@rudderhq/cli 0.7.15 → 0.7.16

package/dist/index.js

@@ -1700,7 +1700,9 @@ var init_rudder_agent_contract_generated = __esm({
         },
         {
           "api": {
-            "transport": "cli-fallback"
+            "method": "GET",
+            "pathTemplate": "/api/issues/{issue}/comments",
+            "transport": "direct"
           },
           "cli": {
             "attachesRunIdWhenAvailable": false,
@@ -1760,7 +1762,9 @@ var init_rudder_agent_contract_generated = __esm({
         },
         {
           "api": {
-            "transport": "cli-fallback"
+            "method": "GET",
+            "pathTemplate": "/api/issues/{issue}/comments/{comment}",
+            "transport": "direct"
           },
           "cli": {
             "attachesRunIdWhenAvailable": false,
@@ -8582,6 +8586,65 @@ var init_rudder_agent_contract_generated = __esm({
             },
             "name": "rudder_runs_retry"
           }
+        },
+        {
+          "api": {
+            "method": "POST",
+            "pathTemplate": "/api/agent-runs/delegation",
+            "transport": "direct"
+          },
+          "cli": {
+            "attachesRunIdWhenAvailable": true,
+            "category": "runs",
+            "command": "rudder runs create --task <text> --idempotency-key <key> [--target-agent-id <id>]",
+            "contract": "agent-v1",
+            "description": "Create an independently governed Delegation Run for the current or another same-organization Agent.",
+            "id": "runs.create",
+            "mutating": true,
+            "requiresAgentId": true,
+            "requiresOrgId": false,
+            "requiresRunId": true
+          },
+          "id": "runs.create",
+          "mcp": {
+            "annotations": {
+              "destructiveHint": false,
+              "idempotentHint": true,
+              "readOnlyHint": false,
+              "title": "Create an independently governed Delegation Run"
+            },
+            "capabilityId": "runs.create",
+            "description": "Create an independently governed Delegation Run for the current or another same-organization Agent. Mutating: yes. Runtime identity and authorization are injected by the Rudder-managed MCP server and are not accepted as tool input. Org context: not required by this tool. Agent context: required from runtime env. Run attribution: attached from runtime env when available.",
+            "inputSchema": {
+              "additionalProperties": false,
+              "properties": {
+                "idempotencyKey": {
+                  "description": "Required stable key for safe replay.",
+                  "maxLength": 500,
+                  "minLength": 1,
+                  "type": "string"
+                },
+                "targetAgentId": {
+                  "description": "Optional same-organization target Agent id.",
+                  "maxLength": 200,
+                  "minLength": 1,
+                  "type": "string"
+                },
+                "task": {
+                  "description": "Delegation task to run independently.",
+                  "maxLength": 2e4,
+                  "minLength": 1,
+                  "type": "string"
+                }
+              },
+              "required": [
+                "task",
+                "idempotencyKey"
+              ],
+              "type": "object"
+            },
+            "name": "rudder_runs_create"
+          }
         }
       ],
       "contractVersion": "rudder.agent-contract/v1",
@@ -16296,6 +16359,50 @@ var init_rudder_mcp_tool_descriptors_generated = __esm({
           ],
           "type": "object"
         }
+      },
+      {
+        "capabilityId": "runs.create",
+        "name": "rudder_runs_create",
+        "description": "Create an independently governed Delegation Run for the current or another same-organization Agent.",
+        "semanticDescription": "Create an independently governed Delegation Run for the current or another same-organization Agent. Mutating: yes. Runtime identity and authorization are injected by the Rudder-managed MCP server and are not accepted as tool input. Org context: not required by this tool. Agent context: required from runtime env. Run attribution: attached from runtime env when available.",
+        "annotations": {
+          "destructiveHint": false,
+          "idempotentHint": true,
+          "readOnlyHint": false,
+          "title": "Create an independently governed Delegation Run"
+        },
+        "mutating": true,
+        "requiresOrgId": false,
+        "requiresAgentId": true,
+        "attachesRunIdWhenAvailable": true,
+        "inputSchema": {
+          "additionalProperties": false,
+          "properties": {
+            "idempotencyKey": {
+              "description": "Required stable key for safe replay.",
+              "maxLength": 500,
+              "minLength": 1,
+              "type": "string"
+            },
+            "targetAgentId": {
+              "description": "Optional same-organization target Agent id.",
+              "maxLength": 200,
+              "minLength": 1,
+              "type": "string"
+            },
+            "task": {
+              "description": "Delegation task to run independently.",
+              "maxLength": 2e4,
+              "minLength": 1,
+              "type": "string"
+            }
+          },
+          "required": [
+            "task",
+            "idempotencyKey"
+          ],
+          "type": "object"
+        }
       }
     ];
   }
@@ -16895,7 +17002,8 @@ var init_constants = __esm({
       "rudder_runs_transcript",
       "rudder_runs_errors",
       "rudder_runs_cancel",
-      "rudder_runs_retry"
+      "rudder_runs_retry",
+      "rudder_runs_create"
     ];
     RUDDER_BROWSER_MCP_TOOL_NAMES2 = RUDDER_AGENT_V1_MCP_TOOL_NAMES.filter((name) => name.startsWith("rudder_browser_"));
     RUDDER_CORE_MCP_TOOL_NAMES2 = RUDDER_AGENT_V1_MCP_TOOL_NAMES.filter((name) => !name.startsWith("rudder_browser_"));
@@ -18532,6 +18640,7 @@ var init_chat = __esm({
     }).strict();
     addChatMessageSchema = z5.object({
       body: z5.string().trim().max(2e4).default(""),
+      clientMutationId: z5.string().trim().min(1).max(120).optional(),
       inlineAnnotations: chatInlineAnnotationsInputSchema.optional(),
       editUserMessageId: z5.string().uuid().optional().nullable(),
       queuedMessageId: z5.string().uuid().optional().nullable(),
@@ -19975,7 +20084,7 @@ var init_resource = __esm({
 
 // ../packages/shared/dist/validators/agent.js
 import { z as z20 } from "zod";
-var agentPermissionsSchema, agentInstructionsBundleModeSchema, updateAgentInstructionsBundleSchema, upsertAgentInstructionsFileSchema, agentRuntimeConfigSchema, optionalAgentNameSchema, uploadedAgentIconSchema, diceBearNotionistsAgentIconSchema, oreoAgentIconSchema, agentIconSchema, createAgentSchema, createAgentHireSchema, updateAgentSchema, updateAgentInstructionsPathSchema, createAgentKeySchema, wakeAgentSchema, resetAgentSessionSchema, testAgentRuntimeEnvironmentSchema, updateAgentPermissionsSchema;
+var agentPermissionsSchema, agentInstructionsBundleModeSchema, updateAgentInstructionsBundleSchema, upsertAgentInstructionsFileSchema, agentRuntimeConfigSchema, optionalAgentNameSchema, uploadedAgentIconSchema, diceBearNotionistsAgentIconSchema, oreoAgentIconSchema, agentIconSchema, createAgentSchema, createAgentHireSchema, updateAgentSchema, updateAgentInstructionsPathSchema, createAgentKeySchema, wakeAgentSchema, delegationTaskSchema, createDelegationRunSchema, resetAgentSessionSchema, testAgentRuntimeEnvironmentSchema, updateAgentPermissionsSchema;
 var init_agent = __esm({
   "../packages/shared/dist/validators/agent.js"() {
     "use strict";
@@ -20072,6 +20181,12 @@ var init_agent = __esm({
       idempotencyKey: z20.string().optional().nullable(),
       forceFreshSession: z20.preprocess((value) => value === null ? void 0 : value, z20.boolean().optional().default(false))
     });
+    delegationTaskSchema = z20.string().trim().min(1).refine((value) => Array.from(value).length <= 2e4, "task must be no more than 20,000 Unicode characters");
+    createDelegationRunSchema = z20.object({
+      task: delegationTaskSchema,
+      targetAgentId: z20.string().trim().min(1).max(200).optional(),
+      idempotencyKey: z20.string().trim().min(1).max(500)
+    });
     resetAgentSessionSchema = z20.object({
       taskKey: z20.string().min(1).optional().nullable()
     });
@@ -20284,7 +20399,7 @@ var init_project = __esm({
 
 // ../packages/shared/dist/validators/issue.js
 import { z as z23 } from "zod";
-var runWorkspaceStrategySchema, issueRunWorkspaceSettingsSchema, issueAssigneeAdapterOverridesSchema, createIssueSchema, createIssueLabelSchema, updateIssueLabelSchema, updateIssueSchema, reorderIssueSchema, checkoutIssueSchema, addIssueCommentSchema, updateIssueCommentSchema, reportIssueCommitSchema, linkIssueApprovalSchema, createIssueAttachmentMetadataSchema, createIssueWorkspaceAttachmentSchema, ISSUE_DOCUMENT_FORMATS, issueDocumentFormatSchema, createLibraryDocumentSchema, updateLibraryDocumentSchema, restoreLibraryDocumentRevisionSchema;
+var runWorkspaceStrategySchema, issueRunWorkspaceSettingsSchema, issueAssigneeAdapterOverridesSchema, createIssueSchema, createRunDebugIssueSchema, createIssueLabelSchema, updateIssueLabelSchema, updateIssueSchema, reorderIssueSchema, checkoutIssueSchema, addIssueCommentSchema, updateIssueCommentSchema, reportIssueCommitSchema, linkIssueApprovalSchema, createIssueAttachmentMetadataSchema, createIssueWorkspaceAttachmentSchema, ISSUE_DOCUMENT_FORMATS, issueDocumentFormatSchema, createLibraryDocumentSchema, updateLibraryDocumentSchema, restoreLibraryDocumentRevisionSchema;
 var init_issue = __esm({
   "../packages/shared/dist/validators/issue.js"() {
     "use strict";
@@ -20347,6 +20462,9 @@ var init_issue = __esm({
       executionWorkspaceSettings: issueRunWorkspaceSettingsSchema.optional().nullable(),
       labelIds: z23.array(z23.string().uuid()).optional()
     });
+    createRunDebugIssueSchema = z23.object({
+      diagnostics: z23.string().trim().min(1).max(32e3)
+    });
     createIssueLabelSchema = z23.object({
       name: z23.string().trim().min(1).max(48),
       color: z23.string().regex(/^#(?:[0-9a-fA-F]{6})$/, "Color must be a 6-digit hex value")
@@ -21105,7 +21223,8 @@ var init_plugin_v1 = __esm({
     inspectRudderPluginArchiveSchema = z36.object({
       sourceLabel: z36.string().trim().min(1).max(240),
       filename: z36.string().trim().min(1).max(240).refine((value) => /\.zip$/i.test(value), "Only ZIP Plugin archives are supported"),
-      content: z36.string().min(1).max(14e6),
+      // 100 MiB binary package ceiling plus base64 expansion.
+      content: z36.string().min(1).max(14e7),
       encoding: z36.literal("base64")
     }).strict();
     configureRudderPluginMarketplaceSchema = z36.object({
@@ -21530,12 +21649,12 @@ var init_dist2 = __esm({
 });
 
 // src/config/home.ts
-import os from "node:os";
-import path from "node:path";
+import os2 from "node:os";
+import path2 from "node:path";
 function resolveRudderHomeDir() {
   const envHome = process.env.RUDDER_HOME?.trim();
-  if (envHome) return path.resolve(expandHomePrefix(envHome));
-  return path.resolve(os.homedir(), ".rudder");
+  if (envHome) return path2.resolve(expandHomePrefix(envHome));
+  return path2.resolve(os2.homedir(), ".rudder");
 }
 function resolveRudderInstanceId(override) {
   const raw = override?.trim() || process.env.RUDDER_INSTANCE_ID?.trim() || DEFAULT_INSTANCE_ID;
@@ -21548,35 +21667,35 @@ function resolveRudderInstanceId(override) {
 }
 function resolveRudderInstanceRoot(instanceId) {
   const id = resolveRudderInstanceId(instanceId);
-  return path.resolve(resolveRudderHomeDir(), "instances", id);
+  return path2.resolve(resolveRudderHomeDir(), "instances", id);
 }
 function resolveDefaultConfigPath(instanceId) {
-  return path.resolve(resolveRudderInstanceRoot(instanceId), "config.json");
+  return path2.resolve(resolveRudderInstanceRoot(instanceId), "config.json");
 }
 function resolveDefaultContextPath() {
-  return path.resolve(resolveRudderHomeDir(), "context.json");
+  return path2.resolve(resolveRudderHomeDir(), "context.json");
 }
 function resolveDefaultCliAuthPath() {
-  return path.resolve(resolveRudderHomeDir(), "auth.json");
+  return path2.resolve(resolveRudderHomeDir(), "auth.json");
 }
 function resolveDefaultEmbeddedPostgresDir(instanceId) {
-  return path.resolve(resolveRudderInstanceRoot(instanceId), "db");
+  return path2.resolve(resolveRudderInstanceRoot(instanceId), "db");
 }
 function resolveDefaultLogsDir(instanceId) {
-  return path.resolve(resolveRudderInstanceRoot(instanceId), "logs");
+  return path2.resolve(resolveRudderInstanceRoot(instanceId), "logs");
 }
 function resolveDefaultSecretsKeyFilePath(instanceId) {
-  return path.resolve(resolveRudderInstanceRoot(instanceId), "secrets", "master.key");
+  return path2.resolve(resolveRudderInstanceRoot(instanceId), "secrets", "master.key");
 }
 function resolveDefaultStorageDir(instanceId) {
-  return path.resolve(resolveRudderInstanceRoot(instanceId), "data", "storage");
+  return path2.resolve(resolveRudderInstanceRoot(instanceId), "data", "storage");
 }
 function resolveDefaultBackupDir(instanceId) {
-  return path.resolve(resolveRudderInstanceRoot(instanceId), "data", "backups");
+  return path2.resolve(resolveRudderInstanceRoot(instanceId), "data", "backups");
 }
 function expandHomePrefix(value) {
-  if (value === "~") return os.homedir();
-  if (value.startsWith("~/")) return path.resolve(os.homedir(), value.slice(2));
+  if (value === "~") return os2.homedir();
+  if (value.startsWith("~/")) return path2.resolve(os2.homedir(), value.slice(2));
   return value;
 }
 function describeLocalInstancePaths(instanceId) {
@@ -21612,30 +21731,30 @@ var init_schema = __esm({
 });
 
 // src/config/store.ts
-import fs3 from "node:fs";
-import path4 from "node:path";
+import fs4 from "node:fs";
+import path5 from "node:path";
 function findConfigFileFromAncestors(startDir) {
-  const absoluteStartDir = path4.resolve(startDir);
+  const absoluteStartDir = path5.resolve(startDir);
   let currentDir = absoluteStartDir;
   while (true) {
-    const candidate = path4.resolve(currentDir, ".rudder", DEFAULT_CONFIG_BASENAME);
-    if (fs3.existsSync(candidate)) {
+    const candidate = path5.resolve(currentDir, ".rudder", DEFAULT_CONFIG_BASENAME);
+    if (fs4.existsSync(candidate)) {
       return candidate;
     }
-    const nextDir = path4.resolve(currentDir, "..");
+    const nextDir = path5.resolve(currentDir, "..");
     if (nextDir === currentDir) break;
     currentDir = nextDir;
   }
   return null;
 }
 function resolveConfigPath(overridePath) {
-  if (overridePath) return path4.resolve(overridePath);
-  if (process.env.RUDDER_CONFIG) return path4.resolve(process.env.RUDDER_CONFIG);
+  if (overridePath) return path5.resolve(overridePath);
+  if (process.env.RUDDER_CONFIG) return path5.resolve(process.env.RUDDER_CONFIG);
   return findConfigFileFromAncestors(process.cwd()) ?? resolveDefaultConfigPath(resolveRudderInstanceId());
 }
 function parseJson2(filePath) {
   try {
-    return JSON.parse(fs3.readFileSync(filePath, "utf-8"));
+    return JSON.parse(fs4.readFileSync(filePath, "utf-8"));
   } catch (err) {
     throw new Error(`Failed to parse JSON at ${filePath}: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -21674,7 +21793,7 @@ function formatValidationError(err) {
 }
 function readConfig(configPath) {
   const filePath = resolveConfigPath(configPath);
-  if (!fs3.existsSync(filePath)) return null;
+  if (!fs4.existsSync(filePath)) return null;
   const raw = parseJson2(filePath);
   const migrated = migrateLegacyConfig(raw);
   const parsed = rudderConfigSchema.safeParse(migrated);
@@ -21685,19 +21804,19 @@ function readConfig(configPath) {
 }
 function writeConfig(config, configPath) {
   const filePath = resolveConfigPath(configPath);
-  const dir = path4.dirname(filePath);
-  fs3.mkdirSync(dir, { recursive: true });
-  if (fs3.existsSync(filePath)) {
+  const dir = path5.dirname(filePath);
+  fs4.mkdirSync(dir, { recursive: true });
+  if (fs4.existsSync(filePath)) {
     const backupPath = filePath + ".backup";
-    fs3.copyFileSync(filePath, backupPath);
-    fs3.chmodSync(backupPath, 384);
+    fs4.copyFileSync(filePath, backupPath);
+    fs4.chmodSync(backupPath, 384);
   }
-  fs3.writeFileSync(filePath, JSON.stringify(config, null, 2) + "\n", {
+  fs4.writeFileSync(filePath, JSON.stringify(config, null, 2) + "\n", {
     mode: 384
   });
 }
 function configExists(configPath) {
-  return fs3.existsSync(resolveConfigPath(configPath));
+  return fs4.existsSync(resolveConfigPath(configPath));
 }
 var DEFAULT_CONFIG_BASENAME;
 var init_store = __esm({
@@ -21711,7 +21830,7 @@ var init_store = __esm({
 
