@mean-weasel/lineage 0.1.11 → 0.1.12

package/dist/cli/lineage.js

@@ -1,19 +1,19 @@
 #!/usr/bin/env node
 
 // src/cli/lineageCli.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "node:fs";
-import { homedir, platform } from "node:os";
-import { dirname as dirname3, join as join7, resolve as resolve5 } from "node:path";
+import { existsSync as existsSync11, mkdirSync as mkdirSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "node:fs";
+import { homedir as homedir2, platform as platform2 } from "node:os";
+import { dirname as dirname5, join as join10, resolve as resolve8 } from "node:path";
 import { spawn } from "node:child_process";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/server/agentClaims.ts
-import { createHash as createHash2, randomBytes, timingSafeEqual } from "node:crypto";
+import { createHash as createHash3, randomBytes, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
 
 // src/server/assetLineageDb.ts
-import { createRequire } from "node:module";
-import { mkdirSync as mkdirSync3 } from "node:fs";
-import { join as join4 } from "node:path";
+import { createRequire as createRequire2 } from "node:module";
+import { existsSync as existsSync6, mkdirSync as mkdirSync5 } from "node:fs";
+import { join as join6, resolve as resolve5 } from "node:path";
 
 // src/server/assetCore.ts
 import { existsSync as existsSync3, mkdirSync as mkdirSync2, readdirSync as readdirSync2, readFileSync as readFileSync2, unlinkSync, writeFileSync } from "node:fs";
@@ -587,20 +587,580 @@ function validateProject(project = defaultProject) {
   return { project: catalog.project, product: catalog.product, catalogPath: resolvedCatalogPath(project), default_bucket: catalog.default_bucket, default_region: catalog.default_region, asset_count: catalog.assets.length };
 }
 
