@koed-labs/server 0.0.0-stage → 0.10.3

package/vendor/chunk-YCDEMYY6.js

@@ -0,0 +1,2076 @@
+import { createRequire as createKoedRequire } from "node:module"; const require = createKoedRequire(import.meta.url);
+import {
+  collectKoedServerDoctor,
+  collectKoedServerStartupStatus,
+  collectKoedServerStatus,
+  ensurePackagedLocalServiceSecrets,
+  koedServerStartupBlockingComponentIds,
+  migrateKoedOwnedCodexRegistrationBestEffort,
+  pinAndResolvePackagedRuntime,
+  provisionDesktopApiToken,
+  provisionLocalApiToken,
+  removeClaude,
+  removeCodexIntegration,
+  removePi,
+  repairCodexIntegration,
+  setupClaude,
+  setupCodex,
+  setupCore,
+  setupPi,
+  startLocalEmbeddingRuntime,
+  startLocalPostgresRuntime,
+  startLocalPrivacyRuntime,
+  stopLocalPostgresRuntime
+} from "./chunk-HZJK5RWC.js";
+import {
+  resolveActiveIntegrationApiToken,
+  resolveLocalApiToken,
+  writeLocalAppCredential
+} from "./chunk-QT24SAW6.js";
+import {
+  invalidateUpstreamEnrollmentReferences
+} from "./chunk-SKVYP7NY.js";
+import {
+  allocateAndPersistLocalPorts
+} from "./chunk-HFM6ROJL.js";
+import {
+  calculateRuntimeRequirements,
+  resolveEffectiveRuntimeConfig
+} from "./chunk-AFLKCQHF.js";
+import {
+  acquireKoedServerSupervisorLock,
+  readCurrentRuntimeOwner,
+  readSupervisorLock,
+  releaseKoedServerSupervisorLock,
+  resolveDesktopRuntimeOwner,
+  resolveKoedServerConfig,
+  resolveProcessIdentity,
+  validateDesktopRuntimeCapability
+} from "./chunk-NM5NXCVM.js";
+import {
+  isProcessRunning,
+  isRuntimeGenerationState
+} from "./chunk-G4IIVVJO.js";
+import {
+  maintainSupervisorLog,
+  startKoedServerDaemon
+} from "./chunk-JKOG52PE.js";
+import {
+  assertKoedAppRuntimeAvailable,
+  resolveKoedAppRuntime,
+  resolveKoedAppRuntimeExecution,
+  resolveKoedRuntimeOwner
+} from "./chunk-A4NKL2PK.js";
+import {
+  listUpstreamBackends,
+  refreshUpstreamBackendCapabilities
+} from "./chunk-YJWREXN6.js";
+import {
+  redeemPairingLink
+} from "./chunk-J2L726BC.js";
+import {
+  bundledPdsSecretProviderEnvironment
+} from "./chunk-2S3OGPUC.js";
+import {
+  ensureDeviceIdentity,
+  inspectDeviceIdentityStatus,
+  rotateDeviceIdentity
+} from "./chunk-XNFVSVBS.js";
+import {
+  ensureKoedHome,
+  resolveKoedServerPaths
+} from "./chunk-K2EIFEQF.js";
+import {
+  environmentWithRepoEnv,
+  loadRepoEnv,
+  resolveApiUrl
+} from "./chunk-W2HNI6AA.js";
+import {
+  createPdsApplicationSecretStore,
+  isPrivateNetworkIpv4Address
+} from "./chunk-473OA62O.js";
+import {
+  resolveLocalModelManifest
+} from "./chunk-ZUGNCQZE.js";
+
+// packages/koed-server/dist/personal-device-request.js
+import { createHash as createHash2, randomBytes as randomBytes2, randomUUID as randomUUID2 } from "node:crypto";
+import { createServer, request as httpRequest } from "node:http";
+import { chmodSync, existsSync, lstatSync, mkdirSync, unlinkSync } from "node:fs";
+import { hostname, networkInterfaces } from "node:os";
+import { join } from "node:path";
+
+// packages/koed-server/dist/personal-device-request-crypto.js
+import { createCipheriv, createDecipheriv, createHash, hkdfSync, randomBytes, randomUUID } from "node:crypto";
+var isPersonalDevicePairingUuid = (value) => typeof value === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(value);
+var PERSONAL_DEVICE_PAIRING_PROTOCOL = "koed/pds-device-request/v1";
+var PERSONAL_DEVICE_PAIRING_MAX_PLAINTEXT_BYTES = 256 * 1024;
+var exactKeys = (value, expected) => {
+  const actual = Object.keys(value).sort();
+  const sortedExpected = [...expected].sort();
+  return actual.length === sortedExpected.length && actual.every((key, index) => key === sortedExpected[index]);
+};
+var strictBase64url = (value, bytes) => {
+  if (typeof value !== "string" || !/^[A-Za-z0-9_-]+$/.test(value)) {
+    throw new Error("Pairing message is invalid.");
+  }
+  const decoded = Buffer.from(value, "base64url");
+  if (bytes !== void 0 && decoded.length !== bytes || decoded.toString("base64url") !== value) {
+    throw new Error("Pairing message is invalid.");
+  }
+  return decoded;
+};
+var pairingKey = (invitationId, token) => {
+  if (!isPersonalDevicePairingUuid(invitationId) || !/^[A-Za-z0-9_-]{43}$/.test(token)) {
+    throw new Error("Pairing credentials are invalid.");
+  }
+  const tokenBytes = strictBase64url(token, 32);
+  const salt = createHash("sha256").update(`${PERSONAL_DEVICE_PAIRING_PROTOCOL}\0${invitationId}`, "utf8").digest();
+  return Buffer.from(hkdfSync("sha256", tokenBytes, salt, Buffer.from(`${PERSONAL_DEVICE_PAIRING_PROTOCOL}/transport-key`, "utf8"), 32));
+};
+var additionalData = (direction, invitationId, messageId) => Buffer.from(`${PERSONAL_DEVICE_PAIRING_PROTOCOL}/${direction}
+${invitationId}
+${messageId}`, "utf8");
+var parseEnvelope = (value) => {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("Pairing message is invalid.");
+  }
+  const envelope = value;
+  if (!exactKeys(envelope, [
+    "protocol",
+    "message_id",
+    "nonce",
+    "ciphertext",
+    "tag"
+  ]) || envelope.protocol !== PERSONAL_DEVICE_PAIRING_PROTOCOL || !isPersonalDevicePairingUuid(envelope.message_id)) {
+    throw new Error("Pairing message is invalid.");
+  }
+  strictBase64url(envelope.nonce, 12);
+  strictBase64url(envelope.tag, 16);
+  const ciphertext = strictBase64url(envelope.ciphertext);
+  if (ciphertext.length > PERSONAL_DEVICE_PAIRING_MAX_PLAINTEXT_BYTES) {
+    throw new Error("Pairing message is too large.");
+  }
+  return envelope;
+};
+var encryptPersonalDevicePairingMessage = (input, options) => {
+  const plaintext = Buffer.from(JSON.stringify(input), "utf8");
+  if (plaintext.length === 0 || plaintext.length > PERSONAL_DEVICE_PAIRING_MAX_PLAINTEXT_BYTES) {
+    throw new Error("Pairing message is too large.");
+  }
+  const messageId = options.messageId ?? randomUUID();
+  const nonce = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", pairingKey(options.invitationId, options.token), nonce);
+  cipher.setAAD(additionalData(options.direction, options.invitationId, messageId));
+  const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+  return {
+    protocol: PERSONAL_DEVICE_PAIRING_PROTOCOL,
+    message_id: messageId,
+    nonce: nonce.toString("base64url"),
+    ciphertext: ciphertext.toString("base64url"),
+    tag: cipher.getAuthTag().toString("base64url")
+  };
+};
+var decryptPersonalDevicePairingMessage = (input, options) => {
+  const envelope = parseEnvelope(input);
+  try {
+    const decipher = createDecipheriv("aes-256-gcm", pairingKey(options.invitationId, options.token), strictBase64url(envelope.nonce, 12));
+    decipher.setAAD(additionalData(options.direction, options.invitationId, envelope.message_id));
+    decipher.setAuthTag(strictBase64url(envelope.tag, 16));
+    const plaintext = Buffer.concat([
+      decipher.update(strictBase64url(envelope.ciphertext)),
+      decipher.final()
+    ]);
+    if (plaintext.length === 0 || plaintext.length > PERSONAL_DEVICE_PAIRING_MAX_PLAINTEXT_BYTES) {
+      throw new Error("Pairing message is too large.");
+    }
+    const value = JSON.parse(plaintext.toString("utf8"));
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+      throw new Error("Pairing message is invalid.");
+    }
+    return {
+      messageId: envelope.message_id,
+      value
+    };
+  } catch {
+    throw new Error("Pairing message authentication failed.");
+  }
+};
+
+// packages/koed-server/dist/personal-device-request.js
+var ttl = 10 * 6e4;
+var maxBytes = 32768;
+var reference = "pds-device-request";
+var uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+var body = async (input) => {
+  const chunks = [];
+  let size = 0;
+  for await (const part of input) {
+    const chunk = Buffer.from(part);
+    size += chunk.length;
+    if (size > maxBytes)
+      throw new Error("Request too large.");
+    chunks.push(chunk);
+  }
+  return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+};
+var reply = (response, status, value) => {
+  response.writeHead(status, {
+    "content-type": "application/json",
+    "cache-control": "no-store",
+    "x-content-type-options": "nosniff"
+  });
+  response.end(JSON.stringify(value));
+};
+var socketPath = (paths) => {
+  const direct = join(paths.runDir, "device-request.sock");
+  if (Buffer.byteLength(direct) < 100)
+    return direct;
+  const directory = `/tmp/koed-pairing-${process.getuid?.() ?? "local"}`;
+  mkdirSync(directory, { recursive: true, mode: 448 });
+  const entry = lstatSync(directory);
+  if (!entry.isDirectory() || entry.isSymbolicLink() || (entry.mode & 63) !== 0 || process.getuid && entry.uid !== process.getuid())
+    throw new Error("The private pairing socket directory is unsafe.");
+  return join(directory, `${createHash2("sha256").update(paths.koedHome).digest("hex").slice(0, 32)}.sock`);
+};
+var deviceRequestCommand = (paths, command, label) => new Promise((resolve6, reject) => {
+  const request = httpRequest({
+    agent: false,
+    socketPath: socketPath(paths),
+    path: "/",
+    method: "POST",
+    timeout: 1e4,
+    headers: { "content-type": "application/json" }
+  }, (response) => {
+    let raw = "";
+    response.on("data", (chunk) => {
+      raw += String(chunk);
+      if (Buffer.byteLength(raw) > maxBytes)
+        response.destroy(new Error("Invalid pairing response."));
+    });
+    response.on("error", reject);
+    response.on("end", () => {
+      try {
+        const value = JSON.parse(raw);
+        if (response.statusCode !== 200)
+          throw new Error(value.error ?? "Pairing unavailable.");
+        resolve6(value);
+      } catch (error) {
+        reject(error instanceof Error ? error : new Error("Invalid pairing response."));
+      }
+    });
+  });
+  request.on("timeout", () => request.destroy(new Error("Koed pairing service timed out.")));
+  request.on("error", () => reject(new Error("Start Koed before connecting this device.")));
+  request.end(JSON.stringify({ command, ...label ? { label } : {} }));
+});
+var resolveDeviceRequestHost = (configuredHost, addresses) => {
+  const trimmed = configuredHost?.trim();
+  if (trimmed) {
+    if (!isPrivateNetworkIpv4Address(trimmed))
+      throw new Error("Request service host must be a private IPv4 interface address.");
+    return trimmed;
+  }
+  return [...addresses].filter(isPrivateNetworkIpv4Address).sort()[0];
+};
+var startDeviceRequestService = async (options) => {
+  const { paths } = options;
+  const store = createPdsApplicationSecretStore({ rootPath: paths.koedHome });
+  let pending = null;
+  let publicServer = null;
+  let running = null;
+  let mutation = Promise.resolve();
+  let closed = false;
+  const enrollmentAbort = new AbortController();
+  const persist = () => {
+    if (pending)
+      store.put(reference, JSON.stringify(pending));
+    else
+      store.delete(reference);
+  };
+  const view = (includeLink = false) => {
+    if (!pending)
+      throw new Error("No pending device request. Create one first.");
+    return {
+      id: pending.id,
+      label: pending.label,
+      expiresAt: pending.expiresAt,
+      state: pending.state,
+      ...includeLink && pending.state === "waiting" ? {
+        link: `http://${pending.host}:${pending.port}/device-request/${pending.id}#token=${pending.token}`
+      } : {}
+    };
+  };
+  const resume = () => {
+    if (!pending?.invitation || running || pending.state !== "connecting")
+      return;
+    const current = pending;
+    running = options.redeem(current.invitation, current.label, enrollmentAbort.signal).then(() => {
+      if (closed)
+        return;
+      current.state = "connected";
+      delete current.invitation;
+      current.token = "";
+      persist();
+    }).catch(() => {
+      if (closed)
+        return;
+      current.state = "failed";
+      delete current.invitation;
+      current.token = "";
+      persist();
+    }).finally(() => {
+      running = null;
+    });
+  };
+  const listen = async () => {
+    if (!pending)
+      return;
+    const current = pending;
+    const server = createServer((request, response) => {
+      void (async () => {
+        if (request.method !== "POST" || request.url !== `/device-request/${current.id}` || request.headers.host !== `${current.host}:${current.port}` || request.headers.origin)
+          throw new Error("Invalid request.");
+        const raw = await body(request);
+        const transaction = mutation.then(() => {
+          if (closed || Date.now() >= Date.parse(current.expiresAt) || !current.token || current.used.length >= 64)
+            throw new Error("Expired.");
+          const decoded = decryptPersonalDevicePairingMessage(raw, {
+            invitationId: current.id,
+            token: current.token,
+            direction: "request"
+          });
+          if (current.used.includes(decoded.messageId))
+            throw new Error("Replay.");
+          const operation = decoded.value.operation;
+          if (operation !== "inspect" && operation !== "accept")
+            throw new Error("Invalid operation.");
+          const expected = operation === "inspect" ? ["operation"] : ["invitation", "operation"];
+          if (Object.keys(decoded.value).sort().join() !== expected.join())
+            throw new Error("Invalid request.");
+          if (operation === "accept") {
