@mean-weasel/lineage 0.1.11 → 0.1.13

package/dist/server.js

@@ -1,12 +1,12 @@
 // src/server.ts
 import express2 from "express";
 import multer from "multer";
-import { existsSync as existsSync7 } from "node:fs";
-import { join as join10 } from "node:path";
+import { existsSync as existsSync14 } from "node:fs";
+import { join as join14 } from "node:path";
 
 // src/server/assetCore.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readdirSync as readdirSync2, readFileSync as readFileSync2, unlinkSync, writeFileSync } from "node:fs";
-import { dirname as dirname2, join as join4, resolve as resolve2 } from "node:path";
+import { existsSync as existsSync6, mkdirSync as mkdirSync5, readdirSync as readdirSync2, readFileSync as readFileSync4, unlinkSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname4, join as join6, resolve as resolve4 } from "node:path";
 import { spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 
@@ -282,22 +282,597 @@ function createS3StorageAdapter(deps) {
 }
 
 // src/server/assetLineageDb.ts
+import { createRequire as createRequire2 } from "node:module";
+import { existsSync as existsSync5, mkdirSync as mkdirSync4 } from "node:fs";
+import { join as join5 } from "node:path";
+
+// src/server/profileWriterLease.ts
+import { createHash as createHash3, randomUUID as randomUUID2, timingSafeEqual } from "node:crypto";
+import { existsSync as existsSync4, lstatSync, mkdirSync as mkdirSync3, readFileSync as readFileSync3, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname3, join as join4, resolve as resolve3 } from "node:path";
+
+// src/server/lineageProfiles.ts
+import { createHash as createHash2, randomUUID } from "node:crypto";
 import { createRequire } from "node:module";
-import { mkdirSync as mkdirSync2 } from "node:fs";
-import { join as join3 } from "node:path";
+import {
+  chmodSync,
+  constants as fsConstants,
+  copyFileSync as copyFileSync2,
+  existsSync as existsSync3,
+  linkSync,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync2,
+  realpathSync,
+  rmSync,
+  statSync as statSync3,
+  writeFileSync
+} from "node:fs";
+import { homedir, platform } from "node:os";
+import { dirname as dirname2, isAbsolute, join as join3, relative as relative2, resolve as resolve2 } from "node:path";
+
+// src/shared/lineageProfileTypes.ts
+var lineageProfileSchemaVersion = "lineage.profile.v1";
+var lineageProfileDoctorSchemaVersion = "lineage.profile_doctor.v1";
+
+// src/server/lineageProfiles.ts
 var require2 = createRequire(import.meta.url);
+var profileIdPattern = /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/;
+function lineageDataRoot() {
+  if (process.env.LINEAGE_HOME) return resolve2(process.env.LINEAGE_HOME);
+  if (platform() === "darwin") return join3(homedir(), "Library", "Application Support", "Lineage");
+  if (platform() === "win32") return join3(process.env.APPDATA || join3(homedir(), "AppData", "Roaming"), "Lineage");
+  return join3(process.env.XDG_DATA_HOME || join3(homedir(), ".local", "share"), "lineage");
+}
+function lineageProfileRoot() {
+  return resolve2(process.env.LINEAGE_PROFILE_ROOT || join3(lineageDataRoot(), "profiles"));
+}
+function environmentChannel(environment) {
+  if (environment === "production") return "stable";
+  if (environment === "preview") return "preview";
+  return "dev";
+}
+function channelEnvironment(channel) {
+  if (channel === "stable") return "production";
+  if (channel === "preview") return "preview";
+  return "development";
+}
+function profileManifestPath(selector) {
+  const value = selector.trim();
+  if (!value) throw new Error("Profile selector must not be empty");
+  const looksLikePath = isAbsolute(value) || value.includes("/") || value.includes("\\") || value.endsWith(".json");
+  if (looksLikePath) return { manifestPath: resolve2(value) };
+  if (!profileIdPattern.test(value)) throw new Error(`Invalid profile ID: ${value}`);
+  return { manifestPath: join3(lineageProfileRoot(), value, "profile.json"), namedProfileId: value };
+}
+function requiredString(record, key) {
+  const value = record[key];
+  if (typeof value !== "string" || !value.trim()) throw new Error(`Profile manifest requires a non-empty ${key}`);
+  return value.trim();
+}
+function optionalString(record, key) {
+  const value = record[key];
+  if (value === void 0) return void 0;
+  if (typeof value !== "string" || !value.trim()) throw new Error(`Profile manifest ${key} must be a non-empty string`);
+  return value.trim();
+}
+function validateEnvironment(value) {
+  if (value === "production" || value === "preview" || value === "development") return value;
+  throw new Error(`Invalid profile environment: ${value}`);
+}
+function validateChannel(value) {
+  if (value === void 0) return void 0;
+  if (value === "stable" || value === "preview" || value === "dev") return value;
+  throw new Error(`Invalid expected runtime channel: ${String(value)}`);
+}
+function validateCodeOrigin(value) {
+  if (value === void 0) return void 0;
+  if (value === "checkout" || value === "package") return value;
+  throw new Error(`Invalid expected runtime code_origin: ${String(value)}`);
+}
+function validateFingerprint(value, field) {
+  if (value === void 0) return void 0;
+  if (!/^[a-f0-9]{64}$/i.test(value)) throw new Error(`Profile ${field} must be a 64-character SHA-256 fingerprint`);
+  return value.toLowerCase();
+}
+function resolveManifestPath(manifestPath, value) {
+  return resolve2(dirname2(manifestPath), value);
+}
+function validateServiceOrigin(value) {
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    throw new Error(`Invalid profile service_origin: ${value}`);
+  }
+  if (parsed.protocol !== "http:") throw new Error("Profile service_origin must use http for the local Lineage service");
+  if (!parsed.port) throw new Error("Profile service_origin must include an explicit port");
+  if (parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash) {
+    throw new Error("Profile service_origin must contain only scheme, host, and port");
+  }
+  return parsed.origin;
+}
+function resolveLineageProfile(selector) {
+  const { manifestPath, namedProfileId } = profileManifestPath(selector);
+  if (!existsSync3(manifestPath)) throw new Error(`Profile manifest does not exist: ${manifestPath}`);
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync2(manifestPath, "utf8"));
+  } catch (error) {
+    throw new Error(`Could not parse profile manifest ${manifestPath}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+  }
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) throw new Error("Profile manifest must be a JSON object");
+  const record = raw;
+  const schemaVersion = requiredString(record, "schema_version");
+  if (schemaVersion !== lineageProfileSchemaVersion) throw new Error(`Unsupported profile schema_version: ${schemaVersion}`);
+  const profileId = requiredString(record, "profile_id");
+  if (!profileIdPattern.test(profileId)) throw new Error(`Invalid profile ID: ${profileId}`);
+  if (namedProfileId && namedProfileId !== profileId) {
+    throw new Error(`Named profile ${namedProfileId} does not match immutable manifest profile_id ${profileId}`);
+  }
+  const expectedRaw = record.expected_runtime;
+  if (expectedRaw !== void 0 && (!expectedRaw || typeof expectedRaw !== "object" || Array.isArray(expectedRaw))) {
+    throw new Error("Profile expected_runtime must be an object");
+  }
+  const expected = expectedRaw;
+  const expectedGitSha = expected ? optionalString(expected, "git_sha") : void 0;
+  const expectedVersion = expected ? optionalString(expected, "version") : void 0;
+  const expectedCodeFingerprint = validateFingerprint(expected ? optionalString(expected, "code_fingerprint") : void 0, "expected_runtime.code_fingerprint");
+  const expectedCodeOrigin = validateCodeOrigin(expected?.code_origin);
+  const migrationsRaw = record.required_schema_migrations;
+  if (migrationsRaw !== void 0 && (!Array.isArray(migrationsRaw) || migrationsRaw.some((value) => typeof value !== "string" || !value.trim()))) {
+    throw new Error("Profile required_schema_migrations must be an array of non-empty strings");
+  }
+  const environment = validateEnvironment(requiredString(record, "environment"));
+  const expectedChannel = validateChannel(expected?.channel);
+  if (expectedChannel && expectedChannel !== environmentChannel(environment)) {
+    throw new Error(`Profile environment ${environment} conflicts with expected runtime channel ${expectedChannel}`);
+  }
+  const manifest = {
+    asset_root: resolveManifestPath(manifestPath, requiredString(record, "asset_root")),
+    database_path: resolveManifestPath(manifestPath, requiredString(record, "database_path")),
+    environment,
+    ...expected ? {
+      expected_runtime: {
+        ...expectedChannel ? { channel: expectedChannel } : {},
+        ...expectedCodeFingerprint ? { code_fingerprint: expectedCodeFingerprint } : {},
+        ...expectedCodeOrigin ? { code_origin: expectedCodeOrigin } : {},
+        ...expectedGitSha ? { git_sha: expectedGitSha } : {},
+        ...expectedVersion ? { version: expectedVersion } : {}
+      }
+    } : {},
+    profile_id: profileId,
+    ...migrationsRaw ? { required_schema_migrations: migrationsRaw.map((value) => value.trim()) } : {},
+    schema_version: lineageProfileSchemaVersion,
+    service_origin: validateServiceOrigin(requiredString(record, "service_origin"))
+  };
+  return { ...manifest, manifest_path: manifestPath, profile_fingerprint: lineageProfileFingerprint(manifest) };
+}
+function lineageProfileFingerprint(profile) {
+  return createHash2("sha256").update(JSON.stringify({
+    asset_root: resolve2(profile.asset_root),
+    database_path: resolve2(profile.database_path),
+    environment: profile.environment,
+    profile_id: profile.profile_id,
+    schema_version: profile.schema_version,
+    service_origin: profile.service_origin
+  })).digest("hex");
+}
+function assertProfileRuntimePin(profile, runtime) {
+  if (!profile.expected_runtime?.code_fingerprint || !profile.expected_runtime.code_origin) {
+    throw new Error(`Profile ${profile.profile_id} must pin expected_runtime.code_fingerprint and expected_runtime.code_origin before binding or writing`);
+  }
+  if (!runtime?.code?.verified) {
+    throw new Error(`Profile ${profile.profile_id} requires a verified runtime code identity before binding or writing`);
+  }
+  if (runtime.code.fingerprint !== profile.expected_runtime.code_fingerprint) {
+    throw new Error(`Profile ${profile.profile_id} expects code fingerprint ${profile.expected_runtime.code_fingerprint}, found ${runtime.code.fingerprint}`);
+  }
+  if (runtime.code.origin !== profile.expected_runtime.code_origin) {
+    throw new Error(`Profile ${profile.profile_id} expects code origin ${profile.expected_runtime.code_origin}, found ${runtime.code.origin}`);
+  }
+}
+function assertProfileChannel(profile, channel) {
+  const requiredChannel = environmentChannel(profile.environment);
+  if (channel === requiredChannel) return;
+  if (profile.environment === "production") {
+    throw new Error(`Refusing to open production profile ${profile.profile_id} from ${channel} code; use the stable channel`);
+  }
+  throw new Error(`Profile ${profile.profile_id} requires the ${requiredChannel} channel, not ${channel}`);
+}
+function tableExists(database, table) {
+  return Boolean(database.prepare("select name from sqlite_master where type = 'table' and name = ?").get(table));
+}
+function tableColumns(database, table) {
+  if (!tableExists(database, table)) return /* @__PURE__ */ new Set();
+  return new Set(database.prepare(`pragma table_info(${table})`).all().map((row) => row.name));
+}
+function inspectDatabase(profile) {
+  const result = {
+    exists: existsSync3(profile.database_path),
+    migration_keys: [],
+    path: profile.database_path
+  };
+  if (!result.exists) return result;
+  try {
+    const { DatabaseSync } = require2("node:sqlite");
+    const database = new DatabaseSync(profile.database_path, { readOnly: true });
+    try {
+      if (tableExists(database, "lineage_profile_identity")) {
+        const columns = tableColumns(database, "lineage_profile_identity");
+        const fingerprintExpression = columns.has("profile_fingerprint") ? "profile_fingerprint" : "'' as profile_fingerprint";
+        const rows = database.prepare(`select profile_id, environment, bound_at, ${fingerprintExpression} from lineage_profile_identity`).all();
+        if (rows.length === 1) {
+          const identity = {
+            bound_at: typeof rows[0].bound_at === "string" ? rows[0].bound_at : void 0,
+            environment: String(rows[0].environment),
+            profile_fingerprint: typeof rows[0].profile_fingerprint === "string" ? rows[0].profile_fingerprint : "",
+            profile_id: String(rows[0].profile_id)
+          };
+          result.identity = identity;
+        } else {
+          result.error = `Expected exactly one lineage_profile_identity row, found ${rows.length}`;
+        }
+      }
+      if (tableExists(database, "lineage_schema_migrations")) {
+        result.migration_keys = database.prepare("select key from lineage_schema_migrations order by key").all().map((row) => row.key);
+      }
+    } finally {
+      database.close();
+    }
+  } catch (error) {
+    result.error = error instanceof Error ? error.message : String(error);
+  }
+  return result;
+}
+function doctorLineageProfile(selector, runtime) {
+  const checks = [];
+  const result = {
+    checks,
+    ok: false,
+    runtime: {
+      channel: runtime.channel,
+      code_fingerprint: runtime.code?.fingerprint,
+      code_origin: runtime.code?.origin,
+      code_verified: runtime.code?.verified,
+      git_sha: runtime.gitSha,
+      version: runtime.version
+    },
+    schema_version: lineageProfileDoctorSchemaVersion
+  };
+  let profile;
+  try {
+    profile = resolveLineageProfile(selector);
+    result.profile = profile;
+    result.manifest_path = profile.manifest_path;
+    checks.push({ id: "manifest", message: `Loaded ${profile.profile_id}`, status: "pass" });
+  } catch (error) {
+    checks.push({ id: "manifest", message: error instanceof Error ? error.message : String(error), status: "fail" });
+    return result;
+  }
+  try {
+    assertProfileChannel(profile, runtime.channel);
+    checks.push({ id: "runtime_channel", message: `${runtime.channel} code matches ${profile.environment}`, status: "pass" });
+  } catch (error) {
+    checks.push({ id: "runtime_channel", message: error instanceof Error ? error.message : String(error), status: "fail" });
+  }
+  try {
+    assertProfileRuntimePin(profile, runtime);
+    checks.push({ id: "runtime_code", message: `Verified ${runtime.code.origin} code ${runtime.code.fingerprint}`, status: "pass" });
+  } catch (error) {
+    checks.push({ id: "runtime_code", message: error instanceof Error ? error.message : String(error), status: "fail" });
+  }
+  if (profile.expected_runtime?.version && profile.expected_runtime.version !== runtime.version) {
+    checks.push({ id: "runtime_version", message: `Expected version ${profile.expected_runtime.version}, found ${runtime.version}`, status: "fail" });
+  } else {
+    checks.push({ id: "runtime_version", message: `Runtime version ${runtime.version}`, status: "pass" });
+  }
+  if (profile.expected_runtime?.git_sha && profile.expected_runtime.git_sha !== runtime.gitSha) {
+    checks.push({ id: "runtime_git_sha", message: `Expected Git SHA ${profile.expected_runtime.git_sha}, found ${runtime.gitSha || "unavailable"}`, status: "fail" });
+  } else if (profile.expected_runtime?.git_sha) {
+    checks.push({ id: "runtime_git_sha", message: `Git SHA ${runtime.gitSha}`, status: "pass" });
+  }
+  const assetExists = existsSync3(profile.asset_root);
+  const assetIsDirectory = assetExists && statSync3(profile.asset_root).isDirectory();
+  result.asset_root = { exists: assetExists, is_directory: assetIsDirectory, path: profile.asset_root };
+  checks.push({
+    id: "asset_root",
+    message: assetIsDirectory ? `Asset root exists: ${profile.asset_root}` : `Asset root is missing or not a directory: ${profile.asset_root}`,
+    status: assetIsDirectory ? "pass" : "fail"
+  });
+  const database = inspectDatabase(profile);
+  result.database = database;
+  checks.push({
+    id: "database_exists",
+    message: database.exists ? `Database exists: ${profile.database_path}` : `Database does not exist: ${profile.database_path}`,
+    status: database.exists ? "pass" : "fail"
+  });
+  if (database.error) checks.push({ id: "database_read", message: database.error, status: "fail" });
+  if (!database.identity) {
+    checks.push({ id: "database_identity", message: "Database is not bound to a Lineage profile", status: "fail" });
+  } else if (database.identity.profile_id !== profile.profile_id || database.identity.environment !== profile.environment || database.identity.profile_fingerprint !== profile.profile_fingerprint) {
+    checks.push({
+      id: "database_identity",
+      message: `Database identity ${database.identity.profile_id}/${database.identity.environment}/${database.identity.profile_fingerprint || "no-fingerprint"} does not match ${profile.profile_id}/${profile.environment}/${profile.profile_fingerprint}`,
+      status: "fail"
+    });
+  } else {
+    checks.push({ id: "database_identity", message: `Database is bound to ${profile.profile_id}`, status: "pass" });
+  }
+  const missingMigrations = (profile.required_schema_migrations || []).filter((key) => !database.migration_keys.includes(key));
+  checks.push({
+    id: "database_schema",
+    message: missingMigrations.length ? `Missing required schema migrations: ${missingMigrations.join(", ")}` : `${database.migration_keys.length} schema migration marker(s) available`,
+    status: missingMigrations.length ? "fail" : "pass"
+  });
+  result.ok = checks.every((check) => check.status !== "fail");
+  return result;
+}
+function runtimeProfileIdentity(channel) {
+  const selector = process.env.LINEAGE_PROFILE;
+  const id = process.env.LINEAGE_PROFILE_ID;
+  const environment = process.env.LINEAGE_PROFILE_ENVIRONMENT;
+  if (selector && id && environment) {
+    return {
+      bound: true,
+      environment,
+      fingerprint: process.env.LINEAGE_PROFILE_FINGERPRINT,
+      id,
+      manifest_path: process.env.LINEAGE_PROFILE_MANIFEST,
+      service_origin: process.env.LINEAGE_PROFILE_SERVICE_ORIGIN
+    };
+  }
+  return {
+    bound: false,
+    environment: channelEnvironment(channel),
+    id: "legacy-unbound",
+    warning: id || environment || process.env.LINEAGE_PROFILE_FINGERPRINT || process.env.LINEAGE_PROFILE_MANIFEST ? "Invalid unbound runtime: derived profile identity was supplied without a resolved LINEAGE_PROFILE selector." : "Legacy unbound runtime: database and asset paths are not protected by a named profile."
+  };
+}
+function assertRuntimeProfileSafety(channel) {
+  const hasDerivedIdentity = Boolean(
+    process.env.LINEAGE_PROFILE_ID || process.env.LINEAGE_PROFILE_ENVIRONMENT || process.env.LINEAGE_PROFILE_FINGERPRINT || process.env.LINEAGE_PROFILE_MANIFEST || process.env.LINEAGE_PROFILE_SERVICE_ORIGIN
+  );
+  if (hasDerivedIdentity && !process.env.LINEAGE_PROFILE) {
+    throw new Error("Derived Lineage profile identity requires LINEAGE_PROFILE; start through the Lineage CLI with --profile");
+  }
+  const profile = runtimeProfileIdentity(channel);
+  if (profile.bound && profile.environment === "production" && channel !== "stable") {
+    throw new Error(`Refusing to open production profile ${profile.id} from ${channel} code; use the stable channel`);
+  }
+}
+function assertUnselectedDatabaseIsUnbound(runtime) {
+  if (!runtime.schema.profile_id) return;
+  const environment = runtime.schema.profile_environment || "unknown";
+  throw new Error(
+    `Database ${runtime.database.path} is bound to Lineage profile ${runtime.schema.profile_id}/${environment}; select that profile with --profile`
+  );
+}
+function assertResolvedRuntimeProfileEnvironment(profile) {
+  const serviceUrl = new URL(profile.service_origin);
+  const expected = /* @__PURE__ */ new Map([
+    ["LINEAGE_PROFILE_ID", profile.profile_id],
+    ["LINEAGE_PROFILE_ENVIRONMENT", profile.environment],
+    ["LINEAGE_PROFILE_FINGERPRINT", profile.profile_fingerprint],
+    ["LINEAGE_PROFILE_MANIFEST", profile.manifest_path],
+    ["LINEAGE_PROFILE_SERVICE_ORIGIN", profile.service_origin],
+    ["LINEAGE_DB", profile.database_path],
+    ["LINEAGE_ASSET_ROOT", profile.asset_root],
+    ["HOST", serviceUrl.hostname],
+    ["PORT", serviceUrl.port]
+  ]);
+  const conflicts = [];
+  for (const [key, expectedValue] of expected) {
+    const actual = process.env[key];
+    const pathValue = key === "LINEAGE_PROFILE_MANIFEST" || key === "LINEAGE_DB" || key === "LINEAGE_ASSET_ROOT";
+    const matches = actual && (pathValue ? resolve2(actual) === resolve2(expectedValue) : actual === expectedValue);
+    if (!matches) conflicts.push(`${key}=${actual || "(missing)"}`);
+  }
+  if (conflicts.length > 0) {
+    throw new Error(`Resolved profile environment conflicts with ${profile.profile_id}: ${conflicts.join(", ")}`);
+  }
+}
+
+// src/server/profileWriterLease.ts
+var writerLeaseSchemaVersion = "lineage.profile_writer_lease.v1";
+var ownerFileName = "owner.json";
+var ProfileWriterLeaseConflictError = class extends Error {
+  constructor(message, owner) {
+    super(message);
+    this.owner = owner;
+    this.name = "ProfileWriterLeaseConflictError";
+  }
+  owner;
+};
+function profileWriterLockPath(profile) {
+  return join4(dirname3(profile.manifest_path), "writer.lock");
+}
+function ownerPath(lockPath) {
+  return join4(lockPath, ownerFileName);
+}
+function errorCode(error) {
+  return error && typeof error === "object" && "code" in error ? String(error.code) : void 0;
+}
+function readOwner(lockPath) {
+  const stat = lstatSync(lockPath);
+  if (!stat.isDirectory() || stat.isSymbolicLink()) {
+    throw new Error(`Writer lease path is not a safe directory: ${lockPath}; manual inspection is required`);
+  }
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync3(ownerPath(lockPath), "utf8"));
+  } catch (error) {
+    throw new Error(`Writer lease metadata is unreadable at ${lockPath}; refusing automatic recovery`, { cause: error });
+  }
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    throw new Error(`Writer lease metadata is invalid at ${lockPath}; refusing automatic recovery`);
+  }
+  const owner = raw;
+  if (owner.schema_version !== writerLeaseSchemaVersion || typeof owner.profile_id !== "string" || typeof owner.profile_fingerprint !== "string" || !/^[a-f0-9]{64}$/i.test(owner.profile_fingerprint) || owner.environment !== "production" && owner.environment !== "preview" && owner.environment !== "development" || owner.role !== "service" && owner.role !== "cli" || !Number.isSafeInteger(owner.pid) || Number(owner.pid) <= 0 || typeof owner.acquired_at !== "string" || Number.isNaN(Date.parse(owner.acquired_at)) || owner.role === "service" && (typeof owner.service_origin !== "string" || !owner.service_origin) || owner.role === "cli" && owner.service_origin !== void 0 || typeof owner.token !== "string" || owner.token.length < 16) {
+    throw new Error(`Writer lease metadata is invalid at ${lockPath}; refusing automatic recovery`);
+  }
+  return owner;
+}
+function processIsAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    if (errorCode(error) === "ESRCH") return false;
+    return true;
+  }
+}
+function createLeaseDirectory(lockPath, owner) {
+  mkdirSync3(lockPath, { mode: 448 });
+  try {
+    writeFileSync2(ownerPath(lockPath), `${JSON.stringify(owner, null, 2)}
+`, { encoding: "utf8", flag: "wx", mode: 384 });
+  } catch (error) {
+    rmSync2(lockPath, { force: true, recursive: true });
+    throw error;
+  }
+}
+function reclaimDeadOwner(lockPath, owner) {
+  if (processIsAlive(owner.pid)) {
+    const { token: _token, ...publicOwner } = owner;
+    throw new ProfileWriterLeaseConflictError(
+      `Lineage profile ${owner.profile_id} already has an active ${owner.role} writer (pid ${owner.pid}); use that managed service or stop it before starting another writer`,
+      publicOwner
+    );
+  }
+  const tokenFence = createHash3("sha256").update(owner.token).digest("hex").slice(0, 24);
+  const tombstone = `${lockPath}.stale-${owner.pid}-${tokenFence}`;
+  try {
+    renameSync(lockPath, tombstone);
+  } catch (error) {
+    if (errorCode(error) === "ENOENT") return;
+    throw error;
+  }
+  rmSync2(tombstone, { force: true, recursive: true });
+}
+function acquireProfileWriterLease(profile, channel, role = "service") {
+  assertProfileChannel(profile, channel);
+  const lockPath = profileWriterLockPath(profile);
+  const owner = {
+    acquired_at: (/* @__PURE__ */ new Date()).toISOString(),
+    environment: profile.environment,
+    pid: process.pid,
+    profile_fingerprint: profile.profile_fingerprint,
+    profile_id: profile.profile_id,
+    role,
+    schema_version: writerLeaseSchemaVersion,
+    ...role === "service" ? { service_origin: profile.service_origin } : {},
+    token: randomUUID2()
+  };
+  for (let attempt = 0; attempt < 4; attempt += 1) {
+    try {
+      createLeaseDirectory(lockPath, owner);
+      process.env.LINEAGE_WRITER_LEASE_TOKEN = owner.token;
+      process.env.LINEAGE_WRITER_LOCK_PATH = lockPath;
+      const { token: _token, ...publicOwner } = owner;
+      let released = false;
+      return {
+        authenticate: (candidate) => {
+          if (!candidate) return false;
+          const expected = Buffer.from(owner.token);
+          const actual = Buffer.from(candidate);
+          return actual.length === expected.length && timingSafeEqual(actual, expected);
+        },
+        lock_path: lockPath,
+        owner: publicOwner,
+        release: () => {
+          if (released) return;
+          released = true;
+          try {
+            const current = readOwner(lockPath);
+            if (current.token === owner.token && current.pid === owner.pid) rmSync2(lockPath, { force: true, recursive: true });
+          } catch {
+          }
+          if (process.env.LINEAGE_WRITER_LEASE_TOKEN === owner.token) delete process.env.LINEAGE_WRITER_LEASE_TOKEN;
+          if (process.env.LINEAGE_WRITER_LOCK_PATH === lockPath) delete process.env.LINEAGE_WRITER_LOCK_PATH;
+        }
+      };
+    } catch (error) {
+      if (errorCode(error) !== "EEXIST") throw error;
+      let existing;
+      try {
+        existing = readOwner(lockPath);
+      } catch (readError) {
+        if (errorCode(readError) === "ENOENT") continue;
+        throw readError;
+      }
+      if (existing.profile_id !== profile.profile_id || existing.environment !== profile.environment || existing.profile_fingerprint !== profile.profile_fingerprint) {
+        throw new Error(`Writer lease identity at ${lockPath} does not match ${profile.profile_id}/${profile.environment}; manual inspection is required`, { cause: error });
+      }
+      reclaimDeadOwner(lockPath, existing);
+    }
+  }
+  throw new Error(`Could not acquire writer lease for Lineage profile ${profile.profile_id}; another writer is racing for ownership`);
+}
+function assertProfileWriterLeaseHeld() {
+  if (!process.env.LINEAGE_PROFILE) {
+    throw new Error("Persistent writes require a selected named Lineage profile and its writer lease; legacy-unbound access is read-only");
+  }
+  const profileId = process.env.LINEAGE_PROFILE_ID;
+  const profileFingerprint = process.env.LINEAGE_PROFILE_FINGERPRINT;
+  const environment = process.env.LINEAGE_PROFILE_ENVIRONMENT;
+  const manifestPath = process.env.LINEAGE_PROFILE_MANIFEST;
+  const lockPath = process.env.LINEAGE_WRITER_LOCK_PATH;
+  const token = process.env.LINEAGE_WRITER_LEASE_TOKEN;
+  if (!profileId || !profileFingerprint || !environment || !manifestPath || !lockPath || !token) {
+    throw new Error("Named Lineage profiles may write only through a process holding the profile writer lease");
+  }
+  const expectedLockPath = join4(dirname3(resolve3(manifestPath)), "writer.lock");
+  if (resolve3(lockPath) !== expectedLockPath) throw new Error("Profile writer lease path does not match the selected profile manifest");
+  const owner = readOwner(lockPath);
+  if (owner.pid !== process.pid || owner.token !== token || owner.profile_id !== profileId || owner.profile_fingerprint !== profileFingerprint || owner.environment !== environment) {
+    throw new Error("Current process does not own the selected Lineage profile writer lease");
+  }
+}
+function assertSelectedProfileDatabaseIdentity(database) {
+  const profileId = process.env.LINEAGE_PROFILE_ID;
+  const environment = process.env.LINEAGE_PROFILE_ENVIRONMENT;
+  const profileFingerprint = process.env.LINEAGE_PROFILE_FINGERPRINT;
+  if (!process.env.LINEAGE_PROFILE || !profileId || !environment || !profileFingerprint) {
+    throw new Error("Writable SQLite identity validation requires a fully resolved named Lineage profile");
+  }
+  const table = database.prepare("select name from sqlite_master where type = 'table' and name = 'lineage_profile_identity'").get();
+  if (!table) throw new Error(`Refusing writable open: database is not bound to Lineage profile ${profileId}`);
+  const columns = new Set(database.prepare("pragma table_info(lineage_profile_identity)").all().map((row) => row.name));
+  if (!columns.has("profile_id") || !columns.has("environment") || !columns.has("profile_fingerprint")) {
+    throw new Error(`Refusing writable open: database identity for ${profileId} is missing required fingerprint fields`);
+  }
+  const rows = database.prepare("select profile_id, environment, profile_fingerprint from lineage_profile_identity").all();
+  if (rows.length !== 1) throw new Error(`Refusing writable open: expected exactly one database profile identity, found ${rows.length}`);
+  const identity = rows[0];
+  if (identity.profile_id !== profileId || identity.environment !== environment || identity.profile_fingerprint !== profileFingerprint) {
+    throw new Error(
+      `Refusing writable open: database identity ${String(identity.profile_id)}/${String(identity.environment)}/${String(identity.profile_fingerprint)} does not match selected profile ${profileId}/${environment}/${profileFingerprint}`
+    );
+  }
+}
+
+// src/server/assetLineageDb.ts
+var require3 = createRequire2(import.meta.url);
 function nowIso() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
 function lineageDbPath() {
-  return process.env.LINEAGE_DB || join3(packageRoot, ".lineage", "asset-lineage.sqlite");
+  return process.env.LINEAGE_DB || join5(packageRoot, ".lineage", "asset-lineage.sqlite");
 }
 function lineageDb() {
-  mkdirSync2(join3(lineageDbPath(), ".."), { recursive: true });
-  const { DatabaseSync } = require2("node:sqlite");
-  const database = new DatabaseSync(lineageDbPath());
+  const readOnly = process.env.LINEAGE_DB_ACCESS === "read-only";
+  if (!readOnly) assertProfileWriterLeaseHeld();
+  if (!readOnly && !existsSync5(lineageDbPath())) {
+    throw new Error(`Refusing writable open of missing profile database ${lineageDbPath()}; bind an existing database or create a non-production clone first`);
+  }
+  if (!readOnly) mkdirSync4(join5(lineageDbPath(), ".."), { recursive: true });
+  const { DatabaseSync } = require3("node:sqlite");
+  const database = readOnly ? new DatabaseSync(lineageDbPath(), { readOnly: true }) : new DatabaseSync(lineageDbPath());
+  if (process.env.LINEAGE_PROFILE) assertSelectedProfileDatabaseIdentity(database);
   database.exec("PRAGMA foreign_keys = ON");
   database.exec("PRAGMA busy_timeout = 5000");
+  if (readOnly) return database;
+  database.exec("PRAGMA journal_mode = WAL");
   database.exec(`
     create table if not exists projects (
       id text primary key,
@@ -1131,21 +1706,21 @@ function ledgerWorkflowStates(database, project, records, sources) {
 
