@mean-weasel/lineage 0.1.11 → 0.1.13

package/dist/cli/lineage-dev.js

@@ -1,19 +1,20 @@
 #!/usr/bin/env node
 
 // src/cli/lineageCli.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "node:fs";
-import { homedir, platform } from "node:os";
-import { dirname as dirname3, join as join7, resolve as resolve5 } from "node:path";
+import { existsSync as existsSync11, mkdirSync as mkdirSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "node:fs";
+import { randomUUID as randomUUID4 } from "node:crypto";
+import { homedir as homedir2, platform as platform2 } from "node:os";
+import { dirname as dirname6, join as join10, resolve as resolve8 } from "node:path";
 import { spawn } from "node:child_process";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // src/server/agentClaims.ts
-import { createHash as createHash2, randomBytes, timingSafeEqual } from "node:crypto";
+import { createHash as createHash4, randomBytes, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
 
 // src/server/assetLineageDb.ts
-import { createRequire } from "node:module";
-import { mkdirSync as mkdirSync3 } from "node:fs";
-import { join as join4 } from "node:path";
+import { createRequire as createRequire2 } from "node:module";
+import { existsSync as existsSync6, mkdirSync as mkdirSync5 } from "node:fs";
+import { join as join6 } from "node:path";
 
 // src/server/assetCore.ts
 import { existsSync as existsSync3, mkdirSync as mkdirSync2, readdirSync as readdirSync2, readFileSync as readFileSync2, unlinkSync, writeFileSync } from "node:fs";
@@ -587,20 +588,869 @@ function validateProject(project = defaultProject) {
   return { project: catalog.project, product: catalog.product, catalogPath: resolvedCatalogPath(project), default_bucket: catalog.default_bucket, default_region: catalog.default_region, asset_count: catalog.assets.length };
 }
 
