@rudderhq/cli 0.7.13 → 0.7.14

package/dist/index.js

@@ -7464,6 +7464,7 @@ import { execFile } from "node:child_process";
 import { existsSync as existsSync3 } from "node:fs";
 import fs6 from "node:fs/promises";
 import path8 from "node:path";
+import { performance } from "node:perf_hooks";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { promisify } from "node:util";
 function nativeTarget() {
@@ -7496,14 +7497,14 @@ function parseEnvelope(stdout, capability) {
   }
   return envelope;
 }
-async function runNativePayload(capability, args, commandMayAccept) {
+async function runNativePayload(capability, args, commandMayAccept, timeoutMs = TIMEOUT_MS) {
   let stdout = "";
   let stderr = "";
   try {
     const command = resolveNativeCommand(resolveNativePayloadBinary(), args);
     const result = await execFileAsync(command.command, command.args, {
       encoding: "utf8",
-      timeout: TIMEOUT_MS,
+      timeout: Math.max(1, Math.min(TIMEOUT_MS, timeoutMs)),
       maxBuffer: OUTPUT_LIMIT_BYTES,
       windowsHide: true
     });
@@ -7522,6 +7523,9 @@ async function runNativePayload(capability, args, commandMayAccept) {
         envelope2
       );
     }
+    if (detail.code === "ETIMEDOUT" || detail.killed === true || detail.signal === "SIGTERM") {
+      throw new NativePayloadError("deadline_exceeded", commandMayAccept, detail.code ?? detail.signal);
+    }
     const failedBeforeSpawn = detail.code === "ENOENT" || detail.code === "EACCES";
     throw new NativePayloadError("process_failed", commandMayAccept && !failedBeforeSpawn, stderr || detail.code);
   }
@@ -7544,16 +7548,16 @@ function nativePayloadPolicy() {
     legacyToggleEnvs: ["RUDDER_NATIVE_RUNTIME_PAYLOAD"]
   });
 }
-async function verifyNativePayload(archivePath, expectedSha256, maxArchiveBytes) {
+async function verifyNativePayload(archivePath, expectedSha256, maxArchiveBytes, timeoutMs) {
   return runNativePayload("payload.verify", [
     "payload",
     "verify",
     path8.resolve(archivePath),
     expectedSha256,
     String(maxArchiveBytes)
-  ], false);
+  ], false, timeoutMs);
 }
-async function extractNativePayload(archivePath, stagingPath, maxArchiveBytes) {
+async function extractNativePayload(archivePath, stagingPath, maxArchiveBytes, timeoutMs) {
   try {
     return await runNativePayload("payload.extract", [
       "payload",
@@ -7565,7 +7569,7 @@ async function extractNativePayload(archivePath, stagingPath, maxArchiveBytes) {
       String(maxArchiveBytes),
       String(maxArchiveBytes * 2),
       "0"
-    ], true);
+    ], true, timeoutMs);
   } catch (error) {
     if (error instanceof NativePayloadError && error.code === "process_failed" && !existsSync3(stagingPath)) {
       throw new NativePayloadError("process_failed", false, error.message);
@@ -7573,24 +7577,53 @@ async function extractNativePayload(archivePath, stagingPath, maxArchiveBytes) {
     throw error;
   }
 }
-async function probeNativePayloadVersion(rootPath, executable) {
+async function probeNativePayloadVersion(rootPath, executable, timeoutMs) {
   return runNativePayload("payload.probeVersion", [
     "payload",
     "probe-version",
     path8.resolve(rootPath),
     executable,
     "PostgreSQL 18.4"
-  ], true);
+  ], true, timeoutMs);
 }
-async function publishNativePayload(stagingPath, destinationPath) {
+async function publishNativePayload(stagingPath, destinationPath, timeoutMs) {
   return runNativePayload("payload.publish", [
     "payload",
     "publish",
     path8.resolve(stagingPath),
     path8.resolve(destinationPath)
-  ], true);
+  ], true, timeoutMs);
 }
 async function tryInstallNativePayload(input) {
+  const now = input.now ?? (() => performance.now());
+  const expiresAt = input.timeoutMs === void 0 ? null : now() + input.timeoutMs;
+  const remainingTimeout = (accepted) => {
+    if (expiresAt === null) return void 0;
+    const remaining = Math.ceil(expiresAt - now());
+    if (remaining <= 0) throw new NativePayloadError("deadline_exceeded", accepted);
+    return remaining;
+  };
+  const runCallbackWithinDeadline = async (accepted, callback) => {
+    const controller = new AbortController();
+    const timeoutMs = remainingTimeout(accepted);
+    let timer;
+    const timeoutPromise = timeoutMs === void 0 ? null : new Promise((_resolve, reject) => {
+      timer = setTimeout(() => {
+        controller.abort();
+        reject(new NativePayloadError("deadline_exceeded", accepted));
+      }, timeoutMs);
+    });
+    const context = {
+      signal: controller.signal,
+      remainingMs: () => remainingTimeout(accepted)
+    };
+    try {
+      const operation = callback(context);
+      return timeoutPromise ? await Promise.race([operation, timeoutPromise]) : await operation;
+    } finally {
+      if (timer) clearTimeout(timer);
+    }
+  };
   const policy = nativePayloadPolicy();
   if (!policy.enabled) return {
     installed: false,
@@ -7613,9 +7646,9 @@ async function tryInstallNativePayload(input) {
   }
   try {
     if (expectedSha256) {
-      await verifyNativePayload(input.archivePath, expectedSha256, input.maxArchiveBytes);
+      await verifyNativePayload(input.archivePath, expectedSha256, input.maxArchiveBytes, remainingTimeout(false));
     }
-    await extractNativePayload(input.archivePath, input.extractPath, input.maxArchiveBytes);
+    await extractNativePayload(input.archivePath, input.extractPath, input.maxArchiveBytes, remainingTimeout(false));
   } catch (error) {
     const fallbackSafe = error instanceof NativePayloadError && error.fallbackSafe;
     if (!policy.fallbackAllowed || !fallbackSafe) throw error;
@@ -7634,10 +7667,16 @@ async function tryInstallNativePayload(input) {
     };
   }
   try {
-    const versionExecutable = await input.preparePublish(input.extractPath, input.publishStagingPath);
-    await probeNativePayloadVersion(input.publishStagingPath, versionExecutable);
-    const published = await publishNativePayload(input.publishStagingPath, input.destinationPath);
-    await input.validatePublished(input.destinationPath);
+    const versionExecutable = await runCallbackWithinDeadline(
+      true,
+      (context) => input.preparePublish(input.extractPath, input.publishStagingPath, context)
+    );
+    await probeNativePayloadVersion(input.publishStagingPath, versionExecutable, remainingTimeout(true));
+    const published = await publishNativePayload(input.publishStagingPath, input.destinationPath, remainingTimeout(true));
+    await runCallbackWithinDeadline(
+      true,
+      (context) => input.validatePublished(input.destinationPath, context)
+    );
     return {
       installed: true,
       fallbackCode: null,
@@ -7651,7 +7690,9 @@ async function tryInstallNativePayload(input) {
       }
     };
   } finally {
-    await fs6.rm(input.publishStagingPath, { recursive: true, force: true });
+    const cleanup = input.cleanupPublishStaging ?? ((publishStagingPath) => fs6.rm(publishStagingPath, { recursive: true, force: true }));
+    void cleanup(input.publishStagingPath).catch(() => {
+    });
   }
 }
 var execFileAsync, PROTOCOL_VERSION, OUTPUT_LIMIT_BYTES, TIMEOUT_MS, NativePayloadError;
@@ -7689,81 +7730,26 @@ var init_native_payload = __esm({
   }
 });
 
-// src/runtime/postgres-payload.ts
-import { cp, mkdir, stat } from "node:fs/promises";
-import path9 from "node:path";
-async function copyRuntimePostgresPayload(sourceRuntimeDir, targetRuntimeDir, sourceShareDir = path9.join(sourceRuntimeDir, "share")) {
-  await mkdir(targetRuntimeDir, { recursive: true });
-  for (const directoryName of ["bin", "lib"]) {
-    const sourceDirectory = path9.join(sourceRuntimeDir, directoryName);
-    if (!await stat(sourceDirectory).catch(() => null)) continue;
-    await cp(
-      sourceDirectory,
-      path9.join(targetRuntimeDir, directoryName),
-      { recursive: true, dereference: true }
-    );
-  }
-  await cp(
-    sourceShareDir,
-    path9.join(targetRuntimeDir, "share"),
-    { recursive: true, dereference: true }
-  );
-}
-var init_postgres_payload = __esm({
-  "src/runtime/postgres-payload.ts"() {
-    "use strict";
-  }
-});
-
 // src/runtime/postgres-runtime-download.ts
 import { createHash as createHash2 } from "node:crypto";
 import { createReadStream, createWriteStream } from "node:fs";
-import { copyFile, stat as stat2 } from "node:fs/promises";
 import { Readable, Transform } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
-async function downloadRuntimePostgresArchive(url, targetPath, trustedSha256) {
+async function downloadRuntimePostgresArchive(url, targetPath, trustedSha256, options = {}) {
   const expectedSha256 = (trustedSha256 ?? process.env[RUDDER_POSTGRES_RUNTIME_ARCHIVE_SHA256_ENV])?.trim().toLowerCase() || null;
   if (expectedSha256 && !/^[a-f0-9]{64}$/.test(expectedSha256)) {
     throw new Error(`${RUDDER_POSTGRES_RUNTIME_ARCHIVE_SHA256_ENV} must be a 64-character SHA-256 digest`);
   }
   const configuredMaxBytes = Number.parseInt(process.env[RUDDER_POSTGRES_RUNTIME_ARCHIVE_MAX_BYTES_ENV] ?? "", 10);
   const maxBytes = Number.isSafeInteger(configuredMaxBytes) && configuredMaxBytes > 0 ? configuredMaxBytes : DEFAULT_RUNTIME_POSTGRES_ARCHIVE_MAX_BYTES;
-  async function verifyFile(filePath) {
-    if (!expectedSha256) return;
-    const hash = createHash2("sha256");
-    await new Promise((resolve, reject) => {
-      const stream = createReadStream(filePath);
-      stream.on("data", (chunk) => hash.update(chunk));
-      stream.on("error", reject);
-      stream.on("end", resolve);
-    });
-    const actual = hash.digest("hex");
-    if (actual !== expectedSha256) throw new Error(`PostgreSQL runtime archive SHA-256 mismatch: expected ${expectedSha256}, got ${actual}`);
-  }
-  if (url.startsWith("file://")) {
-    await copyFile(fileURLToPath4(url), targetPath);
-    const archiveStat = await stat2(targetPath);
-    if (archiveStat.size > maxBytes) throw new Error(`PostgreSQL runtime archive exceeds ${maxBytes} bytes`);
-    await verifyFile(targetPath);
-    return;
-  }
   const parsedTimeout = Number.parseInt(
-    process.env[RUDDER_POSTGRES_RUNTIME_DOWNLOAD_TIMEOUT_MS_ENV] ?? "600000",
+    String(options.timeoutMs ?? process.env[RUDDER_POSTGRES_RUNTIME_DOWNLOAD_TIMEOUT_MS_ENV] ?? "600000"),
     10
   );
   const controller = new AbortController();
   const timeout = Number.isFinite(parsedTimeout) && parsedTimeout > 0 ? setTimeout(() => controller.abort(), parsedTimeout) : null;
   try {
-    const response = await fetch(url, { signal: controller.signal });
-    if (!response.ok) {
-      throw new Error(`failed to download ${url}: ${response.status} ${response.statusText}`);
-    }
-    const contentLength = Number.parseInt(response.headers.get("content-length") ?? "", 10);
-    if (Number.isSafeInteger(contentLength) && contentLength > maxBytes) {
-      throw new Error(`PostgreSQL runtime archive exceeds ${maxBytes} bytes`);
-    }
-    if (!response.body) throw new Error("PostgreSQL runtime archive response has no body");
     const hash = createHash2("sha256");
     let bytes = 0;
     const monitor = new Transform({
@@ -7777,15 +7763,39 @@ async function downloadRuntimePostgresArchive(url, targetPath, trustedSha256) {
         callback(null, chunk);
       }
     });
+    if (url.startsWith("file://")) {
+      const readStream = (options.createReadStreamImpl ?? createReadStream)(fileURLToPath4(url));
+      await pipeline(readStream, monitor, createWriteStream(targetPath), { signal: controller.signal });
+      if (expectedSha256) {
+        const actual = hash.digest("hex");
+        if (actual !== expectedSha256) throw new Error(`PostgreSQL runtime archive SHA-256 mismatch: expected ${expectedSha256}, got ${actual}`);
+      }
+      return;
+    }
+    const response = await fetch(url, { signal: controller.signal });
+    if (!response.ok) {
+      throw new Error(`failed to download ${url}: ${response.status} ${response.statusText}`);
+    }
+    const contentLength = Number.parseInt(response.headers.get("content-length") ?? "", 10);
+    if (Number.isSafeInteger(contentLength) && contentLength > maxBytes) {
+      throw new Error(`PostgreSQL runtime archive exceeds ${maxBytes} bytes`);
+    }
+    if (!response.body) throw new Error("PostgreSQL runtime archive response has no body");
     await pipeline(
       Readable.fromWeb(response.body),
       monitor,
-      createWriteStream(targetPath, { flags: "wx" })
+      createWriteStream(targetPath, { flags: "wx" }),
+      { signal: controller.signal }
     );
     if (expectedSha256) {
       const actual = hash.digest("hex");
       if (actual !== expectedSha256) throw new Error(`PostgreSQL runtime archive SHA-256 mismatch: expected ${expectedSha256}, got ${actual}`);
     }
+  } catch (error) {
+    if (controller.signal.aborted) {
+      throw new Error(`PostgreSQL runtime archive download timed out after ${parsedTimeout}ms`, { cause: error });
+    }
+    throw error;
   } finally {
     if (timeout) clearTimeout(timeout);
   }
@@ -7840,10 +7850,45 @@ var init_postgres_runtime_source = __esm({
 