 // src/server/assetCore.ts
 function isPackageRoot(path) {
-  const packageJson = join4(path, "package.json");
-  if (!existsSync3(packageJson)) return false;
+  const packageJson = join6(path, "package.json");
+  if (!existsSync6(packageJson)) return false;
   try {
-    const packageInfo2 = JSON.parse(readFileSync2(packageJson, "utf8"));
+    const packageInfo2 = JSON.parse(readFileSync4(packageJson, "utf8"));
     return packageInfo2.name === "@mean-weasel/lineage";
   } catch {
     return false;
   }
 }
 function resolvePackageRoot() {
-  const moduleDir = dirname2(fileURLToPath(import.meta.url));
+  const moduleDir = dirname4(fileURLToPath(import.meta.url));
   const candidates = [
     process.env.LINEAGE_REPO_ROOT,
-    resolve2(moduleDir, ".."),
-    resolve2(moduleDir, "../.."),
+    resolve4(moduleDir, ".."),
+    resolve4(moduleDir, "../.."),
     process.cwd()
   ].filter((candidate) => Boolean(candidate));
   const root = candidates.find(isPackageRoot);
@@ -1153,7 +1728,11 @@ function resolvePackageRoot() {
   return root;
 }
 var packageRoot = resolvePackageRoot();
-var repoRoot = resolve2(process.env.LINEAGE_ASSET_ROOT || packageRoot);
+var repoRoot = resolve4(process.env.LINEAGE_ASSET_ROOT || packageRoot);
+function setLineageAssetRoot(path) {
+  repoRoot = resolve4(path || packageRoot);
+  return repoRoot;
+}
 var defaultProject = "demo-project";
 var defaultProduct = process.env.LINEAGE_DEFAULT_PRODUCT || defaultProject;
 var publicFallbackBucket = "lineage-demo-assets";
@@ -1179,16 +1758,16 @@ function cleanProject(project = defaultProject) {
   return project;
 }
 function catalogPath(project = defaultProject) {
-  return join4(repoRoot, cleanProject(project), "assets", "catalog.json");
+  return join6(repoRoot, cleanProject(project), "assets", "catalog.json");
 }
 function fixtureCatalogPath(project = defaultProject) {
-  return join4(packageRoot, "fixtures", cleanProject(project), "assets", "catalog.json");
+  return join6(packageRoot, "fixtures", cleanProject(project), "assets", "catalog.json");
 }
 function resolvedCatalogPath(project = defaultProject) {
   const path = catalogPath(project);
-  if (existsSync3(path)) return path;
+  if (existsSync6(path)) return path;
   const clean = cleanProject(project);
-  if (clean === defaultProject && existsSync3(fixtureCatalogPath(clean))) return fixtureCatalogPath(clean);
+  if (clean === defaultProject && existsSync6(fixtureCatalogPath(clean))) return fixtureCatalogPath(clean);
   return path;
 }
 function normalizeCatalog(catalog, fallbackProject = defaultProject) {
@@ -1305,7 +1884,7 @@ function defaultFallbackCatalog() {
   }, defaultProject);
 }
 function isDefaultFallbackCatalog(catalog) {
-  return catalog.project === defaultProject && !existsSync3(catalogPath(defaultProject));
+  return catalog.project === defaultProject && !existsSync6(catalogPath(defaultProject));
 }
 function fallbackPreviewDataUrl(asset) {
   const label = `${asset.title}
@@ -1318,9 +1897,9 @@ function escapeSvgText2(value) {
 }
 function loadCatalog(project = defaultProject) {
   const path = catalogPath(project);
-  if (existsSync3(path)) {
+  if (existsSync6(path)) {
     try {
-      return normalizeCatalog(JSON.parse(readFileSync2(path, "utf8")), project);
+      return normalizeCatalog(JSON.parse(readFileSync4(path, "utf8")), project);
     } catch (error) {
       if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") {
         throw new LineageAssetError(`Missing catalog: ${path}`, 404);
@@ -1331,8 +1910,8 @@ function loadCatalog(project = defaultProject) {
   const clean = cleanProject(project);
   if (clean === defaultProject) {
     const fixturePath = fixtureCatalogPath(clean);
-    if (existsSync3(fixturePath)) {
-      return normalizeCatalog(JSON.parse(readFileSync2(fixturePath, "utf8")), project);
+    if (existsSync6(fixturePath)) {
+      return normalizeCatalog(JSON.parse(readFileSync4(fixturePath, "utf8")), project);
     }
     return defaultFallbackCatalog();
   }
@@ -1340,8 +1919,8 @@ function loadCatalog(project = defaultProject) {
 }
 function saveCatalog(project, catalog) {
   const normalized = normalizeCatalog(catalog, project);
-  mkdirSync3(dirname2(catalogPath(project)), { recursive: true });
-  writeFileSync(catalogPath(project), `${JSON.stringify(normalized, null, 2)}
+  mkdirSync5(dirname4(catalogPath(project)), { recursive: true });
+  writeFileSync3(catalogPath(project), `${JSON.stringify(normalized, null, 2)}
 `);
   return normalized;
 }
@@ -1366,7 +1945,7 @@ function runAws(args) {
   return run("aws", args);
 }
 function listProjects() {
-  const projects = readdirSync2(repoRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory() && projectNamePattern.test(entry.name) && existsSync3(catalogPath(entry.name))).flatMap((entry) => {
+  const projects = readdirSync2(repoRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory() && projectNamePattern.test(entry.name) && existsSync6(catalogPath(entry.name))).flatMap((entry) => {
     try {
       const catalog = loadCatalog(entry.name);
       return [{ project: catalog.project, product: catalog.product, catalogPath: resolvedCatalogPath(entry.name), default_bucket: catalog.default_bucket, default_region: catalog.default_region, asset_count: catalog.assets.length }];
@@ -1525,15 +2104,15 @@ function deleteObjectGuarded(project, assetId, confirmation) {
   return storageAdapter.deleteObjectGuarded(project, assetId, confirmation);
 }
 function ensureUploadDir() {
-  const dir = join4(repoRoot, ".asset-scratch", "studio-uploads");
-  mkdirSync3(dir, { recursive: true });
+  const dir = join6(repoRoot, ".asset-scratch", "studio-uploads");
+  mkdirSync5(dir, { recursive: true });
   return dir;
 }
 function cleanupUploadedTemp(file) {
   if (!file) return;
   const uploadRoot = ensureUploadDir();
-  const resolved = resolve2(file);
-  if (resolved.startsWith(`${uploadRoot}/`) && existsSync3(resolved)) {
+  const resolved = resolve4(file);
+  if (resolved.startsWith(`${uploadRoot}/`) && existsSync6(resolved)) {
     unlinkSync(resolved);
   }
 }
@@ -1567,7 +2146,7 @@ function lookupAssets(project, assetIds) {
 }
 
 // src/server/assetLineage.ts
-import { join as join5 } from "node:path";
+import { join as join7 } from "node:path";
 
 // src/server/assetLineageSelection.ts
 var LINEAGE_NEXT_VARIATION_LIMIT = 3;
@@ -1590,7 +2169,7 @@ function normalizeSelectionInput(fields) {
 import { randomBytes as randomBytes2 } from "node:crypto";
 