-// src/server/assetLineageDb.ts
+// src/server/lineageProfiles.ts
+import { createRequire } from "node:module";
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync3, statSync as statSync3 } from "node:fs";
+import { homedir, platform } from "node:os";
+import { dirname as dirname3, isAbsolute, join as join4, resolve as resolve3 } from "node:path";
+
+// src/shared/lineageProfileTypes.ts
+var lineageProfileSchemaVersion = "lineage.profile.v1";
+var lineageProfileDoctorSchemaVersion = "lineage.profile_doctor.v1";
+
+// src/server/lineageProfiles.ts
 var require2 = createRequire(import.meta.url);
+var profileIdPattern = /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/;
+function lineageDataRoot() {
+  if (process.env.LINEAGE_HOME) return resolve3(process.env.LINEAGE_HOME);
+  if (platform() === "darwin") return join4(homedir(), "Library", "Application Support", "Lineage");
+  if (platform() === "win32") return join4(process.env.APPDATA || join4(homedir(), "AppData", "Roaming"), "Lineage");
+  return join4(process.env.XDG_DATA_HOME || join4(homedir(), ".local", "share"), "lineage");
+}
+function lineageProfileRoot() {
+  return resolve3(process.env.LINEAGE_PROFILE_ROOT || join4(lineageDataRoot(), "profiles"));
+}
+function environmentChannel(environment) {
+  if (environment === "production") return "stable";
+  if (environment === "preview") return "preview";
+  return "dev";
+}
+function channelEnvironment(channel) {
+  if (channel === "stable") return "production";
+  if (channel === "preview") return "preview";
+  return "development";
+}
+function profileManifestPath(selector) {
+  const value = selector.trim();
+  if (!value) throw new Error("Profile selector must not be empty");
+  const looksLikePath = isAbsolute(value) || value.includes("/") || value.includes("\\") || value.endsWith(".json");
+  if (looksLikePath) return { manifestPath: resolve3(value) };
+  if (!profileIdPattern.test(value)) throw new Error(`Invalid profile ID: ${value}`);
+  return { manifestPath: join4(lineageProfileRoot(), value, "profile.json"), namedProfileId: value };
+}
+function requiredString(record, key) {
+  const value = record[key];
+  if (typeof value !== "string" || !value.trim()) throw new Error(`Profile manifest requires a non-empty ${key}`);
+  return value.trim();
+}
+function optionalString(record, key) {
+  const value = record[key];
+  if (value === void 0) return void 0;
+  if (typeof value !== "string" || !value.trim()) throw new Error(`Profile manifest ${key} must be a non-empty string`);
+  return value.trim();
+}
+function validateEnvironment(value) {
+  if (value === "production" || value === "preview" || value === "development") return value;
+  throw new Error(`Invalid profile environment: ${value}`);
+}
+function validateChannel(value) {
+  if (value === void 0) return void 0;
+  if (value === "stable" || value === "preview" || value === "dev") return value;
+  throw new Error(`Invalid expected runtime channel: ${String(value)}`);
+}
+function resolveManifestPath(manifestPath, value) {
+  return resolve3(dirname3(manifestPath), value);
+}
+function validateServiceOrigin(value) {
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    throw new Error(`Invalid profile service_origin: ${value}`);
+  }
+  if (parsed.protocol !== "http:") throw new Error("Profile service_origin must use http for the local Lineage service");
+  if (!parsed.port) throw new Error("Profile service_origin must include an explicit port");
+  if (parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash) {
+    throw new Error("Profile service_origin must contain only scheme, host, and port");
+  }
+  const hostname = parsed.hostname.replace(/^\[|\]$/g, "").toLowerCase();
+  const isLocal = hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "::1" || /^127(?:\.\d{1,3}){3}$/.test(hostname);
+  if (!isLocal) throw new Error("Profile service_origin must use a loopback or localhost host");
+  return parsed.origin;
+}
+function resolveLineageProfile(selector) {
+  const { manifestPath, namedProfileId } = profileManifestPath(selector);
+  if (!existsSync4(manifestPath)) throw new Error(`Profile manifest does not exist: ${manifestPath}`);
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync3(manifestPath, "utf8"));
+  } catch (error) {
+    throw new Error(`Could not parse profile manifest ${manifestPath}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+  }
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) throw new Error("Profile manifest must be a JSON object");
+  const record = raw;
+  const schemaVersion = requiredString(record, "schema_version");
+  if (schemaVersion !== lineageProfileSchemaVersion) throw new Error(`Unsupported profile schema_version: ${schemaVersion}`);
+  const profileId = requiredString(record, "profile_id");
+  if (!profileIdPattern.test(profileId)) throw new Error(`Invalid profile ID: ${profileId}`);
+  if (namedProfileId && namedProfileId !== profileId) {
+    throw new Error(`Named profile ${namedProfileId} does not match immutable manifest profile_id ${profileId}`);
+  }
+  const expectedRaw = record.expected_runtime;
+  if (expectedRaw !== void 0 && (!expectedRaw || typeof expectedRaw !== "object" || Array.isArray(expectedRaw))) {
+    throw new Error("Profile expected_runtime must be an object");
+  }
+  const expected = expectedRaw;
+  const expectedGitSha = expected ? optionalString(expected, "git_sha") : void 0;
+  const expectedVersion = expected ? optionalString(expected, "version") : void 0;
+  const migrationsRaw = record.required_schema_migrations;
+  if (migrationsRaw !== void 0 && (!Array.isArray(migrationsRaw) || migrationsRaw.some((value) => typeof value !== "string" || !value.trim()))) {
+    throw new Error("Profile required_schema_migrations must be an array of non-empty strings");
+  }
+  const environment = validateEnvironment(requiredString(record, "environment"));
+  const expectedChannel = validateChannel(expected?.channel);
+  if (expectedChannel && expectedChannel !== environmentChannel(environment)) {
+    throw new Error(`Profile environment ${environment} conflicts with expected runtime channel ${expectedChannel}`);
+  }
+  const manifest = {
+    asset_root: resolveManifestPath(manifestPath, requiredString(record, "asset_root")),
+    database_path: resolveManifestPath(manifestPath, requiredString(record, "database_path")),
+    environment,
+    ...expected ? {
+      expected_runtime: {
+        ...expectedChannel ? { channel: expectedChannel } : {},
+        ...expectedGitSha ? { git_sha: expectedGitSha } : {},
+        ...expectedVersion ? { version: expectedVersion } : {}
+      }
+    } : {},
+    profile_id: profileId,
+    ...migrationsRaw ? { required_schema_migrations: migrationsRaw.map((value) => value.trim()) } : {},
+    schema_version: lineageProfileSchemaVersion,
+    service_origin: validateServiceOrigin(requiredString(record, "service_origin"))
+  };
+  return { ...manifest, manifest_path: manifestPath };
+}
+function bindLineageProfileDatabase(profile, confirmWrite) {
+  const result = {
+    database_path: profile.database_path,
+    environment: profile.environment,
+    ok: true,
+    profile_id: profile.profile_id,
+    schema_version: "lineage.profile_bind.v1"
+  };
+  if (!confirmWrite) return { ...result, dryRun: true };
+  mkdirSync3(dirname3(profile.database_path), { recursive: true });
+  const { DatabaseSync } = require2("node:sqlite");
+  const database = new DatabaseSync(profile.database_path);
+  try {
+    database.exec("BEGIN IMMEDIATE");
+    try {
+      database.exec(`
+        create table if not exists lineage_profile_identity (
+          profile_id text primary key,
+          environment text not null,
+          bound_at text not null
+        )
+      `);
+      const rows = database.prepare("select profile_id, environment, bound_at from lineage_profile_identity").all();
+      if (rows.length > 0) {
+        if (rows.length !== 1 || rows[0].profile_id !== profile.profile_id || rows[0].environment !== profile.environment) {
+          throw new Error(`Database ${profile.database_path} is already bound to a different Lineage profile identity`);
+        }
+        database.exec("COMMIT");
+        return { ...result, already_bound: true, bound_at: rows[0].bound_at };
+      }
+      const boundAt = (/* @__PURE__ */ new Date()).toISOString();
+      database.prepare("insert into lineage_profile_identity (profile_id, environment, bound_at) values (?, ?, ?)").run(profile.profile_id, profile.environment, boundAt);
+      database.exec("COMMIT");
+      return { ...result, bound_at: boundAt };
+    } catch (error) {
+      database.exec("ROLLBACK");
+      throw error;
+    }
+  } finally {
+    database.close();
+  }
+}
+function assertProfileChannel(profile, channel) {
+  const requiredChannel = environmentChannel(profile.environment);
+  if (channel === requiredChannel) return;
+  if (profile.environment === "production") {
+    throw new Error(`Refusing to open production profile ${profile.profile_id} from ${channel} code; use the stable channel`);
+  }
+  throw new Error(`Profile ${profile.profile_id} requires the ${requiredChannel} channel, not ${channel}`);
+}
+function tableExists(database, table) {
+  return Boolean(database.prepare("select name from sqlite_master where type = 'table' and name = ?").get(table));
+}
+function gitShasMatch(expected, actual) {
+  if (!actual) return false;
+  const normalizedExpected = expected.toLowerCase();
+  const normalizedActual = actual.toLowerCase();
+  const shorterLength = Math.min(normalizedExpected.length, normalizedActual.length);
+  return shorterLength >= 12 && normalizedExpected.slice(0, shorterLength) === normalizedActual.slice(0, shorterLength);
+}
+function inspectDatabase(profile) {
+  const result = {
+    exists: existsSync4(profile.database_path),
+    migration_keys: [],
+    path: profile.database_path
+  };
+  if (!result.exists) return result;
+  try {
+    const { DatabaseSync } = require2("node:sqlite");
+    const database = new DatabaseSync(profile.database_path, { readOnly: true });
+    try {
+      if (tableExists(database, "lineage_profile_identity")) {
+        const rows = database.prepare("select profile_id, environment, bound_at from lineage_profile_identity").all();
+        if (rows.length === 1) {
+          const identity = {
+            bound_at: typeof rows[0].bound_at === "string" ? rows[0].bound_at : void 0,
+            environment: String(rows[0].environment),
+            profile_id: String(rows[0].profile_id)
+          };
+          result.identity = identity;
+        } else {
+          result.error = `Expected exactly one lineage_profile_identity row, found ${rows.length}`;
+        }
+      }
+      if (tableExists(database, "lineage_schema_migrations")) {
+        result.migration_keys = database.prepare("select key from lineage_schema_migrations order by key").all().map((row) => row.key);
+      }
+    } finally {
+      database.close();
+    }
+  } catch (error) {
+    result.error = error instanceof Error ? error.message : String(error);
+  }
+  return result;
+}
+function doctorLineageProfile(selector, runtime) {
+  const checks = [];
+  const result = {
+    checks,
+    ok: false,
+    runtime: { channel: runtime.channel, git_sha: runtime.gitSha, version: runtime.version },
+    schema_version: lineageProfileDoctorSchemaVersion
+  };
+  let profile;
+  try {
+    profile = resolveLineageProfile(selector);
+    result.profile = profile;
+    result.manifest_path = profile.manifest_path;
+    checks.push({ id: "manifest", message: `Loaded ${profile.profile_id}`, status: "pass" });
+  } catch (error) {
+    checks.push({ id: "manifest", message: error instanceof Error ? error.message : String(error), status: "fail" });
+    return result;
+  }
+  try {
+    assertProfileChannel(profile, runtime.channel);
+    checks.push({ id: "runtime_channel", message: `${runtime.channel} code matches ${profile.environment}`, status: "pass" });
+  } catch (error) {
+    checks.push({ id: "runtime_channel", message: error instanceof Error ? error.message : String(error), status: "fail" });
+  }
+  if (profile.expected_runtime?.version && profile.expected_runtime.version !== runtime.version) {
+    checks.push({ id: "runtime_version", message: `Expected version ${profile.expected_runtime.version}, found ${runtime.version}`, status: "fail" });
+  } else {
+    checks.push({ id: "runtime_version", message: `Runtime version ${runtime.version}`, status: "pass" });
+  }
+  if (profile.expected_runtime?.git_sha && !gitShasMatch(profile.expected_runtime.git_sha, runtime.gitSha)) {
+    checks.push({ id: "runtime_git_sha", message: `Expected Git SHA ${profile.expected_runtime.git_sha}, found ${runtime.gitSha || "unavailable"}`, status: "fail" });
+  } else if (profile.expected_runtime?.git_sha) {
+    checks.push({ id: "runtime_git_sha", message: `Git SHA ${runtime.gitSha}`, status: "pass" });
+  }
+  const assetExists = existsSync4(profile.asset_root);
+  const assetIsDirectory = assetExists && statSync3(profile.asset_root).isDirectory();
+  result.asset_root = { exists: assetExists, is_directory: assetIsDirectory, path: profile.asset_root };
+  checks.push({
+    id: "asset_root",
+    message: assetIsDirectory ? `Asset root exists: ${profile.asset_root}` : `Asset root is missing or not a directory: ${profile.asset_root}`,
+    status: assetIsDirectory ? "pass" : "fail"
+  });
+  const database = inspectDatabase(profile);
+  result.database = database;
+  checks.push({
+    id: "database_exists",
+    message: database.exists ? `Database exists: ${profile.database_path}` : `Database does not exist: ${profile.database_path}`,
+    status: database.exists ? "pass" : "fail"
+  });
+  if (database.error) checks.push({ id: "database_read", message: database.error, status: "fail" });
+  if (!database.identity) {
+    checks.push({ id: "database_identity", message: "Database is not bound to a Lineage profile", status: "fail" });
+  } else if (database.identity.profile_id !== profile.profile_id || database.identity.environment !== profile.environment) {
+    checks.push({
+      id: "database_identity",
+      message: `Database identity ${database.identity.profile_id}/${database.identity.environment} does not match ${profile.profile_id}/${profile.environment}`,
+      status: "fail"
+    });
+  } else {
+    checks.push({ id: "database_identity", message: `Database is bound to ${profile.profile_id}`, status: "pass" });
+  }
+  const missingMigrations = (profile.required_schema_migrations || []).filter((key) => !database.migration_keys.includes(key));
+  checks.push({
+    id: "database_schema",
+    message: missingMigrations.length ? `Missing required schema migrations: ${missingMigrations.join(", ")}` : `${database.migration_keys.length} schema migration marker(s) available`,
+    status: missingMigrations.length ? "fail" : "pass"
+  });
+  result.ok = checks.every((check) => check.status !== "fail");
+  return result;
+}
+function runtimeProfileIdentity(channel) {
+  const selector = process.env.LINEAGE_PROFILE;
+  const id = process.env.LINEAGE_PROFILE_ID;
+  const environment = process.env.LINEAGE_PROFILE_ENVIRONMENT;
+  if (selector && id && environment) {
+    return {
+      bound: true,
+      environment,
+      id,
+      manifest_path: process.env.LINEAGE_PROFILE_MANIFEST,
+      service_origin: process.env.LINEAGE_PROFILE_SERVICE_ORIGIN
+    };
+  }
+  return {
+    bound: false,
+    environment: channelEnvironment(channel),
+    id: "legacy-unbound",
+    warning: id || environment || process.env.LINEAGE_PROFILE_MANIFEST ? "Invalid unbound runtime: derived profile identity was supplied without a resolved LINEAGE_PROFILE selector." : "Legacy unbound runtime: database and asset paths are not protected by a named profile."
+  };
+}
+function assertUnselectedDatabaseIsUnbound(runtime) {
+  if (runtime.database.exists && runtime.database.error) {