 // src/runtime/install.ts
 import { execFileSync, spawnSync as spawnSync2 } from "node:child_process";
-import { mkdir as mkdir2, mkdtemp, readFile, readdir, realpath, rename, rm, stat as stat3, symlink, writeFile } from "node:fs/promises";
+import { createReadStream as createReadStream2, createWriteStream as createWriteStream2 } from "node:fs";
+import { chmod, mkdir, mkdtemp, readFile, readdir, realpath, rename, rm, stat, symlink, writeFile } from "node:fs/promises";
 import { createRequire } from "node:module";
-import path10 from "node:path";
+import path9 from "node:path";
+import { performance as performance2 } from "node:perf_hooks";
+import { pipeline as pipeline2 } from "node:stream/promises";
 import { pathToFileURL } from "node:url";
+function createRuntimeInstallDeadline(options) {
+  if (options.timeoutMs === void 0) return void 0;
+  if (!Number.isFinite(options.timeoutMs) || options.timeoutMs <= 0) {
+    throw new Error("Runtime installation timeout must be a positive number of milliseconds.");
+  }
+  const now = options.now ?? (() => performance2.now());
+  return { expiresAt: now() + options.timeoutMs, now };
+}
+function remainingRuntimeInstallMs(deadline, cacheDir, command) {
+  if (!deadline) return void 0;
+  const remaining = Math.ceil(deadline.expiresAt - deadline.now());
+  if (remaining <= 0) {
+    throw new RuntimeInstallError(
+      `Timed out while preparing the Rudder runtime during ${command}`,
+      { cacheDir, command }
+    );
+  }
+  return remaining;
+}
+function runtimeInstallDeadlineError(cacheDir, command) {
+  return new RuntimeInstallError(
+    `Timed out while preparing the Rudder runtime during ${command}`,
+    { cacheDir, command }
+  );
+}
+function isRuntimeInstallDeadlineError(error) {
+  return error instanceof RuntimeInstallError && error.message.startsWith("Timed out while preparing the Rudder runtime during ");
+}
+function isChildProcessTimeoutError(error) {
+  const detail = error;
+  return detail?.code === "ETIMEDOUT" || detail?.killed === true || detail?.signal === "SIGTERM";
+}
 function sanitizeRuntimeCacheSegment(value) {
   return encodeURIComponent(value.trim() || "latest").replaceAll("%", "_");
 }
@@ -7852,7 +7897,7 @@ function resolveRuntimePackageVersion(version) {
   return normalized.length > 0 ? normalized : "latest";
 }
 function resolveRuntimeCacheDir(version, homeDir = resolveRudderHomeDir()) {
-  return path10.join(homeDir, "runtimes", sanitizeRuntimeCacheSegment(resolveRuntimePackageVersion(version)));
+  return path9.join(homeDir, "runtimes", sanitizeRuntimeCacheSegment(resolveRuntimePackageVersion(version)));
 }
 function resolveRuntimePackageSpec(version, packageName = RUNTIME_NPM_PACKAGE_NAME) {
   const packageVersion = resolveRuntimePackageVersion(version);
@@ -7860,7 +7905,7 @@ function resolveRuntimePackageSpec(version, packageName = RUNTIME_NPM_PACKAGE_NA
 }
 async function readRuntimeInstallMetadata(cacheDir) {
   try {
-    const raw = await readFile(path10.join(cacheDir, RUNTIME_METADATA_FILE), "utf8");
+    const raw = await readFile(path9.join(cacheDir, RUNTIME_METADATA_FILE), "utf8");
     const parsed = JSON.parse(raw);
     if (parsed.version !== 1) return null;
     if (typeof parsed.packageName !== "string" || typeof parsed.packageVersion !== "string") return null;
@@ -7875,7 +7920,7 @@ async function readRuntimeInstallMetadata(cacheDir) {
   }
 }
 async function writeRuntimeInstallMetadata(cacheDir, metadata) {
-  await writeFile(path10.join(cacheDir, RUNTIME_METADATA_FILE), `${JSON.stringify(metadata, null, 2)}
+  await writeFile(path9.join(cacheDir, RUNTIME_METADATA_FILE), `${JSON.stringify(metadata, null, 2)}
 `, "utf8");
 }
 async function touchRuntimeInstallMetadata(cacheDir, postgresRuntime) {
@@ -7903,27 +7948,28 @@ function resolveEmbeddedPostgresPlatformPackage(platform = process.platform, arc
 }
 async function canResolveRuntimePackage(cacheDir, packageName) {
   try {
-    await readFile(path10.join(cacheDir, "node_modules", ...packageName.split("/"), "package.json"), "utf8");
+    await readFile(path9.join(cacheDir, "node_modules", ...packageName.split("/"), "package.json"), "utf8");
     return true;
   } catch {
     return false;
   }
 }
-async function hasRequiredRuntimePlatformDependencies(cacheDir, metadata, postgresVersionProbe) {
+async function hasRequiredRuntimePlatformDependencies(cacheDir, metadata, postgresVersionProbe, deadline) {
   if (!await canResolveRuntimePackage(cacheDir, EMBEDDED_POSTGRES_PACKAGE_NAME)) return true;
   const platformPackage = resolveEmbeddedPostgresPlatformPackage();
   if (!platformPackage) return true;
   if (await canResolveRuntimePackage(cacheDir, platformPackage)) return true;
   const expectedSharedBinDir = resolveSharedRuntimePostgresPayloadBinDir(
-    path10.dirname(path10.dirname(cacheDir))
+    path9.dirname(path9.dirname(cacheDir))
   );
-  return metadata.postgresRuntime?.scope === "shared" && metadata.postgresRuntime.platform === process.platform && metadata.postgresRuntime.arch === process.arch && path10.resolve(metadata.postgresRuntime.binDir) === path10.resolve(expectedSharedBinDir) && await isRuntimePostgresPayloadUsable(
+  return metadata.postgresRuntime?.scope === "shared" && metadata.postgresRuntime.platform === process.platform && metadata.postgresRuntime.arch === process.arch && path9.resolve(metadata.postgresRuntime.binDir) === path9.resolve(expectedSharedBinDir) && await isRuntimePostgresPayloadUsable(
     cacheDir,
     metadata.postgresRuntime.binDir,
-    postgresVersionProbe
+    postgresVersionProbe,
+    deadline
   );
 }
-async function isRuntimeCacheHit(options) {
+async function isRuntimeCacheHitWithinDeadline(options, deadline) {
   const packageName = options.packageName ?? RUNTIME_NPM_PACKAGE_NAME;
   const packageVersion = resolveRuntimePackageVersion(options.version);
   const metadata = await readRuntimeInstallMetadata(options.cacheDir);
@@ -7931,15 +7977,17 @@ async function isRuntimeCacheHit(options) {
     return false;
   }
   try {
-    const packageJsonPath = path10.join(options.cacheDir, "node_modules", ...packageName.split("/"), "package.json");
+    const packageJsonPath = path9.join(options.cacheDir, "node_modules", ...packageName.split("/"), "package.json");
     const packageJson = JSON.parse(await readFile(packageJsonPath, "utf8"));
     const packageVersionMatches = packageVersion === "latest" || packageJson.version === packageVersion;
     return packageVersionMatches && await hasRequiredRuntimePlatformDependencies(
       options.cacheDir,
       metadata,
-      options.postgresVersionProbe ?? readPostgresVersion
+      options.postgresVersionProbe ?? readPostgresVersion,
+      deadline
     );
-  } catch {
+  } catch (error) {
+    if (isRuntimeInstallDeadlineError(error)) throw error;
     return false;
   }
 }
@@ -7947,15 +7995,45 @@ async function ensureRuntimeInstalled(options) {
   const packageVersion = resolveRuntimePackageVersion(options.version);
   const homeDir = options.homeDir ?? resolveRudderHomeDir();
   const cacheDir = resolveRuntimeCacheDir(packageVersion, homeDir);
+  const deadline = createRuntimeInstallDeadline(options);
   return withRuntimeFilesystemLock(
-    path10.join(homeDir, "runtime-payloads", ".postgres-runtime.lifecycle.lock"),
+    path9.join(homeDir, "runtime-payloads", ".postgres-runtime.lifecycle.lock"),
     async () => withRuntimeFilesystemLock(
       `${cacheDir}.install.lock`,
-      async () => ensureRuntimeInstalledUnlocked(options)
-    )
+      async () => {
+        try {
+          return await ensureRuntimeInstalledUnlocked(options, deadline);
+        } catch (error) {
+          if (options.cleanupIncompleteOnFailure === true) {
+            scheduleIncompleteRuntimeCacheCleanup({
+              cacheDir,
+              packageVersion,
+              remove: options.removeIncompleteCache
+            });
+          }
+          throw error;
+        }
+      },
+      { deadline, cacheDir, command: "acquire target runtime install lock" }
+    ),
+    { deadline, cacheDir, command: "acquire PostgreSQL runtime lifecycle lock" }
   );
 }
-async function ensureRuntimeInstalledUnlocked(options) {
+function scheduleIncompleteRuntimeCacheCleanup(options) {
+  const remove = options.remove ?? ((cacheDir) => rm(cacheDir, { recursive: true, force: true }));
+  void withRuntimeFilesystemLock(
+    `${options.cacheDir}.install.lock`,
+    async () => {
+      const metadata = await readRuntimeInstallMetadata(options.cacheDir);
+      if (!metadata || metadata.packageVersion !== options.packageVersion) {
+        await remove(options.cacheDir);
+      }
+    },
+    { cacheDir: options.cacheDir, command: "cleanup incomplete target runtime cache" }
+  ).catch(() => {
+  });
+}
+async function ensureRuntimeInstalledUnlocked(options, deadline) {
   const packageName = options.packageName ?? RUNTIME_NPM_PACKAGE_NAME;
   const packageVersion = resolveRuntimePackageVersion(options.version);
   const homeDir = options.homeDir ?? resolveRudderHomeDir();
@@ -7963,14 +8041,32 @@ async function ensureRuntimeInstalledUnlocked(options) {
   const packageSpec = resolveRuntimePackageSpec(packageVersion, packageName);
   const command = formatRuntimeInstallCommand(cacheDir, packageSpec);
   const preparePostgresPayload = options.preparePostgresPayload === true;
-  const postgresVersionProbe = options.postgresVersionProbe ?? readPostgresVersion;
-  if (await isRuntimeCacheHit({ cacheDir, version: packageVersion, packageName, postgresVersionProbe })) {
+  const postgresVersionProbe = options.postgresVersionProbe ?? ((binaryPath) => {
+    const probeCommand = `${binaryPath} --version`;
+    try {
+      return readPostgresVersion(
+        binaryPath,
+        remainingRuntimeInstallMs(deadline, cacheDir, probeCommand)
+      );
+    } catch (error) {
+      if (isChildProcessTimeoutError(error)) {
+        throw runtimeInstallDeadlineError(cacheDir, probeCommand);
+      }
+      throw error;
+    }
+  });
+  if (await isRuntimeCacheHitWithinDeadline(
+    { cacheDir, version: packageVersion, packageName, postgresVersionProbe },
+    deadline
+  )) {
     const postgresPayload2 = await stageRuntimePostgresPayload(
       cacheDir,
       homeDir,
       packageVersion,
       preparePostgresPayload,
-      postgresVersionProbe
+      postgresVersionProbe,
+      deadline,
+      options.cleanupPostgresDownloadWorkDir
     );
     await touchRuntimeInstallMetadata(cacheDir, postgresPayload2.metadata);
     const prune2 = await maybePruneRuntimeCache({
@@ -7989,7 +8085,8 @@ async function ensureRuntimeInstalledUnlocked(options) {
     spawnSyncImpl,
     cacheDir,
     packageName,
-    packageVersion
+    packageVersion,
+    deadline
   });
   if (existingRuntimeOutput !== null) {
     const postgresPayload2 = await stageRuntimePostgresPayload(
@@ -7997,7 +8094,9 @@ async function ensureRuntimeInstalledUnlocked(options) {
       homeDir,
       packageVersion,
       preparePostgresPayload,
-      postgresVersionProbe
+      postgresVersionProbe,
+      deadline,
+      options.cleanupPostgresDownloadWorkDir
     );
     const metadata2 = {
       version: 1,
@@ -8020,30 +8119,32 @@ async function ensureRuntimeInstalledUnlocked(options) {
     );
   }
   await rm(cacheDir, { recursive: true, force: true });
-  await mkdir2(cacheDir, { recursive: true });
-  await writeFile(path10.join(cacheDir, "package.json"), `${JSON.stringify(RUNTIME_CACHE_PACKAGE_JSON, null, 2)}
+  await mkdir(cacheDir, { recursive: true });
+  await writeFile(path9.join(cacheDir, "package.json"), `${JSON.stringify(RUNTIME_CACHE_PACKAGE_JSON, null, 2)}
 `, "utf8");
-  const result = runNpmRuntimeInstall(spawnSyncImpl, cacheDir, packageSpec);
+  const result = runNpmRuntimeInstall(spawnSyncImpl, cacheDir, packageSpec, deadline);
   let output = collectSpawnOutput(result);
-  if (result.status !== 0 && packageVersion !== "latest" && isVersionNotFoundError(output)) {
+  if (result.status !== 0 && packageVersion !== "latest" && options.allowLatestFallback !== false && isVersionNotFoundError(output)) {
     const fallbackVersion = "latest";
     const fallbackCacheDir = resolveRuntimeCacheDir(fallbackVersion, options.homeDir);
     const fallbackSpec = resolveRuntimePackageSpec(fallbackVersion, packageName);
     const fallbackInstallResult = await withRuntimeFilesystemLock(
       `${fallbackCacheDir}.install.lock`,
       async () => {
-        if (await isRuntimeCacheHit({
+        if (await isRuntimeCacheHitWithinDeadline({
           cacheDir: fallbackCacheDir,
           version: fallbackVersion,
           packageName,
           postgresVersionProbe
-        })) {
+        }, deadline)) {
           const fallbackPostgresPayload = await stageRuntimePostgresPayload(
             fallbackCacheDir,
             homeDir,
             fallbackVersion,
             preparePostgresPayload,
-            postgresVersionProbe
+            postgresVersionProbe,
+            deadline,
+            options.cleanupPostgresDownloadWorkDir
           );
           await touchRuntimeInstallMetadata(fallbackCacheDir, fallbackPostgresPayload.metadata);
           return withPostgresPayload(
@@ -8058,22 +8159,24 @@ async function ensureRuntimeInstalledUnlocked(options) {
           );
         }
         await rm(fallbackCacheDir, { recursive: true, force: true });
-        await mkdir2(fallbackCacheDir, { recursive: true });
-        await writeFile(path10.join(fallbackCacheDir, "package.json"), `${JSON.stringify(RUNTIME_CACHE_PACKAGE_JSON, null, 2)}
+        await mkdir(fallbackCacheDir, { recursive: true });
+        await writeFile(path9.join(fallbackCacheDir, "package.json"), `${JSON.stringify(RUNTIME_CACHE_PACKAGE_JSON, null, 2)}
 `, "utf8");
-        const fallbackResult = runNpmRuntimeInstall(spawnSyncImpl, fallbackCacheDir, fallbackSpec);
+        const fallbackResult = runNpmRuntimeInstall(spawnSyncImpl, fallbackCacheDir, fallbackSpec, deadline);
         let fallbackOutput = collectSpawnOutput(fallbackResult);
         if (fallbackResult.status !== 0) return null;
         fallbackOutput = collectOutputParts(
           fallbackOutput,
-          await ensureRequiredEmbeddedPostgresPlatformPackage(spawnSyncImpl, fallbackCacheDir)
+          await ensureRequiredEmbeddedPostgresPlatformPackage(spawnSyncImpl, fallbackCacheDir, deadline)
         );
         const postgresPayload2 = await stageRuntimePostgresPayload(
           fallbackCacheDir,
           homeDir,
           fallbackVersion,
           preparePostgresPayload,
-          postgresVersionProbe
+          postgresVersionProbe,
+          deadline,
+          options.cleanupPostgresDownloadWorkDir
         );
         const fallbackMetadata = {
           version: 1,
@@ -8094,7 +8197,8 @@ async function ensureRuntimeInstalledUnlocked(options) {
           },
           postgresPayload2
         );
-      }
+      },
+      { deadline, cacheDir: fallbackCacheDir, command: "acquire fallback runtime install lock" }
     );
     if (fallbackInstallResult) return fallbackInstallResult;
   }
@@ -8106,14 +8210,16 @@ async function ensureRuntimeInstalledUnlocked(options) {
   }
   output = collectOutputParts(
     output,
-    await ensureRequiredEmbeddedPostgresPlatformPackage(spawnSyncImpl, cacheDir)
+    await ensureRequiredEmbeddedPostgresPlatformPackage(spawnSyncImpl, cacheDir, deadline)
   );
   const postgresPayload = await stageRuntimePostgresPayload(
     cacheDir,
     homeDir,
     packageVersion,
     preparePostgresPayload,
-    postgresVersionProbe
+    postgresVersionProbe,
+    deadline,
+    options.cleanupPostgresDownloadWorkDir
   );
   const metadata = {
     version: 1,
@@ -8136,10 +8242,10 @@ async function ensureRuntimeInstalledUnlocked(options) {
   );
 }
 function resolveRuntimePostgresPayloadBinDir(cacheDir, platform = process.platform, arch = process.arch) {
-  return path10.join(cacheDir, RUNTIME_POSTGRES_PAYLOAD_DIR, runtimePostgresPlatformSegment(platform, arch), "bin");
+  return path9.join(cacheDir, RUNTIME_POSTGRES_PAYLOAD_DIR, runtimePostgresPlatformSegment(platform, arch), "bin");
 }
 function resolveSharedRuntimePostgresPayloadBinDir(homeDir = resolveRudderHomeDir(), platform = process.platform, arch = process.arch) {
-  return path10.join(
+  return path9.join(
     homeDir,
     "runtime-payloads",
     RUNTIME_POSTGRES_PAYLOAD_DIR,
@@ -8148,19 +8254,21 @@ function resolveSharedRuntimePostgresPayloadBinDir(homeDir = resolveRudderHomeDi
   );
 }
 function resolveRuntimeServerEntrypoint(cacheDir, packageName = RUNTIME_NPM_PACKAGE_NAME) {
-  return createRequire(path10.join(cacheDir, "package.json")).resolve(packageName);
+  return createRequire(path9.join(cacheDir, "package.json")).resolve(packageName);
 }
 async function importRuntimeServerModule(cacheDir, packageName = RUNTIME_NPM_PACKAGE_NAME) {
   const entrypoint = resolveRuntimeServerEntrypoint(cacheDir, packageName);
   return await import(pathToFileURL(entrypoint).href);
 }
-function runNpmRuntimeInstall(spawnSyncImpl, cacheDir, packageSpec) {
+function runNpmRuntimeInstall(spawnSyncImpl, cacheDir, packageSpec, deadline) {
+  const timeout = remainingRuntimeInstallMs(deadline, cacheDir, `npm install ${packageSpec}`);
   return spawnSyncImpl(
     process.platform === "win32" ? "npm.cmd" : "npm",
     ["install", "--prefix", cacheDir, ...RUNTIME_NPM_INSTALL_FLAGS, packageSpec],
     {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"],
+      ...timeout === void 0 ? {} : { timeout },
       ...process.platform === "win32" ? { shell: true, windowsHide: true } : {}
     }
   );
@@ -8169,7 +8277,7 @@ function formatRuntimeInstallCommand(cacheDir, packageSpec) {
   return `npm install --prefix ${cacheDir} ${RUNTIME_NPM_INSTALL_FLAGS.join(" ")} ${packageSpec}`;
 }
 function formatRuntimePlatformRepairCommand(cacheDir, packageSpec) {
-  return `npm pack ${packageSpec} --registry=${NPM_PUBLIC_REGISTRY_URL} --silent, then extract it into ${path10.join(cacheDir, "node_modules")}`;
+  return `npm pack ${packageSpec} --registry=${NPM_PUBLIC_REGISTRY_URL} --silent, then extract it into ${path9.join(cacheDir, "node_modules")}`;
 }
 function collectSpawnOutput(result) {
   return [result.stdout, result.stderr, result.error instanceof Error ? result.error.message : null].filter((value) => typeof value === "string" && value.trim().length > 0).join("\n").trim();
@@ -8186,7 +8294,7 @@ function withPostgresPayload(result, postgresPayload) {
   };
 }
 function runtimePackageJsonPath(cacheDir, packageName) {
-  return path10.join(cacheDir, "node_modules", ...packageName.split("/"), "package.json");
+  return path9.join(cacheDir, "node_modules", ...packageName.split("/"), "package.json");
 }
 async function readRuntimePackageJson(cacheDir, packageName) {
   try {
@@ -8199,7 +8307,11 @@ async function tryRepairExistingRuntimePackage(options) {
   const runtimePackage = await readRuntimePackageJson(options.cacheDir, options.packageName);
   if (!runtimePackage) return null;
   if (options.packageVersion !== "latest" && runtimePackage.version !== options.packageVersion) return null;
-  const output = await ensureRequiredEmbeddedPostgresPlatformPackage(options.spawnSyncImpl, options.cacheDir);
+  const output = await ensureRequiredEmbeddedPostgresPlatformPackage(
+    options.spawnSyncImpl,
+    options.cacheDir,
+    options.deadline
+  );
   if (!await canResolveRuntimePackage(options.cacheDir, EMBEDDED_POSTGRES_PACKAGE_NAME)) return output;
   const platformPackage = resolveEmbeddedPostgresPlatformPackage();
   return !platformPackage || await canResolveRuntimePackage(options.cacheDir, platformPackage) ? output : null;
@@ -8213,13 +8325,19 @@ async function resolveEmbeddedPostgresPlatformPackageSpec(cacheDir) {
   const packageVersion = normalizeOptionalDependencyVersion(versionRange);
   return packageVersion ? `${packageName}@${packageVersion}` : packageName;
 }
-async function ensureRequiredEmbeddedPostgresPlatformPackage(spawnSyncImpl, cacheDir) {
+async function ensureRequiredEmbeddedPostgresPlatformPackage(spawnSyncImpl, cacheDir, deadline) {
   const packageSpec = await resolveEmbeddedPostgresPlatformPackageSpec(cacheDir);
   if (!packageSpec) return "";
   const packageName = packageNameFromSpec(packageSpec);
   if (packageName && await canResolveRuntimePackage(cacheDir, packageName)) return "";
   await removeRuntimeInstallLocks(cacheDir);
-  const result = await installRuntimePackageInStaging(spawnSyncImpl, cacheDir, packageSpec, packageName);
+  const result = await installRuntimePackageInStaging(
+    spawnSyncImpl,
+    cacheDir,
+    packageSpec,
+    packageName,
+    deadline
+  );
   const output = collectSpawnOutput(result);
   if (result.status === 0 && packageName && await canResolveRuntimePackage(cacheDir, packageName)) {
     return output;
@@ -8230,28 +8348,29 @@ async function ensureRequiredEmbeddedPostgresPlatformPackage(spawnSyncImpl, cach
     { cacheDir, command, output }
   );
 }
-async function installRuntimePackageInStaging(spawnSyncImpl, cacheDir, packageSpec, packageName) {
-  const stagingDir = path10.join(cacheDir, `.platform-repair-${process.pid}-${Date.now()}`);
-  await mkdir2(stagingDir, { recursive: true });
+async function installRuntimePackageInStaging(spawnSyncImpl, cacheDir, packageSpec, packageName, deadline) {
+  const stagingDir = path9.join(cacheDir, `.platform-repair-${process.pid}-${Date.now()}`);
+  await mkdir(stagingDir, { recursive: true });
   try {
-    const packResult = runNpmPack(spawnSyncImpl, packageSpec, stagingDir);
+    const packResult = runNpmPack(spawnSyncImpl, packageSpec, stagingDir, cacheDir, deadline);
     if (packResult.status !== 0) return packResult;
     const packFilename = parseNpmPackFilename(packResult.stdout);
     if (!packFilename) {
       return createSyntheticSpawnResult(1, "", `Unable to parse npm pack output for ${packageSpec}.`);
     }
-    const archivePath = path10.join(stagingDir, packFilename);
-    const targetDir = path10.dirname(runtimePackageJsonPath(cacheDir, packageName));
-    await mkdir2(path10.dirname(targetDir), { recursive: true });
+    const archivePath = path9.join(stagingDir, packFilename);
+    const targetDir = path9.dirname(runtimePackageJsonPath(cacheDir, packageName));
+    await mkdir(path9.dirname(targetDir), { recursive: true });
     await rm(targetDir, { recursive: true, force: true });
-    await mkdir2(targetDir, { recursive: true });
-    const extractResult = runTarExtract(spawnSyncImpl, archivePath, targetDir);
+    await mkdir(targetDir, { recursive: true });
+    const extractResult = runTarExtract(spawnSyncImpl, archivePath, targetDir, cacheDir, deadline);
     return combineSpawnResults(packResult, extractResult);
   } finally {
     await rm(stagingDir, { recursive: true, force: true });
   }
 }
-function runNpmPack(spawnSyncImpl, packageSpec, destinationDir) {
+function runNpmPack(spawnSyncImpl, packageSpec, destinationDir, cacheDir, deadline) {
+  const timeout = remainingRuntimeInstallMs(deadline, cacheDir, `npm pack ${packageSpec}`);
   return spawnSyncImpl(
     process.platform === "win32" ? "npm.cmd" : "npm",
     ["pack", packageSpec, "--pack-destination", destinationDir, ...RUNTIME_NPM_PACK_FLAGS],
@@ -8259,17 +8378,20 @@ function runNpmPack(spawnSyncImpl, packageSpec, destinationDir) {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"],
       env: { ...process.env, ...NPM_PLATFORM_REPAIR_ENV },
+      ...timeout === void 0 ? {} : { timeout },
       ...process.platform === "win32" ? { shell: true, windowsHide: true } : {}
     }
   );
 }
-function runTarExtract(spawnSyncImpl, archivePath, targetDir) {
+function runTarExtract(spawnSyncImpl, archivePath, targetDir, cacheDir, deadline) {
+  const timeout = remainingRuntimeInstallMs(deadline, cacheDir, "extract runtime platform package");
   return spawnSyncImpl(
     "tar",
     ["-xzf", archivePath, "-C", targetDir, "--strip-components", "1"],
     {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"],
+      ...timeout === void 0 ? {} : { timeout },
       ...process.platform === "win32" ? { windowsHide: true } : {}
     }
   );
@@ -8293,8 +8415,8 @@ function combineSpawnResults(...results) {
 }
 async function removeRuntimeInstallLocks(cacheDir) {
   await Promise.all([
-    rm(path10.join(cacheDir, "package-lock.json"), { force: true }),
-    rm(path10.join(cacheDir, "node_modules", ".package-lock.json"), { force: true })
+    rm(path9.join(cacheDir, "package-lock.json"), { force: true }),
+    rm(path9.join(cacheDir, "node_modules", ".package-lock.json"), { force: true })
   ]);
 }
 function packageNameFromSpec(packageSpec) {
@@ -8318,77 +8440,95 @@ function runtimePostgresExecutableName(baseName) {
   return process.platform === "win32" ? `${baseName}.exe` : baseName;
 }
 function debianSharedirCandidate(binDir) {
-  const normalized = path10.resolve(binDir);
-  const parts = normalized.split(path10.sep);
+  const normalized = path9.resolve(binDir);
+  const parts = normalized.split(path9.sep);
   const libIndex = parts.lastIndexOf("lib");
   if (libIndex < 0) return null;
   if (parts[libIndex + 1] !== "postgresql") return null;
   const version = parts[libIndex + 2];
   if (!version || parts[libIndex + 3] !== "bin") return null;
-  const prefix = parts.slice(0, libIndex).join(path10.sep) || path10.sep;
-  return path10.join(prefix, "share", "postgresql", version);
+  const prefix = parts.slice(0, libIndex).join(path9.sep) || path9.sep;
+  return path9.join(prefix, "share", "postgresql", version);
 }
-async function resolveRuntimePostgresTemplateDir(binDir) {
+async function resolveRuntimePostgresTemplateDir(binDir, cacheDir = binDir, deadline) {
   for (const candidatePath of [
-    path10.join(binDir, "..", "share", "postgresql", "postgres.bki"),
-    path10.join(binDir, "..", "share", "postgres.bki")
+    path9.join(binDir, "..", "share", "postgresql", "postgres.bki"),
+    path9.join(binDir, "..", "share", "postgres.bki")
   ]) {
+    remainingRuntimeInstallMs(deadline, cacheDir, "discover PostgreSQL runtime templates");
     try {
-      await stat3(candidatePath);
-      return path10.dirname(candidatePath);
+      await stat(candidatePath);
+      return path9.dirname(candidatePath);
     } catch {
     }
   }
   const debianSharedir = debianSharedirCandidate(binDir);
   if (debianSharedir) {
+    remainingRuntimeInstallMs(deadline, cacheDir, "discover PostgreSQL runtime templates");
     try {
-      await stat3(path10.join(debianSharedir, "postgres.bki"));
+      await stat(path9.join(debianSharedir, "postgres.bki"));
       return debianSharedir;
     } catch {
     }
   }
-  const pgConfigPath = path10.join(binDir, process.platform === "win32" ? "pg_config.exe" : "pg_config");
+  const pgConfigPath = path9.join(binDir, process.platform === "win32" ? "pg_config.exe" : "pg_config");
   try {
-    await stat3(pgConfigPath);
-    const sharedir = execFileSync(pgConfigPath, ["--sharedir"], { encoding: "utf8" }).trim();
+    remainingRuntimeInstallMs(deadline, cacheDir, "discover PostgreSQL runtime templates");
+    await stat(pgConfigPath);
+    const timeout = remainingRuntimeInstallMs(deadline, cacheDir, `${pgConfigPath} --sharedir`);
+    let sharedir;
+    try {
+      sharedir = execFileSync(pgConfigPath, ["--sharedir"], {
+        encoding: "utf8",
+        ...timeout === void 0 ? {} : { timeout }
+      }).trim();
+    } catch (error) {
+      if (isChildProcessTimeoutError(error)) {
+        throw runtimeInstallDeadlineError(cacheDir, `${pgConfigPath} --sharedir`);
+      }
+      throw error;
+    }
     if (!sharedir) return null;
-    const candidatePath = path10.join(sharedir, "postgres.bki");
-    await stat3(candidatePath);
+    remainingRuntimeInstallMs(deadline, cacheDir, "validate PostgreSQL runtime templates");
+    const candidatePath = path9.join(sharedir, "postgres.bki");
+    await stat(candidatePath);
     return sharedir;
-  } catch {
+  } catch (error) {
+    if (isRuntimeInstallDeadlineError(error)) throw error;
     return null;
   }
 }
 function resolveRuntimePostgresShareDir(binDir, templateDir) {
-  const adjacentShareDir = path10.resolve(binDir, "..", "share");
+  const adjacentShareDir = path9.resolve(binDir, "..", "share");
   return pathIsInside(templateDir, adjacentShareDir) ? adjacentShareDir : templateDir;
 }
-async function assertRuntimePostgresBinDirComplete(cacheDir, binDir) {
+async function assertRuntimePostgresBinDirComplete(cacheDir, binDir, deadline) {
   const requiredBinaries = ["initdb", "pg_ctl", "postgres"];
   const missing = [];
   for (const binary of requiredBinaries) {
-    const binaryPath = path10.join(binDir, runtimePostgresExecutableName(binary));
+    remainingRuntimeInstallMs(deadline, cacheDir, "validate PostgreSQL runtime binaries");
+    const binaryPath = path9.join(binDir, runtimePostgresExecutableName(binary));
     try {
-      await stat3(binaryPath);
+      await stat(binaryPath);
     } catch {
       missing.push(binaryPath);
     }
   }
-  const templateDir = await resolveRuntimePostgresTemplateDir(binDir);
+  const templateDir = await resolveRuntimePostgresTemplateDir(binDir, cacheDir, deadline);
   if (!templateDir) {
-    missing.push(path10.join(binDir, "..", "share", "postgresql", "postgres.bki"));
+    missing.push(path9.join(binDir, "..", "share", "postgresql", "postgres.bki"));
   } else {
     try {
-      await stat3(path10.join(templateDir, "postgresql.conf.sample"));
+      await stat(path9.join(templateDir, "postgresql.conf.sample"));
     } catch {
-      missing.push(path10.join(templateDir, "postgresql.conf.sample"));
+      missing.push(path9.join(templateDir, "postgresql.conf.sample"));
     }
     const shareDir = resolveRuntimePostgresShareDir(binDir, templateDir);
     const hasTimezoneDir = (await Promise.all([
-      path10.join(templateDir, "timezone"),
-      path10.join(shareDir, "timezone")
-    ].map((candidate) => stat3(candidate).catch(() => null)))).some((candidate) => candidate?.isDirectory());
-    if (!hasTimezoneDir) missing.push(path10.join(shareDir, "timezone"));
+      path9.join(templateDir, "timezone"),
+      path9.join(shareDir, "timezone")
+    ].map((candidate) => stat(candidate).catch(() => null)))).some((candidate) => candidate?.isDirectory());
+    if (!hasTimezoneDir) missing.push(path9.join(shareDir, "timezone"));
   }
   if (missing.length > 0) {
     throw new RuntimeInstallError(
@@ -8397,31 +8537,124 @@ async function assertRuntimePostgresBinDirComplete(cacheDir, binDir) {
     );
   }
 }
-function readPostgresVersion(postgresBinary) {
-  return execFileSync(postgresBinary, ["--version"], { encoding: "utf8" });
+function readPostgresVersion(postgresBinary, timeout) {
+  return execFileSync(postgresBinary, ["--version"], {
+    encoding: "utf8",
+    ...timeout === void 0 ? {} : { timeout }
+  });
 }
-async function isRuntimePostgresPayloadUsable(cacheDir, binDir, postgresVersionProbe) {
+async function isRuntimePostgresPayloadUsable(cacheDir, binDir, postgresVersionProbe, deadline) {
   try {
-    await validateRuntimePostgresVersion(cacheDir, binDir, postgresVersionProbe);
+    await validateRuntimePostgresVersion(cacheDir, binDir, postgresVersionProbe, deadline);
     return true;
-  } catch {
+  } catch (error) {
+    if (isRuntimeInstallDeadlineError(error)) throw error;
     return false;
   }
 }
 function pathIsInside(candidatePath, rootPath) {
-  const relative = path10.relative(path10.resolve(rootPath), path10.resolve(candidatePath));
-  return relative === "" || relative !== ".." && !relative.startsWith(`..${path10.sep}`) && !path10.isAbsolute(relative);
+  const relative = path9.relative(path9.resolve(rootPath), path9.resolve(candidatePath));
+  return relative === "" || relative !== ".." && !relative.startsWith(`..${path9.sep}`) && !path9.isAbsolute(relative);
+}
+async function copyRuntimePayloadEntry(sourcePath, targetPath, cacheDir, deadline, signal, command) {
+  if (signal.aborted) throw runtimeInstallDeadlineError(cacheDir, command);
+  remainingRuntimeInstallMs(deadline, cacheDir, command);
+  const sourceStats = await stat(sourcePath);
+  if (signal.aborted) throw runtimeInstallDeadlineError(cacheDir, command);
+  remainingRuntimeInstallMs(deadline, cacheDir, command);
+  if (sourceStats.isDirectory()) {
+    await mkdir(targetPath, { recursive: true });
+    const entries = await readdir(sourcePath);
+    for (const entry of entries) {
+      await copyRuntimePayloadEntry(
+        path9.join(sourcePath, entry),
+        path9.join(targetPath, entry),
+        cacheDir,
+        deadline,
+        signal,
+        command
+      );
+    }
+    return;
+  }
+  if (!sourceStats.isFile()) return;
+  await mkdir(path9.dirname(targetPath), { recursive: true });
+  try {
+    await pipeline2(
+      createReadStream2(sourcePath),
+      createWriteStream2(targetPath, { flags: "w", mode: sourceStats.mode }),
+      { signal }
+    );
+    await chmod(targetPath, sourceStats.mode);
+    remainingRuntimeInstallMs(deadline, cacheDir, command);