 // src/server/agentClaims.ts
-import { createHash as createHash2, randomBytes, timingSafeEqual } from "node:crypto";
+import { createHash as createHash4, randomBytes, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
 var defaultTtlSeconds = 20 * 60;
 var idleAfterSeconds = 5 * 60;
 var staleAfterSeconds = 15 * 60;
@@ -1626,12 +2205,12 @@ function randomId(prefix) {
   return `${prefix}_${Date.now().toString(36)}_${randomBytes(6).toString("base64url").toLowerCase()}`;
 }
 function tokenHash(token) {
-  return createHash2("sha256").update(token).digest("hex");
+  return createHash4("sha256").update(token).digest("hex");
 }
 function safeEqual(a, b) {
   const left = Buffer.from(a);
   const right = Buffer.from(b);
-  return left.length === right.length && timingSafeEqual(left, right);
+  return left.length === right.length && timingSafeEqual2(left, right);
 }
 function expiresAtFrom(timestamp, ttlSeconds) {
   return new Date(new Date(timestamp).getTime() + ttlSeconds * 1e3).toISOString();
@@ -1658,6 +2237,12 @@ function derivedState(row, now = /* @__PURE__ */ new Date()) {
 }
 function rowToClaim(row, now = /* @__PURE__ */ new Date()) {
   const heartbeatAt = String(row.heartbeat_at);
+  const persistedStatus = String(row.status);
+  const state = derivedState({
+    expires_at: String(row.expires_at),
+    heartbeat_at: heartbeatAt,
+    status: persistedStatus
+  }, now);
   return {
     id: String(row.id),
     project: String(row.project_id),
@@ -1669,7 +2254,7 @@ function rowToClaim(row, now = /* @__PURE__ */ new Date()) {
     agent_name: String(row.agent_name),
     agent_kind: String(row.agent_kind),
     thread_id: typeof row.thread_id === "string" ? row.thread_id : void 0,
-    status: String(row.status),
+    status: persistedStatus === "active" && state === "expired" ? "expired" : persistedStatus,
     created_at: String(row.created_at),
     heartbeat_at: heartbeatAt,
     expires_at: String(row.expires_at),
@@ -1679,11 +2264,7 @@ function rowToClaim(row, now = /* @__PURE__ */ new Date()) {
     override_reason: typeof row.override_reason === "string" ? row.override_reason : void 0,
     metadata: parseMetadata(row.metadata_json),
     heartbeat_age_seconds: Math.max(0, Math.floor((now.getTime() - new Date(heartbeatAt).getTime()) / 1e3)),
-    derived_state: derivedState({
-      expires_at: String(row.expires_at),
-      heartbeat_at: heartbeatAt,
-      status: String(row.status)
-    }, now)
+    derived_state: state
   };
 }
 function eventToRow(row) {
@@ -1825,7 +2406,7 @@ function createAgentClaim(fields) {
 function listAgentClaims(project) {
   const database = lineageDb();
   try {
-    expireActiveClaims(database);
+    if (process.env.LINEAGE_DB_ACCESS !== "read-only") expireActiveClaims(database);
     const rows = project ? database.prepare("select * from agent_claims where project_id = ? order by status, heartbeat_at desc").all(project) : database.prepare("select * from agent_claims order by project_id, status, heartbeat_at desc").all();
     return { ok: true, claims: rows.map((row) => rowToClaim(row)), fetchedAt: nowIso() };
   } finally {
@@ -1835,7 +2416,7 @@ function listAgentClaims(project) {
 function inspectAgentClaim(claimId, project) {
   const database = lineageDb();
   try {
-    expireActiveClaims(database);
+    if (process.env.LINEAGE_DB_ACCESS !== "read-only") expireActiveClaims(database);
     const claim = findClaimById(database, claimId, project);
     if (!claim) throw new AgentClaimError(`Unknown agent claim: ${claimId}`, 404, "claim_not_found");
     const events = database.prepare("select * from agent_claim_events where claim_id = ? order by created_at").all(claim.id);
@@ -2462,6 +3043,44 @@ function cancelLineageIterateTasksForAssets(project, fields) {
     taskId: task.id
   }));
 }
+function resolveLineageTask(project, fields) {
+  const normalizedProject = normalizeProject(project);
+  const actor = normalizeActor(fields.actor, "Resolve actor");
+  const database = lineageDb();
+  try {
+    const task = requireTask(database, normalizedProject, fields.taskId);
+    if (fields.resolvedAssetId) requireAsset(database, normalizedProject, fields.resolvedAssetId);
+    if (task.status === "resolved") return { project: normalizedProject, ok: true, task, events: taskEvents(database, task.id) };
+    if (!["pending", "claimed", "in_progress"].includes(task.status)) {
+      throw new LineageTaskError(`Only open lineage tasks can be resolved; task is ${task.status}.`, 409);
+    }
+    const timestamp = nowIso();
+    const resolvedTask = {
+      ...task,
+      status: "resolved",
+      resolved_asset_id: fields.resolvedAssetId,
+      resolved_at: timestamp,
+      resolved_generation_job_id: fields.resolvedGenerationJobId,
+      updated_at: timestamp
+    };
+    if (!fields.confirmWrite) return { project: normalizedProject, ok: true, dryRun: true, task: resolvedTask, events: taskEvents(database, task.id) };
+    transaction(database, () => {
+      const result = database.prepare(`
+        update lineage_tasks
+        set status = 'resolved', resolved_at = ?, resolved_generation_job_id = ?, resolved_asset_id = ?, updated_at = ?
+        where id = ? and status = ?
+      `).run(timestamp, fields.resolvedGenerationJobId || null, fields.resolvedAssetId || null, timestamp, task.id, task.status);
+      assertChanged(result, `Only ${task.status} lineage task ${task.id} could be resolved.`);
+      recordEvent2(database, task.id, "resolved", actor, "Lineage task resolved.", {
+        resolved_asset_id: fields.resolvedAssetId,
+        resolved_generation_job_id: fields.resolvedGenerationJobId
+      });
+    });
+    return taskWithEvents(database, normalizedProject, task.id);
+  } finally {
+    database.close();
+  }
+}
 
 // src/server/assetLineageWorkspaces.ts
 var actors = /* @__PURE__ */ new Set(["human", "agent", "system"]);
@@ -2536,9 +3155,18 @@ function knownRoots(database, project) {
       and parent_asset_id not in (select child_asset_id from asset_edges where project_id = ?)
     group by parent_asset_id
   `).all(project, project, project, project);
-  return rows.map((row) => ({ root_asset_id: row.root_asset_id, selected_at: row.selected_at || void 0 }));
+  const roots = /* @__PURE__ */ new Map();
+  for (const row of rows) {
+    const existing = roots.get(row.root_asset_id);
+    roots.set(row.root_asset_id, {
+      root_asset_id: row.root_asset_id,
+      selected_at: row.selected_at || existing?.selected_at
+    });
+  }
+  return [...roots.values()];
 }
 function seedLegacyWorkspaces(database, project) {
+  if (process.env.LINEAGE_DB_ACCESS === "read-only") return;
   ensureProject3(database, project);
   const timestamp = nowIso();
   const statement = database.prepare(`
@@ -2562,6 +3190,34 @@ function seedLegacyWorkspaces(database, project) {
     );
   }
 }
+function inferredLegacyWorkspaces(database, project) {
+  if (process.env.LINEAGE_DB_ACCESS !== "read-only") return [];
+  const persistedRoots = new Set(
+    database.prepare("select root_asset_id from lineage_workspaces where project_id = ?").all(project).map((row) => row.root_asset_id)
+  );
+  const asset = database.prepare("select id, title from assets where project_id = ? and id = ?");
+  return knownRoots(database, project).flatMap((root) => {
+    if (persistedRoots.has(root.root_asset_id)) return [];
+    const row = asset.get(project, root.root_asset_id);
+    if (!row) return [];
+    const timestamp = root.selected_at || nowIso();
+    return [{
+      active_at: root.selected_at,
+      created_at: timestamp,
+      created_by: "system",
+      id: lineageWorkspaceId(project, root.root_asset_id),
+      project,
+      root_asset_id: root.root_asset_id,
+      status: "active",
+      title: `${row.title} lineage`,
+      updated_at: timestamp
+    }];
+  });
+}
+function sortWorkspaces(workspaces) {
+  const statusRank = { active: 0, paused: 1, archived: 2 };
+  return workspaces.sort((left, right) => statusRank[left.status] - statusRank[right.status] || (right.active_at || "").localeCompare(left.active_at || "") || right.updated_at.localeCompare(left.updated_at) || left.title.localeCompare(right.title));
+}
 function listRows(database, project) {
   return database.prepare(`
     select * from lineage_workspaces
@@ -2573,23 +3229,15 @@ function listRows(database, project) {
       title
   `).all(project).map(rowToWorkspace);
 }
-function activeWorkspace(database, project) {
-  const row = database.prepare(`
-    select * from lineage_workspaces
-    where project_id = ? and status != 'archived'
-    order by active_at desc nulls last, updated_at desc
-    limit 1
-  `).get(project);
-  return row ? rowToWorkspace(row) : null;
-}
 function listLineageWorkspaces(project) {
   const database = lineageDb();
   try {
     seedLegacyWorkspaces(database, project);
+    const workspaces = sortWorkspaces([...listRows(database, project), ...inferredLegacyWorkspaces(database, project)]);
     return {
       project,
-      active_workspace: activeWorkspace(database, project),
-      workspaces: listRows(database, project),
+      active_workspace: workspaces.find((workspace) => workspace.status !== "archived") || null,
+      workspaces,
       fetchedAt: nowIso()
     };
   } finally {
@@ -2600,7 +3248,7 @@ function inspectLineageWorkspace(project, workspaceId) {
   const database = lineageDb();
   try {
     seedLegacyWorkspaces(database, project);
-    const workspace = workspaceById(database, project, workspaceId) || workspaceByRoot(database, project, workspaceId);
+    const workspace = workspaceById(database, project, workspaceId) || workspaceByRoot(database, project, workspaceId) || inferredLegacyWorkspaces(database, project).find((item) => item.id === workspaceId || item.root_asset_id === workspaceId);
     if (!workspace) throw new LineageWorkspaceError(`Unknown lineage workspace: ${workspaceId}`, 404);
     return workspace;
   } finally {
@@ -2732,7 +3380,7 @@ function activeLineageWorkspaceRoot(project) {
   const database = lineageDb();
   try {
     seedLegacyWorkspaces(database, project);
-    return activeWorkspace(database, project)?.root_asset_id;
+    return sortWorkspaces([...listRows(database, project), ...inferredLegacyWorkspaces(database, project)]).find((workspace) => workspace.status !== "archived")?.root_asset_id;
   } finally {
     database.close();
   }
@@ -2794,7 +3442,7 @@ function upsertProject(database, project) {
     insert into projects (id, product, catalog_path, created_at, updated_at)
     values (?, ?, ?, ?, ?)
     on conflict(id) do update set product = excluded.product, updated_at = excluded.updated_at
-  `).run(project, project, join5(repoRoot, project, "assets", "catalog.json"), timestamp, timestamp);
+  `).run(project, project, join7(repoRoot, project, "assets", "catalog.json"), timestamp, timestamp);
 }
 function upsertAsset(database, project, asset) {
   const timestamp = nowIso();
@@ -2865,8 +3513,8 @@ function rootFor(database, project, assetId) {
 }
 function assertCanonicalRoot(database, project, root) {
   requireAsset3(database, project, root);
-  const canonicalRoot = rootFor(database, project, root);
-  if (canonicalRoot !== root) throw new LineageError(`Asset ${root} is not a lineage root`, 400);
+  const canonicalRoot2 = rootFor(database, project, root);
+  if (canonicalRoot2 !== root) throw new LineageError(`Asset ${root} is not a lineage root`, 400);
 }
 function explicitWorkspaceRoot(database, project, assetId) {
   const row = database.prepare(`
@@ -3013,6 +3661,13 @@ function assertNodeInRoot(database, project, root, node) {
   const nodeRoot = rootFor(database, project, node);
   if (nodeRoot !== root) throw new LineageError(`Asset ${node} is not in lineage rooted at ${root}`);
 }
+function assertAttemptAssetNotVisibleLineageNode(database, project, root, assetId) {
+  const visibleNodeIds = /* @__PURE__ */ new Set([
+    root,
+    ...descendants(database, project, root).flatMap((edge) => [edge.parent_asset_id, edge.child_asset_id])
+  ]);
+  if (visibleNodeIds.has(assetId)) throw new LineageError(`Attempt asset ${assetId} is already a visible lineage node in ${root}`, 400);
+}
 function canPreviewLocally(mediaType, localPath) {
   return Boolean(localPath && ["image", "video", "gif"].includes(mediaType));
 }
@@ -3387,6 +4042,74 @@ function promoteLineageAttempt(project, fields) {
     database.close();
   }
 }
+function recordLineageRerollAttempt(project, fields) {
+  const database = lineageDb();
+  try {
+    assertNodeInRoot(database, project, fields.rootAssetId, fields.nodeAssetId);
+    requireAsset3(database, project, fields.assetId);
+    assertAttemptAssetNotVisibleLineageNode(database, project, fields.rootAssetId, fields.assetId);
+    const timestamp = nowIso();
+    const maxRow = database.prepare("select max(attempt_index) max_index from asset_attempts where project_id = ? and node_asset_id = ?").get(project, fields.nodeAssetId);
+    const attemptIndex = Number(maxRow.max_index || 1) + 1;
+    const attempt = {
+      id: `${project}:${fields.nodeAssetId}:attempt:${attemptIndex}`,
+      project_id: project,
+      node_asset_id: fields.nodeAssetId,
+      asset_id: fields.assetId,
+      attempt_index: attemptIndex,
+      source: "reroll",
+      prompt: fields.prompt,
+      generation_job_id: fields.generationJobId,
+      file_path: fields.filePath,
+      checksum_sha256: fields.checksumSha256,
+      created_at: timestamp,
+      promoted_at: timestamp,
+      is_current: true
+    };
+    if (!fields.confirmWrite) return { ok: true, dryRun: true, attempt };
+    database.exec("BEGIN IMMEDIATE");
+    try {
+      database.prepare("update asset_attempts set is_current = 0 where project_id = ? and node_asset_id = ?").run(project, fields.nodeAssetId);
+      database.prepare(`
+        insert into asset_attempts (
+          id, project_id, node_asset_id, asset_id, attempt_index, source, prompt, generation_job_id,
+          file_path, checksum_sha256, created_at, promoted_at, is_current
+        ) values (?, ?, ?, ?, ?, 'reroll', ?, ?, ?, ?, ?, ?, 1)
+      `).run(
+        attempt.id,
+        project,
+        fields.nodeAssetId,
+        fields.assetId,
+        attempt.attempt_index,
+        fields.prompt,
+        fields.generationJobId,
+        fields.filePath,
+        fields.checksumSha256,
+        timestamp,
+        timestamp
+      );
+      database.prepare(`
+        update asset_reroll_requests
+        set status = 'resolved', resolved_at = ?
+        where project_id = ? and root_asset_id = ? and node_asset_id = ? and status = 'pending'
+      `).run(timestamp, project, fields.rootAssetId, fields.nodeAssetId);
+      database.prepare(`
+        insert into asset_reviews (asset_id, review_state, reviewed_at, ignored_at, notes, updated_at)
+        values (?, 'unreviewed', ?, null, null, ?)
+        on conflict(asset_id) do update set
+          review_state = excluded.review_state, reviewed_at = excluded.reviewed_at,
+          ignored_at = excluded.ignored_at, updated_at = excluded.updated_at
+      `).run(fields.nodeAssetId, timestamp, timestamp);
+      database.exec("COMMIT");
+    } catch (error) {
+      database.exec("ROLLBACK");
+      throw error;
+    }
+    return { ok: true, attempt };
+  } finally {
+    database.close();
+  }
+}
 function markLineageRerollRequest(project, fields) {
   const database = lineageDb();
   try {
@@ -3583,16 +4306,34 @@ function updateAssetReview(project, fields) {
   return { ok: true, message: `Marked ${fields.assetId} ${fields.reviewState}`, asset_id: fields.assetId, review_state: fields.reviewState };
 }
 
-// src/server/assetLineageHandoff.ts
-var publicPackageCommand = "npx @mean-weasel/lineage";
+// src/server/lineageRuntimeCommand.ts
+import { existsSync as existsSync7 } from "node:fs";
+import { createRequire as createRequire3 } from "node:module";
+import { join as join8 } from "node:path";
+var require4 = createRequire3(import.meta.url);
+function lineagePublicPackageCommand() {
+  if (process.env.LINEAGE_CHANNEL === "dev") {
+    const sourceCli = join8(packageRoot, "src", "cli", "lineage-dev.ts");
+    const builtCli = join8(packageRoot, "dist", "cli", "lineage-dev.js");
+    return existsSync7(sourceCli) ? `${shellQuote(process.execPath)} --import ${shellQuote(require4.resolve("tsx"))} ${shellQuote(sourceCli)}` : `${shellQuote(process.execPath)} ${shellQuote(builtCli)}`;
+  }
+  if (process.env.LINEAGE_CHANNEL === "preview") return "LINEAGE_CHANNEL=preview npx --package @mean-weasel/lineage@next lineage-dev";
+  return "npx @mean-weasel/lineage";
+}
 function shellQuote(value) {
   return `'${value.replace(/'/g, "'\\''")}'`;
 }
+function lineageRuntimeSelector() {
+  const manifest = process.env.LINEAGE_PROFILE_MANIFEST?.trim();
+  return manifest ? `--profile ${shellQuote(manifest)}` : `--db ${shellQuote(lineageDbPath())}`;
+}
+
+// src/server/assetLineageHandoff.ts
 function lineageCommand(command, project, rootAssetId) {
-  return `${publicPackageCommand} ${command} --project ${shellQuote(project)} --root ${shellQuote(rootAssetId)} --db ${shellQuote(lineageDbPath())} --json`;
+  return `${lineagePublicPackageCommand()} ${command} --project ${shellQuote(project)} --root ${shellQuote(rootAssetId)} ${lineageRuntimeSelector()} --json`;
 }
 function linkChildCommand(project, rootAssetId) {
-  return `${publicPackageCommand} link-child --project ${shellQuote(project)} --root ${shellQuote(rootAssetId)} --child <asset-id> --confirm-write --db ${shellQuote(lineageDbPath())} --json`;
+  return `${lineagePublicPackageCommand()} link-child --project ${shellQuote(project)} --root ${shellQuote(rootAssetId)} --child <asset-id> --confirm-write ${lineageRuntimeSelector()} --json`;
 }
 function rerollImportGuidance(rootAssetId, targetAssetId) {
   return `Use lineage reroll plan --root ${rootAssetId} --target ${targetAssetId} and lineage reroll import instead.`;
@@ -3634,7 +4375,7 @@ function getLineageBrief(project, rootAssetId) {
     },
     handoff: {
       next_command: lineageCommand("next", project, next.root_asset_id),
-      inspect_command: asset ? `${publicPackageCommand} inspect --project ${shellQuote(project)} --asset-id ${shellQuote(asset.asset_id)} --db ${shellQuote(lineageDbPath())} --json` : void 0,
+      inspect_command: asset ? `${lineagePublicPackageCommand()} inspect --project ${shellQuote(project)} --asset-id ${shellQuote(asset.asset_id)} ${lineageRuntimeSelector()} --json` : void 0,
       link_child_command: asset ? linkChildCommand(project, next.root_asset_id) : void 0
     },
     fetchedAt: nowIso()
@@ -5020,9 +5761,9 @@ function ensureProject5(database, project) {
     on conflict(id) do update set product = excluded.product, updated_at = excluded.updated_at
   `).run(project, project, timestamp, timestamp);
 }
-function definitionFor(adapterType, provider) {
-  const definition = definitions.find((item) => item.adapter_type === adapterType && item.provider === provider);
-  if (!definition) throw new AdapterSettingsError(`Unsupported adapter setting: ${adapterType}/${provider}`, 404);
+function definitionFor(adapterType, provider2) {
+  const definition = definitions.find((item) => item.adapter_type === adapterType && item.provider === provider2);
+  if (!definition) throw new AdapterSettingsError(`Unsupported adapter setting: ${adapterType}/${provider2}`, 404);
   return definition;
 }
 function seedDefaults(database, project) {
@@ -5054,22 +5795,22 @@ function parseConfig(value) {
     return {};
   }
 }
-function credentialFor(provider, env) {
-  if (provider === "s3") {
+function credentialFor(provider2, env) {
+  if (provider2 === "s3") {
     return { detected: false, label: "Optional local cloud CLI credential", secret_ref: null };
   }
-  if (provider === "buffer") {
+  if (provider2 === "buffer") {
     const detected = Boolean(env.LINEAGE_SCHEDULER_TOKEN && env.LINEAGE_SCHEDULER_ORGANIZATION_ID);
     return { detected, label: "LINEAGE_SCHEDULER_TOKEN + LINEAGE_SCHEDULER_ORGANIZATION_ID", secret_ref: "env:LINEAGE_SCHEDULER_TOKEN" };
   }
   return { detected: true, label: "No external secret required", secret_ref: null };
 }
-function healthStatus(provider, enabled, config, credential) {
-  if (provider === "s3") {
+function healthStatus(provider2, enabled, config, credential) {
+  if (provider2 === "s3") {
     if (!enabled) return "live_disabled";
     return config.bucket && config.region ? "not_tested" : "missing_config";
   }
-  if (provider === "buffer") {
+  if (provider2 === "buffer") {
     if (!enabled) return "live_disabled";
     return credential.detected ? "configured" : "dry_run_available";
   }
@@ -5245,8 +5986,8 @@ function getAdapterStatus(project, env = process.env) {
 }
 