 // src/version.ts
 import { existsSync, readFileSync } from "node:fs";
-import path5 from "node:path";
+import path6 from "node:path";
 import { fileURLToPath } from "node:url";
 function readPackageVersion(packagePath, expectedName) {
   if (!existsSync(packagePath)) return null;
@@ -21727,12 +21846,12 @@ function resolveCliVersion(moduleUrl = import.meta.url, env = process.env) {
   if (env.npm_package_name === CLI_PACKAGE_NAME && env.npm_package_version) {
     return env.npm_package_version;
   }
-  const moduleDir = path5.dirname(fileURLToPath(moduleUrl));
+  const moduleDir = path6.dirname(fileURLToPath(moduleUrl));
   const candidates = [
-    path5.resolve(moduleDir, CLI_VERSION_MANIFEST),
-    path5.resolve(moduleDir, "package.json"),
-    path5.resolve(moduleDir, "../package.json"),
-    path5.resolve(moduleDir, "../../package.json")
+    path6.resolve(moduleDir, CLI_VERSION_MANIFEST),
+    path6.resolve(moduleDir, "package.json"),
+    path6.resolve(moduleDir, "../package.json"),
+    path6.resolve(moduleDir, "../../package.json")
   ];
   for (const candidate of candidates) {
     const version = readPackageVersion(candidate, CLI_PACKAGE_NAME);
@@ -21782,10 +21901,10 @@ var init_hostnames = __esm({
 // src/config/env.ts
 import { config as loadDotenv, parse as parseEnvFileContents } from "dotenv";
 import { randomBytes } from "node:crypto";
-import fs5 from "node:fs";
-import path7 from "node:path";
+import fs6 from "node:fs";
+import path8 from "node:path";
 function resolveEnvFilePath(configPath) {
-  return path7.resolve(path7.dirname(resolveConfigPath(configPath)), ".env");
+  return path8.resolve(path8.dirname(resolveConfigPath(configPath)), ".env");
 }
 function isNonEmpty(value) {
   return typeof value === "string" && value.trim().length > 0;
@@ -21820,7 +21939,7 @@ function loadRudderEnvFile(configPath) {
 }
 function loadAgentJwtEnvFile(filePath = resolveEnvFilePath()) {
   if (loadedEnvFiles.has(filePath)) return;
-  if (!fs5.existsSync(filePath)) return;
+  if (!fs6.existsSync(filePath)) return;
   loadedEnvFiles.add(filePath);
   loadDotenv({ path: filePath, override: false, quiet: true });
 }
@@ -21830,8 +21949,8 @@ function readAgentJwtSecretFromEnv(configPath) {
   return isNonEmpty(raw) ? raw.trim() : null;
 }
 function readAgentJwtSecretFromEnvFile(filePath = resolveEnvFilePath()) {
-  if (!fs5.existsSync(filePath)) return null;
-  const raw = fs5.readFileSync(filePath, "utf-8");
+  if (!fs6.existsSync(filePath)) return null;
+  const raw = fs6.readFileSync(filePath, "utf-8");
   const values = parseEnvFile(raw);
   const value = values[JWT_SECRET_ENV_KEY];
   return isNonEmpty(value) ? value.trim() : null;
@@ -21854,13 +21973,13 @@ function writeAgentJwtEnv(secret, filePath = resolveEnvFilePath()) {
   mergePaperclipEnvEntries({ [JWT_SECRET_ENV_KEY]: secret }, filePath);
 }
 function readPaperclipEnvEntries(filePath = resolveEnvFilePath()) {
-  if (!fs5.existsSync(filePath)) return {};
-  return parseEnvFile(fs5.readFileSync(filePath, "utf-8"));
+  if (!fs6.existsSync(filePath)) return {};
+  return parseEnvFile(fs6.readFileSync(filePath, "utf-8"));
 }
 function writePaperclipEnvEntries(entries, filePath = resolveEnvFilePath()) {
-  const dir = path7.dirname(filePath);
-  fs5.mkdirSync(dir, { recursive: true });
-  fs5.writeFileSync(filePath, renderEnvFile(entries), {
+  const dir = path8.dirname(filePath);
+  fs6.mkdirSync(dir, { recursive: true });
+  fs6.writeFileSync(filePath, renderEnvFile(entries), {
     mode: 384
   });
 }
@@ -21904,8 +22023,8 @@ var init_npm_command = __esm({
 // src/runtime/native-payload.ts
 import { execFile } from "node:child_process";
 import { existsSync as existsSync3 } from "node:fs";
-import fs6 from "node:fs/promises";
-import path8 from "node:path";
+import fs7 from "node:fs/promises";
+import path9 from "node:path";
 import { performance } from "node:perf_hooks";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { promisify } from "node:util";
@@ -21914,14 +22033,14 @@ function nativeTarget() {
 }
 function resolveNativePayloadBinary() {
   const configured = process.env.RUDDER_NATIVE_PAYLOAD_PATH?.trim() || process.env.RUDDER_NATIVE_PATH?.trim();
-  if (configured) return path8.resolve(configured);
+  if (configured) return path9.resolve(configured);
   const binaryName = process.platform === "win32" ? "rudder-native.exe" : "rudder-native";
-  const moduleDir = path8.dirname(fileURLToPath3(import.meta.url));
+  const moduleDir = path9.dirname(fileURLToPath3(import.meta.url));
   const target = nativeTarget();
   const candidates = [
-    path8.resolve(moduleDir, "../../../native/target/debug", binaryName),
-    path8.resolve(moduleDir, "../../../../native/target/debug", binaryName),
-    path8.resolve(moduleDir, "../../../native", target ?? "unsupported", binaryName)
+    path9.resolve(moduleDir, "../../../native/target/debug", binaryName),
+    path9.resolve(moduleDir, "../../../../native/target/debug", binaryName),
+    path9.resolve(moduleDir, "../../../native", target ?? "unsupported", binaryName)
   ];
   return candidates.find((candidate) => existsSync3(candidate)) ?? candidates[0];
 }
@@ -21994,7 +22113,7 @@ async function verifyNativePayload(archivePath, expectedSha256, maxArchiveBytes,
   return runNativePayload("payload.verify", [
     "payload",
     "verify",
-    path8.resolve(archivePath),
+    path9.resolve(archivePath),
     expectedSha256,
     String(maxArchiveBytes)
   ], false, timeoutMs);
@@ -22004,9 +22123,9 @@ async function extractNativePayload(archivePath, stagingPath, maxArchiveBytes, t
     return await runNativePayload("payload.extract", [
       "payload",
       "extract",
-      path8.resolve(archivePath),
+      path9.resolve(archivePath),
       "auto",
-      path8.resolve(stagingPath),
+      path9.resolve(stagingPath),
       String(maxArchiveBytes),
       String(maxArchiveBytes),
       String(maxArchiveBytes * 2),
@@ -22023,7 +22142,7 @@ async function probeNativePayloadVersion(rootPath, executable, timeoutMs) {
   return runNativePayload("payload.probeVersion", [
     "payload",
     "probe-version",
-    path8.resolve(rootPath),
+    path9.resolve(rootPath),
     executable,
     "PostgreSQL 18.4"
   ], true, timeoutMs);
@@ -22032,8 +22151,8 @@ async function publishNativePayload(stagingPath, destinationPath, timeoutMs) {
   return runNativePayload("payload.publish", [
     "payload",
     "publish",
-    path8.resolve(stagingPath),
-    path8.resolve(destinationPath)
+    path9.resolve(stagingPath),
+    path9.resolve(destinationPath)
   ], true, timeoutMs);
 }
 async function tryInstallNativePayload(input) {
@@ -22132,7 +22251,7 @@ async function tryInstallNativePayload(input) {
       }
     };
   } finally {
-    const cleanup = input.cleanupPublishStaging ?? ((publishStagingPath) => fs6.rm(publishStagingPath, { recursive: true, force: true }));
+    const cleanup = input.cleanupPublishStaging ?? ((publishStagingPath) => fs7.rm(publishStagingPath, { recursive: true, force: true }));
     void cleanup(input.publishStagingPath).catch(() => {
     });
   }
@@ -22173,7 +22292,7 @@ var init_native_payload = __esm({
 });
 