+    throw new Error(
+      `Database ${runtime.database.path} identity could not be verified: ${runtime.database.error}; refusing unselected access`
+    );
+  }
+  if (runtime.schema.profile_identity_rows !== void 0 && runtime.schema.profile_identity_rows !== 1) {
+    throw new Error(
+      `Database ${runtime.database.path} has invalid Lineage profile identity row count ${runtime.schema.profile_identity_rows}; refusing unselected access`
+    );
+  }
+  if (!runtime.schema.profile_id) return;
+  const environment = runtime.schema.profile_environment || "unknown";
+  throw new Error(
+    `Database ${runtime.database.path} is bound to Lineage profile ${runtime.schema.profile_id}/${environment}; select that profile with --profile`
+  );
+}
+
+// src/server/profileWriterLease.ts
+import { createHash as createHash2, randomUUID, timingSafeEqual } from "node:crypto";
+import { existsSync as existsSync5, lstatSync, mkdirSync as mkdirSync4, readFileSync as readFileSync4, realpathSync, renameSync, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { basename as basename3, dirname as dirname4, join as join5, resolve as resolve4 } from "node:path";
+var writerLeaseSchemaVersion = "lineage.profile_writer_lease.v1";
+var ownerFileName = "owner.json";
+var ProfileWriterLeaseConflictError = class extends Error {
+  constructor(message, owner) {
+    super(message);
+    this.owner = owner;
+    this.name = "ProfileWriterLeaseConflictError";
+  }
+  owner;
+};
+function canonicalDatabasePath(databasePath) {
+  const resolved = resolve4(databasePath);
+  const missingSegments = [];
+  let candidate = resolved;
+  while (!existsSync5(candidate)) {
+    const parent = dirname4(candidate);
+    if (parent === candidate) return resolved;
+    missingSegments.unshift(basename3(candidate));
+    candidate = parent;
+  }
+  try {
+    return join5(realpathSync(candidate), ...missingSegments);
+  } catch {
+    return resolved;
+  }
+}
+function profileWriterLockPath(profile) {
+  return `${canonicalDatabasePath(profile.database_path)}.writer.lock`;
+}
+function ownerPath(lockPath) {
+  return join5(lockPath, ownerFileName);
+}
+function errorCode(error) {
+  return error && typeof error === "object" && "code" in error ? String(error.code) : void 0;
+}
+function readOwner(lockPath) {
+  const stat = lstatSync(lockPath);
+  if (!stat.isDirectory() || stat.isSymbolicLink()) {
+    throw new Error(`Writer lease path is not a safe directory: ${lockPath}; manual inspection is required`);
+  }
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync4(ownerPath(lockPath), "utf8"));
+  } catch (error) {
+    throw new Error(`Writer lease metadata is unreadable at ${lockPath}; refusing automatic recovery`, { cause: error });
+  }
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    throw new Error(`Writer lease metadata is invalid at ${lockPath}; refusing automatic recovery`);
+  }
+  const owner = raw;
+  if (owner.schema_version !== writerLeaseSchemaVersion || typeof owner.profile_id !== "string" || owner.environment !== "production" && owner.environment !== "preview" && owner.environment !== "development" || owner.role !== "service" && owner.role !== "cli" || !Number.isSafeInteger(owner.pid) || Number(owner.pid) <= 0 || typeof owner.acquired_at !== "string" || Number.isNaN(Date.parse(owner.acquired_at)) || owner.role === "service" && (typeof owner.service_origin !== "string" || !owner.service_origin) || owner.role === "cli" && owner.service_origin !== void 0 || typeof owner.token !== "string" || owner.token.length < 16) {
+    throw new Error(`Writer lease metadata is invalid at ${lockPath}; refusing automatic recovery`);
+  }
+  return owner;
+}
+function processIsAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    if (errorCode(error) === "ESRCH") return false;
+    return true;
+  }
+}
+function createLeaseDirectory(lockPath, owner) {
+  mkdirSync4(lockPath, { mode: 448 });
+  try {
+    writeFileSync2(ownerPath(lockPath), `${JSON.stringify(owner, null, 2)}
+`, { encoding: "utf8", flag: "wx", mode: 384 });
+  } catch (error) {
+    rmSync(lockPath, { force: true, recursive: true });
+    throw error;
+  }
+}
+function reclaimDeadOwner(lockPath, owner) {
+  if (processIsAlive(owner.pid)) {
+    const { token: _token, ...publicOwner } = owner;
+    throw new ProfileWriterLeaseConflictError(
+      `Lineage profile ${owner.profile_id} already has an active ${owner.role} writer (pid ${owner.pid}); use that managed service or stop it before starting another writer`,
+      publicOwner
+    );
+  }
+  const tokenFence = createHash2("sha256").update(owner.token).digest("hex").slice(0, 24);
+  const tombstone = `${lockPath}.stale-${owner.pid}-${tokenFence}`;
+  try {
+    renameSync(lockPath, tombstone);
+  } catch (error) {
+    if (errorCode(error) === "ENOENT" || errorCode(error) === "EEXIST" || errorCode(error) === "ENOTEMPTY") return;
+    throw error;
+  }
+}
+function acquireProfileWriterLease(profile, channel, role = "service") {
+  assertProfileChannel(profile, channel);
+  const lockPath = profileWriterLockPath(profile);
+  const owner = {
+    acquired_at: (/* @__PURE__ */ new Date()).toISOString(),
+    environment: profile.environment,
+    pid: process.pid,
+    profile_id: profile.profile_id,
+    role,
+    schema_version: writerLeaseSchemaVersion,
+    ...role === "service" ? { service_origin: profile.service_origin } : {},
+    token: randomUUID()
+  };
+  for (let attempt = 0; attempt < 4; attempt += 1) {
+    try {
+      createLeaseDirectory(lockPath, owner);
+      process.env.LINEAGE_WRITER_LEASE_TOKEN = owner.token;
+      process.env.LINEAGE_WRITER_LOCK_PATH = lockPath;
+      const { token: _token, ...publicOwner } = owner;
+      let released = false;
+      return {
+        authenticate: (candidate) => {
+          if (!candidate) return false;
+          const expected = Buffer.from(owner.token);
+          const actual = Buffer.from(candidate);
+          return actual.length === expected.length && timingSafeEqual(actual, expected);
+        },
+        lock_path: lockPath,
+        owner: publicOwner,
+        release: () => {
+          if (released) return;
+          released = true;
+          try {
+            const current = readOwner(lockPath);
+            if (current.token === owner.token && current.pid === owner.pid) rmSync(lockPath, { force: true, recursive: true });
+          } catch {
+          }
+          if (process.env.LINEAGE_WRITER_LEASE_TOKEN === owner.token) delete process.env.LINEAGE_WRITER_LEASE_TOKEN;
+          if (process.env.LINEAGE_WRITER_LOCK_PATH === lockPath) delete process.env.LINEAGE_WRITER_LOCK_PATH;
+        }
+      };
+    } catch (error) {
+      if (errorCode(error) !== "EEXIST") throw error;
+      let existing;
+      try {
+        existing = readOwner(lockPath);
+      } catch (readError) {
+        if (errorCode(readError) === "ENOENT") continue;
+        throw readError;
+      }
+      if (existing.profile_id !== profile.profile_id || existing.environment !== profile.environment) {
+        throw new Error(`Writer lease identity at ${lockPath} does not match ${profile.profile_id}/${profile.environment}; manual inspection is required`, { cause: error });
+      }
+      reclaimDeadOwner(lockPath, existing);
+    }
+  }
+  throw new Error(`Could not acquire writer lease for Lineage profile ${profile.profile_id}; another writer is racing for ownership`);
+}
+function assertProfileWriterLeaseHeld() {
+  if (!process.env.LINEAGE_PROFILE) return;
+  const profileId = process.env.LINEAGE_PROFILE_ID;
+  const environment = process.env.LINEAGE_PROFILE_ENVIRONMENT;
+  const manifestPath = process.env.LINEAGE_PROFILE_MANIFEST;
+  const databasePath = process.env.LINEAGE_DB;
+  const lockPath = process.env.LINEAGE_WRITER_LOCK_PATH;
+  const token = process.env.LINEAGE_WRITER_LEASE_TOKEN;
+  if (!profileId || !environment || !manifestPath || !databasePath || !lockPath || !token) {
+    throw new Error("Named Lineage profiles may write only through a process holding the profile writer lease");
+  }
+  const expectedLockPath = `${canonicalDatabasePath(databasePath)}.writer.lock`;
+  if (resolve4(lockPath) !== expectedLockPath) throw new Error("Profile writer lease path does not match the selected profile database");
+  const owner = readOwner(lockPath);
+  if (owner.pid !== process.pid || owner.token !== token || owner.profile_id !== profileId || owner.environment !== environment) {
+    throw new Error("Current process does not own the selected Lineage profile writer lease");
+  }
+}
+function getProfileWriterDelegation(profile) {
+  const lockPath = profileWriterLockPath(profile);
+  if (!existsSync5(lockPath)) {
+    throw new Error(
+      `Lineage profile ${profile.profile_id} mutating commands require its managed service at ${profile.service_origin}; no active service writer lease was found`
+    );
+  }
+  const owner = readOwner(lockPath);
+  if (owner.profile_id !== profile.profile_id || owner.environment !== profile.environment) {
+    throw new Error(`Writer lease identity at ${lockPath} does not match ${profile.profile_id}/${profile.environment}; refusing delegation`);
+  }
+  if (owner.role !== "service" || owner.service_origin !== profile.service_origin) {
+    throw new Error(`Writer lease for Lineage profile ${profile.profile_id} is not the configured managed service at ${profile.service_origin}`);
+  }
+  if (!processIsAlive(owner.pid)) {
+    throw new Error(`Managed service writer lease for Lineage profile ${profile.profile_id} is stale; refusing delegation`);
+  }
+  const { token, ...publicOwner } = owner;
+  return { owner: publicOwner, service_origin: owner.service_origin, token };
+}
+
+// src/server/assetLineageDb.ts
+var require3 = createRequire2(import.meta.url);
 function nowIso() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
 function lineageDbPath() {
-  return process.env.LINEAGE_DB || join4(packageRoot, ".lineage", "asset-lineage.sqlite");
+  return process.env.LINEAGE_DB || join6(packageRoot, ".lineage", "asset-lineage.sqlite");
+}
+function assertOpenedProfileIdentity(database, databasePath) {
+  const selector = process.env.LINEAGE_PROFILE;
+  if (!selector) return;
+  const profile = resolveLineageProfile(selector);
+  if (resolve5(databasePath) !== profile.database_path) {
+    throw new Error(`Profile ${profile.profile_id} requires database ${profile.database_path}, not ${databasePath}`);
+  }
+  const table = database.prepare("select 1 from sqlite_master where type = 'table' and name = 'lineage_profile_identity'").get();
+  if (!table) throw new Error(`Profile database ${databasePath} is not bound to a Lineage profile identity`);
+  const rows = database.prepare("select profile_id, environment from lineage_profile_identity").all();
+  if (rows.length !== 1) {
+    throw new Error(`Profile database ${databasePath} has invalid Lineage profile identity row count ${rows.length}`);
+  }
+  if (rows[0].profile_id !== profile.profile_id || rows[0].environment !== profile.environment) {
+    throw new Error(
+      `Profile database ${databasePath} is bound to ${rows[0].profile_id}/${rows[0].environment}, not ${profile.profile_id}/${profile.environment}`
+    );
+  }
 }
 function lineageDb() {
-  mkdirSync3(join4(lineageDbPath(), ".."), { recursive: true });
-  const { DatabaseSync } = require2("node:sqlite");
-  const database = new DatabaseSync(lineageDbPath());
-  database.exec("PRAGMA foreign_keys = ON");
-  database.exec("PRAGMA busy_timeout = 5000");
+  const readOnly = process.env.LINEAGE_DB_ACCESS === "read-only";
+  const databasePath = lineageDbPath();
+  if (!readOnly) assertProfileWriterLeaseHeld();
+  if (process.env.LINEAGE_PROFILE && !existsSync6(databasePath)) {
+    throw new Error(`Profile database does not exist: ${databasePath}; bind the profile before opening it`);
+  }
+  if (!readOnly) mkdirSync5(join6(databasePath, ".."), { recursive: true });
+  const { DatabaseSync } = require3("node:sqlite");
+  const database = readOnly ? new DatabaseSync(databasePath, { readOnly: true }) : new DatabaseSync(databasePath);
+  try {
+    assertOpenedProfileIdentity(database, databasePath);
+    database.exec("PRAGMA foreign_keys = ON");
+    database.exec("PRAGMA busy_timeout = 5000");
+    if (readOnly) return database;
+  } catch (error) {
+    database.close();
+    throw error;
+  }
+  database.exec("PRAGMA journal_mode = WAL");
   database.exec(`
     create table if not exists projects (
       id text primary key,
@@ -1316,12 +1876,12 @@ function randomId(prefix) {
   return `${prefix}_${Date.now().toString(36)}_${randomBytes(6).toString("base64url").toLowerCase()}`;
 }
 function tokenHash(token) {
-  return createHash2("sha256").update(token).digest("hex");
+  return createHash3("sha256").update(token).digest("hex");
 }
 function safeEqual(a, b) {
   const left = Buffer.from(a);
   const right = Buffer.from(b);
-  return left.length === right.length && timingSafeEqual(left, right);
+  return left.length === right.length && timingSafeEqual2(left, right);
 }
 function expiresAtFrom(timestamp, ttlSeconds) {
   return new Date(new Date(timestamp).getTime() + ttlSeconds * 1e3).toISOString();
@@ -1348,6 +1908,12 @@ function derivedState(row, now = /* @__PURE__ */ new Date()) {
 }
 function rowToClaim(row, now = /* @__PURE__ */ new Date()) {
   const heartbeatAt = String(row.heartbeat_at);
+  const persistedStatus = String(row.status);
+  const state = derivedState({
+    expires_at: String(row.expires_at),
+    heartbeat_at: heartbeatAt,
+    status: persistedStatus
+  }, now);
   return {
     id: String(row.id),
     project: String(row.project_id),
@@ -1359,7 +1925,7 @@ function rowToClaim(row, now = /* @__PURE__ */ new Date()) {
     agent_name: String(row.agent_name),
     agent_kind: String(row.agent_kind),
     thread_id: typeof row.thread_id === "string" ? row.thread_id : void 0,
-    status: String(row.status),
+    status: persistedStatus === "active" && state === "expired" ? "expired" : persistedStatus,
     created_at: String(row.created_at),
     heartbeat_at: heartbeatAt,
     expires_at: String(row.expires_at),
@@ -1369,11 +1935,7 @@ function rowToClaim(row, now = /* @__PURE__ */ new Date()) {
     override_reason: typeof row.override_reason === "string" ? row.override_reason : void 0,
     metadata: parseMetadata(row.metadata_json),
     heartbeat_age_seconds: Math.max(0, Math.floor((now.getTime() - new Date(heartbeatAt).getTime()) / 1e3)),
-    derived_state: derivedState({
-      expires_at: String(row.expires_at),
-      heartbeat_at: heartbeatAt,
-      status: String(row.status)
-    }, now)
+    derived_state: state
   };
 }
 function eventToRow(row) {
@@ -1515,7 +2077,7 @@ function createAgentClaim(fields) {
 function listAgentClaims(project) {
   const database = lineageDb();
   try {
-    expireActiveClaims(database);
+    if (process.env.LINEAGE_DB_ACCESS !== "read-only") expireActiveClaims(database);
     const rows = project ? database.prepare("select * from agent_claims where project_id = ? order by status, heartbeat_at desc").all(project) : database.prepare("select * from agent_claims order by project_id, status, heartbeat_at desc").all();
     return { ok: true, claims: rows.map((row) => rowToClaim(row)), fetchedAt: nowIso() };
   } finally {
@@ -1525,7 +2087,7 @@ function listAgentClaims(project) {
 function inspectAgentClaim(claimId, project) {
   const database = lineageDb();
   try {
-    expireActiveClaims(database);
+    if (process.env.LINEAGE_DB_ACCESS !== "read-only") expireActiveClaims(database);
     const claim = findClaimById(database, claimId, project);
     if (!claim) throw new AgentClaimError(`Unknown agent claim: ${claimId}`, 404, "claim_not_found");
     const events = database.prepare("select * from agent_claim_events where claim_id = ? order by created_at").all(claim.id);
@@ -1662,7 +2224,7 @@ function validateAgentClaimForWrite(fields) {
 }
 