 // src/server/adapters/posting/bufferPostingService.ts
-import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync2 } from "node:fs";
-import { join as join6 } from "node:path";
+import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync4 } from "node:fs";
+import { join as join9 } from "node:path";
 
 // src/server/contentPostHandoff.ts
 function readinessForPost(post) {
@@ -5742,12 +6483,12 @@ function resolvePost(project, fields) {
   throw new PostingAdapterError("Buffer dry run requires postId or target=selected");
 }
 function payloadPath(project, postId) {
-  return join6(repoRoot, ".asset-scratch", "buffer-dry-runs", safeSegment(project), `${safeSegment(postId)}.json`);
+  return join9(repoRoot, ".asset-scratch", "buffer-dry-runs", safeSegment(project), `${safeSegment(postId)}.json`);
 }
 function writePayload(project, postId, payload) {
   const file = payloadPath(project, postId);
-  mkdirSync4(join6(file, ".."), { recursive: true });
-  writeFileSync2(file, `${JSON.stringify(payload, null, 2)}
+  mkdirSync6(join9(file, ".."), { recursive: true });
+  writeFileSync4(file, `${JSON.stringify(payload, null, 2)}
 `);
   return file;
 }
@@ -5856,11 +6597,11 @@ function registerAdapterRoutes(app2, projectFrom2, asyncRoute2) {
 import { Router } from "express";
 
 // src/server/contentBatchImport.ts
-import { existsSync as existsSync4, readdirSync as readdirSync3, readFileSync as readFileSync3 } from "node:fs";
-import { basename as basename3, join as join7, relative as relative2 } from "node:path";
+import { existsSync as existsSync8, readdirSync as readdirSync3, readFileSync as readFileSync5 } from "node:fs";
+import { basename as basename3, join as join10, relative as relative3 } from "node:path";
 function walk(dir) {
   return readdirSync3(dir, { withFileTypes: true }).flatMap((entry) => {
-    const path = join7(dir, entry.name);
+    const path = join10(dir, entry.name);
     if (entry.isDirectory()) return walk(path);
     return entry.isFile() && entry.name.endsWith(".md") ? [path] : [];
   });
@@ -5892,7 +6633,7 @@ function itemFromFile(file) {
   const parts = file.split("/");
   const kind = parts.includes("drafts") ? "draft" : parts.includes("concepts") ? "concept" : null;
   if (!kind) return null;
-  const text = readFileSync3(file, "utf8");
+  const text = readFileSync5(file, "utf8");
   const meta = metadata(text);
   const pathChannel = parts[parts.indexOf("channels") + 1] || "";
   const relatedAsset = meta["related asset"] && meta["related asset"] !== "none yet" ? meta["related asset"] : void 0;
@@ -5905,13 +6646,13 @@ function itemFromFile(file) {
     phase: phaseFromStatus(meta.status),
     postId: postIdFor(kind, file),
     relatedAsset,
-    sourcePath: relative2(repoRoot, file),
+    sourcePath: relative3(repoRoot, file),
     title: text.match(/^#\s+(.+)$/m)?.[1] || basename3(file, ".md")
   };
 }
 function demoMarkdownItems(kind) {
-  const root = process.env.LINEAGE_CONTENT_SOURCE_ROOT || join7(repoRoot, "demo-project", "channels");
-  if (!existsSync4(root)) return [];
+  const root = process.env.LINEAGE_CONTENT_SOURCE_ROOT || join10(repoRoot, "demo-project", "channels");
+  if (!existsSync8(root)) return [];
   return walk(root).map(itemFromFile).filter((item) => Boolean(item)).filter((item) => kind === "all" || `${item.kind}s` === kind).sort((a, b) => a.sourcePath.localeCompare(b.sourcePath));
 }
 function importDemoContentBatch(project, options) {
@@ -6250,6 +6991,11 @@ function contentBatchRouter(projectFrom2) {
 }
 
 // src/server/generationReceipts.ts
+import { existsSync as existsSync9, realpathSync as realpathSync2, statSync as statSync4 } from "node:fs";
+import { relative as relative4, resolve as resolve5 } from "node:path";
+import { randomUUID as randomUUID3 } from "node:crypto";
+var adapterVersion = "generation-receipts-v1";
+var provider = "codex-handoff";
 var GenerationReceiptError = class extends Error {
   constructor(message, status = 400) {
     super(message);
@@ -6260,10 +7006,44 @@ var GenerationReceiptError = class extends Error {
 function isGenerationReceiptError(error) {
   return error instanceof GenerationReceiptError;
 }
+function jobId() {
+  return `gen-${Date.now().toString(36)}-${randomUUID3().slice(0, 8)}`;
+}
+function quote(value) {
+  return JSON.stringify(value);
+}
 function parseJson(value, fallback) {
   if (!value) return fallback;
   return JSON.parse(value);
 }
+function buildRerollHandoff(project, id, prompt, rootAssetId, target, request) {
+  const importCommand = `${lineagePublicPackageCommand()} reroll import --project ${quote(project)} --job-id ${quote(id)} --file <.asset-scratch-file> --confirm-write ${lineageRuntimeSelector()} --json`;
+  return {
+    schema_version: "lineage.generation_handoff.v1",
+    provider,
+    project,
+    job_id: id,
+    prompt,
+    expected_output_count: 1,
+    lineage: {
+      root_asset_id: rootAssetId,
+      parent_asset_id: target.asset_id,
+      selection_strategy: "reroll_request",
+      parent_title: target.title,
+      parent_local_path: target.local_path,
+      parent_s3_key: target.s3_key
+    },
+    instructions: [
+      "Use Codex image generation outside Lineage server code.",
+      "Write the regenerated output file under .asset-scratch before import.",
+      "Do not call live provider APIs from the CLI or server.",
+      "Import exactly one output with reroll import, not link-child or generate image import.",
+      `Resolve re-roll request ${request.id}; do not create a visible lineage child edge.`
+    ],
+    import_command: importCommand,
+    guardrails: { live_generation: false, external_services: false, output_root: ".asset-scratch", confirm_write_required: true }
+  };
+}
 function receiptFrom(row) {
   return {
     id: String(row.id),
@@ -6327,32 +7107,217 @@ function loadGenerationJob(database, project, id) {
     receipts
   };
 }
-
-// src/server/generationReceiptJobs.ts
-function listImageGenerationJobs(project = defaultProject, fields = {}) {
-  const clauses = ["job.project_id = ?"];
-  const params = [project];
-  if (fields.rootAssetId) {
-    clauses.push("job.root_asset_id = ?");
-    params.push(fields.rootAssetId);
-  }
-  if (fields.assetId) {
-    clauses.push("(input.asset_id = ? or output.imported_asset_id = ? or output.parent_asset_id = ?)");
-    params.push(fields.assetId, fields.assetId, fields.assetId);
-  }
-  const limit = Math.max(1, Math.min(50, Number.isInteger(fields.limit) ? Number(fields.limit) : 12));
+function insertReceipt(database, id, type, command, payload) {
+  database.prepare(`
+    insert into generation_job_receipts (id, job_id, receipt_type, status, command, payload_json, created_at)
+    values (?, ?, ?, 'ok', ?, ?, ?)
+  `).run(`${id}:receipt:${type}:${Date.now()}`, id, type, command, JSON.stringify(payload), nowIso());
+}
+function planImageReroll(project = defaultProject, fields) {
+  const prompt = fields.prompt.trim();
+  if (!prompt) throw new GenerationReceiptError("Missing --prompt");
+  if (!fields.rootAssetId) throw new GenerationReceiptError("Missing --root");
+  if (!fields.targetAssetId) throw new GenerationReceiptError("Missing --target");
+  const snapshot = getLineageSnapshot(project, fields.rootAssetId);
+  const target = snapshot.nodes.find((node) => node.asset_id === fields.targetAssetId);
+  if (!target) throw new GenerationReceiptError(`Re-roll target is not in lineage: ${fields.targetAssetId}`, 404);
+  const request = listLineageRerollRequests(project, snapshot.root_asset_id).requests.find((item) => item.node_asset_id === fields.targetAssetId);
+  if (!request) throw new GenerationReceiptError(`No pending re-roll request for ${fields.targetAssetId}`);
+  const id = jobId();
+  const timestamp = nowIso();
+  const handoff3 = buildRerollHandoff(project, id, prompt, snapshot.root_asset_id, target, request);
+  const input = {
+    id: `${id}:input:0`,
+    job_id: id,
+    project_id: project,
+    asset_id: target.asset_id,
+    root_asset_id: snapshot.root_asset_id,
+    role: "reroll_target",
+    position: 0,
+    selection_strategy: "reroll_request",
+    selection_snapshot: {
+      project,
+      root_asset_id: snapshot.root_asset_id,
+      strategy: "selected",
+      selection_mode: "single",
+      recommended_action: "evolve_variations",
+      reason: "user_selected",
+      next_asset: target,
+      next_assets: [target],
+      latest: snapshot.latest,
+      selected: [target.asset_id],
+      selection: null,
+      selections: [],
+      candidates: snapshot.nodes,
+      warnings: ["Re-roll target: import output as an attempt, not a lineage child."],
+      fetchedAt: timestamp
+    }
+  };
+  const preview = {
+    id,
+    project_id: project,
+    provider,
+    adapter_version: adapterVersion,
+    source_mode: "lineage_reroll",
+    root_asset_id: snapshot.root_asset_id,
+    prompt,
+    expected_output_count: 1,
+    status: "planned",
+    output_dir: ".asset-scratch",
+    handoff: handoff3,
+    created_at: timestamp,
+    updated_at: timestamp,
+    inputs: [input],
+    outputs: [],
+    receipts: [{
+      id: `${id}:receipt:plan:preview`,
+      job_id: id,
+      receipt_type: "plan",
+      status: "ok",
+      command: "reroll plan",
+      payload: { prompt, expected_output_count: 1, lineage: handoff3.lineage, reroll_request_id: request.id },
+      created_at: timestamp
+    }]
+  };
+  if (fields.dryRun) return { ok: true, command: "reroll plan", project, dryRun: true, wouldWrite: true, job: preview };
   const database = lineageDb();
   try {
-    const rows = database.prepare(`
-      select distinct job.id
-      from generation_jobs job
-        left join generation_job_inputs input on input.job_id = job.id
-        left join generation_job_outputs output on output.job_id = job.id
-      where ${clauses.join(" and ")}
-      order by job.created_at desc, job.id desc
-      limit ?
-    `).all(...params, limit);
-    return { ok: true, command: "generate image jobs", project, jobs: rows.map((row) => loadGenerationJob(database, project, row.id)), fetchedAt: nowIso() };
+    database.exec("BEGIN IMMEDIATE");
+    try {
+      database.prepare(`
+        insert into generation_jobs (
+          id, project_id, provider, adapter_version, source_mode, root_asset_id, prompt,
+          expected_output_count, status, output_dir, handoff_json, created_at, updated_at
+        ) values (?, ?, ?, ?, 'lineage_reroll', ?, ?, 1, 'planned', ?, ?, ?, ?)
+      `).run(id, project, provider, adapterVersion, snapshot.root_asset_id, prompt, ".asset-scratch", JSON.stringify(handoff3), timestamp, timestamp);
+      database.prepare("insert into generation_job_inputs (id, job_id, project_id, asset_id, root_asset_id, role, position, selection_strategy, selection_snapshot_json) values (?, ?, ?, ?, ?, ?, ?, ?, ?)").run(input.id, id, project, input.asset_id, input.root_asset_id, input.role, input.position, input.selection_strategy, JSON.stringify(input.selection_snapshot));
+      insertReceipt(database, id, "plan", "reroll plan", preview.receipts[0].payload);
+      database.exec("COMMIT");
+    } catch (error) {
+      database.exec("ROLLBACK");
+      throw error;
+    }
+    return { ok: true, command: "reroll plan", project, job: loadGenerationJob(database, project, id) };
+  } finally {
+    database.close();
+  }
+}
+function isPathInside2(child, parent) {
+  const rel = relative4(parent, child);
+  return Boolean(rel) && !rel.startsWith("..") && !rel.startsWith("/");
+}
+function resolveScratchFile(file) {
+  const scratchRoot = resolve5(repoRoot, ".asset-scratch");
+  const candidate = file.startsWith(".asset-scratch/") || resolve5(file).startsWith(scratchRoot) ? resolve5(repoRoot, file) : resolve5(scratchRoot, file);
+  if (!isPathInside2(candidate, scratchRoot)) throw new GenerationReceiptError(`Import file must be under .asset-scratch: ${file}`);
+  if (!existsSync9(candidate)) throw new GenerationReceiptError(`Missing import file: ${file}`, 404);
+  const realScratchRoot = realpathSync2(scratchRoot);
+  const realCandidate = realpathSync2(candidate);
+  if (!isPathInside2(realCandidate, realScratchRoot)) throw new GenerationReceiptError(`Import file must be under .asset-scratch: ${file}`);
+  const stats = statSync4(candidate);
+  if (!stats.isFile()) throw new GenerationReceiptError(`Import path is not a file: ${file}`);
+  const checksum = fileSha256(candidate);
+  return {
+    relativePath: relative4(scratchRoot, candidate),
+    checksum,
+    size: stats.size,
+    contentType: contentTypeFor(candidate),
+    assetId: `local-${checksum.slice(0, 12)}`
+  };
+}
+function importImageRerollOutput(project = defaultProject, fields) {
+  if (!fields.jobId) throw new GenerationReceiptError("Missing --job-id");
+  if (!fields.confirmWrite) throw new GenerationReceiptError("Generation import requires --confirm-write");
+  const database = lineageDb();
+  let job;
+  try {
+    job = loadGenerationJob(database, project, fields.jobId);
+  } finally {
+    database.close();
+  }
+  if (job.status !== "planned") throw new GenerationReceiptError(`Generation job is not importable from status: ${job.status}`);
+  if (job.source_mode !== "lineage_reroll") throw new GenerationReceiptError(`Generation job is not a re-roll job: ${job.source_mode}`);
+  const target = job.inputs.filter((input) => input.role === "reroll_target");
+  if (target.length !== 1) throw new GenerationReceiptError("Re-roll import requires exactly one reroll_target input");
+  const resolved = resolveScratchFile(fields.file);
+  indexLineageAssets(project);
+  const writeDb = lineageDb();
+  try {
+    const timestamp = nowIso();
+    writeDb.exec("BEGIN IMMEDIATE");
+    try {
+      const assetRow = writeDb.prepare("select id from assets where project_id = ? and id = ?").get(project, resolved.assetId);
+      if (!assetRow) throw new GenerationReceiptError(`Indexed local asset was not found: ${resolved.relativePath}`);
+      const outputId = `${fields.jobId}:output:0`;
+      writeDb.prepare(`insert into generation_job_outputs (
+        id, job_id, project_id, output_index, file_path, checksum_sha256, size_bytes, content_type, imported_asset_id, parent_asset_id, imported_at
+      ) values (?, ?, ?, 0, ?, ?, ?, ?, ?, ?, ?)`).run(outputId, fields.jobId, project, resolved.relativePath, resolved.checksum, resolved.size, resolved.contentType, resolved.assetId, target[0].asset_id, timestamp);
+      writeDb.prepare(`
+        update generation_jobs
+        set status = 'imported', imported_at = ?, updated_at = ?
+        where project_id = ? and id = ?
+      `).run(timestamp, timestamp, project, fields.jobId);
+      insertReceipt(writeDb, fields.jobId, "import", "reroll import", {
+        file: { output_index: 0, file_path: resolved.relativePath, imported_asset_id: resolved.assetId, parent_asset_id: target[0].asset_id },
+        reroll: { root_asset_id: job.root_asset_id, node_asset_id: target[0].asset_id }
+      });
+      writeDb.exec("COMMIT");
+    } catch (error) {
+      writeDb.exec("ROLLBACK");
+      throw error;
+    }
+    recordLineageRerollAttempt(project, {
+      rootAssetId: job.root_asset_id,
+      nodeAssetId: target[0].asset_id,
+      assetId: resolved.assetId,
+      prompt: job.prompt,
+      generationJobId: fields.jobId,
+      filePath: resolved.relativePath,
+      checksumSha256: resolved.checksum,
+      confirmWrite: true
+    });
+    const rerollTask = listLineageTasks(project, job.root_asset_id).tasks.find((task) => task.task_type === "reroll" && task.target_asset_id === target[0].asset_id);
+    if (rerollTask) {
+      resolveLineageTask(project, {
+        actor: "agent",
+        confirmWrite: true,
+        resolvedAssetId: resolved.assetId,
+        resolvedGenerationJobId: fields.jobId,
+        taskId: rerollTask.id
+      });
+    }
+    const importedJob = loadGenerationJob(writeDb, project, fields.jobId);
+    return { ok: true, command: "reroll import", project, job: importedJob, imported: importedJob.outputs };
+  } finally {
+    writeDb.close();
+  }
+}
+
+// src/server/generationReceiptJobs.ts
+function listImageGenerationJobs(project = defaultProject, fields = {}) {
+  const clauses = ["job.project_id = ?"];
+  const params = [project];
+  if (fields.rootAssetId) {
+    clauses.push("job.root_asset_id = ?");
+    params.push(fields.rootAssetId);
+  }
+  if (fields.assetId) {
+    clauses.push("(input.asset_id = ? or output.imported_asset_id = ? or output.parent_asset_id = ?)");
+    params.push(fields.assetId, fields.assetId, fields.assetId);
+  }
+  const limit = Math.max(1, Math.min(50, Number.isInteger(fields.limit) ? Number(fields.limit) : 12));
+  const database = lineageDb();
+  try {
+    const rows = database.prepare(`
+      select distinct job.id
+      from generation_jobs job
+        left join generation_job_inputs input on input.job_id = job.id
+        left join generation_job_outputs output on output.job_id = job.id
+      where ${clauses.join(" and ")}
+      order by job.created_at desc, job.id desc
+      limit ?
+    `).all(...params, limit);
+    return { ok: true, command: "generate image jobs", project, jobs: rows.map((row) => loadGenerationJob(database, project, row.id)), fetchedAt: nowIso() };
   } finally {
     database.close();
   }
@@ -6417,15 +7382,15 @@ function registerLineageTaskRoutes(app2, projectFrom2, asyncRoute2) {
 }
 