+            if (typeof decoded.value.invitation !== "string" || decoded.value.invitation.length > 4096)
+              throw new Error("Invalid invitation.");
+            if (current.state !== "waiting" && !(current.state === "connecting" && current.invitation === decoded.value.invitation))
+              throw new Error("Already accepted.");
+            current.invitation = decoded.value.invitation;
+            current.state = "connecting";
+          }
+          current.used.push(decoded.messageId);
+          persist();
+          const result = encryptPersonalDevicePairingMessage({
+            id: current.id,
+            label: current.label,
+            expiresAt: current.expiresAt,
+            state: current.state
+          }, {
+            invitationId: current.id,
+            token: current.token,
+            direction: "response",
+            messageId: decoded.messageId
+          });
+          reply(response, 200, result);
+          if (operation === "accept")
+            resume();
+        });
+        mutation = transaction.catch(() => void 0);
+        await transaction;
+      })().catch(() => reply(response, 400, { error: "Device request unavailable." }));
+    });
+    server.requestTimeout = 1e4;
+    server.headersTimeout = 1e4;
+    server.maxConnections = 16;
+    await new Promise((resolve6, reject) => {
+      server.once("error", reject);
+      server.listen(current.port, current.host, () => {
+        server.off("error", reject);
+        resolve6();
+      });
+    });
+    const address = server.address();
+    if (!address || typeof address === "string")
+      throw new Error("Pairing listener unavailable.");
+    current.port = address.port;
+    publicServer = server;
+    persist();
+  };
+  const closePublic = async () => {
+    const server = publicServer;
+    publicServer = null;
+    if (server) {
+      server.closeAllConnections();
+      await new Promise((resolve6) => server.close(() => resolve6()));
+    }
+  };
+  const saved = store.get(reference);
+  if (saved) {
+    try {
+      const value = JSON.parse(saved);
+      if (uuid.test(value.id) && isPrivateNetworkIpv4Address(value.host) && Number.isInteger(value.port) && value.port > 0 && value.port <= 65535 && typeof value.label === "string" && value.label.length <= 80 && Array.isArray(value.used) && value.used.length <= 64 && value.used.every((id) => typeof id === "string" && uuid.test(id)) && Number.isFinite(Date.parse(value.expiresAt)) && Date.parse(value.expiresAt) <= Date.now() + ttl && typeof value.token === "string" && (["waiting", "connecting"].includes(value.state) && /^[A-Za-z0-9_-]{43}$/.test(value.token) || ["connected", "failed", "cancelled", "expired"].includes(value.state) && value.token === "" && !value.invitation)) {
+        pending = value;
+        if (!["waiting", "connecting"].includes(value.state)) {
+        } else if (Date.now() < Date.parse(value.expiresAt)) {
+          await listen();
+          resume();
+        } else {
+          pending.state = "expired";
+          pending.token = "";
+          delete pending.invitation;
+          persist();
+        }
+      }
+    } catch {
+      pending = null;
+      store.delete(reference);
+    }
+  }
+  const local = createServer((request, response) => {
+    void (async () => {
+      if (request.method !== "POST" || request.url !== "/")
+        throw new Error("Invalid command.");
+      const input = await body(request);
+      const transaction = mutation.then(async () => {
+        if (closed)
+          throw new Error("Pairing service stopped.");
+        if (input.command === "create") {
+          if (pending?.state !== "connecting" && await options.enrolled())
+            throw new Error("This installation already belongs to a Personal Device Group.");
+          if (!pending || !["waiting", "connecting"].includes(pending.state)) {
+            await closePublic();
+            const availableAddresses = options.addresses?.() ?? Object.values(networkInterfaces()).flatMap((entries) => entries ?? []).filter((entry) => entry.family === "IPv4" && !entry.internal).map((entry) => entry.address);
+            const host = resolveDeviceRequestHost(options.host, availableAddresses);
+            if (!host)
+              throw new Error("Connect to a private LAN or Tailscale network before pairing.");
+            const label = typeof input.label === "string" ? input.label.trim() : hostname();
+            if (!label || label.length > 80 || Array.from(label).some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127))
+              throw new Error("Device name must contain 1\u201380 printable characters.");
+            pending = {
+              id: randomUUID2(),
+              label,
+              host,
+              port: 0,
+              token: randomBytes2(32).toString("base64url"),
+              expiresAt: new Date(Date.now() + ttl).toISOString(),
+              state: "waiting",
+              used: []
+            };
+            await listen();
+          }
+          return view(true);
+        }
+        if (input.command === "cancel") {
+          if (pending?.state === "connecting" || pending?.state === "connected")
+            throw new Error("Enrollment has started. Check its result and use device removal to revoke membership.");
+          if (pending?.state === "waiting") {
+            pending.state = "cancelled";
+            pending.token = "";
+            delete pending.invitation;
+            persist();
+            await closePublic();
+          }
+        } else if (input.command !== "status")
+          throw new Error("Invalid command.");
+        return view();
+      });
+      mutation = transaction.then(() => void 0, () => void 0);
+      reply(response, 200, await transaction);
+    })().catch((error) => reply(response, 400, {
+      error: error instanceof Error ? error.message : "Pairing unavailable."
+    }));
+  });
+  const path = socketPath(paths);
+  if (existsSync(path)) {
+    if (!lstatSync(path).isSocket())
+      throw new Error("Unsafe pairing socket path.");
+    unlinkSync(path);
+  }
+  await new Promise((resolve6, reject) => {
+    local.once("error", reject);
+    local.listen(path, () => {
+      chmodSync(path, 384);
+      resolve6();
+    });
+  });
+  const timer = setInterval(() => {
+    mutation = mutation.then(async () => {
+      if (closed || !pending || pending.state !== "waiting" || Date.now() < Date.parse(pending.expiresAt))
+        return;
+      pending.state = "expired";
+      pending.token = "";
+      persist();
+      await closePublic();
+    }).catch(() => void 0);
+  }, 1e3);
+  timer.unref();
+  return {
+    close: async () => {
+      closed = true;
+      enrollmentAbort.abort();
+      clearInterval(timer);
+      await mutation;
+      await closePublic();
+      local.closeAllConnections();
+      await new Promise((resolve6) => local.close(() => resolve6()));
+    }
+  };
+};
+
+// packages/koed-server/dist/restart.js
+import { spawn as nodeSpawn } from "node:child_process";
+
+// packages/koed-server/dist/stop.js
+import { existsSync as nodeExistsSync, readFileSync as readFileSync2, rmSync as rmSync2 } from "node:fs";
+import { spawnSync as nodeSpawnSync } from "node:child_process";
+import { resolve as resolve2 } from "node:path";
+
+// packages/koed-server/dist/supervisor-exit-request.js
+import { mkdirSync as mkdirSync2, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+var supervisorExitRequestPath = (paths) => resolve(paths.runDir, "koed-server.stop.json");
+var requestSupervisorExit = (paths, identity) => {
+  mkdirSync2(paths.runDir, { recursive: true, mode: 448 });
+  writeFileSync(supervisorExitRequestPath(paths), `${JSON.stringify(identity, null, 2)}
+`, { mode: 384 });
+};
+var readExitRequest = (path) => {
+  try {
+    const value = JSON.parse(readFileSync(path, "utf8"));
+    return Number.isInteger(value.pid) && Number(value.pid) > 0 && typeof value.startedAt === "string" ? { pid: Number(value.pid), startedAt: value.startedAt } : null;
+  } catch {
+    return null;
+  }
+};
+var monitorSupervisorExitRequest = (paths, identity, options = {}) => {
+  const path = supervisorExitRequestPath(paths);
+  let handled = false;
+  const check = () => {
+    if (handled)
+      return;
+    const request = readExitRequest(path);
+    if (request?.pid !== identity.pid || request.startedAt !== identity.startedAt) {
+      return;
+    }
+    handled = true;
+    rmSync(path, { force: true });
+    (options.onExit ?? (() => process.exit(0)))();
+  };
+  const timer = (options.setInterval ?? setInterval)(check, options.intervalMs ?? 100);
+  timer.unref?.();
+  check();
+  return () => (options.clearInterval ?? clearInterval)(timer);
+};
+
+// packages/koed-server/dist/stop.js
+var APP_PROCESS_ORDER = [
+  {
+    processName: "localAiRuntime",
+    serviceName: "local-ai-runtime"
+  },
+  { processName: "worker", serviceName: "worker" },
+  { processName: "api", serviceName: "api" }
+];
+var readRuntimeState = (path, deps) => {
+  if (!deps.existsSync(path)) {
+    return null;
+  }
+  try {
+    return JSON.parse(String(deps.readFileSync(path, "utf8")));
+  } catch {
+    return null;
+  }
+};
+var readRuntimeGeneration = (path, deps) => {
+  if (!deps.existsSync(path))
+    return null;
+  try {
+    const parsed = JSON.parse(String(deps.readFileSync(path, "utf8")));
+    return isRuntimeGenerationState(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+};
+var expectedRuntimeOwner = (capability, koedHome) => capability ? resolveDesktopRuntimeOwner(capability, koedHome) : resolveKoedRuntimeOwner();
+var ownersMatch = (left, right) => left.kind === right.kind && left.installationId === right.installationId;
+var defaultCheckPid = (pid) => {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+};
+var errorCode = (error) => typeof error === "object" && error !== null && "code" in error ? String(error.code) : "";
+var errorMessage = (error) => error instanceof Error ? error.message : String(error);
+var defaultSleepSync = (ms) => {
+  if (ms <= 0)
+    return;
+  const buffer = new SharedArrayBuffer(4);
+  const view = new Int32Array(buffer);
+  Atomics.wait(view, 0, 0, ms);
+};
+var waitForPidExit = (pid, deps) => {
+  const deadline = Date.now() + deps.waitForExitMs;
+  while (deps.checkPid(pid) && Date.now() < deadline) {
+    deps.sleepSync(Math.min(deps.pollIntervalMs, Math.max(0, deadline - Date.now())));
+  }
+  return !deps.checkPid(pid);
+};
+var stopPid = (label, pid, deps) => {
+  if (!pid || pid <= 0) {
+    return { stoppedPids: [], missingPids: [], errors: [] };
+  }
+  const identityMatches = () => !deps.expectedProcessIdentity || deps.resolveProcessIdentity?.(pid) === deps.expectedProcessIdentity;
+  const identityError = () => ({
+    stoppedPids: [],
+    missingPids: [],
+    errors: [
+      {
+        target: `${label} (${pid})`,
+        error: "Process identity changed before signaling"
+      }
+    ]
+  });
+  if (deps.expectedProcessIdentity && !deps.checkPid(pid))
+    return { stoppedPids: [], missingPids: [pid], errors: [] };
+  if (!identityMatches())
+    return identityError();
+  try {
+    deps.kill(pid, "SIGTERM");
+    if (waitForPidExit(pid, deps)) {
+      return { stoppedPids: [pid], missingPids: [], errors: [] };
+    }
+    if (!identityMatches())
+      return identityError();
+    deps.kill(pid, "SIGKILL");
+    if (waitForPidExit(pid, deps)) {
+      return { stoppedPids: [pid], missingPids: [], errors: [] };
+    }
+    return {
+      stoppedPids: [pid],
+      missingPids: [],
+      errors: [
+        {
+          target: `${label} (${pid})`,
+          error: "Timed out waiting for process to stop"
+        }
+      ]
+    };
+  } catch (error) {
+    if (errorCode(error) === "ESRCH" || !deps.checkPid(pid)) {
+      return { stoppedPids: [], missingPids: [pid], errors: [] };
+    }
+    return {
+      stoppedPids: [],
+      missingPids: [],
+      errors: [{ target: `${label} (${pid})`, error: errorMessage(error) }]
+    };
+  }
+};
+var shouldStopNativePostgres = (runtime) => runtime.dependencyMode === "bundled-local" && runtime.services.includes("postgres-native");
+var stopKoedServer = ({ environment = process.env, existsSync: pathExists = nodeExistsSync, readFileSync: readFile = readFileSync2, rmSync: remove = rmSync2, spawnSync = nodeSpawnSync, kill = (pid, signal) => {
+  process.kill(pid, signal);
+}, checkPid = defaultCheckPid, waitForExitMs = 5e3, pollIntervalMs = 100, sleepSync = defaultSleepSync, readSupervisorLock: readLock = readSupervisorLock, resolveProcessIdentity: resolveProcessIdentity2 = resolveProcessIdentity, desktopRuntimeCapability } = {}) => {
+  const paths = resolveKoedServerPaths(environment);
+  const runtimeEnvironment = environmentWithRepoEnv(paths.repoRoot, environment);
+  const runtime = readRuntimeState(paths.runtimeStatePath, {
+    existsSync: pathExists,
+    readFileSync: readFile
+  });
+  if (!runtime) {
+    return {
+      ok: true,
+      state: "not_configured",
+      koedHome: paths.koedHome,
+      message: "No koed runtime state was found.",
+      stoppedPids: [],
+      missingPids: [],
+      stoppedServices: [],
+      missingServices: []
+    };
+  }
+  const stoppedPids = [];
+  const missingPids = [];
+  const stoppedServices = [];
+  const missingServices = [];
