      throw error;
+    throw new Error("runtime lifecycle is locked; stale locks require stopped-runtime operator recovery", { cause: error });
+  }
+};
+var releaseLifecycleLock = (paths, expected) => {
+  const path = lockPath(paths);
+  const actual = readLockRecord(path);
+  if (!actual || actual.pid !== expected.pid || actual.token !== expected.token || actual.processIdentity !== expected.processIdentity)
+    return;
+  rmSync5(path, { recursive: true, force: true });
+};
+var withStoreLock = async (paths, action) => {
+  assertDirectoryChain2(paths.koedHome, paths.componentsDir);
+  mkdirSync5(paths.componentsDir, { recursive: true, mode: 448 });
+  assertDirectoryChain2(paths.koedHome, paths.componentsDir);
+  const lockPath2 = `${paths.componentsDir}.lock`;
+  assertDirectoryChain2(paths.koedHome, lockPath2);
+  const release = acquireDirectoryLock(lockPath2);
+  try {
+    return await action();
+  } finally {
+    release();
+  }
+};
+var readCurrentId = (paths) => {
+  assertDirectoryChain2(paths.koedHome, paths.componentsDir);
+  const pointerPath = resolve5(paths.componentsDir, "current.json");
+  if (!existsSync3(pointerPath))
+    return null;
+  const value = JSON.parse(readRegularFile(pointerPath));
+  if (!isRecord(value))
+    throw new Error("current generation pointer is invalid");
+  const pointer = value;
+  if (Object.keys(pointer).length !== 2 || pointer.schemaVersion !== 1 || typeof pointer.generationId !== "string" || !/^[a-f0-9]{64}$/.test(pointer.generationId))
+    throw new Error("current generation pointer is invalid");
+  return pointer.generationId;
+};
+var writeCurrentPointer = (paths, id) => {
+  const pointer = resolve5(paths.componentsDir, "current.json");
+  const temporary = resolve5(dirname3(pointer), `.current-${randomBytes(8).toString("hex")}.tmp`);
+  writeFileSync4(temporary, `${JSON.stringify({ schemaVersion: 1, generationId: id })}
+`, { flag: "wx", mode: 384 });
+  try {
+    renameAtomically(temporary, pointer);
+  } catch (error) {
+    rmSync5(temporary, { force: true });
+    throw error;
+  }
+};
+var readPinState = (paths) => {
+  const path = generationStatePath(paths);
+  assertDirectoryChain2(paths.koedHome, dirname3(path));
+  if (!existsSync3(path))
+    return null;
+  const parsed = JSON.parse(readRegularFile(path));
+  if (!isRuntimeGenerationState(parsed))
+    throw new Error("runtime generation state is invalid");
+  return parsed;
+};
+var assertOwner = (generation, requester) => {
+  if (!sameOwner(generation.owner, requester))
+    throw new Error("runtime owner mismatch");
+};
+var assertNoActivePin = (paths, allowCurrentSupervisor = false) => {
+  const pin = readPinState(paths);
+  if (pin) {
+    const identity2 = resolveProcessIdentity(pin.pid);
+    if (identity2 === pin.processIdentity || !identity2 && processIsRunning2(pin.pid))
+      throw new Error("runtime generation is running or pinned");
+    rmSync5(generationStatePath(paths), { force: true });
+  }
+  const supervisorPath = resolve5(paths.runDir, "koed-server.lock");
+  if (!existsSync3(supervisorPath))
+    return;
+  const supervisor = readSupervisorLock(supervisorPath);
+  if (!supervisor)
+    throw new Error("supervisor liveness is uncertain");
+  const identity = resolveProcessIdentity(supervisor.pid);
+  if (allowCurrentSupervisor && supervisor.pid === process.pid && identity !== null && identity === supervisor.processIdentity)
+    return;
+  if (identity === supervisor.processIdentity || !identity && processIsRunning2(supervisor.pid) || !supervisor.processIdentity && processIsRunning2(supervisor.pid))
+    throw new Error("runtime generation is running or pinned");
+};
+function readCurrentGenerationOrderingEvidence(paths) {
+  const id = readCurrentId(paths);
+  if (!id)
+    throw new Error("no active runtime generation");
+  return readGenerationOrderingEvidence(paths, id);
+}
+async function readCurrentGeneration(paths) {
+  const id = readCurrentId(paths);
+  if (!id)
+    throw new Error("no active runtime generation");
+  return readStagedGeneration(paths, id);
+}
+var desktopBundleRecordPath = (paths, id) => resolve5(paths.generationsDir, id, "desktop-bundle.json");
+var persistDesktopBundleRecord = (paths, generation, capability) => {