 // src/runtime/postgres-runtime-download.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 import { createReadStream, createWriteStream } from "node:fs";
 import { Readable, Transform } from "node:stream";
 import { pipeline } from "node:stream/promises";
@@ -22192,7 +22311,7 @@ async function downloadRuntimePostgresArchive(url, targetPath, trustedSha256, op
   const controller = new AbortController();
   const timeout = Number.isFinite(parsedTimeout) && parsedTimeout > 0 ? setTimeout(() => controller.abort(), parsedTimeout) : null;
   try {
-    const hash = createHash2("sha256");
+    const hash = createHash3("sha256");
     let bytes = 0;
     const monitor = new Transform({
       transform(chunk, _encoding, callback) {
@@ -22295,7 +22414,7 @@ import { execFileSync, spawnSync as spawnSync2 } from "node:child_process";
 import { createReadStream as createReadStream2, createWriteStream as createWriteStream2 } from "node:fs";
 import { chmod, mkdir, mkdtemp, readFile, readdir, realpath, rename, rm, stat, symlink, writeFile } from "node:fs/promises";
 import { createRequire } from "node:module";
-import path9 from "node:path";
+import path10 from "node:path";
 import { performance as performance2 } from "node:perf_hooks";
 import { pipeline as pipeline2 } from "node:stream/promises";
 import { pathToFileURL } from "node:url";
@@ -22339,7 +22458,7 @@ function resolveRuntimePackageVersion(version) {
   return normalized.length > 0 ? normalized : "latest";
 }
 function resolveRuntimeCacheDir(version, homeDir = resolveRudderHomeDir()) {
-  return path9.join(homeDir, "runtimes", sanitizeRuntimeCacheSegment(resolveRuntimePackageVersion(version)));
+  return path10.join(homeDir, "runtimes", sanitizeRuntimeCacheSegment(resolveRuntimePackageVersion(version)));
 }
 function resolveRuntimePackageSpec(version, packageName = RUNTIME_NPM_PACKAGE_NAME) {
   const packageVersion = resolveRuntimePackageVersion(version);
@@ -22347,7 +22466,7 @@ function resolveRuntimePackageSpec(version, packageName = RUNTIME_NPM_PACKAGE_NA
 }
 async function readRuntimeInstallMetadata(cacheDir) {
   try {
-    const raw = await readFile(path9.join(cacheDir, RUNTIME_METADATA_FILE), "utf8");
+    const raw = await readFile(path10.join(cacheDir, RUNTIME_METADATA_FILE), "utf8");
     const parsed = JSON.parse(raw);
     if (parsed.version !== 1) return null;
     if (typeof parsed.packageName !== "string" || typeof parsed.packageVersion !== "string") return null;
@@ -22362,7 +22481,7 @@ async function readRuntimeInstallMetadata(cacheDir) {
   }
 }
 async function writeRuntimeInstallMetadata(cacheDir, metadata) {
-  await writeFile(path9.join(cacheDir, RUNTIME_METADATA_FILE), `${JSON.stringify(metadata, null, 2)}
+  await writeFile(path10.join(cacheDir, RUNTIME_METADATA_FILE), `${JSON.stringify(metadata, null, 2)}
 `, "utf8");
 }
 async function touchRuntimeInstallMetadata(cacheDir, postgresRuntime) {
@@ -22390,7 +22509,7 @@ function resolveEmbeddedPostgresPlatformPackage(platform = process.platform, arc
 }
 async function canResolveRuntimePackage(cacheDir, packageName) {
   try {
-    await readFile(path9.join(cacheDir, "node_modules", ...packageName.split("/"), "package.json"), "utf8");
+    await readFile(path10.join(cacheDir, "node_modules", ...packageName.split("/"), "package.json"), "utf8");
     return true;
   } catch {
     return false;
@@ -22402,9 +22521,9 @@ async function hasRequiredRuntimePlatformDependencies(cacheDir, metadata, postgr
   if (!platformPackage) return true;
   if (await canResolveRuntimePackage(cacheDir, platformPackage)) return true;
   const expectedSharedBinDir = resolveSharedRuntimePostgresPayloadBinDir(
-    path9.dirname(path9.dirname(cacheDir))
+    path10.dirname(path10.dirname(cacheDir))
   );
-  return metadata.postgresRuntime?.scope === "shared" && metadata.postgresRuntime.platform === process.platform && metadata.postgresRuntime.arch === process.arch && path9.resolve(metadata.postgresRuntime.binDir) === path9.resolve(expectedSharedBinDir) && await isRuntimePostgresPayloadUsable(
+  return metadata.postgresRuntime?.scope === "shared" && metadata.postgresRuntime.platform === process.platform && metadata.postgresRuntime.arch === process.arch && path10.resolve(metadata.postgresRuntime.binDir) === path10.resolve(expectedSharedBinDir) && await isRuntimePostgresPayloadUsable(
     cacheDir,
     metadata.postgresRuntime.binDir,
     postgresVersionProbe,
@@ -22419,7 +22538,7 @@ async function isRuntimeCacheHitWithinDeadline(options, deadline) {
     return false;
   }
   try {
-    const packageJsonPath = path9.join(options.cacheDir, "node_modules", ...packageName.split("/"), "package.json");
+    const packageJsonPath = path10.join(options.cacheDir, "node_modules", ...packageName.split("/"), "package.json");
     const packageJson = JSON.parse(await readFile(packageJsonPath, "utf8"));
     const packageVersionMatches = packageVersion === "latest" || packageJson.version === packageVersion;
     return packageVersionMatches && await hasRequiredRuntimePlatformDependencies(
@@ -22439,7 +22558,7 @@ async function ensureRuntimeInstalled(options) {
   const cacheDir = resolveRuntimeCacheDir(packageVersion, homeDir);
   const deadline = createRuntimeInstallDeadline(options);
   return withRuntimeFilesystemLock(
-    path9.join(homeDir, "runtime-payloads", ".postgres-runtime.lifecycle.lock"),
+    path10.join(homeDir, "runtime-payloads", ".postgres-runtime.lifecycle.lock"),
     async () => withRuntimeFilesystemLock(
       `${cacheDir}.install.lock`,
       async () => {
@@ -22562,7 +22681,7 @@ async function ensureRuntimeInstalledUnlocked(options, deadline) {
   }
   await rm(cacheDir, { recursive: true, force: true });
   await mkdir(cacheDir, { recursive: true });
-  await writeFile(path9.join(cacheDir, "package.json"), `${JSON.stringify(RUNTIME_CACHE_PACKAGE_JSON, null, 2)}
+  await writeFile(path10.join(cacheDir, "package.json"), `${JSON.stringify(RUNTIME_CACHE_PACKAGE_JSON, null, 2)}
 `, "utf8");
   const result = runNpmRuntimeInstall(spawnSyncImpl, cacheDir, packageSpec, deadline);
   let output = collectSpawnOutput(result);
@@ -22602,7 +22721,7 @@ async function ensureRuntimeInstalledUnlocked(options, deadline) {
         }
         await rm(fallbackCacheDir, { recursive: true, force: true });
         await mkdir(fallbackCacheDir, { recursive: true });
-        await writeFile(path9.join(fallbackCacheDir, "package.json"), `${JSON.stringify(RUNTIME_CACHE_PACKAGE_JSON, null, 2)}
+        await writeFile(path10.join(fallbackCacheDir, "package.json"), `${JSON.stringify(RUNTIME_CACHE_PACKAGE_JSON, null, 2)}
 `, "utf8");
         const fallbackResult = runNpmRuntimeInstall(spawnSyncImpl, fallbackCacheDir, fallbackSpec, deadline);
         let fallbackOutput = collectSpawnOutput(fallbackResult);
@@ -22684,10 +22803,10 @@ async function ensureRuntimeInstalledUnlocked(options, deadline) {
   );
 }
 function resolveRuntimePostgresPayloadBinDir(cacheDir, platform = process.platform, arch = process.arch) {
-  return path9.join(cacheDir, RUNTIME_POSTGRES_PAYLOAD_DIR, runtimePostgresPlatformSegment(platform, arch), "bin");
+  return path10.join(cacheDir, RUNTIME_POSTGRES_PAYLOAD_DIR, runtimePostgresPlatformSegment(platform, arch), "bin");
 }
 function resolveSharedRuntimePostgresPayloadBinDir(homeDir = resolveRudderHomeDir(), platform = process.platform, arch = process.arch) {
-  return path9.join(
+  return path10.join(
     homeDir,
     "runtime-payloads",
     RUNTIME_POSTGRES_PAYLOAD_DIR,
@@ -22696,7 +22815,7 @@ function resolveSharedRuntimePostgresPayloadBinDir(homeDir = resolveRudderHomeDi
   );
 }
 function resolveRuntimeServerEntrypoint(cacheDir, packageName = RUNTIME_NPM_PACKAGE_NAME) {
-  return createRequire(path9.join(cacheDir, "package.json")).resolve(packageName);
+  return createRequire(path10.join(cacheDir, "package.json")).resolve(packageName);
 }
 async function importRuntimeServerModule(cacheDir, packageName = RUNTIME_NPM_PACKAGE_NAME) {
   const entrypoint = resolveRuntimeServerEntrypoint(cacheDir, packageName);
@@ -22720,7 +22839,7 @@ function formatRuntimeInstallCommand(cacheDir, packageSpec) {
   return `npm install --prefix ${cacheDir} ${RUNTIME_NPM_INSTALL_FLAGS.join(" ")} ${packageSpec}`;
 }
 function formatRuntimePlatformRepairCommand(cacheDir, packageSpec) {
-  return `npm pack ${packageSpec} --registry=${NPM_PUBLIC_REGISTRY_URL} --silent, then extract it into ${path9.join(cacheDir, "node_modules")}`;
+  return `npm pack ${packageSpec} --registry=${NPM_PUBLIC_REGISTRY_URL} --silent, then extract it into ${path10.join(cacheDir, "node_modules")}`;
 }
 function collectSpawnOutput(result) {
   return [result.stdout, result.stderr, result.error instanceof Error ? result.error.message : null].filter((value) => typeof value === "string" && value.trim().length > 0).join("\n").trim();
@@ -22737,7 +22856,7 @@ function withPostgresPayload(result, postgresPayload) {
   };
 }
 function runtimePackageJsonPath(cacheDir, packageName) {
-  return path9.join(cacheDir, "node_modules", ...packageName.split("/"), "package.json");
+  return path10.join(cacheDir, "node_modules", ...packageName.split("/"), "package.json");
 }
 async function readRuntimePackageJson(cacheDir, packageName) {
   try {
@@ -22792,7 +22911,7 @@ async function ensureRequiredEmbeddedPostgresPlatformPackage(spawnSyncImpl, cach
   );
 }
 async function installRuntimePackageInStaging(spawnSyncImpl, cacheDir, packageSpec, packageName, deadline) {
-  const stagingDir = path9.join(cacheDir, `.platform-repair-${process.pid}-${Date.now()}`);
+  const stagingDir = path10.join(cacheDir, `.platform-repair-${process.pid}-${Date.now()}`);
   await mkdir(stagingDir, { recursive: true });
   try {
     const packResult = runNpmPack(spawnSyncImpl, packageSpec, stagingDir, cacheDir, deadline);
@@ -22801,9 +22920,9 @@ async function installRuntimePackageInStaging(spawnSyncImpl, cacheDir, packageSp
     if (!packFilename) {
       return createSyntheticSpawnResult(1, "", `Unable to parse npm pack output for ${packageSpec}.`);
     }
-    const archivePath = path9.join(stagingDir, packFilename);
-    const targetDir = path9.dirname(runtimePackageJsonPath(cacheDir, packageName));
-    await mkdir(path9.dirname(targetDir), { recursive: true });
+    const archivePath = path10.join(stagingDir, packFilename);
+    const targetDir = path10.dirname(runtimePackageJsonPath(cacheDir, packageName));
+    await mkdir(path10.dirname(targetDir), { recursive: true });
     await rm(targetDir, { recursive: true, force: true });
     await mkdir(targetDir, { recursive: true });
     const extractResult = runTarExtract(spawnSyncImpl, archivePath, targetDir, cacheDir, deadline);
@@ -22859,8 +22978,8 @@ function combineSpawnResults(...results) {
 }
 async function removeRuntimeInstallLocks(cacheDir) {
   await Promise.all([
-    rm(path9.join(cacheDir, "package-lock.json"), { force: true }),
-    rm(path9.join(cacheDir, "node_modules", ".package-lock.json"), { force: true })
+    rm(path10.join(cacheDir, "package-lock.json"), { force: true }),
+    rm(path10.join(cacheDir, "node_modules", ".package-lock.json"), { force: true })
   ]);
 }
 function packageNameFromSpec(packageSpec) {
@@ -22884,25 +23003,25 @@ function runtimePostgresExecutableName(baseName) {
   return process.platform === "win32" ? `${baseName}.exe` : baseName;
 }
 function debianSharedirCandidate(binDir) {
-  const normalized = path9.resolve(binDir);
-  const parts = normalized.split(path9.sep);
+  const normalized = path10.resolve(binDir);
+  const parts = normalized.split(path10.sep);
   const libIndex = parts.lastIndexOf("lib");
   if (libIndex < 0) return null;
   if (parts[libIndex + 1] !== "postgresql") return null;
   const version = parts[libIndex + 2];
   if (!version || parts[libIndex + 3] !== "bin") return null;
-  const prefix = parts.slice(0, libIndex).join(path9.sep) || path9.sep;
-  return path9.join(prefix, "share", "postgresql", version);
+  const prefix = parts.slice(0, libIndex).join(path10.sep) || path10.sep;
+  return path10.join(prefix, "share", "postgresql", version);
 }
 async function resolveRuntimePostgresTemplateDir(binDir, cacheDir = binDir, deadline) {
   for (const candidatePath of [
-    path9.join(binDir, "..", "share", "postgresql", "postgres.bki"),
-    path9.join(binDir, "..", "share", "postgres.bki")
+    path10.join(binDir, "..", "share", "postgresql", "postgres.bki"),
+    path10.join(binDir, "..", "share", "postgres.bki")
   ]) {
     remainingRuntimeInstallMs(deadline, cacheDir, "discover PostgreSQL runtime templates");
     try {
       await stat(candidatePath);
-      return path9.dirname(candidatePath);
+      return path10.dirname(candidatePath);
     } catch {
     }
   }
@@ -22910,12 +23029,12 @@ async function resolveRuntimePostgresTemplateDir(binDir, cacheDir = binDir, dead
   if (debianSharedir) {
     remainingRuntimeInstallMs(deadline, cacheDir, "discover PostgreSQL runtime templates");
     try {
-      await stat(path9.join(debianSharedir, "postgres.bki"));
+      await stat(path10.join(debianSharedir, "postgres.bki"));
       return debianSharedir;
     } catch {
     }
   }
-  const pgConfigPath = path9.join(binDir, process.platform === "win32" ? "pg_config.exe" : "pg_config");
+  const pgConfigPath = path10.join(binDir, process.platform === "win32" ? "pg_config.exe" : "pg_config");
   try {
     remainingRuntimeInstallMs(deadline, cacheDir, "discover PostgreSQL runtime templates");
     await stat(pgConfigPath);
@@ -22934,7 +23053,7 @@ async function resolveRuntimePostgresTemplateDir(binDir, cacheDir = binDir, dead
     }
     if (!sharedir) return null;
     remainingRuntimeInstallMs(deadline, cacheDir, "validate PostgreSQL runtime templates");
-    const candidatePath = path9.join(sharedir, "postgres.bki");
+    const candidatePath = path10.join(sharedir, "postgres.bki");
     await stat(candidatePath);
     return sharedir;
   } catch (error) {
@@ -22943,7 +23062,7 @@ async function resolveRuntimePostgresTemplateDir(binDir, cacheDir = binDir, dead
   }
 }
 function resolveRuntimePostgresShareDir(binDir, templateDir) {
-  const adjacentShareDir = path9.resolve(binDir, "..", "share");
+  const adjacentShareDir = path10.resolve(binDir, "..", "share");
   return pathIsInside(templateDir, adjacentShareDir) ? adjacentShareDir : templateDir;
 }
 async function assertRuntimePostgresBinDirComplete(cacheDir, binDir, deadline) {
@@ -22951,7 +23070,7 @@ async function assertRuntimePostgresBinDirComplete(cacheDir, binDir, deadline) {
   const missing = [];
   for (const binary of requiredBinaries) {
     remainingRuntimeInstallMs(deadline, cacheDir, "validate PostgreSQL runtime binaries");
-    const binaryPath = path9.join(binDir, runtimePostgresExecutableName(binary));
+    const binaryPath = path10.join(binDir, runtimePostgresExecutableName(binary));
     try {
       await stat(binaryPath);
     } catch {
@@ -22960,19 +23079,19 @@ async function assertRuntimePostgresBinDirComplete(cacheDir, binDir, deadline) {
   }
   const templateDir = await resolveRuntimePostgresTemplateDir(binDir, cacheDir, deadline);
   if (!templateDir) {
-    missing.push(path9.join(binDir, "..", "share", "postgresql", "postgres.bki"));
+    missing.push(path10.join(binDir, "..", "share", "postgresql", "postgres.bki"));
   } else {
     try {
-      await stat(path9.join(templateDir, "postgresql.conf.sample"));
+      await stat(path10.join(templateDir, "postgresql.conf.sample"));
     } catch {
-      missing.push(path9.join(templateDir, "postgresql.conf.sample"));
+      missing.push(path10.join(templateDir, "postgresql.conf.sample"));
     }
     const shareDir = resolveRuntimePostgresShareDir(binDir, templateDir);
     const hasTimezoneDir = (await Promise.all([
-      path9.join(templateDir, "timezone"),
-      path9.join(shareDir, "timezone")
+      path10.join(templateDir, "timezone"),
+      path10.join(shareDir, "timezone")
     ].map((candidate) => stat(candidate).catch(() => null)))).some((candidate) => candidate?.isDirectory());
-    if (!hasTimezoneDir) missing.push(path9.join(shareDir, "timezone"));
+    if (!hasTimezoneDir) missing.push(path10.join(shareDir, "timezone"));
   }
   if (missing.length > 0) {
     throw new RuntimeInstallError(
@@ -22997,8 +23116,8 @@ async function isRuntimePostgresPayloadUsable(cacheDir, binDir, postgresVersionP
   }
 }
 function pathIsInside(candidatePath, rootPath) {
-  const relative = path9.relative(path9.resolve(rootPath), path9.resolve(candidatePath));
-  return relative === "" || relative !== ".." && !relative.startsWith(`..${path9.sep}`) && !path9.isAbsolute(relative);
+  const relative = path10.relative(path10.resolve(rootPath), path10.resolve(candidatePath));
+  return relative === "" || relative !== ".." && !relative.startsWith(`..${path10.sep}`) && !path10.isAbsolute(relative);
 }
 async function copyRuntimePayloadEntry(sourcePath, targetPath, cacheDir, deadline, signal, command) {
   if (signal.aborted) throw runtimeInstallDeadlineError(cacheDir, command);
@@ -23011,8 +23130,8 @@ async function copyRuntimePayloadEntry(sourcePath, targetPath, cacheDir, deadlin
     const entries = await readdir(sourcePath);
     for (const entry of entries) {
       await copyRuntimePayloadEntry(
-        path9.join(sourcePath, entry),
-        path9.join(targetPath, entry),
+        path10.join(sourcePath, entry),
+        path10.join(targetPath, entry),
         cacheDir,
         deadline,
         signal,
@@ -23022,7 +23141,7 @@ async function copyRuntimePayloadEntry(sourcePath, targetPath, cacheDir, deadlin
     return;
   }
   if (!sourceStats.isFile()) return;
-  await mkdir(path9.dirname(targetPath), { recursive: true });
+  await mkdir(path10.dirname(targetPath), { recursive: true });
   try {
     await pipeline2(
       createReadStream2(sourcePath),
@@ -23056,11 +23175,11 @@ async function copyRuntimePostgresPayloadWithinDeadline(sourceRuntimeDir, target
   const copyPromise = (async () => {
     await mkdir(targetRuntimeDir, { recursive: true });
     for (const directoryName of ["bin", "lib"]) {
-      const sourceDirectory = path9.join(sourceRuntimeDir, directoryName);
+      const sourceDirectory = path10.join(sourceRuntimeDir, directoryName);
       if (!await stat(sourceDirectory).catch(() => null)) continue;
       await copyRuntimePayloadEntry(
         sourceDirectory,
-        path9.join(targetRuntimeDir, directoryName),
+        path10.join(targetRuntimeDir, directoryName),
         cacheDir,
         deadline,
         controller.signal,
@@ -23069,7 +23188,7 @@ async function copyRuntimePostgresPayloadWithinDeadline(sourceRuntimeDir, target
     }
     await copyRuntimePayloadEntry(
       sourceShareDir,
-      path9.join(targetRuntimeDir, "share"),
+      path10.join(targetRuntimeDir, "share"),
       cacheDir,
       deadline,
       controller.signal,
@@ -23087,15 +23206,15 @@ async function copyRuntimePostgresPayloadWithinDeadline(sourceRuntimeDir, target
 async function withRuntimeFilesystemLock(lockPath, task, options = {}) {
   const deadlineTimeout = remainingRuntimeInstallMs(
     options.deadline,
-    options.cacheDir ?? path9.dirname(lockPath),
+    options.cacheDir ?? path10.dirname(lockPath),
     options.command ?? `wait for runtime lock ${lockPath}`
   );
   const timeoutMs = Math.min(options.timeoutMs ?? 3e4, deadlineTimeout ?? Number.POSITIVE_INFINITY);
   const pollMs = options.pollMs ?? 50;
   const startedAt = Date.now();
   const lockId = `${process.pid}-${startedAt}-${Math.random().toString(16).slice(2)}`;
-  const ownerPath = path9.join(lockPath, "owner.json");
-  await mkdir(path9.dirname(lockPath), { recursive: true });
+  const ownerPath = path10.join(lockPath, "owner.json");
+  await mkdir(path10.dirname(lockPath), { recursive: true });
   while (true) {
     try {
       await mkdir(lockPath);
@@ -23124,12 +23243,12 @@ async function withRuntimeFilesystemLock(lockPath, task, options = {}) {
       if (Date.now() - startedAt >= timeoutMs) {
         throw new RuntimeInstallError(
           `Timed out waiting for PostgreSQL runtime install lock ${lockPath}`,
-          { cacheDir: path9.dirname(lockPath), command: "prepare shared PostgreSQL runtime", output: "" }
+          { cacheDir: path10.dirname(lockPath), command: "prepare shared PostgreSQL runtime", output: "" }
         );
       }
       remainingRuntimeInstallMs(
         options.deadline,
-        options.cacheDir ?? path9.dirname(lockPath),
+        options.cacheDir ?? path10.dirname(lockPath),
         options.command ?? `wait for runtime lock ${lockPath}`
       );
       await new Promise((resolve) => setTimeout(resolve, pollMs));
@@ -23149,29 +23268,29 @@ async function withRuntimeFilesystemLock(lockPath, task, options = {}) {
 }
 function isManagedRuntimePostgresBinDir(binDir, homeDir) {
   const managedBinDir = process.env[RUDDER_DESKTOP_MANAGED_POSTGRES_BIN_DIR_ENV]?.trim();
-  if (managedBinDir && path9.resolve(managedBinDir) === path9.resolve(binDir)) return true;
-  const runtimesRelative = path9.relative(
-    path9.join(homeDir, "runtimes"),
-    path9.resolve(binDir)
+  if (managedBinDir && path10.resolve(managedBinDir) === path10.resolve(binDir)) return true;
+  const runtimesRelative = path10.relative(
+    path10.join(homeDir, "runtimes"),
+    path10.resolve(binDir)
   );
-  const runtimeSegments = runtimesRelative.split(path9.sep);
-  if (runtimesRelative !== "" && runtimesRelative !== ".." && !runtimesRelative.startsWith(`..${path9.sep}`) && !path9.isAbsolute(runtimesRelative) && runtimeSegments.length === 4 && runtimeSegments[0]?.length > 0 && runtimeSegments[1] === RUNTIME_POSTGRES_PAYLOAD_DIR && runtimeSegments[2] === `${process.platform}-${process.arch}` && runtimeSegments[3] === "bin") {
+  const runtimeSegments = runtimesRelative.split(path10.sep);
+  if (runtimesRelative !== "" && runtimesRelative !== ".." && !runtimesRelative.startsWith(`..${path10.sep}`) && !path10.isAbsolute(runtimesRelative) && runtimeSegments.length === 4 && runtimeSegments[0]?.length > 0 && runtimeSegments[1] === RUNTIME_POSTGRES_PAYLOAD_DIR && runtimeSegments[2] === `${process.platform}-${process.arch}` && runtimeSegments[3] === "bin") {
     return true;
   }
-  const payloadsRelative = path9.relative(
-    path9.join(homeDir, "runtime-payloads"),
-    path9.resolve(binDir)
+  const payloadsRelative = path10.relative(
+    path10.join(homeDir, "runtime-payloads"),
+    path10.resolve(binDir)
   );
-  const payloadSegments = payloadsRelative.split(path9.sep);
-  return payloadsRelative !== "" && payloadsRelative !== ".." && !payloadsRelative.startsWith(`..${path9.sep}`) && !path9.isAbsolute(payloadsRelative) && payloadSegments.length === 3 && payloadSegments[0] === RUNTIME_POSTGRES_PAYLOAD_DIR && payloadSegments[1] === `${process.platform}-${process.arch}` && payloadSegments[2] === "bin";
+  const payloadSegments = payloadsRelative.split(path10.sep);
+  return payloadsRelative !== "" && payloadsRelative !== ".." && !payloadsRelative.startsWith(`..${path10.sep}`) && !path10.isAbsolute(payloadsRelative) && payloadSegments.length === 3 && payloadSegments[0] === RUNTIME_POSTGRES_PAYLOAD_DIR && payloadSegments[1] === `${process.platform}-${process.arch}` && payloadSegments[2] === "bin";
 }
 async function findLegacyRuntimePostgresBinDir(cacheDir, homeDir, postgresVersionProbe, deadline) {
-  const runtimesRoot = path9.join(homeDir, "runtimes");
+  const runtimesRoot = path10.join(homeDir, "runtimes");
   const entries = await readdir(runtimesRoot, { withFileTypes: true }).catch(() => []);
   for (const entry of entries) {
     if (!entry.isDirectory() && !entry.isSymbolicLink()) continue;
-    const candidateCacheDir = path9.join(runtimesRoot, entry.name);
-    if (path9.resolve(candidateCacheDir) === path9.resolve(cacheDir)) continue;
+    const candidateCacheDir = path10.join(runtimesRoot, entry.name);
+    if (path10.resolve(candidateCacheDir) === path10.resolve(cacheDir)) continue;
     const candidateBinDir = resolveRuntimePostgresPayloadBinDir(candidateCacheDir);
     remainingRuntimeInstallMs(deadline, cacheDir, "find cached PostgreSQL runtime payload");
     if (await isRuntimePostgresPayloadUsable(cacheDir, candidateBinDir, postgresVersionProbe, deadline)) {
@@ -23181,13 +23300,13 @@ async function findLegacyRuntimePostgresBinDir(cacheDir, homeDir, postgresVersio
   return null;
 }
 async function readLiveRuntimeDescriptors(homeDir) {
-  const instancesRoot = path9.join(homeDir, "instances");
+  const instancesRoot = path10.join(homeDir, "instances");
   const entries = await readdir(instancesRoot, { withFileTypes: true }).catch(() => []);
   const descriptors = [];
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
     try {
-      const raw = JSON.parse(await readFile(path9.join(instancesRoot, entry.name, "runtime", "server.json"), "utf8"));
+      const raw = JSON.parse(await readFile(path10.join(instancesRoot, entry.name, "runtime", "server.json"), "utf8"));
       if (typeof raw.pid !== "number" || !Number.isInteger(raw.pid) || !isPidRunning(raw.pid) || typeof raw.version !== "string") {
         continue;
       }
@@ -23205,13 +23324,13 @@ async function assertSharedPostgresPayloadNotLive(cacheDir, homeDir, sharedBinDi
   const sharedPhysicalBinDir = await realpath(sharedBinDir).catch(() => null);
   const mayReferenceSharedPayload = await Promise.all(liveDescriptors.map(async (descriptor) => {
     if (descriptor.postgresBinDir === void 0) return true;
-    if (path9.resolve(descriptor.postgresBinDir) === path9.resolve(sharedBinDir)) return true;
+    if (path10.resolve(descriptor.postgresBinDir) === path10.resolve(sharedBinDir)) return true;
     const descriptorPhysicalBinDir = await realpath(descriptor.postgresBinDir).catch(() => null);
-    if (descriptorPhysicalBinDir && sharedPhysicalBinDir && path9.resolve(descriptorPhysicalBinDir) === path9.resolve(sharedPhysicalBinDir)) {
+    if (descriptorPhysicalBinDir && sharedPhysicalBinDir && path10.resolve(descriptorPhysicalBinDir) === path10.resolve(sharedPhysicalBinDir)) {
       return true;
     }
     if (!descriptorPhysicalBinDir) {
-      return pathIsInside(descriptor.postgresBinDir, path9.join(homeDir, "runtimes")) || pathIsInside(descriptor.postgresBinDir, path9.join(homeDir, "runtime-payloads"));
+      return pathIsInside(descriptor.postgresBinDir, path10.join(homeDir, "runtimes")) || pathIsInside(descriptor.postgresBinDir, path10.join(homeDir, "runtime-payloads"));
     }
     return false;
   }));
@@ -23226,7 +23345,7 @@ async function validateRuntimePostgresVersion(cacheDir, binDir, postgresVersionP
   await assertRuntimePostgresBinDirComplete(cacheDir, binDir, deadline);
   for (const binary of ["initdb", "pg_ctl", "postgres"]) {
     remainingRuntimeInstallMs(deadline, cacheDir, "validate PostgreSQL runtime version");
-    const binaryPath = path9.join(binDir, runtimePostgresExecutableName(binary));
+    const binaryPath = path10.join(binDir, runtimePostgresExecutableName(binary));
     const result = postgresVersionProbe(binaryPath);
     if (!/\bPostgreSQL\)?\s+18\.4\b/i.test(result)) {
       throw new RuntimeInstallError(
@@ -23266,24 +23385,24 @@ async function findRuntimePostgresBinDir(rootDir, cacheDir, postgresVersionProbe
     if (await isRuntimePostgresPayloadUsable(cacheDir, current, postgresVersionProbe, deadline)) return current;
     const entries = await readdir(current, { withFileTypes: true }).catch(() => []);
     for (const entry of entries) {
-      if (entry.isDirectory()) queue.push(path9.join(current, entry.name));
+      if (entry.isDirectory()) queue.push(path10.join(current, entry.name));
     }
   }
   return null;
 }
 async function reconcileSharedPostgresPayloadGenerations(cacheDir, sharedPlatformRoot, postgresVersionProbe, cleanupDownloads = false, deadline) {
   remainingRuntimeInstallMs(deadline, cacheDir, "reconcile shared PostgreSQL payload");
-  const parentDir = path9.dirname(sharedPlatformRoot);
-  const baseName = path9.basename(sharedPlatformRoot);
+  const parentDir = path10.dirname(sharedPlatformRoot);
+  const baseName = path10.basename(sharedPlatformRoot);
   const entries = await readdir(parentDir, { withFileTypes: true }).catch(() => []);
-  const temporaryRoots = entries.filter((entry) => entry.name.startsWith(`${baseName}.tmp-`)).map((entry) => path9.join(parentDir, entry.name));
-  const previousRoots = entries.filter((entry) => entry.name.startsWith(`${baseName}.previous-`)).map((entry) => path9.join(parentDir, entry.name)).sort().reverse();
-  const downloadsRoot = path9.join(
-    path9.dirname(path9.dirname(sharedPlatformRoot)),
+  const temporaryRoots = entries.filter((entry) => entry.name.startsWith(`${baseName}.tmp-`)).map((entry) => path10.join(parentDir, entry.name));
+  const previousRoots = entries.filter((entry) => entry.name.startsWith(`${baseName}.previous-`)).map((entry) => path10.join(parentDir, entry.name)).sort().reverse();
+  const downloadsRoot = path10.join(
+    path10.dirname(path10.dirname(sharedPlatformRoot)),
     ".downloads"
   );
-  const staleDownloadRoots = cleanupDownloads ? (await readdir(downloadsRoot, { withFileTypes: true }).catch(() => [])).filter((entry) => entry.name.startsWith("postgres-18.4-")).map((entry) => path9.join(downloadsRoot, entry.name)) : [];
-  const canonicalBinDir = path9.join(sharedPlatformRoot, "bin");
+  const staleDownloadRoots = cleanupDownloads ? (await readdir(downloadsRoot, { withFileTypes: true }).catch(() => [])).filter((entry) => entry.name.startsWith("postgres-18.4-")).map((entry) => path10.join(downloadsRoot, entry.name)) : [];
+  const canonicalBinDir = path10.join(sharedPlatformRoot, "bin");
   if (!await isRuntimePostgresPayloadUsable(
     cacheDir,
     canonicalBinDir,
@@ -23293,7 +23412,7 @@ async function reconcileSharedPostgresPayloadGenerations(cacheDir, sharedPlatfor
     for (const previousRoot of previousRoots) {
       if (!await isRuntimePostgresPayloadUsable(
         cacheDir,
-        path9.join(previousRoot, "bin"),
+        path10.join(previousRoot, "bin"),
         postgresVersionProbe,
         deadline
       )) {
@@ -23312,9 +23431,9 @@ async function reconcileSharedPostgresPayloadGenerations(cacheDir, sharedPlatfor
 }
 async function installSharedRuntimePostgresPayload(cacheDir, homeDir, sourceBinDir, postgresVersionProbe, deadline) {
   const sharedBinDir = resolveSharedRuntimePostgresPayloadBinDir(homeDir);
-  const sharedRuntimeDir = path9.dirname(sharedBinDir);
+  const sharedRuntimeDir = path10.dirname(sharedBinDir);
   const sharedPlatformRoot = sharedRuntimeDir;
-  const sourceRuntimeDir = path9.dirname(sourceBinDir);
+  const sourceRuntimeDir = path10.dirname(sourceBinDir);
   const sourceTemplateDir = await resolveRuntimePostgresTemplateDir(sourceBinDir, cacheDir, deadline);
   if (!sourceTemplateDir) {
     throw new RuntimeInstallError(
@@ -23335,7 +23454,7 @@ async function installSharedRuntimePostgresPayload(cacheDir, homeDir, sourceBinD
       return sharedBinDir;
     }
     await assertSharedPostgresPayloadNotLive(cacheDir, homeDir, sharedBinDir);
-    await mkdir(path9.dirname(sharedPlatformRoot), { recursive: true });
+    await mkdir(path10.dirname(sharedPlatformRoot), { recursive: true });
     const temporaryPlatformRoot = `${sharedPlatformRoot}.tmp-${process.pid}-${Date.now()}`;
     const previousPlatformRoot = `${sharedPlatformRoot}.previous-${process.pid}-${Date.now()}`;
     let previousMoved = false;
@@ -23352,7 +23471,7 @@ async function installSharedRuntimePostgresPayload(cacheDir, homeDir, sourceBinD
         cacheDir,
         deadline
       );
-      const temporaryBinDir = path9.join(temporaryRuntimeDir, "bin");
+      const temporaryBinDir = path10.join(temporaryRuntimeDir, "bin");
       await validateRuntimePostgresVersion(cacheDir, temporaryBinDir, postgresVersionProbe, deadline);
       try {
         await rename(sharedPlatformRoot, previousPlatformRoot);
@@ -23388,17 +23507,17 @@ async function downloadSharedRuntimePostgresPayload(cacheDir, homeDir, postgresV
   const archiveUrl = archiveSource?.url ?? null;
   if (!archiveUrl) return null;
   const sharedBinDir = resolveSharedRuntimePostgresPayloadBinDir(homeDir);
-  const sharedPlatformRoot = path9.dirname(sharedBinDir);
+  const sharedPlatformRoot = path10.dirname(sharedBinDir);
   const downloadLockPath = `${sharedPlatformRoot}.download.lock`;
   return withRuntimeFilesystemLock(downloadLockPath, async () => {
     if (await isRuntimePostgresPayloadUsable(cacheDir, sharedBinDir, postgresVersionProbe, deadline)) {
       return sharedBinDir;
     }
-    const workRoot = path9.join(homeDir, "runtime-payloads", ".downloads");
+    const workRoot = path10.join(homeDir, "runtime-payloads", ".downloads");
     await mkdir(workRoot, { recursive: true });
-    const workDir = await mkdtemp(path9.join(workRoot, "postgres-18.4-"));
-    const archivePath = path9.join(workDir, "postgresql-18.4.zip");
-    const extractDir = path9.join(workDir, "extract");
+    const workDir = await mkdtemp(path10.join(workRoot, "postgres-18.4-"));
+    const archivePath = path10.join(workDir, "postgresql-18.4.zip");
+    const extractDir = path10.join(workDir, "extract");
     try {
       await downloadRuntimePostgresArchive(
         archiveUrl,
@@ -23409,7 +23528,7 @@ async function downloadSharedRuntimePostgresPayload(cacheDir, homeDir, postgresV
       const configuredMaxBytes = Number.parseInt(process.env[RUDDER_POSTGRES_RUNTIME_ARCHIVE_MAX_BYTES_ENV2] ?? "", 10);
       const maxArchiveBytes = Number.isSafeInteger(configuredMaxBytes) && configuredMaxBytes > 0 ? configuredMaxBytes : DEFAULT_RUNTIME_POSTGRES_ARCHIVE_MAX_BYTES2;
       const nativePublishStaging = `${sharedPlatformRoot}.tmp-native-${process.pid}-${Date.now()}`;
-      await mkdir(path9.dirname(sharedPlatformRoot), { recursive: true });
+      await mkdir(path10.dirname(sharedPlatformRoot), { recursive: true });
       const nativeInstall = await tryInstallNativePayload({
         archivePath,
         extractPath: extractDir,
@@ -23441,22 +23560,22 @@ async function downloadSharedRuntimePostgresPayload(cacheDir, homeDir, postgresV
             );
           }
           await copyRuntimePostgresPayloadWithinDeadline(
-            path9.dirname(extractedBinDir2),
+            path10.dirname(extractedBinDir2),
             publishStagingPath,
             resolveRuntimePostgresShareDir(extractedBinDir2, templateDir),
             cacheDir,
             deadline,
             context.signal
           );
-          return path9.relative(
+          return path10.relative(
             publishStagingPath,
-            path9.join(publishStagingPath, "bin", runtimePostgresExecutableName("postgres"))
+            path10.join(publishStagingPath, "bin", runtimePostgresExecutableName("postgres"))
           );
         },
         validatePublished: async (destinationPath) => {
           await validateRuntimePostgresVersion(
             cacheDir,
-            path9.join(destinationPath, "bin"),
+            path10.join(destinationPath, "bin"),
             postgresVersionProbe,
             deadline
           );
@@ -23494,20 +23613,20 @@ async function downloadSharedRuntimePostgresPayload(cacheDir, homeDir, postgresV
   }, { deadline, cacheDir, command: "acquire shared PostgreSQL download lock" });
 }
 async function ensureRuntimePostgresCompatibilityLink(cacheDir, homeDir, packageVersion) {
-  const compatibilityRoot = path9.join(cacheDir, RUNTIME_POSTGRES_PAYLOAD_DIR);
-  const sharedPayloadRoot = path9.join(homeDir, "runtime-payloads", RUNTIME_POSTGRES_PAYLOAD_DIR);
+  const compatibilityRoot = path10.join(cacheDir, RUNTIME_POSTGRES_PAYLOAD_DIR);
+  const sharedPayloadRoot = path10.join(homeDir, "runtime-payloads", RUNTIME_POSTGRES_PAYLOAD_DIR);
   const runtimeMetadata = await readRuntimeInstallMetadata(cacheDir);
   const liveDescriptors = await readLiveRuntimeDescriptors(homeDir);
   const compatibilityBinDir = resolveRuntimePostgresPayloadBinDir(cacheDir);
   const isProtected = liveDescriptors.some((descriptor) => descriptor.postgresBinDir && pathIsInside(descriptor.postgresBinDir, compatibilityRoot) || !descriptor.postgresBinDir && descriptor.version === (runtimeMetadata?.packageVersion ?? packageVersion));
   if (isProtected) return;
-  await mkdir(path9.dirname(compatibilityRoot), { recursive: true });
+  await mkdir(path10.dirname(compatibilityRoot), { recursive: true });
   const temporaryRoot = `${compatibilityRoot}.next-${process.pid}-${Date.now()}`;
   const previousRoot = `${compatibilityRoot}.previous-${process.pid}-${Date.now()}`;
   await rm(temporaryRoot, { recursive: true, force: true });
   await rm(previousRoot, { recursive: true, force: true });
   await symlink(
-    process.platform === "win32" ? sharedPayloadRoot : path9.relative(path9.dirname(compatibilityRoot), sharedPayloadRoot),
+    process.platform === "win32" ? sharedPayloadRoot : path10.relative(path10.dirname(compatibilityRoot), sharedPayloadRoot),
     temporaryRoot,
     process.platform === "win32" ? "junction" : "dir"
   );
@@ -23540,7 +23659,7 @@ async function ensureRuntimePostgresCompatibilityLink(cacheDir, homeDir, package
 async function stageRuntimePostgresPayload(cacheDir, homeDir, packageVersion, enabled, postgresVersionProbe, deadline, cleanupDownloadWorkDir) {
   if (!enabled) return { output: "" };
   const explicitSourceBinDir = process.env[RUDDER_POSTGRES_BIN_DIR_ENV]?.trim();
-  const resolvedExplicitSourceBinDir = explicitSourceBinDir ? path9.resolve(explicitSourceBinDir) : null;
+  const resolvedExplicitSourceBinDir = explicitSourceBinDir ? path10.resolve(explicitSourceBinDir) : null;
   if (resolvedExplicitSourceBinDir && !isManagedRuntimePostgresBinDir(resolvedExplicitSourceBinDir, homeDir)) {
     await validateRuntimePostgresVersion(
       cacheDir,
@@ -23561,7 +23680,7 @@ async function stageRuntimePostgresPayload(cacheDir, homeDir, packageVersion, en
     };
   }
   const sharedBinDir = resolveSharedRuntimePostgresPayloadBinDir(homeDir);
-  const sharedPlatformRoot = path9.dirname(sharedBinDir);
+  const sharedPlatformRoot = path10.dirname(sharedBinDir);
   await withRuntimeFilesystemLock(
     `${sharedPlatformRoot}.install.lock`,
     async () => reconcileSharedPostgresPayloadGenerations(
@@ -23673,13 +23792,13 @@ async function pruneRuntimeCache(options = {}) {
   };
 }
 async function scanRuntimeCacheEntries(homeDir) {
-  const runtimesDir = path9.join(homeDir, "runtimes");
+  const runtimesDir = path10.join(homeDir, "runtimes");
   const dirents = await readdir(runtimesDir, { withFileTypes: true }).catch(() => null);
   if (!dirents) return [];
   const entries = [];
   for (const dirent of dirents) {
     if (!dirent.isDirectory()) continue;
-    const cacheDir = path9.join(runtimesDir, dirent.name);
+    const cacheDir = path10.join(runtimesDir, dirent.name);
     const metadata = await readRuntimeInstallMetadata(cacheDir);
     if (!metadata) continue;
     const fallbackStat = await safeStat(cacheDir);
@@ -23712,7 +23831,7 @@ async function directorySizeBytes(targetPath) {
   if (!dirents) return 0;
   let total = 0;
   for (const dirent of dirents) {
-    const entryPath = path9.join(targetPath, dirent.name);
+    const entryPath = path10.join(targetPath, dirent.name);
     if (dirent.isSymbolicLink()) continue;
     if (dirent.isDirectory()) {
       total += await directorySizeBytes(entryPath);
@@ -23724,14 +23843,14 @@ async function directorySizeBytes(targetPath) {
   return total;
 }
 async function readActiveRuntimeVersions(homeDir) {
-  const instancesDir = path9.join(homeDir, "instances");
+  const instancesDir = path10.join(homeDir, "instances");
   const dirents = await readdir(instancesDir, { withFileTypes: true }).catch(() => null);
   if (!dirents) return [];
   const versions = /* @__PURE__ */ new Set();
   for (const dirent of dirents) {
     if (!dirent.isDirectory()) continue;
     try {
-      const descriptorPath = path9.join(instancesDir, dirent.name, "runtime", "server.json");
+      const descriptorPath = path10.join(instancesDir, dirent.name, "runtime", "server.json");
       const parsed = JSON.parse(await readFile(descriptorPath, "utf8"));
       if (typeof parsed.version !== "string") continue;
       if (typeof parsed.pid === "number" && Number.isInteger(parsed.pid) && parsed.pid > 0 && isPidRunning(parsed.pid)) {
@@ -23891,8 +24010,8 @@ var init_install = __esm({
 });
 