-// src/server/assetLineageDb.ts
+// src/server/profileWriterLease.ts
+import { createHash as createHash3, randomUUID as randomUUID2, timingSafeEqual } from "node:crypto";
+import { existsSync as existsSync5, lstatSync, mkdirSync as mkdirSync4, readFileSync as readFileSync4, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname4, join as join5, resolve as resolve4 } from "node:path";
+
+// src/server/lineageProfiles.ts
+import { createHash as createHash2, randomUUID } from "node:crypto";
+import { createRequire } from "node:module";
+import {
+  chmodSync,
+  constants as fsConstants,
+  copyFileSync as copyFileSync2,
+  existsSync as existsSync4,
+  linkSync,
+  mkdirSync as mkdirSync3,
+  readFileSync as readFileSync3,
+  realpathSync,
+  rmSync,
+  statSync as statSync3,
+  writeFileSync as writeFileSync2
+} from "node:fs";
+import { homedir, platform } from "node:os";
+import { dirname as dirname3, isAbsolute, join as join4, relative as relative2, resolve as resolve3 } from "node:path";
+
+// src/shared/lineageProfileTypes.ts
+var lineageProfileSchemaVersion = "lineage.profile.v1";
+var lineageProfileDoctorSchemaVersion = "lineage.profile_doctor.v1";
+var lineageProfileCloneReceiptSchemaVersion = "lineage.profile_clone_receipt.v1";
+var lineageProfileAssetsCloneReceiptSchemaVersion = "lineage.profile_assets_clone_receipt.v1";
+
+// src/server/lineageProfiles.ts
 var require2 = createRequire(import.meta.url);
+var profileIdPattern = /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/;
+function lineageDataRoot() {
+  if (process.env.LINEAGE_HOME) return resolve3(process.env.LINEAGE_HOME);
+  if (platform() === "darwin") return join4(homedir(), "Library", "Application Support", "Lineage");
+  if (platform() === "win32") return join4(process.env.APPDATA || join4(homedir(), "AppData", "Roaming"), "Lineage");
+  return join4(process.env.XDG_DATA_HOME || join4(homedir(), ".local", "share"), "lineage");
+}
+function lineageProfileRoot() {
+  return resolve3(process.env.LINEAGE_PROFILE_ROOT || join4(lineageDataRoot(), "profiles"));
+}
+function environmentChannel(environment) {
+  if (environment === "production") return "stable";
+  if (environment === "preview") return "preview";
+  return "dev";
+}
+function channelEnvironment(channel) {
+  if (channel === "stable") return "production";
+  if (channel === "preview") return "preview";
+  return "development";
+}
+function profileManifestPath(selector) {
+  const value = selector.trim();
+  if (!value) throw new Error("Profile selector must not be empty");
+  const looksLikePath = isAbsolute(value) || value.includes("/") || value.includes("\\") || value.endsWith(".json");
+  if (looksLikePath) return { manifestPath: resolve3(value) };
+  if (!profileIdPattern.test(value)) throw new Error(`Invalid profile ID: ${value}`);
+  return { manifestPath: join4(lineageProfileRoot(), value, "profile.json"), namedProfileId: value };
+}
+function requiredString(record, key) {
+  const value = record[key];
+  if (typeof value !== "string" || !value.trim()) throw new Error(`Profile manifest requires a non-empty ${key}`);
+  return value.trim();
+}
+function optionalString(record, key) {
+  const value = record[key];
+  if (value === void 0) return void 0;
+  if (typeof value !== "string" || !value.trim()) throw new Error(`Profile manifest ${key} must be a non-empty string`);
+  return value.trim();
+}
+function validateEnvironment(value) {
+  if (value === "production" || value === "preview" || value === "development") return value;
+  throw new Error(`Invalid profile environment: ${value}`);
+}
+function validateChannel(value) {
+  if (value === void 0) return void 0;
+  if (value === "stable" || value === "preview" || value === "dev") return value;
+  throw new Error(`Invalid expected runtime channel: ${String(value)}`);
+}
+function validateCodeOrigin(value) {
+  if (value === void 0) return void 0;
+  if (value === "checkout" || value === "package") return value;
+  throw new Error(`Invalid expected runtime code_origin: ${String(value)}`);
+}
+function validateFingerprint(value, field) {
+  if (value === void 0) return void 0;
+  if (!/^[a-f0-9]{64}$/i.test(value)) throw new Error(`Profile ${field} must be a 64-character SHA-256 fingerprint`);
+  return value.toLowerCase();
+}
+function resolveManifestPath(manifestPath, value) {
+  return resolve3(dirname3(manifestPath), value);
+}
+function validateServiceOrigin(value) {
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    throw new Error(`Invalid profile service_origin: ${value}`);
+  }
+  if (parsed.protocol !== "http:") throw new Error("Profile service_origin must use http for the local Lineage service");
+  if (!parsed.port) throw new Error("Profile service_origin must include an explicit port");
+  if (parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash) {
+    throw new Error("Profile service_origin must contain only scheme, host, and port");
+  }
+  return parsed.origin;
+}
+function resolveLineageProfile(selector) {
+  const { manifestPath, namedProfileId } = profileManifestPath(selector);
+  if (!existsSync4(manifestPath)) throw new Error(`Profile manifest does not exist: ${manifestPath}`);
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync3(manifestPath, "utf8"));
+  } catch (error) {
+    throw new Error(`Could not parse profile manifest ${manifestPath}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+  }
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) throw new Error("Profile manifest must be a JSON object");
+  const record = raw;
+  const schemaVersion = requiredString(record, "schema_version");
+  if (schemaVersion !== lineageProfileSchemaVersion) throw new Error(`Unsupported profile schema_version: ${schemaVersion}`);
+  const profileId = requiredString(record, "profile_id");
+  if (!profileIdPattern.test(profileId)) throw new Error(`Invalid profile ID: ${profileId}`);
+  if (namedProfileId && namedProfileId !== profileId) {
+    throw new Error(`Named profile ${namedProfileId} does not match immutable manifest profile_id ${profileId}`);
+  }
+  const expectedRaw = record.expected_runtime;
+  if (expectedRaw !== void 0 && (!expectedRaw || typeof expectedRaw !== "object" || Array.isArray(expectedRaw))) {
+    throw new Error("Profile expected_runtime must be an object");
+  }
+  const expected = expectedRaw;
+  const expectedGitSha = expected ? optionalString(expected, "git_sha") : void 0;
+  const expectedVersion = expected ? optionalString(expected, "version") : void 0;
+  const expectedCodeFingerprint = validateFingerprint(expected ? optionalString(expected, "code_fingerprint") : void 0, "expected_runtime.code_fingerprint");
+  const expectedCodeOrigin = validateCodeOrigin(expected?.code_origin);
+  const migrationsRaw = record.required_schema_migrations;
+  if (migrationsRaw !== void 0 && (!Array.isArray(migrationsRaw) || migrationsRaw.some((value) => typeof value !== "string" || !value.trim()))) {
+    throw new Error("Profile required_schema_migrations must be an array of non-empty strings");
+  }
+  const environment = validateEnvironment(requiredString(record, "environment"));
+  const expectedChannel = validateChannel(expected?.channel);
+  if (expectedChannel && expectedChannel !== environmentChannel(environment)) {
+    throw new Error(`Profile environment ${environment} conflicts with expected runtime channel ${expectedChannel}`);
+  }
+  const manifest = {
+    asset_root: resolveManifestPath(manifestPath, requiredString(record, "asset_root")),
+    database_path: resolveManifestPath(manifestPath, requiredString(record, "database_path")),
+    environment,
+    ...expected ? {
+      expected_runtime: {
+        ...expectedChannel ? { channel: expectedChannel } : {},
+        ...expectedCodeFingerprint ? { code_fingerprint: expectedCodeFingerprint } : {},
+        ...expectedCodeOrigin ? { code_origin: expectedCodeOrigin } : {},
+        ...expectedGitSha ? { git_sha: expectedGitSha } : {},
+        ...expectedVersion ? { version: expectedVersion } : {}
+      }
+    } : {},
+    profile_id: profileId,
+    ...migrationsRaw ? { required_schema_migrations: migrationsRaw.map((value) => value.trim()) } : {},
+    schema_version: lineageProfileSchemaVersion,
+    service_origin: validateServiceOrigin(requiredString(record, "service_origin"))
+  };
+  return { ...manifest, manifest_path: manifestPath, profile_fingerprint: lineageProfileFingerprint(manifest) };
+}
+function lineageProfileFingerprint(profile) {
+  return createHash2("sha256").update(JSON.stringify({
+    asset_root: resolve3(profile.asset_root),
+    database_path: resolve3(profile.database_path),
+    environment: profile.environment,
+    profile_id: profile.profile_id,
+    schema_version: profile.schema_version,
+    service_origin: profile.service_origin
+  })).digest("hex");
+}
+function assertProfileRuntimePin(profile, runtime) {
+  if (!profile.expected_runtime?.code_fingerprint || !profile.expected_runtime.code_origin) {
+    throw new Error(`Profile ${profile.profile_id} must pin expected_runtime.code_fingerprint and expected_runtime.code_origin before binding or writing`);
+  }
+  if (!runtime?.code?.verified) {
+    throw new Error(`Profile ${profile.profile_id} requires a verified runtime code identity before binding or writing`);
+  }
+  if (runtime.code.fingerprint !== profile.expected_runtime.code_fingerprint) {
+    throw new Error(`Profile ${profile.profile_id} expects code fingerprint ${profile.expected_runtime.code_fingerprint}, found ${runtime.code.fingerprint}`);
+  }
+  if (runtime.code.origin !== profile.expected_runtime.code_origin) {
+    throw new Error(`Profile ${profile.profile_id} expects code origin ${profile.expected_runtime.code_origin}, found ${runtime.code.origin}`);
+  }
+}
+function assertProfileChannel(profile, channel) {
+  const requiredChannel = environmentChannel(profile.environment);
+  if (channel === requiredChannel) return;
+  if (profile.environment === "production") {
+    throw new Error(`Refusing to open production profile ${profile.profile_id} from ${channel} code; use the stable channel`);
+  }
+  throw new Error(`Profile ${profile.profile_id} requires the ${requiredChannel} channel, not ${channel}`);
+}
+function tableExists(database, table) {
+  return Boolean(database.prepare("select name from sqlite_master where type = 'table' and name = ?").get(table));
+}
+function tableColumns(database, table) {
+  if (!tableExists(database, table)) return /* @__PURE__ */ new Set();
+  return new Set(database.prepare(`pragma table_info(${table})`).all().map((row) => row.name));
+}
+function inspectDatabase(profile) {
+  const result = {
+    exists: existsSync4(profile.database_path),
+    migration_keys: [],
+    path: profile.database_path
+  };
+  if (!result.exists) return result;
+  try {
+    const { DatabaseSync } = require2("node:sqlite");
+    const database = new DatabaseSync(profile.database_path, { readOnly: true });
+    try {
+      if (tableExists(database, "lineage_profile_identity")) {
+        const columns = tableColumns(database, "lineage_profile_identity");
+        const fingerprintExpression = columns.has("profile_fingerprint") ? "profile_fingerprint" : "'' as profile_fingerprint";
+        const rows = database.prepare(`select profile_id, environment, bound_at, ${fingerprintExpression} from lineage_profile_identity`).all();
+        if (rows.length === 1) {
+          const identity2 = {
+            bound_at: typeof rows[0].bound_at === "string" ? rows[0].bound_at : void 0,
+            environment: String(rows[0].environment),
+            profile_fingerprint: typeof rows[0].profile_fingerprint === "string" ? rows[0].profile_fingerprint : "",
+            profile_id: String(rows[0].profile_id)
+          };
+          result.identity = identity2;
+        } else {
+          result.error = `Expected exactly one lineage_profile_identity row, found ${rows.length}`;
+        }
+      }
+      if (tableExists(database, "lineage_schema_migrations")) {
+        result.migration_keys = database.prepare("select key from lineage_schema_migrations order by key").all().map((row) => row.key);
+      }
+    } finally {
+      database.close();
+    }
+  } catch (error) {
+    result.error = error instanceof Error ? error.message : String(error);
+  }
+  return result;
+}
+function doctorLineageProfile(selector, runtime) {
+  const checks = [];
+  const result = {
+    checks,
+    ok: false,
+    runtime: {
+      channel: runtime.channel,
+      code_fingerprint: runtime.code?.fingerprint,
+      code_origin: runtime.code?.origin,
+      code_verified: runtime.code?.verified,
+      git_sha: runtime.gitSha,
+      version: runtime.version
+    },
+    schema_version: lineageProfileDoctorSchemaVersion
+  };
+  let profile;
+  try {
+    profile = resolveLineageProfile(selector);
+    result.profile = profile;
+    result.manifest_path = profile.manifest_path;
+    checks.push({ id: "manifest", message: `Loaded ${profile.profile_id}`, status: "pass" });
+  } catch (error) {
+    checks.push({ id: "manifest", message: error instanceof Error ? error.message : String(error), status: "fail" });
+    return result;
+  }
+  try {
+    assertProfileChannel(profile, runtime.channel);
+    checks.push({ id: "runtime_channel", message: `${runtime.channel} code matches ${profile.environment}`, status: "pass" });
+  } catch (error) {
+    checks.push({ id: "runtime_channel", message: error instanceof Error ? error.message : String(error), status: "fail" });
+  }
+  try {
+    assertProfileRuntimePin(profile, runtime);
+    checks.push({ id: "runtime_code", message: `Verified ${runtime.code.origin} code ${runtime.code.fingerprint}`, status: "pass" });
+  } catch (error) {
+    checks.push({ id: "runtime_code", message: error instanceof Error ? error.message : String(error), status: "fail" });
+  }
+  if (profile.expected_runtime?.version && profile.expected_runtime.version !== runtime.version) {
+    checks.push({ id: "runtime_version", message: `Expected version ${profile.expected_runtime.version}, found ${runtime.version}`, status: "fail" });
+  } else {
+    checks.push({ id: "runtime_version", message: `Runtime version ${runtime.version}`, status: "pass" });
+  }
+  if (profile.expected_runtime?.git_sha && profile.expected_runtime.git_sha !== runtime.gitSha) {
+    checks.push({ id: "runtime_git_sha", message: `Expected Git SHA ${profile.expected_runtime.git_sha}, found ${runtime.gitSha || "unavailable"}`, status: "fail" });
+  } else if (profile.expected_runtime?.git_sha) {
+    checks.push({ id: "runtime_git_sha", message: `Git SHA ${runtime.gitSha}`, status: "pass" });
+  }
+  const assetExists = existsSync4(profile.asset_root);
+  const assetIsDirectory = assetExists && statSync3(profile.asset_root).isDirectory();
+  result.asset_root = { exists: assetExists, is_directory: assetIsDirectory, path: profile.asset_root };
+  checks.push({
+    id: "asset_root",
+    message: assetIsDirectory ? `Asset root exists: ${profile.asset_root}` : `Asset root is missing or not a directory: ${profile.asset_root}`,
+    status: assetIsDirectory ? "pass" : "fail"
+  });
+  const database = inspectDatabase(profile);
+  result.database = database;
+  checks.push({
+    id: "database_exists",
+    message: database.exists ? `Database exists: ${profile.database_path}` : `Database does not exist: ${profile.database_path}`,
+    status: database.exists ? "pass" : "fail"
+  });
+  if (database.error) checks.push({ id: "database_read", message: database.error, status: "fail" });
+  if (!database.identity) {
+    checks.push({ id: "database_identity", message: "Database is not bound to a Lineage profile", status: "fail" });
+  } else if (database.identity.profile_id !== profile.profile_id || database.identity.environment !== profile.environment || database.identity.profile_fingerprint !== profile.profile_fingerprint) {
+    checks.push({
+      id: "database_identity",
+      message: `Database identity ${database.identity.profile_id}/${database.identity.environment}/${database.identity.profile_fingerprint || "no-fingerprint"} does not match ${profile.profile_id}/${profile.environment}/${profile.profile_fingerprint}`,
+      status: "fail"
+    });
+  } else {
+    checks.push({ id: "database_identity", message: `Database is bound to ${profile.profile_id}`, status: "pass" });
+  }
+  const missingMigrations = (profile.required_schema_migrations || []).filter((key) => !database.migration_keys.includes(key));
+  checks.push({
+    id: "database_schema",
+    message: missingMigrations.length ? `Missing required schema migrations: ${missingMigrations.join(", ")}` : `${database.migration_keys.length} schema migration marker(s) available`,
+    status: missingMigrations.length ? "fail" : "pass"
+  });
+  result.ok = checks.every((check) => check.status !== "fail");
+  return result;
+}
+function runtimeProfileIdentity(channel) {
+  const selector = process.env.LINEAGE_PROFILE;
+  const id = process.env.LINEAGE_PROFILE_ID;
+  const environment = process.env.LINEAGE_PROFILE_ENVIRONMENT;
+  if (selector && id && environment) {
+    return {
+      bound: true,
+      environment,
+      fingerprint: process.env.LINEAGE_PROFILE_FINGERPRINT,
+      id,
+      manifest_path: process.env.LINEAGE_PROFILE_MANIFEST,
+      service_origin: process.env.LINEAGE_PROFILE_SERVICE_ORIGIN
+    };
+  }
+  return {
+    bound: false,
+    environment: channelEnvironment(channel),
+    id: "legacy-unbound",
+    warning: id || environment || process.env.LINEAGE_PROFILE_FINGERPRINT || process.env.LINEAGE_PROFILE_MANIFEST ? "Invalid unbound runtime: derived profile identity was supplied without a resolved LINEAGE_PROFILE selector." : "Legacy unbound runtime: database and asset paths are not protected by a named profile."
+  };
+}
+function assertUnselectedDatabaseIsUnbound(runtime) {
+  if (!runtime.schema.profile_id) return;
+  const environment = runtime.schema.profile_environment || "unknown";
+  throw new Error(
+    `Database ${runtime.database.path} is bound to Lineage profile ${runtime.schema.profile_id}/${environment}; select that profile with --profile`
+  );
+}
+function ensureProfileIdentityTable(database) {
+  if (!tableExists(database, "lineage_profile_identity")) {
+    database.exec(`
+      create table lineage_profile_identity (
+        profile_id text primary key,
+        environment text not null,
+        profile_fingerprint text not null,
+        bound_at text not null
+      )
+    `);
+    return;
+  }
+  const columns = tableColumns(database, "lineage_profile_identity");
+  if (!columns.has("profile_id") || !columns.has("environment") || !columns.has("bound_at")) {
+    throw new Error("Existing lineage_profile_identity table has an unsupported shape");
+  }
+  if (!columns.has("profile_fingerprint")) {
+    database.exec("alter table lineage_profile_identity add column profile_fingerprint text not null default ''");
+  }
+}
+function assertRequiredMigrations(database, profile) {
+  const required = profile.required_schema_migrations || [];
+  if (required.length === 0) return;
+  if (!tableExists(database, "lineage_schema_migrations")) {
+    throw new Error(`Database is missing required schema migrations: ${required.join(", ")}`);
+  }
+  const available = new Set(database.prepare("select key from lineage_schema_migrations").all().map((row) => row.key));
+  const missing = required.filter((key) => !available.has(key));
+  if (missing.length > 0) throw new Error(`Database is missing required schema migrations: ${missing.join(", ")}`);
+}
+function profileIdentity(profile) {
+  return {
+    bound_at: (/* @__PURE__ */ new Date()).toISOString(),
+    environment: profile.environment,
+    profile_fingerprint: profile.profile_fingerprint,
+    profile_id: profile.profile_id
+  };
+}
+function bindOpenDatabase(database, profile, replace) {
+  database.exec("begin immediate");
+  try {
+    ensureProfileIdentityTable(database);
+    assertRequiredMigrations(database, profile);
+    const rows = database.prepare("select profile_id, environment, profile_fingerprint, bound_at from lineage_profile_identity").all();
+    if (!replace && rows.length > 0) {
+      if (rows.length !== 1) throw new Error(`Expected at most one lineage_profile_identity row, found ${rows.length}`);
+      const existing = rows[0];
+      const sameBaseIdentity = existing.profile_id === profile.profile_id && existing.environment === profile.environment;
+      const migratableLegacyIdentity = sameBaseIdentity && !existing.profile_fingerprint;
+      if (!migratableLegacyIdentity && existing.profile_fingerprint !== profile.profile_fingerprint) {
+        throw new Error(`Database is already bound to ${existing.profile_id}/${existing.environment}/${existing.profile_fingerprint || "no-fingerprint"}`);
+      }
+      if (!migratableLegacyIdentity) {
+        database.exec("commit");
+        return existing;
+      }
+    }
+    const identity2 = profileIdentity(profile);
+    database.exec("delete from lineage_profile_identity");
+    database.prepare("insert into lineage_profile_identity (profile_id, environment, profile_fingerprint, bound_at) values (?, ?, ?, ?)").run(identity2.profile_id, identity2.environment, identity2.profile_fingerprint, identity2.bound_at);
+    const integrity = database.prepare("pragma integrity_check").get();
+    if (integrity?.integrity_check !== "ok") throw new Error(`SQLite integrity check failed: ${integrity?.integrity_check || "unknown result"}`);
+    database.exec("commit");
+    return identity2;
+  } catch (error) {
+    try {
+      database.exec("rollback");
+    } catch {
+    }
+    throw error;
+  }
+}
+function bindLineageProfileDatabase(selector, runtime, confirmWrite) {
+  if (!confirmWrite) throw new Error("Profile bind requires --confirm-write");
+  const profile = resolveLineageProfile(selector);
+  assertProfileChannel(profile, runtime.channel);
+  assertProfileRuntimePin(profile, runtime);
+  if (!existsSync4(profile.database_path)) throw new Error(`Profile database does not exist: ${profile.database_path}`);
+  const { DatabaseSync } = require2("node:sqlite");
+  const database = new DatabaseSync(profile.database_path);
+  try {
+    const before = inspectDatabase(profile).identity;
+    const identity2 = bindOpenDatabase(database, profile, false);
+    return {
+      already_bound: Boolean(before?.profile_fingerprint === profile.profile_fingerprint),
+      database_path: profile.database_path,
+      identity: identity2,
+      schema_version: "lineage.profile_bind.v1"
+    };
+  } finally {
+    database.close();
+  }
+}
+async function cloneLineageProfileDatabase(sourceDatabasePath, targetSelector, runtime, confirmWrite) {
+  if (!confirmWrite) throw new Error("Profile clone requires --confirm-write");
+  const profile = resolveLineageProfile(targetSelector);
+  assertProfileChannel(profile, runtime.channel);
+  assertProfileRuntimePin(profile, runtime);
+  if (profile.environment === "production") throw new Error("Profile clone target must be preview or development, never production");
+  const sourcePath = resolve3(sourceDatabasePath);
+  const targetPath = resolve3(profile.database_path);
+  if (sourcePath === targetPath) throw new Error("Profile clone source and target database paths must be different");
+  if (!existsSync4(sourcePath)) throw new Error(`Profile clone source database does not exist: ${sourcePath}`);
+  if (existsSync4(targetPath)) throw new Error(`Profile clone target database already exists: ${targetPath}`);
+  mkdirSync3(dirname3(targetPath), { recursive: true });
+  const temporaryPath = `${targetPath}.clone-${randomUUID()}.tmp`;
+  const receiptDirectory = join4(dirname3(profile.manifest_path), "clone-receipts");
+  let targetCreated = false;
+  const { DatabaseSync, backup } = require2("node:sqlite");