+  const root = resolve5(paths.generationsDir, generation.id);
+  assertDirectoryChain2(paths.koedHome, root);
+  mkdirSync5(root, { recursive: true, mode: 448 });
+  const path = desktopBundleRecordPath(paths, generation.id);
+  const record = {
+    schemaVersion: 1,
+    kind: "desktop-bundle",
+    id: generation.id,
+    productVersion: generation.productVersion,
+    owner: generation.owner,
+    bundleDigest: capability.bundleDigest,
+    resourcesPath: capability.resourcesPath
+  };
+  try {
+    writeFileSync4(path, `${JSON.stringify(record)}
+`, {
+      flag: "wx",
+      mode: 384
+    });
+  } catch (error) {
+    if (error.code !== "EEXIST")
+      throw error;
+    const existing = JSON.parse(readRegularFile(path));
+    if (!isRecord(existing) || existing.schemaVersion !== record.schemaVersion || existing.kind !== record.kind || existing.id !== record.id || existing.productVersion !== record.productVersion || existing.bundleDigest !== record.bundleDigest || existing.resourcesPath !== record.resourcesPath || !isRecord(existing.owner) || existing.owner.kind !== generation.owner.kind || existing.owner.installationId !== generation.owner.installationId)
+      throw new Error("private Desktop bundle generation record is invalid", {
+        cause: error
+      });
+  }
+};
+var readDesktopBundleGenerationById = async (paths, id, capability) => {
+  const generation = await readDesktopBundleGeneration(paths, capability);
+  if (generation.id !== id)
+    throw new Error("runtime owner mismatch");
+  const record = JSON.parse(readRegularFile(desktopBundleRecordPath(paths, id)));
+  if (!isRecord(record) || record.schemaVersion !== 1 || record.kind !== "desktop-bundle" || record.id !== generation.id || record.productVersion !== generation.productVersion || record.bundleDigest !== capability.bundleDigest || record.resourcesPath !== capability.resourcesPath || !isRecord(record.owner) || record.owner.kind !== generation.owner.kind || record.owner.installationId !== generation.owner.installationId)
+    throw new Error("private Desktop bundle generation record is invalid");
+  return generation;
+};
+async function readDesktopGenerationForCapability(paths, id, capability) {
+  if (!validateDesktopRuntimeCapability(capability))
+    throw new Error("validated private Desktop runtime capability is required");
+  try {
+    return await readDesktopBundleGenerationById(paths, id, capability);
+  } catch (error) {
+    if (error instanceof Error && error.message === "runtime owner mismatch")
+      return readStagedGeneration(paths, id);
+    throw error;
+  }
+}
+async function readCurrentDesktopGeneration(paths, capability) {
+  if (!validateDesktopRuntimeCapability(capability))
+    throw new Error("validated private Desktop runtime capability is required");
+  const id = readCurrentId(paths);
+  if (!id)
+    throw new Error("no active runtime generation");
+  const generation = await readDesktopGenerationForCapability(paths, id, capability);
+  assertOwner(generation, resolveDesktopRuntimeOwner(capability, paths.koedHome));
+  return generation;
+}
+async function readCurrentGenerationForOwner(paths, requester) {
+  const generation = await readCurrentGeneration(paths);
+  assertOwner(generation, requester);
+  return generation;
+}
+var readOrderingJournalFile = (path) => {
+  if (constants4.O_NOFOLLOW === void 0)
+    throw new Error("component metadata no-follow access is unavailable");
+  const descriptor = openSync5(path, constants4.O_RDONLY | constants4.O_NOFOLLOW | constants4.O_NONBLOCK);
+  try {
+    const stat = fstatSync3(descriptor);
+    if (!stat.isFile() || stat.size > 1024 * 1024)
+      throw new Error("generation journal is not a bounded regular file");
+    const bytes = Buffer.alloc(stat.size + 1);
+    let length = 0;
+    while (length < bytes.length) {
+      const count = readSync2(descriptor, bytes, length, bytes.length - length, null);
+      if (count === 0)
+        break;
+      length += count;
+    }
+    if (length > stat.size)
+      throw new Error("generation journal changed while reading");
+    return bytes.subarray(0, length).toString("utf8");
+  } finally {
+    closeSync5(descriptor);
+  }
+};
+var readDesktopOrderingJournal = (paths, id) => {
+  const bundlePath = desktopBundleRecordPath(paths, id);