 // src/runtime/server-entry.ts
-import fs7 from "node:fs";
-import path10 from "node:path";
+import fs8 from "node:fs";
+import path11 from "node:path";
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL2 } from "node:url";
 function formatError(err) {
   if (err instanceof Error) {
@@ -23914,12 +24033,12 @@ function maybeEnableUiDevMiddleware(entrypoint) {
   }
 }
 function resolveDevServerEntry() {
-  const projectRoot = path10.resolve(path10.dirname(fileURLToPath5(import.meta.url)), "../../..");
-  return path10.resolve(projectRoot, "server/src/index.ts");
+  const projectRoot = path11.resolve(path11.dirname(fileURLToPath5(import.meta.url)), "../../..");
+  return path11.resolve(projectRoot, "server/src/index.ts");
 }
 async function loadServerRuntimeModule(options) {
   const devEntry = resolveDevServerEntry();
-  if (fs7.existsSync(devEntry)) {
+  if (fs8.existsSync(devEntry)) {
     maybeEnableUiDevMiddleware(devEntry);
     return await import(pathToFileURL2(devEntry).href);
   }
@@ -23930,7 +24049,7 @@ async function loadServerRuntimeModule(options) {
   };
   const runtime = await ensureRuntimeInstalled(installOptions);
   if (!process.env[RUDDER_POSTGRES_BIN_DIR_ENV2]?.trim()) {
-    if (runtime.postgresPayloadBinDir && fs7.existsSync(runtime.postgresPayloadBinDir)) {
+    if (runtime.postgresPayloadBinDir && fs8.existsSync(runtime.postgresPayloadBinDir)) {
       process.env[RUDDER_POSTGRES_BIN_DIR_ENV2] = runtime.postgresPayloadBinDir;
     }
   }
@@ -24054,24 +24173,24 @@ var init_auth_bootstrap_ceo = __esm({
 });
 
 // src/utils/path-resolver.ts
-import fs10 from "node:fs";
-import path18 from "node:path";
+import fs11 from "node:fs";
+import path19 from "node:path";
 function unique(items) {
   return Array.from(new Set(items));
 }
 function resolveRuntimeLikePath(value, configPath) {
   const expanded = expandHomePrefix(value);
-  if (path18.isAbsolute(expanded)) return path18.resolve(expanded);
+  if (path19.isAbsolute(expanded)) return path19.resolve(expanded);
   const cwd = process.cwd();
-  const configDir = configPath ? path18.dirname(configPath) : null;
-  const workspaceRoot = configDir ? path18.resolve(configDir, "..") : cwd;
+  const configDir = configPath ? path19.dirname(configPath) : null;
+  const workspaceRoot = configDir ? path19.resolve(configDir, "..") : cwd;
   const candidates = unique([
-    ...configDir ? [path18.resolve(configDir, expanded)] : [],
-    path18.resolve(workspaceRoot, "server", expanded),
-    path18.resolve(workspaceRoot, expanded),
-    path18.resolve(cwd, expanded)
+    ...configDir ? [path19.resolve(configDir, expanded)] : [],
+    path19.resolve(workspaceRoot, "server", expanded),
+    path19.resolve(workspaceRoot, expanded),
+    path19.resolve(cwd, expanded)
   ]);
-  return candidates.find((candidate) => fs10.existsSync(candidate)) ?? candidates[0];
+  return candidates.find((candidate) => fs11.existsSync(candidate)) ?? candidates[0];
 }
 var init_path_resolver = __esm({
   "src/utils/path-resolver.ts"() {
@@ -24082,8 +24201,8 @@ var init_path_resolver = __esm({
 
 // src/config/secrets-key.ts
 import { randomBytes as randomBytes2 } from "node:crypto";
-import fs11 from "node:fs";
-import path19 from "node:path";
+import fs12 from "node:fs";
+import path20 from "node:path";
 function ensureLocalSecretsKeyFile(config, configPath) {
   if (config.secrets.provider !== "local_encrypted") {
     return { status: "skipped_provider", path: null };
@@ -24095,16 +24214,16 @@ function ensureLocalSecretsKeyFile(config, configPath) {
   const keyFileOverride = process.env.RUDDER_SECRETS_MASTER_KEY_FILE;
   const configuredPath = keyFileOverride && keyFileOverride.trim().length > 0 ? keyFileOverride.trim() : config.secrets.localEncrypted.keyFilePath;
   const keyFilePath = resolveRuntimeLikePath(configuredPath, configPath);
-  if (fs11.existsSync(keyFilePath)) {
+  if (fs12.existsSync(keyFilePath)) {
     return { status: "existing", path: keyFilePath };
   }
-  fs11.mkdirSync(path19.dirname(keyFilePath), { recursive: true });
-  fs11.writeFileSync(keyFilePath, randomBytes2(32).toString("base64"), {
+  fs12.mkdirSync(path20.dirname(keyFilePath), { recursive: true });
+  fs12.writeFileSync(keyFilePath, randomBytes2(32).toString("base64"), {
     encoding: "utf8",
     mode: 384
   });
   try {
-    fs11.chmodSync(keyFilePath, 384);
+    fs12.chmodSync(keyFilePath, 384);
   } catch {
   }
   return { status: "created", path: keyFilePath };
@@ -24871,7 +24990,7 @@ var init_path_resolver2 = __esm({
 });
 
 // src/checks/database-check.ts
-import fs12 from "node:fs";
+import fs13 from "node:fs";
 async function databaseCheck(config, configPath) {
   if (config.database.mode === "postgres") {
     if (!config.database.connectionString) {
@@ -24903,8 +25022,8 @@ async function databaseCheck(config, configPath) {
   if (config.database.mode === "embedded-postgres") {
     const dataDir = resolveRuntimeLikePath(config.database.embeddedPostgresDataDir, configPath);
     const reportedPath = dataDir;
-    if (!fs12.existsSync(dataDir)) {
-      fs12.mkdirSync(reportedPath, { recursive: true });
+    if (!fs13.existsSync(dataDir)) {
+      fs13.mkdirSync(reportedPath, { recursive: true });
     }
     return {
       name: "Database",
@@ -25100,15 +25219,15 @@ var init_llm_check = __esm({
 });
 
 // src/checks/log-check.ts
-import fs13 from "node:fs";
+import fs14 from "node:fs";
 function logCheck(config, configPath) {
   const logDir = resolveRuntimeLikePath(config.logging.logDir, configPath);
   const reportedDir = logDir;
-  if (!fs13.existsSync(logDir)) {
-    fs13.mkdirSync(reportedDir, { recursive: true });
+  if (!fs14.existsSync(logDir)) {
+    fs14.mkdirSync(reportedDir, { recursive: true });
   }
   try {
-    fs13.accessSync(reportedDir, fs13.constants.W_OK);
+    fs14.accessSync(reportedDir, fs14.constants.W_OK);
     return {
       name: "Log directory",
       status: "pass",
@@ -25183,8 +25302,8 @@ var init_port_check = __esm({
 
 // src/checks/secrets-check.ts
 import { randomBytes as randomBytes3 } from "node:crypto";
-import fs14 from "node:fs";
-import path20 from "node:path";
+import fs15 from "node:fs";
+import path21 from "node:path";
 function decodeMasterKey(raw) {
   const trimmed = raw.trim();
   if (!trimmed) return null;
@@ -25246,7 +25365,7 @@ function secretsCheck(config, configPath) {
   const keyFileOverride = process.env.RUDDER_SECRETS_MASTER_KEY_FILE;
   const configuredPath = keyFileOverride && keyFileOverride.trim().length > 0 ? keyFileOverride.trim() : config.secrets.localEncrypted.keyFilePath;
   const keyFilePath = resolveRuntimeLikePath(configuredPath, configPath);
-  if (!fs14.existsSync(keyFilePath)) {
+  if (!fs15.existsSync(keyFilePath)) {
     return withStrictModeNote(
       {
         name: "Secrets adapter",
@@ -25254,13 +25373,13 @@ function secretsCheck(config, configPath) {
         message: `Secrets key file does not exist yet: ${keyFilePath}`,
         canRepair: true,
         repair: () => {
-          fs14.mkdirSync(path20.dirname(keyFilePath), { recursive: true });
-          fs14.writeFileSync(keyFilePath, randomBytes3(32).toString("base64"), {
+          fs15.mkdirSync(path21.dirname(keyFilePath), { recursive: true });
+          fs15.writeFileSync(keyFilePath, randomBytes3(32).toString("base64"), {
             encoding: "utf8",
             mode: 384
           });
           try {
-            fs14.chmodSync(keyFilePath, 384);
+            fs15.chmodSync(keyFilePath, 384);
           } catch {
           }
         },
@@ -25271,7 +25390,7 @@ function secretsCheck(config, configPath) {
   }
   let raw;
   try {
-    raw = fs14.readFileSync(keyFilePath, "utf8");
+    raw = fs15.readFileSync(keyFilePath, "utf8");
   } catch (err) {
     return {
       name: "Secrets adapter",
@@ -25307,15 +25426,15 @@ var init_secrets_check = __esm({
 });
 
 // src/checks/storage-check.ts
-import fs15 from "node:fs";
+import fs16 from "node:fs";
 function storageCheck(config, configPath) {
   if (config.storage.provider === "local_disk") {
     const baseDir = resolveRuntimeLikePath(config.storage.localDisk.baseDir, configPath);
-    if (!fs15.existsSync(baseDir)) {
-      fs15.mkdirSync(baseDir, { recursive: true });
+    if (!fs16.existsSync(baseDir)) {
+      fs16.mkdirSync(baseDir, { recursive: true });
     }
     try {
-      fs15.accessSync(baseDir, fs15.constants.W_OK);
+      fs16.accessSync(baseDir, fs16.constants.W_OK);
       return {
         name: "Storage",
         status: "pass",
@@ -25721,7 +25840,7 @@ __export(run_exports, {
   runCommand: () => runCommand
 });
 import * as p13 from "@clack/prompts";
-import fs16 from "node:fs";
+import fs17 from "node:fs";
 import pc12 from "picocolors";
 async function runCommand(opts) {
   let localEnvProfile = resolveActiveLocalEnvProfile();
@@ -25731,9 +25850,9 @@ async function runCommand(opts) {
   const instanceId = resolveRudderInstanceId(opts.instance);
   process.env.RUDDER_INSTANCE_ID = instanceId;
   const homeDir = resolveRudderHomeDir();
-  fs16.mkdirSync(homeDir, { recursive: true });
+  fs17.mkdirSync(homeDir, { recursive: true });
   const paths = describeLocalInstancePaths(instanceId);
-  fs16.mkdirSync(paths.instanceRoot, { recursive: true });
+  fs17.mkdirSync(paths.instanceRoot, { recursive: true });
   const configPath = resolveConfigPath(opts.config);
   process.env.RUDDER_CONFIG = configPath;
   loadRudderEnvFile(configPath);
@@ -25830,7 +25949,7 @@ var init_run = __esm({
 
 // src/commands/onboard.ts
 import * as p14 from "@clack/prompts";
-import path21 from "node:path";
+import path22 from "node:path";
 import pc13 from "picocolors";
 function parseBooleanFromEnv(rawValue) {
   if (rawValue === void 0) return null;
@@ -25863,7 +25982,7 @@ function parseEnumFromEnv(rawValue, allowedValues) {
 }
 function resolvePathFromEnv(rawValue) {
   if (!rawValue || rawValue.trim().length === 0) return null;
-  return path21.resolve(expandHomePrefix(rawValue.trim()));
+  return path22.resolve(expandHomePrefix(rawValue.trim()));
 }
 function quickstartDefaultsFromEnv() {
   const instanceId = resolveRudderInstanceId();
@@ -26324,9 +26443,9 @@ function fingerprintRudderMcpToolManifest(tools) {
 init_dist2();
 import { spawn as spawn2, spawnSync } from "node:child_process";
 import { existsSync as existsSync2 } from "node:fs";
-import fs4 from "node:fs/promises";
-import os2 from "node:os";
-import path6 from "node:path";
+import fs5 from "node:fs/promises";
+import os3 from "node:os";
+import path7 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/agent-v1-registry.ts
@@ -27737,6 +27856,18 @@ var AGENT_CLI_CAPABILITIES = [
     "requiresAgentId": false,
     "requiresOrgId": false,
     "requiresRunId": false
+  },
+  {
+    "attachesRunIdWhenAvailable": true,
+    "category": "runs",
+    "command": "rudder runs create --task <text> --idempotency-key <key> [--target-agent-id <id>]",
+    "contract": "agent-v1",
+    "description": "Create an independently governed Delegation Run for the current or another same-organization Agent.",
+    "id": "runs.create",
+    "mutating": true,
+    "requiresAgentId": true,
+    "requiresOrgId": false,
+    "requiresRunId": true
   }
 ];
 