 // src/server/assetLineage.ts
-import { join as join5 } from "node:path";
+import { join as join7 } from "node:path";
 
 // src/server/assetLineageSelection.ts
 function selectedRows(database, project, root) {
@@ -2213,9 +2775,18 @@ function knownRoots(database, project) {
       and parent_asset_id not in (select child_asset_id from asset_edges where project_id = ?)
     group by parent_asset_id
   `).all(project, project, project, project);
-  return rows.map((row) => ({ root_asset_id: row.root_asset_id, selected_at: row.selected_at || void 0 }));
+  const roots = /* @__PURE__ */ new Map();
+  for (const row of rows) {
+    const existing = roots.get(row.root_asset_id);
+    roots.set(row.root_asset_id, {
+      root_asset_id: row.root_asset_id,
+      selected_at: row.selected_at || existing?.selected_at
+    });
+  }
+  return [...roots.values()];
 }
 function seedLegacyWorkspaces(database, project) {
+  if (process.env.LINEAGE_DB_ACCESS === "read-only") return;
   ensureProject2(database, project);
   const timestamp = nowIso();
   const statement = database.prepare(`
@@ -2239,6 +2810,34 @@ function seedLegacyWorkspaces(database, project) {
     );
   }
 }
+function inferredLegacyWorkspaces(database, project) {
+  if (process.env.LINEAGE_DB_ACCESS !== "read-only") return [];
+  const persistedRoots = new Set(
+    database.prepare("select root_asset_id from lineage_workspaces where project_id = ?").all(project).map((row) => row.root_asset_id)
+  );
+  const asset = database.prepare("select id, title from assets where project_id = ? and id = ?");
+  return knownRoots(database, project).flatMap((root) => {
+    if (persistedRoots.has(root.root_asset_id)) return [];
+    const row = asset.get(project, root.root_asset_id);
+    if (!row) return [];
+    const timestamp = root.selected_at || nowIso();
+    return [{
+      active_at: root.selected_at,
+      created_at: timestamp,
+      created_by: "system",
+      id: lineageWorkspaceId(project, root.root_asset_id),
+      project,
+      root_asset_id: root.root_asset_id,
+      status: "active",
+      title: `${row.title} lineage`,
+      updated_at: timestamp
+    }];
+  });
+}
+function sortWorkspaces(workspaces) {
+  const statusRank = { active: 0, paused: 1, archived: 2 };
+  return workspaces.sort((left, right) => statusRank[left.status] - statusRank[right.status] || (right.active_at || "").localeCompare(left.active_at || "") || right.updated_at.localeCompare(left.updated_at) || left.title.localeCompare(right.title));
+}
 function listRows(database, project) {
   return database.prepare(`
     select * from lineage_workspaces
@@ -2250,23 +2849,15 @@ function listRows(database, project) {
       title
   `).all(project).map(rowToWorkspace);
 }
-function activeWorkspace(database, project) {
-  const row = database.prepare(`
-    select * from lineage_workspaces
-    where project_id = ? and status != 'archived'
-    order by active_at desc nulls last, updated_at desc
-    limit 1
-  `).get(project);
-  return row ? rowToWorkspace(row) : null;
-}
 function listLineageWorkspaces(project) {
   const database = lineageDb();
   try {
     seedLegacyWorkspaces(database, project);
+    const workspaces = sortWorkspaces([...listRows(database, project), ...inferredLegacyWorkspaces(database, project)]);
     return {
       project,
-      active_workspace: activeWorkspace(database, project),
-      workspaces: listRows(database, project),
+      active_workspace: workspaces.find((workspace) => workspace.status !== "archived") || null,
+      workspaces,
       fetchedAt: nowIso()
     };
   } finally {
@@ -2277,7 +2868,7 @@ function activeLineageWorkspaceRoot(project) {
   const database = lineageDb();
   try {
     seedLegacyWorkspaces(database, project);
-    return activeWorkspace(database, project)?.root_asset_id;
+    return sortWorkspaces([...listRows(database, project), ...inferredLegacyWorkspaces(database, project)]).find((workspace) => workspace.status !== "archived")?.root_asset_id;
   } finally {
     database.close();
   }
@@ -2336,7 +2927,7 @@ function upsertProject(database, project) {
     insert into projects (id, product, catalog_path, created_at, updated_at)
     values (?, ?, ?, ?, ?)
     on conflict(id) do update set product = excluded.product, updated_at = excluded.updated_at
-  `).run(project, project, join5(repoRoot, project, "assets", "catalog.json"), timestamp, timestamp);
+  `).run(project, project, join7(repoRoot, project, "assets", "catalog.json"), timestamp, timestamp);
 }
 function upsertAsset(database, project, asset) {
   const timestamp = nowIso();
@@ -2975,16 +3566,34 @@ function clearLineageRerollRequest(project, fields) {
   }
 }
 
-// src/server/assetLineageHandoff.ts
-var publicPackageCommand = "npx @mean-weasel/lineage";
+// src/server/lineageRuntimeCommand.ts
+import { existsSync as existsSync7 } from "node:fs";
+import { createRequire as createRequire3 } from "node:module";
+import { join as join8 } from "node:path";
+var require4 = createRequire3(import.meta.url);
+function lineagePublicPackageCommand() {
+  if (process.env.LINEAGE_CHANNEL === "dev") {
+    const sourceCli = join8(packageRoot, "src", "cli", "lineage-dev.ts");
+    const builtCli = join8(packageRoot, "dist", "cli", "lineage-dev.js");
+    return existsSync7(sourceCli) ? `${shellQuote(process.execPath)} --import ${shellQuote(require4.resolve("tsx"))} ${shellQuote(sourceCli)}` : `${shellQuote(process.execPath)} ${shellQuote(builtCli)}`;
+  }
+  if (process.env.LINEAGE_CHANNEL === "preview") return "LINEAGE_CHANNEL=preview npx --package @mean-weasel/lineage@next lineage-dev";
+  return "npx @mean-weasel/lineage";
+}
 function shellQuote(value) {
   return `'${value.replace(/'/g, "'\\''")}'`;
 }
+function lineageRuntimeSelector() {
+  const manifest = process.env.LINEAGE_PROFILE_MANIFEST?.trim();
+  return manifest ? `--profile ${shellQuote(manifest)}` : `--db ${shellQuote(lineageDbPath())}`;
+}
+
+// src/server/assetLineageHandoff.ts
 function lineageCommand(command, project, rootAssetId) {
-  return `${publicPackageCommand} ${command} --project ${shellQuote(project)} --root ${shellQuote(rootAssetId)} --db ${shellQuote(lineageDbPath())} --json`;
+  return `${lineagePublicPackageCommand()} ${command} --project ${shellQuote(project)} --root ${shellQuote(rootAssetId)} ${lineageRuntimeSelector()} --json`;
 }
 function linkChildCommand(project, rootAssetId) {
-  return `${publicPackageCommand} link-child --project ${shellQuote(project)} --root ${shellQuote(rootAssetId)} --child <asset-id> --confirm-write --db ${shellQuote(lineageDbPath())} --json`;
+  return `${lineagePublicPackageCommand()} link-child --project ${shellQuote(project)} --root ${shellQuote(rootAssetId)} --child <asset-id> --confirm-write ${lineageRuntimeSelector()} --json`;
 }
 function rerollImportGuidance(rootAssetId, targetAssetId) {
   return `Use lineage reroll plan --root ${rootAssetId} --target ${targetAssetId} and lineage reroll import instead.`;
@@ -3026,7 +3635,7 @@ function getLineageBrief(project, rootAssetId) {
     },
     handoff: {
       next_command: lineageCommand("next", project, next.root_asset_id),
-      inspect_command: asset ? `${publicPackageCommand} inspect --project ${shellQuote(project)} --asset-id ${shellQuote(asset.asset_id)} --db ${shellQuote(lineageDbPath())} --json` : void 0,
+      inspect_command: asset ? `${lineagePublicPackageCommand()} inspect --project ${shellQuote(project)} --asset-id ${shellQuote(asset.asset_id)} ${lineageRuntimeSelector()} --json` : void 0,
       link_child_command: asset ? linkChildCommand(project, next.root_asset_id) : void 0
     },
     fetchedAt: nowIso()
@@ -3078,9 +3687,9 @@ function linkSelectedLineageChild(project, fields) {
 }
 
 // src/server/generationReceipts.ts
-import { existsSync as existsSync4, realpathSync, statSync as statSync3 } from "node:fs";
-import { relative as relative2, resolve as resolve3 } from "node:path";
-import { randomUUID } from "node:crypto";
+import { existsSync as existsSync8, realpathSync as realpathSync2, statSync as statSync4 } from "node:fs";
+import { relative as relative2, resolve as resolve6 } from "node:path";
+import { randomUUID as randomUUID2 } from "node:crypto";
 var adapterVersion = "generation-receipts-v1";
 var provider = "codex-handoff";
 var GenerationReceiptError = class extends Error {
@@ -3091,7 +3700,7 @@ var GenerationReceiptError = class extends Error {
   status;
 };
 function jobId() {
-  return `gen-${Date.now().toString(36)}-${randomUUID().slice(0, 8)}`;
+  return `gen-${Date.now().toString(36)}-${randomUUID2().slice(0, 8)}`;
 }
 function quote(value) {
   return JSON.stringify(value);
@@ -3101,7 +3710,7 @@ function parseJson(value, fallback) {
   return JSON.parse(value);
 }
 function buildRerollHandoff(project, id, prompt, rootAssetId, target, request) {
-  const importCommand = `npx lineage reroll import --project ${quote(project)} --job-id ${quote(id)} --file <.asset-scratch-file> --confirm-write --json`;
+  const importCommand = `${lineagePublicPackageCommand()} reroll import --project ${quote(project)} --job-id ${quote(id)} --file <.asset-scratch-file> --confirm-write ${lineageRuntimeSelector()} --json`;
   return {
     schema_version: "lineage.generation_handoff.v1",
     provider,
@@ -3291,14 +3900,14 @@ function isPathInside(child, parent) {
   return Boolean(rel) && !rel.startsWith("..") && !rel.startsWith("/");
 }
 function resolveScratchFile(file) {
-  const scratchRoot = resolve3(repoRoot, ".asset-scratch");
-  const candidate = file.startsWith(".asset-scratch/") || resolve3(file).startsWith(scratchRoot) ? resolve3(repoRoot, file) : resolve3(scratchRoot, file);
+  const scratchRoot = resolve6(repoRoot, ".asset-scratch");
+  const candidate = file.startsWith(".asset-scratch/") || resolve6(file).startsWith(scratchRoot) ? resolve6(repoRoot, file) : resolve6(scratchRoot, file);
   if (!isPathInside(candidate, scratchRoot)) throw new GenerationReceiptError(`Import file must be under .asset-scratch: ${file}`);
-  if (!existsSync4(candidate)) throw new GenerationReceiptError(`Missing import file: ${file}`, 404);
-  const realScratchRoot = realpathSync(scratchRoot);
-  const realCandidate = realpathSync(candidate);
+  if (!existsSync8(candidate)) throw new GenerationReceiptError(`Missing import file: ${file}`, 404);
+  const realScratchRoot = realpathSync2(scratchRoot);
+  const realCandidate = realpathSync2(candidate);
   if (!isPathInside(realCandidate, realScratchRoot)) throw new GenerationReceiptError(`Import file must be under .asset-scratch: ${file}`);
-  const stats = statSync3(candidate);
+  const stats = statSync4(candidate);
   if (!stats.isFile()) throw new GenerationReceiptError(`Import path is not a file: ${file}`);
   const checksum = fileSha256(candidate);
   return {
@@ -3378,17 +3987,19 @@ function importImageRerollOutput(project = defaultProject, fields) {
 }
 