+  const hasBundle = existsSync3(bundlePath);
+  if (hasBundle)
+    assertDirectoryChain2(paths.koedHome, dirname3(bundlePath));
+  const record = hasBundle ? JSON.parse(readOrderingJournalFile(bundlePath)) : readGenerationRecord(paths, id);
+  if (!isRecord(record))
+    throw new Error("generation record is invalid");
+  if (record.kind !== "desktop-bundle" && record.kind !== "desktop-bundle-with-privacy")
+    return null;
+  validateDesktopOrderingJournal(record, id);
+  return Object.freeze({
+    kind: "desktop-generation-ordering-evidence",
+    id,
+    productVersion: record.productVersion,
+    owner: Object.freeze({ ...record.owner }),
+    bundleDigest: record.bundleDigest,
+    resourcesPath: record.resourcesPath,
+    components: Object.freeze(record.kind === "desktop-bundle" ? ["base"] : ["base", "privacy"])
+  });
+};
+function validateDesktopOrderingJournal(record, id) {
+  const privacy = record.kind === "desktop-bundle-with-privacy";
+  const keys = [
+    "schemaVersion",
+    "kind",
+    "id",
+    "productVersion",
+    "owner",
+    "bundleDigest",
+    "resourcesPath",
+    ...privacy ? ["privacy"] : []
+  ];
+  if (Object.keys(record).length !== keys.length || !keys.every((key) => Object.hasOwn(record, key)) || record.schemaVersion !== 1 || record.id !== id || typeof record.productVersion !== "string" || !/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(record.productVersion) || !isRuntimeOwnerRecord(record.owner) || record.owner.kind !== "desktop" || typeof record.resourcesPath !== "string" || !isAbsolute4(record.resourcesPath) || typeof record.bundleDigest !== "string" || !/^[a-f0-9]{64}$/.test(record.bundleDigest))
+    throw new Error("private Desktop bundle generation record is invalid");
+  if (privacy)
+    validateDesktopPrivacyJournal(record, id);
+  else if (createHash4("sha256").update(`${record.owner.installationId}
+${record.bundleDigest}`).digest("hex") !== id)
+    throw new Error("Desktop bundle generation identity mismatch");
+}
+function validateDesktopPrivacyJournal(record, id) {
+  if (!isRecord(record.privacy) || Object.keys(record.privacy).length !== 2 || typeof record.privacy.root !== "string" || isAbsolute4(record.privacy.root) || record.privacy.root.split(/[\\/]/).includes("..") || typeof record.privacy.manifestDigest !== "string" || !/^[a-f0-9]{64}$/.test(record.privacy.manifestDigest))
+    throw new Error("private Desktop privacy journal is invalid");
+  const identity = { ...record };
+  delete identity.id;
+  if (createHash4("sha256").update(canonicalArtifactJson(identity)).digest("hex") !== id)
+    throw new Error("Desktop privacy generation digest mismatch");
+}
+function readCurrentDesktopGenerationOrderingEvidence(paths, capability) {
+  if (!validateDesktopRuntimeCapability(capability))
+    throw new Error("validated private Desktop runtime capability is required");
+  const id = readCurrentId(paths);
+  if (!id)
+    throw new Error("no active runtime generation");
+  const evidence = readDesktopOrderingJournal(paths, id) ?? readGenerationOrderingEvidence(paths, id);
+  if (evidence.kind === "desktop-generation-ordering-evidence" && evidence.resourcesPath !== capability.resourcesPath)
+    throw new Error("runtime owner mismatch");
+  assertOwner(evidence, resolveDesktopRuntimeOwner(capability, paths.koedHome));
+  return evidence;
+}
+async function readCurrentRuntimeOwner(paths) {
+  if (!existsSync3(resolve5(paths.componentsDir, "current.json")))
+    return null;
+  const id = readCurrentId(paths);
+  if (!id)
+    return null;
+  return (await Promise.resolve(readDesktopOrderingJournal(paths, id) ?? readGenerationOrderingEvidence(paths, id))).owner;
+}
+var persistPinState = (paths, generation, requester, lock, source = "manifest-pinned-store") => {
+  const processIdentity = resolveProcessIdentity(process.pid);
+  if (!processIdentity)
+    throw new Error("runtime process identity is unavailable");
+  const state = {
+    schemaVersion: 1,
+    generationId: generation.id,
+    pid: process.pid,
+    processIdentity,
+    startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    owner: requester,
+    pinToken: lock.token,
+    ...source === "desktop-bundle" ? { source } : {}
+  };
+  const path = generationStatePath(paths);