+  const source = new DatabaseSync(sourcePath, { readOnly: true });
+  try {
+    const pagesCopied = await backup(source, temporaryPath);
+    const cloned = new DatabaseSync(temporaryPath);
+    let identity2;
+    try {
+      identity2 = bindOpenDatabase(cloned, profile, true);
+    } finally {
+      cloned.close();
+    }
+    linkSync(temporaryPath, targetPath);
+    targetCreated = true;
+    rmSync(temporaryPath, { force: true });
+    mkdirSync3(receiptDirectory, { recursive: true, mode: 448 });
+    const receiptPath = join4(receiptDirectory, `${Date.now()}-${randomUUID()}.json`);
+    const result = {
+      database_path: targetPath,
+      pages_copied: pagesCopied,
+      receipt_path: receiptPath,
+      schema_version: lineageProfileCloneReceiptSchemaVersion,
+      source_database_path: sourcePath,
+      target_identity: identity2
+    };
+    writeFileSync2(receiptPath, `${JSON.stringify({ ...result, created_at: (/* @__PURE__ */ new Date()).toISOString() }, null, 2)}
+`, { encoding: "utf8", flag: "wx", mode: 384 });
+    return result;
+  } catch (error) {
+    rmSync(temporaryPath, { force: true });
+    if (targetCreated) rmSync(targetPath, { force: true });
+    throw error;
+  } finally {
+    source.close();
+  }
+}
+function pathIsInside(path, parent) {
+  const child = relative2(parent, path);
+  return child !== "" && !child.startsWith("..") && !isAbsolute(child);
+}
+function fileSha2562(path) {
+  return createHash2("sha256").update(readFileSync3(path)).digest("hex");
+}
+function profileAssetReferences(database) {
+  const references = [];
+  const addColumn = (table, column, kind) => {
+    if (!tableColumns(database, table).has(column)) return;
+    const rows = database.prepare(`select ${column} value from ${table} where ${column} is not null and ${column} <> ''`).all();
+    for (const row of rows) references.push({ kind, value: row.value });
+  };
+  addColumn("assets", "local_path", "scratch");
+  addColumn("asset_attempts", "file_path", "scratch");
+  addColumn("generation_job_outputs", "file_path", "scratch");
+  addColumn("asset_ledger_sources", "local_path", "scratch");
+  addColumn("content_posts", "source_path", "root");
+  if (tableColumns(database, "projects").has("id")) {
+    const projects = database.prepare("select id from projects where id is not null and id <> ''").all();
+    for (const project of projects) {
+      if (!/^[a-z0-9][a-z0-9-]*$/.test(project.id)) throw new Error("A project ID cannot be mapped safely into the source asset root");
+      references.push({ kind: "root", value: join4(project.id, "assets", "catalog.json") });
+    }
+  }
+  return references;
+}
+function resolveProfileAssetReference(sourceRoot, reference) {
+  if (reference.value.includes("\0")) throw new Error("A referenced asset path contains a null byte");
+  const sourceScratch = join4(sourceRoot, ".asset-scratch");
+  const base = reference.kind === "scratch" ? sourceScratch : sourceRoot;
+  const value = reference.kind === "scratch" && reference.value.startsWith(".asset-scratch/") ? reference.value.slice(".asset-scratch/".length) : reference.value;
+  const candidate = isAbsolute(value) ? resolve3(value) : resolve3(base, value);
+  if (!pathIsInside(candidate, base)) throw new Error("A referenced asset path escapes the declared source asset root");
+  return { path: candidate, relative_path: relative2(sourceRoot, candidate) };
+}
+function cloneLineageProfileAssets(sourceAssetRoot, targetSelector, runtime, confirmWrite) {
+  if (!confirmWrite) throw new Error("Profile asset clone requires --confirm-write");
+  const profile = resolveLineageProfile(targetSelector);
+  assertProfileChannel(profile, runtime.channel);
+  assertProfileRuntimePin(profile, runtime);
+  if (!existsSync4(profile.database_path)) throw new Error(`Profile database does not exist: ${profile.database_path}`);
+  const sourceRoot = resolve3(sourceAssetRoot);
+  const targetRoot = resolve3(profile.asset_root);
+  if (!existsSync4(sourceRoot) || !statSync3(sourceRoot).isDirectory()) throw new Error(`Source asset root does not exist: ${sourceRoot}`);
+  if (sourceRoot === targetRoot || pathIsInside(targetRoot, sourceRoot) || pathIsInside(sourceRoot, targetRoot)) {
+    throw new Error("Source and target asset roots must be disjoint");
+  }
+  if (pathIsInside(profile.database_path, targetRoot)) throw new Error("Profile database must not be stored inside its asset root");
+  if (existsSync4(targetRoot)) throw new Error(`Profile asset clone target already exists: ${targetRoot}`);
+  const databaseIdentity = inspectDatabase(profile).identity;
+  if (databaseIdentity && (databaseIdentity.profile_id !== profile.profile_id || databaseIdentity.environment !== profile.environment || databaseIdentity.profile_fingerprint && databaseIdentity.profile_fingerprint !== profile.profile_fingerprint)) {
+    throw new Error(`Profile database is already bound to ${databaseIdentity.profile_id}/${databaseIdentity.environment}`);
+  }
+  const { DatabaseSync } = require2("node:sqlite");
+  const database = new DatabaseSync(profile.database_path, { readOnly: true });
+  let references;
+  try {
+    database.exec("begin");
+    references = profileAssetReferences(database);
+    database.exec("commit");
+  } catch (error) {
+    try {
+      database.exec("rollback");
+    } catch {
+    }
+    throw error;
+  } finally {
+    database.close();
+  }
+  const sourceRealRoot = realpathSync(sourceRoot);
+  const files = /* @__PURE__ */ new Map();
+  let missingReferences = 0;
+  let duplicateReferences = 0;
+  for (const reference of references) {
+    const resolved = resolveProfileAssetReference(sourceRoot, reference);
+    if (!existsSync4(resolved.path)) {
+      missingReferences += 1;
+      continue;
+    }
+    const stats = statSync3(resolved.path);
+    if (!stats.isFile()) {
+      missingReferences += 1;
+      continue;
+    }
+    const realSource = realpathSync(resolved.path);
+    if (!pathIsInside(realSource, sourceRealRoot)) throw new Error("A referenced asset symlink escapes the declared source asset root");
+    const existing = files.get(resolved.relative_path);
+    if (existing) {
+      if (realpathSync(existing) !== realSource) throw new Error("Two source assets map to the same target path");
+      duplicateReferences += 1;
+      continue;
+    }
+    files.set(resolved.relative_path, resolved.path);
+  }
+  mkdirSync3(dirname3(targetRoot), { recursive: true, mode: 448 });
+  mkdirSync3(targetRoot, { mode: 448 });
+  try {
+    let bytesCopied = 0;
+    const treeHash = createHash2("sha256");
+    for (const relativePath of [...files.keys()].sort()) {
+      const sourcePath = files.get(relativePath);
+      const destinationPath = join4(targetRoot, relativePath);
+      mkdirSync3(dirname3(destinationPath), { recursive: true, mode: 448 });
+      copyFileSync2(sourcePath, destinationPath, fsConstants.COPYFILE_EXCL);
+      chmodSync(destinationPath, 384);
+      const sourceHash = fileSha2562(sourcePath);
+      const destinationHash = fileSha2562(destinationPath);
+      if (sourceHash !== destinationHash) throw new Error("A source asset changed or failed checksum verification during clone");
+      bytesCopied += statSync3(destinationPath).size;
+      treeHash.update(relativePath.replaceAll("\\", "/"));
+      treeHash.update("\0");
+      treeHash.update(destinationHash);
+      treeHash.update("\0");
+    }
+    chmodSync(targetRoot, 448);
+    const receiptPath = join4(targetRoot, ".lineage-profile-assets.json");
+    const result = {
+      asset_root: targetRoot,
+      bytes_copied: bytesCopied,
+      code_fingerprint: runtime.code.fingerprint,
+      database_path: profile.database_path,
+      duplicate_references: duplicateReferences,
+      files_copied: files.size,
+      missing_references: missingReferences,
+      profile_fingerprint: profile.profile_fingerprint,
+      profile_id: profile.profile_id,
+      receipt_path: receiptPath,
+      references_discovered: references.length,
+      runtime_channel: runtime.channel,
+      schema_version: lineageProfileAssetsCloneReceiptSchemaVersion,
+      source_asset_root: sourceRoot,
+      tree_sha256: treeHash.digest("hex")
+    };
+    writeFileSync2(receiptPath, `${JSON.stringify({ ...result, created_at: (/* @__PURE__ */ new Date()).toISOString() }, null, 2)}
+`, {
+      encoding: "utf8",
+      flag: "wx",
+      mode: 384
+    });
+    return result;
+  } catch (error) {
+    rmSync(targetRoot, { force: true, recursive: true });
+    throw error;
+  }
+}
+
+// src/server/profileWriterLease.ts
+var writerLeaseSchemaVersion = "lineage.profile_writer_lease.v1";
+var ownerFileName = "owner.json";
+var ProfileWriterLeaseConflictError = class extends Error {
+  constructor(message, owner) {
+    super(message);
+    this.owner = owner;
+    this.name = "ProfileWriterLeaseConflictError";
+  }
+  owner;
+};
+function profileWriterLockPath(profile) {
+  return join5(dirname4(profile.manifest_path), "writer.lock");
+}
+function ownerPath(lockPath) {
+  return join5(lockPath, ownerFileName);
+}
+function errorCode(error) {
+  return error && typeof error === "object" && "code" in error ? String(error.code) : void 0;
+}
+function readOwner(lockPath) {
+  const stat = lstatSync(lockPath);
+  if (!stat.isDirectory() || stat.isSymbolicLink()) {
+    throw new Error(`Writer lease path is not a safe directory: ${lockPath}; manual inspection is required`);
+  }
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync4(ownerPath(lockPath), "utf8"));
+  } catch (error) {
+    throw new Error(`Writer lease metadata is unreadable at ${lockPath}; refusing automatic recovery`, { cause: error });
+  }
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    throw new Error(`Writer lease metadata is invalid at ${lockPath}; refusing automatic recovery`);
+  }
+  const owner = raw;
+  if (owner.schema_version !== writerLeaseSchemaVersion || typeof owner.profile_id !== "string" || typeof owner.profile_fingerprint !== "string" || !/^[a-f0-9]{64}$/i.test(owner.profile_fingerprint) || owner.environment !== "production" && owner.environment !== "preview" && owner.environment !== "development" || owner.role !== "service" && owner.role !== "cli" || !Number.isSafeInteger(owner.pid) || Number(owner.pid) <= 0 || typeof owner.acquired_at !== "string" || Number.isNaN(Date.parse(owner.acquired_at)) || owner.role === "service" && (typeof owner.service_origin !== "string" || !owner.service_origin) || owner.role === "cli" && owner.service_origin !== void 0 || typeof owner.token !== "string" || owner.token.length < 16) {
+    throw new Error(`Writer lease metadata is invalid at ${lockPath}; refusing automatic recovery`);
+  }
+  return owner;
+}
+function processIsAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    if (errorCode(error) === "ESRCH") return false;
+    return true;
+  }
+}
+function createLeaseDirectory(lockPath, owner) {
+  mkdirSync4(lockPath, { mode: 448 });
+  try {
+    writeFileSync3(ownerPath(lockPath), `${JSON.stringify(owner, null, 2)}
+`, { encoding: "utf8", flag: "wx", mode: 384 });
+  } catch (error) {
+    rmSync2(lockPath, { force: true, recursive: true });
+    throw error;
+  }
+}
+function reclaimDeadOwner(lockPath, owner) {
+  if (processIsAlive(owner.pid)) {
+    const { token: _token, ...publicOwner } = owner;
+    throw new ProfileWriterLeaseConflictError(
+      `Lineage profile ${owner.profile_id} already has an active ${owner.role} writer (pid ${owner.pid}); use that managed service or stop it before starting another writer`,
+      publicOwner
+    );
+  }
+  const tokenFence = createHash3("sha256").update(owner.token).digest("hex").slice(0, 24);
+  const tombstone = `${lockPath}.stale-${owner.pid}-${tokenFence}`;
+  try {
+    renameSync(lockPath, tombstone);
+  } catch (error) {
+    if (errorCode(error) === "ENOENT") return;
+    throw error;
+  }
+  rmSync2(tombstone, { force: true, recursive: true });
+}
+function acquireProfileWriterLease(profile, channel, role = "service") {
+  assertProfileChannel(profile, channel);
+  const lockPath = profileWriterLockPath(profile);
+  const owner = {
+    acquired_at: (/* @__PURE__ */ new Date()).toISOString(),
+    environment: profile.environment,
+    pid: process.pid,
+    profile_fingerprint: profile.profile_fingerprint,
+    profile_id: profile.profile_id,
+    role,
+    schema_version: writerLeaseSchemaVersion,
+    ...role === "service" ? { service_origin: profile.service_origin } : {},
+    token: randomUUID2()
+  };
+  for (let attempt = 0; attempt < 4; attempt += 1) {
+    try {
+      createLeaseDirectory(lockPath, owner);
+      process.env.LINEAGE_WRITER_LEASE_TOKEN = owner.token;
+      process.env.LINEAGE_WRITER_LOCK_PATH = lockPath;
+      const { token: _token, ...publicOwner } = owner;
+      let released = false;
+      return {
+        authenticate: (candidate) => {
+          if (!candidate) return false;
+          const expected = Buffer.from(owner.token);
+          const actual = Buffer.from(candidate);
+          return actual.length === expected.length && timingSafeEqual(actual, expected);
+        },
+        lock_path: lockPath,
+        owner: publicOwner,
+        release: () => {
+          if (released) return;
+          released = true;
+          try {
+            const current = readOwner(lockPath);
+            if (current.token === owner.token && current.pid === owner.pid) rmSync2(lockPath, { force: true, recursive: true });
+          } catch {
+          }
+          if (process.env.LINEAGE_WRITER_LEASE_TOKEN === owner.token) delete process.env.LINEAGE_WRITER_LEASE_TOKEN;
+          if (process.env.LINEAGE_WRITER_LOCK_PATH === lockPath) delete process.env.LINEAGE_WRITER_LOCK_PATH;
+        }
+      };
+    } catch (error) {
+      if (errorCode(error) !== "EEXIST") throw error;
+      let existing;
+      try {
+        existing = readOwner(lockPath);
+      } catch (readError) {
+        if (errorCode(readError) === "ENOENT") continue;
+        throw readError;
+      }
+      if (existing.profile_id !== profile.profile_id || existing.environment !== profile.environment || existing.profile_fingerprint !== profile.profile_fingerprint) {
+        throw new Error(`Writer lease identity at ${lockPath} does not match ${profile.profile_id}/${profile.environment}; manual inspection is required`, { cause: error });
+      }
+      reclaimDeadOwner(lockPath, existing);
+    }
+  }
+  throw new Error(`Could not acquire writer lease for Lineage profile ${profile.profile_id}; another writer is racing for ownership`);
+}
+function assertProfileWriterLeaseHeld() {
+  if (!process.env.LINEAGE_PROFILE) {
+    throw new Error("Persistent writes require a selected named Lineage profile and its writer lease; legacy-unbound access is read-only");
+  }
+  const profileId = process.env.LINEAGE_PROFILE_ID;
+  const profileFingerprint = process.env.LINEAGE_PROFILE_FINGERPRINT;
+  const environment = process.env.LINEAGE_PROFILE_ENVIRONMENT;
+  const manifestPath = process.env.LINEAGE_PROFILE_MANIFEST;
+  const lockPath = process.env.LINEAGE_WRITER_LOCK_PATH;
+  const token = process.env.LINEAGE_WRITER_LEASE_TOKEN;
+  if (!profileId || !profileFingerprint || !environment || !manifestPath || !lockPath || !token) {
+    throw new Error("Named Lineage profiles may write only through a process holding the profile writer lease");
+  }
+  const expectedLockPath = join5(dirname4(resolve4(manifestPath)), "writer.lock");
+  if (resolve4(lockPath) !== expectedLockPath) throw new Error("Profile writer lease path does not match the selected profile manifest");
+  const owner = readOwner(lockPath);
+  if (owner.pid !== process.pid || owner.token !== token || owner.profile_id !== profileId || owner.profile_fingerprint !== profileFingerprint || owner.environment !== environment) {
+    throw new Error("Current process does not own the selected Lineage profile writer lease");
+  }
+}
+function assertSelectedProfileDatabaseIdentity(database) {
+  const profileId = process.env.LINEAGE_PROFILE_ID;
+  const environment = process.env.LINEAGE_PROFILE_ENVIRONMENT;
+  const profileFingerprint = process.env.LINEAGE_PROFILE_FINGERPRINT;
+  if (!process.env.LINEAGE_PROFILE || !profileId || !environment || !profileFingerprint) {
+    throw new Error("Writable SQLite identity validation requires a fully resolved named Lineage profile");
+  }
+  const table = database.prepare("select name from sqlite_master where type = 'table' and name = 'lineage_profile_identity'").get();
+  if (!table) throw new Error(`Refusing writable open: database is not bound to Lineage profile ${profileId}`);
+  const columns = new Set(database.prepare("pragma table_info(lineage_profile_identity)").all().map((row) => row.name));
+  if (!columns.has("profile_id") || !columns.has("environment") || !columns.has("profile_fingerprint")) {
+    throw new Error(`Refusing writable open: database identity for ${profileId} is missing required fingerprint fields`);
+  }
+  const rows = database.prepare("select profile_id, environment, profile_fingerprint from lineage_profile_identity").all();
+  if (rows.length !== 1) throw new Error(`Refusing writable open: expected exactly one database profile identity, found ${rows.length}`);
+  const identity2 = rows[0];
+  if (identity2.profile_id !== profileId || identity2.environment !== environment || identity2.profile_fingerprint !== profileFingerprint) {
+    throw new Error(
+      `Refusing writable open: database identity ${String(identity2.profile_id)}/${String(identity2.environment)}/${String(identity2.profile_fingerprint)} does not match selected profile ${profileId}/${environment}/${profileFingerprint}`
+    );
+  }
+}
+function getProfileWriterDelegation(profile) {
+  const lockPath = profileWriterLockPath(profile);
+  if (!existsSync5(lockPath)) {
+    throw new Error(
+      `Lineage profile ${profile.profile_id} mutating commands require its managed service at ${profile.service_origin}; no active service writer lease was found`
+    );
+  }
+  const owner = readOwner(lockPath);
+  if (owner.profile_id !== profile.profile_id || owner.environment !== profile.environment || owner.profile_fingerprint !== profile.profile_fingerprint) {
+    throw new Error(`Writer lease identity at ${lockPath} does not match ${profile.profile_id}/${profile.environment}; refusing delegation`);
+  }
+  if (owner.role !== "service" || owner.service_origin !== profile.service_origin) {
+    throw new Error(`Writer lease for Lineage profile ${profile.profile_id} is not the configured managed service at ${profile.service_origin}`);
+  }
+  if (!processIsAlive(owner.pid)) {
+    throw new Error(`Managed service writer lease for Lineage profile ${profile.profile_id} is stale; refusing delegation`);
+  }
+  const { token, ...publicOwner } = owner;
+  return { owner: publicOwner, service_origin: owner.service_origin, token };
+}
+
+// src/server/assetLineageDb.ts
+var require3 = createRequire2(import.meta.url);
 function nowIso() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
 function lineageDbPath() {
-  return process.env.LINEAGE_DB || join4(packageRoot, ".lineage", "asset-lineage.sqlite");
+  return process.env.LINEAGE_DB || join6(packageRoot, ".lineage", "asset-lineage.sqlite");
 }
 function lineageDb() {
-  mkdirSync3(join4(lineageDbPath(), ".."), { recursive: true });
-  const { DatabaseSync } = require2("node:sqlite");
-  const database = new DatabaseSync(lineageDbPath());
+  const readOnly = process.env.LINEAGE_DB_ACCESS === "read-only";
+  if (!readOnly) assertProfileWriterLeaseHeld();
+  if (!readOnly && !existsSync6(lineageDbPath())) {
+    throw new Error(`Refusing writable open of missing profile database ${lineageDbPath()}; bind an existing database or create a non-production clone first`);
+  }
+  if (!readOnly) mkdirSync5(join6(lineageDbPath(), ".."), { recursive: true });
+  const { DatabaseSync } = require3("node:sqlite");
+  const database = readOnly ? new DatabaseSync(lineageDbPath(), { readOnly: true }) : new DatabaseSync(lineageDbPath());
+  if (process.env.LINEAGE_PROFILE) assertSelectedProfileDatabaseIdentity(database);
   database.exec("PRAGMA foreign_keys = ON");
   database.exec("PRAGMA busy_timeout = 5000");
+  if (readOnly) return database;
+  database.exec("PRAGMA journal_mode = WAL");
   database.exec(`
     create table if not exists projects (
       id text primary key,
@@ -1316,12 +2166,12 @@ function randomId(prefix) {
   return `${prefix}_${Date.now().toString(36)}_${randomBytes(6).toString("base64url").toLowerCase()}`;
 }
 function tokenHash(token) {
-  return createHash2("sha256").update(token).digest("hex");
+  return createHash4("sha256").update(token).digest("hex");
 }
 function safeEqual(a, b) {
   const left = Buffer.from(a);
   const right = Buffer.from(b);
-  return left.length === right.length && timingSafeEqual(left, right);
+  return left.length === right.length && timingSafeEqual2(left, right);
 }
 function expiresAtFrom(timestamp, ttlSeconds) {
   return new Date(new Date(timestamp).getTime() + ttlSeconds * 1e3).toISOString();
@@ -1348,6 +2198,12 @@ function derivedState(row, now = /* @__PURE__ */ new Date()) {
 }
 function rowToClaim(row, now = /* @__PURE__ */ new Date()) {
   const heartbeatAt = String(row.heartbeat_at);
+  const persistedStatus = String(row.status);
+  const state = derivedState({
+    expires_at: String(row.expires_at),
+    heartbeat_at: heartbeatAt,
+    status: persistedStatus
+  }, now);
   return {
     id: String(row.id),
     project: String(row.project_id),
@@ -1359,7 +2215,7 @@ function rowToClaim(row, now = /* @__PURE__ */ new Date()) {
     agent_name: String(row.agent_name),
     agent_kind: String(row.agent_kind),
     thread_id: typeof row.thread_id === "string" ? row.thread_id : void 0,
-    status: String(row.status),
+    status: persistedStatus === "active" && state === "expired" ? "expired" : persistedStatus,
     created_at: String(row.created_at),
     heartbeat_at: heartbeatAt,
     expires_at: String(row.expires_at),
@@ -1369,11 +2225,7 @@ function rowToClaim(row, now = /* @__PURE__ */ new Date()) {
     override_reason: typeof row.override_reason === "string" ? row.override_reason : void 0,
     metadata: parseMetadata(row.metadata_json),
     heartbeat_age_seconds: Math.max(0, Math.floor((now.getTime() - new Date(heartbeatAt).getTime()) / 1e3)),
-    derived_state: derivedState({
-      expires_at: String(row.expires_at),
-      heartbeat_at: heartbeatAt,
-      status: String(row.status)
-    }, now)
+    derived_state: state
   };
 }
 function eventToRow(row) {
@@ -1515,7 +2367,7 @@ function createAgentClaim(fields) {
 function listAgentClaims(project) {
   const database = lineageDb();
   try {
-    expireActiveClaims(database);
+    if (process.env.LINEAGE_DB_ACCESS !== "read-only") expireActiveClaims(database);
     const rows = project ? database.prepare("select * from agent_claims where project_id = ? order by status, heartbeat_at desc").all(project) : database.prepare("select * from agent_claims order by project_id, status, heartbeat_at desc").all();
     return { ok: true, claims: rows.map((row) => rowToClaim(row)), fetchedAt: nowIso() };
   } finally {
@@ -1525,7 +2377,7 @@ function listAgentClaims(project) {
 function inspectAgentClaim(claimId, project) {
   const database = lineageDb();
   try {
-    expireActiveClaims(database);
+    if (process.env.LINEAGE_DB_ACCESS !== "read-only") expireActiveClaims(database);
     const claim = findClaimById(database, claimId, project);
     if (!claim) throw new AgentClaimError(`Unknown agent claim: ${claimId}`, 404, "claim_not_found");
     const events = database.prepare("select * from agent_claim_events where claim_id = ? order by created_at").all(claim.id);
@@ -1662,7 +2514,7 @@ function validateAgentClaimForWrite(fields) {
 }
 