+  const errors = [];
+  let supervisorStoppedGracefully = false;
+  let supervisorLockMatches = true;
+  let expectedSupervisorIdentity;
+  const supervisorLockPath = resolve2(paths.runDir, "koed-server.lock");
+  const owner = expectedRuntimeOwner(desktopRuntimeCapability, paths.koedHome);
+  const ownerPinRequired = desktopRuntimeCapability !== void 0 || resolveKoedAppRuntimeExecution() === "packaged";
+  const isExpectedSupervisorRunning = (identity) => {
+    const lock2 = readLock(supervisorLockPath);
+    return lock2?.pid === runtime.pid && lock2.processIdentity === identity && checkPid(runtime.pid) && resolveProcessIdentity2(runtime.pid) === identity;
+  };
+  const markSupervisorIdentityUnverified = () => {
+    if (!supervisorLockMatches)
+      return;
+    supervisorLockMatches = false;
+    errors.push({
+      target: `supervisor (${runtime.pid})`,
+      error: "Supervisor identity changed during stop; refusing fallback signals"
+    });
+  };
+  const canSignalFallbackProcesses = () => {
+    if (!supervisorLockMatches)
+      return false;
+    if (expectedSupervisorIdentity && !isExpectedSupervisorRunning(expectedSupervisorIdentity)) {
+      markSupervisorIdentityUnverified();
+      return false;
+    }
+    return true;
+  };
+  const pinPath = paths.generationStatePath ?? resolve2(paths.runDir, "runtime-generation.json");
+  const pinExists = pathExists(pinPath);
+  const pin = readRuntimeGeneration(pinPath, {
+    existsSync: pathExists,
+    readFileSync: readFile
+  });
+  const lock = readLock(supervisorLockPath);
+  const supervisorRunning = runtime.pid > 0 && checkPid(runtime.pid);
+  const processIdentity = supervisorRunning ? resolveProcessIdentity2(runtime.pid) : null;
+  if (ownerPinRequired && !pin || pinExists && !pin || pin !== null && (pin.pid !== runtime.pid || !ownersMatch(pin.owner, owner) || lock?.pid !== runtime.pid || !lock.processIdentity || pin.processIdentity !== lock.processIdentity || supervisorRunning && processIdentity !== pin.processIdentity)) {
+    supervisorLockMatches = false;
+    errors.push({
+      target: `supervisor (${runtime.pid})`,
+      error: "Runtime owner and process identity could not be verified; refusing to stop"
+    });
+  } else if (pin) {
+    expectedSupervisorIdentity = pin.processIdentity;
+  }
+  if (runtime.pid > 0 && runtime.pid !== process.pid && checkPid(runtime.pid)) {
+    const lock2 = readLock(supervisorLockPath);
+    if (!supervisorLockMatches) {
+    } else if (lock2?.pid !== runtime.pid) {
+      supervisorLockMatches = false;
+      errors.push({
+        target: `supervisor (${runtime.pid})`,
+        error: "Runtime state does not match the active supervisor lock"
+      });
+    } else if (!lock2.processIdentity) {
+      supervisorLockMatches = false;
+      errors.push({
+        target: `supervisor (${runtime.pid})`,
+        error: "Supervisor process identity is missing from its lock"
+      });
+    } else if (resolveProcessIdentity2(runtime.pid) !== lock2.processIdentity) {
+      supervisorLockMatches = false;
+      errors.push({
+        target: `supervisor (${runtime.pid})`,
+        error: "Supervisor process identity does not match its lock"
+      });
+    } else {
+      expectedSupervisorIdentity = lock2.processIdentity;
+      requestSupervisorExit(paths, {
+        pid: runtime.pid,
+        startedAt: runtime.startedAt
+      });
+      supervisorStoppedGracefully = waitForPidExit(runtime.pid, {
+        checkPid,
+        waitForExitMs,
+        pollIntervalMs,
+        sleepSync
+      });
+      if (supervisorStoppedGracefully) {
+        stoppedPids.push(...Object.values(runtime.processes ?? {}).filter((pid) => typeof pid === "number" && pid > 0), runtime.pid);
+        stoppedServices.push(...runtime.services, "supervisor");
+      }
+    }
+  }
+  if (!supervisorStoppedGracefully)
+    canSignalFallbackProcesses();
+  if (!supervisorStoppedGracefully && supervisorLockMatches) {
+    for (const { processName, serviceName } of APP_PROCESS_ORDER) {
+      if (!canSignalFallbackProcesses())
+        break;
+      const pid = runtime.processes?.[processName];
+      if (!pid || pid <= 0) {
+        if (runtime.services.includes(serviceName)) {
+          missingServices.push(serviceName);
+        }
+        continue;
+      }
+      const stopped = stopPid(serviceName, pid, {
+        kill,
+        checkPid,
+        waitForExitMs,
+        pollIntervalMs,
+        sleepSync
+      });
+      stoppedPids.push(...stopped.stoppedPids);
+      missingPids.push(...stopped.missingPids);
+      if (stopped.missingPids.length > 0) {
+        missingServices.push(serviceName);
+      } else if (stopped.stoppedPids.length > 0) {
+        stoppedServices.push(serviceName);
+      }
+      errors.push(...stopped.errors);
+    }
+    if (runtime.dependencyMode === "bundled-local") {
+      const embeddingPid = runtime.processes?.embeddingService;
+      if (canSignalFallbackProcesses() && runtime.services.includes("embedding-service-native")) {
+        if (!embeddingPid || embeddingPid <= 0) {
+          missingServices.push("embedding-service-native");
+        } else {
+          const stopped = stopPid("embedding-service-native", embeddingPid, {
+            kill,
+            checkPid,
+            waitForExitMs,
+            pollIntervalMs,
+            sleepSync
+          });
+          stoppedPids.push(...stopped.stoppedPids);
+          missingPids.push(...stopped.missingPids);
+          errors.push(...stopped.errors);
+          if (stopped.missingPids.length > 0) {
+            missingServices.push("embedding-service-native");
+          } else if (stopped.stoppedPids.length > 0) {
+            stoppedServices.push("embedding-service-native");
+          }
+        }
+      }
+      if (canSignalFallbackProcesses() && shouldStopNativePostgres(runtime)) {
+        const stopped = stopLocalPostgresRuntime(paths, runtimeEnvironment, {
+          existsSync: pathExists,
+          spawnSync
+        });
+        if (stopped.ok) {
+          stoppedServices.push("postgres-native");
+        } else {
+          errors.push({
+            target: "postgres-native",
+            error: stopped.error ?? stopped.message
+          });
+        }
+      }
+    }
+  }
+  if (!supervisorStoppedGracefully && canSignalFallbackProcesses() && runtime.pid > 0 && runtime.pid !== process.pid && checkPid(runtime.pid)) {
+    const stopped = stopPid("supervisor", runtime.pid, {
+      kill,
+      checkPid,
+      waitForExitMs,
+      pollIntervalMs,
+      sleepSync,
+      expectedProcessIdentity: expectedSupervisorIdentity,
+      resolveProcessIdentity: resolveProcessIdentity2
+    });
+    stoppedPids.push(...stopped.stoppedPids);
+    missingPids.push(...stopped.missingPids);
+    errors.push(...stopped.errors);
+    if (stopped.missingPids.length > 0) {
+      missingServices.push("supervisor");
+    } else if (stopped.stoppedPids.length > 0) {
+      stoppedServices.push("supervisor");
+    }
+  }
+  if (errors.length === 0) {
+    const currentRuntime = readRuntimeState(paths.runtimeStatePath, {
+      existsSync: pathExists,
+      readFileSync: readFile
+    });
+    if (currentRuntime && (currentRuntime.pid !== runtime.pid || currentRuntime.startedAt !== runtime.startedAt)) {
+      errors.push({
+        target: "runtime-state",
+        error: "Runtime state changed while stop was in progress"
+      });
+    } else {
+      remove(paths.runtimeStatePath, { force: true });
+    }
+  }
+  return {
+    ok: errors.length === 0,
+    state: errors.length === 0 ? "healthy" : "needs_attention",
+    koedHome: paths.koedHome,
+    message: errors.length === 0 ? "Koed server stop completed." : "Koed server stop encountered errors.",
+    stoppedPids,
+    missingPids,
+    stoppedServices,
+    missingServices,
+    ...errors.length > 0 ? { errors } : {}
+  };
+};
+
+// packages/koed-server/dist/restart.js
+var defaultCheckPid2 = (pid) => {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+};
+var startDetached = ({ environment = process.env, spawn = nodeSpawn, startCommand = process.argv[1], cwd }) => {
+  if (!startCommand) {
+    throw new Error("Could not resolve koed-server CLI path for restart.");
+  }
+  const child = spawn(process.execPath, [startCommand, "start"], {
+    cwd: cwd ?? environment.KOED_REPO_ROOT ?? process.cwd(),
+    detached: true,
+    env: environment,
+    stdio: "ignore"
+  });
+  if (!child.pid) {
+    throw new Error("Could not start koed restart child process.");
+  }
+  child.unref();
+  return child.pid;
+};
+var waitForPidsToExit = async (pids, { checkPid = defaultCheckPid2, waitForExitMs = 1e4, pollIntervalMs = 250, sleep = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms)) }) => {
+  const uniquePids = [...new Set(pids)].filter((pid) => pid > 0);
+  const deadline = Date.now() + waitForExitMs;
+  let running = uniquePids.filter(checkPid);
+  while (running.length > 0 && Date.now() < deadline) {
+    await sleep(Math.min(pollIntervalMs, Math.max(0, deadline - Date.now())));
+    running = uniquePids.filter(checkPid);
+  }
+  return running;
+};
+var restartKoedServer = async (options = {}) => {
+  const stop = stopKoedServer(options);
+  if (!stop.ok) {
+    return {
+      ok: false,
+      state: "needs_attention",
+      koedHome: stop.koedHome,
+      message: stop.message,
+      stoppedPids: stop.stoppedPids,
+      missingPids: stop.missingPids,
+      stoppedServices: stop.stoppedServices,
+      missingServices: stop.missingServices
+    };
+  }
+  const stillRunning = await waitForPidsToExit(stop.stoppedPids, options);
+  if (stillRunning.length > 0) {
+    const kill = options.kill ?? ((pid, signal) => {
+      process.kill(pid, signal);
+    });
+    for (const pid of stillRunning) {
+      kill(pid, "SIGKILL");
+    }
+    const runningAfterKill = await waitForPidsToExit(stillRunning, options);
+    if (runningAfterKill.length > 0) {
+      return {
+        ok: false,
+        state: "needs_attention",
+        koedHome: stop.koedHome,
+        message: "Timed out waiting for koed-server processes to stop.",
+        stoppedPids: stop.stoppedPids,
+        missingPids: [...stop.missingPids, ...runningAfterKill],
+        stoppedServices: stop.stoppedServices,
+        missingServices: stop.missingServices
+      };
+    }
+  }
+  let startedPid;
+  if (options.start) {
+    await options.start(options);
+  } else {
+    startedPid = startDetached(options);
+  }
+  return {
+    ok: true,
+    state: "starting",
+    koedHome: stop.koedHome,
+    message: "Koed server restarted.",
+    ...startedPid ? { startedPid } : {},
+    stoppedPids: stop.stoppedPids,
+    missingPids: stop.missingPids,
+    stoppedServices: stop.stoppedServices,
+    missingServices: stop.missingServices
+  };
+};
+
+// packages/koed-server/dist/upstream-capability-maintenance.js
+var maintainUpstreamCapabilities = (paths, options = {}) => {
+  const list = options.list ?? listUpstreamBackends;
+  const refresh = options.refresh ?? refreshUpstreamBackendCapabilities;
+  const controller = new AbortController();
+  let running = false;
+  const tick = async () => {
+    if (running || controller.signal.aborted)
+      return;
+    running = true;
+    try {
+      const now = (options.now ?? Date.now)();
+      for (const backend of list(paths).backends ?? []) {
+        if (controller.signal.aborted)
+          break;
+        if (backend.credential.status === "revoked")
+          continue;
+        if (!Object.values(backend.routePolicy).includes("enabled"))
+          continue;
+        const expiry = Date.parse(backend.capabilities.expiresAt ?? "");
+        if (backend.capabilities.state === "validated" && Number.isFinite(expiry) && expiry > now + (options.leadMs ?? 6e4))
+          continue;
+        await refresh(paths, backend.id, { signal: controller.signal });
+      }
+    } catch {
+      if (!controller.signal.aborted)
+        options.onError?.();
+    } finally {
+      running = false;
+    }
+  };
+  const timer = setInterval(() => void tick(), options.intervalMs ?? 3e4);
+  timer.unref?.();
+  void tick();
+  return () => {
+    clearInterval(timer);
+    controller.abort();
+  };
+};
+
+// packages/koed-server/dist/start.js
+import { spawn as nodeSpawn2, spawnSync as nodeSpawnSync2 } from "node:child_process";
+import { randomBytes as randomBytes3 } from "node:crypto";
+import { setTimeout as delay } from "node:timers/promises";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync4, rmSync as rmSync3, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname, resolve as resolve4 } from "node:path";
+
+// packages/koed-server/dist/runtime-lifecycle.js
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "node:fs";
+import { resolve as resolve3 } from "node:path";
+var readJson = (path) => {
+  try {
+    return JSON.parse(readFileSync3(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+};
+function observeRuntimeLifecycle(paths, { resolveProcessIdentity: resolveProcessIdentity2 = resolveProcessIdentity, isProcessRunning: isProcessRunning2 = isProcessRunning } = {}) {
+  const lockPath = resolve3(paths.runDir, "koed-server.lock");
+  if (!existsSync2(lockPath))
+    return {
+      state: "stopped",
+      epoch: "stopped",
+      message: "Koed is not running."