+  mkdirSync5(dirname3(path), { recursive: true, mode: 448 });
+  const temporary = `${path}.${lock.token}.tmp`;
+  writeFileSync4(temporary, `${JSON.stringify(state)}
+`, {
+    flag: "wx",
+    mode: 384
+  });
+  renameSync4(temporary, path);
+  return { path, processIdentity };
+};
+var createPinRelease = (paths, lock, pinPath, processIdentity) => {
+  let released = false;
+  return () => Promise.resolve().then(() => {
+    if (released)
+      return;
+    released = true;
+    try {
+      const current = readPinState(paths);
+      if (current?.pinToken === lock.token && current.processIdentity === processIdentity)
+        rmSync5(pinPath, { force: true });
+    } finally {
+      releaseLifecycleLock(paths, lock);
+    }
+  });
+};
+function readDesktopBundleGeneration(paths, capability) {
+  if (!validateDesktopRuntimeCapability(capability))
+    throw new Error("validated private Desktop runtime capability is required");
+  const currentCapability = verifyDesktopRuntimeBundle(capability.resourcesPath);
+  if (currentCapability.productVersion !== capability.productVersion || currentCapability.bundleDigest !== capability.bundleDigest)
+    throw new Error("Desktop runtime bundle changed after verification");
+  const owner = resolveDesktopRuntimeOwner(capability, paths.koedHome);
+  const generation = desktopBundleGeneration(currentCapability, owner);
+  return Promise.resolve(generation);
+}
+async function pinDesktopBundleGenerationForStart(paths, capability) {
+  if (!validateDesktopRuntimeCapability(capability))
+    throw new Error("validated private Desktop runtime capability is required");
+  const requester = resolveDesktopRuntimeOwner(capability, paths.koedHome);
+  const lock = acquireLifecycleLock(paths);
+  try {
+    return await withStoreLock(paths, async () => {
+      assertNoActivePin(paths, true);
+      const bundled = await readDesktopBundleGeneration(paths, capability);
+      const activeId = readCurrentId(paths);
+      let active = null;
+      if (activeId) {
+        const prior = readCurrentDesktopGenerationOrderingEvidence(paths, capability);
+        if (isVersionDowngrade(prior.productVersion, bundled.productVersion))
+          throw new Error("Desktop generation downgrades are not supported.");
+        if (prior.kind === "desktop-generation-ordering-evidence" ? prior.bundleDigest === capability.bundleDigest : prior.productVersion === bundled.productVersion) {
+          active = await readDesktopGenerationForCapability(paths, activeId, capability);
+        }
+      }
+      if (active)
+        assertOwner(active, requester);
+      persistDesktopBundleRecord(paths, bundled, capability);
+      const generation = active && sameOwner(active.owner, requester) && active.productVersion === bundled.productVersion && active.base.manifestDigest === bundled.base.manifestDigest ? active : bundled;
+      if (activeId !== generation.id)
+        writeCurrentPointer(paths, generation.id);
+      const pin = persistPinState(paths, generation, requester, lock, "desktop-bundle");
+      return {
+        generation,
+        release: createPinRelease(paths, lock, pin.path, pin.processIdentity)
+      };
+    });
+  } catch (error) {
+    releaseLifecycleLock(paths, lock);
+    throw error;
+  }
+}
+var desktopBundleGeneration = (capability, owner) => {
+  const manifest = capability.manifest;
+  const id = createHash4("sha256").update(`${owner.installationId}
+${capability.bundleDigest}`).digest("hex");
+  return {
+    id,
+    productVersion: capability.productVersion,
+    base: {
+      kind: "desktop-bundle",
+      manifest,
+      root: resolve5(capability.resourcesPath, "koed-runtime"),
+      manifestDigest: capability.bundleDigest
+    },
+    owner
+  };
+};
+async function pinGenerationForStart(paths, requester) {
+  const lock = acquireLifecycleLock(paths);
+  try {
+    return await withStoreLock(paths, async () => {
+      assertNoActivePin(paths, true);
+      const generation = await readCurrentGeneration(paths);
+      assertOwner(generation, requester);
+      const pin = persistPinState(paths, generation, requester, lock);
+      return {
+        generation,
+        release: createPinRelease(paths, lock, pin.path, pin.processIdentity)
+      };
+    });
+  } catch (error) {