 // src/server/assetLineage.ts
-import { join as join5 } from "node:path";
+import { join as join7 } from "node:path";
 
 // src/server/assetLineageSelection.ts
 function selectedRows(database, project, root) {
@@ -2213,9 +3065,18 @@ function knownRoots(database, project) {
       and parent_asset_id not in (select child_asset_id from asset_edges where project_id = ?)
     group by parent_asset_id
   `).all(project, project, project, project);
-  return rows.map((row) => ({ root_asset_id: row.root_asset_id, selected_at: row.selected_at || void 0 }));
+  const roots = /* @__PURE__ */ new Map();
+  for (const row of rows) {
+    const existing = roots.get(row.root_asset_id);
+    roots.set(row.root_asset_id, {
+      root_asset_id: row.root_asset_id,
+      selected_at: row.selected_at || existing?.selected_at
+    });
+  }
+  return [...roots.values()];
 }
 function seedLegacyWorkspaces(database, project) {
+  if (process.env.LINEAGE_DB_ACCESS === "read-only") return;
   ensureProject2(database, project);
   const timestamp = nowIso();
   const statement = database.prepare(`
@@ -2239,6 +3100,34 @@ function seedLegacyWorkspaces(database, project) {
     );
   }
 }
+function inferredLegacyWorkspaces(database, project) {
+  if (process.env.LINEAGE_DB_ACCESS !== "read-only") return [];
+  const persistedRoots = new Set(
+    database.prepare("select root_asset_id from lineage_workspaces where project_id = ?").all(project).map((row) => row.root_asset_id)
+  );
+  const asset = database.prepare("select id, title from assets where project_id = ? and id = ?");
+  return knownRoots(database, project).flatMap((root) => {
+    if (persistedRoots.has(root.root_asset_id)) return [];
+    const row = asset.get(project, root.root_asset_id);
+    if (!row) return [];
+    const timestamp = root.selected_at || nowIso();
+    return [{
+      active_at: root.selected_at,
+      created_at: timestamp,
+      created_by: "system",
+      id: lineageWorkspaceId(project, root.root_asset_id),
+      project,
+      root_asset_id: root.root_asset_id,
+      status: "active",
+      title: `${row.title} lineage`,
+      updated_at: timestamp
+    }];
+  });
+}
+function sortWorkspaces(workspaces) {
+  const statusRank = { active: 0, paused: 1, archived: 2 };
+  return workspaces.sort((left, right) => statusRank[left.status] - statusRank[right.status] || (right.active_at || "").localeCompare(left.active_at || "") || right.updated_at.localeCompare(left.updated_at) || left.title.localeCompare(right.title));
+}
 function listRows(database, project) {
   return database.prepare(`
     select * from lineage_workspaces
@@ -2250,23 +3139,15 @@ function listRows(database, project) {
       title
   `).all(project).map(rowToWorkspace);
 }
-function activeWorkspace(database, project) {
-  const row = database.prepare(`
-    select * from lineage_workspaces
-    where project_id = ? and status != 'archived'
-    order by active_at desc nulls last, updated_at desc
-    limit 1
-  `).get(project);
-  return row ? rowToWorkspace(row) : null;
-}
 function listLineageWorkspaces(project) {
   const database = lineageDb();
   try {
     seedLegacyWorkspaces(database, project);
+    const workspaces = sortWorkspaces([...listRows(database, project), ...inferredLegacyWorkspaces(database, project)]);
     return {
       project,
-      active_workspace: activeWorkspace(database, project),
-      workspaces: listRows(database, project),
+      active_workspace: workspaces.find((workspace) => workspace.status !== "archived") || null,
+      workspaces,
       fetchedAt: nowIso()
     };
   } finally {
@@ -2277,7 +3158,7 @@ function activeLineageWorkspaceRoot(project) {
   const database = lineageDb();
   try {
     seedLegacyWorkspaces(database, project);
-    return activeWorkspace(database, project)?.root_asset_id;
+    return sortWorkspaces([...listRows(database, project), ...inferredLegacyWorkspaces(database, project)]).find((workspace) => workspace.status !== "archived")?.root_asset_id;
   } finally {
     database.close();
   }
@@ -2336,7 +3217,7 @@ function upsertProject(database, project) {
     insert into projects (id, product, catalog_path, created_at, updated_at)
     values (?, ?, ?, ?, ?)
     on conflict(id) do update set product = excluded.product, updated_at = excluded.updated_at
-  `).run(project, project, join5(repoRoot, project, "assets", "catalog.json"), timestamp, timestamp);
+  `).run(project, project, join7(repoRoot, project, "assets", "catalog.json"), timestamp, timestamp);
 }
 function upsertAsset(database, project, asset) {
   const timestamp = nowIso();
@@ -2407,8 +3288,8 @@ function rootFor(database, project, assetId) {
 }
 function assertCanonicalRoot(database, project, root) {
   requireAsset2(database, project, root);
-  const canonicalRoot = rootFor(database, project, root);
-  if (canonicalRoot !== root) throw new LineageError(`Asset ${root} is not a lineage root`, 400);
+  const canonicalRoot2 = rootFor(database, project, root);
+  if (canonicalRoot2 !== root) throw new LineageError(`Asset ${root} is not a lineage root`, 400);
 }
 function explicitWorkspaceRoot(database, project, assetId) {
   const row = database.prepare(`
@@ -2975,16 +3856,34 @@ function clearLineageRerollRequest(project, fields) {
   }
 }
 
-// src/server/assetLineageHandoff.ts
-var publicPackageCommand = "npx @mean-weasel/lineage";
+// src/server/lineageRuntimeCommand.ts
+import { existsSync as existsSync7 } from "node:fs";
+import { createRequire as createRequire3 } from "node:module";
+import { join as join8 } from "node:path";
+var require4 = createRequire3(import.meta.url);
+function lineagePublicPackageCommand() {
+  if (process.env.LINEAGE_CHANNEL === "dev") {
+    const sourceCli = join8(packageRoot, "src", "cli", "lineage-dev.ts");
+    const builtCli = join8(packageRoot, "dist", "cli", "lineage-dev.js");
+    return existsSync7(sourceCli) ? `${shellQuote(process.execPath)} --import ${shellQuote(require4.resolve("tsx"))} ${shellQuote(sourceCli)}` : `${shellQuote(process.execPath)} ${shellQuote(builtCli)}`;
+  }
+  if (process.env.LINEAGE_CHANNEL === "preview") return "LINEAGE_CHANNEL=preview npx --package @mean-weasel/lineage@next lineage-dev";
+  return "npx @mean-weasel/lineage";
+}
 function shellQuote(value) {
   return `'${value.replace(/'/g, "'\\''")}'`;
 }
+function lineageRuntimeSelector() {
+  const manifest = process.env.LINEAGE_PROFILE_MANIFEST?.trim();
+  return manifest ? `--profile ${shellQuote(manifest)}` : `--db ${shellQuote(lineageDbPath())}`;
+}
+
+// src/server/assetLineageHandoff.ts
 function lineageCommand(command, project, rootAssetId) {
-  return `${publicPackageCommand} ${command} --project ${shellQuote(project)} --root ${shellQuote(rootAssetId)} --db ${shellQuote(lineageDbPath())} --json`;
+  return `${lineagePublicPackageCommand()} ${command} --project ${shellQuote(project)} --root ${shellQuote(rootAssetId)} ${lineageRuntimeSelector()} --json`;
 }
 function linkChildCommand(project, rootAssetId) {
-  return `${publicPackageCommand} link-child --project ${shellQuote(project)} --root ${shellQuote(rootAssetId)} --child <asset-id> --confirm-write --db ${shellQuote(lineageDbPath())} --json`;
+  return `${lineagePublicPackageCommand()} link-child --project ${shellQuote(project)} --root ${shellQuote(rootAssetId)} --child <asset-id> --confirm-write ${lineageRuntimeSelector()} --json`;
 }
 function rerollImportGuidance(rootAssetId, targetAssetId) {
   return `Use lineage reroll plan --root ${rootAssetId} --target ${targetAssetId} and lineage reroll import instead.`;
@@ -3026,7 +3925,7 @@ function getLineageBrief(project, rootAssetId) {
     },
     handoff: {
       next_command: lineageCommand("next", project, next.root_asset_id),
-      inspect_command: asset ? `${publicPackageCommand} inspect --project ${shellQuote(project)} --asset-id ${shellQuote(asset.asset_id)} --db ${shellQuote(lineageDbPath())} --json` : void 0,
+      inspect_command: asset ? `${lineagePublicPackageCommand()} inspect --project ${shellQuote(project)} --asset-id ${shellQuote(asset.asset_id)} ${lineageRuntimeSelector()} --json` : void 0,
       link_child_command: asset ? linkChildCommand(project, next.root_asset_id) : void 0
     },
     fetchedAt: nowIso()
@@ -3078,9 +3977,9 @@ function linkSelectedLineageChild(project, fields) {
 }
 
 // src/server/generationReceipts.ts
-import { existsSync as existsSync4, realpathSync, statSync as statSync3 } from "node:fs";
-import { relative as relative2, resolve as resolve3 } from "node:path";
-import { randomUUID } from "node:crypto";
+import { existsSync as existsSync8, realpathSync as realpathSync2, statSync as statSync4 } from "node:fs";
+import { relative as relative3, resolve as resolve5 } from "node:path";
+import { randomUUID as randomUUID3 } from "node:crypto";
 var adapterVersion = "generation-receipts-v1";
 var provider = "codex-handoff";
 var GenerationReceiptError = class extends Error {
@@ -3091,7 +3990,7 @@ var GenerationReceiptError = class extends Error {
   status;
 };
 function jobId() {
-  return `gen-${Date.now().toString(36)}-${randomUUID().slice(0, 8)}`;
+  return `gen-${Date.now().toString(36)}-${randomUUID3().slice(0, 8)}`;
 }
 function quote(value) {
   return JSON.stringify(value);
@@ -3101,7 +4000,7 @@ function parseJson(value, fallback) {
   return JSON.parse(value);
 }
 function buildRerollHandoff(project, id, prompt, rootAssetId, target, request) {
-  const importCommand = `npx lineage reroll import --project ${quote(project)} --job-id ${quote(id)} --file <.asset-scratch-file> --confirm-write --json`;
+  const importCommand = `${lineagePublicPackageCommand()} reroll import --project ${quote(project)} --job-id ${quote(id)} --file <.asset-scratch-file> --confirm-write ${lineageRuntimeSelector()} --json`;
   return {
     schema_version: "lineage.generation_handoff.v1",
     provider,
@@ -3237,7 +4136,7 @@ function planImageReroll(project = defaultProject, fields) {
       fetchedAt: timestamp
     }
   };
-  const preview = {
+  const preview2 = {
     id,
     project_id: project,
     provider,
@@ -3263,7 +4162,7 @@ function planImageReroll(project = defaultProject, fields) {
       created_at: timestamp
     }]
   };
-  if (fields.dryRun) return { ok: true, command: "reroll plan", project, dryRun: true, wouldWrite: true, job: preview };
+  if (fields.dryRun) return { ok: true, command: "reroll plan", project, dryRun: true, wouldWrite: true, job: preview2 };
   const database = lineageDb();
   try {
     database.exec("BEGIN IMMEDIATE");
@@ -3275,7 +4174,7 @@ function planImageReroll(project = defaultProject, fields) {
         ) values (?, ?, ?, ?, 'lineage_reroll', ?, ?, 1, 'planned', ?, ?, ?, ?)
       `).run(id, project, provider, adapterVersion, snapshot.root_asset_id, prompt, ".asset-scratch", JSON.stringify(handoff), timestamp, timestamp);
       database.prepare("insert into generation_job_inputs (id, job_id, project_id, asset_id, root_asset_id, role, position, selection_strategy, selection_snapshot_json) values (?, ?, ?, ?, ?, ?, ?, ?, ?)").run(input.id, id, project, input.asset_id, input.root_asset_id, input.role, input.position, input.selection_strategy, JSON.stringify(input.selection_snapshot));
-      insertReceipt(database, id, "plan", "reroll plan", preview.receipts[0].payload);
+      insertReceipt(database, id, "plan", "reroll plan", preview2.receipts[0].payload);
       database.exec("COMMIT");
     } catch (error) {
       database.exec("ROLLBACK");
@@ -3287,22 +4186,22 @@ function planImageReroll(project = defaultProject, fields) {
   }
 }
 function isPathInside(child, parent) {
-  const rel = relative2(parent, child);
+  const rel = relative3(parent, child);
   return Boolean(rel) && !rel.startsWith("..") && !rel.startsWith("/");
 }
 function resolveScratchFile(file) {
-  const scratchRoot = resolve3(repoRoot, ".asset-scratch");
-  const candidate = file.startsWith(".asset-scratch/") || resolve3(file).startsWith(scratchRoot) ? resolve3(repoRoot, file) : resolve3(scratchRoot, file);
+  const scratchRoot = resolve5(repoRoot, ".asset-scratch");
+  const candidate = file.startsWith(".asset-scratch/") || resolve5(file).startsWith(scratchRoot) ? resolve5(repoRoot, file) : resolve5(scratchRoot, file);
   if (!isPathInside(candidate, scratchRoot)) throw new GenerationReceiptError(`Import file must be under .asset-scratch: ${file}`);
-  if (!existsSync4(candidate)) throw new GenerationReceiptError(`Missing import file: ${file}`, 404);
-  const realScratchRoot = realpathSync(scratchRoot);
-  const realCandidate = realpathSync(candidate);
+  if (!existsSync8(candidate)) throw new GenerationReceiptError(`Missing import file: ${file}`, 404);
+  const realScratchRoot = realpathSync2(scratchRoot);
+  const realCandidate = realpathSync2(candidate);
   if (!isPathInside(realCandidate, realScratchRoot)) throw new GenerationReceiptError(`Import file must be under .asset-scratch: ${file}`);
-  const stats = statSync3(candidate);
+  const stats = statSync4(candidate);
   if (!stats.isFile()) throw new GenerationReceiptError(`Import path is not a file: ${file}`);
   const checksum = fileSha256(candidate);
   return {
-    relativePath: relative2(scratchRoot, candidate),
+    relativePath: relative3(scratchRoot, candidate),
     checksum,
     size: stats.size,
     contentType: contentTypeFor(candidate),
@@ -3378,17 +4277,19 @@ function importImageRerollOutput(project = defaultProject, fields) {
 }
 