+    };
+  const lock = readSupervisorLock(lockPath);
+  if (!lock)
+    return {
+      state: "unavailable",
+      epoch: "unavailable",
+      message: "Koed supervisor lock is unreadable."
+    };
+  const identity = resolveProcessIdentity2(lock.pid);
+  if (!identity) {
+    return isProcessRunning2(lock.pid) ? {
+      state: "unavailable",
+      epoch: "unavailable",
+      message: "Koed supervisor identity could not be verified.",
+      pid: lock.pid
+    } : { state: "stopped", epoch: "stopped", message: "Koed is not running." };
+  }
+  if (lock.processIdentity !== identity)
+    return {
+      state: "stopped",
+      epoch: "stopped",
+      message: "Koed is not running."
+    };
+  const epoch = `${lock.pid}:${identity}`;
+  const pin = readJson(paths.generationStatePath ?? resolve3(paths.runDir, "runtime-generation.json"));
+  const pinned = isRuntimeGenerationState(pin) && pin.pid === lock.pid && pin.processIdentity === identity ? pin : null;
+  const runtime = readJson(paths.runtimeStatePath);
+  const running = pinned !== null && runtime?.pid === lock.pid;
+  return {
+    state: running ? "running" : "starting",
+    epoch,
+    message: running ? "Koed is running." : "Koed is starting.",
+    pid: lock.pid,
+    processIdentity: identity,
+    owner: pinned ? { ...pinned.owner } : null,
+    ...pinned ? { generationId: pinned.generationId } : {}
+  };
+}
+var runtimeOwnedBy = (observation, owner) => Boolean(observation.owner && observation.owner.kind === owner.kind && observation.owner.installationId === owner.installationId);
+
+// packages/koed-server/dist/start.js
+var localRuntimeFailureDetails = (details) => {
+  if (!details || typeof details !== "object" || Array.isArray(details)) {
+    return "";
+  }
+  const result = details;
+  const exitCode = typeof result.exitCode === "number" ? result.exitCode : null;
+  const stderr = typeof result.stderr === "string" ? result.stderr.trim().slice(0, 2e3) : "";
+  const parts = [
+    exitCode === null ? null : `exit code ${exitCode}`,
+    stderr || null
+  ].filter((part) => Boolean(part));
+  return parts.length ? ` (${parts.join(": ")})` : "";
+};
+var startupComponentLabels = {
+  api: "API",
+  database: "database",
+  redis: "Redis",
+  workerQueues: "Worker/queue",
+  embeddingService: "Embedding Service",
+  privacyService: "Privacy Filter Service",
+  localAiRuntime: "Local AI Runtime",
+  apiToken: "Personal API Token"
+};
+var startupBlockingSummary = (status, componentIds = koedServerStartupBlockingComponentIds(status.runtimeMode)) => {
+  const blockers = componentIds.flatMap((componentId) => {
+    const component = status[componentId];
+    return component.state === "healthy" ? [] : [`${startupComponentLabels[componentId]} (${component.state})`];
+  });
+  return blockers.length > 0 ? blockers.join(", ") : "unknown";
+};
+var runCommand = (paths, label, command, args, environment, spawnSync, cwd = paths.repoRoot) => {
+  console.log(`> ${label}`);
+  const result = spawnSync(command, args, {
+    cwd,
+    env: environment,
+    stdio: "inherit"
+  });
+  if (result.error) {
+    throw result.error;
+  }
+  if (result.status !== 0) {
+    throw new Error(`${label} failed with exit code ${result.status ?? 1}.`);
+  }
+};
+var createOpaqueSecret = (prefix) => `${prefix}_${randomBytes3(32).toString("base64url")}`;
+var appProcessEnvironment = (environment) => {
+  const output = { ...environment };
+  delete output.PRIVACY_RUNTIME_CONTROL_TOKEN;
+  return output;
+};
+var spawnManagedProcess = (paths, label, command, args, environment, spawn, cwd = paths.repoRoot) => {
+  console.log(`> Start ${label}`);
+  const child = spawn(command, args, {
+    cwd,
+    env: environment,
+    stdio: "inherit"
+  });
+  child.on("exit", (code) => {
+    console.log(`${label} exited with code ${code ?? "signal"}.`);
+  });
+  return child;
+};
+var waitForHealthyOrReady = async ({ environment, timeoutMs, pollIntervalMs, collectStatus, signal, isReady = (status) => status.ok }) => {
+  const startedAt = Date.now();
+  signal.throwIfAborted();
+  let lastStatus = await collectStatus(environment);
+  while (true) {
+    signal.throwIfAborted();
+    if (isReady(lastStatus)) {
+      return lastStatus;
+    }
+    if (Date.now() - startedAt >= timeoutMs)
+      return lastStatus;
+    await delay(pollIntervalMs, void 0, { signal });
+    lastStatus = await collectStatus(environment);
+  }
+};
+var resolveWorkQueueBackend = (value) => value?.trim() === "local" ? "local" : "bullmq";
+var prefixedApiEnv = (environment, repoEnv, name) => environment[`API_${name}`] ?? environment[name] ?? repoEnv[`API_${name}`] ?? repoEnv[name];
+var resolveEffectiveWorkQueueBackend = (config, environment, repoEnv) => {
+  if (environment.WORK_QUEUE_BACKEND) {
+    return resolveWorkQueueBackend(environment.WORK_QUEUE_BACKEND);
+  }
+  if (config.dependencyMode === "bundled-local") {
+    return "local";
+  }
+  return resolveWorkQueueBackend(repoEnv.WORK_QUEUE_BACKEND);
+};
+var koedServerConfigEnvironment = (environment, repoEnv) => ({
+  ...environment,
+  KOED_RUNTIME_MODE: environment.KOED_RUNTIME_MODE ?? repoEnv.KOED_RUNTIME_MODE,
+  KOED_DEPENDENCY_MODE: environment.KOED_DEPENDENCY_MODE ?? repoEnv.KOED_DEPENDENCY_MODE,
+  KOED_EXTERNAL_DATABASE_URL: environment.KOED_EXTERNAL_DATABASE_URL ?? repoEnv.KOED_EXTERNAL_DATABASE_URL,
+  KOED_EXTERNAL_REDIS_URL: environment.KOED_EXTERNAL_REDIS_URL ?? repoEnv.KOED_EXTERNAL_REDIS_URL,
+  KOED_EXTERNAL_EMBEDDING_SERVICE_URL: environment.KOED_EXTERNAL_EMBEDDING_SERVICE_URL ?? repoEnv.KOED_EXTERNAL_EMBEDDING_SERVICE_URL,
+  MEMORY_CODEX_TRANSCRIPT_WATCHER_ENABLED: environment.MEMORY_CODEX_TRANSCRIPT_WATCHER_ENABLED ?? repoEnv.MEMORY_CODEX_TRANSCRIPT_WATCHER_ENABLED,
+  MEMORY_CLAUDE_TRANSCRIPT_WATCHER_ENABLED: environment.MEMORY_CLAUDE_TRANSCRIPT_WATCHER_ENABLED ?? repoEnv.MEMORY_CLAUDE_TRANSCRIPT_WATCHER_ENABLED,
+  KOED_HARDWARE_ACCELERATION: environment.KOED_HARDWARE_ACCELERATION ?? repoEnv.KOED_HARDWARE_ACCELERATION
+});
+var bundledLocalDatabaseUrl = (environment, repoEnv) => {
+  const user = environment.POSTGRES_USER ?? repoEnv.POSTGRES_USER ?? "koed";
+  const password = environment.POSTGRES_PASSWORD ?? repoEnv.POSTGRES_PASSWORD ?? environment.KOED_BUNDLED_POSTGRES_PASSWORD ?? "koed-local-postgres";
+  const database = environment.POSTGRES_DB ?? repoEnv.POSTGRES_DB ?? "koed";
+  const host = environment.KOED_POSTGRES_HOST ?? "127.0.0.1";
+  const port = environment.KOED_POSTGRES_PORT ?? environment.POSTGRES_HOST_PORT ?? repoEnv.POSTGRES_HOST_PORT ?? "15432";
+  return `postgres://${encodeURIComponent(user)}:${encodeURIComponent(password)}@${host}:${port}/${encodeURIComponent(database)}`;
+};
+var corsOrigins = (environment, repoEnv) => {
+  const configured = [
+    environment.API_CORS_ORIGINS,
+    repoEnv.API_CORS_ORIGINS,
+    environment.CORS_ORIGINS,
+    repoEnv.CORS_ORIGINS
+  ].flatMap((value) => value?.split(",") ?? []).map((value) => value.trim()).filter(Boolean);
+  configured.push("koed://app");
+  return Array.from(new Set(configured)).join(",");
+};
+var localServiceEnv = (environment, repoEnv, apiToken, paths) => {
+  const apiPort = environment.API_HOST_PORT ?? repoEnv.API_HOST_PORT ?? "3300";
+  const embeddingPort = environment.EMBEDDING_SERVICE_HOST_PORT ?? repoEnv.EMBEDDING_SERVICE_HOST_PORT ?? "3800";
+  const embeddingServiceUrl = `http://localhost:${embeddingPort}`;
+  const privacyPort = environment.PRIVACY_SERVICE_PORT ?? repoEnv.PRIVACY_SERVICE_PORT ?? "8092";
+  const privacyServiceUrl = `http://localhost:${privacyPort}`;
+  const serverConfig = resolveKoedServerConfig(paths, koedServerConfigEnvironment(environment, repoEnv));
+  const queueBackend = resolveEffectiveWorkQueueBackend(serverConfig, environment, repoEnv);
+  const modelEnvironment = { ...repoEnv, ...environment };
+  const embeddingModel = resolveLocalModelManifest(paths, "embedding", modelEnvironment);
+  const installedModelPaths = [embeddingModel.modelPath].filter((modelPath) => existsSync3(modelPath));
+  const localEmbeddingModelPath = existsSync3(embeddingModel.modelPath) ? embeddingModel.modelPath : void 0;
+  const modelsDir = installedModelPaths[0] ? dirname(installedModelPaths[0]) : paths.modelsDir;
+  return {
+    ...bundledPdsSecretProviderEnvironment({
+      ...process.env,
+      ...repoEnv,
+      ...environment
+    }),
+    KOED_HOME: paths.koedHome,
+    KOED_RUNTIME_MODE: serverConfig.runtimeMode,
+    KOED_DEPENDENCY_MODE: serverConfig.dependencyMode,
+    PDS_RUNTIME_SECRET_REF: environment.PDS_RUNTIME_SECRET_REF?.trim() || "pds-runtime",
+    ...apiToken ? { MEMORY_API_TOKEN: apiToken.token } : {},
+    NODE_ENV: environment.API_NODE_ENV ?? repoEnv.API_NODE_ENV ?? environment.NODE_ENV ?? "production",
+    LOG_LEVEL: environment.API_LOG_LEVEL ?? repoEnv.API_LOG_LEVEL ?? environment.LOG_LEVEL,
+    API_HOST: environment.API_HOST ?? repoEnv.API_HOST ?? "127.0.0.1",
+    WORK_QUEUE_BACKEND: queueBackend,
+    KOED_MODELS_DIR: modelsDir,
+    KOED_EMBEDDING_ACCELERATION: environment.KOED_EMBEDDING_ACCELERATION ?? repoEnv.KOED_EMBEDDING_ACCELERATION ?? serverConfig.hardwareAcceleration,
+    KOED_HARDWARE_ACCELERATION: environment.KOED_HARDWARE_ACCELERATION ?? repoEnv.KOED_HARDWARE_ACCELERATION ?? serverConfig.hardwareAcceleration,
+    PRIVACY_RUNTIME_PROVIDER: environment.PRIVACY_RUNTIME_PROVIDER ?? repoEnv.PRIVACY_RUNTIME_PROVIDER ?? environment.KOED_HARDWARE_ACCELERATION ?? repoEnv.KOED_HARDWARE_ACCELERATION ?? serverConfig.hardwareAcceleration,
+    WORKER_LOG_LEVEL: repoEnv.WORKER_LOG_LEVEL ?? environment.WORKER_LOG_LEVEL,
+    KOED_EMBEDDING_POOL_KEY: environment.WORKER_KOED_EMBEDDING_POOL_KEY ?? repoEnv.WORKER_KOED_EMBEDDING_POOL_KEY ?? environment.KOED_EMBEDDING_POOL_KEY ?? repoEnv.KOED_EMBEDDING_POOL_KEY,
+    API_PORT: apiPort,
+    DATABASE_URL: serverConfig.dependencyMode === "external" ? serverConfig.external?.databaseUrl ?? environment.DATABASE_URL ?? repoEnv.DATABASE_URL : bundledLocalDatabaseUrl(environment, repoEnv),
+    REDIS_URL: serverConfig.external?.redisUrl ?? environment.REDIS_URL ?? repoEnv.REDIS_URL,
+    RATE_LIMIT_STORE: prefixedApiEnv(environment, repoEnv, "RATE_LIMIT_STORE"),
+    RATE_LIMIT_REDIS_URL: prefixedApiEnv(environment, repoEnv, "RATE_LIMIT_REDIS_URL") ?? "",
+    AUTH_RATE_LIMIT_WINDOW_MS: prefixedApiEnv(environment, repoEnv, "AUTH_RATE_LIMIT_WINDOW_MS"),
+    AUTH_RATE_LIMIT_MAX: prefixedApiEnv(environment, repoEnv, "AUTH_RATE_LIMIT_MAX"),
+    MEMORY_RATE_LIMIT_WINDOW_MS: prefixedApiEnv(environment, repoEnv, "MEMORY_RATE_LIMIT_WINDOW_MS"),