+  } catch (error) {
+    await rm(targetPath, { force: true });
+    if (signal.aborted || isRuntimeInstallDeadlineError(error)) {
+      throw runtimeInstallDeadlineError(cacheDir, command);
+    }
+    throw error;
+  }
+}
+async function copyRuntimePostgresPayloadWithinDeadline(sourceRuntimeDir, targetRuntimeDir, sourceShareDir, cacheDir, deadline, externalSignal) {
+  const command = "copy PostgreSQL runtime payload";
+  const timeoutMs = remainingRuntimeInstallMs(deadline, cacheDir, command);
+  const controller = new AbortController();
+  const abortFromExternal = () => controller.abort(externalSignal?.reason);
+  if (externalSignal?.aborted) abortFromExternal();
+  else externalSignal?.addEventListener("abort", abortFromExternal, { once: true });
+  let timer;
+  const timeoutPromise = timeoutMs === void 0 ? null : new Promise((_resolve, reject) => {
+    timer = setTimeout(() => {
+      controller.abort();
+      reject(runtimeInstallDeadlineError(cacheDir, command));
+    }, timeoutMs);
+  });
+  const copyPromise = (async () => {
+    await mkdir(targetRuntimeDir, { recursive: true });
+    for (const directoryName of ["bin", "lib"]) {
+      const sourceDirectory = path9.join(sourceRuntimeDir, directoryName);
+      if (!await stat(sourceDirectory).catch(() => null)) continue;
+      await copyRuntimePayloadEntry(
+        sourceDirectory,
+        path9.join(targetRuntimeDir, directoryName),
+        cacheDir,
+        deadline,
+        controller.signal,
+        command
+      );
+    }
+    await copyRuntimePayloadEntry(
+      sourceShareDir,
+      path9.join(targetRuntimeDir, "share"),
+      cacheDir,
+      deadline,
+      controller.signal,
+      command
+    );
+  })();
+  try {
+    if (timeoutPromise) await Promise.race([copyPromise, timeoutPromise]);
+    else await copyPromise;
+  } finally {
+    if (timer) clearTimeout(timer);
+    externalSignal?.removeEventListener("abort", abortFromExternal);
+  }
 }
 async function withRuntimeFilesystemLock(lockPath, task, options = {}) {
-  const timeoutMs = options.timeoutMs ?? 3e4;
+  const deadlineTimeout = remainingRuntimeInstallMs(
+    options.deadline,
+    options.cacheDir ?? path9.dirname(lockPath),
+    options.command ?? `wait for runtime lock ${lockPath}`
+  );
+  const timeoutMs = Math.min(options.timeoutMs ?? 3e4, deadlineTimeout ?? Number.POSITIVE_INFINITY);
   const pollMs = options.pollMs ?? 50;
   const startedAt = Date.now();
   const lockId = `${process.pid}-${startedAt}-${Math.random().toString(16).slice(2)}`;
-  const ownerPath = path10.join(lockPath, "owner.json");
-  await mkdir2(path10.dirname(lockPath), { recursive: true });
+  const ownerPath = path9.join(lockPath, "owner.json");
+  await mkdir(path9.dirname(lockPath), { recursive: true });
   while (true) {
     try {
-      await mkdir2(lockPath);
+      await mkdir(lockPath);
       await writeFile(
         ownerPath,
         `${JSON.stringify({ pid: process.pid, lockId, createdAt: (/* @__PURE__ */ new Date()).toISOString() })}
@@ -8438,7 +8671,7 @@ async function withRuntimeFilesystemLock(lockPath, task, options = {}) {
           continue;
         }
       } catch {
-        const lockStats = await stat3(lockPath).catch(() => null);
+        const lockStats = await stat(lockPath).catch(() => null);
         if (lockStats && Date.now() - lockStats.mtimeMs > 5e3) {
           await rm(lockPath, { recursive: true, force: true });
           continue;
@@ -8447,9 +8680,14 @@ async function withRuntimeFilesystemLock(lockPath, task, options = {}) {
       if (Date.now() - startedAt >= timeoutMs) {
         throw new RuntimeInstallError(
           `Timed out waiting for PostgreSQL runtime install lock ${lockPath}`,
-          { cacheDir: path10.dirname(lockPath), command: "prepare shared PostgreSQL runtime", output: "" }
+          { cacheDir: path9.dirname(lockPath), command: "prepare shared PostgreSQL runtime", output: "" }
         );
       }
+      remainingRuntimeInstallMs(
+        options.deadline,
+        options.cacheDir ?? path9.dirname(lockPath),
+        options.command ?? `wait for runtime lock ${lockPath}`
+      );
       await new Promise((resolve) => setTimeout(resolve, pollMs));
     }
   }
@@ -8467,44 +8705,45 @@ async function withRuntimeFilesystemLock(lockPath, task, options = {}) {
 }
 function isManagedRuntimePostgresBinDir(binDir, homeDir) {
   const managedBinDir = process.env[RUDDER_DESKTOP_MANAGED_POSTGRES_BIN_DIR_ENV]?.trim();
-  if (managedBinDir && path10.resolve(managedBinDir) === path10.resolve(binDir)) return true;
-  const runtimesRelative = path10.relative(
-    path10.join(homeDir, "runtimes"),
-    path10.resolve(binDir)
+  if (managedBinDir && path9.resolve(managedBinDir) === path9.resolve(binDir)) return true;
+  const runtimesRelative = path9.relative(
+    path9.join(homeDir, "runtimes"),
+    path9.resolve(binDir)
   );
-  const runtimeSegments = runtimesRelative.split(path10.sep);
-  if (runtimesRelative !== "" && runtimesRelative !== ".." && !runtimesRelative.startsWith(`..${path10.sep}`) && !path10.isAbsolute(runtimesRelative) && runtimeSegments.length === 4 && runtimeSegments[0]?.length > 0 && runtimeSegments[1] === RUNTIME_POSTGRES_PAYLOAD_DIR && runtimeSegments[2] === `${process.platform}-${process.arch}` && runtimeSegments[3] === "bin") {
+  const runtimeSegments = runtimesRelative.split(path9.sep);
+  if (runtimesRelative !== "" && runtimesRelative !== ".." && !runtimesRelative.startsWith(`..${path9.sep}`) && !path9.isAbsolute(runtimesRelative) && runtimeSegments.length === 4 && runtimeSegments[0]?.length > 0 && runtimeSegments[1] === RUNTIME_POSTGRES_PAYLOAD_DIR && runtimeSegments[2] === `${process.platform}-${process.arch}` && runtimeSegments[3] === "bin") {
     return true;
   }
-  const payloadsRelative = path10.relative(
-    path10.join(homeDir, "runtime-payloads"),
-    path10.resolve(binDir)
+  const payloadsRelative = path9.relative(
+    path9.join(homeDir, "runtime-payloads"),
+    path9.resolve(binDir)
   );
-  const payloadSegments = payloadsRelative.split(path10.sep);
-  return payloadsRelative !== "" && payloadsRelative !== ".." && !payloadsRelative.startsWith(`..${path10.sep}`) && !path10.isAbsolute(payloadsRelative) && payloadSegments.length === 3 && payloadSegments[0] === RUNTIME_POSTGRES_PAYLOAD_DIR && payloadSegments[1] === `${process.platform}-${process.arch}` && payloadSegments[2] === "bin";
+  const payloadSegments = payloadsRelative.split(path9.sep);
+  return payloadsRelative !== "" && payloadsRelative !== ".." && !payloadsRelative.startsWith(`..${path9.sep}`) && !path9.isAbsolute(payloadsRelative) && payloadSegments.length === 3 && payloadSegments[0] === RUNTIME_POSTGRES_PAYLOAD_DIR && payloadSegments[1] === `${process.platform}-${process.arch}` && payloadSegments[2] === "bin";
 }
-async function findLegacyRuntimePostgresBinDir(cacheDir, homeDir, postgresVersionProbe) {
-  const runtimesRoot = path10.join(homeDir, "runtimes");
+async function findLegacyRuntimePostgresBinDir(cacheDir, homeDir, postgresVersionProbe, deadline) {
+  const runtimesRoot = path9.join(homeDir, "runtimes");
   const entries = await readdir(runtimesRoot, { withFileTypes: true }).catch(() => []);
   for (const entry of entries) {
     if (!entry.isDirectory() && !entry.isSymbolicLink()) continue;
-    const candidateCacheDir = path10.join(runtimesRoot, entry.name);
-    if (path10.resolve(candidateCacheDir) === path10.resolve(cacheDir)) continue;
+    const candidateCacheDir = path9.join(runtimesRoot, entry.name);
+    if (path9.resolve(candidateCacheDir) === path9.resolve(cacheDir)) continue;
     const candidateBinDir = resolveRuntimePostgresPayloadBinDir(candidateCacheDir);
-    if (await isRuntimePostgresPayloadUsable(cacheDir, candidateBinDir, postgresVersionProbe)) {
+    remainingRuntimeInstallMs(deadline, cacheDir, "find cached PostgreSQL runtime payload");
+    if (await isRuntimePostgresPayloadUsable(cacheDir, candidateBinDir, postgresVersionProbe, deadline)) {
       return candidateBinDir;
     }
   }
   return null;
 }
 async function readLiveRuntimeDescriptors(homeDir) {
-  const instancesRoot = path10.join(homeDir, "instances");
+  const instancesRoot = path9.join(homeDir, "instances");
   const entries = await readdir(instancesRoot, { withFileTypes: true }).catch(() => []);
   const descriptors = [];
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
     try {
-      const raw = JSON.parse(await readFile(path10.join(instancesRoot, entry.name, "runtime", "server.json"), "utf8"));
+      const raw = JSON.parse(await readFile(path9.join(instancesRoot, entry.name, "runtime", "server.json"), "utf8"));
       if (typeof raw.pid !== "number" || !Number.isInteger(raw.pid) || !isPidRunning(raw.pid) || typeof raw.version !== "string") {
         continue;
       }
@@ -8522,13 +8761,13 @@ async function assertSharedPostgresPayloadNotLive(cacheDir, homeDir, sharedBinDi
   const sharedPhysicalBinDir = await realpath(sharedBinDir).catch(() => null);
   const mayReferenceSharedPayload = await Promise.all(liveDescriptors.map(async (descriptor) => {
     if (descriptor.postgresBinDir === void 0) return true;
-    if (path10.resolve(descriptor.postgresBinDir) === path10.resolve(sharedBinDir)) return true;
+    if (path9.resolve(descriptor.postgresBinDir) === path9.resolve(sharedBinDir)) return true;
     const descriptorPhysicalBinDir = await realpath(descriptor.postgresBinDir).catch(() => null);
-    if (descriptorPhysicalBinDir && sharedPhysicalBinDir && path10.resolve(descriptorPhysicalBinDir) === path10.resolve(sharedPhysicalBinDir)) {
+    if (descriptorPhysicalBinDir && sharedPhysicalBinDir && path9.resolve(descriptorPhysicalBinDir) === path9.resolve(sharedPhysicalBinDir)) {
       return true;
     }
     if (!descriptorPhysicalBinDir) {
-      return pathIsInside(descriptor.postgresBinDir, path10.join(homeDir, "runtimes")) || pathIsInside(descriptor.postgresBinDir, path10.join(homeDir, "runtime-payloads"));
+      return pathIsInside(descriptor.postgresBinDir, path9.join(homeDir, "runtimes")) || pathIsInside(descriptor.postgresBinDir, path9.join(homeDir, "runtime-payloads"));
     }
     return false;
   }));
@@ -8539,10 +8778,11 @@ async function assertSharedPostgresPayloadNotLive(cacheDir, homeDir, sharedBinDi
     );
   }
 }
-async function validateRuntimePostgresVersion(cacheDir, binDir, postgresVersionProbe) {
-  await assertRuntimePostgresBinDirComplete(cacheDir, binDir);
+async function validateRuntimePostgresVersion(cacheDir, binDir, postgresVersionProbe, deadline) {
+  await assertRuntimePostgresBinDirComplete(cacheDir, binDir, deadline);
   for (const binary of ["initdb", "pg_ctl", "postgres"]) {
-    const binaryPath = path10.join(binDir, runtimePostgresExecutableName(binary));
+    remainingRuntimeInstallMs(deadline, cacheDir, "validate PostgreSQL runtime version");
+    const binaryPath = path9.join(binDir, runtimePostgresExecutableName(binary));
     const result = postgresVersionProbe(binaryPath);
     if (!/\bPostgreSQL\)?\s+18\.4\b/i.test(result)) {
       throw new RuntimeInstallError(
@@ -8552,7 +8792,8 @@ async function validateRuntimePostgresVersion(cacheDir, binDir, postgresVersionP
     }
   }
 }
-function extractRuntimePostgresArchive(archivePath, extractDir) {
+function extractRuntimePostgresArchive(archivePath, extractDir, cacheDir, deadline) {
+  const timeout = remainingRuntimeInstallMs(deadline, cacheDir, "extract PostgreSQL runtime archive");
   const result = process.platform === "win32" ? spawnSync2("powershell.exe", [
     "-NoProfile",
     "-NonInteractive",
@@ -8563,46 +8804,54 @@ function extractRuntimePostgresArchive(archivePath, extractDir) {
   ], {
     encoding: "utf8",
     env: { ...process.env, PG_ARCHIVE_PATH: archivePath, PG_EXTRACT_DIR: extractDir },
-    windowsHide: true
-  }) : spawnSync2("tar", ["-xf", archivePath, "-C", extractDir], { encoding: "utf8" });
+    windowsHide: true,
+    ...timeout === void 0 ? {} : { timeout }
+  }) : spawnSync2("tar", ["-xf", archivePath, "-C", extractDir], {
+    encoding: "utf8",
+    ...timeout === void 0 ? {} : { timeout }
+  });
   if (result.status !== 0) {
     throw new Error(`failed to extract PostgreSQL archive: ${result.stderr || result.stdout}`);
   }
 }
-async function findRuntimePostgresBinDir(rootDir, cacheDir, postgresVersionProbe) {
+async function findRuntimePostgresBinDir(rootDir, cacheDir, postgresVersionProbe, deadline) {
   const queue = [rootDir];
   for (let index = 0; index < queue.length; index += 1) {
     const current = queue[index];
-    if (await isRuntimePostgresPayloadUsable(cacheDir, current, postgresVersionProbe)) return current;
+    remainingRuntimeInstallMs(deadline, cacheDir, "find PostgreSQL runtime payload");
+    if (await isRuntimePostgresPayloadUsable(cacheDir, current, postgresVersionProbe, deadline)) return current;
     const entries = await readdir(current, { withFileTypes: true }).catch(() => []);
     for (const entry of entries) {
-      if (entry.isDirectory()) queue.push(path10.join(current, entry.name));
+      if (entry.isDirectory()) queue.push(path9.join(current, entry.name));
     }
   }
   return null;
 }
-async function reconcileSharedPostgresPayloadGenerations(cacheDir, sharedPlatformRoot, postgresVersionProbe, cleanupDownloads = false) {
-  const parentDir = path10.dirname(sharedPlatformRoot);
-  const baseName = path10.basename(sharedPlatformRoot);
+async function reconcileSharedPostgresPayloadGenerations(cacheDir, sharedPlatformRoot, postgresVersionProbe, cleanupDownloads = false, deadline) {
+  remainingRuntimeInstallMs(deadline, cacheDir, "reconcile shared PostgreSQL payload");
+  const parentDir = path9.dirname(sharedPlatformRoot);
+  const baseName = path9.basename(sharedPlatformRoot);
   const entries = await readdir(parentDir, { withFileTypes: true }).catch(() => []);
-  const temporaryRoots = entries.filter((entry) => entry.name.startsWith(`${baseName}.tmp-`)).map((entry) => path10.join(parentDir, entry.name));
-  const previousRoots = entries.filter((entry) => entry.name.startsWith(`${baseName}.previous-`)).map((entry) => path10.join(parentDir, entry.name)).sort().reverse();
-  const downloadsRoot = path10.join(
-    path10.dirname(path10.dirname(sharedPlatformRoot)),
+  const temporaryRoots = entries.filter((entry) => entry.name.startsWith(`${baseName}.tmp-`)).map((entry) => path9.join(parentDir, entry.name));
+  const previousRoots = entries.filter((entry) => entry.name.startsWith(`${baseName}.previous-`)).map((entry) => path9.join(parentDir, entry.name)).sort().reverse();
+  const downloadsRoot = path9.join(
+    path9.dirname(path9.dirname(sharedPlatformRoot)),
     ".downloads"
   );
-  const staleDownloadRoots = cleanupDownloads ? (await readdir(downloadsRoot, { withFileTypes: true }).catch(() => [])).filter((entry) => entry.name.startsWith("postgres-18.4-")).map((entry) => path10.join(downloadsRoot, entry.name)) : [];
-  const canonicalBinDir = path10.join(sharedPlatformRoot, "bin");
+  const staleDownloadRoots = cleanupDownloads ? (await readdir(downloadsRoot, { withFileTypes: true }).catch(() => [])).filter((entry) => entry.name.startsWith("postgres-18.4-")).map((entry) => path9.join(downloadsRoot, entry.name)) : [];
+  const canonicalBinDir = path9.join(sharedPlatformRoot, "bin");
   if (!await isRuntimePostgresPayloadUsable(
     cacheDir,
     canonicalBinDir,
-    postgresVersionProbe
+    postgresVersionProbe,
+    deadline
   )) {
     for (const previousRoot of previousRoots) {
       if (!await isRuntimePostgresPayloadUsable(
         cacheDir,
-        path10.join(previousRoot, "bin"),
-        postgresVersionProbe
+        path9.join(previousRoot, "bin"),
+        postgresVersionProbe,
+        deadline
       )) {
         continue;
       }
@@ -8617,12 +8866,12 @@ async function reconcileSharedPostgresPayloadGenerations(cacheDir, sharedPlatfor
     ...staleDownloadRoots.map((candidate) => rm(candidate, { recursive: true, force: true }))
   ]);
 }
-async function installSharedRuntimePostgresPayload(cacheDir, homeDir, sourceBinDir, postgresVersionProbe) {
+async function installSharedRuntimePostgresPayload(cacheDir, homeDir, sourceBinDir, postgresVersionProbe, deadline) {
   const sharedBinDir = resolveSharedRuntimePostgresPayloadBinDir(homeDir);
-  const sharedRuntimeDir = path10.dirname(sharedBinDir);
+  const sharedRuntimeDir = path9.dirname(sharedBinDir);
   const sharedPlatformRoot = sharedRuntimeDir;
-  const sourceRuntimeDir = path10.dirname(sourceBinDir);
-  const sourceTemplateDir = await resolveRuntimePostgresTemplateDir(sourceBinDir);
+  const sourceRuntimeDir = path9.dirname(sourceBinDir);
+  const sourceTemplateDir = await resolveRuntimePostgresTemplateDir(sourceBinDir, cacheDir, deadline);
   if (!sourceTemplateDir) {
     throw new RuntimeInstallError(
       `${RUDDER_POSTGRES_BIN_DIR_ENV} must contain PostgreSQL 18.4 initdb template files`,
@@ -8634,13 +8883,15 @@ async function installSharedRuntimePostgresPayload(cacheDir, homeDir, sourceBinD
     await reconcileSharedPostgresPayloadGenerations(
       cacheDir,
       sharedPlatformRoot,
-      postgresVersionProbe
+      postgresVersionProbe,
+      false,
+      deadline
     );
-    if (await isRuntimePostgresPayloadUsable(cacheDir, sharedBinDir, postgresVersionProbe)) {
+    if (await isRuntimePostgresPayloadUsable(cacheDir, sharedBinDir, postgresVersionProbe, deadline)) {
       return sharedBinDir;
     }
     await assertSharedPostgresPayloadNotLive(cacheDir, homeDir, sharedBinDir);
-    await mkdir2(path10.dirname(sharedPlatformRoot), { recursive: true });
+    await mkdir(path9.dirname(sharedPlatformRoot), { recursive: true });
     const temporaryPlatformRoot = `${sharedPlatformRoot}.tmp-${process.pid}-${Date.now()}`;
     const previousPlatformRoot = `${sharedPlatformRoot}.previous-${process.pid}-${Date.now()}`;
     let previousMoved = false;
@@ -8650,13 +8901,15 @@ async function installSharedRuntimePostgresPayload(cacheDir, homeDir, sourceBinD
     try {
       const temporaryRuntimeDir = temporaryPlatformRoot;
       const sourceShareDir = resolveRuntimePostgresShareDir(sourceBinDir, sourceTemplateDir);
-      await copyRuntimePostgresPayload(
+      await copyRuntimePostgresPayloadWithinDeadline(
         sourceRuntimeDir,
         temporaryRuntimeDir,
-        sourceShareDir
+        sourceShareDir,
+        cacheDir,
+        deadline
       );
-      const temporaryBinDir = path10.join(temporaryRuntimeDir, "bin");
-      await validateRuntimePostgresVersion(cacheDir, temporaryBinDir, postgresVersionProbe);
+      const temporaryBinDir = path9.join(temporaryRuntimeDir, "bin");
+      await validateRuntimePostgresVersion(cacheDir, temporaryBinDir, postgresVersionProbe, deadline);
       try {
         await rename(sharedPlatformRoot, previousPlatformRoot);
         previousMoved = true;
@@ -8684,30 +8937,35 @@ async function installSharedRuntimePostgresPayload(cacheDir, homeDir, sourceBinD
       }
     }
     return sharedBinDir;
-  });
+  }, { deadline, cacheDir, command: "acquire shared PostgreSQL install lock" });
 }
-async function downloadSharedRuntimePostgresPayload(cacheDir, homeDir, postgresVersionProbe) {
+async function downloadSharedRuntimePostgresPayload(cacheDir, homeDir, postgresVersionProbe, deadline, cleanupWorkDir) {
   const archiveSource = resolvePostgresRuntimeArchiveSource();
   const archiveUrl = archiveSource?.url ?? null;
   if (!archiveUrl) return null;
   const sharedBinDir = resolveSharedRuntimePostgresPayloadBinDir(homeDir);
-  const sharedPlatformRoot = path10.dirname(sharedBinDir);
+  const sharedPlatformRoot = path9.dirname(sharedBinDir);
   const downloadLockPath = `${sharedPlatformRoot}.download.lock`;
   return withRuntimeFilesystemLock(downloadLockPath, async () => {
-    if (await isRuntimePostgresPayloadUsable(cacheDir, sharedBinDir, postgresVersionProbe)) {
+    if (await isRuntimePostgresPayloadUsable(cacheDir, sharedBinDir, postgresVersionProbe, deadline)) {
       return sharedBinDir;
     }
-    const workRoot = path10.join(homeDir, "runtime-payloads", ".downloads");
-    await mkdir2(workRoot, { recursive: true });
-    const workDir = await mkdtemp(path10.join(workRoot, "postgres-18.4-"));
-    const archivePath = path10.join(workDir, "postgresql-18.4.zip");
-    const extractDir = path10.join(workDir, "extract");
+    const workRoot = path9.join(homeDir, "runtime-payloads", ".downloads");
+    await mkdir(workRoot, { recursive: true });
+    const workDir = await mkdtemp(path9.join(workRoot, "postgres-18.4-"));
+    const archivePath = path9.join(workDir, "postgresql-18.4.zip");
+    const extractDir = path9.join(workDir, "extract");
     try {
-      await downloadRuntimePostgresArchive(archiveUrl, archivePath, archiveSource?.expectedSha256);
+      await downloadRuntimePostgresArchive(
+        archiveUrl,
+        archivePath,
+        archiveSource?.expectedSha256,
+        { timeoutMs: remainingRuntimeInstallMs(deadline, cacheDir, "download PostgreSQL runtime archive") }
+      );
       const configuredMaxBytes = Number.parseInt(process.env[RUDDER_POSTGRES_RUNTIME_ARCHIVE_MAX_BYTES_ENV2] ?? "", 10);
       const maxArchiveBytes = Number.isSafeInteger(configuredMaxBytes) && configuredMaxBytes > 0 ? configuredMaxBytes : DEFAULT_RUNTIME_POSTGRES_ARCHIVE_MAX_BYTES2;
       const nativePublishStaging = `${sharedPlatformRoot}.tmp-native-${process.pid}-${Date.now()}`;
-      await mkdir2(path10.dirname(sharedPlatformRoot), { recursive: true });
+      await mkdir(path9.dirname(sharedPlatformRoot), { recursive: true });
       const nativeInstall = await tryInstallNativePayload({
         archivePath,
         extractPath: extractDir,
@@ -8715,11 +8973,14 @@ async function downloadSharedRuntimePostgresPayload(cacheDir, homeDir, postgresV
         destinationPath: sharedPlatformRoot,
         maxArchiveBytes,
         expectedSha256: archiveSource?.expectedSha256,
-        preparePublish: async (nativeExtractPath, publishStagingPath) => {
+        timeoutMs: remainingRuntimeInstallMs(deadline, cacheDir, "prepare native PostgreSQL runtime payload"),
+        now: deadline?.now,
+        preparePublish: async (nativeExtractPath, publishStagingPath, context) => {
           const extractedBinDir2 = await findRuntimePostgresBinDir(
             nativeExtractPath,
             cacheDir,
-            postgresVersionProbe
+            postgresVersionProbe,
+            deadline
           );
           if (!extractedBinDir2) {
             throw new RuntimeInstallError(
@@ -8727,41 +8988,46 @@ async function downloadSharedRuntimePostgresPayload(cacheDir, homeDir, postgresV
               { cacheDir, command: "prepare native PostgreSQL runtime payload", output: "" }
             );
           }
-          await validateRuntimePostgresVersion(cacheDir, extractedBinDir2, postgresVersionProbe);
-          const templateDir = await resolveRuntimePostgresTemplateDir(extractedBinDir2);
+          await validateRuntimePostgresVersion(cacheDir, extractedBinDir2, postgresVersionProbe, deadline);
+          const templateDir = await resolveRuntimePostgresTemplateDir(extractedBinDir2, cacheDir, deadline);
           if (!templateDir) {
             throw new RuntimeInstallError(
               "PostgreSQL 18.4 archive did not contain initdb template files",
               { cacheDir, command: "prepare native PostgreSQL runtime payload", output: "" }
             );
           }
-          await copyRuntimePostgresPayload(
-            path10.dirname(extractedBinDir2),
+          await copyRuntimePostgresPayloadWithinDeadline(
+            path9.dirname(extractedBinDir2),
             publishStagingPath,
-            resolveRuntimePostgresShareDir(extractedBinDir2, templateDir)
+            resolveRuntimePostgresShareDir(extractedBinDir2, templateDir),
+            cacheDir,
+            deadline,
+            context.signal
           );
-          return path10.relative(
+          return path9.relative(
             publishStagingPath,
-            path10.join(publishStagingPath, "bin", runtimePostgresExecutableName("postgres"))
+            path9.join(publishStagingPath, "bin", runtimePostgresExecutableName("postgres"))
           );
         },
         validatePublished: async (destinationPath) => {
           await validateRuntimePostgresVersion(
             cacheDir,
-            path10.join(destinationPath, "bin"),
-            postgresVersionProbe
+            path9.join(destinationPath, "bin"),
+            postgresVersionProbe,
+            deadline
           );
         }
       });
       if (nativeInstall.installed) {
         return sharedBinDir;
       }
-      await mkdir2(extractDir, { recursive: true });
-      extractRuntimePostgresArchive(archivePath, extractDir);
+      await mkdir(extractDir, { recursive: true });
+      extractRuntimePostgresArchive(archivePath, extractDir, cacheDir, deadline);
       const extractedBinDir = await findRuntimePostgresBinDir(
         extractDir,
         cacheDir,
-        postgresVersionProbe
+        postgresVersionProbe,
+        deadline
       );
       if (!extractedBinDir) {
         throw new RuntimeInstallError(
@@ -8773,28 +9039,31 @@ async function downloadSharedRuntimePostgresPayload(cacheDir, homeDir, postgresV
         cacheDir,
         homeDir,
         extractedBinDir,
-        postgresVersionProbe
+        postgresVersionProbe,
+        deadline
       );
     } finally {
-      await rm(workDir, { recursive: true, force: true });
+      const cleanup = cleanupWorkDir ?? ((candidate) => rm(candidate, { recursive: true, force: true }));
+      void cleanup(workDir).catch(() => {
+      });
     }
-  });
+  }, { deadline, cacheDir, command: "acquire shared PostgreSQL download lock" });
 }
 async function ensureRuntimePostgresCompatibilityLink(cacheDir, homeDir, packageVersion) {
-  const compatibilityRoot = path10.join(cacheDir, RUNTIME_POSTGRES_PAYLOAD_DIR);
-  const sharedPayloadRoot = path10.join(homeDir, "runtime-payloads", RUNTIME_POSTGRES_PAYLOAD_DIR);
+  const compatibilityRoot = path9.join(cacheDir, RUNTIME_POSTGRES_PAYLOAD_DIR);
+  const sharedPayloadRoot = path9.join(homeDir, "runtime-payloads", RUNTIME_POSTGRES_PAYLOAD_DIR);
   const runtimeMetadata = await readRuntimeInstallMetadata(cacheDir);
   const liveDescriptors = await readLiveRuntimeDescriptors(homeDir);
   const compatibilityBinDir = resolveRuntimePostgresPayloadBinDir(cacheDir);
   const isProtected = liveDescriptors.some((descriptor) => descriptor.postgresBinDir && pathIsInside(descriptor.postgresBinDir, compatibilityRoot) || !descriptor.postgresBinDir && descriptor.version === (runtimeMetadata?.packageVersion ?? packageVersion));
   if (isProtected) return;
-  await mkdir2(path10.dirname(compatibilityRoot), { recursive: true });
+  await mkdir(path9.dirname(compatibilityRoot), { recursive: true });
   const temporaryRoot = `${compatibilityRoot}.next-${process.pid}-${Date.now()}`;
   const previousRoot = `${compatibilityRoot}.previous-${process.pid}-${Date.now()}`;
   await rm(temporaryRoot, { recursive: true, force: true });
   await rm(previousRoot, { recursive: true, force: true });
   await symlink(
-    process.platform === "win32" ? sharedPayloadRoot : path10.relative(path10.dirname(compatibilityRoot), sharedPayloadRoot),
+    process.platform === "win32" ? sharedPayloadRoot : path9.relative(path9.dirname(compatibilityRoot), sharedPayloadRoot),
     temporaryRoot,
     process.platform === "win32" ? "junction" : "dir"
   );
@@ -8824,15 +9093,16 @@ async function ensureRuntimePostgresCompatibilityLink(cacheDir, homeDir, package
     if (!previousMoved) await rm(previousRoot, { recursive: true, force: true });
   }
 }
-async function stageRuntimePostgresPayload(cacheDir, homeDir, packageVersion, enabled, postgresVersionProbe) {
+async function stageRuntimePostgresPayload(cacheDir, homeDir, packageVersion, enabled, postgresVersionProbe, deadline, cleanupDownloadWorkDir) {
   if (!enabled) return { output: "" };
   const explicitSourceBinDir = process.env[RUDDER_POSTGRES_BIN_DIR_ENV]?.trim();
-  const resolvedExplicitSourceBinDir = explicitSourceBinDir ? path10.resolve(explicitSourceBinDir) : null;
+  const resolvedExplicitSourceBinDir = explicitSourceBinDir ? path9.resolve(explicitSourceBinDir) : null;
   if (resolvedExplicitSourceBinDir && !isManagedRuntimePostgresBinDir(resolvedExplicitSourceBinDir, homeDir)) {
     await validateRuntimePostgresVersion(
       cacheDir,
       resolvedExplicitSourceBinDir,
-      postgresVersionProbe
+      postgresVersionProbe,
+      deadline
     );
     return {
       output: "",
@@ -8847,35 +9117,41 @@ async function stageRuntimePostgresPayload(cacheDir, homeDir, packageVersion, en
     };
   }
   const sharedBinDir = resolveSharedRuntimePostgresPayloadBinDir(homeDir);
-  const sharedPlatformRoot = path10.dirname(sharedBinDir);
+  const sharedPlatformRoot = path9.dirname(sharedBinDir);
   await withRuntimeFilesystemLock(
     `${sharedPlatformRoot}.install.lock`,
     async () => reconcileSharedPostgresPayloadGenerations(
       cacheDir,
       sharedPlatformRoot,
       postgresVersionProbe,
-      true
-    )
+      true,
+      deadline
+    ),
+    { deadline, cacheDir, command: "reconcile shared PostgreSQL payload" }
   );
   let output = "";
-  if (!await isRuntimePostgresPayloadUsable(cacheDir, sharedBinDir, postgresVersionProbe)) {
-    const sourceBinDir = resolvedExplicitSourceBinDir ?? await findLegacyRuntimePostgresBinDir(cacheDir, homeDir, postgresVersionProbe);
+  if (!await isRuntimePostgresPayloadUsable(cacheDir, sharedBinDir, postgresVersionProbe, deadline)) {
+    const sourceBinDir = resolvedExplicitSourceBinDir ?? await findLegacyRuntimePostgresBinDir(cacheDir, homeDir, postgresVersionProbe, deadline);
     if (sourceBinDir) {
       await validateRuntimePostgresVersion(
         cacheDir,
         sourceBinDir,
-        postgresVersionProbe
+        postgresVersionProbe,
+        deadline
       );
       await installSharedRuntimePostgresPayload(
         cacheDir,
         homeDir,
         sourceBinDir,
-        postgresVersionProbe
+        postgresVersionProbe,
+        deadline
       );
     } else if (!await downloadSharedRuntimePostgresPayload(
       cacheDir,
       homeDir,
-      postgresVersionProbe
+      postgresVersionProbe,
+      deadline,
+      cleanupDownloadWorkDir
     )) {
       return { output: "" };
     }
@@ -8953,13 +9229,13 @@ async function pruneRuntimeCache(options = {}) {
   };
 }
 async function scanRuntimeCacheEntries(homeDir) {
-  const runtimesDir = path10.join(homeDir, "runtimes");
+  const runtimesDir = path9.join(homeDir, "runtimes");
   const dirents = await readdir(runtimesDir, { withFileTypes: true }).catch(() => null);
   if (!dirents) return [];
   const entries = [];
   for (const dirent of dirents) {
     if (!dirent.isDirectory()) continue;
-    const cacheDir = path10.join(runtimesDir, dirent.name);
+    const cacheDir = path9.join(runtimesDir, dirent.name);
     const metadata = await readRuntimeInstallMetadata(cacheDir);
     if (!metadata) continue;
     const fallbackStat = await safeStat(cacheDir);
@@ -8982,7 +9258,7 @@ function parseTimestampMs(value) {
 }
 async function safeStat(targetPath) {
   try {
-    return await stat3(targetPath);
+    return await stat(targetPath);
   } catch {
     return null;
   }
@@ -8992,7 +9268,7 @@ async function directorySizeBytes(targetPath) {
   if (!dirents) return 0;
   let total = 0;
   for (const dirent of dirents) {
-    const entryPath = path10.join(targetPath, dirent.name);
+    const entryPath = path9.join(targetPath, dirent.name);
     if (dirent.isSymbolicLink()) continue;
     if (dirent.isDirectory()) {
       total += await directorySizeBytes(entryPath);
@@ -9004,14 +9280,14 @@ async function directorySizeBytes(targetPath) {
   return total;
 }
 async function readActiveRuntimeVersions(homeDir) {
-  const instancesDir = path10.join(homeDir, "instances");
+  const instancesDir = path9.join(homeDir, "instances");
   const dirents = await readdir(instancesDir, { withFileTypes: true }).catch(() => null);
   if (!dirents) return [];
   const versions = /* @__PURE__ */ new Set();
   for (const dirent of dirents) {
     if (!dirent.isDirectory()) continue;
     try {
-      const descriptorPath = path10.join(instancesDir, dirent.name, "runtime", "server.json");
+      const descriptorPath = path9.join(instancesDir, dirent.name, "runtime", "server.json");
       const parsed = JSON.parse(await readFile(descriptorPath, "utf8"));
       if (typeof parsed.version !== "string") continue;
       if (typeof parsed.pid === "number" && Number.isInteger(parsed.pid) && parsed.pid > 0 && isPidRunning(parsed.pid)) {
@@ -9126,7 +9402,6 @@ var init_install = __esm({
     "use strict";
     init_home();
     init_native_payload();
-    init_postgres_payload();
     init_postgres_runtime_download();
     init_postgres_runtime_source();
     RUNTIME_NPM_PACKAGE_NAME = "@rudderhq/server";
@@ -9172,7 +9447,7 @@ var init_install = __esm({
 