 // src/server/lineageSelectionPacket.ts
-import { createHash as createHash3 } from "node:crypto";
-import { existsSync as existsSync5, statSync as statSync4 } from "node:fs";
-import { isAbsolute, resolve as resolve4 } from "node:path";
+import { createHash as createHash5 } from "node:crypto";
+import { existsSync as existsSync9, statSync as statSync5 } from "node:fs";
+import { isAbsolute as isAbsolute2, resolve as resolve6 } from "node:path";
 var LineageSelectionPacketError = class extends Error {
-  constructor(message, warnings = [], errors = []) {
+  constructor(message, warnings = [], errors = [], diagnostics = []) {
     super(message);
     this.warnings = warnings;
     this.errors = errors;
+    this.diagnostics = diagnostics;
   }
   warnings;
   errors;
+  diagnostics;
 };
 function listAllAssets(project) {
   const pageSize = 100;
@@ -3424,15 +4325,15 @@ function resolveWorkspace(project, options) {
 }
 function resolveLocalReference(reference) {
   if (!reference) return void 0;
-  if (isAbsolute(reference)) return reference;
-  const repoRelative = resolve4(repoRoot, reference);
-  if (existsSync5(repoRelative)) return repoRelative;
-  return resolve4(repoRoot, ".asset-scratch", reference);
+  if (isAbsolute2(reference)) return reference;
+  const repoRelative = resolve6(repoRoot, reference);
+  if (existsSync9(repoRelative)) return repoRelative;
+  return resolve6(repoRoot, ".asset-scratch", reference);
 }
 function fileSize(path) {
-  if (!path || !existsSync5(path)) return void 0;
+  if (!path || !existsSync9(path)) return void 0;
   try {
-    return statSync4(path).size;
+    return statSync5(path).size;
   } catch {
     return void 0;
   }
@@ -3458,7 +4359,7 @@ function currentAttemptFor(node) {
 function assetForNode(node, catalogAsset, warnings) {
   const localReference = catalogAsset?.local?.absolute_path || node.current_attempt?.file_path || node.local_path || catalogAsset?.local?.relative_path;
   const absolutePath = catalogAsset?.local?.absolute_path || resolveLocalReference(localReference);
-  const localExists = absolutePath ? existsSync5(absolutePath) : false;
+  const localExists = absolutePath ? existsSync9(absolutePath) : false;
   const hasLocalClaim = Boolean(absolutePath || node.local_path || catalogAsset?.local?.relative_path);
   const s3Key = catalogAsset?.s3?.key || node.s3_key;
   const hasS3 = Boolean(s3Key);
@@ -3503,27 +4404,209 @@ function assetForNode(node, catalogAsset, warnings) {
   };
 }
 function packetId(packetIdentity) {
-  const digest = createHash3("sha256").update(JSON.stringify(packetIdentity)).digest("hex").slice(0, 24);
+  const digest = createHash5("sha256").update(JSON.stringify(packetIdentity)).digest("hex").slice(0, 24);
   return `lineage_packet_${digest}`;
 }
-function getLineageSelectionPacket(project, options = {}) {
-  const workspace = resolveWorkspace(project, options);
-  const snapshot = getLineageSnapshot(project, workspace.root_asset_id);
-  const catalogSummary = validateProject(project);
-  const catalogAssets = listAllAssets(project);
-  const catalogById = new Map(catalogAssets.map((asset) => [asset.asset_id, asset]));
-  const warnings = [];
-  const errors = [];
-  const nodeById = new Map(snapshot.nodes.map((node) => [node.asset_id, node]));
-  const selectedItems = snapshot.selections.map((selection) => ({
-    asset_id: selection.asset_id,
-    position: selection.position,
-    selected_at: selection.selected_at,
-    selection_note: selection.notes
-  }));
-  if (selectedItems.length === 0) warnings.push(`Lineage workspace ${workspace.id} has no selected assets.`);
-  const assets = selectedItems.flatMap((item) => {
-    const node = nodeById.get(item.asset_id);
+var SHA256_PATTERN = /^[a-f0-9]{64}$/;
+function canonicalValue(value) {
+  if (Array.isArray(value)) return value.map((item) => canonicalValue(item));
+  if (value && typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value).filter(([, item]) => item !== void 0).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([key, item]) => [key, canonicalValue(item)])
+    );
+  }
+  return value;
+}
+function canonicalLineageSelectionPacketIdentityJson(projection) {
+  return JSON.stringify(canonicalValue(projection));
+}
+function lineageSelectionPacketV2IdentityProjection(packet) {
+  const assetsById = new Map(packet.assets.map((asset) => [asset.asset_id, asset]));
+  const selection = packet.selection.items.map((item) => {
+    const asset = assetsById.get(item.asset_id);
+    if (!asset) {
+      const diagnostics = [{ asset_id: item.asset_id, code: "selected_asset_missing", severity: "error" }];
+      throw new LineageSelectionPacketError(
+        `Selected asset ${item.asset_id} is absent from the v2 packet asset envelope.`,
+        [],
+        ["selected_asset_missing"],
+        diagnostics
+      );
+    }
+    return {
+      asset_id: item.asset_id,
+      campaign: asset.campaign,
+      channel: asset.channel,
+      current_attempt: {
+        asset_id: asset.current_attempt.asset_id,
+        attempt_index: asset.current_attempt.attempt_index,
+        checksum_sha256: asset.current_attempt.checksum_sha256,
+        id: asset.current_attempt.id,
+        source: asset.current_attempt.source
+      },
+      media_type: asset.media_type,
+      mime_type: asset.mime_type,
+      position: item.position,
+      selection_note: item.selection_note,
+      title: asset.title
+    };
+  });
+  return {
+    schema_version: "lineage.selection_packet.v2",
+    project: packet.project,
+    product: packet.product,
+    workspace: {
+      id: packet.workspace.id,
+      root_asset_id: packet.workspace.root_asset_id
+    },
+    context: {
+      campaign: packet.context.campaign,
+      channel: packet.context.channel,
+      labels: packet.context.labels,
+      notes: packet.context.notes
+    },
+    selection,
+    diagnostics: packet.diagnostics.map((diagnostic) => ({
+      code: diagnostic.code,
+      severity: diagnostic.severity,
+      ...diagnostic.asset_id ? { asset_id: diagnostic.asset_id } : {}
+    }))
+  };
+}
+function lineageSelectionPacketV2IdentitySha256(packet) {
+  const projection = lineageSelectionPacketV2IdentityProjection(packet);
+  return createHash5("sha256").update(canonicalLineageSelectionPacketIdentityJson(projection)).digest("hex");
+}
+function addDiagnostic(diagnostics, diagnostic) {
+  if (diagnostics.some((item) => item.code === diagnostic.code && item.severity === diagnostic.severity && item.asset_id === diagnostic.asset_id)) return;
+  diagnostics.push(diagnostic);
+}
+function requireV2CurrentAttempt(node, warnings, diagnostics) {
+  const attempt = node.current_attempt;
+  if (!attempt) {
+    const message = `Selected asset ${node.asset_id} has no current attempt identity.`;
+    const diagnostic = { asset_id: node.asset_id, code: "current_attempt_missing", severity: "error" };
+    throw new LineageSelectionPacketError(message, warnings, ["current_attempt_missing"], [...diagnostics, diagnostic]);
+  }
+  if (!attempt.id || !attempt.asset_id || !Number.isInteger(attempt.attempt_index) || attempt.attempt_index <= 0 || !attempt.source || attempt.is_current !== true) {
+    const message = `Selected asset ${node.asset_id} has malformed current attempt identity.`;
+    const diagnostic = { asset_id: node.asset_id, code: "current_attempt_invalid_identity", severity: "error" };
+    throw new LineageSelectionPacketError(message, warnings, ["current_attempt_invalid_identity"], [...diagnostics, diagnostic]);
+  }
+  if (!attempt.checksum_sha256 || !SHA256_PATTERN.test(attempt.checksum_sha256)) {
+    const message = `Selected asset ${node.asset_id} current attempt does not have a valid lowercase SHA-256 checksum.`;
+    const diagnostic = { asset_id: node.asset_id, code: "current_attempt_invalid_checksum", severity: "error" };
+    throw new LineageSelectionPacketError(message, warnings, ["current_attempt_invalid_checksum"], [...diagnostics, diagnostic]);
+  }
+  return {
+    asset_id: attempt.asset_id,
+    attempt_index: attempt.attempt_index,
+    checksum_sha256: attempt.checksum_sha256,
+    file_path: attempt.file_path,
+    generation_job_id: attempt.generation_job_id,
+    id: attempt.id,
+    is_current: attempt.is_current,
+    source: attempt.source
+  };
+}
+function assetForNodeV2(node, visibleCatalogAsset, catalogById, warnings, errors, diagnostics) {
+  const currentAttempt = requireV2CurrentAttempt(node, warnings, diagnostics);
+  const currentAttemptCatalogAsset = catalogById.get(currentAttempt.asset_id);
+  const isVisibleNodeAttempt = currentAttempt.asset_id === node.asset_id;
+  const mediaCatalogAsset = currentAttemptCatalogAsset || (isVisibleNodeAttempt ? visibleCatalogAsset : void 0);
+  const localReference = currentAttempt.file_path || mediaCatalogAsset?.local?.absolute_path || mediaCatalogAsset?.local?.relative_path || (isVisibleNodeAttempt ? node.local_path : void 0);
+  const absolutePath = resolveLocalReference(localReference);
+  const localExists = absolutePath ? existsSync9(absolutePath) : false;
+  const hasLocalClaim = Boolean(localReference);
+  const s3Key = mediaCatalogAsset?.s3?.key || (isVisibleNodeAttempt ? node.s3_key : void 0);
+  const hasS3 = Boolean(s3Key);
+  const mimeType = mediaCatalogAsset?.local?.content_type || mediaCatalogAsset?.s3?.content_type || visibleCatalogAsset?.local?.content_type || visibleCatalogAsset?.s3?.content_type || (localReference ? contentTypeFor(localReference) : void 0);
+  const mediaType = mediaCatalogAsset?.content_type || visibleCatalogAsset?.content_type || node.media_type;
+  if (localExists && absolutePath && fileSha256(absolutePath) !== currentAttempt.checksum_sha256) {
+    const message = `Selected asset ${node.asset_id} current attempt checksum does not match its local file.`;
+    const diagnostic = { asset_id: node.asset_id, code: "current_attempt_checksum_mismatch", severity: "error" };
+    throw new LineageSelectionPacketError(message, [...warnings, message], ["current_attempt_checksum_mismatch"], [...diagnostics, diagnostic]);
+  }
+  const s3Checksum = mediaCatalogAsset?.s3?.checksum_sha256;
+  if (hasS3 && s3Checksum && s3Checksum !== currentAttempt.checksum_sha256) {
+    const message = `Selected asset ${node.asset_id} current attempt checksum does not match its S3 media envelope.`;
+    const diagnostic = { asset_id: node.asset_id, code: "current_attempt_checksum_mismatch", severity: "error" };
+    throw new LineageSelectionPacketError(message, [...warnings, message], ["current_attempt_checksum_mismatch"], [...diagnostics, diagnostic]);
+  }
+  if (hasLocalClaim && !localExists) {
+    warnings.push(`Selected asset ${node.asset_id} current attempt has a local path but the file is missing: ${absolutePath || localReference}`);
+  }
+  if (!hasLocalClaim && !hasS3) {
+    const message = `Selected asset ${node.asset_id} current attempt has neither a local file nor S3 key.`;
+    warnings.push(message);
+    errors.push(message);
+  }
+  if (mediaType && mediaType !== "image" && mediaType !== "gif") {
+    warnings.push(`Selected asset ${node.asset_id} is ${mediaType}, not an image/gif asset.`);
+    addDiagnostic(diagnostics, { asset_id: node.asset_id, code: "unsupported_media_type", severity: "warning" });
+  }
+  const conflictingChecksums = [
+    currentAttemptCatalogAsset?.local?.checksum_sha256,
+    currentAttemptCatalogAsset?.s3?.checksum_sha256,
+    visibleCatalogAsset?.local?.checksum_sha256,
+    visibleCatalogAsset?.s3?.checksum_sha256,
+    node.checksum_sha256
+  ].filter((checksum) => Boolean(checksum && checksum !== currentAttempt.checksum_sha256));
+  if (conflictingChecksums.length > 0) {
+    warnings.push(`Selected asset ${node.asset_id} catalog or visible-node checksum differs from its current attempt; current attempt checksum is authoritative.`);
+  }
+  return {
+    asset_id: node.asset_id,
+    campaign: visibleCatalogAsset?.campaign || node.campaign,
+    channel: visibleCatalogAsset?.channel || node.channel,
+    checksum_sha256: currentAttempt.checksum_sha256,
+    current_attempt: currentAttempt,
+    local: {
+      absolute_path: absolutePath,
+      content_type: mediaCatalogAsset?.local?.content_type,
+      exists: localExists,
+      relative_path: mediaCatalogAsset?.local?.relative_path || currentAttempt.file_path || (isVisibleNodeAttempt ? node.local_path : void 0),
+      size_bytes: mediaCatalogAsset?.local?.size_bytes || fileSize(absolutePath)
+    },
+    media_type: mediaType,
+    mime_type: mimeType,
+    review_notes: node.review_notes,
+    review_state: node.review_state,
+    s3: {
+      bucket: mediaCatalogAsset?.s3?.bucket,
+      checksum_sha256: mediaCatalogAsset?.s3?.checksum_sha256,
+      content_type: mediaCatalogAsset?.s3?.content_type,
+      etag: mediaCatalogAsset?.s3?.etag,
+      key: s3Key,
+      region: mediaCatalogAsset?.s3?.region,
+      size_bytes: mediaCatalogAsset?.s3?.size_bytes,
+      version_id: mediaCatalogAsset?.s3?.version_id
+    },
+    selection_note: node.selection_note,
+    source: mediaCatalogAsset?.source || visibleCatalogAsset?.source || node.source,
+    status: visibleCatalogAsset?.status || node.status,
+    storage_state: storageState(hasLocalClaim, hasS3),
+    title: visibleCatalogAsset?.title || node.title || node.asset_id
+  };
+}
+function getLineageSelectionPacketV1(project, options = {}) {
+  const workspace = resolveWorkspace(project, options);
+  const snapshot = getLineageSnapshot(project, workspace.root_asset_id);
+  const catalogSummary = validateProject(project);
+  const catalogAssets = listAllAssets(project);
+  const catalogById = new Map(catalogAssets.map((asset) => [asset.asset_id, asset]));
+  const warnings = [];
+  const errors = [];
+  const nodeById = new Map(snapshot.nodes.map((node) => [node.asset_id, node]));
+  const selectedItems = snapshot.selections.map((selection) => ({
+    asset_id: selection.asset_id,
+    position: selection.position,
+    selected_at: selection.selected_at,
+    selection_note: selection.notes
+  }));
+  if (selectedItems.length === 0) warnings.push(`Lineage workspace ${workspace.id} has no selected assets.`);
+  const assets = selectedItems.flatMap((item) => {
+    const node = nodeById.get(item.asset_id);
     if (!node) {
       const message = `Selected asset ${item.asset_id} is not present in the resolved workspace snapshot.`;
       warnings.push(message);
@@ -3549,7 +4632,7 @@ function getLineageSelectionPacket(project, options = {}) {
     labels: options.labels || [],
     notes: options.contextNotes
   };
-  const identity = {
+  const identity2 = {
     assets: assets.map((asset) => ({
       asset_id: asset.asset_id,
       checksum_sha256: asset.checksum_sha256,
@@ -3570,7 +4653,7 @@ function getLineageSelectionPacket(project, options = {}) {
     created_at: (/* @__PURE__ */ new Date()).toISOString(),
     errors,
     kind: "lineage.selection_packet",
-    packet_id: packetId(identity),
+    packet_id: packetId(identity2),
     product: catalogSummary.product,
     project,
     schema_version: "lineage.selection_packet.v1",
@@ -3597,16 +4680,149 @@ function getLineageSelectionPacket(project, options = {}) {
     }
   };
 }
+function getLineageSelectionPacketV2(project, options) {
+  const workspace = resolveWorkspace(project, options);
+  const snapshot = getLineageSnapshot(project, workspace.root_asset_id);
+  const catalogSummary = validateProject(project);
+  const catalogAssets = listAllAssets(project);
+  const catalogById = new Map(catalogAssets.map((asset) => [asset.asset_id, asset]));
+  const warnings = [];
+  const errors = [];
+  const diagnostics = [];
+  const nodeById = new Map(snapshot.nodes.map((node) => [node.asset_id, node]));
+  const selectedItems = snapshot.selections.map((selection) => ({
+    asset_id: selection.asset_id,
+    position: selection.position,
+    selected_at: selection.selected_at,
+    selection_note: selection.notes
+  }));
+  if (selectedItems.length === 0) {
+    warnings.push(`Lineage workspace ${workspace.id} has no selected assets.`);
+    addDiagnostic(diagnostics, { code: "empty_selection", severity: "warning" });
+  }
+  const assets = [];
+  for (const item of selectedItems) {
+    const node = nodeById.get(item.asset_id);
+    if (!node) {
+      const message = `Selected asset ${item.asset_id} is not present in the resolved workspace snapshot.`;
+      warnings.push(message);
+      errors.push(message);
+      const diagnostic = { asset_id: item.asset_id, code: "selected_asset_outside_workspace", severity: "error" };
+      addDiagnostic(diagnostics, diagnostic);
+      throw new LineageSelectionPacketError(message, warnings, ["selected_asset_outside_workspace"], diagnostics);
+    }
+    assets.push(assetForNodeV2(node, catalogById.get(item.asset_id), catalogById, warnings, errors, diagnostics));
+  }
+  if (assets.some((asset) => !asset.dimensions)) {
+    warnings.push("Image dimensions are unavailable for one or more selected assets.");
+  }
+  if (options.strict) {
+    const strictErrors = [
+      ...selectedItems.length === 0 ? ["empty_selection"] : [],
+      ...assets.filter((asset) => asset.local.absolute_path && !asset.local.exists).map((asset) => `missing_local_file:${asset.asset_id}`),
+      ...assets.filter((asset) => asset.storage_state === "unresolved").map((asset) => `unresolved_current_attempt_media:${asset.asset_id}`),
+      ...diagnostics.filter((diagnostic) => diagnostic.severity === "error").map((diagnostic) => `${diagnostic.code}${diagnostic.asset_id ? `:${diagnostic.asset_id}` : ""}`)
+    ];
+    if (strictErrors.length > 0) {
+      throw new LineageSelectionPacketError(
+        `Lineage selection packet strict mode failed: ${strictErrors.join(", ")}`,
+        warnings,
+        strictErrors,
+        diagnostics
+      );
+    }
+  }
+  const packet = {
+    assets,
+    context: {
+      campaign: options.campaign,
+      channel: options.channel,
+      labels: options.labels || [],
+      notes: options.contextNotes
+    },
+    created_at: (/* @__PURE__ */ new Date()).toISOString(),
+    diagnostics,
+    errors: [...new Set(errors)],
+    identity_sha256: "",
+    kind: "lineage.selection_packet",
+    packet_id: "",
+    product: catalogSummary.product,
+    project,
+    schema_version: "lineage.selection_packet.v2",
+    selection: {
+      asset_ids: selectedItems.map((item) => item.asset_id),
+      count: selectedItems.length,
+      items: selectedItems,
+      root_asset_id: workspace.root_asset_id
+    },
+    source: {
+      app: "lineage",
+      command: options.command,
+      db_path: options.dbPath || process.env.LINEAGE_DB || lineageDbPath(),
+      package: options.packageVersion
+    },
+    warnings: [...new Set(warnings)],
+    workspace: {
+      active_at: workspace.active_at,
+      id: workspace.id,
+      notes: workspace.notes,
+      root_asset_id: workspace.root_asset_id,
+      status: workspace.status,
+      title: workspace.title
+    }
+  };
+  packet.identity_sha256 = lineageSelectionPacketV2IdentitySha256(packet);
+  packet.packet_id = `lineage_packet_${packet.identity_sha256.slice(0, 24)}`;
+  return packet;
+}
+function getLineageSelectionPacket(project, options = {}) {
+  return options.schema === "v2" ? getLineageSelectionPacketV2(project, options) : getLineageSelectionPacketV1(project, options);
+}
 