@@ -27839,6 +27970,8 @@ function formatAgentCliCapabilitiesHumanReadable(capabilities = getAgentCliCapab
 
 // src/client/http.ts
 import { URL as URL2 } from "node:url";
+
+// src/client/api-request-error.ts
 var ApiRequestError = class extends Error {
   status;
   code;
@@ -27852,6 +27985,222 @@ var ApiRequestError = class extends Error {
     this.body = body;
   }
 };
+
+// src/client/issue-transport-budget.ts
+import { createHash as createHash2 } from "node:crypto";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+var DEFAULT_BACKOFF_MS = 6e4;
+var LOCK_RETRY_MS = 5;
+var LOCK_TIMEOUT_MS = 250;
+var IssueTransportBudget = class {
+  runId;
+  surface;
+  stateDir;
+  backoffMs;
+  now;
+  constructor(options) {
+    this.runId = options.runId?.trim() || void 0;
+    this.surface = options.surface ?? transportSurfaceFromEnv();
+    this.stateDir = options.stateDir ?? process.env.RUDDER_RUNTIME_TMPDIR?.trim() ?? path.join(os.tmpdir(), "rudder-issue-transport");
+    this.backoffMs = options.backoffMs ?? DEFAULT_BACKOFF_MS;
+    this.now = options.now ?? Date.now;
+  }
+  async reserve(method, requestPath) {
+    if (!this.runId) return null;
+    const scope = issueTransportScope(method, requestPath);
+    if (!scope) return null;
+    const filePath = this.stateFilePath(scope);
+    try {
+      return await this.withLock(filePath, async () => {
+        const now = this.now();
+        let state = await readState(filePath);
+        if (state && state.expiresAt <= now) {
+          await fs.rm(filePath, { force: true });
+          state = null;
+        }
+        if (!state) {
+          return { filePath, scope, surface: this.surface, attempt: "initial" };
+        }
+        if (state.phase === "fallback_available" && state.initialSurface !== this.surface) {
+          await writeState(filePath, {
+            ...state,
+            phase: "fallback_in_flight",
+            fallbackSurface: this.surface
+          });
+          return { filePath, scope, surface: this.surface, attempt: "fallback" };
+        }
+        throw issueTransportUnavailable(state, now);
+      });
+    } catch (error) {
+      if (error instanceof ApiRequestError) throw error;
+      return null;
+    }
+  }
+  async succeed(reservation) {
+    if (!reservation) return;
+    await this.tryWithLock(reservation.filePath, async () => {
+      await fs.rm(reservation.filePath, { force: true });
+    });
+  }
+  async fail(reservation, error) {
+    if (!reservation) return;
+    if (error.status < 500 || error.status > 599) {
+      await this.succeed(reservation);
+      return;
+    }
+    const failure = buildFingerprint(reservation.scope, error);
+    const now = this.now();
+    await this.tryWithLock(reservation.filePath, async () => {
+      const current = await readState(reservation.filePath);
+      const concurrentMatchingFailure = reservation.attempt === "initial" && current?.failure?.fingerprint === failure.fingerprint;
+      const budgetExhausted = reservation.attempt === "fallback" || concurrentMatchingFailure;
+      const state = {
+        ...reservation.scope,
+        phase: budgetExhausted ? "blocked" : "fallback_available",
+        initialSurface: current?.initialSurface ?? reservation.surface,
+        fallbackSurface: reservation.attempt === "fallback" ? reservation.surface : void 0,
+        fallbackMatchedFingerprint: budgetExhausted ? current?.failure?.fingerprint === failure.fingerprint : void 0,
+        failure,
+        observedAt: now,
+        expiresAt: now + this.backoffMs
+      };
+      await writeState(reservation.filePath, state);
+      attachTransportDiagnostic(error, state, now);
+      if (budgetExhausted) {
+        error.code = "issue_transport_unavailable";
+        error.message = "Issue transport unavailable";
+      }
+    });
+  }
+  stateFilePath(scope) {
+    const key = [this.runId, scope.operation, scope.issueId].join("\n");
+    const digest = createHash2("sha256").update(key).digest("hex");
+    return path.join(this.stateDir, "issue-transport-budget", `${digest}.json`);
+  }
+  async tryWithLock(filePath, action) {
+    try {
+      return await this.withLock(filePath, action);
+    } catch {
+      return void 0;
+    }
+  }
+  async withLock(filePath, action) {
+    await fs.mkdir(path.dirname(filePath), { recursive: true, mode: 448 });
+    const lockPath = `${filePath}.lock`;
+    const deadline = Date.now() + LOCK_TIMEOUT_MS;
+    let lock = null;
+    while (!lock) {
+      try {
+        lock = await fs.open(lockPath, "wx", 384);
+      } catch (error) {
+        if (!isAlreadyExists(error) || Date.now() >= deadline) throw error;
+        await new Promise((resolve) => setTimeout(resolve, LOCK_RETRY_MS));
+      }
+    }
+    try {
+      return await action();
+    } finally {
+      await lock.close();
+      await fs.rm(lockPath, { force: true });
+    }
+  }
+};
+function issueTransportScope(method, requestPath) {
+  const normalizedMethod = String(method ?? "GET").toUpperCase();
+  const pathname = requestPath.split("?", 1)[0] ?? "";
+  const match = /^\/api\/issues\/([^/]+)(?:\/(heartbeat-context|comments)(?:\/([^/]+))?)?$/.exec(pathname);
+  if (!match) return null;
+  const issueId = decodeURIComponent(match[1] ?? "");
+  const resource = match[2];
+  const commentId = match[3];
+  let operation = null;
+  if (normalizedMethod === "GET" && !resource) operation = "issue.get";
+  if (normalizedMethod === "GET" && resource === "heartbeat-context") operation = "issue.context";
+  if (normalizedMethod === "GET" && resource === "comments" && !commentId) operation = "issue.comments.list";
+  if (normalizedMethod === "GET" && resource === "comments" && commentId) operation = "issue.comments.get";
+  if (normalizedMethod === "POST" && resource === "comments" && !commentId) operation = "issue.comment";
+  return operation ? { operation, issueId } : null;
+}
+function buildFingerprint(scope, error) {
+  const normalizedMessage = error.message.trim().replace(/\s+/g, " ").toLowerCase().slice(0, 256);
+  const code = error.code?.trim() || "api_request_error";
+  const value = [scope.operation, scope.issueId, error.status, code, normalizedMessage].join("\n");
+  return {
+    fingerprint: createHash2("sha256").update(value).digest("hex"),
+    status: error.status,
+    code,
+    normalizedMessage
+  };
+}
+function issueTransportUnavailable(state, now) {
+  const details = { issueTransport: transportDiagnostic(state, now) };
+  return new ApiRequestError(
+    503,
+    state.phase === "fallback_in_flight" ? "Issue transport probe already in flight" : "Issue transport unavailable",
+    details,
+    { error: "Issue transport unavailable", code: "issue_transport_unavailable", details },
+    "issue_transport_unavailable"
+  );
+}
+function attachTransportDiagnostic(error, state, now) {
+  const upstreamDetails = error.details;
+  error.details = {
+    ...isRecord2(upstreamDetails) ? upstreamDetails : upstreamDetails === void 0 ? {} : { upstreamDetails },
+    issueTransport: transportDiagnostic(state, now)
+  };
+}
+function transportDiagnostic(state, now) {
+  return {
+    state: state.phase,
+    fingerprint: state.failure?.fingerprint ?? null,
+    operation: state.operation,
+    issueId: state.issueId,
+    upstreamStatus: state.failure?.status ?? null,
+    upstreamCode: state.failure?.code ?? null,
+    normalizedServerMessage: state.failure?.normalizedMessage ?? null,
+    initialSurface: state.initialSurface,
+    fallbackSurface: state.fallbackSurface ?? null,
+    fallbackMatchedFingerprint: state.fallbackMatchedFingerprint ?? null,
+    fallbackBudgetRemaining: state.phase === "fallback_available" ? 1 : 0,
+    retryAfterMs: Math.max(0, state.expiresAt - now),
+    checkpoint: "Issue transport unavailable"
+  };
+}
+async function readState(filePath) {
+  try {
+    const parsed = JSON.parse(await fs.readFile(filePath, "utf8"));
+    return isIssueTransportState(parsed) ? parsed : null;
+  } catch (error) {
+    if (isNotFound(error) || error instanceof SyntaxError) return null;
+    throw error;
+  }
+}
+async function writeState(filePath, state) {
+  const tempPath = `${filePath}.${process.pid}.${Math.random().toString(16).slice(2)}.tmp`;
+  await fs.writeFile(tempPath, `${JSON.stringify(state)}
+`, { encoding: "utf8", mode: 384 });
+  await fs.rename(tempPath, filePath);
+}
+function isIssueTransportState(value) {
+  if (!isRecord2(value)) return false;
+  return typeof value.operation === "string" && typeof value.issueId === "string" && ["fallback_available", "fallback_in_flight", "blocked"].includes(String(value.phase)) && (value.initialSurface === "cli" || value.initialSurface === "mcp") && typeof value.observedAt === "number" && typeof value.expiresAt === "number";
+}
+function transportSurfaceFromEnv() {
+  return process.env.RUDDER_TOOL_TRANSPORT_SURFACE === "mcp" ? "mcp" : "cli";
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isAlreadyExists(error) {
+  return isRecord2(error) && error.code === "EEXIST";
+}
+function isNotFound(error) {
+  return isRecord2(error) && error.code === "ENOENT";
+}
+
+// src/client/http.ts
 var RudderApiClient = class {
   apiBase;
   apiKey;
@@ -27859,6 +28208,7 @@ var RudderApiClient = class {
   runId;
   signal;
   recoverAuth;
+  issueTransportBudget;
   constructor(opts) {
     this.apiBase = opts.apiBase.replace(/\/+$/, "");
     this.apiKey = opts.apiKey?.trim() || void 0;
@@ -27866,42 +28216,50 @@ var RudderApiClient = class {
     this.runId = opts.runId?.trim() || void 0;
     this.signal = opts.signal;
     this.recoverAuth = opts.recoverAuth;
+    this.issueTransportBudget = new IssueTransportBudget({
+      runId: this.runId,
+      surface: opts.transportSurface,
+      stateDir: opts.transportStateDir,
+      backoffMs: opts.transportBackoffMs,
+      now: opts.now
+    });
   }
-  get(path25, opts) {
-    return this.request(path25, { method: "GET" }, opts);
+  get(path26, opts) {
+    return this.request(path26, { method: "GET" }, opts);
   }
-  post(path25, body, opts) {
-    return this.request(path25, {
+  post(path26, body, opts) {
+    return this.request(path26, {
       method: "POST",
       body: body === void 0 ? void 0 : JSON.stringify(body)
     }, opts);
   }
-  postForm(path25, form, opts) {
-    return this.request(path25, {
+  postForm(path26, form, opts) {
+    return this.request(path26, {
       method: "POST",
       body: form
     }, opts);
   }
-  patch(path25, body, opts) {
-    return this.request(path25, {
+  patch(path26, body, opts) {
+    return this.request(path26, {
       method: "PATCH",
       body: body === void 0 ? void 0 : JSON.stringify(body)
     }, opts);
   }
-  put(path25, body, opts) {
-    return this.request(path25, {
+  put(path26, body, opts) {
+    return this.request(path26, {
       method: "PUT",
       body: body === void 0 ? void 0 : JSON.stringify(body)
     }, opts);
   }
-  delete(path25, opts) {
-    return this.request(path25, { method: "DELETE" }, opts);
+  delete(path26, opts) {
+    return this.request(path26, { method: "DELETE" }, opts);
   }
   setApiKey(apiKey) {
     this.apiKey = apiKey?.trim() || void 0;
   }
-  async request(path25, init, opts, hasRetriedAuth = false) {
-    const url = buildUrl(this.apiBase, path25);
+  async request(path26, init, opts, hasRetriedAuth = false) {
+    const url = buildUrl(this.apiBase, path26);
+    const reservation = await this.issueTransportBudget.reserve(init.method, path26);
     const headers = {
       accept: "application/json",
       ...toStringRecord(init.headers)
@@ -27920,29 +28278,39 @@ var RudderApiClient = class {
         headers["x-rudder-run-id"] = this.runId;
       }
     }
-    const response = await fetch(url, {
-      ...init,
-      headers,
-      signal: init.signal ?? this.signal
-    });
+    let response;
+    try {
+      response = await fetch(url, {
+        ...init,
+        headers,
+        signal: init.signal ?? this.signal
+      });
+    } catch (error) {
+      await this.issueTransportBudget.succeed(reservation);
+      throw error;
+    }
     if (opts?.ignoreNotFound && response.status === 404) {
+      await this.issueTransportBudget.succeed(reservation);
       return null;
     }
     if (!response.ok) {
       const apiError = await toApiError(response);
       if (!hasRetriedAuth && this.recoverAuth) {
         const recoveredToken = await this.recoverAuth({
-          path: path25,
+          path: path26,
           method: String(init.method ?? "GET").toUpperCase(),
           error: apiError
         });
         if (recoveredToken) {
+          await this.issueTransportBudget.succeed(reservation);
           this.setApiKey(recoveredToken);
-          return this.request(path25, init, opts, true);
+          return this.request(path26, init, opts, true);
         }
       }
+      await this.issueTransportBudget.fail(reservation, apiError);
       throw apiError;
     }
+    await this.issueTransportBudget.succeed(reservation);
     if (response.status === 204) {
       return null;
     }
@@ -27957,8 +28325,8 @@ function shouldAttachAgentContext(method) {
   const normalized = String(method ?? "GET").toUpperCase();
   return normalized !== "GET" && normalized !== "HEAD";
 }
-function buildUrl(apiBase, path25) {
-  const normalizedPath = path25.startsWith("/") ? path25 : `/${path25}`;
+function buildUrl(apiBase, path26) {
+  const normalizedPath = path26.startsWith("/") ? path26 : `/${path26}`;
   const [pathname, query] = normalizedPath.split("?");
   const url = new URL2(apiBase);
   url.pathname = `${url.pathname.replace(/\/+$/, "")}${pathname}`;
@@ -28009,8 +28377,8 @@ import pc2 from "picocolors";
 // src/client/board-auth.ts
 init_home();
 import { spawn } from "node:child_process";
-import fs from "node:fs";
-import path2 from "node:path";
+import fs2 from "node:fs";
+import path3 from "node:path";
 import pc from "picocolors";
 
 // src/client/command-label.ts
@@ -28033,14 +28401,14 @@ function normalizeApiBase(apiBase) {
   return apiBase.trim().replace(/\/+$/, "");
 }
 function resolveBoardAuthStorePath(overridePath) {
-  if (overridePath?.trim()) return path2.resolve(overridePath.trim());
-  if (process.env.RUDDER_AUTH_STORE?.trim()) return path2.resolve(process.env.RUDDER_AUTH_STORE.trim());
+  if (overridePath?.trim()) return path3.resolve(overridePath.trim());
+  if (process.env.RUDDER_AUTH_STORE?.trim()) return path3.resolve(process.env.RUDDER_AUTH_STORE.trim());
   return resolveDefaultCliAuthPath();
 }
 function readBoardAuthStore(storePath) {
   const filePath = resolveBoardAuthStorePath(storePath);
-  if (!fs.existsSync(filePath)) return defaultBoardAuthStore();
-  const raw = JSON.parse(fs.readFileSync(filePath, "utf8"));
+  if (!fs2.existsSync(filePath)) return defaultBoardAuthStore();
+  const raw = JSON.parse(fs2.readFileSync(filePath, "utf8"));
   const credentials = raw?.credentials && typeof raw.credentials === "object" ? raw.credentials : {};
   const normalized = {};
   for (const [key, value] of Object.entries(credentials)) {
@@ -28066,8 +28434,8 @@ function readBoardAuthStore(storePath) {
 }
 function writeBoardAuthStore(store, storePath) {
   const filePath = resolveBoardAuthStorePath(storePath);
-  fs.mkdirSync(path2.dirname(filePath), { recursive: true });
-  fs.writeFileSync(filePath, `${JSON.stringify(store, null, 2)}
+  fs2.mkdirSync(path3.dirname(filePath), { recursive: true });
+  fs2.writeFileSync(filePath, `${JSON.stringify(store, null, 2)}
 `, { mode: 384 });
 }
 function getStoredBoardCredential(apiBase, storePath) {
@@ -28213,27 +28581,27 @@ async function revokeStoredBoardCredential(params) {
 