+    MEMORY_RATE_LIMIT_MAX: prefixedApiEnv(environment, repoEnv, "MEMORY_RATE_LIMIT_MAX"),
+    MEMORY_READ_RATE_LIMIT_WINDOW_MS: prefixedApiEnv(environment, repoEnv, "MEMORY_READ_RATE_LIMIT_WINDOW_MS"),
+    MEMORY_READ_RATE_LIMIT_MAX: prefixedApiEnv(environment, repoEnv, "MEMORY_READ_RATE_LIMIT_MAX"),
+    MEMORY_WRITE_RATE_LIMIT_WINDOW_MS: prefixedApiEnv(environment, repoEnv, "MEMORY_WRITE_RATE_LIMIT_WINDOW_MS"),
+    MEMORY_WRITE_RATE_LIMIT_MAX: prefixedApiEnv(environment, repoEnv, "MEMORY_WRITE_RATE_LIMIT_MAX"),
+    MEMORY_RECALL_RATE_LIMIT_WINDOW_MS: prefixedApiEnv(environment, repoEnv, "MEMORY_RECALL_RATE_LIMIT_WINDOW_MS"),
+    MEMORY_RECALL_RATE_LIMIT_MAX: prefixedApiEnv(environment, repoEnv, "MEMORY_RECALL_RATE_LIMIT_MAX"),
+    SOURCE_JOURNAL_RATE_LIMIT_WINDOW_MS: prefixedApiEnv(environment, repoEnv, "SOURCE_JOURNAL_RATE_LIMIT_WINDOW_MS"),
+    SOURCE_JOURNAL_RATE_LIMIT_MAX: prefixedApiEnv(environment, repoEnv, "SOURCE_JOURNAL_RATE_LIMIT_MAX"),
+    CACHE_STORE: prefixedApiEnv(environment, repoEnv, "CACHE_STORE"),
+    CACHE_REDIS_URL: prefixedApiEnv(environment, repoEnv, "CACHE_REDIS_URL") ?? "",
+    GRAPH_CACHE_TTL_SECONDS: prefixedApiEnv(environment, repoEnv, "GRAPH_CACHE_TTL_SECONDS"),
+    GRAPH_UPDATE_DEBOUNCE_MS: prefixedApiEnv(environment, repoEnv, "GRAPH_UPDATE_DEBOUNCE_MS"),
+    MEMORY_EVENT_GRAPH_UPDATE_DEBOUNCE_MS: prefixedApiEnv(environment, repoEnv, "MEMORY_EVENT_GRAPH_UPDATE_DEBOUNCE_MS"),
+    DATA_ENCRYPTION_KEY: environment.API_DATA_ENCRYPTION_KEY ?? repoEnv.API_DATA_ENCRYPTION_KEY ?? environment.DATA_ENCRYPTION_KEY ?? repoEnv.DATA_ENCRYPTION_KEY,
+    OWNER_PRIVATE_REPLICA_DATA_ENCRYPTION_KEY: environment.OWNER_PRIVATE_REPLICA_DATA_ENCRYPTION_KEY ?? repoEnv.OWNER_PRIVATE_REPLICA_DATA_ENCRYPTION_KEY,
+    TEAM_MEMORY_DATA_ENCRYPTION_KEY: prefixedApiEnv(environment, repoEnv, "TEAM_MEMORY_DATA_ENCRYPTION_KEY"),
+    TEAM_MEMORY_ENVELOPE_ENCRYPTION_PROVIDER: prefixedApiEnv(environment, repoEnv, "TEAM_MEMORY_ENVELOPE_ENCRYPTION_PROVIDER"),
+    TEAM_MEMORY_MANAGED_KMS_KEY_ID: prefixedApiEnv(environment, repoEnv, "TEAM_MEMORY_MANAGED_KMS_KEY_ID"),
+    TEAM_MEMORY_MANAGED_KMS_KEY_VERSION: prefixedApiEnv(environment, repoEnv, "TEAM_MEMORY_MANAGED_KMS_KEY_VERSION"),
+    TEAM_MEMORY_MANAGED_KMS_ENDPOINT_URL: prefixedApiEnv(environment, repoEnv, "TEAM_MEMORY_MANAGED_KMS_ENDPOINT_URL"),
+    TEAM_MEMORY_MANAGED_KMS_AUTH_TOKEN: prefixedApiEnv(environment, repoEnv, "TEAM_MEMORY_MANAGED_KMS_AUTH_TOKEN"),
+    OWNER_PRIVATE_REPLICA_ENVELOPE_ENCRYPTION_PROVIDER: environment.OWNER_PRIVATE_REPLICA_ENVELOPE_ENCRYPTION_PROVIDER ?? repoEnv.OWNER_PRIVATE_REPLICA_ENVELOPE_ENCRYPTION_PROVIDER,
+    OWNER_PRIVATE_REPLICA_MANAGED_KMS_KEY_ID: environment.OWNER_PRIVATE_REPLICA_MANAGED_KMS_KEY_ID ?? repoEnv.OWNER_PRIVATE_REPLICA_MANAGED_KMS_KEY_ID,
+    OWNER_PRIVATE_REPLICA_MANAGED_KMS_KEY_VERSION: environment.OWNER_PRIVATE_REPLICA_MANAGED_KMS_KEY_VERSION ?? repoEnv.OWNER_PRIVATE_REPLICA_MANAGED_KMS_KEY_VERSION,
+    OWNER_PRIVATE_REPLICA_MANAGED_KMS_ENDPOINT_URL: environment.OWNER_PRIVATE_REPLICA_MANAGED_KMS_ENDPOINT_URL ?? repoEnv.OWNER_PRIVATE_REPLICA_MANAGED_KMS_ENDPOINT_URL,
+    OWNER_PRIVATE_REPLICA_MANAGED_KMS_AUTH_TOKEN: environment.OWNER_PRIVATE_REPLICA_MANAGED_KMS_AUTH_TOKEN ?? repoEnv.OWNER_PRIVATE_REPLICA_MANAGED_KMS_AUTH_TOKEN,
+    API_TOKEN_PEPPER: environment.API_TOKEN_PEPPER ?? repoEnv.API_TOKEN_PEPPER,
+    COLLABORATION_LOCAL_BROKER_SECRET: prefixedApiEnv(environment, repoEnv, "COLLABORATION_LOCAL_BROKER_SECRET"),
+    COLLABORATION_REALTIME_CURSOR_SECRET: prefixedApiEnv(environment, repoEnv, "COLLABORATION_REALTIME_CURSOR_SECRET"),
+    COLLABORATION_REALTIME_STREAM_MAX_CLIENTS: prefixedApiEnv(environment, repoEnv, "COLLABORATION_REALTIME_STREAM_MAX_CLIENTS"),
+    COLLABORATION_REALTIME_STREAM_MAX_CLIENTS_PER_PRINCIPAL: prefixedApiEnv(environment, repoEnv, "COLLABORATION_REALTIME_STREAM_MAX_CLIENTS_PER_PRINCIPAL"),
+    EMBEDDING_SERVICE_URL: serverConfig.dependencyMode === "external" ? serverConfig.external?.embeddingServiceUrl ?? environment.EMBEDDING_SERVICE_URL ?? repoEnv.EMBEDDING_SERVICE_URL : environment.EMBEDDING_SERVICE_URL ?? repoEnv.EMBEDDING_SERVICE_URL ?? embeddingServiceUrl,
+    EMBEDDING_SERVICE_TOKEN: environment.EMBEDDING_SERVICE_TOKEN ?? repoEnv.EMBEDDING_SERVICE_TOKEN,
+    PRIVACY_SERVICE_URL: serverConfig.dependencyMode === "external" ? serverConfig.external?.privacyServiceUrl ?? environment.PRIVACY_SERVICE_URL ?? repoEnv.PRIVACY_SERVICE_URL ?? process.env.PRIVACY_SERVICE_URL : environment.PRIVACY_SERVICE_URL ?? repoEnv.PRIVACY_SERVICE_URL ?? privacyServiceUrl,
+    PRIVACY_SERVICE_TOKEN: serverConfig.dependencyMode === "external" ? environment.PRIVACY_SERVICE_TOKEN ?? repoEnv.PRIVACY_SERVICE_TOKEN ?? process.env.PRIVACY_SERVICE_TOKEN : environment.PRIVACY_SERVICE_TOKEN ?? repoEnv.PRIVACY_SERVICE_TOKEN ?? process.env.PRIVACY_SERVICE_TOKEN ?? createOpaqueSecret("privacy"),
+    PRIVACY_RUNTIME_CONTROL_TOKEN: serverConfig.dependencyMode === "external" ? environment.PRIVACY_RUNTIME_CONTROL_TOKEN ?? repoEnv.PRIVACY_RUNTIME_CONTROL_TOKEN ?? process.env.PRIVACY_RUNTIME_CONTROL_TOKEN : environment.PRIVACY_RUNTIME_CONTROL_TOKEN ?? repoEnv.PRIVACY_RUNTIME_CONTROL_TOKEN ?? process.env.PRIVACY_RUNTIME_CONTROL_TOKEN ?? createOpaqueSecret("privacy-control"),
+    EMBEDDING_MODEL: environment.EMBEDDING_MODEL_KEY ?? environment.EMBEDDING_MODEL ?? repoEnv.EMBEDDING_MODEL_KEY ?? embeddingModel.key,
+    MODEL_KEY: environment.EMBEDDING_MODEL_KEY ?? environment.MODEL_KEY ?? environment.EMBEDDING_MODEL ?? repoEnv.EMBEDDING_MODEL_KEY ?? embeddingModel.key,
+    EMBEDDING_MODEL_PATH: serverConfig.dependencyMode === "bundled-local" ? localEmbeddingModelPath : environment.EMBEDDING_MODEL_PATH,
+    MODEL_PATH: serverConfig.dependencyMode === "bundled-local" ? localEmbeddingModelPath : environment.EMBEDDING_MODEL_PATH ?? environment.MODEL_PATH,
+    LLAMA_SERVER_BINARY: environment.LLAMA_SERVER_BINARY ?? repoEnv.EMBEDDING_LLAMA_SERVER_BINARY ?? environment.EMBEDDING_LLAMA_SERVER_BINARY,
+    LLAMA_N_CTX: environment.EMBEDDING_LLAMA_N_CTX ?? environment.LLAMA_N_CTX ?? repoEnv.EMBEDDING_LLAMA_N_CTX,
+    LLAMA_N_THREADS: environment.EMBEDDING_LLAMA_N_THREADS ?? environment.LLAMA_N_THREADS ?? repoEnv.EMBEDDING_LLAMA_N_THREADS,
+    LLAMA_N_BATCH: environment.EMBEDDING_LLAMA_N_BATCH ?? environment.LLAMA_N_BATCH ?? repoEnv.EMBEDDING_LLAMA_N_BATCH,
+    LLAMA_BATCH_TOKEN_HEADROOM: environment.EMBEDDING_LLAMA_BATCH_TOKEN_HEADROOM ?? environment.LLAMA_BATCH_TOKEN_HEADROOM ?? repoEnv.EMBEDDING_LLAMA_BATCH_TOKEN_HEADROOM,
+    LLAMA_N_UBATCH: environment.EMBEDDING_LLAMA_N_UBATCH ?? environment.LLAMA_N_UBATCH ?? repoEnv.EMBEDDING_LLAMA_N_UBATCH,
+    LLAMA_PARALLEL: environment.EMBEDDING_LLAMA_PARALLEL ?? environment.LLAMA_PARALLEL ?? repoEnv.EMBEDDING_LLAMA_PARALLEL,
+    LLAMA_SERVER_STARTUP_TIMEOUT_SECONDS: environment.EMBEDDING_LLAMA_SERVER_STARTUP_TIMEOUT_SECONDS ?? environment.LLAMA_SERVER_STARTUP_TIMEOUT_SECONDS ?? repoEnv.EMBEDDING_LLAMA_SERVER_STARTUP_TIMEOUT_SECONDS,
+    LLAMA_EMBEDDING_SERVER_PORT: environment.EMBEDDING_LLAMA_EMBEDDING_SERVER_PORT ?? environment.LLAMA_EMBEDDING_SERVER_PORT ?? repoEnv.EMBEDDING_LLAMA_EMBEDDING_SERVER_PORT,
+    CORS_ORIGINS: corsOrigins(environment, repoEnv),
+    COOKIE_SECURE: prefixedApiEnv(environment, repoEnv, "COOKIE_SECURE"),
+    BROWSER_PUBLIC_URL: prefixedApiEnv(environment, repoEnv, "BROWSER_PUBLIC_URL"),
+    MEMORY_API_URL: resolveApiUrl(environment, repoEnv)
+  };
+};
+var waitForChildExit = (child, timeoutMs) => new Promise((resolveExit) => {
+  if (child.exitCode != null || child.signalCode != null) {
+    resolveExit(true);
+    return;
+  }
+  let settled = false;
+  const finish = (exited) => {
+    if (settled)
+      return;
+    settled = true;
+    clearTimeout(timeout);
+    child.off("exit", onExit);
+    resolveExit(exited);
+  };
+  const onExit = () => finish(true);
+  const timeout = setTimeout(() => finish(false), timeoutMs);
+  child.once("exit", onExit);
+});
+var stopChildProcess = async (child, timeoutMs = 5e3, label = "managed child") => {
+  if (!child?.pid || child.exitCode != null || child.signalCode != null)
+    return;
+  child.kill("SIGTERM");
+  if (await waitForChildExit(child, timeoutMs))
+    return;
+  child.kill("SIGKILL");
+  if (!await waitForChildExit(child, timeoutMs)) {
+    throw new Error(`Timed out stopping ${label} process ${child.pid}.`);
+  }
+};
+var createManagedProcessMonitor = (options = {}) => {
+  const expectedSignals = new Set(options.expectedSignals ?? ["SIGINT", "SIGTERM"]);
+  const listeners = /* @__PURE__ */ new Map();
+  let resolveResult;
+  let rejectResult;
+  const result = new Promise((resolvePromise, rejectPromise) => {
+    resolveResult = resolvePromise;
+    rejectResult = rejectPromise;
+  });
+  let settled = false;
+  const dispose = () => {
+    for (const [child, listener] of listeners) {
+      child.off("exit", listener.exit);
+      child.off("error", listener.error);
+    }
+    listeners.clear();
+  };
+  const settle = (error) => {
+    if (settled)
+      return;
+    settled = true;
+    dispose();
+    if (error)
+      rejectResult(error);
+    else
+      resolveResult();
+  };
+  const recordExit = (name, code, signal) => {
+    if (signal && expectedSignals.has(signal)) {
+      settle();
+      return;
+    }
+    settle(new Error(`Essential managed child ${name} exited unexpectedly with ${signal ? `signal ${signal}` : `code ${code ?? "unknown"}`}.`));
+  };
+  return {
+    watch: (name, child) => {
+      if (settled)
+        return;
+      if (child.exitCode != null || child.signalCode != null) {
+        recordExit(name, child.exitCode, child.signalCode);
+        return;
+      }
+      const listener = {
+        exit: (code, signal) => recordExit(name, code, signal),
+        error: (error) => settle(new Error(`Essential managed child ${name} failed: ${error.message}`, {
+          cause: error
+        }))
+      };
+      listeners.set(child, listener);
+      child.once("exit", listener.exit);
+      child.once("error", listener.error);
+    },
+    result,
+    dispose
+  };
+};
+var startKoedServer = async ({ environment = process.env, pollIntervalMs = 500, timeoutMs = 18e4, spawnSync = nodeSpawnSync2, spawn = nodeSpawn2, collectStatus = collectKoedServerStartupStatus, provisionLocalApiToken: provisionLocalApiTokenDependency = provisionLocalApiToken, signal, desktopRuntimeCapability, onReady } = {}) => {
+  if (desktopRuntimeCapability !== void 0 && !validateDesktopRuntimeCapability(desktopRuntimeCapability)) {
+    throw new Error("validated private Desktop runtime capability is required");