 // src/server/runtimeInfo.ts
+import { createHash as createHash6 } from "node:crypto";
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { createRequire as createRequire2 } from "node:module";
-import { existsSync as existsSync6, readFileSync as readFileSync3, statSync as statSync5 } from "node:fs";
-import { join as join6 } from "node:path";
-var require3 = createRequire2(import.meta.url);
-function packageInfo() {
+import { createRequire as createRequire4 } from "node:module";
+import { existsSync as existsSync10, lstatSync as lstatSync2, readFileSync as readFileSync5, readdirSync as readdirSync3, readlinkSync, realpathSync as realpathSync3, statSync as statSync6 } from "node:fs";
+import { dirname as dirname5, isAbsolute as isAbsolute3, join as join9, resolve as resolve7 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+
+// src/shared/runtimeInfoTypes.ts
+var lineageRuntimeBuildSchemaVersion = "lineage.runtime_build.v1";
+var lineageRuntimeInstallSchemaVersion = "lineage.runtime_install.v1";
+
+// src/server/runtimeInfo.ts
+var require5 = createRequire4(import.meta.url);
+var processStartedAt = (/* @__PURE__ */ new Date()).toISOString();
+function isLineagePackageRoot(root) {
+  try {
+    const info = JSON.parse(readFileSync5(join9(root, "package.json"), "utf8"));
+    return info.name === "@mean-weasel/lineage";
+  } catch {
+    return false;
+  }
+}
+function executingCodeRoot() {
+  const moduleDirectory = dirname5(fileURLToPath2(import.meta.url));
+  const candidates = [resolve7(moduleDirectory, "../.."), resolve7(moduleDirectory, "..")];
+  const root = candidates.find(isLineagePackageRoot);
+  if (!root) throw new Error(`Unable to derive Lineage code root from executing module ${fileURLToPath2(import.meta.url)}`);
+  return canonicalRoot(root);
+}
+var codeRoot = executingCodeRoot();
+function sha256(value) {
+  return createHash6("sha256").update(value).digest("hex");
+}
+function canonicalRoot(root) {
   try {
-    const info = JSON.parse(readFileSync3(join6(packageRoot, "package.json"), "utf8"));
+    return realpathSync3(root);
+  } catch {
+    return resolve7(root);
+  }
+}
+function packageInfo(root = codeRoot) {
+  try {
+    const info = JSON.parse(readFileSync5(join9(root, "package.json"), "utf8"));
     return { name: info.name || "@mean-weasel/lineage", version: info.version || "0.0.0" };
   } catch {
     return { name: "@mean-weasel/lineage", version: "0.0.0" };
@@ -3619,35 +4835,240 @@ function normalizeRuntimeChannel(value) {
   if (value === "development") return "dev";
   return process.env.NODE_ENV === "production" ? "stable" : "dev";
 }
-function gitSha() {
-  const envSha = process.env.LINEAGE_GIT_SHA || process.env.GITHUB_SHA;
-  if (envSha) return envSha.slice(0, 40);
-  if (!existsSync6(join6(packageRoot, ".git"))) return void 0;
-  const result = spawnSync2("git", ["rev-parse", "--short=12", "HEAD"], { cwd: packageRoot, encoding: "utf8" });
-  return result.status === 0 ? result.stdout.trim() || void 0 : void 0;
+function git(root, args) {
+  const result = spawnSync2("git", args, { cwd: root, encoding: "utf8", maxBuffer: 32 * 1024 * 1024 });
+  return result.status === 0 ? result.stdout : void 0;
+}
+function untrackedFingerprint(root, status) {
+  const hash = createHash6("sha256");
+  hash.update(status);
+  const listed = git(root, ["ls-files", "--others", "--exclude-standard", "-z"]);
+  if (listed === void 0) return hash.digest("hex");
+  for (const relativePath of listed.split("\0").filter(Boolean).sort()) {
+    hash.update("\0");
+    hash.update(relativePath);
+    const path = join9(root, relativePath);
+    try {
+      const stat = lstatSync2(path);
+      if (stat.isSymbolicLink()) hash.update(readlinkSync(path));
+      else if (stat.isFile()) hash.update(readFileSync5(path));
+      else hash.update(`[${stat.mode}:${stat.size}]`);
+    } catch (error) {
+      hash.update(`[unreadable:${error instanceof Error ? error.message : String(error)}]`);
+    }
+  }
+  return hash.digest("hex");
 }
-function tableExists(database, table) {
+function checkoutCodeIdentity(root, channel, version) {
+  const errors = [];
+  const gitRootRaw = git(root, ["rev-parse", "--show-toplevel"])?.trim();
+  const gitSha = git(root, ["rev-parse", "HEAD"])?.trim();
+  const status = git(root, ["status", "--porcelain=v1", "-z", "--untracked-files=all"]);
+  const diff = git(root, ["diff", "--binary", "HEAD", "--"]);
+  const canonicalGitRoot = gitRootRaw ? canonicalRoot(gitRootRaw) : void 0;
+  if (!canonicalGitRoot || canonicalGitRoot !== root) errors.push("Code root is not the canonical root of a Git checkout/worktree");
+  if (!gitSha || !/^[a-f0-9]{40}$/i.test(gitSha)) errors.push("Checkout Git revision is unavailable");
+  if (status === void 0 || diff === void 0) errors.push("Checkout dirty state could not be inspected");
+  if (channel !== "dev") errors.push(`Checkout code may run only as dev, not ${channel}`);
+  const dirty = Boolean(status);
+  const sourceFingerprint = sha256(`${gitSha || "unknown"}\0${sha256(diff || "")}\0${untrackedFingerprint(root, status || "")}`);
+  return {
+    channel,
+    dirty,
+    errors,
+    fingerprint: sha256(JSON.stringify({ channel, dirty, git_sha: gitSha, origin: "checkout", root, source_fingerprint: sourceFingerprint, version })),
+    git_sha: gitSha,
+    origin: "checkout",
+    package_version: version,
+    root,
+    source_fingerprint: sourceFingerprint,
+    verified: errors.length === 0
+  };
+}
+function buildFingerprint(build) {
+  return sha256(JSON.stringify({
+    package_name: build.package_name,
+    package_version: build.package_version,
+    schema_version: build.schema_version,
+    source_dirty: build.source_dirty,
+    source_fingerprint: build.source_fingerprint,
+    source_git_sha: build.source_git_sha
+  }));
+}
+function readBuildIdentity(root, errors) {
+  const path = join9(root, "dist", "runtime-build.json");
+  let build;
+  try {
+    build = JSON.parse(readFileSync5(path, "utf8"));
+  } catch (error) {
+    errors.push(`Embedded build identity is missing or unreadable at ${path}: ${error instanceof Error ? error.message : String(error)}`);
+    return void 0;
+  }
+  if (build.schema_version !== lineageRuntimeBuildSchemaVersion) errors.push(`Unsupported build identity schema: ${String(build.schema_version)}`);
+  if (!/^[a-f0-9]{40}$/i.test(build.source_git_sha || "")) errors.push("Embedded build Git revision is invalid");
+  if (!/^[a-f0-9]{64}$/i.test(build.source_fingerprint || "")) errors.push("Embedded source fingerprint is invalid");
+  const expected = buildFingerprint(build);
+  if (build.build_fingerprint !== expected) errors.push("Embedded build fingerprint does not match its contents");
+  return build;
+}
+function readInstallReceipt(path, errors) {
+  if (!path) {
+    errors.push("Packaged runtime was not launched through a channel install receipt");
+    return void 0;
+  }
+  let receipt;
+  const receiptPath = resolve7(path);
+  try {
+    receipt = JSON.parse(readFileSync5(receiptPath, "utf8"));
+  } catch (error) {
+    errors.push(`Runtime install receipt is missing or unreadable at ${receiptPath}: ${error instanceof Error ? error.message : String(error)}`);
+    return void 0;
+  }
+  if (receipt.schema_version !== lineageRuntimeInstallSchemaVersion) errors.push(`Unsupported runtime install receipt schema: ${String(receipt.schema_version)}`);
+  if (!isAbsolute3(receipt.package_root || "")) errors.push("Runtime install receipt package_root must be absolute");
+  if (!receipt.package_integrity?.startsWith("sha512-")) errors.push("Runtime install receipt package integrity is invalid");
+  if (receipt.package_source !== "registry" && receipt.package_source !== "local") errors.push("Runtime install receipt package source is invalid");
+  if (typeof receipt.package_spec !== "string" || !receipt.package_spec) errors.push("Runtime install receipt package spec is invalid");
+  if (!/^[a-f0-9]{64}$/i.test(receipt.package_tree_sha256 || "")) errors.push("Runtime install receipt package tree hash is invalid");
+  if (Number.isNaN(Date.parse(receipt.installed_at))) errors.push("Runtime install receipt timestamp is invalid");
+  return { ...receipt, receipt_path: receiptPath };
+}
+function lineagePackageTreeSha256(root) {
+  const hash = createHash6("sha256");
+  const visit = (directory, relativeDirectory = "") => {
+    for (const entry of readdirSync3(directory, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name))) {
+      const relativePath = relativeDirectory ? join9(relativeDirectory, entry.name) : entry.name;
+      const path = join9(directory, entry.name);
+      hash.update(relativePath.replaceAll("\\", "/"));
+      hash.update("\0");
+      if (entry.isDirectory()) {
+        hash.update("directory\0");
+        visit(path, relativePath);
+      } else if (entry.isSymbolicLink()) {
+        hash.update("symlink\0");
+        hash.update(readlinkSync(path));
+      } else if (entry.isFile()) {
+        hash.update("file\0");
+        hash.update(readFileSync5(path));
+      } else {
+        hash.update("other\0");
+      }
+      hash.update("\0");
+    }
+  };
+  visit(root);
+  return hash.digest("hex");
+}
+function packageCodeIdentity(root, channel, info, receiptPath) {
+  const errors = [];
+  const build = readBuildIdentity(root, errors);
+  const install = readInstallReceipt(receiptPath, errors);
+  if (channel === "dev") errors.push("Published package code cannot run as dev; use a Git checkout/worktree");
+  if (build?.package_name !== info.name || build?.package_version !== info.version) {
+    errors.push("Embedded build package identity does not match package.json");
+  }
+  if (build?.source_dirty) errors.push("Stable and preview package installs require a clean-source build");
+  if (install) {
+    if (install.channel !== channel) errors.push(`Install receipt channel ${install.channel} does not match requested ${channel}`);
+    if (canonicalRoot(install.package_root) !== root) errors.push("Install receipt package root does not match the executing package root");
+    if (install.package_name !== info.name || install.package_version !== info.version) errors.push("Install receipt package identity does not match package.json");
+    if (build && install.build_fingerprint !== build.build_fingerprint) errors.push("Install receipt build fingerprint does not match the embedded build");
+    try {
+      if (lineagePackageTreeSha256(root) !== install.package_tree_sha256) errors.push("Installed package tree does not match the channel install receipt");
+    } catch (error) {
+      errors.push(`Installed package tree could not be verified: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+  const gitSha = build?.source_git_sha;
+  const sourceFingerprint = build?.source_fingerprint;
+  return {
+    build,
+    channel,
+    dirty: build?.source_dirty,
+    errors,
+    fingerprint: sha256(JSON.stringify({
+      build_fingerprint: build?.build_fingerprint,
+      channel,
+      install_integrity: install?.package_integrity,
+      origin: "package",
+      root,
+      version: info.version
+    })),
+    git_sha: gitSha,
+    install,
+    origin: "package",
+    package_version: info.version,
+    root,
+    source_fingerprint: sourceFingerprint,
+    verified: errors.length === 0
+  };
+}
+function getLineageCodeIdentity(channel, options = {}) {
+  const root = canonicalRoot(options.root || codeRoot);
+  const info = packageInfo(root);
+  if (existsSync10(join9(root, ".git"))) return checkoutCodeIdentity(root, channel, info.version);
+  if (existsSync10(join9(root, "package.json"))) {
+    return packageCodeIdentity(root, channel, info, options.receiptPath ?? process.env.LINEAGE_RUNTIME_RECEIPT);
+  }
+  const errors = [`Code root has neither checkout metadata nor package.json: ${root}`];
+  return {
+    channel,
+    errors,
+    fingerprint: sha256(JSON.stringify({ channel, origin: "unknown", root, version: info.version })),
+    origin: "unknown",
+    package_version: info.version,
+    root,
+    verified: false
+  };
+}
+function assertLineageCodeOrigin(channel) {
+  const identity2 = getLineageCodeIdentity(channel);
+  if (!identity2.verified) {
+    const migration = channel === "dev" ? "Run dev from a Git checkout with npm run lineage:dev -- <command>." : `Install and launch an isolated ${channel} runtime with lineage-channel install ${channel}.`;
+    throw new Error(`Unverified ${channel} code origin: ${identity2.errors.join("; ")}. ${migration}`);
+  }
+  return identity2;
+}
+function tableExists2(database, table) {
   return Boolean(database.prepare("select name from sqlite_master where type = 'table' and name = ?").get(table));
 }
 function tableCount(database, table) {
-  if (!tableExists(database, table)) return void 0;
+  if (!tableExists2(database, table)) return void 0;
   const row = database.prepare(`select count(*) count from ${table}`).get();
   return typeof row?.count === "number" ? row.count : void 0;
 }
+function migrationKeys(database) {
+  if (!tableExists2(database, "lineage_schema_migrations")) return [];
+  return database.prepare("select key from lineage_schema_migrations order by key").all().map((row) => row.key);
+}
 function getLineageRuntimeInfo(options = {}) {
   const info = packageInfo();
   const dbPath = options.dbPath || lineageDbPath();
-  const databaseInfo = { exists: existsSync6(dbPath), path: dbPath };
+  const channel = normalizeRuntimeChannel(options.channel || process.env.LINEAGE_CHANNEL || process.env.LINEAGE_RELEASE_CHANNEL);
+  const code = options.code || getLineageCodeIdentity(channel);
+  const databaseInfo = { exists: existsSync10(dbPath), path: dbPath };
+  const schema = { migration_keys: [] };
   if (databaseInfo.exists) {
     try {
-      const stat = statSync5(dbPath);
+      const stat = statSync6(dbPath);
       databaseInfo.modified_at = stat.mtime.toISOString();
       databaseInfo.size_bytes = stat.size;
-      const { DatabaseSync } = require3("node:sqlite");
+      const { DatabaseSync } = require5("node:sqlite");
       const database = new DatabaseSync(dbPath, { readOnly: true });
       try {
         databaseInfo.projects = tableCount(database, "projects");
         databaseInfo.workspaces = tableCount(database, "lineage_workspaces");
+        schema.migration_keys = migrationKeys(database);
+        if (tableExists2(database, "lineage_profile_identity")) {
+          const columns = new Set(database.prepare("pragma table_info(lineage_profile_identity)").all().map((row) => row.name));
+          const fingerprintExpression = columns.has("profile_fingerprint") ? "profile_fingerprint" : "null as profile_fingerprint";
+          const rows = database.prepare(`select profile_id, environment, ${fingerprintExpression} from lineage_profile_identity`).all();
+          if (rows.length === 1) {
+            schema.profile_id = rows[0].profile_id;
+            schema.profile_environment = rows[0].environment;
+            if (rows[0].profile_fingerprint) schema.profile_fingerprint = rows[0].profile_fingerprint;
+          }
+        }
       } finally {
         database.close();
       }
@@ -3657,27 +5078,120 @@ function getLineageRuntimeInfo(options = {}) {
   }
   return {
     asset_root: repoRoot,
-    channel: normalizeRuntimeChannel(options.channel || process.env.LINEAGE_CHANNEL || process.env.LINEAGE_RELEASE_CHANNEL),
+    channel,
+    code,
     database: databaseInfo,
     fetchedAt: nowIso(),
-    git_sha: gitSha(),
+    git_sha: code.git_sha,
     node_env: process.env.NODE_ENV,
     package_name: info.name,
+    profile: runtimeProfileIdentity(channel),
+    schema,
+    service: {
+      instance_id: process.env.LINEAGE_SERVICE_INSTANCE_ID,
+      launcher_pid: process.env.LINEAGE_LAUNCHER_PID ? Number(process.env.LINEAGE_LAUNCHER_PID) : void 0,
+      pid: process.pid,
+      started_at: processStartedAt
+    },
     version: info.version
   };
 }
 