 // src/server/assetLineageDemo.ts
-import { createHash as createHash3 } from "node:crypto";
-import { copyFileSync as copyFileSync2, existsSync as existsSync5, mkdirSync as mkdirSync5, mkdtempSync, readFileSync as readFileSync4, rmSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { createHash as createHash5 } from "node:crypto";
+import { copyFileSync as copyFileSync3, existsSync as existsSync10, mkdirSync as mkdirSync7, mkdtempSync, readFileSync as readFileSync6, rmSync as rmSync3, writeFileSync as writeFileSync5 } from "node:fs";
 import { tmpdir } from "node:os";
-import { dirname as dirname3, join as join8, posix } from "node:path";
+import { dirname as dirname5, join as join11, posix } from "node:path";
 import { gunzipSync } from "node:zlib";
 var demoWorkspaceTitle = "Demo: Content iteration tree";
 var demoWorkspaceNotes = "Repeatable sample lineage for demos and onboarding. Archive it when reviewing real work.";
 var demoBasePath = ["lineage-demo", "2026-06-lineage-demo"];
-var swissifierManifestPath = join8(packageRoot, "fixtures", defaultProject, "lineage", "swissifier-rich-demo.json");
+var swissifierManifestPath = join11(packageRoot, "fixtures", defaultProject, "lineage", "swissifier-rich-demo.json");
 var demoAssets = [
   { key: "root", channel: "linkedin", file: "demo-root.svg", label: "Initial Demo Concept", fill: "#f6fbfb", stroke: "#0b7f88" },
   { key: "hookA", channel: "tiktok", file: "demo-hook-a-v01.svg", label: "Hook A v01", fill: "#fff8e6", stroke: "#9a6a00" },
@@ -6462,37 +7427,37 @@ var demoPositions = /* @__PURE__ */ new Map([
   ["alt", { x: 1060, y: 80 }]
 ]);
 function demoProjectDir(project) {
-  return join8(repoRoot, ".asset-scratch", ...demoBasePath, project);
+  return join11(repoRoot, ".asset-scratch", ...demoBasePath, project);
 }
 function demoRelativePath(project, asset) {
-  return join8(...demoBasePath, project, asset.channel, asset.file);
+  return join11(...demoBasePath, project, asset.channel, asset.file);
 }
 function demoFilePath(project, asset) {
-  return join8(demoProjectDir(project), asset.channel, asset.file);
+  return join11(demoProjectDir(project), asset.channel, asset.file);
 }
 function swissifierManifest() {
-  return JSON.parse(readFileSync4(swissifierManifestPath, "utf8"));
+  return JSON.parse(readFileSync6(swissifierManifestPath, "utf8"));
 }
 function swissifierRelativePath(manifest, asset) {
-  return join8(manifest.media.target_dir, asset.file);
+  return join11(manifest.media.target_dir, asset.file);
 }
 function swissifierFilePath(manifest, asset) {
-  return join8(repoRoot, ".asset-scratch", swissifierRelativePath(manifest, asset));
+  return join11(repoRoot, ".asset-scratch", swissifierRelativePath(manifest, asset));
 }
 function swissifierRerollRelativePath(manifest, attempt) {
-  return join8(manifest.media.target_dir, "reroll-attempts", attempt.file);
+  return join11(manifest.media.target_dir, "reroll-attempts", attempt.file);
 }
 function swissifierRerollFilePath(manifest, attempt) {
-  return join8(repoRoot, ".asset-scratch", swissifierRerollRelativePath(manifest, attempt));
+  return join11(repoRoot, ".asset-scratch", swissifierRerollRelativePath(manifest, attempt));
 }
 function swissifierRerollFixturePath(attempt) {
-  return join8(dirname3(swissifierManifestPath), "swissifier-rerolls", attempt.file);
+  return join11(dirname5(swissifierManifestPath), "swissifier-rerolls", attempt.file);
 }
 function swissifierSourcePath(manifest, asset, sourceDir) {
-  const direct = join8(sourceDir, asset.file);
-  if (existsSync5(direct)) return direct;
-  const nested = join8(sourceDir, manifest.media.target_dir, asset.file);
-  return existsSync5(nested) ? nested : null;
+  const direct = join11(sourceDir, asset.file);
+  if (existsSync10(direct)) return direct;
+  const nested = join11(sourceDir, manifest.media.target_dir, asset.file);
+  return existsSync10(nested) ? nested : null;
 }
 function swissifierMediaState(manifest) {
   const missing = [];
@@ -6500,7 +7465,7 @@ function swissifierMediaState(manifest) {
   for (const asset of manifest.assets) {
     const relativePath = swissifierRelativePath(manifest, asset);
     const path = swissifierFilePath(manifest, asset);
-    if (!existsSync5(path)) {
+    if (!existsSync10(path)) {
       missing.push(relativePath);
       continue;
     }
@@ -6509,7 +7474,7 @@ function swissifierMediaState(manifest) {
   return { invalid, missing };
 }
 function sha256Hex(input) {
-  return createHash3("sha256").update(input).digest("hex");
+  return createHash5("sha256").update(input).digest("hex");
 }
 function safeTarEntryName(rawName) {
   const stripped = rawName.replace(/\0.*$/, "").replace(/^\.\//, "");
@@ -6572,9 +7537,9 @@ function extractSwissifierMediaArchive(archive, manifest, destination) {
     const file = body.subarray(offset, offset + size);
     const actualSha = sha256Hex(file);
     if (actualSha !== asset.checksum_sha256) throw new Error(`Checksum mismatch for Swissifier media archive entry: ${name}`);
-    const target = join8(destination, directName);
-    mkdirSync5(dirname3(target), { recursive: true });
-    writeFileSync3(target, file);
+    const target = join11(destination, directName);
+    mkdirSync7(dirname5(target), { recursive: true });
+    writeFileSync5(target, file);
     extracted.add(directName);
     offset = nextOffset;
   }
@@ -6592,14 +7557,14 @@ async function downloadBuffer(url, maxBytes) {
   return buffer;
 }
 function missingDemoMedia(project) {
-  return demoAssets.filter((asset) => !existsSync5(demoFilePath(project, asset))).map((asset) => demoRelativePath(project, asset));
+  return demoAssets.filter((asset) => !existsSync10(demoFilePath(project, asset))).map((asset) => demoRelativePath(project, asset));
 }
 function demoSeedMediaStatus(project = defaultProject) {
   const missing = missingDemoMedia(project);
   const present = demoAssets.length - missing.length;
   return {
     ok: true,
-    media_root: join8(repoRoot, ".asset-scratch"),
+    media_root: join11(repoRoot, ".asset-scratch"),
     present,
     total: demoAssets.length,
     missing,
@@ -6616,7 +7581,7 @@ function swissifierRichDemoMediaStatus(project = defaultProject) {
     ok: true,
     demo_id: manifest.id,
     project,
-    media_root: join8(repoRoot, ".asset-scratch"),
+    media_root: join11(repoRoot, ".asset-scratch"),
     media_target: manifest.media.target_dir,
     download_available: Boolean(manifest.media.download),
     download_file: manifest.media.download?.file,
@@ -6667,7 +7632,7 @@ async function downloadSwissifierRichDemoMedia(project = defaultProject, fields
       would_restore: manifest.assets.length
     };
   }
-  const sourceDir = mkdtempSync(join8(tmpdir(), "lineage-swissifier-media-"));
+  const sourceDir = mkdtempSync(join11(tmpdir(), "lineage-swissifier-media-"));
   try {
     const extracted = extractSwissifierMediaArchive(archive, manifest, sourceDir);
     const restored = restoreSwissifierRichDemoMedia(project, { confirmWrite: true, sourceDir });
@@ -6681,7 +7646,7 @@ async function downloadSwissifierRichDemoMedia(project = defaultProject, fields
       media_status: swissifierRichDemoMediaStatus(project)
     };
   } finally {
-    rmSync(sourceDir, { force: true, recursive: true });
+    rmSync3(sourceDir, { force: true, recursive: true });
   }
 }
 function restoreDemoSeedMedia(project = defaultProject, fields = { confirmWrite: false }) {
@@ -6694,7 +7659,7 @@ function restoreDemoSeedMedia(project = defaultProject, fields = { confirmWrite:
   return {
     ok: true,
     dryRun: !fields.confirmWrite,
-    media_root: join8(repoRoot, ".asset-scratch"),
+    media_root: join11(repoRoot, ".asset-scratch"),
     restored: fields.confirmWrite ? missing.size : 0,
     total: demoAssets.length,
     would_restore: fields.confirmWrite ? 0 : missing.size,
@@ -6711,7 +7676,7 @@ function restoreSwissifierRichDemoMedia(project = defaultProject, fields = { con
       demo_id: manifest.id,
       project,
       dryRun: !fields.confirmWrite,
-      media_root: join8(repoRoot, ".asset-scratch"),
+      media_root: join11(repoRoot, ".asset-scratch"),
       restored: 0,
       total: manifest.assets.length,
       would_restore: 0,
@@ -6739,8 +7704,8 @@ function restoreSwissifierRichDemoMedia(project = defaultProject, fields = { con
   if (fields.confirmWrite) {
     for (const item of copyable) {
       const target = swissifierFilePath(manifest, item.asset);
-      mkdirSync5(dirname3(target), { recursive: true });
-      copyFileSync2(item.source, target);
+      mkdirSync7(dirname5(target), { recursive: true });
+      copyFileSync3(item.source, target);
     }
   }
   return {
@@ -6748,7 +7713,7 @@ function restoreSwissifierRichDemoMedia(project = defaultProject, fields = { con
     demo_id: manifest.id,
     project,
     dryRun: !fields.confirmWrite,
-    media_root: join8(repoRoot, ".asset-scratch"),
+    media_root: join11(repoRoot, ".asset-scratch"),
     restored: fields.confirmWrite ? copyable.length : 0,
     total: manifest.assets.length,
     would_restore: fields.confirmWrite ? 0 : copyable.length,
@@ -6770,15 +7735,15 @@ function svg(label, fill, stroke) {
 `;
 }
 function assetIdFor(asset) {
-  return `local-${createHash3("sha256").update(svg(asset.label, asset.fill, asset.stroke)).digest("hex").slice(0, 12)}`;
+  return `local-${createHash5("sha256").update(svg(asset.label, asset.fill, asset.stroke)).digest("hex").slice(0, 12)}`;
 }
 function demoAssetIds() {
   return Object.fromEntries(demoAssets.map((asset) => [asset.key, assetIdFor(asset)]));
 }
 function writeDemoFile(project, asset) {
   const path = demoFilePath(project, asset);
-  mkdirSync5(dirname3(path), { recursive: true });
-  writeFileSync3(path, svg(asset.label, asset.fill, asset.stroke));
+  mkdirSync7(dirname5(path), { recursive: true });
+  writeFileSync5(path, svg(asset.label, asset.fill, asset.stroke));
 }
 function writeDemoFiles(project) {
   const ids = demoAssetIds();
@@ -6787,8 +7752,8 @@ function writeDemoFiles(project) {
 }
 function swissifierRerollAsset(attempt) {
   const source = swissifierRerollFixturePath(attempt);
-  if (!existsSync5(source)) throw new Error(`Missing Swissifier re-roll fixture media: ${attempt.file}`);
-  const body = readFileSync4(source);
+  if (!existsSync10(source)) throw new Error(`Missing Swissifier re-roll fixture media: ${attempt.file}`);
+  const body = readFileSync6(source);
   if (body.length !== attempt.size_bytes) throw new Error(`Unexpected Swissifier re-roll fixture size for ${attempt.file}`);
   const checksumSha256 = sha256Hex(body);
   if (checksumSha256 !== attempt.checksum_sha256) throw new Error(`Checksum mismatch for Swissifier re-roll fixture: ${attempt.file}`);
@@ -6802,8 +7767,8 @@ function writeSwissifierRerollFiles(manifest) {
   for (const attempt of manifest.reroll_attempts || []) {
     swissifierRerollAsset(attempt);
     const target = swissifierRerollFilePath(manifest, attempt);
-    mkdirSync5(dirname3(target), { recursive: true });
-    copyFileSync2(swissifierRerollFixturePath(attempt), target);
+    mkdirSync7(dirname5(target), { recursive: true });
+    copyFileSync3(swissifierRerollFixturePath(attempt), target);
   }
 }
 function upsertDemoAssets(project, ids) {
@@ -6814,7 +7779,7 @@ function upsertDemoAssets(project, ids) {
       insert into projects (id, product, catalog_path, created_at, updated_at)
       values (?, ?, ?, ?, ?)
       on conflict(id) do update set product = excluded.product, updated_at = excluded.updated_at
-    `).run(project, project, join8(repoRoot, project, "assets", "catalog.json"), timestamp, timestamp);
+    `).run(project, project, join11(repoRoot, project, "assets", "catalog.json"), timestamp, timestamp);
     const assetStatement = database.prepare(`
       insert into assets (
         id, project_id, source, local_path, s3_key, checksum_sha256, media_type, title, status,
@@ -6837,7 +7802,7 @@ function upsertDemoAssets(project, ids) {
         ids[asset.key],
         project,
         demoRelativePath(project, asset),
-        createHash3("sha256").update(body).digest("hex"),
+        createHash5("sha256").update(body).digest("hex"),
         asset.label,
         asset.channel,
         Buffer.byteLength(body),
@@ -6860,7 +7825,7 @@ function upsertSwissifierAssets(project, manifest) {
       insert into projects (id, product, catalog_path, created_at, updated_at)
       values (?, ?, ?, ?, ?)
       on conflict(id) do update set product = excluded.product, updated_at = excluded.updated_at
-    `).run(project, project, join8(repoRoot, project, "assets", "catalog.json"), timestamp, timestamp);
+    `).run(project, project, join11(repoRoot, project, "assets", "catalog.json"), timestamp, timestamp);
     const assetStatement = database.prepare(`
       insert into assets (
         id, project_id, source, local_path, s3_key, checksum_sha256, media_type, title, status,
@@ -7096,7 +8061,7 @@ function archiveDemoLineageWorkspace(project, confirmWrite) {
     if (!isLineageWorkspaceError(error) || error.status !== 404) throw error;
     archived = { ok: true, message: "No demo lineage workspace exists yet", workspace: null };
   }
-  if (confirmWrite) rmSync(demoProjectDir(project), { force: true, recursive: true });
+  if (confirmWrite) rmSync3(demoProjectDir(project), { force: true, recursive: true });
   return {
     ok: true,
     message: confirmWrite ? `Archived ${demoWorkspaceTitle}` : `Would archive ${demoWorkspaceTitle}`,
@@ -7190,14 +8155,49 @@ function registerLineageWorkspaceRoutes(app2, projectFrom2, asyncRoute2) {
 }
 