 // src/client/context.ts
 init_home();
-import fs2 from "node:fs";
-import path3 from "node:path";
+import fs3 from "node:fs";
+import path4 from "node:path";
 var DEFAULT_CONTEXT_BASENAME = "context.json";
 var DEFAULT_PROFILE = "default";
 function findContextFileFromAncestors(startDir) {
-  const absoluteStartDir = path3.resolve(startDir);
+  const absoluteStartDir = path4.resolve(startDir);
   let currentDir = absoluteStartDir;
   while (true) {
-    const candidate = path3.resolve(currentDir, ".rudder", DEFAULT_CONTEXT_BASENAME);
-    if (fs2.existsSync(candidate)) {
+    const candidate = path4.resolve(currentDir, ".rudder", DEFAULT_CONTEXT_BASENAME);
+    if (fs3.existsSync(candidate)) {
       return candidate;
     }
-    const nextDir = path3.resolve(currentDir, "..");
+    const nextDir = path4.resolve(currentDir, "..");
     if (nextDir === currentDir) break;
     currentDir = nextDir;
   }
   return null;
 }
 function resolveContextPath(overridePath) {
-  if (overridePath) return path3.resolve(overridePath);
-  if (process.env.RUDDER_CONTEXT) return path3.resolve(process.env.RUDDER_CONTEXT);
+  if (overridePath) return path4.resolve(overridePath);
+  if (process.env.RUDDER_CONTEXT) return path4.resolve(process.env.RUDDER_CONTEXT);
   return findContextFileFromAncestors(process.cwd()) ?? resolveDefaultContextPath();
 }
 function defaultClientContext() {
@@ -28247,7 +28615,7 @@ function defaultClientContext() {
 }
 function parseJson(filePath) {
   try {
-    return JSON.parse(fs2.readFileSync(filePath, "utf-8"));
+    return JSON.parse(fs3.readFileSync(filePath, "utf-8"));
   } catch (err) {
     throw new Error(`Failed to parse JSON at ${filePath}: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -28293,7 +28661,7 @@ function normalizeContext(raw) {
 }
 function readContext(contextPath) {
   const filePath = resolveContextPath(contextPath);
-  if (!fs2.existsSync(filePath)) {
+  if (!fs3.existsSync(filePath)) {
     return defaultClientContext();
   }
   const raw = parseJson(filePath);
@@ -28301,10 +28669,10 @@ function readContext(contextPath) {
 }
 function writeContext(context, contextPath) {
   const filePath = resolveContextPath(contextPath);
-  const dir = path3.dirname(filePath);
-  fs2.mkdirSync(dir, { recursive: true });
+  const dir = path4.dirname(filePath);
+  fs3.mkdirSync(dir, { recursive: true });
   const normalized = normalizeContext(context);
-  fs2.writeFileSync(filePath, `${JSON.stringify(normalized, null, 2)}
+  fs3.writeFileSync(filePath, `${JSON.stringify(normalized, null, 2)}
 `, { mode: 384 });
 }
 function upsertProfile(profileName, patch, contextPath) {
@@ -28750,7 +29118,8 @@ function buildMcpServerEnv(env = process.env) {
     RUDDER_BROWSER_ENABLED: env.RUDDER_BROWSER_ENABLED,
     RUDDER_COMPUTER_ENABLED: env.RUDDER_COMPUTER_ENABLED,
     RUDDER_PROJECT_LIBRARY_PATH: env.RUDDER_PROJECT_LIBRARY_PATH,
-    RUDDER_MCP_RUDDER_BIN: env.RUDDER_MCP_RUDDER_BIN
+    RUDDER_MCP_RUDDER_BIN: env.RUDDER_MCP_RUDDER_BIN,
+    RUDDER_TOOL_TRANSPORT_SURFACE: env.RUDDER_TOOL_TRANSPORT_SURFACE
   };
 }
 function buildAgentV1ToolCallPlan(toolName, rawArgs, env = buildMcpServerEnv()) {
@@ -28758,10 +29127,10 @@ function buildAgentV1ToolCallPlan(toolName, rawArgs, env = buildMcpServerEnv())
   if (!capabilityId) {
     throw new Error(`Unknown Rudder MCP tool: ${toolName}`);
   }
-  if (rawArgs !== void 0 && rawArgs !== null && !isRecord2(rawArgs)) {
+  if (rawArgs !== void 0 && rawArgs !== null && !isRecord3(rawArgs)) {
     throwInvalidMcpArgument(toolName, "arguments", "must be object");
   }
-  const input = normalizeLegacyToolArguments(capabilityId, isRecord2(rawArgs) ? rawArgs : {});
+  const input = normalizeLegacyToolArguments(capabilityId, isRecord3(rawArgs) ? rawArgs : {});
   const capability = getAgentCliCapabilityById(capabilityId);
   rejectModelProvidedRuntimeIdentity(input);
   rejectUnsupportedToolArguments(toolName, input);
@@ -28784,7 +29153,8 @@ function buildAgentV1ToolCallPlan(toolName, rawArgs, env = buildMcpServerEnv())
       RUDDER_RUN_ID: env.RUDDER_RUN_ID,
       RUDDER_BROWSER_ENABLED: env.RUDDER_BROWSER_ENABLED,
       RUDDER_COMPUTER_ENABLED: env.RUDDER_COMPUTER_ENABLED,
-      RUDDER_PROJECT_LIBRARY_PATH: env.RUDDER_PROJECT_LIBRARY_PATH
+      RUDDER_PROJECT_LIBRARY_PATH: env.RUDDER_PROJECT_LIBRARY_PATH,
+      RUDDER_TOOL_TRANSPORT_SURFACE: "mcp"
     },
     tempFiles
   };
@@ -28870,7 +29240,7 @@ async function runAgentV1McpJsonRpcMessage(message, env = buildMcpServerEnv(), s
       case "tools/list": {
         const tools = surface === "computer" ? computerCapabilityEnabled(env) ? COMPUTER_USE_MCP_TOOLS : [] : surface === "browser" && !browserCapabilityEnabled(env) ? [] : buildAgentV1McpToolsManifest("agent-v1", { surface }).tools.map(toMcpToolListEntry);
         if (isModernMcpRequest(message.params)) {
-          const cursor = isRecord2(message.params) ? message.params.cursor : void 0;
+          const cursor = isRecord3(message.params) ? message.params.cursor : void 0;
           if (typeof cursor === "string" && parseMcpToolCursor(cursor) === null) {
             return rpcError(id, -32602, "Invalid tools/list cursor");
           }
@@ -29024,7 +29394,7 @@ async function callToolSafely(params, env, surface, signal) {
     const details = errorDetails(err);
     const payload = {
       status: "error",
-      code: isRecord2(details) && typeof details.code === "string" ? details.code : "rudder_mcp_tool_error",
+      code: isRecord3(details) && typeof details.code === "string" ? details.code : "rudder_mcp_tool_error",
       message: errorMessage(err),
       details: details ?? null
     };
@@ -29039,7 +29409,7 @@ async function callToolSafely(params, env, surface, signal) {
   }
 }
 async function callTool(params, env, surface, signal) {
-  const record = isRecord2(params) ? params : {};
+  const record = isRecord3(params) ? params : {};
   const toolName = typeof record.name === "string" ? record.name : "";
   if (surface === "computer") {
     if (!computerCapabilityEnabled(env)) {
@@ -29054,7 +29424,7 @@ async function callTool(params, env, surface, signal) {
       error.code = "rudder_mcp_tool_not_available";
       throw error;
     }
-    const rawArgs2 = isRecord2(record.arguments) ? record.arguments : {};
+    const rawArgs2 = isRecord3(record.arguments) ? record.arguments : {};
     rejectModelProvidedRuntimeIdentity(rawArgs2);
     const parsed = computerUseActionSchemas[action].safeParse(rawArgs2);
     if (!parsed.success) {
@@ -29073,17 +29443,17 @@ async function callTool(params, env, surface, signal) {
     throw err;
   }
   const rawArgs = record.arguments;
-  const args = isRecord2(rawArgs) ? normalizeLegacyToolArguments(toolNameToCapabilityId(toolName) ?? "", rawArgs) : rawArgs;
+  const args = isRecord3(rawArgs) ? normalizeLegacyToolArguments(toolNameToCapabilityId(toolName) ?? "", rawArgs) : rawArgs;
   const plan = buildAgentV1ToolCallPlan(toolName, args, env);
   const directResult = await callToolDirectlyIfSupported(toolName, args, env, signal);
   if (directResult) return directResult;
-  const tempDir = plan.tempFiles.length > 0 ? await fs4.mkdtemp(path6.join(os2.tmpdir(), "rudder-mcp-")) : null;
+  const tempDir = plan.tempFiles.length > 0 ? await fs5.mkdtemp(path7.join(os3.tmpdir(), "rudder-mcp-")) : null;
   const materializedArgs = [...plan.args];
   try {
     if (tempDir) {
       for (const tempFile of plan.tempFiles) {
-        const tempPath = path6.join(tempDir, `${tempFile.flag.replace(/^-+/, "")}.md`);
-        await fs4.writeFile(tempPath, tempFile.contents, "utf8");
+        const tempPath = path7.join(tempDir, `${tempFile.flag.replace(/^-+/, "")}.md`);
+        await fs5.writeFile(tempPath, tempFile.contents, "utf8");
         const index = materializedArgs.indexOf(tempFile.flag);
         if (index >= 0) materializedArgs[index + 1] = tempPath;
       }
@@ -29111,13 +29481,13 @@ async function callTool(params, env, surface, signal) {
       isError: true
     };
   } finally {
-    if (tempDir) await fs4.rm(tempDir, { recursive: true, force: true });
+    if (tempDir) await fs5.rm(tempDir, { recursive: true, force: true });
   }
 }
 async function callToolDirectlyIfSupported(toolName, rawArgs, env, signal) {
   const capabilityId = toolNameToCapabilityId(toolName);
   if (!capabilityId) return null;
-  const input = isRecord2(rawArgs) ? rawArgs : {};
+  const input = isRecord3(rawArgs) ? rawArgs : {};
   if (hasLocalImageInputs(input.images)) return null;
   const api = mcpApiClient(env, signal);
   const success = (data) => mcpSuccess(
@@ -29242,6 +29612,18 @@ async function callToolDirectlyIfSupported(toolName, rawArgs, env, signal) {
         `/api/issues/${encodeURIComponent(requiredAnyString(input, ["issue", "issueId"]))}/heartbeat-context${query ? `?${query}` : ""}`
       ));
     }
+    case "issue.comments.list": {
+      const params = new URLSearchParams();
+      appendOptionalQuery(params, "after", input.after);
+      appendOptionalQuery(params, "order", input.order ?? "desc");
+      return success(await api.get(
+        `/api/issues/${encodeURIComponent(requiredAnyString(input, ["issue", "issueId"]))}/comments?${params}`
+      ));
+    }
+    case "issue.comments.get":
+      return success(await api.get(
+        `/api/issues/${encodeURIComponent(requiredAnyString(input, ["issue", "issueId"]))}/comments/${encodeURIComponent(requiredAnyString(input, ["comment", "commentId"]))}`
+      ));
     case "issue.checkout": {
       const expectedStatuses = parseCsvInput(input.expectedStatuses, "todo,backlog,blocked");
       const payload = checkoutIssueSchema.parse({
@@ -29270,6 +29652,12 @@ async function callToolDirectlyIfSupported(toolName, rawArgs, env, signal) {
         { status: "done", comment }
       ));
     }
+    case "runs.create":
+      return success(await api.post("/api/agent-runs/delegation", {
+        task: requiredString(input, "task"),
+        ...optionalString(input.targetAgentId) ? { targetAgentId: optionalString(input.targetAgentId) } : {},
+        idempotencyKey: requiredString(input, "idempotencyKey")
+      }));
     case "runs.list":
       return success(await api.get(
         `/api/run-intelligence/orgs/${encodeURIComponent(requiredRuntimeString(env, "RUDDER_ORG_ID"))}/runs?${buildDirectRunsListQuery(input)}`
@@ -29452,11 +29840,12 @@ function mcpApiClient(env, signal) {
     apiKey: optionalString(env.RUDDER_API_KEY) ?? void 0,
     agentId: optionalString(env.RUDDER_AGENT_ID) ?? void 0,
     runId: optionalString(env.RUDDER_RUN_ID) ?? void 0,
+    transportSurface: "mcp",
     signal
   });
 }
 function mcpSuccess(data, maxResultBytes = RUDDER_MCP_MAX_TOOL_RESULT_BYTES) {
-  if (isRecord2(data) && (data.mimeType === "image/png" || data.mimeType === "image/jpeg") && typeof data.base64 === "string" && data.base64.length > 0) {
+  if (isRecord3(data) && (data.mimeType === "image/png" || data.mimeType === "image/jpeg") && typeof data.base64 === "string" && data.base64.length > 0) {
     const { base64, ...metadata } = data;
     return {
       content: [{ type: "image", data: base64, mimeType: data.mimeType }],
@@ -29467,9 +29856,9 @@ function mcpSuccess(data, maxResultBytes = RUDDER_MCP_MAX_TOOL_RESULT_BYTES) {
   return mcpSuccessFromJsonText(JSON.stringify(data ?? {}), maxResultBytes);
 }
 function mcpSuccessWithImages(data, maxResultBytes) {
-  if (!isRecord2(data) || !Array.isArray(data.images)) return mcpSuccess(data, maxResultBytes);
+  if (!isRecord3(data) || !Array.isArray(data.images)) return mcpSuccess(data, maxResultBytes);
   const images = data.images.filter(
-    (entry) => isRecord2(entry) && (entry.mimeType === "image/png" || entry.mimeType === "image/jpeg") && typeof entry.base64 === "string" && entry.base64.length > 0
+    (entry) => isRecord3(entry) && (entry.mimeType === "image/png" || entry.mimeType === "image/jpeg") && typeof entry.base64 === "string" && entry.base64.length > 0
   );
   if (images.length === 0) return mcpSuccess(data, maxResultBytes);
   const metadata = { ...data };
@@ -30073,6 +30462,11 @@ function cliArgsForCapability(capabilityId, input, tempFiles, env) {
     }
     case "chat.archive":
       return ["chat", "archive", requiredAnyString(input, ["chat", "chatId"])];
+    case "runs.create": {
+      const args = ["runs", "create", "--task", requiredString(input, "task"), "--idempotency-key", requiredString(input, "idempotencyKey")];
+      pushOptional(args, "--target-agent-id", input.targetAgentId);
+      return args;
+    }
     case "runs.list": {
       const args = ["runs", "list"];
       pushOptional(args, "--updated-after", input.updatedAfter);
@@ -30162,7 +30556,7 @@ function modernOrLegacyResult(params, result, options) {
 }
 function paginateMcpTools(tools, params) {
   if (!isModernMcpRequest(params)) return { tools };
-  const record = isRecord2(params) ? params : {};
+  const record = isRecord3(params) ? params : {};
   const cursor = typeof record.cursor === "string" ? record.cursor : null;
   const offset = cursor === null ? 0 : parseMcpToolCursor(cursor) ?? 0;
   const page = tools.slice(offset, offset + RUDDER_MCP_TOOL_PAGE_SIZE);
@@ -30185,7 +30579,7 @@ function parseMcpToolCursor(cursor) {
   return null;
 }
 function requestedProtocolVersion(params) {
-  if (!isRecord2(params)) return null;
+  if (!isRecord3(params)) return null;
   return typeof params.protocolVersion === "string" && params.protocolVersion.trim().length > 0 ? params.protocolVersion.trim() : null;
 }
 function toolNameToCapabilityId(toolName) {
@@ -30230,7 +30624,7 @@ function pushJson(args, flag, value) {
     args.push(flag, value.trim());
     return;
   }
-  if (isRecord2(value) || Array.isArray(value)) {
+  if (isRecord3(value) || Array.isArray(value)) {
     args.push(flag, JSON.stringify(value));
   }
 }
@@ -30299,20 +30693,20 @@ function validateMcpToolArguments(toolName, input) {
   }
   if (Array.isArray(schema.anyOf)) {
     const matches = schema.anyOf.some((candidate) => {
-      if (!isRecord2(candidate) || !Array.isArray(candidate.required)) return false;
+      if (!isRecord3(candidate) || !Array.isArray(candidate.required)) return false;
       return candidate.required.every((key) => {
         const value = input[String(key)];
         return value !== void 0 && value !== null && !(typeof value === "string" && value.trim().length === 0) && !(Array.isArray(value) && value.length === 0);
       });
     });
     if (!matches) {
-      const alternatives = schema.anyOf.flatMap((candidate) => isRecord2(candidate) && Array.isArray(candidate.required) ? candidate.required : []).map(String);
+      const alternatives = schema.anyOf.flatMap((candidate) => isRecord3(candidate) && Array.isArray(candidate.required) ? candidate.required : []).map(String);
       throwInvalidMcpArgument(toolName, alternatives.join(" or "), "is required");
     }
   }
   for (const [key, value] of Object.entries(input)) {
     const property = schema.properties[key];
-    if (!isRecord2(property) || value === void 0) continue;
+    if (!isRecord3(property) || value === void 0) continue;
     const violation = jsonSchemaViolation(value, property);
     if (violation) throwInvalidMcpArgument(toolName, key, violation);
   }
@@ -30320,20 +30714,21 @@ function validateMcpToolArguments(toolName, input) {
 function jsonSchemaViolation(value, schema) {
   if (Array.isArray(schema.oneOf)) {
     const matches = schema.oneOf.some(
-      (candidate) => isRecord2(candidate) && jsonSchemaViolation(value, candidate) === null
+      (candidate) => isRecord3(candidate) && jsonSchemaViolation(value, candidate) === null
     );
     if (!matches) return "does not match any allowed shape";
   }
   const types = Array.isArray(schema.type) ? schema.type : schema.type === void 0 ? [] : [schema.type];
   if (types.length > 0) {
-    const validType = types.some((type) => type === "string" ? typeof value === "string" : type === "number" ? typeof value === "number" && Number.isFinite(value) : type === "boolean" ? typeof value === "boolean" : type === "array" ? Array.isArray(value) : type === "object" ? isRecord2(value) : false);
+    const validType = types.some((type) => type === "string" ? typeof value === "string" : type === "number" ? typeof value === "number" && Number.isFinite(value) : type === "boolean" ? typeof value === "boolean" : type === "array" ? Array.isArray(value) : type === "object" ? isRecord3(value) : type === "null" ? value === null : false);
     if (!validType) return `must be ${types.join(" or ")}`;
   }
   if (typeof value === "string") {
-    if (typeof schema.minLength === "number" && value.length < schema.minLength) {
+    const characterLength = Array.from(value).length;
+    if (typeof schema.minLength === "number" && characterLength < schema.minLength) {
       return `must contain at least ${schema.minLength} character(s)`;
     }
-    if (typeof schema.maxLength === "number" && value.length > schema.maxLength) {
+    if (typeof schema.maxLength === "number" && characterLength > schema.maxLength) {
       return `must contain at most ${schema.maxLength} characters`;
     }
     if (Array.isArray(schema.enum) && !schema.enum.includes(value)) {
@@ -30355,15 +30750,18 @@ function jsonSchemaViolation(value, schema) {
     if (typeof schema.maxItems === "number" && value.length > schema.maxItems) {
       return `must contain at most ${schema.maxItems} items`;
     }
-    if (isRecord2(schema.items)) {
+    if (isRecord3(schema.items)) {
       for (const [index, item] of value.entries()) {
         const violation = jsonSchemaViolation(item, schema.items);
         if (violation) return `item ${index} ${violation}`;
       }
     }
   }
-  if (isRecord2(value) && schema.type === "object") {
-    const properties = isRecord2(schema.properties) ? schema.properties : {};
+  if (isRecord3(value) && schema.type === "object") {
+    if (typeof schema.minProperties === "number" && Object.keys(value).length < schema.minProperties) {
+      return `must contain at least ${schema.minProperties} properties`;
+    }
+    const properties = isRecord3(schema.properties) ? schema.properties : {};
     const required = Array.isArray(schema.required) ? schema.required.map(String) : [];
     for (const key of required) {
       if (!(key in value)) return `field ${key} is required`;
@@ -30374,7 +30772,7 @@ function jsonSchemaViolation(value, schema) {
     }
     for (const [key, child] of Object.entries(value)) {
       const childSchema = properties[key];
-      if (!isRecord2(childSchema)) continue;
+      if (!isRecord3(childSchema)) continue;
       const violation = jsonSchemaViolation(child, childSchema);
       if (violation) return `field ${key} ${violation}`;
     }
@@ -30436,7 +30834,7 @@ function assertBrowserCapabilityEnabled(capabilityId, env) {
 function structuredContentFromJsonText(text6) {
   try {
     const parsed = JSON.parse(text6);
-    if (isRecord2(parsed)) return { structuredContent: parsed };
+    if (isRecord3(parsed)) return { structuredContent: parsed };
     return { structuredContent: { result: parsed } };
   } catch {
     return {};
@@ -30497,10 +30895,18 @@ function errorMessage(err) {
 }
 function errorDetails(err) {
   if (!(err instanceof Error)) return void 0;
+  if (err instanceof ApiRequestError) {
+    const details = isRecord3(err.details) ? err.details : err.details === void 0 ? {} : { upstreamDetails: err.details };
+    return {
+      code: err.code ?? "api_request_error",
+      status: err.status,
+      ...details
+    };
+  }
   const code = err.code;
   return code ? { code } : void 0;
 }
-function isRecord2(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -30554,8 +30960,8 @@ function registerActivityCommands(program) {
         if (opts.entityType) params.set("entityType", opts.entityType);
         if (opts.entityId) params.set("entityId", opts.entityId);
         const query = params.toString();
-        const path25 = `/api/orgs/${ctx.orgId}/activity${query ? `?${query}` : ""}`;
-        const rows = await ctx.api.get(path25) ?? [];
+        const path26 = `/api/orgs/${ctx.orgId}/activity${query ? `?${query}` : ""}`;
+        const rows = await ctx.api.get(path26) ?? [];
         if (ctx.json) {
           printOutput(rows, { json: true });
           return;
@@ -30586,8 +30992,8 @@ function registerActivityCommands(program) {
 }
 
 // ../packages/agent-runtime-utils/dist/server-utils.cli.js
-import { promises as fs8 } from "node:fs";
-import path11 from "node:path";
+import { promises as fs9 } from "node:fs";
+import path12 from "node:path";
 