+// src/server/managedWriterRouting.ts
+var managedWriterRequestSchemaVersion = "lineage.managed_writer_request.v1";
+var managedWriterResponseSchemaVersion = "lineage.managed_writer_response.v1";
+var managedWriterRoute = "/api/managed-writer/execute";
+var delegationHeader = "X-Lineage-Writer-Delegation";
+var ManagedWriterRoutingError = class extends Error {
+  constructor(message, status = 409, options) {
+    super(message, options);
+    this.status = status;
+    this.name = "ManagedWriterRoutingError";
+  }
+  status;
+};
+function managedWriterTimeoutMs(command, args) {
+  const subcommand = args.find((arg) => !arg.startsWith("-")) || "";
+  return command === "reroll" && subcommand === "import" ? 5 * 6e4 : 3e4;
+}
+function errorMessage(body, fallback) {
+  if (!body || typeof body !== "object" || Array.isArray(body)) return fallback;
+  const record = body;
+  if (typeof record.message === "string") return record.message;
+  if (typeof record.error === "string") return record.error;
+  return fallback;
+}
+function agentClaimError(body, status) {
+  if (!body || typeof body !== "object" || Array.isArray(body)) return void 0;
+  const record = body;
+  if (typeof record.message !== "string" || typeof record.error !== "string") return void 0;
+  const conflicts = Array.isArray(record.conflicts) ? record.conflicts : [];
+  return new AgentClaimError(record.message, status, record.error, conflicts);
+}
+function assertResponseIdentity(body, profile, channel) {
+  if (!body || typeof body !== "object" || Array.isArray(body)) {
+    throw new ManagedWriterRoutingError("Managed writer service returned a non-object response", 502);
+  }
+  const response = body;
+  if (response.ok !== true || response.schema_version !== managedWriterResponseSchemaVersion || !response.service || response.service.profile_id !== profile.profile_id || response.service.environment !== profile.environment || response.service.service_origin !== profile.service_origin || response.service.channel !== channel) {
+    throw new ManagedWriterRoutingError("Managed writer response identity does not match the selected profile/service", 502);
+  }
+}
+async function executeManagedWriterCommand(profile, channel, command, args) {
+  const delegation = getProfileWriterDelegation(profile);
+  let response;
+  try {
+    response = await fetch(new URL(managedWriterRoute, delegation.service_origin), {
+      body: JSON.stringify({
+        args,
+        channel,
+        command,
+        environment: profile.environment,
+        profile_id: profile.profile_id,
+        schema_version: managedWriterRequestSchemaVersion,
+        service_origin: profile.service_origin
+      }),
+      headers: {
+        "Content-Type": "application/json",
+        [delegationHeader]: delegation.token
+      },
+      method: "POST",
+      redirect: "error",
+      signal: AbortSignal.timeout(managedWriterTimeoutMs(command, args))
+    });
+  } catch (error) {
+    throw new ManagedWriterRoutingError(
+      `Managed service for Lineage profile ${profile.profile_id} is unavailable or did not respond at ${profile.service_origin}; no direct fallback was attempted and the mutation outcome is unknown`,
+      503,
+      { cause: error }
+    );
+  }
+  let body;
+  try {
+    body = await response.json();
+  } catch (error) {
+    throw new ManagedWriterRoutingError("Managed writer service returned invalid JSON; mutation result is unknown", 502, { cause: error });
+  }
+  if (!response.ok) {
+    const claimError = agentClaimError(body, response.status);
+    if (claimError) throw claimError;
+    throw new ManagedWriterRoutingError(errorMessage(body, `Managed writer service returned HTTP ${response.status}`), response.status);
+  }
+  assertResponseIdentity(body, profile, channel);
+  return body.result;
+}
+
 // src/cli/lineageCli.ts
 var signalExitCodes = {
   SIGINT: 130,
   SIGTERM: 143
 };
 function packageRoot2() {
-  return resolve5(dirname3(fileURLToPath2(import.meta.url)), "..", "..");
+  return resolve8(dirname6(fileURLToPath3(import.meta.url)), "..", "..");
 }
 function packageVersion() {
   try {
-    const packageInfo2 = JSON.parse(readFileSync4(join7(packageRoot2(), "package.json"), "utf8"));
+    const packageInfo2 = JSON.parse(readFileSync6(join10(packageRoot2(), "package.json"), "utf8"));
     return packageInfo2.version || "0.0.0";
   } catch {
     return "0.0.0";
@@ -3685,9 +5199,9 @@ function packageVersion() {
 }
 function dataRoot(displayName) {
   if (process.env.LINEAGE_HOME) return process.env.LINEAGE_HOME;
-  if (platform() === "darwin") return join7(homedir(), "Library", "Application Support", displayName);
-  if (platform() === "win32") return join7(process.env.APPDATA || join7(homedir(), "AppData", "Roaming"), displayName);
-  return join7(process.env.XDG_DATA_HOME || join7(homedir(), ".local", "share"), displayName.toLowerCase().replace(/\s+/g, "-"));
+  if (platform2() === "darwin") return join10(homedir2(), "Library", "Application Support", displayName);
+  if (platform2() === "win32") return join10(process.env.APPDATA || join10(homedir2(), "AppData", "Roaming"), displayName);
+  return join10(process.env.XDG_DATA_HOME || join10(homedir2(), ".local", "share"), displayName.toLowerCase().replace(/\s+/g, "-"));
 }
 function readOption(args, name) {
   const prefix = `${name}=`;
@@ -3711,22 +5225,29 @@ function readOptions(args, name) {
   return values;
 }
 function resolveStartOptions(config, args) {
-  const rawPort = readOption(args, "--port") || process.env.PORT || String(config.defaultPort);
+  const profile = prepareCliProfile(config, args);
+  const serviceUrl = profile ? new URL(profile.service_origin) : void 0;
+  const rawPort = readOption(args, "--port") || process.env.PORT || serviceUrl?.port || String(config.defaultPort);
   const port = Number(rawPort);
   if (!Number.isInteger(port) || port < 1 || port > 65535) {
     throw new Error(`Invalid port: ${rawPort}`);
   }
+  const host = readOption(args, "--host") || process.env.HOST || serviceUrl?.hostname || config.defaultHost;
+  if (profile && serviceUrl && (host !== serviceUrl.hostname || port !== Number(serviceUrl.port || 80))) {
+    throw new Error(`Profile ${profile.profile_id} service_origin ${profile.service_origin} conflicts with requested host/port ${host}:${port}`);
+  }
   return {
-    assetRoot: resolveCliAssetRoot(args),
-    dbPath: resolveCliDbPath(config, args),
-    host: readOption(args, "--host") || process.env.HOST || config.defaultHost,
+    assetRoot: profile?.asset_root || resolveCliAssetRoot(args),
+    dbPath: profile?.database_path || resolveCliDbPath(config, args),
+    host,
     json: args.includes("--json"),
     open: args.includes("--open"),
-    port
+    port,
+    profile
   };
 }
 function resolveCliAssetRoot(args) {
-  return resolve5(readOption(args, "--asset-root") || process.env.LINEAGE_ASSET_ROOT || packageRoot);
+  return resolve8(readOption(args, "--asset-root") || process.env.LINEAGE_ASSET_ROOT || packageRoot);
 }
 function configureCliAssetRoot(args) {
   const assetRoot = resolveCliAssetRoot(args);
@@ -3734,17 +5255,66 @@ function configureCliAssetRoot(args) {
   return setLineageAssetRoot(assetRoot);
 }
 function resolveCliDbPath(config, args) {
-  return readOption(args, "--db") || process.env.LINEAGE_DB || join7(dataRoot(config.displayName), `${config.binName}.sqlite`);
+  return readOption(args, "--db") || process.env.LINEAGE_DB || join10(dataRoot(config.displayName), `${config.binName}.sqlite`);
+}
+function hasOption(args, name) {
+  return args.includes(name) || args.some((arg) => arg.startsWith(`${name}=`));
+}
+function profileSelector(args) {
+  const option = readOption(args, "--profile");
+  if (option && process.env.LINEAGE_PROFILE && option !== process.env.LINEAGE_PROFILE) {
+    throw new Error(`--profile ${option} conflicts with LINEAGE_PROFILE ${process.env.LINEAGE_PROFILE}`);
+  }
+  return option || process.env.LINEAGE_PROFILE;
+}
+function doctorFailures(result) {
+  return result.checks.filter((check) => check.status === "fail").map((check) => `${check.id}: ${check.message}`).join("; ");
+}
+function prepareCliProfile(config, args) {
+  const selector = profileSelector(args);
+  if (!selector) {
+    assertUnselectedDatabaseIsUnbound(getLineageRuntimeInfo({ channel: config.channel, dbPath: resolveCliDbPath(config, args) }));
+    return void 0;
+  }
+  if (hasOption(args, "--db")) throw new Error("A named profile cannot be combined with --db");
+  if (hasOption(args, "--asset-root")) throw new Error("A named profile cannot be combined with --asset-root");
+  const profile = resolveLineageProfile(selector);
+  if (process.env.LINEAGE_DB && resolve8(process.env.LINEAGE_DB) !== profile.database_path) {
+    throw new Error(`Profile ${profile.profile_id} database_path conflicts with LINEAGE_DB`);
+  }
+  if (process.env.LINEAGE_ASSET_ROOT && resolve8(process.env.LINEAGE_ASSET_ROOT) !== profile.asset_root) {
+    throw new Error(`Profile ${profile.profile_id} asset_root conflicts with LINEAGE_ASSET_ROOT`);
+  }
+  assertProfileChannel(profile, config.channel);
+  const runtime = getLineageRuntimeInfo({ channel: config.channel, dbPath: profile.database_path });
+  const doctor = doctorLineageProfile(selector, { channel: config.channel, code: runtime.code, gitSha: runtime.git_sha, version: runtime.version });
+  if (!doctor.ok) throw new Error(`Profile ${profile.profile_id} failed doctor: ${doctorFailures(doctor)}`);
+  process.env.LINEAGE_ASSET_ROOT = profile.asset_root;
+  process.env.LINEAGE_DB = profile.database_path;
+  process.env.LINEAGE_PROFILE = selector;
+  process.env.LINEAGE_PROFILE_ENVIRONMENT = profile.environment;
+  process.env.LINEAGE_PROFILE_FINGERPRINT = profile.profile_fingerprint;
+  process.env.LINEAGE_PROFILE_ID = profile.profile_id;
+  process.env.LINEAGE_PROFILE_MANIFEST = profile.manifest_path;
+  process.env.LINEAGE_PROFILE_SERVICE_ORIGIN = profile.service_origin;
+  setLineageAssetRoot(profile.asset_root);
+  return profile;
 }
 function formatLineageHelp(config) {
   return `${config.binName} ${packageVersion()}
 
 Usage:
-  ${config.binName} start [--port <port>] [--host <host>] [--db <path>] [--asset-root <path>] [--open] [--json]
+  ${config.binName} start [--profile <id-or-manifest>] [--port <port>] [--host <host>] [--db <path>] [--asset-root <path>] [--open] [--json]
+  ${config.binName} profile doctor --profile <id-or-manifest> [--json]
+  ${config.binName} profile bind --profile <id-or-manifest> --confirm-write [--json]
+  ${config.binName} profile clone --source-db <snapshot-source> --target-profile <id-or-manifest> --confirm-write [--json]
+  ${config.binName} profile clone-assets --source-asset-root <path> --target-profile <id-or-manifest> --confirm-write [--json]
+  ${config.binName} runtime info [--json]
+  ${config.binName} runtime doctor [--json]
   ${config.binName} next [--project <project>] [--root <asset-id>] [--db <path>] [--json]
   ${config.binName} brief [--project <project>] [--root <asset-id>] [--db <path>] [--json]
   ${config.binName} inspect --asset-id <asset-id> [--project <project>] [--db <path>] [--json]
-  ${config.binName} selection packet [--project <project>] [--workspace <id-or-root>|--root <asset-id>] [--channel <channel>] [--campaign <campaign>] [--context-notes <text>] [--label <label>] [--out <path>] [--strict] [--db <path>] [--json]
+  ${config.binName} selection packet [--project <project>] [--workspace <id-or-root>|--root <asset-id>] [--channel <channel>] [--campaign <campaign>] [--context-notes <text>] [--label <label>] [--schema v2] [--out <path>] [--strict] [--db <path>] [--json]
   ${config.binName} link-child --root <asset-id> --child <asset-id> [--project <project>] [--claim-token <claim-id.secret>] [--confirm-write] [--db <path>] [--json]
   ${config.binName} reroll list --root <asset-id> [--project <project>] [--db <path>] [--json]
   ${config.binName} reroll mark --root <asset-id> --target <asset-id> [--notes <text>] [--requested-by agent|human|system] [--project <project>] [--confirm-write] [--db <path>] [--json]
@@ -3776,6 +5346,19 @@ ${config.displayName} runs the bundled Lineage server for the ${config.channel}
 Asset catalogs and local media default to the installed package root. Pass
 --asset-root <path> or LINEAGE_ASSET_ROOT to use an external project root.
 