 // src/runtime/server-entry.ts
 import fs7 from "node:fs";
-import path11 from "node:path";
+import path10 from "node:path";
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL2 } from "node:url";
 function formatError(err) {
   if (err instanceof Error) {
@@ -9194,8 +9469,8 @@ function maybeEnableUiDevMiddleware(entrypoint) {
   }
 }
 function resolveDevServerEntry() {
-  const projectRoot = path11.resolve(path11.dirname(fileURLToPath5(import.meta.url)), "../../..");
-  return path11.resolve(projectRoot, "server/src/index.ts");
+  const projectRoot = path10.resolve(path10.dirname(fileURLToPath5(import.meta.url)), "../../..");
+  return path10.resolve(projectRoot, "server/src/index.ts");
 }
 async function loadServerRuntimeModule(options) {
   const devEntry = resolveDevServerEntry();
@@ -9335,21 +9610,21 @@ var init_auth_bootstrap_ceo = __esm({
 
 // src/utils/path-resolver.ts
 import fs10 from "node:fs";
-import path19 from "node:path";
+import path18 from "node:path";
 function unique(items) {
   return Array.from(new Set(items));
 }
 function resolveRuntimeLikePath(value, configPath) {
   const expanded = expandHomePrefix(value);
-  if (path19.isAbsolute(expanded)) return path19.resolve(expanded);
+  if (path18.isAbsolute(expanded)) return path18.resolve(expanded);
   const cwd = process.cwd();
-  const configDir = configPath ? path19.dirname(configPath) : null;
-  const workspaceRoot = configDir ? path19.resolve(configDir, "..") : cwd;
+  const configDir = configPath ? path18.dirname(configPath) : null;
+  const workspaceRoot = configDir ? path18.resolve(configDir, "..") : cwd;
   const candidates = unique([
-    ...configDir ? [path19.resolve(configDir, expanded)] : [],
-    path19.resolve(workspaceRoot, "server", expanded),
-    path19.resolve(workspaceRoot, expanded),
-    path19.resolve(cwd, expanded)
+    ...configDir ? [path18.resolve(configDir, expanded)] : [],
+    path18.resolve(workspaceRoot, "server", expanded),
+    path18.resolve(workspaceRoot, expanded),
+    path18.resolve(cwd, expanded)
   ]);
   return candidates.find((candidate) => fs10.existsSync(candidate)) ?? candidates[0];
 }
@@ -9363,7 +9638,7 @@ var init_path_resolver = __esm({
 // src/config/secrets-key.ts
 import { randomBytes as randomBytes2 } from "node:crypto";
 import fs11 from "node:fs";
-import path20 from "node:path";
+import path19 from "node:path";
 function ensureLocalSecretsKeyFile(config, configPath) {
   if (config.secrets.provider !== "local_encrypted") {
     return { status: "skipped_provider", path: null };
@@ -9378,7 +9653,7 @@ function ensureLocalSecretsKeyFile(config, configPath) {
   if (fs11.existsSync(keyFilePath)) {
     return { status: "existing", path: keyFilePath };
   }
-  fs11.mkdirSync(path20.dirname(keyFilePath), { recursive: true });
+  fs11.mkdirSync(path19.dirname(keyFilePath), { recursive: true });
   fs11.writeFileSync(keyFilePath, randomBytes2(32).toString("base64"), {
     encoding: "utf8",
     mode: 384
@@ -10464,7 +10739,7 @@ var init_port_check = __esm({
 // src/checks/secrets-check.ts
 import { randomBytes as randomBytes3 } from "node:crypto";
 import fs14 from "node:fs";
-import path21 from "node:path";
+import path20 from "node:path";
 function decodeMasterKey(raw) {
   const trimmed = raw.trim();
   if (!trimmed) return null;
@@ -10534,7 +10809,7 @@ function secretsCheck(config, configPath) {
         message: `Secrets key file does not exist yet: ${keyFilePath}`,
         canRepair: true,
         repair: () => {
-          fs14.mkdirSync(path21.dirname(keyFilePath), { recursive: true });
+          fs14.mkdirSync(path20.dirname(keyFilePath), { recursive: true });
           fs14.writeFileSync(keyFilePath, randomBytes3(32).toString("base64"), {
             encoding: "utf8",
             mode: 384
@@ -11107,7 +11382,7 @@ var init_run = __esm({
 