 // ../packages/agent-runtime-utils/dist/native-process-runner.js
 init_dist2();
@@ -31055,6 +31461,12 @@ var RUDDER_AGENT_OPERATING_CONTRACT = [
   "",
   "When an issue comment, done comment, or blocker comment cites visual evidence from a local screenshot/image path, attach the image with the Rudder CLI `--image <path>` option instead of leaving only the filesystem path in the text.",
   "",
+  "## Rudder Issue Transport Failures",
+  "",
+  "For Issue read/comment operations, treat typed Rudder MCP and the `rudder issue` CLI as one backend failure domain. Build the failure fingerprint from operation, Issue id, HTTP status/code, and normalized server message.",
+  "After the typed MCP surface returns a 5xx failure, make at most one recorded fallback through the CLI. If that fallback returns the same fingerprint or reports `issue_transport_unavailable`, stop all Issue transport probes for the reported backoff: do not switch profiles, repeat either surface, or call the API directly.",
+  "When the Issue transport budget is exhausted but local task work can continue, record the checkpoint `Issue transport unavailable` in the run outcome and keep Issue ownership, reviewer, and lifecycle state unchanged. Retry only after the diagnostic backoff expires or an explicit prerequisite changes.",
+  "",
   "## Memory and Shared Work Notes",
   "",
   "You MUST use the `para-memory-files` skill for all memory operations: storing facts, writing daily notes, creating entities, running weekly synthesis, recalling past context, and managing shared work notes. The skill defines your three-layer memory system (knowledge graph, daily notes, tacit knowledge), the PARA folder structure, atomic fact schemas, memory decay rules, and recall conventions.",
@@ -31093,15 +31505,15 @@ var RUDDER_AGENT_HEARTBEAT_INSTRUCTION = [
 // ../packages/agent-runtime-utils/dist/server-utils.cli.js
 async function resolveRudderSkillsDir(moduleDir, additionalCandidates = []) {
   const candidates = [
-    ...RUDDER_SKILL_ROOT_RELATIVE_CANDIDATES.map((relativePath) => path11.resolve(moduleDir, relativePath)),
-    ...additionalCandidates.map((candidate) => path11.resolve(candidate))
+    ...RUDDER_SKILL_ROOT_RELATIVE_CANDIDATES.map((relativePath) => path12.resolve(moduleDir, relativePath)),
+    ...additionalCandidates.map((candidate) => path12.resolve(candidate))
   ];
   const seenRoots = /* @__PURE__ */ new Set();
   for (const root of candidates) {
     if (seenRoots.has(root))
       continue;
     seenRoots.add(root);
-    const isDirectory = await fs8.stat(root).then((stats) => stats.isDirectory()).catch(() => false);
+    const isDirectory = await fs9.stat(root).then((stats) => stats.isDirectory()).catch(() => false);
     if (isDirectory)
       return root;
   }
@@ -31111,36 +31523,36 @@ async function removeMaintainerOnlySkillSymlinks(skillsHome, allowedSkillNames)
   return removeUnselectedRudderSkillSymlinks(skillsHome, allowedSkillNames);
 }
 async function readRudderMaterializedSkillSource(target) {
-  const manifestPath = path11.join(target, ".rudder", "materialized-skill.json");
-  const raw = await fs8.readFile(manifestPath, "utf8").catch(() => null);
+  const manifestPath = path12.join(target, ".rudder", "materialized-skill.json");
+  const raw = await fs9.readFile(manifestPath, "utf8").catch(() => null);
   if (!raw)
     return null;
   try {
     const parsed = parseObject(JSON.parse(raw));
     const sourcePath = asString(parsed.sourcePath, "").trim();
-    return sourcePath.length > 0 ? path11.resolve(sourcePath) : null;
+    return sourcePath.length > 0 ? path12.resolve(sourcePath) : null;
   } catch {
     return null;
   }
 }
 async function removeUnselectedRudderSkillSymlinks(skillsHome, allowedSkillNames, knownSkillSources = []) {
   const allowed = new Set(Array.from(allowedSkillNames));
-  const knownSources = new Set(Array.from(knownSkillSources).map((value) => value.trim()).filter(Boolean).map((value) => path11.resolve(value)));
+  const knownSources = new Set(Array.from(knownSkillSources).map((value) => value.trim()).filter(Boolean).map((value) => path12.resolve(value)));
   try {
-    const entries = await fs8.readdir(skillsHome, { withFileTypes: true });
+    const entries = await fs9.readdir(skillsHome, { withFileTypes: true });
     const removed = [];
     for (const entry of entries) {
-      const target = path11.join(skillsHome, entry.name);
-      const existing = await fs8.lstat(target).catch(() => null);
+      const target = path12.join(skillsHome, entry.name);
+      const existing = await fs9.lstat(target).catch(() => null);
       if (!existing)
         continue;
       let isRudderManagedSkill = false;
       if (existing.isSymbolicLink()) {
-        const linkedPath = await fs8.readlink(target).catch(() => null);
+        const linkedPath = await fs9.readlink(target).catch(() => null);
         if (!linkedPath)
           continue;
-        const resolvedLinkedPath = path11.isAbsolute(linkedPath) ? linkedPath : path11.resolve(path11.dirname(target), linkedPath);
-        isRudderManagedSkill = knownSources.has(path11.resolve(resolvedLinkedPath)) || isMaintainerOnlySkillTarget(linkedPath) || isMaintainerOnlySkillTarget(resolvedLinkedPath);
+        const resolvedLinkedPath = path12.isAbsolute(linkedPath) ? linkedPath : path12.resolve(path12.dirname(target), linkedPath);
+        isRudderManagedSkill = knownSources.has(path12.resolve(resolvedLinkedPath)) || isMaintainerOnlySkillTarget(linkedPath) || isMaintainerOnlySkillTarget(resolvedLinkedPath);
       } else if (existing.isDirectory()) {
         const materializedSource = await readRudderMaterializedSkillSource(target);
         isRudderManagedSkill = materializedSource !== null && knownSources.has(materializedSource);
@@ -31149,7 +31561,7 @@ async function removeUnselectedRudderSkillSymlinks(skillsHome, allowedSkillNames
         continue;
       if (allowed.has(entry.name))
         continue;
-      await fs8.rm(target, { recursive: true, force: true });
+      await fs9.rm(target, { recursive: true, force: true });
       removed.push(entry.name);
     }
     return removed;
@@ -31160,9 +31572,9 @@ async function removeUnselectedRudderSkillSymlinks(skillsHome, allowedSkillNames
 
 // src/commands/client/agent.ts
 init_dist2();
-import fs9 from "node:fs/promises";
-import os3 from "node:os";
-import path12 from "node:path";
+import fs10 from "node:fs/promises";
+import os4 from "node:os";
+import path13 from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 
 // src/commands/client/help.ts
@@ -31186,16 +31598,16 @@ function formatHelpExample(example) {
 }
 
 // src/commands/client/agent.ts
-var __moduleDir = path12.dirname(fileURLToPath6(import.meta.url));
+var __moduleDir = path13.dirname(fileURLToPath6(import.meta.url));
 function codexSkillsHome() {
   const fromEnv = process.env.CODEX_HOME?.trim();
-  const base = fromEnv && fromEnv.length > 0 ? fromEnv : path12.join(os3.homedir(), ".codex");
-  return path12.join(base, "skills");
+  const base = fromEnv && fromEnv.length > 0 ? fromEnv : path13.join(os4.homedir(), ".codex");
+  return path13.join(base, "skills");
 }
 function claudeSkillsHome() {
   const fromEnv = process.env.CLAUDE_HOME?.trim();
-  const base = fromEnv && fromEnv.length > 0 ? fromEnv : path12.join(os3.homedir(), ".claude");
-  return path12.join(base, "skills");
+  const base = fromEnv && fromEnv.length > 0 ? fromEnv : path13.join(os4.homedir(), ".claude");
+  return path13.join(base, "skills");
 }
 async function installSkillsForTarget(sourceSkillsDir, targetSkillsDir, tool2) {
   const summary = {
@@ -31206,26 +31618,26 @@ async function installSkillsForTarget(sourceSkillsDir, targetSkillsDir, tool2) {
     skipped: [],
     failed: []
   };
-  await fs9.mkdir(targetSkillsDir, { recursive: true });
-  const entries = await fs9.readdir(sourceSkillsDir, { withFileTypes: true });
+  await fs10.mkdir(targetSkillsDir, { recursive: true });
+  const entries = await fs10.readdir(sourceSkillsDir, { withFileTypes: true });
   summary.removed = await removeMaintainerOnlySkillSymlinks(
     targetSkillsDir,
     entries.filter((entry) => entry.isDirectory()).map((entry) => entry.name)
   );
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    const source = path12.join(sourceSkillsDir, entry.name);
-    const target = path12.join(targetSkillsDir, entry.name);
-    const existing = await fs9.lstat(target).catch(() => null);
+    const source = path13.join(sourceSkillsDir, entry.name);
+    const target = path13.join(targetSkillsDir, entry.name);
+    const existing = await fs10.lstat(target).catch(() => null);
     if (existing) {
       if (existing.isSymbolicLink()) {
         let linkedPath = null;
         try {
-          linkedPath = await fs9.readlink(target);
+          linkedPath = await fs10.readlink(target);
         } catch (err) {
-          await fs9.unlink(target);
+          await fs10.unlink(target);
           try {
-            await fs9.symlink(source, target);
+            await fs10.symlink(source, target);
             summary.linked.push(entry.name);
             continue;
           } catch (linkErr) {
@@ -31236,10 +31648,10 @@ async function installSkillsForTarget(sourceSkillsDir, targetSkillsDir, tool2) {
             continue;
           }
         }
-        const resolvedLinkedPath = path12.isAbsolute(linkedPath) ? linkedPath : path12.resolve(path12.dirname(target), linkedPath);
-        const linkedTargetExists = await fs9.stat(resolvedLinkedPath).then(() => true).catch(() => false);
+        const resolvedLinkedPath = path13.isAbsolute(linkedPath) ? linkedPath : path13.resolve(path13.dirname(target), linkedPath);
+        const linkedTargetExists = await fs10.stat(resolvedLinkedPath).then(() => true).catch(() => false);
         if (!linkedTargetExists) {
-          await fs9.unlink(target);
+          await fs10.unlink(target);
         } else {
           summary.skipped.push(entry.name);
           continue;
@@ -31250,7 +31662,7 @@ async function installSkillsForTarget(sourceSkillsDir, targetSkillsDir, tool2) {
       }
     }
     try {
-      await fs9.symlink(source, target);
+      await fs10.symlink(source, target);
       summary.linked.push(entry.name);
     } catch (err) {
       summary.failed.push({
@@ -31461,7 +31873,7 @@ function registerAgentCommands(program) {
         if (opts.markdown && opts.markdownFile) {
           throw new Error("Pass only one of --markdown or --markdown-file.");
         }
-        const markdown = opts.markdownFile ? await fs9.readFile(path12.resolve(opts.markdownFile), "utf8") : opts.markdown;
+        const markdown = opts.markdownFile ? await fs10.readFile(path13.resolve(opts.markdownFile), "utf8") : opts.markdown;
         const payload = organizationSkillCreateSchema.parse({
           name: opts.name,
           slug: opts.slug?.trim() || null,
@@ -31640,7 +32052,7 @@ function registerAgentCommands(program) {
         }
         const installSummaries = [];
         if (opts.installSkills !== false) {
-          const skillsDir = await resolveRudderSkillsDir(__moduleDir, [path12.resolve(process.cwd(), "skills")]);
+          const skillsDir = await resolveRudderSkillsDir(__moduleDir, [path13.resolve(process.cwd(), "skills")]);
           if (!skillsDir) {
             throw new Error(
               "Could not locate local Rudder skills directory. Expected ./skills in the repo checkout."
@@ -31728,10 +32140,10 @@ async function buildAgentUpdatePatch(opts) {
   if (opts.capabilities !== void 0) rawPatch.capabilities = opts.capabilities;
   if (opts.description !== void 0) rawPatch.capabilities = opts.description;
   if (opts.capabilitiesFile !== void 0) {
-    rawPatch.capabilities = await fs9.readFile(path12.resolve(opts.capabilitiesFile), "utf8");
+    rawPatch.capabilities = await fs10.readFile(path13.resolve(opts.capabilitiesFile), "utf8");
   }
   if (opts.descriptionFile !== void 0) {
-    rawPatch.capabilities = await fs9.readFile(path12.resolve(opts.descriptionFile), "utf8");
+    rawPatch.capabilities = await fs10.readFile(path13.resolve(opts.descriptionFile), "utf8");
   }
   if (clearCapabilities) rawPatch.capabilities = null;
   return updateAgentSchema.parse(rawPatch);
@@ -31755,7 +32167,7 @@ function parseJsonObject(value, name) {
 // src/commands/client/approval.ts
 init_dist2();
 import { readFile as readFile2 } from "node:fs/promises";
-import path13 from "node:path";
+import path14 from "node:path";
 function registerApprovalCommands(program) {
   const approval = program.command("approval").description("Approval operations");
   addCommonClientOptions(
@@ -31946,7 +32358,7 @@ async function readTextInputFile(inputPath, optionName) {
   if (inputPath === "-") {
     return readStdinText();
   }
-  const resolvedPath = path13.resolve(process.cwd(), inputPath);
+  const resolvedPath = path14.resolve(process.cwd(), inputPath);
   return readFile2(resolvedPath, "utf8").catch((err) => {
     throw new Error(`Unable to read ${optionName} ${inputPath}: ${err instanceof Error ? err.message : String(err)}`);
   });
@@ -32784,11 +33196,11 @@ async function readStdin() {
 // src/commands/client/company.ts
 import * as p3 from "@clack/prompts";
 import { mkdir as mkdir2, readdir as readdir2, readFile as readFile3, stat as stat2, writeFile as writeFile2 } from "node:fs/promises";
-import path15 from "node:path";
+import path16 from "node:path";
 import pc5 from "picocolors";
 
 // src/commands/client/zip.ts
-import path14 from "node:path";
+import path15 from "node:path";
 import { inflateRawSync } from "node:zlib";
 var textDecoder = new TextDecoder();
 var binaryContentTypeByExtension = {
@@ -32816,7 +33228,7 @@ function sharedArchiveRoot(paths) {
   return firstSegments.every((parts) => parts.length > 1 && parts[0] === candidate) ? candidate : null;
 }
 function bytesToPortableFileEntry(pathValue, bytes) {
-  const contentType = binaryContentTypeByExtension[path14.extname(pathValue).toLowerCase()];
+  const contentType = binaryContentTypeByExtension[path15.extname(pathValue).toLowerCase()];
   if (!contentType) return textDecoder.decode(bytes);
   return {
     encoding: "base64",
@@ -32904,7 +33316,7 @@ var IMPORT_INCLUDE_OPTIONS = [
 ];
 var IMPORT_PREVIEW_SAMPLE_LIMIT = 6;
 function readPortableFileEntry(filePath, contents) {
-  const contentType = binaryContentTypeByExtension[path15.extname(filePath).toLowerCase()];
+  const contentType = binaryContentTypeByExtension[path16.extname(filePath).toLowerCase()];
   if (!contentType) return contents.toString("utf8");
   return {
     encoding: "base64",
@@ -32959,10 +33371,10 @@ function normalizePortablePath(filePath) {
   return filePath.replace(/\\/g, "/");
 }
 function shouldIncludePortableFile(filePath) {
-  const baseName = path15.basename(filePath);
+  const baseName = path16.basename(filePath);
   const isMarkdown = baseName.endsWith(".md");
   const isPaperclipYaml = baseName === ".rudder.yaml" || baseName === ".rudder.yml";
-  const contentType = binaryContentTypeByExtension[path15.extname(baseName).toLowerCase()];
+  const contentType = binaryContentTypeByExtension[path16.extname(baseName).toLowerCase()];
   return isMarkdown || isPaperclipYaml || Boolean(contentType);
 }
 function findPortableExtensionPath(files) {
@@ -33517,7 +33929,7 @@ function normalizeGithubImportSource(input, refOverride) {
 }
 async function pathExists(inputPath) {
   try {
-    await stat2(path15.resolve(inputPath));
+    await stat2(path16.resolve(inputPath));
     return true;
   } catch {
     return false;
@@ -33527,45 +33939,45 @@ async function collectPackageFiles(root, current, files) {
   const entries = await readdir2(current, { withFileTypes: true });
   for (const entry of entries) {
     if (entry.name.startsWith(".git")) continue;
-    const absolutePath = path15.join(current, entry.name);
+    const absolutePath = path16.join(current, entry.name);
     if (entry.isDirectory()) {
       await collectPackageFiles(root, absolutePath, files);
       continue;
     }
     if (!entry.isFile()) continue;
-    const relativePath = path15.relative(root, absolutePath).replace(/\\/g, "/");
+    const relativePath = path16.relative(root, absolutePath).replace(/\\/g, "/");
     if (!shouldIncludePortableFile(relativePath)) continue;
     files[relativePath] = readPortableFileEntry(relativePath, await readFile3(absolutePath));
   }
 }
 async function resolveInlineSourceFromPath(inputPath) {
-  const resolved = path15.resolve(inputPath);
+  const resolved = path16.resolve(inputPath);
   const resolvedStat = await stat2(resolved);
-  if (resolvedStat.isFile() && path15.extname(resolved).toLowerCase() === ".zip") {
+  if (resolvedStat.isFile() && path16.extname(resolved).toLowerCase() === ".zip") {
     const archive = await readZipArchive(await readFile3(resolved));
     const filteredFiles = Object.fromEntries(
       Object.entries(archive.files).filter(([relativePath]) => shouldIncludePortableFile(relativePath))
     );
     return {
-      rootPath: archive.rootPath ?? path15.basename(resolved, ".zip"),
+      rootPath: archive.rootPath ?? path16.basename(resolved, ".zip"),
       files: filteredFiles
     };
   }
-  const rootDir = resolvedStat.isDirectory() ? resolved : path15.dirname(resolved);
+  const rootDir = resolvedStat.isDirectory() ? resolved : path16.dirname(resolved);
   const files = {};
   await collectPackageFiles(rootDir, rootDir, files);
   return {
-    rootPath: path15.basename(rootDir),
+    rootPath: path16.basename(rootDir),
     files
   };
 }
 async function writeExportToFolder(outDir, exported) {
-  const root = path15.resolve(outDir);
+  const root = path16.resolve(outDir);
   await mkdir2(root, { recursive: true });
   for (const [relativePath, content] of Object.entries(exported.files)) {
     const normalized = relativePath.replace(/\\/g, "/");
-    const filePath = path15.join(root, normalized);
-    await mkdir2(path15.dirname(filePath), { recursive: true });
+    const filePath = path16.join(root, normalized);
+    await mkdir2(path16.dirname(filePath), { recursive: true });
     const writeValue = portableFileEntryToWriteValue(content);
     if (typeof writeValue === "string") {
       await writeFile2(filePath, writeValue, "utf8");
@@ -33575,7 +33987,7 @@ async function writeExportToFolder(outDir, exported) {
   }
 }
 async function confirmOverwriteExportDirectory(outDir) {
-  const root = path15.resolve(outDir);
+  const root = path16.resolve(outDir);
   const stats = await stat2(root).catch(() => null);
   if (!stats) return;
   if (!stats.isDirectory()) {
@@ -33757,7 +34169,7 @@ function registerCompanyCommands(program) {
         printOutput(
           {
             ok: true,
-            out: path15.resolve(opts.out),
+            out: path16.resolve(opts.out),
             rootPath: exported.rootPath,
             filesWritten: Object.keys(exported.files).length,
             rudderExtensionPath: exported.rudderExtensionPath,
@@ -34256,7 +34668,7 @@ function parseResultValue(value) {
 // src/commands/client/issue.ts
 init_dist2();
 import { readFile as readFile4, stat as stat3 } from "node:fs/promises";
-import path16 from "node:path";
+import path17 from "node:path";
 function registerIssueCommands(program) {
   const issue = program.command("issue").description("Issue operations");
   addCommonClientOptions(
@@ -34620,7 +35032,7 @@ async function readTextInputFile2(inputPath, optionName) {
   if (inputPath === "-") {
     return readStdinText2();
   }
-  const resolvedPath = path16.resolve(process.cwd(), inputPath);
+  const resolvedPath = path17.resolve(process.cwd(), inputPath);
   return readFile4(resolvedPath, "utf8").catch((err) => {
     throw new Error(`Unable to read ${optionName} ${inputPath}: ${err instanceof Error ? err.message : String(err)}`);
   });
@@ -34677,14 +35089,14 @@ async function appendUploadedIssueImages(ctx, issueId, body, imagePaths) {
 ${imageBlock}` : imageBlock;
 }
 async function uploadIssueCommentImage(ctx, issue, imagePath) {
-  const resolvedPath = path16.resolve(process.cwd(), imagePath);
+  const resolvedPath = path17.resolve(process.cwd(), imagePath);
   const stats = await stat3(resolvedPath).catch((err) => {
     throw new Error(`Unable to read image ${imagePath}: ${err instanceof Error ? err.message : String(err)}`);
   });
   if (!stats.isFile()) {
     throw new Error(`Image path must be a file: ${imagePath}`);
   }
-  const filename = path16.basename(resolvedPath);
+  const filename = path17.basename(resolvedPath);
   const contentType = inferCommentImageContentType(filename);
   const buffer = await readFile4(resolvedPath);
   if (buffer.length <= 0) {
@@ -34703,7 +35115,7 @@ async function uploadIssueCommentImage(ctx, issue, imagePath) {
   return attachment;
 }
 function inferCommentImageContentType(filename) {
-  const ext = path16.extname(filename).toLowerCase();
+  const ext = path17.extname(filename).toLowerCase();
   switch (ext) {
     case ".png":
       return "image/png";
@@ -34807,7 +35219,7 @@ function formatIssueSearchMatch(match) {
 