 // src/server/runtimeInfo.ts
+import { createHash as createHash6 } from "node:crypto";
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { createRequire as createRequire2 } from "node:module";
-import { existsSync as existsSync6, readFileSync as readFileSync5, statSync as statSync3 } from "node:fs";
-import { join as join9 } from "node:path";
-var require3 = createRequire2(import.meta.url);
-function packageInfo() {
+import { createRequire as createRequire4 } from "node:module";
+import { existsSync as existsSync11, lstatSync as lstatSync2, readFileSync as readFileSync7, readdirSync as readdirSync4, readlinkSync, realpathSync as realpathSync3, statSync as statSync5 } from "node:fs";
+import { dirname as dirname6, isAbsolute as isAbsolute2, join as join12, resolve as resolve6 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+
+// src/shared/runtimeInfoTypes.ts
+var lineageRuntimeBuildSchemaVersion = "lineage.runtime_build.v1";
+var lineageRuntimeInstallSchemaVersion = "lineage.runtime_install.v1";
+
+// src/server/runtimeInfo.ts
+var require5 = createRequire4(import.meta.url);
+var processStartedAt = (/* @__PURE__ */ new Date()).toISOString();
+function isLineagePackageRoot(root) {
+  try {
+    const info = JSON.parse(readFileSync7(join12(root, "package.json"), "utf8"));
+    return info.name === "@mean-weasel/lineage";
+  } catch {
+    return false;
+  }
+}
+function executingCodeRoot() {
+  const moduleDirectory = dirname6(fileURLToPath2(import.meta.url));
+  const candidates = [resolve6(moduleDirectory, "../.."), resolve6(moduleDirectory, "..")];
+  const root = candidates.find(isLineagePackageRoot);
+  if (!root) throw new Error(`Unable to derive Lineage code root from executing module ${fileURLToPath2(import.meta.url)}`);
+  return canonicalRoot(root);
+}
+var codeRoot = executingCodeRoot();
+function sha256(value) {
+  return createHash6("sha256").update(value).digest("hex");
+}
+function canonicalRoot(root) {
+  try {
+    return realpathSync3(root);
+  } catch {
+    return resolve6(root);
+  }
+}
+function packageInfo(root = codeRoot) {
   try {
-    const info = JSON.parse(readFileSync5(join9(packageRoot, "package.json"), "utf8"));
+    const info = JSON.parse(readFileSync7(join12(root, "package.json"), "utf8"));
     return { name: info.name || "@mean-weasel/lineage", version: info.version || "0.0.0" };
   } catch {
     return { name: "@mean-weasel/lineage", version: "0.0.0" };
@@ -7210,35 +8210,240 @@ function normalizeRuntimeChannel(value) {
   if (value === "development") return "dev";
   return process.env.NODE_ENV === "production" ? "stable" : "dev";
 }
-function gitSha() {
-  const envSha = process.env.LINEAGE_GIT_SHA || process.env.GITHUB_SHA;
-  if (envSha) return envSha.slice(0, 40);
-  if (!existsSync6(join9(packageRoot, ".git"))) return void 0;
-  const result = spawnSync2("git", ["rev-parse", "--short=12", "HEAD"], { cwd: packageRoot, encoding: "utf8" });
-  return result.status === 0 ? result.stdout.trim() || void 0 : void 0;
+function git(root, args) {
+  const result = spawnSync2("git", args, { cwd: root, encoding: "utf8", maxBuffer: 32 * 1024 * 1024 });
+  return result.status === 0 ? result.stdout : void 0;
+}
+function untrackedFingerprint(root, status) {
+  const hash = createHash6("sha256");
+  hash.update(status);
+  const listed = git(root, ["ls-files", "--others", "--exclude-standard", "-z"]);
+  if (listed === void 0) return hash.digest("hex");
+  for (const relativePath of listed.split("\0").filter(Boolean).sort()) {
+    hash.update("\0");
+    hash.update(relativePath);
+    const path = join12(root, relativePath);
+    try {
+      const stat = lstatSync2(path);
+      if (stat.isSymbolicLink()) hash.update(readlinkSync(path));
+      else if (stat.isFile()) hash.update(readFileSync7(path));
+      else hash.update(`[${stat.mode}:${stat.size}]`);
+    } catch (error) {
+      hash.update(`[unreadable:${error instanceof Error ? error.message : String(error)}]`);
+    }
+  }
+  return hash.digest("hex");
+}
+function checkoutCodeIdentity(root, channel, version) {
+  const errors = [];
+  const gitRootRaw = git(root, ["rev-parse", "--show-toplevel"])?.trim();
+  const gitSha = git(root, ["rev-parse", "HEAD"])?.trim();
+  const status = git(root, ["status", "--porcelain=v1", "-z", "--untracked-files=all"]);
+  const diff = git(root, ["diff", "--binary", "HEAD", "--"]);
+  const canonicalGitRoot = gitRootRaw ? canonicalRoot(gitRootRaw) : void 0;
+  if (!canonicalGitRoot || canonicalGitRoot !== root) errors.push("Code root is not the canonical root of a Git checkout/worktree");
+  if (!gitSha || !/^[a-f0-9]{40}$/i.test(gitSha)) errors.push("Checkout Git revision is unavailable");
+  if (status === void 0 || diff === void 0) errors.push("Checkout dirty state could not be inspected");
+  if (channel !== "dev") errors.push(`Checkout code may run only as dev, not ${channel}`);
+  const dirty = Boolean(status);
+  const sourceFingerprint = sha256(`${gitSha || "unknown"}\0${sha256(diff || "")}\0${untrackedFingerprint(root, status || "")}`);
+  return {
+    channel,
+    dirty,
+    errors,
+    fingerprint: sha256(JSON.stringify({ channel, dirty, git_sha: gitSha, origin: "checkout", root, source_fingerprint: sourceFingerprint, version })),
+    git_sha: gitSha,
+    origin: "checkout",
+    package_version: version,
+    root,
+    source_fingerprint: sourceFingerprint,
+    verified: errors.length === 0
+  };
 }
-function tableExists(database, table) {
+function buildFingerprint(build) {
+  return sha256(JSON.stringify({
+    package_name: build.package_name,
+    package_version: build.package_version,
+    schema_version: build.schema_version,
+    source_dirty: build.source_dirty,
+    source_fingerprint: build.source_fingerprint,
+    source_git_sha: build.source_git_sha
+  }));
+}
+function readBuildIdentity(root, errors) {
+  const path = join12(root, "dist", "runtime-build.json");
+  let build;
+  try {
+    build = JSON.parse(readFileSync7(path, "utf8"));
+  } catch (error) {
+    errors.push(`Embedded build identity is missing or unreadable at ${path}: ${error instanceof Error ? error.message : String(error)}`);
+    return void 0;
+  }
+  if (build.schema_version !== lineageRuntimeBuildSchemaVersion) errors.push(`Unsupported build identity schema: ${String(build.schema_version)}`);
+  if (!/^[a-f0-9]{40}$/i.test(build.source_git_sha || "")) errors.push("Embedded build Git revision is invalid");
+  if (!/^[a-f0-9]{64}$/i.test(build.source_fingerprint || "")) errors.push("Embedded source fingerprint is invalid");
+  const expected = buildFingerprint(build);
+  if (build.build_fingerprint !== expected) errors.push("Embedded build fingerprint does not match its contents");
+  return build;
+}
+function readInstallReceipt(path, errors) {
+  if (!path) {
+    errors.push("Packaged runtime was not launched through a channel install receipt");
+    return void 0;
+  }
+  let receipt;
+  const receiptPath = resolve6(path);
+  try {
+    receipt = JSON.parse(readFileSync7(receiptPath, "utf8"));
+  } catch (error) {
+    errors.push(`Runtime install receipt is missing or unreadable at ${receiptPath}: ${error instanceof Error ? error.message : String(error)}`);
+    return void 0;
+  }
+  if (receipt.schema_version !== lineageRuntimeInstallSchemaVersion) errors.push(`Unsupported runtime install receipt schema: ${String(receipt.schema_version)}`);
+  if (!isAbsolute2(receipt.package_root || "")) errors.push("Runtime install receipt package_root must be absolute");
+  if (!receipt.package_integrity?.startsWith("sha512-")) errors.push("Runtime install receipt package integrity is invalid");
+  if (receipt.package_source !== "registry" && receipt.package_source !== "local") errors.push("Runtime install receipt package source is invalid");
+  if (typeof receipt.package_spec !== "string" || !receipt.package_spec) errors.push("Runtime install receipt package spec is invalid");
+  if (!/^[a-f0-9]{64}$/i.test(receipt.package_tree_sha256 || "")) errors.push("Runtime install receipt package tree hash is invalid");
+  if (Number.isNaN(Date.parse(receipt.installed_at))) errors.push("Runtime install receipt timestamp is invalid");
+  return { ...receipt, receipt_path: receiptPath };
+}
+function lineagePackageTreeSha256(root) {
+  const hash = createHash6("sha256");
+  const visit = (directory, relativeDirectory = "") => {
+    for (const entry of readdirSync4(directory, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name))) {
+      const relativePath = relativeDirectory ? join12(relativeDirectory, entry.name) : entry.name;
+      const path = join12(directory, entry.name);
+      hash.update(relativePath.replaceAll("\\", "/"));
+      hash.update("\0");
+      if (entry.isDirectory()) {
+        hash.update("directory\0");
+        visit(path, relativePath);
+      } else if (entry.isSymbolicLink()) {
+        hash.update("symlink\0");
+        hash.update(readlinkSync(path));
+      } else if (entry.isFile()) {
+        hash.update("file\0");
+        hash.update(readFileSync7(path));
+      } else {
+        hash.update("other\0");
+      }
+      hash.update("\0");
+    }
+  };
+  visit(root);
+  return hash.digest("hex");
+}
+function packageCodeIdentity(root, channel, info, receiptPath) {
+  const errors = [];
+  const build = readBuildIdentity(root, errors);
+  const install = readInstallReceipt(receiptPath, errors);
+  if (channel === "dev") errors.push("Published package code cannot run as dev; use a Git checkout/worktree");
+  if (build?.package_name !== info.name || build?.package_version !== info.version) {
+    errors.push("Embedded build package identity does not match package.json");
+  }
+  if (build?.source_dirty) errors.push("Stable and preview package installs require a clean-source build");
+  if (install) {
+    if (install.channel !== channel) errors.push(`Install receipt channel ${install.channel} does not match requested ${channel}`);
+    if (canonicalRoot(install.package_root) !== root) errors.push("Install receipt package root does not match the executing package root");
+    if (install.package_name !== info.name || install.package_version !== info.version) errors.push("Install receipt package identity does not match package.json");
+    if (build && install.build_fingerprint !== build.build_fingerprint) errors.push("Install receipt build fingerprint does not match the embedded build");
+    try {
+      if (lineagePackageTreeSha256(root) !== install.package_tree_sha256) errors.push("Installed package tree does not match the channel install receipt");
+    } catch (error) {
+      errors.push(`Installed package tree could not be verified: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+  const gitSha = build?.source_git_sha;
+  const sourceFingerprint = build?.source_fingerprint;
+  return {
+    build,
+    channel,
+    dirty: build?.source_dirty,
+    errors,
+    fingerprint: sha256(JSON.stringify({
+      build_fingerprint: build?.build_fingerprint,
+      channel,
+      install_integrity: install?.package_integrity,
+      origin: "package",
+      root,
+      version: info.version
+    })),
+    git_sha: gitSha,
+    install,
+    origin: "package",
+    package_version: info.version,
+    root,
+    source_fingerprint: sourceFingerprint,
+    verified: errors.length === 0
+  };
+}
+function getLineageCodeIdentity(channel, options = {}) {
+  const root = canonicalRoot(options.root || codeRoot);
+  const info = packageInfo(root);
+  if (existsSync11(join12(root, ".git"))) return checkoutCodeIdentity(root, channel, info.version);
+  if (existsSync11(join12(root, "package.json"))) {
+    return packageCodeIdentity(root, channel, info, options.receiptPath ?? process.env.LINEAGE_RUNTIME_RECEIPT);
+  }
+  const errors = [`Code root has neither checkout metadata nor package.json: ${root}`];
+  return {
+    channel,
+    errors,
+    fingerprint: sha256(JSON.stringify({ channel, origin: "unknown", root, version: info.version })),
+    origin: "unknown",
+    package_version: info.version,
+    root,
+    verified: false
+  };
+}
+function assertLineageCodeOrigin(channel) {
+  const identity = getLineageCodeIdentity(channel);
+  if (!identity.verified) {
+    const migration = channel === "dev" ? "Run dev from a Git checkout with npm run lineage:dev -- <command>." : `Install and launch an isolated ${channel} runtime with lineage-channel install ${channel}.`;
+    throw new Error(`Unverified ${channel} code origin: ${identity.errors.join("; ")}. ${migration}`);
+  }
+  return identity;
+}
+function tableExists2(database, table) {
   return Boolean(database.prepare("select name from sqlite_master where type = 'table' and name = ?").get(table));
 }
 function tableCount(database, table) {
-  if (!tableExists(database, table)) return void 0;
+  if (!tableExists2(database, table)) return void 0;
   const row = database.prepare(`select count(*) count from ${table}`).get();
   return typeof row?.count === "number" ? row.count : void 0;
 }
+function migrationKeys(database) {
+  if (!tableExists2(database, "lineage_schema_migrations")) return [];
+  return database.prepare("select key from lineage_schema_migrations order by key").all().map((row) => row.key);
+}
 function getLineageRuntimeInfo(options = {}) {
   const info = packageInfo();
   const dbPath = options.dbPath || lineageDbPath();
-  const databaseInfo = { exists: existsSync6(dbPath), path: dbPath };
+  const channel = normalizeRuntimeChannel(options.channel || process.env.LINEAGE_CHANNEL || process.env.LINEAGE_RELEASE_CHANNEL);
+  const code = options.code || getLineageCodeIdentity(channel);
+  const databaseInfo = { exists: existsSync11(dbPath), path: dbPath };
+  const schema = { migration_keys: [] };
   if (databaseInfo.exists) {
     try {
-      const stat = statSync3(dbPath);
+      const stat = statSync5(dbPath);
       databaseInfo.modified_at = stat.mtime.toISOString();
       databaseInfo.size_bytes = stat.size;
-      const { DatabaseSync } = require3("node:sqlite");
+      const { DatabaseSync } = require5("node:sqlite");
       const database = new DatabaseSync(dbPath, { readOnly: true });
       try {
         databaseInfo.projects = tableCount(database, "projects");
         databaseInfo.workspaces = tableCount(database, "lineage_workspaces");
+        schema.migration_keys = migrationKeys(database);
+        if (tableExists2(database, "lineage_profile_identity")) {
+          const columns = new Set(database.prepare("pragma table_info(lineage_profile_identity)").all().map((row) => row.name));
+          const fingerprintExpression = columns.has("profile_fingerprint") ? "profile_fingerprint" : "null as profile_fingerprint";
+          const rows = database.prepare(`select profile_id, environment, ${fingerprintExpression} from lineage_profile_identity`).all();
+          if (rows.length === 1) {
+            schema.profile_id = rows[0].profile_id;
+            schema.profile_environment = rows[0].environment;
+            if (rows[0].profile_fingerprint) schema.profile_fingerprint = rows[0].profile_fingerprint;
+          }
+        }
       } finally {
         database.close();
       }
@@ -7248,24 +8453,974 @@ function getLineageRuntimeInfo(options = {}) {
   }
   return {
     asset_root: repoRoot,
-    channel: normalizeRuntimeChannel(options.channel || process.env.LINEAGE_CHANNEL || process.env.LINEAGE_RELEASE_CHANNEL),
+    channel,
+    code,
     database: databaseInfo,
     fetchedAt: nowIso(),
-    git_sha: gitSha(),
+    git_sha: code.git_sha,
     node_env: process.env.NODE_ENV,
     package_name: info.name,
+    profile: runtimeProfileIdentity(channel),
+    schema,
+    service: {
+      instance_id: process.env.LINEAGE_SERVICE_INSTANCE_ID,
+      launcher_pid: process.env.LINEAGE_LAUNCHER_PID ? Number(process.env.LINEAGE_LAUNCHER_PID) : void 0,
+      pid: process.pid,
+      started_at: processStartedAt
+    },
     version: info.version
   };
 }
 