+  }
+  const requestedEnvironment = environment;
+  const startupId = randomBytes3(12).toString("hex");
+  const startupStartedAt = process.hrtime.bigint();
+  const emitStartupMilestone = (milestone) => {
+    console.log(JSON.stringify({
+      event: "koed.supervisor.startup",
+      startupId,
+      milestone,
+      elapsedMs: Number(process.hrtime.bigint() - startupStartedAt) / 1e6
+    }));
+  };
+  emitStartupMilestone("supervisor_entry");
+  const execution = resolveKoedAppRuntimeExecution();
+  const bootstrapPaths = resolveKoedServerPaths(environment);
+  const bootstrapEnvironment = execution === "source" ? environmentWithRepoEnv(bootstrapPaths.repoRoot, environment) : environment;
+  const paths = resolveKoedServerPaths(bootstrapEnvironment);
+  const owner = desktopRuntimeCapability === void 0 ? resolveKoedRuntimeOwner() : resolveDesktopRuntimeOwner(desktopRuntimeCapability, paths.koedHome);
+  const ownerMismatchMessage = desktopRuntimeCapability === void 0 ? "Packaged runtime owner does not match this standalone control plane." : "Packaged runtime owner does not match this Desktop installation.";
+  const persistedOwner = await readCurrentRuntimeOwner(paths);
+  if (persistedOwner && (persistedOwner.kind !== owner.kind || persistedOwner.installationId !== owner.installationId))
+    throw new Error(ownerMismatchMessage);
+  const assertObservedOwner = (existing) => {
+    if (existing.state === "stopped")
+      return;
+    if (!existing.owner)
+      throw new Error("Runtime owner could not be verified; refusing to share this KOED_HOME.");
+    if (!runtimeOwnedBy(existing, owner))
+      throw new Error(ownerMismatchMessage);
+  };
+  assertObservedOwner(observeRuntimeLifecycle(paths));
+  ensureKoedHome(paths);
+  const supervisorLock = acquireKoedServerSupervisorLock(paths);
+  if (!supervisorLock.acquired) {
+    assertObservedOwner(observeRuntimeLifecycle(paths));
+    console.log(JSON.stringify({
+      ok: true,
+      state: "already_running",
+      koedHome: paths.koedHome,
+      message: "A koed-server supervisor already owns this KOED_HOME.",
+      ...supervisorLock.ownerPid ? { supervisorPid: supervisorLock.ownerPid } : {}
+    }, null, 2));
+    return;
+  }
+  let supervisorLockReleased = false;
+  let cleanupStarted = false;
+  let startupPhase = "post-lock initialization";
+  const releaseSupervisorLock = () => {
+    if (supervisorLockReleased)
+      return;
+    supervisorLockReleased = true;
+    releaseKoedServerSupervisorLock(supervisorLock);
+  };
+  try {
+    const initializeUnderSupervisorLock = async (initialize) => {
+      try {
+        return await initialize();
+      } catch (error) {
+        releaseSupervisorLock();
+        throw error;
+      }
+    };
+    startupPhase = "device identity initialization";
+    await initializeUnderSupervisorLock(() => ensureDeviceIdentity(paths, { environment }));
+    const supervisorStartedAt = (/* @__PURE__ */ new Date()).toISOString();
+    startupPhase = "effective runtime configuration";
+    const effectiveRuntimeConfig = await initializeUnderSupervisorLock(() => resolveEffectiveRuntimeConfig(paths, requestedEnvironment, execution));
+    environment = effectiveRuntimeConfig.environment;
+    startupPhase = "runtime requirements";
+    const requiredRuntime = await initializeUnderSupervisorLock(() => calculateRuntimeRequirements(effectiveRuntimeConfig));
+    environment = {
+      ...environment,
+      WORK_QUEUE_BACKEND: requiredRuntime.queue
+    };
+    const desktopManagedLocal = environment.KOED_AUTO_PORTS === "1";
+    const startupConfig = effectiveRuntimeConfig.config;
+    startupPhase = "packaged local service secrets";
+    environment = await initializeUnderSupervisorLock(() => ensurePackagedLocalServiceSecrets(paths, execution === "packaged" || startupConfig.runtimeMode === "local-personal" && startupConfig.dependencyMode === "bundled-local", environment));
+    mkdirSync3(paths.logsDir, { recursive: true, mode: 448 });
+    if (startupConfig.runtimeMode === "local-personal" && startupConfig.dependencyMode === "bundled-local" && environment.KOED_AUTO_PORTS === void 0) {
+      environment = { ...environment, KOED_AUTO_PORTS: "1" };
+    }
+    const portAllocationEnvironment = { ...environment };
+    if (environment.KOED_AUTO_PORTS === "1") {
+      for (const key of [
+        "API_HOST_PORT",
+        "POSTGRES_HOST_PORT",
+        "EMBEDDING_SERVICE_HOST_PORT",
+        "PRIVACY_SERVICE_PORT",
+        "EMBEDDING_LLAMA_EMBEDDING_SERVER_PORT"
+      ]) {
+        if (!requestedEnvironment[key]?.trim())
+          delete portAllocationEnvironment[key];
+      }
+    }
+    const allocatedPortEnvironmentForStart = environment.KOED_ENV_PATH?.trim() ? {
+      ...environmentWithRepoEnv(paths.repoRoot, environment),
+      ...portAllocationEnvironment
+    } : portAllocationEnvironment;
+    startupPhase = "local port allocation";
+    const allocatedPortEnvironment = await initializeUnderSupervisorLock(() => allocateAndPersistLocalPorts(paths, allocatedPortEnvironmentForStart));
+    environment = {
+      ...environment,
+      API_HOST_PORT: allocatedPortEnvironment.API_HOST_PORT,
+      POSTGRES_HOST_PORT: allocatedPortEnvironment.POSTGRES_HOST_PORT,
+      EMBEDDING_SERVICE_HOST_PORT: allocatedPortEnvironment.EMBEDDING_SERVICE_HOST_PORT,
+      PRIVACY_SERVICE_PORT: allocatedPortEnvironment.PRIVACY_SERVICE_PORT,
+      EMBEDDING_LLAMA_EMBEDDING_SERVER_PORT: allocatedPortEnvironment.EMBEDDING_LLAMA_EMBEDDING_SERVER_PORT
+    };
+    startupPhase = "repository environment and credentials";
+    const repoEnv = execution === "source" || environment.KOED_ENV_PATH?.trim() ? loadRepoEnv(paths.repoRoot, environment) : {};
+    const migration = migrateKoedOwnedCodexRegistrationBestEffort({
+      environment: { ...repoEnv, ...environment, KOED_HOME: paths.koedHome }
+    });
+    if (migration.diagnostic) {
+      console.warn(migration.diagnostic);
+    }
+    const apiToken = desktopManagedLocal ? null : resolveLocalApiToken(environment, repoEnv);
+    if (apiToken) {
+      writeLocalAppCredential(paths, {
+        apiToken: apiToken.token,
+        provisionedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        source: apiToken.source
+      });
+    }
+    const config = startupConfig;
+    const initialServiceEnv = localServiceEnv(environment, repoEnv, apiToken, paths);
+    const useBundledLocalDependencies = config.dependencyMode === "bundled-local";
+    const teamCollaborationEnabled = effectiveRuntimeConfig.teamEnabled;
+    const localAiRuntimeEnabled = config.runtimeMode !== "external";
+    const runtimeServices = useBundledLocalDependencies ? [
+      "postgres-native",
+      "embedding-service-native",
+      ...teamCollaborationEnabled ? ["privacy-service-native"] : []
+    ] : [];
+    const appServices = [
+      "api",
+      "worker",
+      ...localAiRuntimeEnabled ? ["local-ai-runtime"] : []
+    ];
+    const childEnv = initialServiceEnv;
+    if (execution === "source") {
+      startupPhase = "source environment preparation";
+      runCommand(paths, "Prepare Koed environment", process.execPath, [resolve4(paths.repoRoot, "scripts/setup-env.mjs")], childEnv, spawnSync);
+    }
+    startupPhase = "refreshed repository environment and credentials";
+    const refreshedRepoEnv = await initializeUnderSupervisorLock(() => execution === "source" || environment.KOED_ENV_PATH?.trim() ? loadRepoEnv(paths.repoRoot, environment) : {});
+    const refreshedApiToken = desktopManagedLocal ? null : resolveLocalApiToken(environment, refreshedRepoEnv);
+    if (refreshedApiToken) {
+      writeLocalAppCredential(paths, {
+        apiToken: refreshedApiToken.token,
+        provisionedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        source: refreshedApiToken.source
+      });
+    }
+    const refreshedEnv = localServiceEnv(environment, refreshedRepoEnv, refreshedApiToken, paths);
+    refreshedEnv.WORK_QUEUE_BACKEND = requiredRuntime.queue;
+    const apiUrlEnvironment = { ...environment };
+    if (requestedEnvironment.API_HOST_PORT?.trim() && !requestedEnvironment.MEMORY_API_URL?.trim()) {
+      delete apiUrlEnvironment.MEMORY_API_URL;
+    }
+    const apiUrl = resolveApiUrl(apiUrlEnvironment, refreshedRepoEnv);
+    let appRuntime;
+    let generationPin;
+    let startedNativePostgres = false;
+    let nativeEmbeddingProcess;
+    let nativePrivacyProcess;
+    const managedChildren = {};
+    const managedProcessMonitor = createManagedProcessMonitor({
+      expectedSignals: []
+    });
+    const managedProcessOutcome = managedProcessMonitor.result.then(() => ({ error: null }), (error) => ({ error }));
+    const manageChild = (name, child) => {
+      managedChildren[name] = child;
+      managedProcessMonitor.watch(name, child);
+      return child;
+    };
+    let runtimeStateWritten = false;
+    let stopSupervisorExitMonitor = () => void 0;
+    let stopCapabilityMaintenance = () => void 0;
+    const runtimeStateOwnedByCurrentProcess = () => {
+      try {
+        const runtime = JSON.parse(readFileSync4(paths.runtimeStatePath, "utf8"));
+        return runtime.pid === process.pid && runtime.startedAt === supervisorStartedAt;
+      } catch {
+        return false;
+      }
+    };
+    let deviceRequestService;
+    let cleanupPromise;
+    let cleanupCompleted = false;
+    const cleanupStartedResources = () => {
+      cleanupStarted = true;
+      if (cleanupPromise)
+        return cleanupPromise;
+      cleanupPromise = (async () => {
+        const cleanupErrors = [];
+        try {
+          await deviceRequestService?.close();
+        } catch (error) {
+          cleanupErrors.push(error instanceof Error ? error.message : String(error));
+        }
+        const shutdownOrder = [
+          "localAiRuntime",
+          "worker",
+          "api",
+          "privacyService",
+          "embeddingService"
+        ];
+        for (const name of shutdownOrder) {
+          try {
+            await stopChildProcess(managedChildren[name], 5e3, name);
+          } catch (error) {
+            cleanupErrors.push(error instanceof Error ? error.message : String(error));
+          }
+        }
+        if (nativeEmbeddingProcess && !Object.values(managedChildren).includes(nativeEmbeddingProcess)) {
+          try {
+            await stopChildProcess(nativeEmbeddingProcess, 5e3, "embeddingService");
+          } catch (error) {
+            cleanupErrors.push(error instanceof Error ? error.message : String(error));
+          }
+        }