 // src/server/lineageSelectionPacket.ts
-import { createHash as createHash3 } from "node:crypto";
-import { existsSync as existsSync5, statSync as statSync4 } from "node:fs";
-import { isAbsolute, resolve as resolve4 } from "node:path";
+import { createHash as createHash4 } from "node:crypto";
+import { existsSync as existsSync9, statSync as statSync5 } from "node:fs";
+import { isAbsolute as isAbsolute2, resolve as resolve7 } from "node:path";
 var LineageSelectionPacketError = class extends Error {
-  constructor(message, warnings = [], errors = []) {
+  constructor(message, warnings = [], errors = [], diagnostics = []) {
     super(message);
     this.warnings = warnings;
     this.errors = errors;
+    this.diagnostics = diagnostics;
   }
   warnings;
   errors;
+  diagnostics;
 };
 function listAllAssets(project) {
   const pageSize = 100;
@@ -3424,15 +4035,15 @@ function resolveWorkspace(project, options) {
 }
 function resolveLocalReference(reference) {
   if (!reference) return void 0;
-  if (isAbsolute(reference)) return reference;
-  const repoRelative = resolve4(repoRoot, reference);
-  if (existsSync5(repoRelative)) return repoRelative;
-  return resolve4(repoRoot, ".asset-scratch", reference);
+  if (isAbsolute2(reference)) return reference;
+  const repoRelative = resolve7(repoRoot, reference);
+  if (existsSync9(repoRelative)) return repoRelative;
+  return resolve7(repoRoot, ".asset-scratch", reference);
 }
 function fileSize(path) {
-  if (!path || !existsSync5(path)) return void 0;
+  if (!path || !existsSync9(path)) return void 0;
   try {
-    return statSync4(path).size;
+    return statSync5(path).size;
   } catch {
     return void 0;
   }
@@ -3458,7 +4069,7 @@ function currentAttemptFor(node) {
 function assetForNode(node, catalogAsset, warnings) {
   const localReference = catalogAsset?.local?.absolute_path || node.current_attempt?.file_path || node.local_path || catalogAsset?.local?.relative_path;
   const absolutePath = catalogAsset?.local?.absolute_path || resolveLocalReference(localReference);
-  const localExists = absolutePath ? existsSync5(absolutePath) : false;
+  const localExists = absolutePath ? existsSync9(absolutePath) : false;
   const hasLocalClaim = Boolean(absolutePath || node.local_path || catalogAsset?.local?.relative_path);
   const s3Key = catalogAsset?.s3?.key || node.s3_key;
   const hasS3 = Boolean(s3Key);
@@ -3503,10 +4114,192 @@ function assetForNode(node, catalogAsset, warnings) {
   };
 }
 function packetId(packetIdentity) {
-  const digest = createHash3("sha256").update(JSON.stringify(packetIdentity)).digest("hex").slice(0, 24);
+  const digest = createHash4("sha256").update(JSON.stringify(packetIdentity)).digest("hex").slice(0, 24);
   return `lineage_packet_${digest}`;
 }
-function getLineageSelectionPacket(project, options = {}) {
+var SHA256_PATTERN = /^[a-f0-9]{64}$/;
+function canonicalValue(value) {
+  if (Array.isArray(value)) return value.map((item) => canonicalValue(item));
+  if (value && typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value).filter(([, item]) => item !== void 0).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([key, item]) => [key, canonicalValue(item)])
+    );
+  }
+  return value;
+}
+function canonicalLineageSelectionPacketIdentityJson(projection) {
+  return JSON.stringify(canonicalValue(projection));
+}
+function lineageSelectionPacketV2IdentityProjection(packet) {
+  const assetsById = new Map(packet.assets.map((asset) => [asset.asset_id, asset]));
+  const selection = packet.selection.items.map((item) => {
+    const asset = assetsById.get(item.asset_id);
+    if (!asset) {
+      const diagnostics = [{ asset_id: item.asset_id, code: "selected_asset_missing", severity: "error" }];
+      throw new LineageSelectionPacketError(
+        `Selected asset ${item.asset_id} is absent from the v2 packet asset envelope.`,
+        [],
+        ["selected_asset_missing"],
+        diagnostics
+      );
+    }
+    return {
+      asset_id: item.asset_id,
+      campaign: asset.campaign,
+      channel: asset.channel,
+      current_attempt: {
+        asset_id: asset.current_attempt.asset_id,
+        attempt_index: asset.current_attempt.attempt_index,
+        checksum_sha256: asset.current_attempt.checksum_sha256,
+        id: asset.current_attempt.id,
+        source: asset.current_attempt.source
+      },
+      media_type: asset.media_type,
+      mime_type: asset.mime_type,
+      position: item.position,
+      selection_note: item.selection_note,
+      title: asset.title
+    };
+  });
+  return {
+    schema_version: "lineage.selection_packet.v2",
+    project: packet.project,
+    product: packet.product,
+    workspace: {
+      id: packet.workspace.id,
+      root_asset_id: packet.workspace.root_asset_id
+    },
+    context: {
+      campaign: packet.context.campaign,
+      channel: packet.context.channel,
+      labels: packet.context.labels,
+      notes: packet.context.notes
+    },
+    selection,
+    diagnostics: packet.diagnostics.map((diagnostic) => ({
+      code: diagnostic.code,
+      severity: diagnostic.severity,
+      ...diagnostic.asset_id ? { asset_id: diagnostic.asset_id } : {}
+    }))
+  };
+}
+function lineageSelectionPacketV2IdentitySha256(packet) {
+  const projection = lineageSelectionPacketV2IdentityProjection(packet);
+  return createHash4("sha256").update(canonicalLineageSelectionPacketIdentityJson(projection)).digest("hex");
+}
+function addDiagnostic(diagnostics, diagnostic) {
+  if (diagnostics.some((item) => item.code === diagnostic.code && item.severity === diagnostic.severity && item.asset_id === diagnostic.asset_id)) return;
+  diagnostics.push(diagnostic);
+}
+function requireV2CurrentAttempt(node, warnings, diagnostics) {
+  const attempt = node.current_attempt;
+  if (!attempt) {
+    const message = `Selected asset ${node.asset_id} has no current attempt identity.`;
+    const diagnostic = { asset_id: node.asset_id, code: "current_attempt_missing", severity: "error" };
+    throw new LineageSelectionPacketError(message, warnings, ["current_attempt_missing"], [...diagnostics, diagnostic]);
+  }
+  if (!attempt.id || !attempt.asset_id || !Number.isInteger(attempt.attempt_index) || attempt.attempt_index <= 0 || !attempt.source || attempt.is_current !== true) {
+    const message = `Selected asset ${node.asset_id} has malformed current attempt identity.`;
+    const diagnostic = { asset_id: node.asset_id, code: "current_attempt_invalid_identity", severity: "error" };
+    throw new LineageSelectionPacketError(message, warnings, ["current_attempt_invalid_identity"], [...diagnostics, diagnostic]);
+  }
+  if (!attempt.checksum_sha256 || !SHA256_PATTERN.test(attempt.checksum_sha256)) {
+    const message = `Selected asset ${node.asset_id} current attempt does not have a valid lowercase SHA-256 checksum.`;
+    const diagnostic = { asset_id: node.asset_id, code: "current_attempt_invalid_checksum", severity: "error" };
+    throw new LineageSelectionPacketError(message, warnings, ["current_attempt_invalid_checksum"], [...diagnostics, diagnostic]);
+  }
+  return {
+    asset_id: attempt.asset_id,
+    attempt_index: attempt.attempt_index,
+    checksum_sha256: attempt.checksum_sha256,
+    file_path: attempt.file_path,
+    generation_job_id: attempt.generation_job_id,
+    id: attempt.id,
+    is_current: attempt.is_current,
+    source: attempt.source
+  };
+}
+function assetForNodeV2(node, visibleCatalogAsset, catalogById, warnings, errors, diagnostics) {
+  const currentAttempt = requireV2CurrentAttempt(node, warnings, diagnostics);
+  const currentAttemptCatalogAsset = catalogById.get(currentAttempt.asset_id);
+  const isVisibleNodeAttempt = currentAttempt.asset_id === node.asset_id;
+  const mediaCatalogAsset = currentAttemptCatalogAsset || (isVisibleNodeAttempt ? visibleCatalogAsset : void 0);
+  const localReference = currentAttempt.file_path || mediaCatalogAsset?.local?.absolute_path || mediaCatalogAsset?.local?.relative_path || (isVisibleNodeAttempt ? node.local_path : void 0);
+  const absolutePath = resolveLocalReference(localReference);
+  const localExists = absolutePath ? existsSync9(absolutePath) : false;
+  const hasLocalClaim = Boolean(localReference);
+  const s3Key = mediaCatalogAsset?.s3?.key || (isVisibleNodeAttempt ? node.s3_key : void 0);
+  const hasS3 = Boolean(s3Key);
+  const mimeType = mediaCatalogAsset?.local?.content_type || mediaCatalogAsset?.s3?.content_type || visibleCatalogAsset?.local?.content_type || visibleCatalogAsset?.s3?.content_type || (localReference ? contentTypeFor(localReference) : void 0);
+  const mediaType = mediaCatalogAsset?.content_type || visibleCatalogAsset?.content_type || node.media_type;
+  if (localExists && absolutePath && fileSha256(absolutePath) !== currentAttempt.checksum_sha256) {
+    const message = `Selected asset ${node.asset_id} current attempt checksum does not match its local file.`;
+    const diagnostic = { asset_id: node.asset_id, code: "current_attempt_checksum_mismatch", severity: "error" };
+    throw new LineageSelectionPacketError(message, [...warnings, message], ["current_attempt_checksum_mismatch"], [...diagnostics, diagnostic]);
+  }
+  const s3Checksum = mediaCatalogAsset?.s3?.checksum_sha256;
+  if (hasS3 && s3Checksum && s3Checksum !== currentAttempt.checksum_sha256) {
+    const message = `Selected asset ${node.asset_id} current attempt checksum does not match its S3 media envelope.`;
+    const diagnostic = { asset_id: node.asset_id, code: "current_attempt_checksum_mismatch", severity: "error" };
+    throw new LineageSelectionPacketError(message, [...warnings, message], ["current_attempt_checksum_mismatch"], [...diagnostics, diagnostic]);
+  }
+  if (hasLocalClaim && !localExists) {
+    warnings.push(`Selected asset ${node.asset_id} current attempt has a local path but the file is missing: ${absolutePath || localReference}`);
+  }
+  if (!hasLocalClaim && !hasS3) {
+    const message = `Selected asset ${node.asset_id} current attempt has neither a local file nor S3 key.`;
+    warnings.push(message);
+    errors.push(message);
+  }
+  if (mediaType && mediaType !== "image" && mediaType !== "gif") {
+    warnings.push(`Selected asset ${node.asset_id} is ${mediaType}, not an image/gif asset.`);
+    addDiagnostic(diagnostics, { asset_id: node.asset_id, code: "unsupported_media_type", severity: "warning" });
+  }
+  const conflictingChecksums = [
+    currentAttemptCatalogAsset?.local?.checksum_sha256,
+    currentAttemptCatalogAsset?.s3?.checksum_sha256,
+    visibleCatalogAsset?.local?.checksum_sha256,
+    visibleCatalogAsset?.s3?.checksum_sha256,
+    node.checksum_sha256
+  ].filter((checksum) => Boolean(checksum && checksum !== currentAttempt.checksum_sha256));
+  if (conflictingChecksums.length > 0) {
+    warnings.push(`Selected asset ${node.asset_id} catalog or visible-node checksum differs from its current attempt; current attempt checksum is authoritative.`);
+  }
+  return {
+    asset_id: node.asset_id,
+    campaign: visibleCatalogAsset?.campaign || node.campaign,
+    channel: visibleCatalogAsset?.channel || node.channel,
+    checksum_sha256: currentAttempt.checksum_sha256,
+    current_attempt: currentAttempt,
+    local: {
+      absolute_path: absolutePath,
+      content_type: mediaCatalogAsset?.local?.content_type,
+      exists: localExists,
+      relative_path: mediaCatalogAsset?.local?.relative_path || currentAttempt.file_path || (isVisibleNodeAttempt ? node.local_path : void 0),
+      size_bytes: mediaCatalogAsset?.local?.size_bytes || fileSize(absolutePath)
+    },
+    media_type: mediaType,
+    mime_type: mimeType,
+    review_notes: node.review_notes,
+    review_state: node.review_state,
+    s3: {
+      bucket: mediaCatalogAsset?.s3?.bucket,
+      checksum_sha256: mediaCatalogAsset?.s3?.checksum_sha256,
+      content_type: mediaCatalogAsset?.s3?.content_type,
+      etag: mediaCatalogAsset?.s3?.etag,
+      key: s3Key,
+      region: mediaCatalogAsset?.s3?.region,
+      size_bytes: mediaCatalogAsset?.s3?.size_bytes,
+      version_id: mediaCatalogAsset?.s3?.version_id
+    },
+    selection_note: node.selection_note,
+    source: mediaCatalogAsset?.source || visibleCatalogAsset?.source || node.source,
+    status: visibleCatalogAsset?.status || node.status,
+    storage_state: storageState(hasLocalClaim, hasS3),
+    title: visibleCatalogAsset?.title || node.title || node.asset_id
+  };
+}
+function getLineageSelectionPacketV1(project, options = {}) {
   const workspace = resolveWorkspace(project, options);
   const snapshot = getLineageSnapshot(project, workspace.root_asset_id);
   const catalogSummary = validateProject(project);
@@ -3597,16 +4390,114 @@ function getLineageSelectionPacket(project, options = {}) {
     }
   };
 }
+function getLineageSelectionPacketV2(project, options) {
+  const workspace = resolveWorkspace(project, options);
+  const snapshot = getLineageSnapshot(project, workspace.root_asset_id);
+  const catalogSummary = validateProject(project);
+  const catalogAssets = listAllAssets(project);
+  const catalogById = new Map(catalogAssets.map((asset) => [asset.asset_id, asset]));
+  const warnings = [];
+  const errors = [];
+  const diagnostics = [];
+  const nodeById = new Map(snapshot.nodes.map((node) => [node.asset_id, node]));
+  const selectedItems = snapshot.selections.map((selection) => ({
+    asset_id: selection.asset_id,
+    position: selection.position,
+    selected_at: selection.selected_at,
+    selection_note: selection.notes
+  }));
+  if (selectedItems.length === 0) {
+    warnings.push(`Lineage workspace ${workspace.id} has no selected assets.`);
+    addDiagnostic(diagnostics, { code: "empty_selection", severity: "warning" });
+  }
+  const assets = [];
+  for (const item of selectedItems) {
+    const node = nodeById.get(item.asset_id);
+    if (!node) {
+      const message = `Selected asset ${item.asset_id} is not present in the resolved workspace snapshot.`;
+      warnings.push(message);
+      errors.push(message);
+      const diagnostic = { asset_id: item.asset_id, code: "selected_asset_outside_workspace", severity: "error" };
+      addDiagnostic(diagnostics, diagnostic);
+      throw new LineageSelectionPacketError(message, warnings, ["selected_asset_outside_workspace"], diagnostics);
+    }
+    assets.push(assetForNodeV2(node, catalogById.get(item.asset_id), catalogById, warnings, errors, diagnostics));
+  }
+  if (assets.some((asset) => !asset.dimensions)) {
+    warnings.push("Image dimensions are unavailable for one or more selected assets.");
+  }
+  if (options.strict) {
+    const strictErrors = [
+      ...selectedItems.length === 0 ? ["empty_selection"] : [],
+      ...assets.filter((asset) => asset.local.absolute_path && !asset.local.exists).map((asset) => `missing_local_file:${asset.asset_id}`),
+      ...assets.filter((asset) => asset.storage_state === "unresolved").map((asset) => `unresolved_current_attempt_media:${asset.asset_id}`),
+      ...diagnostics.filter((diagnostic) => diagnostic.severity === "error").map((diagnostic) => `${diagnostic.code}${diagnostic.asset_id ? `:${diagnostic.asset_id}` : ""}`)
+    ];
+    if (strictErrors.length > 0) {
+      throw new LineageSelectionPacketError(
+        `Lineage selection packet strict mode failed: ${strictErrors.join(", ")}`,
+        warnings,
+        strictErrors,
+        diagnostics
+      );
+    }
+  }
+  const packet = {
+    assets,
+    context: {
+      campaign: options.campaign,
+      channel: options.channel,
+      labels: options.labels || [],
+      notes: options.contextNotes
+    },
+    created_at: (/* @__PURE__ */ new Date()).toISOString(),
+    diagnostics,
+    errors: [...new Set(errors)],
+    identity_sha256: "",
+    kind: "lineage.selection_packet",
+    packet_id: "",
+    product: catalogSummary.product,
+    project,
+    schema_version: "lineage.selection_packet.v2",
+    selection: {
+      asset_ids: selectedItems.map((item) => item.asset_id),
+      count: selectedItems.length,
+      items: selectedItems,
+      root_asset_id: workspace.root_asset_id
+    },
+    source: {
+      app: "lineage",
+      command: options.command,
+      db_path: options.dbPath || process.env.LINEAGE_DB || lineageDbPath(),
+      package: options.packageVersion
+    },
+    warnings: [...new Set(warnings)],
+    workspace: {
+      active_at: workspace.active_at,
+      id: workspace.id,
+      notes: workspace.notes,
+      root_asset_id: workspace.root_asset_id,
+      status: workspace.status,
+      title: workspace.title
+    }
+  };
+  packet.identity_sha256 = lineageSelectionPacketV2IdentitySha256(packet);
+  packet.packet_id = `lineage_packet_${packet.identity_sha256.slice(0, 24)}`;
+  return packet;
+}
+function getLineageSelectionPacket(project, options = {}) {
+  return options.schema === "v2" ? getLineageSelectionPacketV2(project, options) : getLineageSelectionPacketV1(project, options);
+}
 