 // src/commands/onboard.ts
 import * as p14 from "@clack/prompts";
-import path22 from "node:path";
+import path21 from "node:path";
 import pc13 from "picocolors";
 function parseBooleanFromEnv(rawValue) {
   if (rawValue === void 0) return null;
@@ -11140,7 +11415,7 @@ function parseEnumFromEnv(rawValue, allowedValues) {
 }
 function resolvePathFromEnv(rawValue) {
   if (!rawValue || rawValue.trim().length === 0) return null;
-  return path22.resolve(expandHomePrefix(rawValue.trim()));
+  return path21.resolve(expandHomePrefix(rawValue.trim()));
 }
 function quickstartDefaultsFromEnv() {
   const instanceId = resolveRudderInstanceId();
@@ -11572,7 +11847,7 @@ var init_onboard = __esm({
 });
 
 // src/program.ts
-import { Command, CommanderError } from "commander";
+import { Command, CommanderError, Option } from "commander";
 
 // src/agent-v1-mcp-server.ts
 init_dist();
@@ -13105,41 +13380,41 @@ var RudderApiClient = class {
     this.signal = opts.signal;
     this.recoverAuth = opts.recoverAuth;
   }
-  get(path26, opts) {
-    return this.request(path26, { method: "GET" }, opts);
+  get(path25, opts) {
+    return this.request(path25, { method: "GET" }, opts);
   }
-  post(path26, body, opts) {
-    return this.request(path26, {
+  post(path25, body, opts) {
+    return this.request(path25, {
       method: "POST",
       body: body === void 0 ? void 0 : JSON.stringify(body)
     }, opts);
   }
-  postForm(path26, form, opts) {
-    return this.request(path26, {
+  postForm(path25, form, opts) {
+    return this.request(path25, {
       method: "POST",
       body: form
     }, opts);
   }
-  patch(path26, body, opts) {
-    return this.request(path26, {
+  patch(path25, body, opts) {
+    return this.request(path25, {
       method: "PATCH",
       body: body === void 0 ? void 0 : JSON.stringify(body)
     }, opts);
   }
-  put(path26, body, opts) {
-    return this.request(path26, {
+  put(path25, body, opts) {
+    return this.request(path25, {
       method: "PUT",
       body: body === void 0 ? void 0 : JSON.stringify(body)
     }, opts);
   }
-  delete(path26, opts) {
-    return this.request(path26, { method: "DELETE" }, opts);
+  delete(path25, opts) {
+    return this.request(path25, { method: "DELETE" }, opts);
   }
   setApiKey(apiKey) {
     this.apiKey = apiKey?.trim() || void 0;
   }
-  async request(path26, init, opts, hasRetriedAuth = false) {
-    const url = buildUrl(this.apiBase, path26);
+  async request(path25, init, opts, hasRetriedAuth = false) {
+    const url = buildUrl(this.apiBase, path25);
     const headers = {
       accept: "application/json",
       ...toStringRecord(init.headers)
@@ -13170,13 +13445,13 @@ var RudderApiClient = class {
       const apiError = await toApiError(response);
       if (!hasRetriedAuth && this.recoverAuth) {
         const recoveredToken = await this.recoverAuth({
-          path: path26,
+          path: path25,
           method: String(init.method ?? "GET").toUpperCase(),
           error: apiError
         });
         if (recoveredToken) {
           this.setApiKey(recoveredToken);
-          return this.request(path26, init, opts, true);
+          return this.request(path25, init, opts, true);
         }
       }
       throw apiError;
@@ -13195,8 +13470,8 @@ function shouldAttachAgentContext(method) {
   const normalized = String(method ?? "GET").toUpperCase();
   return normalized !== "GET" && normalized !== "HEAD";
 }
-function buildUrl(apiBase, path26) {
-  const normalizedPath = path26.startsWith("/") ? path26 : `/${path26}`;
+function buildUrl(apiBase, path25) {
+  const normalizedPath = path25.startsWith("/") ? path25 : `/${path25}`;
   const [pathname, query] = normalizedPath.split("?");
   const url = new URL2(apiBase);
   url.pathname = `${url.pathname.replace(/\/+$/, "")}${pathname}`;
@@ -14359,7 +14634,7 @@ async function callToolDirectlyIfSupported(toolName, rawArgs, env, signal) {
   if (hasLocalImageInputs(input.images)) return null;
   const api = mcpApiClient(env, signal);
   const success = (data) => mcpSuccess(
-    toCliShortIdOutput(data),
+    capabilityId.startsWith("browser.") ? data : toCliShortIdOutput(data),
     capabilityId.startsWith("browser.") ? RUDDER_BROWSER_MCP_MAX_TOOL_RESULT_BYTES : RUDDER_MCP_MAX_TOOL_RESULT_BYTES
   );
   switch (capabilityId) {
@@ -15786,8 +16061,8 @@ function registerActivityCommands(program) {
         if (opts.entityType) params.set("entityType", opts.entityType);
         if (opts.entityId) params.set("entityId", opts.entityId);
         const query = params.toString();
-        const path26 = `/api/orgs/${ctx.orgId}/activity${query ? `?${query}` : ""}`;
-        const rows = await ctx.api.get(path26) ?? [];
+        const path25 = `/api/orgs/${ctx.orgId}/activity${query ? `?${query}` : ""}`;
+        const rows = await ctx.api.get(path25) ?? [];
         if (ctx.json) {
           printOutput(rows, { json: true });
           return;
@@ -15819,7 +16094,7 @@ function registerActivityCommands(program) {
 
 // ../packages/agent-runtime-utils/dist/server-utils.cli.js
 import { promises as fs8 } from "node:fs";
-import path12 from "node:path";
+import path11 from "node:path";
 
 // ../packages/agent-runtime-utils/dist/native-process-runner.js
 init_dist2();
@@ -16093,12 +16368,11 @@ The prior Run has already persisted the checkpoint named above. Reconstruct the
 
 If the checkpoint instead records a wait or human decision, this wake is unexpected: do not invent authorization or execute the waiting action. Refresh managed Goal context, report the mismatch, and leave the Goal waiting for its named actor or external trigger. If a ready Result Proposal exists, stop and wait for human Acceptance.`;
 var ISSUE_ASSIGNEE_EXECUTION_RAIL = "Before doing issue-scoped execution as the assignee, check out the assigned issue. If checkout returns `409`, do not retry; stop and report the ownership conflict.";
-var ISSUE_ASSIGN_PROMPT_TEMPLATE = `You are agent {{agent.id}} ({{agent.name}}). You have been assigned to work on an issue.
+var ISSUE_ASSIGN_PROMPT_TEMPLATE = `<wake_context>
+You are agent {{agent.id}} ({{agent.name}}). You have been assigned to work on an issue.
 
 {{context.rudderWorkspace.orgResourcesPrompt}}
 
-## Task Context
-
 **Issue:** {{issue.title}}
 **ID:** {{issue.id}}
 **Status:** {{issue.status}}
@@ -16107,21 +16381,23 @@ var ISSUE_ASSIGN_PROMPT_TEMPLATE = `You are agent {{agent.id}} ({{agent.name}}).
 **Reviewer:** {{issue.reviewerLabel}}
 **Created At:** {{issue.createdAt}}
 **Updated At:** {{issue.updatedAt}}
+</wake_context>
 
+<quoted_issue_context>
 **Description:**
 {{issue.description}}
+</quoted_issue_context>
 
 
 Your task is to review this issue, understand what kind of work it asks for, and take the appropriate next action.
 
 Do not assume every issue is a codebase task. If the issue is a question, screenshot check, review, planning request, coordination task, or another non-code request, answer or handle that request directly. Inspect the codebase and implement a change only when the issue actually asks for engineering work or when the relevant project resources make code changes necessary.
 ${ISSUE_ASSIGNEE_EXECUTION_RAIL}`;
-var ISSUE_COMMENTED_PROMPT_TEMPLATE = `You are agent {{agent.id}} ({{agent.name}}). There is a new comment on an issue you own.
+var ISSUE_COMMENTED_PROMPT_TEMPLATE = `<wake_context>
+You are agent {{agent.id}} ({{agent.name}}). There is a new comment on an issue you own.
 
 {{context.rudderWorkspace.orgResourcesPrompt}}
 
-## Context
-
 **Issue:** {{issue.title}}
 **ID:** {{issue.id}}
 **Status:** {{issue.status}}
@@ -16129,7 +16405,9 @@ var ISSUE_COMMENTED_PROMPT_TEMPLATE = `You are agent {{agent.id}} ({{agent.name}
 **Reviewer:** {{issue.reviewerLabel}}
 **Created At:** {{issue.createdAt}}
 **Updated At:** {{issue.updatedAt}}
+</wake_context>
 
+<quoted_issue_context>
 **Issue Description:**
 {{issue.description}}
 
@@ -16138,15 +16416,15 @@ var ISSUE_COMMENTED_PROMPT_TEMPLATE = `You are agent {{agent.id}} ({{agent.name}
 From: {{comment.authorLabel}} ({{comment.authorKind}})
 
 {{comment.body}}
+</quoted_issue_context>
 
 Review the new comment and continue the issue from the current state. Respond or take action as needed.
 ${ISSUE_ASSIGNEE_EXECUTION_RAIL}`;
-var ISSUE_CHANGES_REQUESTED_PROMPT_TEMPLATE = `You are agent {{agent.id}} ({{agent.name}}). A reviewer requested changes on an issue you own.
+var ISSUE_CHANGES_REQUESTED_PROMPT_TEMPLATE = `<wake_context>
+You are agent {{agent.id}} ({{agent.name}}). A reviewer requested changes on an issue you own.
 
 {{context.rudderWorkspace.orgResourcesPrompt}}
 
-## Context
-
 **Issue:** {{issue.title}}
 **ID:** {{issue.id}}
 **Status:** {{issue.status}}
@@ -16154,7 +16432,9 @@ var ISSUE_CHANGES_REQUESTED_PROMPT_TEMPLATE = `You are agent {{agent.id}} ({{age
 **Reviewer:** {{issue.reviewerLabel}}
 **Created At:** {{issue.createdAt}}
 **Updated At:** {{issue.updatedAt}}
+</wake_context>
 
+<quoted_issue_context>
 **Issue Description:**
 {{issue.description}}
 
@@ -16163,10 +16443,12 @@ var ISSUE_CHANGES_REQUESTED_PROMPT_TEMPLATE = `You are agent {{agent.id}} ({{age
 From: {{comment.authorLabel}} ({{comment.authorKind}})
 
 {{comment.body}}
+</quoted_issue_context>
 
 Review the requested changes and continue the issue from the current state. Address the reviewer feedback before handing it back for review.
 ${ISSUE_ASSIGNEE_EXECUTION_RAIL}`;
-var ISSUE_RECOVERY_PROMPT_TEMPLATE = `You are agent {{agent.id}} ({{agent.name}}). This is a recovery run, not a fresh task.
+var ISSUE_RECOVERY_PROMPT_TEMPLATE = `<wake_context>
+You are agent {{agent.id}} ({{agent.name}}). This is a recovery run, not a fresh task.
 
 {{context.rudderWorkspace.orgResourcesPrompt}}
 
@@ -16188,14 +16470,18 @@ var ISSUE_RECOVERY_PROMPT_TEMPLATE = `You are agent {{agent.id}} ({{agent.name}}
 - Reviewer: {{issue.reviewerLabel}}
 - Created At: {{issue.createdAt}}
 - Updated At: {{issue.updatedAt}}
+</wake_context>
 
+<quoted_issue_context>
 - Description:
 {{issue.description}}
+</quoted_issue_context>
 
 
 Before doing anything else, inspect what the previous run already completed and any side effects it may have caused. Continue the remaining work from the current state. Avoid blindly re-running the whole task.
 ${ISSUE_ASSIGNEE_EXECUTION_RAIL}`;
-var ISSUE_PASSIVE_FOLLOWUP_PROMPT_TEMPLATE = `You are agent {{agent.id}} ({{agent.name}}). This is a passive issue follow-up, not a fresh assignment and not a failure recovery.
+var ISSUE_PASSIVE_FOLLOWUP_PROMPT_TEMPLATE = `<wake_context>
+You are agent {{agent.id}} ({{agent.name}}). This is a passive issue follow-up, not a fresh assignment and not a failure recovery.
 