+    releaseLifecycleLock(paths, lock);
+    throw error;
+  }
+}
+async function activateGeneration(paths, id, requester, capability, selection) {
+  const lock = acquireLifecycleLock(paths);
+  try {
+    return await withStoreLock(paths, async () => {
+      assertNoActivePin(paths);
+      const currentId = readCurrentId(paths);
+      if (selection && currentId !== selection.expectedCurrentGeneration)
+        throw new Error("Runtime selection changed during Privacy installation. Retry from the current selection; no generation was replaced.");
+      const candidate = capability ? await readDesktopGenerationForCapability(paths, id, capability) : await readStagedGeneration(paths, id);
+      assertOwner(candidate, requester);
+      if (currentId) {
+        const current = capability ? await readDesktopGenerationForCapability(paths, currentId, capability) : readGenerationOrderingEvidence(paths, currentId);
+        assertOwner(current, requester);
+        if (isVersionDowngrade(current.productVersion, candidate.productVersion))
+          throw new Error(`Cannot activate generation ${candidate.productVersion} over active ${current.productVersion}: generation downgrades are not supported.`);
+      }
+      writeCurrentPointer(paths, candidate.id);
+      return candidate;
+    });
+  } finally {
+    releaseLifecycleLock(paths, lock);
+  }
+}
+var listOwnedGenerations = async (paths, requester) => {
+  assertDirectoryChain2(paths.koedHome, paths.generationsDir);
+  let entries;
+  try {
+    entries = readdirSync4(paths.generationsDir, { withFileTypes: true });
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return [];
+    throw error;
+  }
+  const candidates = entries.filter((entry) => entry.isDirectory() && /^[a-f0-9]{64}$/.test(entry.name)).map((entry) => ({
+    id: entry.name,
+    path: resolve5(paths.generationsDir, entry.name),
+    mtime: statSync(resolve5(paths.generationsDir, entry.name)).mtimeMs
+  })).sort((left, right) => right.mtime - left.mtime || left.id.localeCompare(right.id));
+  const verified = [];
+  for (const entry of candidates) {
+    try {
+      const generation = await readStagedGeneration(paths, entry.id);
+      if (sameOwner(generation.owner, requester))
+        verified.push(entry);
+    } catch {
+    }
+  }
+  return verified;
+};
+var removeUnretainedGenerations = (generations, retain, currentId) => {
+  const kept = new Set(generations.slice(0, retain).map((entry) => entry.id));
+  if (currentId)
+    kept.add(currentId);
+  const removed = [];
+  for (const entry of generations) {
+    if (kept.has(entry.id))
+      continue;
+    rmSync5(entry.path, { recursive: true, force: true });
+    removed.push(entry.id);
+  }
+  return removed;
+};
+async function cleanupGenerations(paths, retain, requester) {
+  if (!Number.isInteger(retain) || retain < 1)
+    throw new Error("generation retention must be a positive integer");
+  const lock = acquireLifecycleLock(paths);
+  try {
+    return await withStoreLock(paths, async () => {
+      assertNoActivePin(paths);
+      const currentId = readCurrentId(paths);
+      const current = currentId ? await readStagedGeneration(paths, currentId) : null;
+      if (current)
+        assertOwner(current, requester);
+      const generations = await listOwnedGenerations(paths, requester);
+      return removeUnretainedGenerations(generations, retain, currentId);
+    });
+  } finally {
+    releaseLifecycleLock(paths, lock);
+  }
+}
+
+export {
+  resolveKoedServerConfig,
+  writeCodexGlobalMemoryGuidancePreference,
+  validateDesktopRuntimeCapability,
+  resolveDesktopRuntimeOwner,
+  discoverActualRuntimeIdentity,
+  resolveComponentManifestPinTarget,
+  stageComponent,
+  stageGeneration,
+  readStoredComponents,
+  readGenerationComponentPresence,
+  readStagedGeneration,
+  resolveProcessIdentity,
+  readSupervisorLock,
+  acquireKoedServerSupervisorLock,
+  releaseKoedServerSupervisorLock,
+  readCurrentGenerationOrderingEvidence,
+  readCurrentGeneration,
+  readCurrentDesktopGeneration,
+  readCurrentGenerationForOwner,
+  readCurrentDesktopGenerationOrderingEvidence,
+  readCurrentRuntimeOwner,
+  readDesktopBundleGeneration,
+  pinDesktopBundleGenerationForStart,
+  pinGenerationForStart,
+  activateGeneration,
+  cleanupGenerations
+};