+// src/server/managedWriterRouting.ts
+var managedWriterRequestSchemaVersion = "lineage.managed_writer_request.v1";
+var managedWriterResponseSchemaVersion = "lineage.managed_writer_response.v1";
+var managedWriterRoute = "/api/managed-writer/execute";
+var delegationHeader = "X-Lineage-Writer-Delegation";
+var ManagedWriterRoutingError = class extends Error {
+  constructor(message, status = 409, options) {
+    super(message, options);
+    this.status = status;
+    this.name = "ManagedWriterRoutingError";
+  }
+  status;
+};
+function isManagedWriterRoutingError(error) {
+  return error instanceof ManagedWriterRoutingError;
+}
+function requestBody(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new ManagedWriterRoutingError("Managed writer request must be a JSON object", 400);
+  }
+  const body = value;
+  if (body.schema_version !== managedWriterRequestSchemaVersion) {
+    throw new ManagedWriterRoutingError(`Unsupported managed writer request schema: ${String(body.schema_version)}`, 400);
+  }
+  if (typeof body.command !== "string" || !body.command || !Array.isArray(body.args) || body.args.some((arg) => typeof arg !== "string")) {
+    throw new ManagedWriterRoutingError("Managed writer request requires a command and string args", 400);
+  }
+  if (typeof body.profile_id !== "string" || typeof body.channel !== "string" || typeof body.environment !== "string" || typeof body.service_origin !== "string") {
+    throw new ManagedWriterRoutingError("Managed writer request requires profile identity", 400);
+  }
+  return body;
+}
+function containsProtectedOverride(args) {
+  return args.some((arg) => arg === "--db" || arg.startsWith("--db=") || arg === "--asset-root" || arg.startsWith("--asset-root=") || arg === "--profile" || arg.startsWith("--profile="));
+}
+function registerManagedWriterRoute(app2, fields) {
+  app2.post(managedWriterRoute, (req, res, next) => {
+    try {
+      if (!fields.profile || !fields.writerLease) {
+        throw new ManagedWriterRoutingError("Managed writer delegation is unavailable for an unprofiled service", 404);
+      }
+      if (!fields.writerLease.authenticate(req.header(delegationHeader))) {
+        throw new ManagedWriterRoutingError("Managed writer delegation was not authorized", 401);
+      }
+      const body = requestBody(req.body);
+      if (body.profile_id !== fields.profile.profile_id || body.channel !== fields.channel || body.environment !== fields.profile.environment || body.service_origin !== fields.profile.service_origin) {
+        throw new ManagedWriterRoutingError("Managed writer request profile/service identity does not match this service", 409);
+      }
+      if (containsProtectedOverride(body.args)) {
+        throw new ManagedWriterRoutingError("Managed writer requests cannot override profile, database, or asset root", 400);
+      }
+      if (!fields.accepts(body.command, body.args)) {
+        throw new ManagedWriterRoutingError(`Unsupported managed writer command: ${body.command}`, 400);
+      }
+      const result = fields.execute(body.command, body.args);
+      const response = {
+        ok: true,
+        result,
+        schema_version: managedWriterResponseSchemaVersion,
+        service: {
+          channel: fields.channel,
+          environment: fields.profile.environment,
+          profile_id: fields.profile.profile_id,
+          service_origin: fields.profile.service_origin
+        }
+      };
+      res.json(response);
+    } catch (error) {
+      next(error);
+    }
+  });
+}
+
+// src/cli/lineageCli.ts
+import { existsSync as existsSync13, mkdirSync as mkdirSync8, readFileSync as readFileSync8, writeFileSync as writeFileSync6 } from "node:fs";
+import { dirname as dirname7, join as join13, resolve as resolve8 } from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
+
+// src/server/lineageSelectionPacket.ts
+import { createHash as createHash7 } from "node:crypto";
+import { existsSync as existsSync12, statSync as statSync6 } from "node:fs";
+import { isAbsolute as isAbsolute3, resolve as resolve7 } from "node:path";
+var LineageSelectionPacketError = class extends Error {
+  constructor(message, warnings = [], errors = [], diagnostics = []) {
+    super(message);
+    this.warnings = warnings;
+    this.errors = errors;
+    this.diagnostics = diagnostics;
+  }
+  warnings;
+  errors;
+  diagnostics;
+};
+function listAllAssets(project) {
+  const pageSize = 100;
+  const first = listAssets(project, { page: 1, pageSize, source: "all" });
+  const assets = [...first.assets];
+  for (let page = 2; page <= first.pagination.totalPages; page += 1) {
+    assets.push(...listAssets(project, { page, pageSize, source: "all" }).assets);
+  }
+  return assets;
+}
+function resolveWorkspace(project, options) {
+  if (options.rootAssetId && options.workspaceId) {
+    throw new LineageSelectionPacketError("Use either --root or --workspace, not both.", [], ["ambiguous_workspace"]);
+  }
+  const snapshot = listLineageWorkspaces(project);
+  const target = options.workspaceId || options.rootAssetId;
+  const workspace = target ? snapshot.workspaces.find((item) => item.id === target || item.root_asset_id === target) : snapshot.active_workspace;
+  if (workspace) return workspace;
+  if (options.rootAssetId) {
+    return {
+      id: lineageWorkspaceId(project, options.rootAssetId),
+      project,
+      root_asset_id: options.rootAssetId,
+      title: `${options.rootAssetId} lineage`,
+      status: "active",
+      created_by: "system",
+      created_at: "",
+      updated_at: ""
+    };
+  }
+  const message = options.workspaceId ? `Unknown lineage workspace: ${options.workspaceId}` : "No active lineage workspace. Pass --root or activate a workspace first.";
+  throw new LineageSelectionPacketError(message, [], [options.workspaceId ? "unknown_workspace" : "missing_active_workspace"]);
+}
+function resolveLocalReference(reference) {
+  if (!reference) return void 0;
+  if (isAbsolute3(reference)) return reference;
+  const repoRelative = resolve7(repoRoot, reference);
+  if (existsSync12(repoRelative)) return repoRelative;
+  return resolve7(repoRoot, ".asset-scratch", reference);
+}
+function fileSize(path) {
+  if (!path || !existsSync12(path)) return void 0;
+  try {
+    return statSync6(path).size;
+  } catch {
+    return void 0;
+  }
+}
+function storageState(hasLocal, hasS3) {
+  if (hasLocal && hasS3) return "local_and_s3";
+  if (hasLocal) return "local_only";
+  if (hasS3) return "s3_backed";
+  return "unresolved";
+}
+function currentAttemptFor(node) {
+  if (!node.current_attempt) return void 0;
+  return {
+    asset_id: node.current_attempt.asset_id,
+    checksum_sha256: node.current_attempt.checksum_sha256,
+    file_path: node.current_attempt.file_path,
+    generation_job_id: node.current_attempt.generation_job_id,
+    id: node.current_attempt.id,
+    is_current: node.current_attempt.is_current,
+    source: node.current_attempt.source
+  };
+}
+function assetForNode(node, catalogAsset, warnings) {
+  const localReference = catalogAsset?.local?.absolute_path || node.current_attempt?.file_path || node.local_path || catalogAsset?.local?.relative_path;
+  const absolutePath = catalogAsset?.local?.absolute_path || resolveLocalReference(localReference);
+  const localExists = absolutePath ? existsSync12(absolutePath) : false;
+  const hasLocalClaim = Boolean(absolutePath || node.local_path || catalogAsset?.local?.relative_path);
+  const s3Key = catalogAsset?.s3?.key || node.s3_key;
+  const hasS3 = Boolean(s3Key);
+  const checksum = catalogAsset?.local?.checksum_sha256 || node.current_attempt?.checksum_sha256 || node.checksum_sha256 || catalogAsset?.s3?.checksum_sha256;
+  const mimeType = catalogAsset?.local?.content_type || catalogAsset?.s3?.content_type;
+  const mediaType = catalogAsset?.content_type || node.media_type;
+  if (hasLocalClaim && !localExists) warnings.push(`Selected asset ${node.asset_id} has a local path but the file is missing: ${absolutePath || node.local_path}`);
+  if (!hasLocalClaim && !hasS3) warnings.push(`Selected asset ${node.asset_id} has neither a local file nor S3 key.`);
+  if (mediaType && mediaType !== "image" && mediaType !== "gif") warnings.push(`Selected asset ${node.asset_id} is ${mediaType}, not an image/gif asset.`);
+  return {
+    asset_id: node.asset_id,
+    campaign: catalogAsset?.campaign || node.campaign,
+    channel: catalogAsset?.channel || node.channel,
+    checksum_sha256: checksum,
+    current_attempt: currentAttemptFor(node),
+    local: {
+      absolute_path: absolutePath,
+      content_type: catalogAsset?.local?.content_type,
+      exists: localExists,
+      relative_path: catalogAsset?.local?.relative_path || node.local_path || node.current_attempt?.file_path,
+      size_bytes: catalogAsset?.local?.size_bytes || fileSize(absolutePath)
+    },
+    media_type: mediaType,
+    mime_type: mimeType,
+    review_notes: node.review_notes,
+    review_state: node.review_state,
+    s3: {
+      bucket: catalogAsset?.s3?.bucket,
+      checksum_sha256: catalogAsset?.s3?.checksum_sha256,
+      content_type: catalogAsset?.s3?.content_type,
+      etag: catalogAsset?.s3?.etag,
+      key: s3Key,
+      region: catalogAsset?.s3?.region,
+      size_bytes: catalogAsset?.s3?.size_bytes,
+      version_id: catalogAsset?.s3?.version_id
+    },
+    selection_note: node.selection_note,
+    source: catalogAsset?.source || node.source,
+    status: catalogAsset?.status || node.status,
+    storage_state: storageState(hasLocalClaim, hasS3),
+    title: catalogAsset?.title || node.title || node.asset_id
+  };
+}
+function packetId(packetIdentity) {
+  const digest = createHash7("sha256").update(JSON.stringify(packetIdentity)).digest("hex").slice(0, 24);
+  return `lineage_packet_${digest}`;
+}
+var SHA256_PATTERN = /^[a-f0-9]{64}$/;
+function canonicalValue(value) {
+  if (Array.isArray(value)) return value.map((item) => canonicalValue(item));
+  if (value && typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value).filter(([, item]) => item !== void 0).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([key, item]) => [key, canonicalValue(item)])
+    );
+  }
+  return value;
+}
+function canonicalLineageSelectionPacketIdentityJson(projection) {
+  return JSON.stringify(canonicalValue(projection));
+}
+function lineageSelectionPacketV2IdentityProjection(packet) {
+  const assetsById = new Map(packet.assets.map((asset) => [asset.asset_id, asset]));
+  const selection = packet.selection.items.map((item) => {
+    const asset = assetsById.get(item.asset_id);
+    if (!asset) {
+      const diagnostics = [{ asset_id: item.asset_id, code: "selected_asset_missing", severity: "error" }];
+      throw new LineageSelectionPacketError(
+        `Selected asset ${item.asset_id} is absent from the v2 packet asset envelope.`,
+        [],
+        ["selected_asset_missing"],
+        diagnostics
+      );
+    }
+    return {
+      asset_id: item.asset_id,
+      campaign: asset.campaign,
+      channel: asset.channel,
+      current_attempt: {
+        asset_id: asset.current_attempt.asset_id,
+        attempt_index: asset.current_attempt.attempt_index,
+        checksum_sha256: asset.current_attempt.checksum_sha256,
+        id: asset.current_attempt.id,
+        source: asset.current_attempt.source
+      },
+      media_type: asset.media_type,
+      mime_type: asset.mime_type,
+      position: item.position,
+      selection_note: item.selection_note,
+      title: asset.title
+    };
+  });
+  return {
+    schema_version: "lineage.selection_packet.v2",
+    project: packet.project,
+    product: packet.product,
+    workspace: {
+      id: packet.workspace.id,
+      root_asset_id: packet.workspace.root_asset_id
+    },
+    context: {
+      campaign: packet.context.campaign,
+      channel: packet.context.channel,
+      labels: packet.context.labels,
+      notes: packet.context.notes
+    },
+    selection,
+    diagnostics: packet.diagnostics.map((diagnostic) => ({
+      code: diagnostic.code,
+      severity: diagnostic.severity,
+      ...diagnostic.asset_id ? { asset_id: diagnostic.asset_id } : {}
+    }))
+  };
+}
+function lineageSelectionPacketV2IdentitySha256(packet) {
+  const projection = lineageSelectionPacketV2IdentityProjection(packet);
+  return createHash7("sha256").update(canonicalLineageSelectionPacketIdentityJson(projection)).digest("hex");
+}
+function addDiagnostic(diagnostics, diagnostic) {
+  if (diagnostics.some((item) => item.code === diagnostic.code && item.severity === diagnostic.severity && item.asset_id === diagnostic.asset_id)) return;
+  diagnostics.push(diagnostic);
+}
+function requireV2CurrentAttempt(node, warnings, diagnostics) {
+  const attempt = node.current_attempt;
+  if (!attempt) {
+    const message = `Selected asset ${node.asset_id} has no current attempt identity.`;
+    const diagnostic = { asset_id: node.asset_id, code: "current_attempt_missing", severity: "error" };
+    throw new LineageSelectionPacketError(message, warnings, ["current_attempt_missing"], [...diagnostics, diagnostic]);
+  }
+  if (!attempt.id || !attempt.asset_id || !Number.isInteger(attempt.attempt_index) || attempt.attempt_index <= 0 || !attempt.source || attempt.is_current !== true) {
+    const message = `Selected asset ${node.asset_id} has malformed current attempt identity.`;
+    const diagnostic = { asset_id: node.asset_id, code: "current_attempt_invalid_identity", severity: "error" };
+    throw new LineageSelectionPacketError(message, warnings, ["current_attempt_invalid_identity"], [...diagnostics, diagnostic]);
+  }
+  if (!attempt.checksum_sha256 || !SHA256_PATTERN.test(attempt.checksum_sha256)) {
+    const message = `Selected asset ${node.asset_id} current attempt does not have a valid lowercase SHA-256 checksum.`;
+    const diagnostic = { asset_id: node.asset_id, code: "current_attempt_invalid_checksum", severity: "error" };
+    throw new LineageSelectionPacketError(message, warnings, ["current_attempt_invalid_checksum"], [...diagnostics, diagnostic]);
+  }
+  return {
+    asset_id: attempt.asset_id,
+    attempt_index: attempt.attempt_index,
+    checksum_sha256: attempt.checksum_sha256,
+    file_path: attempt.file_path,
+    generation_job_id: attempt.generation_job_id,
+    id: attempt.id,
+    is_current: attempt.is_current,
+    source: attempt.source
+  };
+}
+function assetForNodeV2(node, visibleCatalogAsset, catalogById, warnings, errors, diagnostics) {
+  const currentAttempt = requireV2CurrentAttempt(node, warnings, diagnostics);
+  const currentAttemptCatalogAsset = catalogById.get(currentAttempt.asset_id);
+  const isVisibleNodeAttempt = currentAttempt.asset_id === node.asset_id;
+  const mediaCatalogAsset = currentAttemptCatalogAsset || (isVisibleNodeAttempt ? visibleCatalogAsset : void 0);
+  const localReference = currentAttempt.file_path || mediaCatalogAsset?.local?.absolute_path || mediaCatalogAsset?.local?.relative_path || (isVisibleNodeAttempt ? node.local_path : void 0);
+  const absolutePath = resolveLocalReference(localReference);
+  const localExists = absolutePath ? existsSync12(absolutePath) : false;
+  const hasLocalClaim = Boolean(localReference);
+  const s3Key = mediaCatalogAsset?.s3?.key || (isVisibleNodeAttempt ? node.s3_key : void 0);
+  const hasS3 = Boolean(s3Key);
+  const mimeType = mediaCatalogAsset?.local?.content_type || mediaCatalogAsset?.s3?.content_type || visibleCatalogAsset?.local?.content_type || visibleCatalogAsset?.s3?.content_type || (localReference ? contentTypeFor(localReference) : void 0);
+  const mediaType = mediaCatalogAsset?.content_type || visibleCatalogAsset?.content_type || node.media_type;
+  if (localExists && absolutePath && fileSha256(absolutePath) !== currentAttempt.checksum_sha256) {
+    const message = `Selected asset ${node.asset_id} current attempt checksum does not match its local file.`;
+    const diagnostic = { asset_id: node.asset_id, code: "current_attempt_checksum_mismatch", severity: "error" };
+    throw new LineageSelectionPacketError(message, [...warnings, message], ["current_attempt_checksum_mismatch"], [...diagnostics, diagnostic]);
+  }
+  const s3Checksum = mediaCatalogAsset?.s3?.checksum_sha256;
+  if (hasS3 && s3Checksum && s3Checksum !== currentAttempt.checksum_sha256) {
+    const message = `Selected asset ${node.asset_id} current attempt checksum does not match its S3 media envelope.`;
+    const diagnostic = { asset_id: node.asset_id, code: "current_attempt_checksum_mismatch", severity: "error" };
+    throw new LineageSelectionPacketError(message, [...warnings, message], ["current_attempt_checksum_mismatch"], [...diagnostics, diagnostic]);
+  }
+  if (hasLocalClaim && !localExists) {
+    warnings.push(`Selected asset ${node.asset_id} current attempt has a local path but the file is missing: ${absolutePath || localReference}`);
+  }
+  if (!hasLocalClaim && !hasS3) {
+    const message = `Selected asset ${node.asset_id} current attempt has neither a local file nor S3 key.`;
+    warnings.push(message);
+    errors.push(message);
+  }
+  if (mediaType && mediaType !== "image" && mediaType !== "gif") {
+    warnings.push(`Selected asset ${node.asset_id} is ${mediaType}, not an image/gif asset.`);
+    addDiagnostic(diagnostics, { asset_id: node.asset_id, code: "unsupported_media_type", severity: "warning" });
+  }
+  const conflictingChecksums = [
+    currentAttemptCatalogAsset?.local?.checksum_sha256,
+    currentAttemptCatalogAsset?.s3?.checksum_sha256,
+    visibleCatalogAsset?.local?.checksum_sha256,
+    visibleCatalogAsset?.s3?.checksum_sha256,
+    node.checksum_sha256
+  ].filter((checksum) => Boolean(checksum && checksum !== currentAttempt.checksum_sha256));
+  if (conflictingChecksums.length > 0) {
+    warnings.push(`Selected asset ${node.asset_id} catalog or visible-node checksum differs from its current attempt; current attempt checksum is authoritative.`);
+  }
+  return {
+    asset_id: node.asset_id,
+    campaign: visibleCatalogAsset?.campaign || node.campaign,
+    channel: visibleCatalogAsset?.channel || node.channel,
+    checksum_sha256: currentAttempt.checksum_sha256,
+    current_attempt: currentAttempt,
+    local: {
+      absolute_path: absolutePath,
+      content_type: mediaCatalogAsset?.local?.content_type,
+      exists: localExists,
+      relative_path: mediaCatalogAsset?.local?.relative_path || currentAttempt.file_path || (isVisibleNodeAttempt ? node.local_path : void 0),
+      size_bytes: mediaCatalogAsset?.local?.size_bytes || fileSize(absolutePath)
+    },
+    media_type: mediaType,
+    mime_type: mimeType,
+    review_notes: node.review_notes,
+    review_state: node.review_state,
+    s3: {
+      bucket: mediaCatalogAsset?.s3?.bucket,
+      checksum_sha256: mediaCatalogAsset?.s3?.checksum_sha256,
+      content_type: mediaCatalogAsset?.s3?.content_type,
+      etag: mediaCatalogAsset?.s3?.etag,
+      key: s3Key,
+      region: mediaCatalogAsset?.s3?.region,
+      size_bytes: mediaCatalogAsset?.s3?.size_bytes,
+      version_id: mediaCatalogAsset?.s3?.version_id
+    },
+    selection_note: node.selection_note,
+    source: mediaCatalogAsset?.source || visibleCatalogAsset?.source || node.source,
+    status: visibleCatalogAsset?.status || node.status,
+    storage_state: storageState(hasLocalClaim, hasS3),
+    title: visibleCatalogAsset?.title || node.title || node.asset_id
+  };
+}
+function getLineageSelectionPacketV1(project, options = {}) {
+  const workspace = resolveWorkspace(project, options);
+  const snapshot = getLineageSnapshot(project, workspace.root_asset_id);
+  const catalogSummary = validateProject(project);
+  const catalogAssets = listAllAssets(project);
+  const catalogById = new Map(catalogAssets.map((asset) => [asset.asset_id, asset]));
+  const warnings = [];
+  const errors = [];
+  const nodeById = new Map(snapshot.nodes.map((node) => [node.asset_id, node]));
+  const selectedItems = snapshot.selections.map((selection) => ({
+    asset_id: selection.asset_id,
+    position: selection.position,
+    selected_at: selection.selected_at,
+    selection_note: selection.notes
+  }));
+  if (selectedItems.length === 0) warnings.push(`Lineage workspace ${workspace.id} has no selected assets.`);
+  const assets = selectedItems.flatMap((item) => {
+    const node = nodeById.get(item.asset_id);
+    if (!node) {
+      const message = `Selected asset ${item.asset_id} is not present in the resolved workspace snapshot.`;
+      warnings.push(message);
+      errors.push("selected_asset_outside_workspace");
+      return [];
+    }
+    return [assetForNode(node, catalogById.get(item.asset_id), warnings)];
+  });
+  if (assets.some((asset) => !asset.dimensions)) warnings.push("Image dimensions are unavailable for one or more selected assets.");
+  if (options.strict) {
+    const strictErrors = [
+      ...selectedItems.length === 0 ? ["empty_selection"] : [],
+      ...assets.filter((asset) => asset.local.absolute_path && !asset.local.exists).map((asset) => `missing_local_file:${asset.asset_id}`),
+      ...errors
+    ];
+    if (strictErrors.length > 0) {
+      throw new LineageSelectionPacketError(`Lineage selection packet strict mode failed: ${strictErrors.join(", ")}`, warnings, strictErrors);
+    }
+  }
+  const context = {
+    campaign: options.campaign,
+    channel: options.channel,
+    labels: options.labels || [],
+    notes: options.contextNotes
+  };
+  const identity = {
+    assets: assets.map((asset) => ({
+      asset_id: asset.asset_id,
+      checksum_sha256: asset.checksum_sha256,
+      local_path: asset.local.absolute_path,
+      s3_key: asset.s3.key,
+      storage_state: asset.storage_state
+    })),
+    context,
+    project,
+    root_asset_id: workspace.root_asset_id,
+    schema_version: "lineage.selection_packet.v1",
+    selection: selectedItems,
+    workspace_id: workspace.id
+  };
+  return {
+    assets,
+    context,
+    created_at: (/* @__PURE__ */ new Date()).toISOString(),
+    errors,
+    kind: "lineage.selection_packet",
+    packet_id: packetId(identity),
+    product: catalogSummary.product,
+    project,
+    schema_version: "lineage.selection_packet.v1",
+    selection: {
+      asset_ids: selectedItems.map((item) => item.asset_id),
+      count: selectedItems.length,
+      items: selectedItems,
+      root_asset_id: workspace.root_asset_id
+    },
+    source: {
+      app: "lineage",
+      command: options.command,
+      db_path: options.dbPath || process.env.LINEAGE_DB || lineageDbPath(),
+      package: options.packageVersion
+    },
+    warnings: [...new Set(warnings)],
+    workspace: {
+      active_at: workspace.active_at,
+      id: workspace.id,
+      notes: workspace.notes,
+      root_asset_id: workspace.root_asset_id,
+      status: workspace.status,
+      title: workspace.title
+    }
+  };
+}
+function getLineageSelectionPacketV2(project, options) {
+  const workspace = resolveWorkspace(project, options);
+  const snapshot = getLineageSnapshot(project, workspace.root_asset_id);
+  const catalogSummary = validateProject(project);
+  const catalogAssets = listAllAssets(project);