 {{context.rudderWorkspace.orgResourcesPrompt}}
 
@@ -16218,16 +16504,17 @@ Reason: {{context.passiveFollowup.reason}}
 - Reviewer: {{issue.reviewerLabel}}
 - Created At: {{issue.createdAt}}
 - Updated At: {{issue.updatedAt}}
+</wake_context>
 
+<quoted_issue_context>
 - Description:
 {{issue.description}}
+</quoted_issue_context>
 
 
 Before changing the issue, continue to progress the current issue, then inspect the current issue state and any side effects from the previous run. Finally, do exactly one close-out action: add a progress comment, mark the issue done, block it with a reason, or hand it off explicitly with explanation.
 ${ISSUE_ASSIGNEE_EXECUTION_RAIL}`;
 var RUDDER_AGENT_OPERATING_CONTRACT = [
-  "# Rudder Agent Operating Contract",
-  "",
   "You are a helpful assistant running inside Rudder. Your home directory is `$AGENT_HOME`. Everything personal to you -- life, memory, knowledge -- lives there. Other agents may have their own folders and you may update them when necessary.",
   "",
   "Read Rudder mcp tools to firstly.",
@@ -16288,8 +16575,6 @@ var RUDDER_AGENT_OPERATING_CONTRACT = [
   "- When the user explicitly mentions previously handled issue, tasks or conversations, you need to retrieve the relevant tasks first before proceeding with the next action."
 ].join("\n");
 var RUDDER_AGENT_HEARTBEAT_INSTRUCTION = [
-  "# Rudder Heartbeat Instruction",
-  "",
   "This section is injected by Rudder only for heartbeat scene runs. It is the platform-owned heartbeat/self-check pipeline.",
   "",
   "## Heartbeat Pipeline",
@@ -16315,8 +16600,8 @@ var RUDDER_AGENT_HEARTBEAT_INSTRUCTION = [
 // ../packages/agent-runtime-utils/dist/server-utils.cli.js
 async function resolveRudderSkillsDir(moduleDir, additionalCandidates = []) {
   const candidates = [
-    ...RUDDER_SKILL_ROOT_RELATIVE_CANDIDATES.map((relativePath) => path12.resolve(moduleDir, relativePath)),
-    ...additionalCandidates.map((candidate) => path12.resolve(candidate))
+    ...RUDDER_SKILL_ROOT_RELATIVE_CANDIDATES.map((relativePath) => path11.resolve(moduleDir, relativePath)),
+    ...additionalCandidates.map((candidate) => path11.resolve(candidate))
   ];
   const seenRoots = /* @__PURE__ */ new Set();
   for (const root of candidates) {
@@ -16333,26 +16618,26 @@ async function removeMaintainerOnlySkillSymlinks(skillsHome, allowedSkillNames)
   return removeUnselectedRudderSkillSymlinks(skillsHome, allowedSkillNames);
 }
 async function readRudderMaterializedSkillSource(target) {
-  const manifestPath = path12.join(target, ".rudder", "materialized-skill.json");
+  const manifestPath = path11.join(target, ".rudder", "materialized-skill.json");
   const raw = await fs8.readFile(manifestPath, "utf8").catch(() => null);
   if (!raw)
     return null;
   try {
     const parsed = parseObject(JSON.parse(raw));
     const sourcePath = asString(parsed.sourcePath, "").trim();
-    return sourcePath.length > 0 ? path12.resolve(sourcePath) : null;
+    return sourcePath.length > 0 ? path11.resolve(sourcePath) : null;
   } catch {
     return null;
   }
 }
 async function removeUnselectedRudderSkillSymlinks(skillsHome, allowedSkillNames, knownSkillSources = []) {
   const allowed = new Set(Array.from(allowedSkillNames));
-  const knownSources = new Set(Array.from(knownSkillSources).map((value) => value.trim()).filter(Boolean).map((value) => path12.resolve(value)));
+  const knownSources = new Set(Array.from(knownSkillSources).map((value) => value.trim()).filter(Boolean).map((value) => path11.resolve(value)));
   try {
     const entries = await fs8.readdir(skillsHome, { withFileTypes: true });
     const removed = [];
     for (const entry of entries) {
-      const target = path12.join(skillsHome, entry.name);
+      const target = path11.join(skillsHome, entry.name);
       const existing = await fs8.lstat(target).catch(() => null);
       if (!existing)
         continue;
@@ -16361,8 +16646,8 @@ async function removeUnselectedRudderSkillSymlinks(skillsHome, allowedSkillNames
         const linkedPath = await fs8.readlink(target).catch(() => null);
         if (!linkedPath)
           continue;
-        const resolvedLinkedPath = path12.isAbsolute(linkedPath) ? linkedPath : path12.resolve(path12.dirname(target), linkedPath);
-        isRudderManagedSkill = knownSources.has(path12.resolve(resolvedLinkedPath)) || isMaintainerOnlySkillTarget(linkedPath) || isMaintainerOnlySkillTarget(resolvedLinkedPath);
+        const resolvedLinkedPath = path11.isAbsolute(linkedPath) ? linkedPath : path11.resolve(path11.dirname(target), linkedPath);
+        isRudderManagedSkill = knownSources.has(path11.resolve(resolvedLinkedPath)) || isMaintainerOnlySkillTarget(linkedPath) || isMaintainerOnlySkillTarget(resolvedLinkedPath);
       } else if (existing.isDirectory()) {
         const materializedSource = await readRudderMaterializedSkillSource(target);
         isRudderManagedSkill = materializedSource !== null && knownSources.has(materializedSource);
@@ -16384,7 +16669,7 @@ async function removeUnselectedRudderSkillSymlinks(skillsHome, allowedSkillNames
 init_dist2();
 import fs9 from "node:fs/promises";
 import os3 from "node:os";
-import path13 from "node:path";
+import path12 from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 
 // src/commands/client/help.ts
@@ -16408,16 +16693,16 @@ function formatHelpExample(example) {
 }
 
 // src/commands/client/agent.ts
-var __moduleDir = path13.dirname(fileURLToPath6(import.meta.url));
+var __moduleDir = path12.dirname(fileURLToPath6(import.meta.url));
 function codexSkillsHome() {
   const fromEnv = process.env.CODEX_HOME?.trim();
-  const base = fromEnv && fromEnv.length > 0 ? fromEnv : path13.join(os3.homedir(), ".codex");
-  return path13.join(base, "skills");
+  const base = fromEnv && fromEnv.length > 0 ? fromEnv : path12.join(os3.homedir(), ".codex");
+  return path12.join(base, "skills");
 }
 function claudeSkillsHome() {
   const fromEnv = process.env.CLAUDE_HOME?.trim();
-  const base = fromEnv && fromEnv.length > 0 ? fromEnv : path13.join(os3.homedir(), ".claude");
-  return path13.join(base, "skills");
+  const base = fromEnv && fromEnv.length > 0 ? fromEnv : path12.join(os3.homedir(), ".claude");
+  return path12.join(base, "skills");
 }
 async function installSkillsForTarget(sourceSkillsDir, targetSkillsDir, tool2) {
   const summary = {
@@ -16436,8 +16721,8 @@ async function installSkillsForTarget(sourceSkillsDir, targetSkillsDir, tool2) {
   );
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    const source = path13.join(sourceSkillsDir, entry.name);
-    const target = path13.join(targetSkillsDir, entry.name);
+    const source = path12.join(sourceSkillsDir, entry.name);
+    const target = path12.join(targetSkillsDir, entry.name);
     const existing = await fs9.lstat(target).catch(() => null);
     if (existing) {
       if (existing.isSymbolicLink()) {
@@ -16458,7 +16743,7 @@ async function installSkillsForTarget(sourceSkillsDir, targetSkillsDir, tool2) {
             continue;
           }
         }
-        const resolvedLinkedPath = path13.isAbsolute(linkedPath) ? linkedPath : path13.resolve(path13.dirname(target), linkedPath);
+        const resolvedLinkedPath = path12.isAbsolute(linkedPath) ? linkedPath : path12.resolve(path12.dirname(target), linkedPath);
         const linkedTargetExists = await fs9.stat(resolvedLinkedPath).then(() => true).catch(() => false);
         if (!linkedTargetExists) {
           await fs9.unlink(target);
@@ -16683,7 +16968,7 @@ function registerAgentCommands(program) {
         if (opts.markdown && opts.markdownFile) {
           throw new Error("Pass only one of --markdown or --markdown-file.");
         }
-        const markdown = opts.markdownFile ? await fs9.readFile(path13.resolve(opts.markdownFile), "utf8") : opts.markdown;
+        const markdown = opts.markdownFile ? await fs9.readFile(path12.resolve(opts.markdownFile), "utf8") : opts.markdown;
         const payload = organizationSkillCreateSchema.parse({
           name: opts.name,
           slug: opts.slug?.trim() || null,
@@ -16862,7 +17147,7 @@ function registerAgentCommands(program) {
         }
         const installSummaries = [];
         if (opts.installSkills !== false) {
-          const skillsDir = await resolveRudderSkillsDir(__moduleDir, [path13.resolve(process.cwd(), "skills")]);
+          const skillsDir = await resolveRudderSkillsDir(__moduleDir, [path12.resolve(process.cwd(), "skills")]);
           if (!skillsDir) {
             throw new Error(
               "Could not locate local Rudder skills directory. Expected ./skills in the repo checkout."
@@ -16950,10 +17235,10 @@ async function buildAgentUpdatePatch(opts) {
   if (opts.capabilities !== void 0) rawPatch.capabilities = opts.capabilities;
   if (opts.description !== void 0) rawPatch.capabilities = opts.description;
   if (opts.capabilitiesFile !== void 0) {
-    rawPatch.capabilities = await fs9.readFile(path13.resolve(opts.capabilitiesFile), "utf8");
+    rawPatch.capabilities = await fs9.readFile(path12.resolve(opts.capabilitiesFile), "utf8");
   }
   if (opts.descriptionFile !== void 0) {
-    rawPatch.capabilities = await fs9.readFile(path13.resolve(opts.descriptionFile), "utf8");
+    rawPatch.capabilities = await fs9.readFile(path12.resolve(opts.descriptionFile), "utf8");
   }
   if (clearCapabilities) rawPatch.capabilities = null;
   return updateAgentSchema.parse(rawPatch);
@@ -16977,7 +17262,7 @@ function parseJsonObject(value, name) {
 // src/commands/client/approval.ts
 init_dist2();
 import { readFile as readFile2 } from "node:fs/promises";
-import path14 from "node:path";
+import path13 from "node:path";
 function registerApprovalCommands(program) {
   const approval = program.command("approval").description("Approval operations");
   addCommonClientOptions(
@@ -17168,7 +17453,7 @@ async function readTextInputFile(inputPath, optionName) {
   if (inputPath === "-") {
     return readStdinText();
   }
-  const resolvedPath = path14.resolve(process.cwd(), inputPath);
+  const resolvedPath = path13.resolve(process.cwd(), inputPath);
   return readFile2(resolvedPath, "utf8").catch((err) => {
     throw new Error(`Unable to read ${optionName} ${inputPath}: ${err instanceof Error ? err.message : String(err)}`);
   });
@@ -18005,12 +18290,12 @@ async function readStdin() {
 
 // src/commands/client/company.ts
 import * as p3 from "@clack/prompts";
-import { mkdir as mkdir3, readdir as readdir2, readFile as readFile3, stat as stat4, writeFile as writeFile2 } from "node:fs/promises";
-import path16 from "node:path";
+import { mkdir as mkdir2, readdir as readdir2, readFile as readFile3, stat as stat2, writeFile as writeFile2 } from "node:fs/promises";
+import path15 from "node:path";
 import pc5 from "picocolors";
 
 // src/commands/client/zip.ts
-import path15 from "node:path";
+import path14 from "node:path";
 import { inflateRawSync } from "node:zlib";
 var textDecoder = new TextDecoder();
 var binaryContentTypeByExtension = {
@@ -18038,7 +18323,7 @@ function sharedArchiveRoot(paths) {
   return firstSegments.every((parts) => parts.length > 1 && parts[0] === candidate) ? candidate : null;
 }
 function bytesToPortableFileEntry(pathValue, bytes) {
-  const contentType = binaryContentTypeByExtension[path15.extname(pathValue).toLowerCase()];
+  const contentType = binaryContentTypeByExtension[path14.extname(pathValue).toLowerCase()];
   if (!contentType) return textDecoder.decode(bytes);
   return {
     encoding: "base64",
@@ -18126,7 +18411,7 @@ var IMPORT_INCLUDE_OPTIONS = [
 ];
 var IMPORT_PREVIEW_SAMPLE_LIMIT = 6;
 function readPortableFileEntry(filePath, contents) {
-  const contentType = binaryContentTypeByExtension[path16.extname(filePath).toLowerCase()];
+  const contentType = binaryContentTypeByExtension[path15.extname(filePath).toLowerCase()];
   if (!contentType) return contents.toString("utf8");
   return {
     encoding: "base64",
@@ -18181,10 +18466,10 @@ function normalizePortablePath(filePath) {
   return filePath.replace(/\\/g, "/");
 }
 function shouldIncludePortableFile(filePath) {
-  const baseName = path16.basename(filePath);
+  const baseName = path15.basename(filePath);
   const isMarkdown = baseName.endsWith(".md");
   const isPaperclipYaml = baseName === ".rudder.yaml" || baseName === ".rudder.yml";
-  const contentType = binaryContentTypeByExtension[path16.extname(baseName).toLowerCase()];
+  const contentType = binaryContentTypeByExtension[path15.extname(baseName).toLowerCase()];
   return isMarkdown || isPaperclipYaml || Boolean(contentType);
 }
 function findPortableExtensionPath(files) {
@@ -18739,7 +19024,7 @@ function normalizeGithubImportSource(input, refOverride) {
 }
 async function pathExists(inputPath) {
   try {
-    await stat4(path16.resolve(inputPath));
+    await stat2(path15.resolve(inputPath));
     return true;
   } catch {
     return false;
@@ -18749,45 +19034,45 @@ async function collectPackageFiles(root, current, files) {
   const entries = await readdir2(current, { withFileTypes: true });
   for (const entry of entries) {
     if (entry.name.startsWith(".git")) continue;
-    const absolutePath = path16.join(current, entry.name);
+    const absolutePath = path15.join(current, entry.name);
     if (entry.isDirectory()) {
       await collectPackageFiles(root, absolutePath, files);
       continue;
     }
     if (!entry.isFile()) continue;
-    const relativePath = path16.relative(root, absolutePath).replace(/\\/g, "/");
+    const relativePath = path15.relative(root, absolutePath).replace(/\\/g, "/");
     if (!shouldIncludePortableFile(relativePath)) continue;
     files[relativePath] = readPortableFileEntry(relativePath, await readFile3(absolutePath));
   }
 }
 async function resolveInlineSourceFromPath(inputPath) {
-  const resolved = path16.resolve(inputPath);
-  const resolvedStat = await stat4(resolved);
-  if (resolvedStat.isFile() && path16.extname(resolved).toLowerCase() === ".zip") {
+  const resolved = path15.resolve(inputPath);
+  const resolvedStat = await stat2(resolved);
+  if (resolvedStat.isFile() && path15.extname(resolved).toLowerCase() === ".zip") {
     const archive = await readZipArchive(await readFile3(resolved));
     const filteredFiles = Object.fromEntries(
       Object.entries(archive.files).filter(([relativePath]) => shouldIncludePortableFile(relativePath))
     );
     return {
-      rootPath: archive.rootPath ?? path16.basename(resolved, ".zip"),
+      rootPath: archive.rootPath ?? path15.basename(resolved, ".zip"),
       files: filteredFiles
     };
   }
-  const rootDir = resolvedStat.isDirectory() ? resolved : path16.dirname(resolved);
+  const rootDir = resolvedStat.isDirectory() ? resolved : path15.dirname(resolved);
   const files = {};
   await collectPackageFiles(rootDir, rootDir, files);
   return {
-    rootPath: path16.basename(rootDir),
+    rootPath: path15.basename(rootDir),
     files
   };
 }
 async function writeExportToFolder(outDir, exported) {
-  const root = path16.resolve(outDir);
-  await mkdir3(root, { recursive: true });
+  const root = path15.resolve(outDir);
+  await mkdir2(root, { recursive: true });
   for (const [relativePath, content] of Object.entries(exported.files)) {
     const normalized = relativePath.replace(/\\/g, "/");
-    const filePath = path16.join(root, normalized);
-    await mkdir3(path16.dirname(filePath), { recursive: true });
+    const filePath = path15.join(root, normalized);
+    await mkdir2(path15.dirname(filePath), { recursive: true });
     const writeValue = portableFileEntryToWriteValue(content);
     if (typeof writeValue === "string") {
       await writeFile2(filePath, writeValue, "utf8");
@@ -18797,8 +19082,8 @@ async function writeExportToFolder(outDir, exported) {
   }
 }
 async function confirmOverwriteExportDirectory(outDir) {
-  const root = path16.resolve(outDir);
-  const stats = await stat4(root).catch(() => null);
+  const root = path15.resolve(outDir);
+  const stats = await stat2(root).catch(() => null);
   if (!stats) return;
   if (!stats.isDirectory()) {
     throw new Error(`Export output path ${root} exists and is not a directory.`);
@@ -18979,7 +19264,7 @@ function registerCompanyCommands(program) {
         printOutput(
           {
             ok: true,
-            out: path16.resolve(opts.out),
+            out: path15.resolve(opts.out),
             rootPath: exported.rootPath,
             filesWritten: Object.keys(exported.files).length,
             rudderExtensionPath: exported.rudderExtensionPath,
@@ -19477,8 +19762,8 @@ function parseResultValue(value) {
 
 // src/commands/client/issue.ts
 init_dist2();
-import { readFile as readFile4, stat as stat5 } from "node:fs/promises";
-import path17 from "node:path";
+import { readFile as readFile4, stat as stat3 } from "node:fs/promises";
+import path16 from "node:path";
 function registerIssueCommands(program) {
   const issue = program.command("issue").description("Issue operations");
   addCommonClientOptions(
@@ -19842,7 +20127,7 @@ async function readTextInputFile2(inputPath, optionName) {
   if (inputPath === "-") {
     return readStdinText2();
   }
-  const resolvedPath = path17.resolve(process.cwd(), inputPath);
+  const resolvedPath = path16.resolve(process.cwd(), inputPath);
   return readFile4(resolvedPath, "utf8").catch((err) => {
     throw new Error(`Unable to read ${optionName} ${inputPath}: ${err instanceof Error ? err.message : String(err)}`);
   });
@@ -19899,14 +20184,14 @@ async function appendUploadedIssueImages(ctx, issueId, body, imagePaths) {
 ${imageBlock}` : imageBlock;
 }
 async function uploadIssueCommentImage(ctx, issue, imagePath) {
-  const resolvedPath = path17.resolve(process.cwd(), imagePath);
-  const stats = await stat5(resolvedPath).catch((err) => {
+  const resolvedPath = path16.resolve(process.cwd(), imagePath);
+  const stats = await stat3(resolvedPath).catch((err) => {
     throw new Error(`Unable to read image ${imagePath}: ${err instanceof Error ? err.message : String(err)}`);
   });
   if (!stats.isFile()) {
     throw new Error(`Image path must be a file: ${imagePath}`);
   }
-  const filename = path17.basename(resolvedPath);
+  const filename = path16.basename(resolvedPath);
   const contentType = inferCommentImageContentType(filename);
   const buffer = await readFile4(resolvedPath);
   if (buffer.length <= 0) {
@@ -19925,7 +20210,7 @@ async function uploadIssueCommentImage(ctx, issue, imagePath) {
   return attachment;
 }
 function inferCommentImageContentType(filename) {
-  const ext = path17.extname(filename).toLowerCase();
+  const ext = path16.extname(filename).toLowerCase();
   switch (ext) {
     case ".png":
       return "image/png";
@@ -20029,7 +20314,7 @@ function formatIssueSearchMatch(match) {
 
 // src/commands/client/library.ts
 import { readFile as readFile5 } from "node:fs/promises";
-import path18 from "node:path";
+import path17 from "node:path";
 function toLibraryFileLinkResult(detail) {
   return {
     filePath: detail.filePath,
@@ -20174,7 +20459,7 @@ async function resolveBodyFileInput(inputPath) {
   if (inputPath === "-") {
     return readStdinText3();
   }
-  const resolvedPath = path18.resolve(process.cwd(), inputPath);
+  const resolvedPath = path17.resolve(process.cwd(), inputPath);
   return readFile5(resolvedPath, "utf8").catch((err) => {
     throw new Error(`Unable to read --body-file ${inputPath}: ${err instanceof Error ? err.message : String(err)}`);
   });
@@ -20933,8 +21218,8 @@ function registerUserCommands(program) {
         appendParam(params, "limit", opts.limit);
         appendParam(params, "cursor", opts.cursor);
         const query = params.toString();
-        const path26 = `/api/orgs/${ctx.orgId}/users/${encodeURIComponent(userId)}/activity-ledger${query ? `?${query}` : ""}`;
-        const result = await ctx.api.get(path26);
+        const path25 = `/api/orgs/${ctx.orgId}/users/${encodeURIComponent(userId)}/activity-ledger${query ? `?${query}` : ""}`;
+        const result = await ctx.api.get(path25);
         if (ctx.json) {
           printOutput(result, { json: true });
           return;
@@ -21751,9 +22036,9 @@ import * as p15 from "@clack/prompts";
 import { spawn as spawn3, spawnSync as spawnSync4 } from "node:child_process";
 import { createHash as createHash4, randomUUID } from "node:crypto";
 import { constants as fsConstants, mkdirSync as mkdirSync2, readFileSync as readFileSync2 } from "node:fs";
-import { access, chmod, copyFile as copyFile2, cp as cp2, lstat, mkdir as mkdir4, mkdtemp as mkdtemp2, readdir as readdir3, readFile as readFile6, rm as rm3, stat as stat6, utimes, writeFile as writeFile3 } from "node:fs/promises";
+import { access, chmod as chmod2, copyFile, cp, lstat, mkdir as mkdir3, mkdtemp as mkdtemp2, readdir as readdir3, readFile as readFile6, rm as rm3, stat as stat4, utimes, writeFile as writeFile3 } from "node:fs/promises";
 import { homedir, tmpdir } from "node:os";
-import path24 from "node:path";
+import path23 from "node:path";
 import { clearTimeout as clearTimeout3, setTimeout as setTimeout3 } from "node:timers";
 import { setTimeout as delay2 } from "node:timers/promises";
 import pc14 from "picocolors";
@@ -21782,11 +22067,11 @@ init_home();
 