 // src/server/runtimeInfo.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { createRequire as createRequire2 } from "node:module";
-import { existsSync as existsSync6, readFileSync as readFileSync3, statSync as statSync5 } from "node:fs";
-import { join as join6 } from "node:path";
-var require3 = createRequire2(import.meta.url);
+import { createRequire as createRequire4 } from "node:module";
+import { existsSync as existsSync10, readFileSync as readFileSync5, statSync as statSync6 } from "node:fs";
+import { join as join9 } from "node:path";
+var require5 = createRequire4(import.meta.url);
 function packageInfo() {
   try {
-    const info = JSON.parse(readFileSync3(join6(packageRoot, "package.json"), "utf8"));
+    const info = JSON.parse(readFileSync5(join9(packageRoot, "package.json"), "utf8"));
     return { name: info.name || "@mean-weasel/lineage", version: info.version || "0.0.0" };
   } catch {
     return { name: "@mean-weasel/lineage", version: "0.0.0" };
@@ -3622,32 +4513,47 @@ function normalizeRuntimeChannel(value) {
 function gitSha() {
   const envSha = process.env.LINEAGE_GIT_SHA || process.env.GITHUB_SHA;
   if (envSha) return envSha.slice(0, 40);
-  if (!existsSync6(join6(packageRoot, ".git"))) return void 0;
+  if (!existsSync10(join9(packageRoot, ".git"))) return void 0;
   const result = spawnSync2("git", ["rev-parse", "--short=12", "HEAD"], { cwd: packageRoot, encoding: "utf8" });
   return result.status === 0 ? result.stdout.trim() || void 0 : void 0;
 }
-function tableExists(database, table) {
+function tableExists2(database, table) {
   return Boolean(database.prepare("select name from sqlite_master where type = 'table' and name = ?").get(table));
 }
 function tableCount(database, table) {
-  if (!tableExists(database, table)) return void 0;
+  if (!tableExists2(database, table)) return void 0;
   const row = database.prepare(`select count(*) count from ${table}`).get();
   return typeof row?.count === "number" ? row.count : void 0;
 }
+function migrationKeys(database) {
+  if (!tableExists2(database, "lineage_schema_migrations")) return [];
+  return database.prepare("select key from lineage_schema_migrations order by key").all().map((row) => row.key);
+}
 function getLineageRuntimeInfo(options = {}) {
   const info = packageInfo();
   const dbPath = options.dbPath || lineageDbPath();
-  const databaseInfo = { exists: existsSync6(dbPath), path: dbPath };
+  const channel = normalizeRuntimeChannel(options.channel || process.env.LINEAGE_CHANNEL || process.env.LINEAGE_RELEASE_CHANNEL);
+  const databaseInfo = { exists: existsSync10(dbPath), path: dbPath };
+  const schema = { migration_keys: [] };
   if (databaseInfo.exists) {
     try {
-      const stat = statSync5(dbPath);
+      const stat = statSync6(dbPath);
       databaseInfo.modified_at = stat.mtime.toISOString();
       databaseInfo.size_bytes = stat.size;
-      const { DatabaseSync } = require3("node:sqlite");
+      const { DatabaseSync } = require5("node:sqlite");
       const database = new DatabaseSync(dbPath, { readOnly: true });
       try {
         databaseInfo.projects = tableCount(database, "projects");
         databaseInfo.workspaces = tableCount(database, "lineage_workspaces");
+        schema.migration_keys = migrationKeys(database);
+        if (tableExists2(database, "lineage_profile_identity")) {
+          const rows = database.prepare("select profile_id, environment from lineage_profile_identity").all();
+          schema.profile_identity_rows = rows.length;
+          if (rows.length === 1) {
+            schema.profile_id = rows[0].profile_id;
+            schema.profile_environment = rows[0].environment;
+          }
+        }
       } finally {
         database.close();
       }
@@ -3657,27 +4563,113 @@ function getLineageRuntimeInfo(options = {}) {
   }
   return {
     asset_root: repoRoot,
-    channel: normalizeRuntimeChannel(options.channel || process.env.LINEAGE_CHANNEL || process.env.LINEAGE_RELEASE_CHANNEL),
+    channel,
     database: databaseInfo,
     fetchedAt: nowIso(),
     git_sha: gitSha(),
     node_env: process.env.NODE_ENV,
     package_name: info.name,
+    profile: runtimeProfileIdentity(channel),
+    schema,
     version: info.version
   };
 }
 