+All commands accept --profile <id-or-manifest> or LINEAGE_PROFILE. Named
+profiles are authoritative for database, asset root, environment, and origin;
+they cannot be combined with direct --db or --asset-root overrides. Commands
+without a profile run in legacy-unbound diagnostic/read-only mode.
+
+Operational commands also require an attested code origin. Stable and preview
+run from separate lineage-channel install receipts. Dev runs only from a Git
+checkout/worktree through npm run lineage:dev.
+
+Server startup independently verifies code origin. When --open is requested,
+the browser opens only after /api/runtime matches the expected code, profile,
+database, and unique service instance.
+
 Variation vs re-roll:
   link-child creates a new visible child variation edge.
   reroll mark -> reroll plan -> reroll import updates the same node with a new attempt.`;
@@ -3784,11 +5367,53 @@ function printHelp(config) {
   console.log(formatLineageHelp(config));
 }
 function openBrowser(url) {
-  const command = platform() === "darwin" ? "open" : platform() === "win32" ? "cmd" : "xdg-open";
-  const args = platform() === "win32" ? ["/c", "start", "", url] : [url];
+  const command = platform2() === "darwin" ? "open" : platform2() === "win32" ? "cmd" : "xdg-open";
+  const args = platform2() === "win32" ? ["/c", "start", "", url] : [url];
   const opener = spawn(command, args, { detached: true, stdio: "ignore" });
   opener.unref();
 }
+function lineageServiceIdentityErrors(runtime, expected) {
+  const errors = [];
+  if (runtime.channel !== expected.channel) errors.push(`channel ${runtime.channel} != ${expected.channel}`);
+  if (!runtime.code?.verified) errors.push("service code identity is not verified");
+  if (runtime.code?.fingerprint !== expected.code_fingerprint) errors.push(`code fingerprint ${runtime.code?.fingerprint || "missing"} != ${expected.code_fingerprint}`);
+  if (resolve8(runtime.database.path) !== resolve8(expected.database_path)) errors.push(`database ${runtime.database.path} != ${expected.database_path}`);
+  if (runtime.service?.instance_id !== expected.instance_id) errors.push(`service instance ${runtime.service?.instance_id || "missing"} != ${expected.instance_id}`);
+  if (runtime.service?.launcher_pid !== expected.launcher_pid) errors.push(`launcher pid ${runtime.service?.launcher_pid || "missing"} != ${expected.launcher_pid}`);
+  if (expected.profile) {
+    if (!runtime.profile.bound) errors.push("service profile is unbound");
+    if (runtime.profile.id !== expected.profile.profile_id) errors.push(`profile ${runtime.profile.id} != ${expected.profile.profile_id}`);
+    if (runtime.profile.environment !== expected.profile.environment) errors.push(`environment ${runtime.profile.environment} != ${expected.profile.environment}`);
+    if (runtime.profile.fingerprint !== expected.profile.profile_fingerprint) errors.push(`profile fingerprint ${runtime.profile.fingerprint || "missing"} != ${expected.profile.profile_fingerprint}`);
+    if (runtime.schema.profile_id !== expected.profile.profile_id) errors.push(`database profile ${runtime.schema.profile_id || "missing"} != ${expected.profile.profile_id}`);
+    if (runtime.schema.profile_fingerprint !== expected.profile.profile_fingerprint) errors.push(`database fingerprint ${runtime.schema.profile_fingerprint || "missing"} != ${expected.profile.profile_fingerprint}`);
+  }
+  return errors;
+}
+async function openBrowserAfterReadiness(url, expected, child) {
+  const deadline = Date.now() + 15e3;
+  let lastError = "service did not respond";
+  while (Date.now() < deadline && child.exitCode === null) {
+    try {
+      const response = await fetch(`${url}/api/runtime`, { signal: AbortSignal.timeout(1e3) });
+      if (response.ok) {
+        const body = await response.json();
+        if (body.runtime) {
+          const errors = lineageServiceIdentityErrors(body.runtime, expected);
+          if (errors.length === 0) {
+            openBrowser(url);
+            return;
+          }
+          lastError = errors.join("; ");
+        }
+      } else lastError = `HTTP ${response.status}`;
+    } catch (error) {
+      lastError = error instanceof Error ? error.message : String(error);
+    }
+    await new Promise((resolveDelay) => setTimeout(resolveDelay, 200));
+  }
+  throw new Error(`Service readiness failed; browser was not opened: ${lastError}`);
+}
 function positionalArgs(args) {
   const values = [];
   for (let index = 0; index < args.length; index += 1) {
@@ -3828,6 +5453,8 @@ function runLineageDataCommand(command, args) {
   if (command === "selection") {
     const subcommand = positionalArgs(args)[0] || "";
     if (subcommand !== "packet") throw new Error(`Unknown selection command: ${subcommand}`);
+    const schema = readOption(args, "--schema");
+    if (schema && schema !== "v2") throw new Error(`Unsupported selection packet schema: ${schema}. Omit --schema for v1 or pass --schema v2.`);
     const labels = readOptions(args, "--label").flatMap((label) => label.split(",")).map((label) => label.trim()).filter(Boolean);
     const packet = getLineageSelectionPacket(options.project, {
       campaign: readOption(args, "--campaign"),
@@ -3838,14 +5465,15 @@ function runLineageDataCommand(command, args) {
       labels,
       packageVersion: packageVersion(),
       rootAssetId: options.rootAssetId,
+      schema: schema === "v2" ? "v2" : void 0,
       strict: args.includes("--strict"),
       workspaceId: readOption(args, "--workspace") || readOption(args, "--workspace-id")
     });
     const out = readOption(args, "--out");
     if (out) {
-      const outPath = resolve5(out);
-      mkdirSync4(dirname3(outPath), { recursive: true });
-      writeFileSync2(outPath, `${JSON.stringify(packet, null, 2)}
+      const outPath = resolve8(out);
+      mkdirSync6(dirname6(outPath), { recursive: true });
+      writeFileSync4(outPath, `${JSON.stringify(packet, null, 2)}
 `);
     }
     return packet;
@@ -4055,6 +5683,113 @@ function runLineageDbCommand(config, command, args) {
   if (command === "info") return getLineageRuntimeInfo({ channel: config.channel, dbPath });
   throw new Error(`Unknown db command: ${command}`);
 }
+function runLineageProfileCommand(config, command, args) {
+  const runtime = getLineageRuntimeInfo({ channel: config.channel });
+  const runtimeIdentity = { channel: config.channel, code: runtime.code, gitSha: runtime.git_sha, version: runtime.version };
+  if (command === "clone") {
+    const source = readOption(args, "--source-db");
+    const target = readOption(args, "--target-profile");
+    if (!source || !target) throw new Error("lineage profile clone requires --source-db and --target-profile");
+    if (hasOption(args, "--profile")) throw new Error("Profile clone uses --target-profile, not --profile");
+    if (!args.includes("--confirm-write")) throw new Error("Profile clone requires --confirm-write");
+    const targetProfile = resolveLineageProfile(target);
+    const writerLease = acquireProfileWriterLease(targetProfile, config.channel, "cli");
+    return cloneLineageProfileDatabase(source, target, runtimeIdentity, true).finally(writerLease.release);
+  }
+  if (command === "clone-assets") {
+    const source = readOption(args, "--source-asset-root");
+    const target = readOption(args, "--target-profile");
+    if (!source || !target) throw new Error("lineage profile clone-assets requires --source-asset-root and --target-profile");
+    if (hasOption(args, "--profile")) throw new Error("Profile asset clone uses --target-profile, not --profile");
+    if (!args.includes("--confirm-write")) throw new Error("Profile asset clone requires --confirm-write");
+    const targetProfile = resolveLineageProfile(target);
+    const writerLease = acquireProfileWriterLease(targetProfile, config.channel, "cli");
+    try {
+      return cloneLineageProfileAssets(source, target, runtimeIdentity, true);
+    } finally {
+      writerLease.release();
+    }
+  }
+  if (hasOption(args, "--db")) throw new Error(`Profile ${command} cannot be combined with --db`);
+  if (hasOption(args, "--asset-root")) throw new Error(`Profile ${command} cannot be combined with --asset-root`);
+  const selector = profileSelector(args);
+  if (!selector) throw new Error(`lineage profile ${command} requires --profile or LINEAGE_PROFILE`);
+  if (command === "doctor") return doctorLineageProfile(selector, runtimeIdentity);
+  if (command === "bind") {
+    if (!args.includes("--confirm-write")) throw new Error("Profile bind requires --confirm-write");
+    const profile = resolveLineageProfile(selector);
+    const writerLease = acquireProfileWriterLease(profile, config.channel, "cli");
+    try {
+      return bindLineageProfileDatabase(selector, runtimeIdentity, true);
+    } finally {
+      writerLease.release();
+    }
+  }
+  throw new Error(`Unknown profile command: ${command}`);
+}
+function printProfileResult(result, json) {
+  if (json) {
+    console.log(JSON.stringify(result, null, 2));
+    return;
+  }
+  if (result.schema_version === "lineage.profile_doctor.v1") {
+    console.log(`Profile doctor: ${result.ok ? "ok" : "failed"}`);
+    for (const check of result.checks) console.log(`${check.status.toUpperCase()} ${check.id}: ${check.message}`);
+  } else if (result.schema_version === "lineage.profile_bind.v1") {
+    console.log(`${result.already_bound ? "Already bound" : "Bound"} ${result.database_path} to ${result.identity.profile_id}`);
+  } else if (result.schema_version === "lineage.profile_clone_receipt.v1") {
+    console.log(`Cloned ${result.source_database_path} to ${result.database_path} for ${result.target_identity.profile_id}`);
+    console.log(`Receipt: ${result.receipt_path}`);
+  } else {
+    console.log(`Cloned ${result.files_copied} referenced asset file(s) into ${result.asset_root}`);
+    console.log(`Receipt: ${result.receipt_path}`);
+  }
+}
+function lineageProfileDoctorExitCode(result) {
+  return result.ok ? 0 : 1;
+}
+function runLineageRuntimeCommand(config, command) {
+  if (command === "info") return getLineageCodeIdentity(config.channel);
+  if (command === "doctor") return assertLineageCodeOrigin(config.channel);
+  throw new Error(`Unknown runtime command: ${command}`);
+}
+function printRuntimeResult(result, json) {
+  if (json) {
+    console.log(JSON.stringify(result, null, 2));
+    return;
+  }
+  console.log(`Code origin: ${result.origin}`);
+  console.log(`Code root: ${result.root}`);
+  console.log(`Channel: ${result.channel}`);
+  console.log(`Version: ${result.package_version}`);
+  if (result.git_sha) console.log(`Git: ${result.git_sha}`);
+  if (result.dirty !== void 0) console.log(`Dirty: ${result.dirty ? "yes" : "no"}`);
+  console.log(`Fingerprint: ${result.fingerprint}`);
+  console.log(`Verified: ${result.verified ? "yes" : "no"}`);
+  for (const error of result.errors) console.log(`FAIL: ${error}`);
+}
+function lineageCliRequiresWriterLease(command, args) {
+  if (command === "next" || command === "brief" || command === "inspect" || command === "selection") return false;
+  const subcommand = positionalArgs(args)[0] || "";
+  if (command === "reroll") return subcommand !== "list";
+  if (command === "tasks") return subcommand !== "list" && subcommand !== "inspect";
+  if (command === "db") return subcommand !== "info";
+  if (command === "agent") return subcommand !== "status" && subcommand !== "graph" && subcommand !== "inspect";
+  return true;
+}
+function argsWithoutProfileSelector(args) {
+  const filtered = [];
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === "--profile") {
+      index += 1;
+      continue;
+    }
+    if (arg.startsWith("--profile=")) continue;
+    filtered.push(arg);
+  }
+  return filtered;
+}
 function printDbResult(command, result, json) {
   if (json) {
     console.log(JSON.stringify(result, null, 2));
@@ -4064,6 +5799,10 @@ function printDbResult(command, result, json) {
     const runtime = result;
     console.log(`Channel: ${runtime.channel}`);
     console.log(`Version: ${runtime.version}`);
+    if (runtime.code) {
+      console.log(`Code: ${runtime.code.origin} ${runtime.code.verified ? "verified" : "unverified"} ${runtime.code.fingerprint}`);
+      console.log(`Code root: ${runtime.code.root}`);
+    }
     if (runtime.git_sha) console.log(`Git: ${runtime.git_sha}`);
     if (runtime.node_env) console.log(`Node env: ${runtime.node_env}`);
     console.log(`Assets: ${runtime.asset_root}`);
@@ -4205,23 +5944,26 @@ function start(config, args) {
     else console.error(`${config.binName}: ${message}`);
     process.exit(1);
   }
-  const serverPath = join7(packageRoot2(), "dist", "server.js");
-  if (!existsSync7(serverPath)) {
+  const serverPath = join10(packageRoot2(), "dist", "server.js");
+  if (!existsSync11(serverPath)) {
     const message = `Missing bundled server at ${serverPath}. Run npm run build before using ${config.binName} start from a source checkout.`;
     if (options.json) console.error(JSON.stringify({ ok: false, error: message }, null, 2));
     else console.error(`${config.binName}: ${message}`);
     process.exit(1);
   }
-  mkdirSync4(dirname3(options.dbPath), { recursive: true });
+  mkdirSync6(dirname6(options.dbPath), { recursive: true });
   const url = `http://${options.host}:${options.port}`;
   if (options.json) {
-    console.log(JSON.stringify({ assetRoot: options.assetRoot, channel: config.channel, dbPath: options.dbPath, host: options.host, port: options.port, status: "starting", url }, null, 2));
+    console.log(JSON.stringify({ assetRoot: options.assetRoot, channel: config.channel, dbPath: options.dbPath, host: options.host, port: options.port, profile: options.profile ? { environment: options.profile.environment, id: options.profile.profile_id } : { bound: false, id: "legacy-unbound" }, status: "starting", url }, null, 2));
   } else {
     console.log(`${config.displayName} starting at ${url}`);
+    if (options.profile) console.log(`Profile: ${options.profile.profile_id} (${options.profile.environment})`);
+    else console.warn("Warning: legacy-unbound runtime; database and asset paths are not protected by a named profile.");
     console.log(`SQLite: ${options.dbPath}`);
     console.log(`Assets: ${options.assetRoot}`);
   }
-  if (options.open) openBrowser(url);
+  const code = getLineageCodeIdentity(config.channel);
+  const serviceInstanceId = process.env.LINEAGE_SERVICE_INSTANCE_ID || randomUUID4();
   const child = spawn(process.execPath, [serverPath], {
     env: {
       ...process.env,
@@ -4229,11 +5971,33 @@ function start(config, args) {
       LINEAGE_ASSET_ROOT: options.assetRoot,
       LINEAGE_CHANNEL: config.channel,
       LINEAGE_DB: options.dbPath,
+      LINEAGE_PROFILE: options.profile ? process.env.LINEAGE_PROFILE : void 0,
+      LINEAGE_PROFILE_ENVIRONMENT: options.profile?.environment,
+      LINEAGE_PROFILE_FINGERPRINT: options.profile?.profile_fingerprint,
+      LINEAGE_PROFILE_ID: options.profile?.profile_id,
+      LINEAGE_PROFILE_MANIFEST: options.profile?.manifest_path,
+      LINEAGE_PROFILE_SERVICE_ORIGIN: options.profile?.service_origin,
+      LINEAGE_LAUNCHER_PID: String(process.pid),
+      LINEAGE_SERVICE_INSTANCE_ID: serviceInstanceId,
+      LINEAGE_DB_ACCESS: options.profile ? void 0 : "read-only",
       NODE_ENV: "production",
       PORT: String(options.port)
     },
     stdio: "inherit"
   });
+  if (options.open) {
+    void openBrowserAfterReadiness(url, {
+      channel: config.channel,
+      code_fingerprint: code.fingerprint,
+      database_path: options.dbPath,
+      instance_id: serviceInstanceId,
+      launcher_pid: process.pid,
+      profile: options.profile
+    }, child).catch((error) => {
+      console.error(`${config.binName}: ${error instanceof Error ? error.message : String(error)}`);
+      child.kill("SIGTERM");
+    });
+  }
   let forwardedSignal;
   const stop = (signal) => {
     forwardedSignal = signal;
@@ -4241,13 +6005,14 @@ function start(config, args) {
   };
   process.once("SIGINT", stop);
   process.once("SIGTERM", stop);
-  child.on("exit", (code) => process.exit(code ?? (forwardedSignal ? signalExitCodes[forwardedSignal] || 1 : 0)));
+  child.on("exit", (code2) => process.exit(code2 ?? (forwardedSignal ? signalExitCodes[forwardedSignal] || 1 : 0)));
   child.on("error", (error) => {
     console.error(`${config.binName}: failed to start server: ${error.message}`);
     process.exit(1);
   });
 }
-function runLineageCli(config, args = process.argv.slice(2)) {
+async function runLineageCli(config, args = process.argv.slice(2)) {
+  process.env.LINEAGE_CHANNEL = config.channel;
   if (args.includes("--help") || args.includes("-h") || args.length === 0) {
     printHelp(config);
     process.exit(0);
@@ -4258,15 +6023,99 @@ function runLineageCli(config, args = process.argv.slice(2)) {
   }
   const normalizedArgs = args[0] === "lineage" ? args.slice(1) : args;
   const [command] = normalizedArgs;
+  if (command === "profile") {
+    const commandArgs = normalizedArgs.slice(2);
+    const profileCommand = normalizedArgs[1] || "";
+    const json2 = commandArgs.includes("--json");
+    try {
+      const result = runLineageProfileCommand(config, profileCommand, commandArgs);
+      if (result instanceof Promise) {
+        result.then((value) => {
+          printProfileResult(value, json2);
+          process.exit(0);
+        }).catch((error) => {
+          const message2 = error instanceof Error ? error.message : String(error);
+          if (json2) console.error(JSON.stringify({ ok: false, command: `profile ${profileCommand}`, error: message2 }, null, 2));
+          else console.error(`${config.binName}: ${message2}`);
+          process.exit(1);
+        });
+        return;
+      }
+      printProfileResult(result, json2);
+      process.exit(result.schema_version === "lineage.profile_doctor.v1" ? lineageProfileDoctorExitCode(result) : 0);
+    } catch (error) {
+      const message2 = error instanceof Error ? error.message : String(error);
+      if (json2) console.error(JSON.stringify({ ok: false, command: `profile ${profileCommand}`, error: message2 }, null, 2));
+      else console.error(`${config.binName}: ${message2}`);
+      process.exit(1);
+    }
+  }
+  if (command === "runtime") {
+    const runtimeCommand = normalizedArgs[1] || "";
+    const commandArgs = normalizedArgs.slice(2);
+    const json2 = commandArgs.includes("--json");
+    try {
+      printRuntimeResult(runLineageRuntimeCommand(config, runtimeCommand), json2);
+      process.exit(0);
+    } catch (error) {
+      const message2 = error instanceof Error ? error.message : String(error);
+      if (json2) console.error(JSON.stringify({ ok: false, command: `runtime ${runtimeCommand}`, error: message2 }, null, 2));
+      else console.error(`${config.binName}: ${message2}`);
+      process.exit(1);
+    }
+  }
+  const originDiagnosticOnly = command === "db" && normalizedArgs[1] === "info";
+  if (!originDiagnosticOnly) {
+    try {
+      assertLineageCodeOrigin(config.channel);
+    } catch (error) {
+      const message2 = error instanceof Error ? error.message : String(error);
+      const json2 = normalizedArgs.includes("--json");
+      if (json2) console.error(JSON.stringify({ ok: false, command, error: message2 }, null, 2));
+      else console.error(`${config.binName}: ${message2}`);
+      process.exit(1);
+    }
+  }
   if (command === "start") {
     start(config, normalizedArgs.slice(1));
     return;
   }
+  let managedWriterProfile;
+  try {
+    const profile = prepareCliProfile(config, normalizedArgs.slice(1));
+    const requiresWriter = lineageCliRequiresWriterLease(command, normalizedArgs.slice(1));
+    if (profile) {
+      if (requiresWriter) {
+        delete process.env.LINEAGE_DB_ACCESS;
+        try {
+          const writerLease = acquireProfileWriterLease(profile, config.channel, "cli");
+          process.once("exit", writerLease.release);
+        } catch (error) {
+          if (!(error instanceof ProfileWriterLeaseConflictError) || error.owner.role !== "service") throw error;
+          process.env.LINEAGE_DB_ACCESS = "read-only";
+          managedWriterProfile = profile;
+        }
+      } else {
+        process.env.LINEAGE_DB_ACCESS = "read-only";
+      }
+    } else if (requiresWriter) {
+      throw new Error("Persistent writes require --profile; legacy-unbound access is read-only");
+    } else {
+      process.env.LINEAGE_DB_ACCESS = "read-only";
+    }
+  } catch (error) {
+    const message2 = error instanceof Error ? error.message : String(error);
+    const json2 = normalizedArgs.includes("--json");
+    if (json2) console.error(JSON.stringify({ ok: false, command, error: message2 }, null, 2));
+    else console.error(`${config.binName}: ${message2}`);
+    process.exit(1);
+  }
   if (command === "next" || command === "brief" || command === "inspect" || command === "selection" || command === "link-child" || command === "reroll" || command === "tasks") {
     const commandArgs = normalizedArgs.slice(1);
     const json2 = commandArgs.includes("--json");
     try {
-      printDataResult(command, runLineageDataCommand(command, commandArgs), json2);
+      const result = managedWriterProfile ? await executeManagedWriterCommand(managedWriterProfile, config.channel, command, argsWithoutProfileSelector(commandArgs)) : runLineageDataCommand(command, commandArgs);
+      printDataResult(command, result, json2);
     } catch (error) {
       const message2 = redactAgentClaimTokens(error instanceof Error ? error.message : String(error));
       if (json2) {
@@ -4296,7 +6145,13 @@ function runLineageCli(config, args = process.argv.slice(2)) {
     const agentCommand = normalizedArgs[1] || "";
     const json2 = commandArgs.includes("--json");
     try {
-      printAgentResult(agentCommand, runLineageAgentCommand(agentCommand, commandArgs), json2);
+      const result = managedWriterProfile ? await executeManagedWriterCommand(
+        managedWriterProfile,
+        config.channel,
+        "agent",
+        argsWithoutProfileSelector([agentCommand, ...commandArgs])
+      ) : runLineageAgentCommand(agentCommand, commandArgs);
+      printAgentResult(agentCommand, result, json2);
     } catch (error) {
       const message2 = redactAgentClaimTokens(error instanceof Error ? error.message : String(error));
       if (json2) {
@@ -4317,5 +6172,17 @@ function runLineageCli(config, args = process.argv.slice(2)) {
 }
 
 // src/cli/lineage-dev.ts
-runLineageCli({ binName: "lineage-dev", channel: "dev", defaultHost: "lineage-dev.localhost", defaultPort: 5198, displayName: "Lineage Dev" });
+var identity = getLineageCodeIdentity("dev");
+if (!identity.verified) {
+  console.error(`lineage-dev: published package execution is disabled. ${identity.errors.join("; ")}. Run dev from a Git checkout with npm run lineage:dev -- <command>.`);
+  process.exit(1);
+}
+var preview = process.env.LINEAGE_CHANNEL === "preview";
+await runLineageCli({
+  binName: "lineage-dev",
+  channel: preview ? "preview" : "dev",
+  defaultHost: preview ? "lineage-preview.localhost" : "lineage-dev.localhost",
+  defaultPort: preview ? 5199 : 5198,
+  displayName: preview ? "Lineage Preview" : "Lineage Dev"
+});
 //# sourceMappingURL=lineage-dev.js.map