 // src/desktop-download.ts
 import { createHash as createHash3 } from "node:crypto";
-import { createWriteStream as createWriteStream2, mkdirSync } from "node:fs";
+import { createWriteStream as createWriteStream3, mkdirSync } from "node:fs";
 import { rm as rm2 } from "node:fs/promises";
-import path23 from "node:path";
+import path22 from "node:path";
 import { Readable as Readable2, Transform as Transform2 } from "node:stream";
-import { pipeline as pipeline2 } from "node:stream/promises";
+import { pipeline as pipeline3 } from "node:stream/promises";
 import { clearTimeout as clearTimeout2, setTimeout as setTimeout2 } from "node:timers";
 
 // src/utils/progress.ts
@@ -22024,7 +22309,7 @@ async function resolveDesktopDownloadOrigins(options) {
 }
 async function downloadAsset(asset, outputDir, progressFactory = createByteProgress, expectedChecksum, timeouts = {}) {
   mkdirSync(outputDir, { recursive: true });
-  const outputPath = path23.join(outputDir, path23.basename(asset.name));
+  const outputPath = path22.join(outputDir, path22.basename(asset.name));
   const idleTimeoutMs = timeouts.idleMs ?? DESKTOP_ASSET_IDLE_TIMEOUT_MS;
   const responseTimeoutMs = timeouts.responseMs ?? DESKTOP_ASSET_RESPONSE_TIMEOUT_MS;
   const failures = [];
@@ -22064,7 +22349,7 @@ async function downloadAsset(asset, outputDir, progressFactory = createByteProgr
       });
       progress.start(totalBytes);
       armIdleTimeout();
-      await pipeline2(Readable2.fromWeb(response.body), monitor, createWriteStream2(outputPath));
+      await pipeline3(Readable2.fromWeb(response.body), monitor, createWriteStream3(outputPath));
       if (idleTimeout) clearTimeout2(idleTimeout);
       idleTimeout = null;
       const actualChecksum = hash.digest("hex");
@@ -22128,6 +22413,15 @@ var DEFAULT_DESKTOP_ASSET_CACHE_MAX_BYTES = 768 * 1024 * 1024;
 var DEFAULT_DESKTOP_ASSET_CACHE_KEEP_PREVIOUS = 1;
 var DESKTOP_INSTALL_LOCK_TIMEOUT_MS = 60 * 60 * 1e3;
 var DESKTOP_INSTALL_LOCK_POLL_MS = 250;
+var DESKTOP_RUNTIME_PREPARE_TIMEOUT_MS = 9e4;
+async function waitForDesktopRuntimeSmokeEvidence(envName) {
+  if (process.env.RUDDER_DESKTOP_SMOKE_AUTO_UPDATE_PUBLIC !== "1") return;
+  const value = Number(process.env[envName]);
+  if (!Number.isFinite(value) || value <= 0) return;
+  await delay2(Math.min(value, 1e4));
+}
+var DEFAULT_GITHUB_API_BASE_URL = "https://api.github.com";
+var DEFAULT_GITHUB_DOWNLOAD_BASE_URL = "https://github.com";
 function normalizeProgressTotal(totalBytes) {
   return typeof totalBytes === "number" && Number.isFinite(totalBytes) && totalBytes > 0 ? totalBytes : null;
 }
@@ -22351,38 +22645,38 @@ function resolveDesktopAssetTarget(platform = process.platform, arch = process.a
   throw new Error(`Rudder Desktop does not publish portable assets for ${platform}.`);
 }
 function resolveDefaultDesktopInstallRoot(target, env = process.env, homeDir = homedir()) {
-  if (target.platform === "macos") return path24.join(homeDir, "Applications");
+  if (target.platform === "macos") return path23.join(homeDir, "Applications");
   if (target.platform === "windows") {
-    const localAppData = env.LOCALAPPDATA?.trim() || path24.join(homeDir, "AppData", "Local");
-    return path24.join(localAppData, "Programs", DESKTOP_APP_NAME);
+    const localAppData = env.LOCALAPPDATA?.trim() || path23.join(homeDir, "AppData", "Local");
+    return path23.join(localAppData, "Programs", DESKTOP_APP_NAME);
   }
-  return path24.join(homeDir, ".local", "share", "rudder");
+  return path23.join(homeDir, ".local", "share", "rudder");
 }
 function resolveDesktopInstallPaths(target, installRoot) {
-  const root = path24.resolve(installRoot);
+  const root = path23.resolve(installRoot);
   if (target.platform === "macos") {
-    const appPath2 = path24.join(root, `${DESKTOP_APP_NAME}.app`);
+    const appPath2 = path23.join(root, `${DESKTOP_APP_NAME}.app`);
     return {
       installRoot: root,
       appPath: appPath2,
-      executablePath: path24.join(appPath2, "Contents", "MacOS", DESKTOP_APP_NAME),
-      metadataPath: path24.join(root, DESKTOP_METADATA_FILE)
+      executablePath: path23.join(appPath2, "Contents", "MacOS", DESKTOP_APP_NAME),
+      metadataPath: path23.join(root, DESKTOP_METADATA_FILE)
     };
   }
   if (target.platform === "windows") {
     return {
       installRoot: root,
       appPath: root,
-      executablePath: path24.join(root, `${DESKTOP_APP_NAME}.exe`),
-      metadataPath: path24.join(root, DESKTOP_METADATA_FILE)
+      executablePath: path23.join(root, `${DESKTOP_APP_NAME}.exe`),
+      metadataPath: path23.join(root, DESKTOP_METADATA_FILE)
     };
   }
-  const appPath = path24.join(root, `${DESKTOP_APP_NAME}.AppImage`);
+  const appPath = path23.join(root, `${DESKTOP_APP_NAME}.AppImage`);
   return {
     installRoot: root,
     appPath,
     executablePath: appPath,
-    metadataPath: path24.join(root, DESKTOP_METADATA_FILE)
+    metadataPath: path23.join(root, DESKTOP_METADATA_FILE)
   };
 }
 function normalizeAssetName(name) {
@@ -22441,10 +22735,20 @@ function resolveDesktopAssetCandidates(options) {
   const candidates = [];
   const deterministicShellName = options.directReleaseVersion ? resolveDesktopShellAssetName(options.directReleaseVersion, options.target) : null;
   if (options.allowShellAssets !== false) {
-    const shellAsset = selectDesktopShellAsset(options.releaseAssets, options.target) ?? (options.releaseAssets.length === 0 && deterministicShellName ? buildGithubReleaseAsset(options.repo, options.tag, deterministicShellName) : null);
+    const shellAsset = selectDesktopShellAsset(options.releaseAssets, options.target) ?? (options.releaseAssets.length === 0 && deterministicShellName ? buildGithubReleaseAsset(
+      options.repo,
+      options.tag,
+      deterministicShellName,
+      options.downloadBaseUrl
+    ) : null);
     if (shellAsset) candidates.push({ asset: shellAsset, kind: "shell" });
   }
-  const fullAsset = selectDesktopAsset(options.releaseAssets, options.target) ?? (options.directReleaseVersion ? buildGithubReleaseAsset(options.repo, options.tag, resolveDesktopAssetName(options.directReleaseVersion, options.target)) : null);
+  const fullAsset = selectDesktopAsset(options.releaseAssets, options.target) ?? (options.directReleaseVersion ? buildGithubReleaseAsset(
+    options.repo,
+    options.tag,
+    resolveDesktopAssetName(options.directReleaseVersion, options.target),
+    options.downloadBaseUrl
+  ) : null);
   if (fullAsset) candidates.push({ asset: fullAsset, kind: "full" });
   return candidates;
 }
@@ -22488,8 +22792,35 @@ function githubApiHeaders() {
   };
 }
 var GITHUB_API_TIMEOUT_MS = 15e3;
-async function fetchGithubRelease(repo, tag) {
-  const endpoint = tag === "latest" ? `https://api.github.com/repos/${repo}/releases/latest` : `https://api.github.com/repos/${repo}/releases/tags/${encodeURIComponent(tag)}`;
+function resolveDesktopSmokeReleaseBaseUrls(env = process.env) {
+  if (env.RUDDER_DESKTOP_SMOKE_AUTO_UPDATE_PUBLIC !== "1") {
+    return {
+      apiBaseUrl: DEFAULT_GITHUB_API_BASE_URL,
+      downloadBaseUrl: DEFAULT_GITHUB_DOWNLOAD_BASE_URL
+    };
+  }
+  const normalizeBaseUrl = (value, fallback) => {
+    const configured = value?.trim();
+    if (!configured) return fallback;
+    const parsed = new URL(configured);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+      throw new Error(`Desktop smoke release base URL must use HTTP or HTTPS: ${configured}`);
+    }
+    return configured.replace(/\/+$/u, "");
+  };
+  return {
+    apiBaseUrl: normalizeBaseUrl(
+      env.RUDDER_DESKTOP_SMOKE_RELEASE_API_BASE_URL,
+      DEFAULT_GITHUB_API_BASE_URL
+    ),
+    downloadBaseUrl: normalizeBaseUrl(
+      env.RUDDER_DESKTOP_SMOKE_RELEASE_DOWNLOAD_BASE_URL,
+      DEFAULT_GITHUB_DOWNLOAD_BASE_URL
+    )
+  };
+}
+async function fetchGithubRelease(repo, tag, apiBaseUrl = DEFAULT_GITHUB_API_BASE_URL) {
+  const endpoint = tag === "latest" ? `${apiBaseUrl}/repos/${repo}/releases/latest` : `${apiBaseUrl}/repos/${repo}/releases/tags/${encodeURIComponent(tag)}`;
   const response = await fetchWithTimeout2(endpoint, { headers: githubApiHeaders() }, GITHUB_API_TIMEOUT_MS);
   if (!response.ok) {
     throw new Error(`GitHub Release ${tag} was not found in ${repo} (${response.status}).`);
@@ -22517,14 +22848,14 @@ function resolveDesktopShellAssetName(version, target) {
 function encodeReleaseTagForDownloadUrl2(tag) {
   return tag.split("/").map((segment) => encodeURIComponent(segment)).join("/");
 }
-function buildGithubReleaseAssetDownloadUrl(repo, tag, assetName) {
+function buildGithubReleaseAssetDownloadUrl(repo, tag, assetName, downloadBaseUrl = DEFAULT_GITHUB_DOWNLOAD_BASE_URL) {
   const encodedTag = encodeReleaseTagForDownloadUrl2(tag);
-  return `https://github.com/${repo}/releases/download/${encodedTag}/${encodeURIComponent(assetName)}`;
+  return `${downloadBaseUrl}/${repo}/releases/download/${encodedTag}/${encodeURIComponent(assetName)}`;
 }
-function buildGithubReleaseAsset(repo, tag, assetName) {
+function buildGithubReleaseAsset(repo, tag, assetName, downloadBaseUrl) {
   return {
     name: assetName,
-    browser_download_url: buildGithubReleaseAssetDownloadUrl(repo, tag, assetName)
+    browser_download_url: buildGithubReleaseAssetDownloadUrl(repo, tag, assetName, downloadBaseUrl)
   };
 }
 function checksumForFile(filePath) {
@@ -22533,16 +22864,16 @@ function checksumForFile(filePath) {
   return hash.digest("hex");
 }
 function resolveAssetChecksum(checksums, assetName) {
-  const expected = checksums.get(path24.basename(assetName));
+  const expected = checksums.get(path23.basename(assetName));
   if (!expected) {
-    throw new Error(`Desktop release checksums do not include ${path24.basename(assetName)}.`);
+    throw new Error(`Desktop release checksums do not include ${path23.basename(assetName)}.`);
   }
   return expected;
 }
 function assertChecksumMatch(filePath, expected) {
   const actual = checksumForFile(filePath);
   if (actual !== expected.toLowerCase()) {
-    throw new Error(`Checksum mismatch for ${path24.basename(filePath)}.`);
+    throw new Error(`Checksum mismatch for ${path23.basename(filePath)}.`);
   }
   return actual;
 }
@@ -22561,10 +22892,10 @@ function normalizeDesktopAssetChecksum(checksum) {
   return normalized;
 }
 function resolveDesktopAssetCacheDir(assetChecksum, homeDir = resolveRudderHomeDir()) {
-  return path24.join(homeDir, DESKTOP_ASSET_CACHE_DIR, normalizeDesktopAssetChecksum(assetChecksum));
+  return path23.join(homeDir, DESKTOP_ASSET_CACHE_DIR, normalizeDesktopAssetChecksum(assetChecksum));
 }
 function resolveDesktopCachedAssetPath(assetName, assetChecksum, homeDir = resolveRudderHomeDir()) {
-  return path24.join(resolveDesktopAssetCacheDir(assetChecksum, homeDir), path24.basename(assetName));
+  return path23.join(resolveDesktopAssetCacheDir(assetChecksum, homeDir), path23.basename(assetName));
 }
 async function pruneDesktopAssetCache(options = {}) {
   const homeDir = options.homeDir ?? resolveRudderHomeDir();
@@ -22610,7 +22941,7 @@ async function maybePruneDesktopAssetCache(options) {
   return result.deleted.length > 0 || result.warnings.length > 0 ? result : null;
 }
 async function scanDesktopAssetCacheEntries(homeDir) {
-  const cacheRoot = path24.join(homeDir, DESKTOP_ASSET_CACHE_DIR);
+  const cacheRoot = path23.join(homeDir, DESKTOP_ASSET_CACHE_DIR);
   const dirents = await readdir3(cacheRoot, { withFileTypes: true }).catch(() => null);
   if (!dirents) return [];
   const entries = [];
@@ -22622,7 +22953,7 @@ async function scanDesktopAssetCacheEntries(homeDir) {
     } catch {
       continue;
     }
-    const cacheDir = path24.join(cacheRoot, dirent.name);
+    const cacheDir = path23.join(cacheRoot, dirent.name);
     const stats = await desktopCacheDirectoryStats(cacheDir);
     entries.push({
       cacheDir,
@@ -22634,7 +22965,7 @@ async function scanDesktopAssetCacheEntries(homeDir) {
   return entries;
 }
 async function desktopCacheDirectoryStats(targetPath) {
-  const fallbackStat = await stat6(targetPath).catch(() => null);
+  const fallbackStat = await stat4(targetPath).catch(() => null);
   const dirents = await readdir3(targetPath, { withFileTypes: true }).catch(() => null);
   if (!dirents) {
     return {
@@ -22646,8 +22977,8 @@ async function desktopCacheDirectoryStats(targetPath) {
   let lastUsedAtMs = Number(fallbackStat?.mtimeMs ?? 0);
   for (const dirent of dirents) {
     if (dirent.isSymbolicLink()) continue;
-    const entryPath = path24.join(targetPath, dirent.name);
-    const entryStat = await stat6(entryPath).catch(() => null);
+    const entryPath = path23.join(targetPath, dirent.name);
+    const entryStat = await stat4(entryPath).catch(() => null);
     if (!entryStat) continue;
     lastUsedAtMs = Math.max(lastUsedAtMs, Number(entryStat.mtimeMs ?? 0));
     if (dirent.isDirectory()) {
@@ -22723,14 +23054,14 @@ async function downloadDesktopAssetWithCache(asset, expectedChecksum, options =
       await rm3(cachePath, { force: true });
     }
   }
-  const outputDir = options.outputDir ?? await mkdtemp2(path24.join(tmpdir(), "rudder-desktop-installer."));
+  const outputDir = options.outputDir ?? await mkdtemp2(path23.join(tmpdir(), "rudder-desktop-installer."));
   const removeOutputDir = options.outputDir ? false : true;
   try {
     const downloadedPath = await downloadAsset(asset, outputDir, options.progressFactory, normalizedChecksum);
     const checksum = assertChecksumMatch(downloadedPath, normalizedChecksum);
-    await mkdir4(path24.dirname(cachePath), { recursive: true });
-    if (path24.resolve(downloadedPath) !== path24.resolve(cachePath)) {
-      await copyFile2(downloadedPath, cachePath);
+    await mkdir3(path23.dirname(cachePath), { recursive: true });
+    if (path23.resolve(downloadedPath) !== path23.resolve(cachePath)) {
+      await copyFile(downloadedPath, cachePath);
     }
     return { path: cachePath, checksum, cacheStatus: "miss" };
   } finally {
@@ -22746,8 +23077,8 @@ async function pathExists2(targetPath) {
   }
 }
 function resolveDesktopInstallLockPath(paths) {
-  const installRootHash = createHash4("sha256").update(path24.resolve(paths.installRoot)).digest("hex").slice(0, 16);
-  return path24.join(path24.dirname(paths.appPath), `.rudder-desktop-install-${installRootHash}.lock`);
+  const installRootHash = createHash4("sha256").update(path23.resolve(paths.installRoot)).digest("hex").slice(0, 16);
+  return path23.join(path23.dirname(paths.appPath), `.rudder-desktop-install-${installRootHash}.lock`);
 }
 async function readDesktopInstallLock(lockPath) {
   try {
@@ -22767,17 +23098,17 @@ async function readDesktopInstallLock(lockPath) {
 }
 async function withDesktopInstallLock(paths, fn, options = {}) {
   const lockPath = resolveDesktopInstallLockPath(paths);
-  const lockDir = path24.dirname(lockPath);
+  const lockDir = path23.dirname(lockPath);
   const timeoutMs = options.timeoutMs ?? DESKTOP_INSTALL_LOCK_TIMEOUT_MS;
   const pollMs = options.pollMs ?? DESKTOP_INSTALL_LOCK_POLL_MS;
   const startedAt = Date.now();
   const payload = {
     lockId: randomUUID(),
     pid: process.pid,
-    installRoot: path24.resolve(paths.installRoot),
+    installRoot: path23.resolve(paths.installRoot),
     createdAt: (/* @__PURE__ */ new Date()).toISOString()
   };
-  await mkdir4(lockDir, { recursive: true });
+  await mkdir3(lockDir, { recursive: true });
   while (true) {
     try {
       await writeFile3(lockPath, `${JSON.stringify(payload, null, 2)}
@@ -22834,7 +23165,7 @@ function isSuccessfulRobocopyExitCode(status) {
 }
 async function extractZip(zipPath, outputDir, target) {
   await rm3(outputDir, { recursive: true, force: true });
-  await mkdir4(outputDir, { recursive: true });
+  await mkdir3(outputDir, { recursive: true });
   if (target.platform === "macos") {
     runChecked("ditto", ["-x", "-k", zipPath, outputDir]);
     return;
@@ -22850,7 +23181,7 @@ async function findPath(root, predicate, maxDepth = 5) {
   async function visit(dir, depth) {
     const entries = await readdir3(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = path24.join(dir, entry.name);
+      const fullPath = path23.join(dir, entry.name);
       if (predicate(fullPath, entry.isDirectory())) return fullPath;
       if (entry.isDirectory() && depth < maxDepth) {
         const nested = await visit(fullPath, depth + 1);
@@ -22862,18 +23193,18 @@ async function findPath(root, predicate, maxDepth = 5) {
   return await visit(root, 0);
 }
 async function findMacApp(extractDir) {
-  const direct = path24.join(extractDir, `${DESKTOP_APP_NAME}.app`);
+  const direct = path23.join(extractDir, `${DESKTOP_APP_NAME}.app`);
   if (await pathExists2(direct)) return direct;
-  const found = await findPath(extractDir, (filePath, isDirectory) => isDirectory && path24.basename(filePath) === `${DESKTOP_APP_NAME}.app`);
+  const found = await findPath(extractDir, (filePath, isDirectory) => isDirectory && path23.basename(filePath) === `${DESKTOP_APP_NAME}.app`);
   if (!found) throw new Error(`Portable macOS archive did not contain ${DESKTOP_APP_NAME}.app.`);
   return found;
 }
 async function findWindowsAppDir(extractDir) {
-  const direct = path24.join(extractDir, `${DESKTOP_APP_NAME}.exe`);
+  const direct = path23.join(extractDir, `${DESKTOP_APP_NAME}.exe`);
   if (await pathExists2(direct)) return extractDir;
-  const executable = await findPath(extractDir, (filePath, isDirectory) => !isDirectory && path24.basename(filePath).toLowerCase() === `${DESKTOP_APP_NAME.toLowerCase()}.exe`);
+  const executable = await findPath(extractDir, (filePath, isDirectory) => !isDirectory && path23.basename(filePath).toLowerCase() === `${DESKTOP_APP_NAME.toLowerCase()}.exe`);
   if (!executable) throw new Error(`Portable Windows archive did not contain ${DESKTOP_APP_NAME}.exe.`);
-  return path24.dirname(executable);
+  return path23.dirname(executable);
 }
 async function readInstallMetadata(metadataPath) {
   try {
@@ -22941,7 +23272,7 @@ async function waitForUpdateQuitResponse(responsePath, timeoutMs = 8e3) {
 }
 async function requestDesktopQuit(executablePath, target, options = {}) {
   if (!await pathExists2(executablePath)) return { ok: true, status: "not_running" };
-  const responsePath = path24.join(tmpdir(), `rudder-update-quit-${process.pid}-${Date.now()}.json`);
+  const responsePath = path23.join(tmpdir(), `rudder-update-quit-${process.pid}-${Date.now()}.json`);
   const result = spawnSync4(executablePath, [
     `${DESKTOP_UPDATE_QUIT_ARG}=${responsePath}`,
     ...options.forceUpdate ? [DESKTOP_UPDATE_FORCE_ARG] : []
@@ -23099,13 +23430,13 @@ async function prepareForDesktopReplace(paths, target, options = {}) {
   throw new Error(`Failed to replace existing Rudder Desktop at ${replacePath}. Close Rudder and rerun start.`);
 }
 async function installPortableDesktop(installerPath, paths, target) {
-  await mkdir4(paths.installRoot, { recursive: true });
+  await mkdir3(paths.installRoot, { recursive: true });
   if (target.platform === "linux") {
-    await copyFile2(installerPath, paths.appPath);
-    await chmod(paths.appPath, 493);
+    await copyFile(installerPath, paths.appPath);
+    await chmod2(paths.appPath, 493);
     return;
   }
-  const extractDir = await mkdtemp2(path24.join(tmpdir(), "rudder-desktop-extract."));
+  const extractDir = await mkdtemp2(path23.join(tmpdir(), "rudder-desktop-extract."));
   try {
     await extractZip(installerPath, extractDir, target);
     if (target.platform === "macos") {
@@ -23114,7 +23445,7 @@ async function installPortableDesktop(installerPath, paths, target) {
       return;
     }
     const appSource = await findWindowsAppDir(extractDir);
-    await mkdir4(path24.dirname(paths.installRoot), { recursive: true });
+    await mkdir3(path23.dirname(paths.installRoot), { recursive: true });
     await copyPortableAppBundle(appSource, paths.installRoot);
   } finally {
     await rm3(extractDir, { recursive: true, force: true });
@@ -23122,7 +23453,7 @@ async function installPortableDesktop(installerPath, paths, target) {
 }
 async function copyPortableAppBundle(sourcePath, destinationPath) {
   if (process.platform === "win32") {
-    await mkdir4(destinationPath, { recursive: true });
+    await mkdir3(destinationPath, { recursive: true });
     const command = buildWindowsRobocopyMirrorCommand(sourcePath, destinationPath);
     const result = spawnSync4(command.command, command.args, {
       encoding: "utf8",
@@ -23131,7 +23462,7 @@ async function copyPortableAppBundle(sourcePath, destinationPath) {
     if (isSuccessfulRobocopyExitCode(result.status)) return;
     throw new Error(formatCommandFailure(command.command, command.args, result.stdout, result.stderr));
   }
-  await cp2(sourcePath, destinationPath, { recursive: true, verbatimSymlinks: true });
+  await cp(sourcePath, destinationPath, { recursive: true, verbatimSymlinks: true });
 }
 async function removeMacQuarantine(paths, target) {
   if (target.platform !== "macos") return;
@@ -23155,26 +23486,26 @@ function buildLinuxDesktopEntry(executablePath) {
   ].join("\n");
 }
 async function writeLinuxLaunchers(paths) {
-  const desktopDir = path24.join(homedir(), ".local", "share", "applications");
-  await mkdir4(desktopDir, { recursive: true });
-  await writeFile3(path24.join(desktopDir, "rudder.desktop"), buildLinuxDesktopEntry(paths.executablePath), "utf8");
-  const binDir = path24.join(homedir(), ".local", "bin");
-  await mkdir4(binDir, { recursive: true });
-  const wrapperPath = path24.join(binDir, "rudder-desktop");
+  const desktopDir = path23.join(homedir(), ".local", "share", "applications");
+  await mkdir3(desktopDir, { recursive: true });
+  await writeFile3(path23.join(desktopDir, "rudder.desktop"), buildLinuxDesktopEntry(paths.executablePath), "utf8");
+  const binDir = path23.join(homedir(), ".local", "bin");
+  await mkdir3(binDir, { recursive: true });
+  const wrapperPath = path23.join(binDir, "rudder-desktop");
   const escaped = paths.executablePath.replaceAll("'", `'"'"'`);
   await writeFile3(wrapperPath, `#!/bin/sh
 exec '${escaped}' "$@"
 `, "utf8");
-  await chmod(wrapperPath, 493);
+  await chmod2(wrapperPath, 493);
 }
 function buildWindowsShortcutScript(executablePath) {
-  const appData = process.env.APPDATA?.trim() || path24.join(homedir(), "AppData", "Roaming");
-  const shortcutPath = path24.join(appData, "Microsoft", "Windows", "Start Menu", "Programs", "Rudder.lnk");
+  const appData = process.env.APPDATA?.trim() || path23.join(homedir(), "AppData", "Roaming");
+  const shortcutPath = path23.join(appData, "Microsoft", "Windows", "Start Menu", "Programs", "Rudder.lnk");
   return [
     "$shell = New-Object -ComObject WScript.Shell",
     `$shortcut = $shell.CreateShortcut(${powershellQuote(shortcutPath)})`,
     `$shortcut.TargetPath = ${powershellQuote(executablePath)}`,
-    `$shortcut.WorkingDirectory = ${powershellQuote(path24.dirname(executablePath))}`,
+    `$shortcut.WorkingDirectory = ${powershellQuote(path23.dirname(executablePath))}`,
     "$shortcut.Save()"
   ].join("; ");
 }
@@ -23206,7 +23537,7 @@ function launchDesktop(paths, target) {
   spawn3(paths.executablePath, [], { detached: true, stdio: "ignore" }).unref();
 }
 async function writeInstallMetadata(paths, releaseTag, assetName, assetChecksum, assetKind = "full") {
-  mkdirSync2(path24.dirname(paths.metadataPath), { recursive: true });
+  mkdirSync2(path23.dirname(paths.metadataPath), { recursive: true });
   const metadata = {
     version: 1,
     releaseTag,
@@ -23253,6 +23584,7 @@ async function startCommand(opts) {
   const version = opts.targetVersion?.trim() || opts.version?.trim() || resolveCurrentCliVersion();
   const dryRun = opts.dryRun === true;
   const desktopProgressJson = opts.desktopProgressJson === true;
+  const desktopRuntimeBestEffort = opts.desktopRuntimeBestEffort === true && installDesktop;
   const exactDesktopAssetPath = opts.desktopAssetPath?.trim() || null;
   const exactDesktopAssetChecksum = opts.desktopAssetChecksum?.trim() || null;
   const exactDesktopAssetName = opts.desktopAssetName?.trim() || null;
@@ -23261,7 +23593,7 @@ async function startCommand(opts) {
     if (!exactDesktopAssetPath || !exactDesktopAssetChecksum || !exactDesktopAssetName || !exactDesktopReleaseDigest) {
       throw new Error("Exact Desktop asset mode requires path, checksum, asset name, and release digest.");
     }
-    if (!path24.isAbsolute(exactDesktopAssetPath) || exactDesktopAssetName.includes("/") || !/^[a-f0-9]{64}$/iu.test(exactDesktopAssetChecksum) || !/^[a-f0-9]{64}$/iu.test(exactDesktopReleaseDigest)) {
+    if (!path23.isAbsolute(exactDesktopAssetPath) || exactDesktopAssetName.includes("/") || !/^[a-f0-9]{64}$/iu.test(exactDesktopAssetChecksum) || !/^[a-f0-9]{64}$/iu.test(exactDesktopReleaseDigest)) {
       throw new Error("Exact Desktop asset mode received invalid candidate identity.");
     }
     if (opts.desktopAssetKind && opts.desktopAssetKind !== "full" && opts.desktopAssetKind !== "shell") {
@@ -23284,13 +23616,29 @@ async function startCommand(opts) {
   }
   if (installRuntime) {
     p15.log.step("Preparing Rudder runtime");
+    if (desktopProgressJson && desktopRuntimeBestEffort) {
+      writeDesktopProgress({
+        phase: "preparing_runtime",
+        message: "Preparing the lightweight Desktop update runtime; the full package will be used if this takes too long."
+      });
+      await waitForDesktopRuntimeSmokeEvidence("RUDDER_DESKTOP_SMOKE_RUNTIME_PREPARING_DELAY_MS");
+    }
     if (dryRun) {
       p15.log.message(`[dry-run] Would install or reuse ${pc14.cyan(`@rudderhq/server@${version}`)} in the Rudder runtime cache.`);
     } else {
       const spinner3 = p15.spinner();
       spinner3.start("Installing or reusing Rudder runtime...");
       try {
-        const runtime = await ensureRuntimeInstalled({ version, preparePostgresPayload: true });
+        const runtime = await ensureRuntimeInstalled({
+          version,
+          preparePostgresPayload: true,
+          ...desktopRuntimeBestEffort ? {
+            timeoutMs: DESKTOP_RUNTIME_PREPARE_TIMEOUT_MS,
+            cleanupIncompleteOnFailure: true,
+            pruneRuntimeCache: false,
+            allowLatestFallback: false
+          } : {}
+        });
         runtimeSupportsShellAssets = runtimeSupportsDesktopShellAssets(version, runtime);
         spinner3.stop(
           runtime.status === "hit" ? `Rudder runtime cache hit at ${pc14.cyan(runtime.cacheDir)}.` : `Rudder runtime installed at ${pc14.cyan(runtime.cacheDir)}.`
@@ -23301,12 +23649,27 @@ async function startCommand(opts) {
         if (!runtimeSupportsShellAssets && installDesktop) {
           p15.log.warn("Rudder runtime did not resolve to the exact Desktop version; the full portable Desktop asset will be used.");
         }
+        if (desktopProgressJson && desktopRuntimeBestEffort) {
+          writeDesktopProgress({
+            phase: "preparing_runtime",
+            message: runtimeSupportsShellAssets ? "Lightweight Desktop update runtime is ready." : "Lightweight runtime is unavailable; continuing with the full Desktop package."
+          });
+        }
       } catch (error) {
         spinner3.stop(pc14.red("Rudder runtime installation failed."));
         if (error instanceof RuntimeInstallError && error.output) {
           p15.log.message(pc14.dim(error.output));
         }
-        throw error;
+        if (!desktopRuntimeBestEffort) throw error;
+        const detail = error instanceof Error ? error.message : String(error);
+        p15.log.warn(`Lightweight Desktop update runtime preparation failed; continuing with the full portable asset. ${detail}`);
+        if (desktopProgressJson) {
+          writeDesktopProgress({
+            phase: "preparing_runtime",
+            message: "Lightweight runtime preparation did not finish; continuing with the full Desktop package."
+          });
+          await waitForDesktopRuntimeSmokeEvidence("RUDDER_DESKTOP_SMOKE_RUNTIME_FALLBACK_DELAY_MS");
+        }
       }
     }
   }
@@ -23341,11 +23704,12 @@ async function startCommand(opts) {
   if (installDesktop) {
     const downloadSource = resolveDesktopDownloadSource(opts.downloadSource);
     const mirrorBaseUrl = resolveDesktopReleaseMirrorBaseUrl(repo);
+    const smokeReleaseBaseUrls = resolveDesktopSmokeReleaseBaseUrls();
     const target = resolveDesktopAssetTarget();
     const tag = resolveDesktopReleaseTag(version);
-    const installRoot = opts.desktopInstallDir ? path24.resolve(opts.desktopInstallDir) : resolveDefaultDesktopInstallRoot(target);
+    const installRoot = opts.desktopInstallDir ? path23.resolve(opts.desktopInstallDir) : resolveDefaultDesktopInstallRoot(target);
     const installPaths = resolveDesktopInstallPaths(target, installRoot);
-    const outputDir = opts.outputDir ? path24.resolve(opts.outputDir) : await mkdtemp2(path24.join(tmpdir(), "rudder-desktop-installer."));
+    const outputDir = opts.outputDir ? path23.resolve(opts.outputDir) : await mkdtemp2(path23.join(tmpdir(), "rudder-desktop-installer."));
     p15.log.step("Installing desktop app");
     p15.log.message(`Release: ${pc14.cyan(`${repo}@${tag}`)}`);
     p15.log.message(`Target: ${pc14.cyan(`${target.platform}/${target.arch}`)}`);
@@ -23385,13 +23749,13 @@ async function startCommand(opts) {
         if (computedReleaseDigest !== exactDesktopReleaseDigest.toLowerCase()) {
           throw new Error("Exact Desktop asset release digest does not match the candidate identity.");
         }
-        const descriptor = await stat6(exactDesktopAssetPath);
+        const descriptor = await stat4(exactDesktopAssetPath);
         if (!descriptor.isFile()) throw new Error("Exact Desktop asset must be a regular file.");
         const linkDescriptor = await lstat(exactDesktopAssetPath);
         if (linkDescriptor.isSymbolicLink()) throw new Error("Exact Desktop asset must not be a symbolic link.");
         const checksum = await runStartPhase(
           "Verifying staged Desktop checksum...",
-          `Verified ${pc14.cyan(path24.basename(exactDesktopAssetPath))}.`,
+          `Verified ${pc14.cyan(path23.basename(exactDesktopAssetPath))}.`,
           () => assertChecksumMatch(exactDesktopAssetPath, expectedChecksum),
           desktopProgressJson ? "verifying_checksum" : null
         );
@@ -23403,7 +23767,7 @@ async function startCommand(opts) {
           release = await runStartPhase(
             "Resolving Desktop release...",
             "Desktop release resolved.",
-            () => fetchGithubRelease(repo, tag),
+            () => fetchGithubRelease(repo, tag, smokeReleaseBaseUrls.apiBaseUrl),
             desktopProgressJson ? "resolving_release" : null
           );
         } catch (error) {
@@ -23420,12 +23784,18 @@ async function startCommand(opts) {
           repo,
           tag,
           directReleaseVersion,
-          allowShellAssets: runtimeSupportsShellAssets
+          allowShellAssets: runtimeSupportsShellAssets,
+          downloadBaseUrl: smokeReleaseBaseUrls.downloadBaseUrl
         });
         if (assetCandidates.length === 0) {
           throw new Error(`No Rudder Desktop portable asset found for ${target.platform}/${target.arch} in ${repo}@${releaseTag}.`);
         }
-        const checksumAsset = selectChecksumAsset(release?.assets ?? []) ?? (directReleaseVersion ? buildGithubReleaseAsset(repo, tag, DESKTOP_CHECKSUM_ASSET_NAME) : null);
+        const checksumAsset = selectChecksumAsset(release?.assets ?? []) ?? (directReleaseVersion ? buildGithubReleaseAsset(
+          repo,
+          tag,
+          DESKTOP_CHECKSUM_ASSET_NAME,
+          smokeReleaseBaseUrls.downloadBaseUrl
+        ) : null);
         if (!checksumAsset) {
           throw new Error("Desktop release is missing SHASUMS256.txt.");
         }
@@ -23504,7 +23874,7 @@ async function startCommand(opts) {
         }
         const checksum = await runStartPhase(
           "Verifying Desktop checksum...",
-          `Verified ${pc14.cyan(path24.basename(verifiedAsset.path))}.`,
+          `Verified ${pc14.cyan(path23.basename(verifiedAsset.path))}.`,
           () => assertChecksumMatch(verifiedAsset.path, expectedChecksum),
           desktopProgressJson ? "verifying_checksum" : null
         );
@@ -23515,7 +23885,8 @@ async function startCommand(opts) {
             percent: 100,
             assetName: selectedAsset.name,
             assetChecksum: checksum,
-            stagedArtifactPath: path24.resolve(verifiedAsset.path),
+            assetKind: selectedAssetKind,
+            stagedArtifactPath: path23.resolve(verifiedAsset.path),
             stagedArtifactDigest: checksum,
             releaseDigest: createHash4("sha256").update(JSON.stringify({
               releaseTag,
@@ -23608,11 +23979,11 @@ async function startCommand(opts) {
 