+        if (startedNativePostgres) {
+          const stopped = stopLocalPostgresRuntime(paths, refreshedEnv, {
+            spawnSync
+          });
+          startedNativePostgres = false;
+          if (!stopped.ok) {
+            cleanupErrors.push(stopped.error ?? stopped.message);
+          }
+        }
+        if (cleanupErrors.length > 0) {
+          throw new Error(cleanupErrors.join("; "));
+        }
+        cleanupCompleted = true;
+      })();
+      return cleanupPromise;
+    };
+    let requestShutdown = () => void 0;
+    const shutdownRequested = new Promise((resolveShutdown) => {
+      requestShutdown = resolveShutdown;
+    });
+    const waitForStartupReadiness = async (isReady) => {
+      const controller = new AbortController();
+      const interrupted = Promise.race([
+        managedProcessOutcome.then(({ error }) => {
+          throw error ?? new Error("Managed processes stopped during startup.");
+        }),
+        shutdownRequested.then(() => {
+          throw new Error("Koed startup was stopped before readiness.");
+        })
+      ]);
+      try {
+        return await Promise.race([
+          interrupted,
+          waitForHealthyOrReady({
+            environment: refreshedEnv,
+            timeoutMs,
+            pollIntervalMs,
+            signal: controller.signal,
+            collectStatus: (env) => collectStatus(env, {
+              desktopRuntimeCapability,
+              appRuntime,
+              fetch: (url, init) => fetch(url, {
+                ...init,
+                signal: init?.signal ? AbortSignal.any([controller.signal, init.signal]) : controller.signal
+              })
+            }),
+            ...isReady ? { isReady } : {}
+          })
+        ]);
+      } finally {
+        controller.abort();
+      }
+    };
+    const shutdown = () => {
+      stopCapabilityMaintenance();
+      requestShutdown();
+    };
+    if (signal?.aborted)
+      requestShutdown();
+    else
+      signal?.addEventListener("abort", shutdown, { once: true });
+    process.on("SIGINT", shutdown);
+    process.on("SIGTERM", shutdown);
+    const stopSupervisorLogMaintenance = maintainSupervisorLog(refreshedEnv);
+    let sourceRuntimeLeaseAcquired = false;
+    let startupReady = false;
+    try {
+      startupPhase = "authenticated runtime selection";
+      if (execution === "packaged") {
+        const selected = await pinAndResolvePackagedRuntime(paths, environment, requiredRuntime, existsSync3, desktopRuntimeCapability);
+        generationPin = selected.pin;
+        appRuntime = selected.runtime;
+      } else {
+        appRuntime = resolveKoedAppRuntime(paths, environment, existsSync3, void 0, requiredRuntime);
+        assertKoedAppRuntimeAvailable(appRuntime, paths);
+      }
+      if (appRuntime.kind === "source") {
+        runCommand(paths, "Check source runtime artifacts", process.execPath, [
+          resolve4(paths.repoRoot, "scripts/source-runtime-build.mjs"),
+          "check",
+          "--lease-pid",
+          String(process.pid)
+        ], refreshedEnv, spawnSync);
+        sourceRuntimeLeaseAcquired = true;
+        emitStartupMilestone("source_runtime_verification_complete");
+      }
+      startupPhase = "service dependency validation and startup";
+      if (config.dependencyMode === "external") {
+        const queueBackend = requiredRuntime.queue;
+        const requiredExternalServices = [
+          ["DATABASE_URL", refreshedEnv.DATABASE_URL],
+          ...queueBackend === "bullmq" ? [
+            ["REDIS_URL", refreshedEnv.REDIS_URL]
+          ] : [],
+          ["EMBEDDING_SERVICE_URL", refreshedEnv.EMBEDDING_SERVICE_URL]
+        ];
+        if (teamCollaborationEnabled) {
+          requiredExternalServices.push(["PRIVACY_SERVICE_URL", refreshedEnv.PRIVACY_SERVICE_URL], ["PRIVACY_SERVICE_TOKEN", refreshedEnv.PRIVACY_SERVICE_TOKEN], [
+            "PRIVACY_RUNTIME_CONTROL_TOKEN",
+            refreshedEnv.PRIVACY_RUNTIME_CONTROL_TOKEN
+          ]);
+        }
+        const missing = requiredExternalServices.flatMap(([name, value]) => value?.trim() ? [] : [name]);
+        if (missing.length > 0) {
+          throw new Error(`External dependency mode requires Operator-managed service configuration: ${missing.join(", ")}. Set values in KOED_HOME/config/server.json or environment.`);
+        }
+      } else {
+        const queueBackend = requiredRuntime.queue;
+        if (queueBackend === "bullmq" && !refreshedEnv.REDIS_URL?.trim()) {
+          throw new Error("Bundled-local mode with WORK_QUEUE_BACKEND=bullmq requires an Operator-managed Redis URL. Set REDIS_URL or use WORK_QUEUE_BACKEND=local.");
+        }
+      }
+      if (useBundledLocalDependencies) {
+        const result = startLocalPostgresRuntime(paths, refreshedEnv, {
+          spawnSync
+        });
+        Object.assign(refreshedEnv, result.env);
+        startedNativePostgres = result.started;
+        if (!result.ok) {
+          throw new Error(`Bundled-local native Postgres could not start: ${result.status.message ?? result.status.state}${localRuntimeFailureDetails(result.status.details)}${result.status.action ? ` ${result.status.action}` : ""}`);
+        }
+        emitStartupMilestone("local_postgres_start_complete");
+      }
+      if (useBundledLocalDependencies && teamCollaborationEnabled) {
+        const result = await startLocalPrivacyRuntime(paths, refreshedEnv, {
+          spawn,
+          appRuntime
+        });
+        Object.assign(refreshedEnv, result.env);
+        nativePrivacyProcess = result.process;
+        if (nativePrivacyProcess) {
+          manageChild("privacyService", nativePrivacyProcess);
+        }
+        if (!result.ok) {
+          throw new Error(`Bundled-local Privacy Filter Service could not start: ${result.status.message ?? result.status.state}${result.status.action ? ` ${result.status.action}` : ""}`);
+        }
+        emitStartupMilestone("privacy_filter_process_spawned");
+      }
+      if (useBundledLocalDependencies) {
+        const result = startLocalEmbeddingRuntime(paths, appProcessEnvironment(refreshedEnv), { spawn, appRuntime });
+        Object.assign(refreshedEnv, result.env);
+        nativeEmbeddingProcess = result.process;
+        if (nativeEmbeddingProcess) {
+          manageChild("embeddingService", nativeEmbeddingProcess);
+        }
+        if (!result.ok) {
+          throw new Error(`Bundled-local native Embedding Service could not start: ${result.status.message ?? result.status.state}${result.status.action ? ` ${result.status.action}` : ""}`);
+        }
+        emitStartupMilestone("embedding_service_process_spawned");
+      }
+      const api = appRuntime.kind === "packaged" ? spawnManagedProcess(paths, "API", process.execPath, [appRuntime.apiEntry], appProcessEnvironment(refreshedEnv), spawn, resolve4(appRuntime.root, "api")) : spawnManagedProcess(paths, "API", process.execPath, [resolve4(paths.repoRoot, "apps/api/dist/index.js")], appProcessEnvironment(refreshedEnv), spawn, resolve4(paths.repoRoot, "apps/api"));
+      manageChild("api", api);
+      emitStartupMilestone("api_process_spawned");
+      const runtime = {
+        pid: process.pid,
+        startedAt: supervisorStartedAt,
+        repoRoot: paths.repoRoot,
+        apiUrl,
+        runtimeMode: config.runtimeMode,
+        dependencyMode: config.dependencyMode,
+        automaticPorts: environment.KOED_AUTO_PORTS === "1",
+        codexTranscriptWatcherEnabled: config.codexTranscriptWatcherEnabled,
+        claudeTranscriptWatcherEnabled: config.claudeTranscriptWatcherEnabled,
+        piTranscriptWatcherEnabled: config.piTranscriptWatcherEnabled,
+        services: [...runtimeServices, "api"],
+        processes: {
+          ...nativeEmbeddingProcess ? { embeddingService: nativeEmbeddingProcess.pid ?? 0 } : {},
+          ...nativePrivacyProcess ? { privacyService: nativePrivacyProcess.pid ?? 0 } : {},
+          api: api.pid ?? 0
+        }
+      };
+      const persistRuntime = () => {
+        writeFileSync2(paths.runtimeStatePath, `${JSON.stringify(runtime, null, 2)}
+`, {
+          mode: 384
+        });
+        runtimeStateWritten = true;
+      };
+      persistRuntime();
+      stopSupervisorExitMonitor = monitorSupervisorExitRequest(paths, {
+        pid: process.pid,
+        startedAt: supervisorStartedAt
+      }, {
+        onExit: requestShutdown
+      });
+      let status = await waitForStartupReadiness((candidate) => candidate.api.state === "healthy" && candidate.database.state === "healthy");
+      if (status.api.state !== "healthy" || status.database.state !== "healthy") {
+        throw new Error(`API and database did not become ready before local credential provisioning. Blocking checks: ${startupBlockingSummary(status, ["api", "database"])}. Inspect /ready and koed status --json for details.`);
+      }
+      emitStartupMilestone("api_and_database_ready");
+      if (desktopManagedLocal) {
+        const desktopApiToken = await provisionDesktopApiToken(paths, appRuntime, refreshedEnv);
+        if (desktopApiToken) {
+          Object.assign(refreshedEnv, {
+            MEMORY_API_TOKEN: desktopApiToken
+          });
+        }
+        emitStartupMilestone("desktop_credential_provisioned");
+      } else if (useBundledLocalDependencies && config.runtimeMode === "local-personal" && !resolveActiveIntegrationApiToken(paths, refreshedEnv, refreshedRepoEnv)) {
+        const provisioned = await provisionLocalApiTokenDependency(paths, appRuntime, refreshedEnv, refreshedRepoEnv);
+        Object.assign(refreshedEnv, { MEMORY_API_TOKEN: provisioned.token });
+        emitStartupMilestone("packaged_personal_credential_provisioned");
+      }
+      const finalApiToken = resolveActiveIntegrationApiToken(paths, refreshedEnv, refreshedRepoEnv)?.token;
+      if (finalApiToken) {
+        Object.assign(refreshedEnv, { MEMORY_API_TOKEN: finalApiToken });
+      }
+      let localAiRuntime;
+      if (localAiRuntimeEnabled) {
+        if (!finalApiToken) {
+          throw new Error("A Personal API Token is required to start the local AI runtime.");
+        }
+        localAiRuntime = spawnManagedProcess(paths, "Local AI Runtime", process.execPath, [appRuntime.localAiRuntime], {
+          ...appProcessEnvironment(refreshedEnv),
+          KOED_HOME: paths.koedHome,
+          MEMORY_API_URL: apiUrl,
+          MEMORY_API_TOKEN: finalApiToken,
+          MEMORY_CODEX_TRANSCRIPT_WATCHER_ENABLED: String(config.codexTranscriptWatcherEnabled),
+          MEMORY_CLAUDE_TRANSCRIPT_WATCHER_ENABLED: String(config.claudeTranscriptWatcherEnabled),