+  const catalogById = new Map(catalogAssets.map((asset) => [asset.asset_id, asset]));
+  const warnings = [];
+  const errors = [];
+  const diagnostics = [];
+  const nodeById = new Map(snapshot.nodes.map((node) => [node.asset_id, node]));
+  const selectedItems = snapshot.selections.map((selection) => ({
+    asset_id: selection.asset_id,
+    position: selection.position,
+    selected_at: selection.selected_at,
+    selection_note: selection.notes
+  }));
+  if (selectedItems.length === 0) {
+    warnings.push(`Lineage workspace ${workspace.id} has no selected assets.`);
+    addDiagnostic(diagnostics, { code: "empty_selection", severity: "warning" });
+  }
+  const assets = [];
+  for (const item of selectedItems) {
+    const node = nodeById.get(item.asset_id);
+    if (!node) {
+      const message = `Selected asset ${item.asset_id} is not present in the resolved workspace snapshot.`;
+      warnings.push(message);
+      errors.push(message);
+      const diagnostic = { asset_id: item.asset_id, code: "selected_asset_outside_workspace", severity: "error" };
+      addDiagnostic(diagnostics, diagnostic);
+      throw new LineageSelectionPacketError(message, warnings, ["selected_asset_outside_workspace"], diagnostics);
+    }
+    assets.push(assetForNodeV2(node, catalogById.get(item.asset_id), catalogById, warnings, errors, diagnostics));
+  }
+  if (assets.some((asset) => !asset.dimensions)) {
+    warnings.push("Image dimensions are unavailable for one or more selected assets.");
+  }
+  if (options.strict) {
+    const strictErrors = [
+      ...selectedItems.length === 0 ? ["empty_selection"] : [],
+      ...assets.filter((asset) => asset.local.absolute_path && !asset.local.exists).map((asset) => `missing_local_file:${asset.asset_id}`),
+      ...assets.filter((asset) => asset.storage_state === "unresolved").map((asset) => `unresolved_current_attempt_media:${asset.asset_id}`),
+      ...diagnostics.filter((diagnostic) => diagnostic.severity === "error").map((diagnostic) => `${diagnostic.code}${diagnostic.asset_id ? `:${diagnostic.asset_id}` : ""}`)
+    ];
+    if (strictErrors.length > 0) {
+      throw new LineageSelectionPacketError(
+        `Lineage selection packet strict mode failed: ${strictErrors.join(", ")}`,
+        warnings,
+        strictErrors,
+        diagnostics
+      );
+    }
+  }
+  const packet = {
+    assets,
+    context: {
+      campaign: options.campaign,
+      channel: options.channel,
+      labels: options.labels || [],
+      notes: options.contextNotes
+    },
+    created_at: (/* @__PURE__ */ new Date()).toISOString(),
+    diagnostics,
+    errors: [...new Set(errors)],
+    identity_sha256: "",
+    kind: "lineage.selection_packet",
+    packet_id: "",
+    product: catalogSummary.product,
+    project,
+    schema_version: "lineage.selection_packet.v2",
+    selection: {
+      asset_ids: selectedItems.map((item) => item.asset_id),
+      count: selectedItems.length,
+      items: selectedItems,
+      root_asset_id: workspace.root_asset_id
+    },
+    source: {
+      app: "lineage",
+      command: options.command,
+      db_path: options.dbPath || process.env.LINEAGE_DB || lineageDbPath(),
+      package: options.packageVersion
+    },
+    warnings: [...new Set(warnings)],
+    workspace: {
+      active_at: workspace.active_at,
+      id: workspace.id,
+      notes: workspace.notes,
+      root_asset_id: workspace.root_asset_id,
+      status: workspace.status,
+      title: workspace.title
+    }
+  };
+  packet.identity_sha256 = lineageSelectionPacketV2IdentitySha256(packet);
+  packet.packet_id = `lineage_packet_${packet.identity_sha256.slice(0, 24)}`;
+  return packet;
+}
+function getLineageSelectionPacket(project, options = {}) {
+  return options.schema === "v2" ? getLineageSelectionPacketV2(project, options) : getLineageSelectionPacketV1(project, options);
+}
+
+// src/cli/lineageCli.ts
+function packageRoot2() {
+  return resolve8(dirname7(fileURLToPath3(import.meta.url)), "..", "..");
+}
+function packageVersion() {
+  try {
+    const packageInfo2 = JSON.parse(readFileSync8(join13(packageRoot2(), "package.json"), "utf8"));
+    return packageInfo2.version || "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
+function readOption(args, name) {
+  const prefix = `${name}=`;
+  const inline = args.find((arg) => arg.startsWith(prefix));
+  if (inline) return inline.slice(prefix.length);
+  const index = args.indexOf(name);
+  if (index >= 0) return args[index + 1];
+  return void 0;
+}
+function readOptions(args, name) {
+  const values = [];
+  const prefix = `${name}=`;
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg.startsWith(prefix)) values.push(arg.slice(prefix.length));
+    else if (arg === name && args[index + 1] && !args[index + 1].startsWith("--")) {
+      values.push(args[index + 1]);
+      index += 1;
+    }
+  }
+  return values;
+}
+function resolveCliAssetRoot(args) {
+  return resolve8(readOption(args, "--asset-root") || process.env.LINEAGE_ASSET_ROOT || packageRoot);
+}
+function configureCliAssetRoot(args) {
+  const assetRoot = resolveCliAssetRoot(args);
+  process.env.LINEAGE_ASSET_ROOT = assetRoot;
+  return setLineageAssetRoot(assetRoot);
+}
+function positionalArgs(args) {
+  const values = [];
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg.startsWith("--")) {
+      if (!arg.includes("=") && args[index + 1] && !args[index + 1].startsWith("--")) index += 1;
+      continue;
+    }
+    values.push(arg);
+  }
+  return values;
+}
+function resolveDataCommandOptions(args) {
+  configureCliAssetRoot(args);
+  const positions = positionalArgs(args);
+  const options = {
+    assetId: readOption(args, "--asset-id") || positions[0],
+    childAssetId: readOption(args, "--child"),
+    claimToken: readOption(args, "--claim-token") || process.env.LINEAGE_CLAIM_TOKEN,
+    confirmWrite: args.includes("--confirm-write"),
+    dbPath: readOption(args, "--db"),
+    json: args.includes("--json"),
+    project: readOption(args, "--project") || process.env.LINEAGE_DEFAULT_PRODUCT || defaultProduct,
+    rootAssetId: readOption(args, "--root")
+  };
+  if (options.dbPath) process.env.LINEAGE_DB = options.dbPath;
+  return options;
+}
+function runLineageDataCommand(command, args) {
+  const options = resolveDataCommandOptions(args);
+  if (command === "next") return getLineageNextAsset(options.project, options.rootAssetId || options.assetId);
+  if (command === "brief") return getLineageBrief(options.project, options.rootAssetId || options.assetId);
+  if (command === "inspect") {
+    if (!options.assetId) throw new Error("lineage inspect requires --asset-id");
+    return getLineageSnapshot(options.project, options.assetId);
+  }
+  if (command === "selection") {
+    const subcommand = positionalArgs(args)[0] || "";
+    if (subcommand !== "packet") throw new Error(`Unknown selection command: ${subcommand}`);
+    const schema = readOption(args, "--schema");
+    if (schema && schema !== "v2") throw new Error(`Unsupported selection packet schema: ${schema}. Omit --schema for v1 or pass --schema v2.`);
+    const labels = readOptions(args, "--label").flatMap((label) => label.split(",")).map((label) => label.trim()).filter(Boolean);
+    const packet = getLineageSelectionPacket(options.project, {
+      campaign: readOption(args, "--campaign"),
+      channel: readOption(args, "--channel"),
+      command: "lineage selection packet",
+      contextNotes: readOption(args, "--context-notes") || readOption(args, "--notes"),
+      dbPath: options.dbPath,
+      labels,
+      packageVersion: packageVersion(),
+      rootAssetId: options.rootAssetId,
+      schema: schema === "v2" ? "v2" : void 0,
+      strict: args.includes("--strict"),
+      workspaceId: readOption(args, "--workspace") || readOption(args, "--workspace-id")
+    });
+    const out = readOption(args, "--out");
+    if (out) {
+      const outPath = resolve8(out);
+      mkdirSync8(dirname7(outPath), { recursive: true });
+      writeFileSync6(outPath, `${JSON.stringify(packet, null, 2)}
+`);
+    }
+    return packet;
+  }
+  if (command === "link-child") {
+    if (!options.childAssetId) throw new Error("lineage link-child requires --child");
+    return linkSelectedLineageChild(options.project, {
+      childAssetId: options.childAssetId,
+      claimToken: options.claimToken,
+      confirmWrite: options.confirmWrite,
+      rootAssetId: options.rootAssetId || options.assetId
+    });
+  }
+  if (command === "reroll") {
+    const subcommand = positionalArgs(args)[0] || "";
+    if (subcommand === "list") {
+      if (!options.rootAssetId) throw new Error("lineage reroll list requires --root");
+      return listLineageRerollRequests(options.project, options.rootAssetId);
+    }
+    if (subcommand === "mark") {
+      const targetAssetId = readOption(args, "--target");
+      const requestedBy = rerollRequestedBy(readOption(args, "--requested-by") || "agent");
+      if (!options.rootAssetId) throw new Error("lineage reroll mark requires --root");
+      if (!targetAssetId) throw new Error("lineage reroll mark requires --target");
+      return markLineageRerollRequest(options.project, {
+        rootAssetId: options.rootAssetId,
+        nodeAssetId: targetAssetId,
+        notes: readOption(args, "--notes"),
+        requestedBy,
+        confirmWrite: options.confirmWrite
+      });
+    }
+    if (subcommand === "cancel") {
+      const targetAssetId = readOption(args, "--target");
+      if (!options.rootAssetId) throw new Error("lineage reroll cancel requires --root");
+      if (!targetAssetId) throw new Error("lineage reroll cancel requires --target");
+      return clearLineageRerollRequest(options.project, {
+        rootAssetId: options.rootAssetId,
+        nodeAssetId: targetAssetId,
+        confirmWrite: options.confirmWrite
+      });
+    }
+    if (subcommand === "plan") {
+      const targetAssetId = readOption(args, "--target");
+      const prompt = readOption(args, "--prompt");
+      if (!options.rootAssetId) throw new Error("lineage reroll plan requires --root");
+      if (!targetAssetId) throw new Error("lineage reroll plan requires --target");
+      if (!prompt) throw new Error("lineage reroll plan requires --prompt");
+      return planImageReroll(options.project, {
+        rootAssetId: options.rootAssetId,
+        targetAssetId,
+        prompt,
+        dryRun: args.includes("--dry-run")
+      });
+    }
+    if (subcommand === "import") {
+      const jobId2 = readOption(args, "--job-id");
+      const file = readOption(args, "--file");
+      if (!jobId2) throw new Error("lineage reroll import requires --job-id");
+      if (!file) throw new Error("lineage reroll import requires --file");
+      return importImageRerollOutput(options.project, { jobId: jobId2, file, confirmWrite: options.confirmWrite });
+    }
+    throw new Error(`Unknown reroll command: ${subcommand}`);
+  }
+  if (command === "tasks") {
+    const subcommand = positionalArgs(args)[0] || "";
+    const taskId = readOption(args, "--task");
+    if (subcommand === "list") {
+      if (!options.rootAssetId) throw new Error("lineage tasks list requires --root");
+      return listLineageTasks(options.project, options.rootAssetId);
+    }
+    if (subcommand === "inspect") {
+      if (!taskId) throw new Error("lineage tasks inspect requires --task");
+      return getLineageTask(options.project, taskId);
+    }
+    if (subcommand === "claim") {
+      const agentName = readOption(args, "--agent-name");
+      if (!taskId) throw new Error("lineage tasks claim requires --task");
+      if (!agentName) throw new Error("lineage tasks claim requires --agent-name");
+      return claimLineageTask(options.project, { taskId, agentName });
+    }
+    if (subcommand === "start") {
+      if (!taskId) throw new Error("lineage tasks start requires --task");
+      if (!options.claimToken) throw new Error("lineage tasks start requires --claim-token");
+      return startLineageTask(options.project, { taskId, claimToken: options.claimToken });
+    }
+    if (subcommand === "comment") {
+      const message = readOption(args, "--message");
+      if (!taskId) throw new Error("lineage tasks comment requires --task");
+      if (!message) throw new Error("lineage tasks comment requires --message");
+      return addLineageTaskComment(options.project, {
+        actor: readOption(args, "--actor") || "human",
+        message,
+        taskId
+      });
+    }
+    if (subcommand === "cancel") {
+      if (!taskId) throw new Error("lineage tasks cancel requires --task");
+      return cancelLineageTask(options.project, {
+        actor: readOption(args, "--actor") || "human",
+        confirmWrite: options.confirmWrite,
+        override: args.includes("--override"),
+        taskId
+      });
+    }
+    if (subcommand === "override") {
+      const reason = readOption(args, "--reason");
+      if (!taskId) throw new Error("lineage tasks override requires --task");
+      if (!reason) throw new Error("lineage tasks override requires --reason");
+      return overrideLineageTask(options.project, {
+        actor: readOption(args, "--actor") || "human",
+        instructions: readOption(args, "--instructions"),
+        reason,
+        taskId
+      });
+    }
+    if (subcommand === "instructions") {
+      const instructions = readOption(args, "--instructions");
+      if (!taskId) throw new Error("lineage tasks instructions requires --task");
+      if (instructions === void 0) throw new Error("lineage tasks instructions requires --instructions");
+      return updateLineageTaskInstructions(options.project, { instructions, taskId });
+    }
+    throw new Error(`Unknown tasks command: ${subcommand}`);
+  }
+  throw new Error(`Unknown command: ${command}`);
+}
+function rerollRequestedBy(value) {
+  if (value === "agent" || value === "human" || value === "system") return value;
+  throw new Error(`Invalid re-roll requester: ${value}`);
+}
+function lineageCliCanDelegateMutation(command, args) {
+  const subcommand = positionalArgs(args)[0] || "";
+  if (command === "link-child") return true;
+  if (command === "reroll") return ["mark", "cancel", "plan", "import"].includes(subcommand);
+  if (command === "tasks") return ["claim", "start", "comment", "cancel", "override", "instructions"].includes(subcommand);
+  if (command === "agent") return ["claim", "heartbeat", "release", "revoke", "transfer"].includes(subcommand);
+  return false;
+}
+function executeDelegatedLineageMutation(command, args) {
+  if (!lineageCliCanDelegateMutation(command, args)) throw new Error(`Unsupported managed writer command: ${command}`);
+  if (command === "agent") {
+    const agentCommand = args[0] || "";
+    return runLineageAgentCommand(agentCommand, args.slice(1));
+  }
+  return runLineageDataCommand(command, args);
+}
+function runLineageAgentCommand(command, args) {
+  configureCliAssetRoot(args);
+  const dbPath = readOption(args, "--db");
+  if (dbPath) process.env.LINEAGE_DB = dbPath;
+  const project = readOption(args, "--project") || process.env.LINEAGE_DEFAULT_PRODUCT || defaultProduct;
+  const claimId = readOption(args, "--claim");
+  const claimToken = readOption(args, "--claim-token") || process.env.LINEAGE_CLAIM_TOKEN;
+  if (command === "claim") {
+    return createAgentClaim({
+      agentId: readOption(args, "--agent-id"),
+      agentKind: readOption(args, "--agent-kind"),
+      agentName: readOption(args, "--agent-name") || "",
+      channel: readOption(args, "--channel"),
+      force: args.includes("--force"),
+      project,
+      reason: readOption(args, "--reason"),
+      scopeType: readOption(args, "--scope") || "",
+      targetId: readOption(args, "--target") || "",
+      targetTitle: readOption(args, "--target-title"),
+      threadId: readOption(args, "--thread-id"),
+      ttlSeconds: parseClaimTtl(readOption(args, "--ttl"))
+    });
+  }
+  if (command === "status") return listAgentClaims(project);
+  if (command === "graph") {
+    const rootAssetId = readOption(args, "--root") || readOption(args, "--asset-id") || positionalArgs(args)[0];
+    if (!rootAssetId) throw new Error("lineage agent graph requires --root");
+    return getLineageSnapshot(project, rootAssetId);
+  }
+  if (command === "inspect") {
+    if (!claimId) throw new Error("lineage agent inspect requires --claim");
+    return inspectAgentClaim(claimId, project);
+  }
+  if (command === "heartbeat") {
+    if (!claimToken) throw new Error("lineage agent heartbeat requires --claim-token");
+    return heartbeatAgentClaim(claimToken, parseClaimTtl(readOption(args, "--ttl")));
+  }
+  if (command === "release") {
+    if (!claimToken) throw new Error("lineage agent release requires --claim-token");
+    return releaseAgentClaim(claimToken);
+  }
+  if (command === "revoke") {
+    if (!claimId) throw new Error("lineage agent revoke requires --claim");
+    return revokeAgentClaim(project, claimId, {
+      actor: readOption(args, "--actor") || "human",
+      confirmWrite: args.includes("--confirm-write"),
+      reason: readOption(args, "--reason")
+    });
+  }
+  if (command === "transfer") {
+    if (!claimId) throw new Error("lineage agent transfer requires --claim");
+    return transferAgentClaim(project, claimId, {
+      actor: readOption(args, "--actor") || "human",
+      confirmWrite: args.includes("--confirm-write"),
+      reason: readOption(args, "--reason"),
+      toAgentName: readOption(args, "--to-agent-name") || ""
+    });
+  }
+  throw new Error(`Unknown agent command: ${command}`);
+}
+
 // src/server.ts
+var runtimeChannel = normalizeRuntimeChannel(process.env.LINEAGE_CHANNEL || process.env.LINEAGE_RELEASE_CHANNEL);
+var startupCode = assertLineageCodeOrigin(runtimeChannel);
+assertRuntimeProfileSafety(runtimeChannel);
+var startupRuntime = getLineageRuntimeInfo({ channel: runtimeChannel, code: startupCode });
+if (!process.env.LINEAGE_PROFILE) assertUnselectedDatabaseIsUnbound(startupRuntime);
+var startupProfile;
+if (process.env.LINEAGE_PROFILE) {
+  if (!process.env.LINEAGE_PROFILE_ID || !process.env.LINEAGE_PROFILE_ENVIRONMENT || !process.env.LINEAGE_PROFILE_MANIFEST) {
+    throw new Error("LINEAGE_PROFILE must be resolved by the Lineage CLI before server startup; use lineage start --profile or lineage-dev start --profile");
+  }
+  const doctor = doctorLineageProfile(process.env.LINEAGE_PROFILE, {
+    channel: runtimeChannel,
+    code: startupRuntime.code,
+    gitSha: startupRuntime.git_sha,
+    version: startupRuntime.version
+  });
+  if (!doctor.ok) {
+    const failures = doctor.checks.filter((check) => check.status === "fail").map((check) => `${check.id}: ${check.message}`).join("; ");
+    throw new Error(`Configured Lineage profile failed doctor: ${failures}`);
+  }
+  assertResolvedRuntimeProfileEnvironment(doctor.profile);
+  startupProfile = doctor.profile;
+}
+var writerLease = startupProfile ? acquireProfileWriterLease(startupProfile, runtimeChannel, "service") : void 0;
+if (startupProfile) delete process.env.LINEAGE_DB_ACCESS;
+else process.env.LINEAGE_DB_ACCESS = "read-only";
+if (writerLease) {
+  try {
+    const startupDatabase = lineageDb();
+    startupDatabase.close();
+  } catch (error) {
+    writerLease.release();
+    throw error;
+  }
+}
 var app = express2();
 var port = Number(process.env.PORT || 5173);
 var host = process.env.HOST || "lineage.localhost";
 var isProduction = process.env.NODE_ENV === "production";
 var maxUploadBytes = Number(process.env.LINEAGE_MAX_UPLOAD_MB || 200) * 1024 * 1024;
-var upload = multer({ dest: ensureUploadDir(), limits: { fileSize: maxUploadBytes } });
+var upload = multer({
+  limits: { fileSize: maxUploadBytes },
+  storage: startupProfile ? multer.diskStorage({ destination: ensureUploadDir() }) : multer.memoryStorage()
+});
 app.use(express2.json({ limit: "1mb" }));
+registerManagedWriterRoute(app, {
+  accepts: lineageCliCanDelegateMutation,
+  channel: runtimeChannel,
+  execute: executeDelegatedLineageMutation,
+  profile: startupProfile,
+  writerLease
+});
+app.use((req, res, next) => {
+  if (startupProfile || req.method === "GET" || req.method === "HEAD" || req.method === "OPTIONS") return next();
+  res.status(409).json({
+    error: "profile_required",
+    message: "Persistent writes require a selected named Lineage profile; legacy-unbound service access is read-only."
+  });
+});
 function projectFrom(input) {
   const candidate = input.body?.project || input.body?.product || input.query?.project || input.query?.product;
   return typeof candidate === "string" ? candidate : defaultProduct;
@@ -7279,7 +9434,7 @@ app.get("/api/projects", asyncRoute((_req, res) => {
   res.json({ projects: listProjects() });
 }));
 app.get("/api/runtime", asyncRoute((_req, res) => {
-  res.json({ ok: true, runtime: getLineageRuntimeInfo() });
+  res.json({ ok: true, runtime: getLineageRuntimeInfo({ channel: runtimeChannel, code: startupCode }) });
 }));
 app.get(
   "/api/assets",
@@ -7601,16 +9756,16 @@ app.post(
   })
 );
 if (isProduction) {
-  const dist = join10(packageRoot, "dist", "web");
-  if (existsSync7(dist)) {
+  const dist = join14(packageRoot, "dist", "web");
+  if (existsSync14(dist)) {
     app.use(express2.static(dist));
-    app.get("*", (_req, res) => res.sendFile(join10(dist, "index.html")));
+    app.get("*", (_req, res) => res.sendFile(join14(dist, "index.html")));
   }
 } else {
   const { createServer: createViteServer } = await import("vite");
   const e2ePort = process.env.LINEAGE_E2E_PORT ? Number(process.env.LINEAGE_E2E_PORT) : void 0;
   const vite = await createViteServer({
-    configFile: join10(packageRoot, "vite.config.ts"),
+    configFile: join14(packageRoot, "vite.config.ts"),
     server: {
       middlewareMode: true,
       ...e2ePort ? { ws: { port: e2ePort + 1e3 } } : {}
@@ -7660,6 +9815,10 @@ app.use((error, _req, res, _next) => {
     res.status(error.status).json({ error: error.message });
     return;
   }
+  if (isManagedWriterRoutingError(error)) {
+    res.status(error.status).json({ error: error.message });
+    return;
+  }
   if (isAgentClaimError(error)) {
     res.status(error.status).json({ error: error.code, message: error.message, conflicts: error.conflicts });
     return;
@@ -7679,7 +9838,23 @@ app.use((error, _req, res, _next) => {
   const message = error instanceof Error ? error.message : String(error);
   res.status(500).json({ error: message });
 });
-app.listen(port, host, () => {
-  console.log(`Lineage listening on http://${host}:${port}`);
+var listenOrigin = `http://${host.includes(":") ? `[${host}]` : host}:${port}`;
+var server = app.listen(port, host, () => {
+  console.log(`Lineage listening on ${listenOrigin}`);
+});
+var releaseWriterLease = () => writerLease?.release();
+process.once("exit", releaseWriterLease);
+process.once("SIGINT", () => {
+  releaseWriterLease();
+  process.exit(130);
+});
+process.once("SIGTERM", () => {
+  releaseWriterLease();
+  process.exit(143);
+});
+server.once("error", (error) => {
+  releaseWriterLease();
+  console.error(`Lineage failed to listen on ${listenOrigin}: ${error.message}`);
+  process.exit(1);
 });
 //# sourceMappingURL=server.js.map