+// src/server/managedWriterRouting.ts
+var managedWriterRequestSchemaVersion = "lineage.managed_writer_request.v1";
+var managedWriterResponseSchemaVersion = "lineage.managed_writer_response.v1";
+var managedWriterRoute = "/api/managed-writer/execute";
+var delegationHeader = "X-Lineage-Writer-Delegation";
+var ManagedWriterRoutingError = class extends Error {
+  constructor(message, status = 409, options) {
+    super(message, options);
+    this.status = status;
+    this.name = "ManagedWriterRoutingError";
+  }
+  status;
+};
+function managedWriterTimeoutMs(command, args) {
+  const subcommand = args.find((arg) => !arg.startsWith("-")) || "";
+  return command === "reroll" && subcommand === "import" ? 5 * 6e4 : 3e4;
+}
+function errorMessage(body, fallback) {
+  if (!body || typeof body !== "object" || Array.isArray(body)) return fallback;
+  const record = body;
+  if (typeof record.message === "string") return record.message;
+  if (typeof record.error === "string") return record.error;
+  return fallback;
+}
+function agentClaimError(body, status) {
+  if (!body || typeof body !== "object" || Array.isArray(body)) return void 0;
+  const record = body;
+  if (typeof record.message !== "string" || typeof record.error !== "string") return void 0;
+  const conflicts = Array.isArray(record.conflicts) ? record.conflicts : [];
+  return new AgentClaimError(record.message, status, record.error, conflicts);
+}
+function assertResponseIdentity(body, profile, channel) {
+  if (!body || typeof body !== "object" || Array.isArray(body)) {
+    throw new ManagedWriterRoutingError("Managed writer service returned a non-object response", 502);
+  }
+  const response = body;
+  if (response.ok !== true || response.schema_version !== managedWriterResponseSchemaVersion || !response.service || response.service.profile_id !== profile.profile_id || response.service.environment !== profile.environment || response.service.service_origin !== profile.service_origin || response.service.channel !== channel) {
+    throw new ManagedWriterRoutingError("Managed writer response identity does not match the selected profile/service", 502);
+  }
+}
+async function executeManagedWriterCommand(profile, channel, command, args) {
+  const delegation = getProfileWriterDelegation(profile);
+  let response;
+  try {
+    response = await fetch(new URL(managedWriterRoute, delegation.service_origin), {
+      body: JSON.stringify({
+        args,
+        channel,
+        command,
+        environment: profile.environment,
+        profile_id: profile.profile_id,
+        schema_version: managedWriterRequestSchemaVersion,
+        service_origin: profile.service_origin
+      }),
+      headers: {
+        "Content-Type": "application/json",
+        [delegationHeader]: delegation.token
+      },
+      method: "POST",
+      redirect: "error",
+      signal: AbortSignal.timeout(managedWriterTimeoutMs(command, args))
+    });
+  } catch (error) {
+    throw new ManagedWriterRoutingError(
+      `Managed service for Lineage profile ${profile.profile_id} is unavailable or did not respond at ${profile.service_origin}; no direct fallback was attempted and the mutation outcome is unknown`,
+      503,
+      { cause: error }
+    );
+  }
+  let body;
+  try {
+    body = await response.json();
+  } catch (error) {
+    throw new ManagedWriterRoutingError("Managed writer service returned invalid JSON; mutation result is unknown", 502, { cause: error });
+  }
+  if (!response.ok) {
+    const claimError = agentClaimError(body, response.status);
+    if (claimError) throw claimError;
+    throw new ManagedWriterRoutingError(errorMessage(body, `Managed writer service returned HTTP ${response.status}`), response.status);
+  }
+  assertResponseIdentity(body, profile, channel);
+  return body.result;
+}
+
 // src/cli/lineageCli.ts
 var signalExitCodes = {
   SIGINT: 130,
   SIGTERM: 143
 };
 function packageRoot2() {
-  return resolve5(dirname3(fileURLToPath2(import.meta.url)), "..", "..");
+  return resolve8(dirname5(fileURLToPath2(import.meta.url)), "..", "..");
 }
 function packageVersion() {
   try {
-    const packageInfo2 = JSON.parse(readFileSync4(join7(packageRoot2(), "package.json"), "utf8"));
+    const packageInfo2 = JSON.parse(readFileSync6(join10(packageRoot2(), "package.json"), "utf8"));
     return packageInfo2.version || "0.0.0";
   } catch {
     return "0.0.0";
@@ -3685,9 +4677,9 @@ function packageVersion() {
 }
 function dataRoot(displayName) {
   if (process.env.LINEAGE_HOME) return process.env.LINEAGE_HOME;
-  if (platform() === "darwin") return join7(homedir(), "Library", "Application Support", displayName);
-  if (platform() === "win32") return join7(process.env.APPDATA || join7(homedir(), "AppData", "Roaming"), displayName);
-  return join7(process.env.XDG_DATA_HOME || join7(homedir(), ".local", "share"), displayName.toLowerCase().replace(/\s+/g, "-"));
+  if (platform2() === "darwin") return join10(homedir2(), "Library", "Application Support", displayName);
+  if (platform2() === "win32") return join10(process.env.APPDATA || join10(homedir2(), "AppData", "Roaming"), displayName);
+  return join10(process.env.XDG_DATA_HOME || join10(homedir2(), ".local", "share"), displayName.toLowerCase().replace(/\s+/g, "-"));
 }
 function readOption(args, name) {
   const prefix = `${name}=`;
@@ -3711,22 +4703,37 @@ function readOptions(args, name) {
   return values;
 }
 function resolveStartOptions(config, args) {
-  const rawPort = readOption(args, "--port") || process.env.PORT || String(config.defaultPort);
+  const profile = prepareCliProfile(config, args);
+  const serviceUrl = profile ? new URL(profile.service_origin) : void 0;
+  const rawPort = readOption(args, "--port") || process.env.PORT || serviceUrl?.port || String(config.defaultPort);
   const port = Number(rawPort);
   if (!Number.isInteger(port) || port < 1 || port > 65535) {
     throw new Error(`Invalid port: ${rawPort}`);
   }
+  const profileHost = serviceUrl ? normalizeListenHost(serviceUrl.hostname) : void 0;
+  const host = normalizeListenHost(readOption(args, "--host") || process.env.HOST || profileHost || config.defaultHost);
+  if (profile && serviceUrl && (host !== profileHost || port !== Number(serviceUrl.port || 80))) {
+    throw new Error(`Profile ${profile.profile_id} service_origin ${profile.service_origin} conflicts with requested host/port ${host}:${port}`);
+  }
   return {
-    assetRoot: resolveCliAssetRoot(args),
-    dbPath: resolveCliDbPath(config, args),
-    host: readOption(args, "--host") || process.env.HOST || config.defaultHost,
+    assetRoot: profile?.asset_root || resolveCliAssetRoot(args),
+    dbPath: profile?.database_path || resolveCliDbPath(config, args),
+    host,
     json: args.includes("--json"),
     open: args.includes("--open"),
-    port
+    port,
+    profile
   };
 }
+function normalizeListenHost(host) {
+  return host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+}
+function lineageServiceUrl(host, port) {
+  const urlHost = host.includes(":") ? `[${normalizeListenHost(host)}]` : host;
+  return `http://${urlHost}:${port}`;
+}
 function resolveCliAssetRoot(args) {
-  return resolve5(readOption(args, "--asset-root") || process.env.LINEAGE_ASSET_ROOT || packageRoot);
+  return resolve8(readOption(args, "--asset-root") || process.env.LINEAGE_ASSET_ROOT || packageRoot);
 }
 function configureCliAssetRoot(args) {
   const assetRoot = resolveCliAssetRoot(args);
@@ -3734,17 +4741,68 @@ function configureCliAssetRoot(args) {
   return setLineageAssetRoot(assetRoot);
 }
 function resolveCliDbPath(config, args) {
-  return readOption(args, "--db") || process.env.LINEAGE_DB || join7(dataRoot(config.displayName), `${config.binName}.sqlite`);
+  return readOption(args, "--db") || process.env.LINEAGE_DB || join10(dataRoot(config.displayName), `${config.binName}.sqlite`);
+}
+function hasOption(args, name) {
+  return args.includes(name) || args.some((arg) => arg.startsWith(`${name}=`));
+}
+function profileSelector(args) {
+  const option = readOption(args, "--profile");
+  if (hasOption(args, "--profile") && !option?.trim()) {
+    throw new Error("--profile requires a non-empty profile ID or manifest path");
+  }
+  if (option && process.env.LINEAGE_PROFILE) {
+    const optionProfile = resolveLineageProfile(option);
+    const environmentProfile = resolveLineageProfile(process.env.LINEAGE_PROFILE);
+    if (optionProfile.manifest_path !== environmentProfile.manifest_path) {
+      throw new Error(`--profile ${option} conflicts with LINEAGE_PROFILE ${process.env.LINEAGE_PROFILE}`);
+    }
+  }
+  return option || process.env.LINEAGE_PROFILE;
+}
+function doctorFailures(result) {
+  return result.checks.filter((check) => check.status === "fail").map((check) => `${check.id}: ${check.message}`).join("; ");
+}
+function prepareCliProfile(config, args) {
+  const selector = profileSelector(args);
+  if (!selector) {
+    assertUnselectedDatabaseIsUnbound(getLineageRuntimeInfo({ channel: config.channel, dbPath: resolveCliDbPath(config, args) }));
+    return void 0;
+  }
+  if (hasOption(args, "--db")) throw new Error("A named profile cannot be combined with --db");
+  if (hasOption(args, "--asset-root")) throw new Error("A named profile cannot be combined with --asset-root");
+  const profile = resolveLineageProfile(selector);
+  if (process.env.LINEAGE_DB && resolve8(process.env.LINEAGE_DB) !== profile.database_path) {
+    throw new Error(`Profile ${profile.profile_id} database_path conflicts with LINEAGE_DB`);
+  }
+  if (process.env.LINEAGE_ASSET_ROOT && resolve8(process.env.LINEAGE_ASSET_ROOT) !== profile.asset_root) {
+    throw new Error(`Profile ${profile.profile_id} asset_root conflicts with LINEAGE_ASSET_ROOT`);
+  }
+  assertProfileChannel(profile, config.channel);
+  const runtime = getLineageRuntimeInfo({ channel: config.channel, dbPath: profile.database_path });
+  const doctor = doctorLineageProfile(selector, { channel: config.channel, gitSha: runtime.git_sha, version: runtime.version });
+  if (!doctor.ok) throw new Error(`Profile ${profile.profile_id} failed doctor: ${doctorFailures(doctor)}`);
+  process.env.LINEAGE_ASSET_ROOT = profile.asset_root;
+  process.env.LINEAGE_DB = profile.database_path;
+  process.env.LINEAGE_PROFILE = selector;
+  process.env.LINEAGE_PROFILE_ENVIRONMENT = profile.environment;
+  process.env.LINEAGE_PROFILE_ID = profile.profile_id;
+  process.env.LINEAGE_PROFILE_MANIFEST = profile.manifest_path;
+  process.env.LINEAGE_PROFILE_SERVICE_ORIGIN = profile.service_origin;
+  setLineageAssetRoot(profile.asset_root);
+  return profile;
 }
 function formatLineageHelp(config) {
   return `${config.binName} ${packageVersion()}
 
 Usage:
-  ${config.binName} start [--port <port>] [--host <host>] [--db <path>] [--asset-root <path>] [--open] [--json]
+  ${config.binName} start [--profile <id-or-manifest>] [--port <port>] [--host <host>] [--db <path>] [--asset-root <path>] [--open] [--json]
+  ${config.binName} profile doctor --profile <id-or-manifest> [--json]
+  ${config.binName} profile bind --profile <id-or-manifest> [--confirm-write] [--json]
   ${config.binName} next [--project <project>] [--root <asset-id>] [--db <path>] [--json]
   ${config.binName} brief [--project <project>] [--root <asset-id>] [--db <path>] [--json]
   ${config.binName} inspect --asset-id <asset-id> [--project <project>] [--db <path>] [--json]
-  ${config.binName} selection packet [--project <project>] [--workspace <id-or-root>|--root <asset-id>] [--channel <channel>] [--campaign <campaign>] [--context-notes <text>] [--label <label>] [--out <path>] [--strict] [--db <path>] [--json]
+  ${config.binName} selection packet [--project <project>] [--workspace <id-or-root>|--root <asset-id>] [--channel <channel>] [--campaign <campaign>] [--context-notes <text>] [--label <label>] [--schema v2] [--out <path>] [--strict] [--db <path>] [--json]
   ${config.binName} link-child --root <asset-id> --child <asset-id> [--project <project>] [--claim-token <claim-id.secret>] [--confirm-write] [--db <path>] [--json]
   ${config.binName} reroll list --root <asset-id> [--project <project>] [--db <path>] [--json]
   ${config.binName} reroll mark --root <asset-id> --target <asset-id> [--notes <text>] [--requested-by agent|human|system] [--project <project>] [--confirm-write] [--db <path>] [--json]
@@ -3776,6 +4834,11 @@ ${config.displayName} runs the bundled Lineage server for the ${config.channel}
 Asset catalogs and local media default to the installed package root. Pass
 --asset-root <path> or LINEAGE_ASSET_ROOT to use an external project root.
 