+          MEMORY_PI_TRANSCRIPT_WATCHER_ENABLED: String(config.piTranscriptWatcherEnabled)
+        }, spawn, appRuntime.kind === "packaged" ? resolve4(appRuntime.root, "mcp-server") : resolve4(paths.repoRoot, "packages", "mcp-server"));
+        manageChild("localAiRuntime", localAiRuntime);
+        emitStartupMilestone("local_ai_runtime_process_spawned");
+      }
+      const worker = appRuntime.kind === "packaged" ? spawnManagedProcess(paths, "Worker", process.execPath, [appRuntime.workerEntry], appProcessEnvironment(refreshedEnv), spawn, resolve4(appRuntime.root, "worker")) : spawnManagedProcess(paths, "Worker", process.execPath, [resolve4(paths.repoRoot, "apps/worker/dist/index.js")], appProcessEnvironment(refreshedEnv), spawn, resolve4(paths.repoRoot, "apps/worker"));
+      manageChild("worker", worker);
+      emitStartupMilestone("worker_process_spawned");
+      if (config.runtimeMode === "local-personal") {
+        deviceRequestService = await startDeviceRequestService({
+          paths,
+          host: environment.KOED_PDS_REQUEST_HOST?.trim() || void 0,
+          enrolled: () => Boolean(createPdsApplicationSecretStore({ rootPath: paths.koedHome }).get("pds-runtime")),
+          redeem: async (link, label, signal2) => {
+            const fetchWithShutdown = (input, init) => fetch(input, {
+              ...init,
+              signal: init?.signal ? AbortSignal.any([signal2, init.signal]) : signal2
+            });
+            const result = await redeemPairingLink(link, label, paths, { ...refreshedEnv, PDS_LOCAL_CONTROL_URL: apiUrl }, { fetch: fetchWithShutdown });
+            if (!result.ok)
+              throw new Error("Enrollment did not complete.");
+          }
+        });
+      }
+      runtime.services = [...runtimeServices, ...appServices];
+      runtime.processes = {
+        ...runtime.processes,
+        ...localAiRuntime ? { localAiRuntime: localAiRuntime.pid ?? 0 } : {},
+        worker: worker.pid ?? 0
+      };
+      persistRuntime();
+      console.log(JSON.stringify({
+        ok: true,
+        state: "starting",
+        koedHome: paths.koedHome,
+        apiUrl,
+        services: runtime.services
+      }, null, 2));
+      status = await waitForStartupReadiness();
+      if (!status.ok) {
+        throw new Error(`Core services did not become ready before timeout. Blocking checks: ${startupBlockingSummary(status)}. Inspect /ready and koed status --json for details.`);
+      }
+      if (localAiRuntimeEnabled) {
+        stopCapabilityMaintenance = maintainUpstreamCapabilities(paths, {
+          onError: () => console.warn("Upstream capability maintenance will retry.")
+        });
+      }
+      emitStartupMilestone("core_services_ready");
+      startupReady = true;
+      onReady?.();
+      console.log(JSON.stringify(status, null, 2));
+      emitStartupMilestone("final_supervisor_status_emitted");
+      console.log("Koed server supervisor is running. Press Ctrl-C to stop local app processes.");
+      await Promise.race([
+        shutdownRequested,
+        managedProcessOutcome.then(({ error }) => {
+          if (error)
+            throw error;
+        })
+      ]);
+      await cleanupStartedResources();
+    } catch (error) {
+      if (!startupReady)
+        emitStartupMilestone("startup_failed");
+      try {
+        await cleanupStartedResources();
+        if (runtimeStateOwnedByCurrentProcess()) {
+          rmSync3(paths.runtimeStatePath, { force: true });
+        }
+      } catch (cleanupError) {
+        throw new Error(`${error instanceof Error ? error.message : String(error)} Cleanup failed: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`, { cause: cleanupError });
+      }
+      throw error;
+    } finally {
+      stopCapabilityMaintenance();
+      stopSupervisorExitMonitor();
+      stopSupervisorLogMaintenance();
+      process.off("SIGINT", shutdown);
+      process.off("SIGTERM", shutdown);
+      signal?.removeEventListener("abort", shutdown);
+      managedProcessMonitor.dispose();
+      if (runtimeStateWritten && runtimeStateOwnedByCurrentProcess()) {
+        rmSync3(paths.runtimeStatePath, { force: true });
+      }
+      if (sourceRuntimeLeaseAcquired) {
+        try {
+          const releaseResult = spawnSync(process.execPath, [
+            resolve4(paths.repoRoot, "scripts/source-runtime-build.mjs"),
+            "release-lease",
+            "--lease-pid",
+            String(process.pid)
+          ], {
+            cwd: paths.repoRoot,
+            env: refreshedEnv,
+            stdio: "inherit"
+          });
+          if (releaseResult.error || releaseResult.status !== 0) {
+            console.warn(`Could not release the source-runtime lease: ${releaseResult.error?.message ?? `exit code ${releaseResult.status ?? 1}`}.`);
+          }
+        } catch (error) {
+          console.warn(`Could not release the source-runtime lease: ${error instanceof Error ? error.message : String(error)}.`);
+        }
+      }
+      if (cleanupCompleted) {
+        try {
+          await generationPin?.release();
+        } finally {
+          releaseSupervisorLock();
+        }
+      } else {
+        console.error("Supervisor cleanup could not confirm all managed children exited; retaining runtime generation pin and supervisor lock.");
+      }
+    }
+  } catch (error) {
+    throw new Error(`${startupPhase} failed: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+  } finally {
+    if (!cleanupStarted)
+      releaseSupervisorLock();
+  }
+};
+
+// packages/koed-server/dist/cli-service-context.js
+var createCliServiceContext = ({ collectStatus = collectKoedServerStatus, collectStartupStatus = collectKoedServerStartupStatus, collectDoctor = collectKoedServerDoctor, inspectDeviceIdentity = inspectDeviceIdentityStatus, rotateDeviceIdentity: rotateIdentity = rotateDeviceIdentity, invalidateUpstreamEnrollmentReferences: invalidateEnrollmentReferences = invalidateUpstreamEnrollmentReferences, start = startKoedServer, startDaemon = startKoedServerDaemon, stop = stopKoedServer, restart = restartKoedServer, setupCore: setupCoreIntegration = setupCore, setupCodex: setup = setupCodex, setupClaude: setupClaudeIntegration = setupClaude, setupPi: setupPiIntegration = setupPi, removeClaude: removeClaudeIntegration = removeClaude, removePi: removePiIntegration = removePi, removeCodex: removeCodexIntegrationFn = removeCodexIntegration, repairCodex = repairCodexIntegration, resolvePaths = resolveKoedServerPaths, stdout = process.stdout, stderr = process.stderr, desktopRuntimeCapability, supervisorInvocation } = {}) => {
+  if (desktopRuntimeCapability) {
+    const authority = { desktopRuntimeCapability };
+    const [status, startupStatus, doctor, foreground, restartServer, stopServer] = [
+      collectStatus,
+      collectStartupStatus,
+      collectDoctor,
+      start,
+      restart,
+      stop
+    ];
+    const [core, codex, claude, pi, codexRepair] = [
+      setupCoreIntegration,
+      setup,
+      setupClaudeIntegration,
+      setupPiIntegration,
+      repairCodex
+    ];
+    const daemon = startDaemon;
+    collectStatus = (environment, dependencies, options) => status(environment, { ...dependencies, ...authority }, options);
+    collectStartupStatus = (environment, dependencies) => startupStatus(environment, { ...dependencies, ...authority });
+    collectDoctor = (environment, dependencies) => doctor(environment, { ...dependencies, ...authority });
+    start = (options) => foreground({ ...options, ...authority });
+    stop = (options = {}) => stopServer({ ...options, ...authority });
+    restart = (options) => restartServer({ ...options, ...authority, ...supervisorStart() });
+    startDaemon = (options) => daemon({ ...options, ...supervisorStart() });
+    setupCoreIntegration = (options) => core({ ...options, ...authority });
+    setup = (options) => codex({ ...options, ...authority });
+    repairCodex = (options) => codexRepair({ ...options, ...authority });
+    setupClaudeIntegration = (environment, spawnSync, options) => claude(environment, spawnSync, { ...options, ...authority });
+    setupPiIntegration = (environment, spawnSync, options) => pi(environment, spawnSync, { ...options, ...authority });
+  }
+  function supervisorStart() {
+    if (!supervisorInvocation)
+      throw new Error("Verified Desktop supervisor command is unavailable.");
+    return supervisorInvocation;
+  }
+  return {
+    collectStatus,
+    collectStartupStatus,
+    collectDoctor,
+    inspectDeviceIdentity,
+    rotateIdentity,
+    invalidateEnrollmentReferences,
+    start,
+    startDaemon,
+    stop,
+    restart,
+    setupCoreIntegration,
+    setup,
+    setupClaudeIntegration,
+    setupPiIntegration,
+    removeClaudeIntegration,
+    removePiIntegration,
+    removeCodexIntegrationFn,
+    repairCodex,
+    resolvePaths,
+    stdout,
+    stderr,
+    desktopRuntimeCapability
+  };
+};
+
+// packages/koed-server/dist/cli-service-output.js
+import { existsSync as existsSync4, mkdirSync as mkdirSync4, writeFileSync as writeFileSync3 } from "node:fs";
+import { resolve as resolve5 } from "node:path";
+var safeLifecycle = (paths) => {
+  try {
+    return observeRuntimeLifecycle(paths);
+  } catch {
+    return {
+      state: "unavailable",
+      epoch: "unavailable",
+      message: "Koed state could not be read."
+    };
+  }
+};
+var printJson = (stdout, value) => {
+  stdout.write(`${JSON.stringify(value, null, 2)}
+`);
+};
+var persistDoctorVerification = (paths, doctor) => {
+  mkdirSync4(resolve5(paths.lastVerificationPath, ".."), {
+    recursive: true,
+    mode: 448
+  });
+  writeFileSync3(paths.lastVerificationPath, `${JSON.stringify({
+    ok: doctor.ok,
+    checkedAt: doctor.generatedAt,
+    message: doctor.summary
+  }, null, 2)}
+`, { mode: 384 });
+};
+var checkCoreSetupNeeded = (paths) => {
+  if (!existsSync4(paths.localAppCredentialPath)) {
+    return `Core setup is required. Run:
+
+  koed setup core
+
+This will provision your local API Token and prepare Koed services.`;
+  }
+  return null;
+};
+var getNoAgentsWarning = (status) => {
+  const anyConfigured = status.codex?.configured || status.claudeCode?.configured || status.pi?.configured;
+  if (!anyConfigured) {
+    return "No AI Clients configured. Run: koed setup codex, setup claude, or setup pi";
+  }
+  return null;
+};
+
+export {
+  deviceRequestCommand,
+  createCliServiceContext,
+  safeLifecycle,
+  printJson,
+  persistDoctorVerification,
+  checkCoreSetupNeeded,
+  getNoAgentsWarning
+};