 // src/config/data-dir.ts
 init_home();
-import path25 from "node:path";
+import path24 from "node:path";
 function applyDataDirOverride(options, support = {}) {
   const rawDataDir = options.dataDir?.trim();
   if (!rawDataDir) return null;
-  const resolvedDataDir = path25.resolve(expandHomePrefix(rawDataDir));
+  const resolvedDataDir = path24.resolve(expandHomePrefix(rawDataDir));
   process.env.RUDDER_HOME = resolvedDataDir;
   if (support.hasConfigOption) {
     const hasConfigOverride = Boolean(options.config?.trim()) || Boolean(process.env.RUDDER_CONFIG?.trim());
@@ -23672,7 +24043,7 @@ function createProgram() {
     });
     loadRudderEnvFile(options.config);
   });
-  program.command("start").description("Start Rudder Desktop and prepare the matching persistent CLI").option("--server-only", "Prepare the Rudder server runtime and persistent CLI without installing Desktop").option("--no-cli", "Skip persistent CLI installation").option("--no-runtime", "Skip Rudder runtime installation").option("--no-desktop", "Skip desktop app installation").option("--version <version>", "Rudder version to start (default: current CLI version)").option("--target-version <version>", "Rudder version to start; avoids the root CLI version flag").option("--repo <owner/repo>", "GitHub repository that hosts desktop releases").option("--download-source <source>", "Desktop download source: auto, cn, or global").option("--output-dir <path>", "Directory for downloaded desktop release assets").option("--desktop-install-dir <path>", "Directory for the portable Desktop install").option("--no-open", "Install Desktop without launching it").option("--wait-for-active-runs", "Wait for active Rudder runs to finish before replacing Desktop", false).option("--desktop-progress-json", "Emit newline-delimited Desktop update progress events").option("--desktop-wait-for-apply", "Wait for an apply signal after downloading and verifying the Desktop update", false).option("--desktop-prepare-only", "Download and verify the Desktop update without installing or launching it", false).option("--desktop-asset-path <path>", "Use one previously staged, exact Desktop asset path").option("--desktop-asset-checksum <sha256>", "SHA-256 for the exact staged Desktop asset").option("--desktop-asset-name <name>", "Asset name bound to the exact staged Desktop candidate").option("--desktop-asset-kind <kind>", "Asset kind bound to the exact staged Desktop candidate (full or shell)").option("--desktop-release-digest <sha256>", "Release digest bound to the exact staged Desktop candidate").option("--no-version-check", "Skip checking npm for a newer Rudder CLI version").option("--dry-run", "Print the start actions without changing the machine", false).action(startCommand);
+  program.command("start").description("Start Rudder Desktop and prepare the matching persistent CLI").option("--server-only", "Prepare the Rudder server runtime and persistent CLI without installing Desktop").option("--no-cli", "Skip persistent CLI installation").option("--no-runtime", "Skip Rudder runtime installation").option("--no-desktop", "Skip desktop app installation").option("--version <version>", "Rudder version to start (default: current CLI version)").option("--target-version <version>", "Rudder version to start; avoids the root CLI version flag").option("--repo <owner/repo>", "GitHub repository that hosts desktop releases").option("--download-source <source>", "Desktop download source: auto, cn, or global").option("--output-dir <path>", "Directory for downloaded desktop release assets").option("--desktop-install-dir <path>", "Directory for the portable Desktop install").option("--no-open", "Install Desktop without launching it").option("--wait-for-active-runs", "Wait for active Rudder runs to finish before replacing Desktop", false).option("--desktop-progress-json", "Emit newline-delimited Desktop update progress events").option("--desktop-wait-for-apply", "Wait for an apply signal after downloading and verifying the Desktop update", false).option("--desktop-prepare-only", "Download and verify the Desktop update without installing or launching it", false).option("--desktop-asset-path <path>", "Use one previously staged, exact Desktop asset path").option("--desktop-asset-checksum <sha256>", "SHA-256 for the exact staged Desktop asset").option("--desktop-asset-name <name>", "Asset name bound to the exact staged Desktop candidate").option("--desktop-asset-kind <kind>", "Asset kind bound to the exact staged Desktop candidate (full or shell)").option("--desktop-release-digest <sha256>", "Release digest bound to the exact staged Desktop candidate").addOption(new Option("--desktop-runtime-best-effort").hideHelp()).option("--no-version-check", "Skip checking npm for a newer Rudder CLI version").option("--dry-run", "Print the start actions without changing the machine", false).action(startCommand);
   program.command("onboard").description("Interactive first-run setup wizard").option("-c, --config <path>", "Path to config file").option("-d, --data-dir <path>", DATA_DIR_OPTION_HELP).option("-y, --yes", "Accept defaults (quickstart + start immediately)", false).option("--run", "Start Rudder immediately after saving config", false).action(onboard);
   program.command("doctor").description("Run diagnostic checks on your Rudder setup").option("-c, --config <path>", "Path to config file").option("-d, --data-dir <path>", DATA_DIR_OPTION_HELP).option("--repair", "Attempt to repair issues automatically").alias("--fix").option("-y, --yes", "Skip repair confirmation prompts").action(async (opts) => {
     await doctor(opts);