+All commands accept --profile <id-or-manifest> or LINEAGE_PROFILE. Named
+profiles are authoritative for database, asset root, environment, and origin;
+they cannot be combined with direct --db or --asset-root overrides. Commands
+without a profile run in legacy-unbound compatibility mode.
+
 Variation vs re-roll:
   link-child creates a new visible child variation edge.
   reroll mark -> reroll plan -> reroll import updates the same node with a new attempt.`;
@@ -3784,8 +4847,8 @@ function printHelp(config) {
   console.log(formatLineageHelp(config));
 }
 function openBrowser(url) {
-  const command = platform() === "darwin" ? "open" : platform() === "win32" ? "cmd" : "xdg-open";
-  const args = platform() === "win32" ? ["/c", "start", "", url] : [url];
+  const command = platform2() === "darwin" ? "open" : platform2() === "win32" ? "cmd" : "xdg-open";
+  const args = platform2() === "win32" ? ["/c", "start", "", url] : [url];
   const opener = spawn(command, args, { detached: true, stdio: "ignore" });
   opener.unref();
 }
@@ -3828,6 +4891,8 @@ function runLineageDataCommand(command, args) {
   if (command === "selection") {
     const subcommand = positionalArgs(args)[0] || "";
     if (subcommand !== "packet") throw new Error(`Unknown selection command: ${subcommand}`);
+    const schema = readOption(args, "--schema");
+    if (schema && schema !== "v2") throw new Error(`Unsupported selection packet schema: ${schema}. Omit --schema for v1 or pass --schema v2.`);
     const labels = readOptions(args, "--label").flatMap((label) => label.split(",")).map((label) => label.trim()).filter(Boolean);
     const packet = getLineageSelectionPacket(options.project, {
       campaign: readOption(args, "--campaign"),
@@ -3838,14 +4903,15 @@ function runLineageDataCommand(command, args) {
       labels,
       packageVersion: packageVersion(),
       rootAssetId: options.rootAssetId,
+      schema: schema === "v2" ? "v2" : void 0,
       strict: args.includes("--strict"),
       workspaceId: readOption(args, "--workspace") || readOption(args, "--workspace-id")
     });
     const out = readOption(args, "--out");
     if (out) {
-      const outPath = resolve5(out);
-      mkdirSync4(dirname3(outPath), { recursive: true });
-      writeFileSync2(outPath, `${JSON.stringify(packet, null, 2)}
+      const outPath = resolve8(out);
+      mkdirSync6(dirname5(outPath), { recursive: true });
+      writeFileSync3(outPath, `${JSON.stringify(packet, null, 2)}
 `);
     }
     return packet;
@@ -4055,6 +5121,64 @@ function runLineageDbCommand(config, command, args) {
   if (command === "info") return getLineageRuntimeInfo({ channel: config.channel, dbPath });
   throw new Error(`Unknown db command: ${command}`);
 }
+function runLineageProfileCommand(config, command, args) {
+  if (command !== "doctor" && command !== "bind") throw new Error(`Unknown profile command: ${command}`);
+  if (hasOption(args, "--db")) throw new Error(`Profile ${command} cannot be combined with --db`);
+  if (hasOption(args, "--asset-root")) throw new Error(`Profile ${command} cannot be combined with --asset-root`);
+  const selector = profileSelector(args);
+  if (!selector) throw new Error(`lineage profile ${command} requires --profile or LINEAGE_PROFILE`);
+  if (command === "bind") {
+    const profile = resolveLineageProfile(selector);
+    assertProfileChannel(profile, config.channel);
+    if (!args.includes("--confirm-write")) return bindLineageProfileDatabase(profile, false);
+    mkdirSync6(dirname5(profile.database_path), { recursive: true });
+    const writerLease = acquireProfileWriterLease(profile, config.channel, "cli");
+    try {
+      return bindLineageProfileDatabase(profile, true);
+    } finally {
+      writerLease.release();
+    }
+  }
+  const runtime = getLineageRuntimeInfo({ channel: config.channel });
+  return doctorLineageProfile(selector, { channel: config.channel, gitSha: runtime.git_sha, version: runtime.version });
+}
+function printProfileResult(result, json) {
+  if (json) {
+    console.log(JSON.stringify(result, null, 2));
+    return;
+  }
+  if (result.schema_version === "lineage.profile_bind.v1") {
+    console.log(`${result.dryRun ? "Would bind" : result.already_bound ? "Already bound" : "Bound"} ${result.profile_id} to ${result.database_path}`);
+    return;
+  }
+  console.log(`Profile doctor: ${result.ok ? "ok" : "failed"}`);
+  for (const check of result.checks) console.log(`${check.status.toUpperCase()} ${check.id}: ${check.message}`);
+}
+function lineageProfileDoctorExitCode(result) {
+  return result.ok ? 0 : 1;
+}
+function lineageCliRequiresWriterLease(command, args) {
+  if (command === "next" || command === "brief" || command === "inspect" || command === "selection") return false;
+  const subcommand = positionalArgs(args)[0] || "";
+  if (command === "reroll") return subcommand !== "list";
+  if (command === "tasks") return subcommand !== "list" && subcommand !== "inspect";
+  if (command === "db") return subcommand !== "info";
+  if (command === "agent") return subcommand !== "status" && subcommand !== "graph" && subcommand !== "inspect";
+  return true;
+}
+function argsWithoutProfileSelector(args) {
+  const filtered = [];
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === "--profile") {
+      index += 1;
+      continue;
+    }
+    if (arg.startsWith("--profile=")) continue;
+    filtered.push(arg);
+  }
+  return filtered;
+}
 function printDbResult(command, result, json) {
   if (json) {
     console.log(JSON.stringify(result, null, 2));
@@ -4205,19 +5329,21 @@ function start(config, args) {
     else console.error(`${config.binName}: ${message}`);
     process.exit(1);
   }
-  const serverPath = join7(packageRoot2(), "dist", "server.js");
-  if (!existsSync7(serverPath)) {
+  const serverPath = join10(packageRoot2(), "dist", "server.js");
+  if (!existsSync11(serverPath)) {
     const message = `Missing bundled server at ${serverPath}. Run npm run build before using ${config.binName} start from a source checkout.`;
     if (options.json) console.error(JSON.stringify({ ok: false, error: message }, null, 2));
     else console.error(`${config.binName}: ${message}`);
     process.exit(1);
   }
-  mkdirSync4(dirname3(options.dbPath), { recursive: true });
-  const url = `http://${options.host}:${options.port}`;
+  mkdirSync6(dirname5(options.dbPath), { recursive: true });
+  const url = lineageServiceUrl(options.host, options.port);
   if (options.json) {
-    console.log(JSON.stringify({ assetRoot: options.assetRoot, channel: config.channel, dbPath: options.dbPath, host: options.host, port: options.port, status: "starting", url }, null, 2));
+    console.log(JSON.stringify({ assetRoot: options.assetRoot, channel: config.channel, dbPath: options.dbPath, host: options.host, port: options.port, profile: options.profile ? { environment: options.profile.environment, id: options.profile.profile_id } : { bound: false, id: "legacy-unbound" }, status: "starting", url }, null, 2));
   } else {
     console.log(`${config.displayName} starting at ${url}`);
+    if (options.profile) console.log(`Profile: ${options.profile.profile_id} (${options.profile.environment})`);
+    else console.warn("Warning: legacy-unbound runtime; database and asset paths are not protected by a named profile.");
     console.log(`SQLite: ${options.dbPath}`);
     console.log(`Assets: ${options.assetRoot}`);
   }
@@ -4229,6 +5355,12 @@ function start(config, args) {
       LINEAGE_ASSET_ROOT: options.assetRoot,
       LINEAGE_CHANNEL: config.channel,
       LINEAGE_DB: options.dbPath,
+      LINEAGE_PROFILE: options.profile ? process.env.LINEAGE_PROFILE : void 0,
+      LINEAGE_PROFILE_ENVIRONMENT: options.profile?.environment,
+      LINEAGE_PROFILE_ID: options.profile?.profile_id,
+      LINEAGE_PROFILE_MANIFEST: options.profile?.manifest_path,
+      LINEAGE_PROFILE_SERVICE_ORIGIN: options.profile?.service_origin,
+      LINEAGE_DB_ACCESS: void 0,
       NODE_ENV: "production",
       PORT: String(options.port)
     },
@@ -4247,7 +5379,8 @@ function start(config, args) {
     process.exit(1);
   });
 }
-function runLineageCli(config, args = process.argv.slice(2)) {
+async function runLineageCli(config, args = process.argv.slice(2)) {
+  process.env.LINEAGE_CHANNEL = config.channel;
   if (args.includes("--help") || args.includes("-h") || args.length === 0) {
     printHelp(config);
     process.exit(0);
@@ -4262,11 +5395,52 @@ function runLineageCli(config, args = process.argv.slice(2)) {
     start(config, normalizedArgs.slice(1));
     return;
   }
+  if (command === "profile") {
+    const commandArgs = normalizedArgs.slice(2);
+    const profileCommand = normalizedArgs[1] || "";
+    const json2 = commandArgs.includes("--json");
+    try {
+      const result = runLineageProfileCommand(config, profileCommand, commandArgs);
+      printProfileResult(result, json2);
+      process.exit(lineageProfileDoctorExitCode(result));
+    } catch (error) {
+      const message2 = error instanceof Error ? error.message : String(error);
+      if (json2) console.error(JSON.stringify({ ok: false, command: `profile ${profileCommand}`, error: message2 }, null, 2));
+      else console.error(`${config.binName}: ${message2}`);
+      process.exit(1);
+    }
+  }
+  let managedWriterProfile;
+  try {
+    const profile = prepareCliProfile(config, normalizedArgs.slice(1));
+    if (profile) {
+      if (lineageCliRequiresWriterLease(command, normalizedArgs.slice(1))) {
+        delete process.env.LINEAGE_DB_ACCESS;
+        try {
+          const writerLease = acquireProfileWriterLease(profile, config.channel, "cli");
+          process.once("exit", writerLease.release);
+        } catch (error) {
+          if (!(error instanceof ProfileWriterLeaseConflictError) || error.owner.role !== "service") throw error;
+          process.env.LINEAGE_DB_ACCESS = "read-only";
+          managedWriterProfile = profile;
+        }
+      } else {
+        process.env.LINEAGE_DB_ACCESS = "read-only";
+      }
+    }
+  } catch (error) {
+    const message2 = error instanceof Error ? error.message : String(error);
+    const json2 = normalizedArgs.includes("--json");
+    if (json2) console.error(JSON.stringify({ ok: false, command, error: message2 }, null, 2));
+    else console.error(`${config.binName}: ${message2}`);
+    process.exit(1);
+  }
   if (command === "next" || command === "brief" || command === "inspect" || command === "selection" || command === "link-child" || command === "reroll" || command === "tasks") {
     const commandArgs = normalizedArgs.slice(1);
     const json2 = commandArgs.includes("--json");
     try {
-      printDataResult(command, runLineageDataCommand(command, commandArgs), json2);
+      const result = managedWriterProfile ? await executeManagedWriterCommand(managedWriterProfile, config.channel, command, argsWithoutProfileSelector(commandArgs)) : runLineageDataCommand(command, commandArgs);
+      printDataResult(command, result, json2);
     } catch (error) {
       const message2 = redactAgentClaimTokens(error instanceof Error ? error.message : String(error));
       if (json2) {
@@ -4296,7 +5470,13 @@ function runLineageCli(config, args = process.argv.slice(2)) {
     const agentCommand = normalizedArgs[1] || "";
     const json2 = commandArgs.includes("--json");
     try {
-      printAgentResult(agentCommand, runLineageAgentCommand(agentCommand, commandArgs), json2);
+      const result = managedWriterProfile ? await executeManagedWriterCommand(
+        managedWriterProfile,
+        config.channel,
+        "agent",
+        argsWithoutProfileSelector([agentCommand, ...commandArgs])
+      ) : runLineageAgentCommand(agentCommand, commandArgs);
+      printAgentResult(agentCommand, result, json2);
     } catch (error) {
       const message2 = redactAgentClaimTokens(error instanceof Error ? error.message : String(error));
       if (json2) {
@@ -4317,5 +5497,5 @@ function runLineageCli(config, args = process.argv.slice(2)) {
 }
 
 // src/cli/lineage.ts
-runLineageCli({ binName: "lineage", channel: "stable", defaultHost: "lineage.localhost", defaultPort: 5197, displayName: "Lineage" });
+await runLineageCli({ binName: "lineage", channel: "stable", defaultHost: "lineage.localhost", defaultPort: 5197, displayName: "Lineage" });
 //# sourceMappingURL=lineage.js.map