 // src/commands/client/library.ts
 import { readFile as readFile5 } from "node:fs/promises";
-import path17 from "node:path";
+import path18 from "node:path";
 function toLibraryFileLinkResult(detail) {
   return {
     filePath: detail.filePath,
@@ -34952,7 +35364,7 @@ async function resolveBodyFileInput(inputPath) {
   if (inputPath === "-") {
     return readStdinText3();
   }
-  const resolvedPath = path17.resolve(process.cwd(), inputPath);
+  const resolvedPath = path18.resolve(process.cwd(), inputPath);
   return readFile5(resolvedPath, "utf8").catch((err) => {
     throw new Error(`Unable to read --body-file ${inputPath}: ${err instanceof Error ? err.message : String(err)}`);
   });
@@ -35154,6 +35566,21 @@ function projectPath(projectRef, orgId) {
 // src/commands/client/runs.ts
 function registerRunsCommands(program) {
   const runs = program.command("runs").description("Run debugging operations");
+  addCommonClientOptions(
+    runs.command("create").description(getAgentCliCapabilityById("runs.create").description).requiredOption("--task <text>", "Delegation task text").option("--target-agent-id <id>", "Same-organization target Agent; defaults to the current Agent").requiredOption("--idempotency-key <key>", "Stable key for safe replay").action(async (opts) => {
+      try {
+        const ctx = resolveCommandContext(opts);
+        const row = await ctx.api.post("/api/agent-runs/delegation", {
+          task: opts.task,
+          ...opts.targetAgentId ? { targetAgentId: opts.targetAgentId } : {},
+          idempotencyKey: opts.idempotencyKey
+        });
+        printOutput(row, { json: ctx.json });
+      } catch (err) {
+        handleCommandError(err);
+      }
+    })
+  );
   addCommonClientOptions(
     runs.command("list").description(getAgentCliCapabilityById("runs.list").description).option("-O, --org-id <id>", "Organization ID").option("--updated-after <iso>", "Only runs updated after this timestamp").option("--run-id-prefix <prefix>", "Filter by run ID prefix").option("--agent-id <id>", "Filter by agent ID").option("--status <status>", "Filter by run status").option("--runtime <type>", "Filter by runtime type").option("--issue-id <id>", "Filter by linked issue ID").option("--used-skill <key-or-name>", "Filter by skill actually used during the run").option("--loaded-skill <key-or-name>", "Filter by skill loaded for the run").option("--created-before <iso>", "Only runs created before this timestamp").option("--cursor <cursor>", "Stable summary cursor returned in page.nextCursor").option("--limit <n>", "Maximum rows; defaults to 50 summaries or 200 full rows").option("--full", "Use the legacy full-row list response for compatibility").addHelpText("after", formatExamplesAndCautions({
       examples: [
@@ -35806,8 +36233,8 @@ function registerUserCommands(program) {
         appendParam(params, "limit", opts.limit);
         appendParam(params, "cursor", opts.cursor);
         const query = params.toString();
-        const path25 = `/api/orgs/${ctx.orgId}/users/${encodeURIComponent(userId)}/activity-ledger${query ? `?${query}` : ""}`;
-        const result = await ctx.api.get(path25);
+        const path26 = `/api/orgs/${ctx.orgId}/users/${encodeURIComponent(userId)}/activity-ledger${query ? `?${query}` : ""}`;
+        const result = await ctx.api.get(path26);
         if (ctx.json) {
           printOutput(result, { json: true });
           return;
@@ -36622,11 +37049,11 @@ init_run();
 // src/commands/start.ts
 import * as p15 from "@clack/prompts";
 import { spawn as spawn3, spawnSync as spawnSync4 } from "node:child_process";
-import { createHash as createHash4, randomUUID } from "node:crypto";
+import { createHash as createHash5, randomUUID } from "node:crypto";
 import { constants as fsConstants, mkdirSync as mkdirSync2, readFileSync as readFileSync2 } from "node:fs";
 import { access, chmod as chmod2, copyFile, cp, lstat, mkdir as mkdir3, mkdtemp as mkdtemp2, readdir as readdir3, readFile as readFile6, rm as rm3, stat as stat4, utimes, writeFile as writeFile3 } from "node:fs/promises";
 import { homedir, tmpdir } from "node:os";
-import path23 from "node:path";
+import path24 from "node:path";
 import { clearTimeout as clearTimeout3, setTimeout as setTimeout3 } from "node:timers";
 import { setTimeout as delay2 } from "node:timers/promises";
 import pc14 from "picocolors";
@@ -36654,10 +37081,10 @@ function parseChecksumFile(contents) {
 init_home();
 
 // src/desktop-download.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 import { createWriteStream as createWriteStream3, mkdirSync } from "node:fs";
 import { rm as rm2 } from "node:fs/promises";
-import path22 from "node:path";
+import path23 from "node:path";
 import { Readable as Readable2, Transform as Transform2 } from "node:stream";
 import { pipeline as pipeline3 } from "node:stream/promises";
 import { clearTimeout as clearTimeout2, setTimeout as setTimeout2 } from "node:timers";
@@ -36897,7 +37324,7 @@ async function resolveDesktopDownloadOrigins(options) {
 }
 async function downloadAsset(asset, outputDir, progressFactory = createByteProgress, expectedChecksum, timeouts = {}) {
   mkdirSync(outputDir, { recursive: true });
-  const outputPath = path22.join(outputDir, path22.basename(asset.name));
+  const outputPath = path23.join(outputDir, path23.basename(asset.name));
   const idleTimeoutMs = timeouts.idleMs ?? DESKTOP_ASSET_IDLE_TIMEOUT_MS;
   const responseTimeoutMs = timeouts.responseMs ?? DESKTOP_ASSET_RESPONSE_TIMEOUT_MS;
   const failures = [];
@@ -36917,7 +37344,7 @@ async function downloadAsset(asset, outputDir, progressFactory = createByteProgr
       const totalBytes = contentLengthFromHeaders(response.headers);
       progress = progressFactory(`Downloading ${asset.name}`);
       let receivedBytes = 0;
-      const hash = createHash3("sha256");
+      const hash = createHash4("sha256");
       let monitor;
       const armIdleTimeout = () => {
         if (idleTimeout) clearTimeout2(idleTimeout);
@@ -37233,38 +37660,38 @@ function resolveDesktopAssetTarget(platform = process.platform, arch = process.a
   throw new Error(`Rudder Desktop does not publish portable assets for ${platform}.`);
 }
 function resolveDefaultDesktopInstallRoot(target, env = process.env, homeDir = homedir()) {
-  if (target.platform === "macos") return path23.join(homeDir, "Applications");
+  if (target.platform === "macos") return path24.join(homeDir, "Applications");
   if (target.platform === "windows") {
-    const localAppData = env.LOCALAPPDATA?.trim() || path23.join(homeDir, "AppData", "Local");
-    return path23.join(localAppData, "Programs", DESKTOP_APP_NAME);
+    const localAppData = env.LOCALAPPDATA?.trim() || path24.join(homeDir, "AppData", "Local");
+    return path24.join(localAppData, "Programs", DESKTOP_APP_NAME);
   }
-  return path23.join(homeDir, ".local", "share", "rudder");
+  return path24.join(homeDir, ".local", "share", "rudder");
 }
 function resolveDesktopInstallPaths(target, installRoot) {
-  const root = path23.resolve(installRoot);
+  const root = path24.resolve(installRoot);
   if (target.platform === "macos") {
-    const appPath2 = path23.join(root, `${DESKTOP_APP_NAME}.app`);
+    const appPath2 = path24.join(root, `${DESKTOP_APP_NAME}.app`);
     return {
       installRoot: root,
       appPath: appPath2,
-      executablePath: path23.join(appPath2, "Contents", "MacOS", DESKTOP_APP_NAME),
-      metadataPath: path23.join(root, DESKTOP_METADATA_FILE)
+      executablePath: path24.join(appPath2, "Contents", "MacOS", DESKTOP_APP_NAME),
+      metadataPath: path24.join(root, DESKTOP_METADATA_FILE)
     };
   }
   if (target.platform === "windows") {
     return {
       installRoot: root,
       appPath: root,
-      executablePath: path23.join(root, `${DESKTOP_APP_NAME}.exe`),
-      metadataPath: path23.join(root, DESKTOP_METADATA_FILE)
+      executablePath: path24.join(root, `${DESKTOP_APP_NAME}.exe`),
+      metadataPath: path24.join(root, DESKTOP_METADATA_FILE)
     };
   }
-  const appPath = path23.join(root, `${DESKTOP_APP_NAME}.AppImage`);
+  const appPath = path24.join(root, `${DESKTOP_APP_NAME}.AppImage`);
   return {
     installRoot: root,
     appPath,
     executablePath: appPath,
-    metadataPath: path23.join(root, DESKTOP_METADATA_FILE)
+    metadataPath: path24.join(root, DESKTOP_METADATA_FILE)
   };
 }
 function normalizeAssetName(name) {
@@ -37447,21 +37874,21 @@ function buildGithubReleaseAsset(repo, tag, assetName, downloadBaseUrl) {
   };
 }
 function checksumForFile(filePath) {
-  const hash = createHash4("sha256");
+  const hash = createHash5("sha256");
   hash.update(readFileSync2(filePath));
   return hash.digest("hex");
 }
 function resolveAssetChecksum(checksums, assetName) {
-  const expected = checksums.get(path23.basename(assetName));
+  const expected = checksums.get(path24.basename(assetName));
   if (!expected) {
-    throw new Error(`Desktop release checksums do not include ${path23.basename(assetName)}.`);
+    throw new Error(`Desktop release checksums do not include ${path24.basename(assetName)}.`);
   }
   return expected;
 }
 function assertChecksumMatch(filePath, expected) {
   const actual = checksumForFile(filePath);
   if (actual !== expected.toLowerCase()) {
-    throw new Error(`Checksum mismatch for ${path23.basename(filePath)}.`);
+    throw new Error(`Checksum mismatch for ${path24.basename(filePath)}.`);
   }
   return actual;
 }
@@ -37480,10 +37907,10 @@ function normalizeDesktopAssetChecksum(checksum) {
   return normalized;
 }
 function resolveDesktopAssetCacheDir(assetChecksum, homeDir = resolveRudderHomeDir()) {
-  return path23.join(homeDir, DESKTOP_ASSET_CACHE_DIR, normalizeDesktopAssetChecksum(assetChecksum));
+  return path24.join(homeDir, DESKTOP_ASSET_CACHE_DIR, normalizeDesktopAssetChecksum(assetChecksum));
 }
 function resolveDesktopCachedAssetPath(assetName, assetChecksum, homeDir = resolveRudderHomeDir()) {
-  return path23.join(resolveDesktopAssetCacheDir(assetChecksum, homeDir), path23.basename(assetName));
+  return path24.join(resolveDesktopAssetCacheDir(assetChecksum, homeDir), path24.basename(assetName));
 }
 async function pruneDesktopAssetCache(options = {}) {
   const homeDir = options.homeDir ?? resolveRudderHomeDir();
@@ -37529,7 +37956,7 @@ async function maybePruneDesktopAssetCache(options) {
   return result.deleted.length > 0 || result.warnings.length > 0 ? result : null;
 }
 async function scanDesktopAssetCacheEntries(homeDir) {
-  const cacheRoot = path23.join(homeDir, DESKTOP_ASSET_CACHE_DIR);
+  const cacheRoot = path24.join(homeDir, DESKTOP_ASSET_CACHE_DIR);
   const dirents = await readdir3(cacheRoot, { withFileTypes: true }).catch(() => null);
   if (!dirents) return [];
   const entries = [];
@@ -37541,7 +37968,7 @@ async function scanDesktopAssetCacheEntries(homeDir) {
     } catch {
       continue;
     }
-    const cacheDir = path23.join(cacheRoot, dirent.name);
+    const cacheDir = path24.join(cacheRoot, dirent.name);
     const stats = await desktopCacheDirectoryStats(cacheDir);
     entries.push({
       cacheDir,
@@ -37565,7 +37992,7 @@ async function desktopCacheDirectoryStats(targetPath) {
   let lastUsedAtMs = Number(fallbackStat?.mtimeMs ?? 0);
   for (const dirent of dirents) {
     if (dirent.isSymbolicLink()) continue;
-    const entryPath = path23.join(targetPath, dirent.name);
+    const entryPath = path24.join(targetPath, dirent.name);
     const entryStat = await stat4(entryPath).catch(() => null);
     if (!entryStat) continue;
     lastUsedAtMs = Math.max(lastUsedAtMs, Number(entryStat.mtimeMs ?? 0));
@@ -37642,13 +38069,13 @@ async function downloadDesktopAssetWithCache(asset, expectedChecksum, options =
       await rm3(cachePath, { force: true });
     }
   }
-  const outputDir = options.outputDir ?? await mkdtemp2(path23.join(tmpdir(), "rudder-desktop-installer."));
+  const outputDir = options.outputDir ?? await mkdtemp2(path24.join(tmpdir(), "rudder-desktop-installer."));
   const removeOutputDir = options.outputDir ? false : true;
   try {
     const downloadedPath = await downloadAsset(asset, outputDir, options.progressFactory, normalizedChecksum);
     const checksum = assertChecksumMatch(downloadedPath, normalizedChecksum);
-    await mkdir3(path23.dirname(cachePath), { recursive: true });
-    if (path23.resolve(downloadedPath) !== path23.resolve(cachePath)) {
+    await mkdir3(path24.dirname(cachePath), { recursive: true });
+    if (path24.resolve(downloadedPath) !== path24.resolve(cachePath)) {
       await copyFile(downloadedPath, cachePath);
     }
     return { path: cachePath, checksum, cacheStatus: "miss" };
@@ -37665,8 +38092,8 @@ async function pathExists2(targetPath) {
   }
 }
 function resolveDesktopInstallLockPath(paths) {
-  const installRootHash = createHash4("sha256").update(path23.resolve(paths.installRoot)).digest("hex").slice(0, 16);
-  return path23.join(path23.dirname(paths.appPath), `.rudder-desktop-install-${installRootHash}.lock`);
+  const installRootHash = createHash5("sha256").update(path24.resolve(paths.installRoot)).digest("hex").slice(0, 16);
+  return path24.join(path24.dirname(paths.appPath), `.rudder-desktop-install-${installRootHash}.lock`);
 }
 async function readDesktopInstallLock(lockPath) {
   try {
@@ -37686,14 +38113,14 @@ async function readDesktopInstallLock(lockPath) {
 }
 async function withDesktopInstallLock(paths, fn, options = {}) {
   const lockPath = resolveDesktopInstallLockPath(paths);
-  const lockDir = path23.dirname(lockPath);
+  const lockDir = path24.dirname(lockPath);
   const timeoutMs = options.timeoutMs ?? DESKTOP_INSTALL_LOCK_TIMEOUT_MS;
   const pollMs = options.pollMs ?? DESKTOP_INSTALL_LOCK_POLL_MS;
   const startedAt = Date.now();
   const payload = {
     lockId: randomUUID(),
     pid: process.pid,
-    installRoot: path23.resolve(paths.installRoot),
+    installRoot: path24.resolve(paths.installRoot),
     createdAt: (/* @__PURE__ */ new Date()).toISOString()
   };
   await mkdir3(lockDir, { recursive: true });
@@ -37769,7 +38196,7 @@ async function findPath(root, predicate, maxDepth = 5) {
   async function visit(dir, depth) {
     const entries = await readdir3(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = path23.join(dir, entry.name);
+      const fullPath = path24.join(dir, entry.name);
       if (predicate(fullPath, entry.isDirectory())) return fullPath;
       if (entry.isDirectory() && depth < maxDepth) {
         const nested = await visit(fullPath, depth + 1);
@@ -37781,18 +38208,18 @@ async function findPath(root, predicate, maxDepth = 5) {
   return await visit(root, 0);
 }
 async function findMacApp(extractDir) {
-  const direct = path23.join(extractDir, `${DESKTOP_APP_NAME}.app`);
+  const direct = path24.join(extractDir, `${DESKTOP_APP_NAME}.app`);
   if (await pathExists2(direct)) return direct;
-  const found = await findPath(extractDir, (filePath, isDirectory) => isDirectory && path23.basename(filePath) === `${DESKTOP_APP_NAME}.app`);
+  const found = await findPath(extractDir, (filePath, isDirectory) => isDirectory && path24.basename(filePath) === `${DESKTOP_APP_NAME}.app`);
   if (!found) throw new Error(`Portable macOS archive did not contain ${DESKTOP_APP_NAME}.app.`);
   return found;
 }
 async function findWindowsAppDir(extractDir) {
-  const direct = path23.join(extractDir, `${DESKTOP_APP_NAME}.exe`);
+  const direct = path24.join(extractDir, `${DESKTOP_APP_NAME}.exe`);
   if (await pathExists2(direct)) return extractDir;
-  const executable = await findPath(extractDir, (filePath, isDirectory) => !isDirectory && path23.basename(filePath).toLowerCase() === `${DESKTOP_APP_NAME.toLowerCase()}.exe`);
+  const executable = await findPath(extractDir, (filePath, isDirectory) => !isDirectory && path24.basename(filePath).toLowerCase() === `${DESKTOP_APP_NAME.toLowerCase()}.exe`);
   if (!executable) throw new Error(`Portable Windows archive did not contain ${DESKTOP_APP_NAME}.exe.`);
-  return path23.dirname(executable);
+  return path24.dirname(executable);
 }
 async function readInstallMetadata(metadataPath) {
   try {
@@ -37860,7 +38287,7 @@ async function waitForUpdateQuitResponse(responsePath, timeoutMs = 8e3) {
 }
 async function requestDesktopQuit(executablePath, target, options = {}) {
   if (!await pathExists2(executablePath)) return { ok: true, status: "not_running" };
-  const responsePath = path23.join(tmpdir(), `rudder-update-quit-${process.pid}-${Date.now()}.json`);
+  const responsePath = path24.join(tmpdir(), `rudder-update-quit-${process.pid}-${Date.now()}.json`);
   const result = spawnSync4(executablePath, [
     `${DESKTOP_UPDATE_QUIT_ARG}=${responsePath}`,
     ...options.forceUpdate ? [DESKTOP_UPDATE_FORCE_ARG] : []
@@ -38024,7 +38451,7 @@ async function installPortableDesktop(installerPath, paths, target) {
     await chmod2(paths.appPath, 493);
     return;
   }
-  const extractDir = await mkdtemp2(path23.join(tmpdir(), "rudder-desktop-extract."));
+  const extractDir = await mkdtemp2(path24.join(tmpdir(), "rudder-desktop-extract."));
   try {
     await extractZip(installerPath, extractDir, target);
     if (target.platform === "macos") {
@@ -38033,7 +38460,7 @@ async function installPortableDesktop(installerPath, paths, target) {
       return;
     }
     const appSource = await findWindowsAppDir(extractDir);
-    await mkdir3(path23.dirname(paths.installRoot), { recursive: true });
+    await mkdir3(path24.dirname(paths.installRoot), { recursive: true });
     await copyPortableAppBundle(appSource, paths.installRoot);
   } finally {
     await rm3(extractDir, { recursive: true, force: true });
@@ -38074,12 +38501,12 @@ function buildLinuxDesktopEntry(executablePath) {
   ].join("\n");
 }
 async function writeLinuxLaunchers(paths) {
-  const desktopDir = path23.join(homedir(), ".local", "share", "applications");
+  const desktopDir = path24.join(homedir(), ".local", "share", "applications");
   await mkdir3(desktopDir, { recursive: true });
-  await writeFile3(path23.join(desktopDir, "rudder.desktop"), buildLinuxDesktopEntry(paths.executablePath), "utf8");
-  const binDir = path23.join(homedir(), ".local", "bin");
+  await writeFile3(path24.join(desktopDir, "rudder.desktop"), buildLinuxDesktopEntry(paths.executablePath), "utf8");
+  const binDir = path24.join(homedir(), ".local", "bin");
   await mkdir3(binDir, { recursive: true });
-  const wrapperPath = path23.join(binDir, "rudder-desktop");
+  const wrapperPath = path24.join(binDir, "rudder-desktop");
   const escaped = paths.executablePath.replaceAll("'", `'"'"'`);
   await writeFile3(wrapperPath, `#!/bin/sh
 exec '${escaped}' "$@"
@@ -38087,13 +38514,13 @@ exec '${escaped}' "$@"
   await chmod2(wrapperPath, 493);
 }
 function buildWindowsShortcutScript(executablePath) {
-  const appData = process.env.APPDATA?.trim() || path23.join(homedir(), "AppData", "Roaming");
-  const shortcutPath = path23.join(appData, "Microsoft", "Windows", "Start Menu", "Programs", "Rudder.lnk");
+  const appData = process.env.APPDATA?.trim() || path24.join(homedir(), "AppData", "Roaming");
+  const shortcutPath = path24.join(appData, "Microsoft", "Windows", "Start Menu", "Programs", "Rudder.lnk");
   return [
     "$shell = New-Object -ComObject WScript.Shell",
     `$shortcut = $shell.CreateShortcut(${powershellQuote(shortcutPath)})`,
     `$shortcut.TargetPath = ${powershellQuote(executablePath)}`,
-    `$shortcut.WorkingDirectory = ${powershellQuote(path23.dirname(executablePath))}`,
+    `$shortcut.WorkingDirectory = ${powershellQuote(path24.dirname(executablePath))}`,
     "$shortcut.Save()"
   ].join("; ");
 }
@@ -38125,7 +38552,7 @@ function launchDesktop(paths, target) {
   spawn3(paths.executablePath, [], { detached: true, stdio: "ignore" }).unref();
 }
 async function writeInstallMetadata(paths, releaseTag, assetName, assetChecksum, assetKind = "full") {
-  mkdirSync2(path23.dirname(paths.metadataPath), { recursive: true });
+  mkdirSync2(path24.dirname(paths.metadataPath), { recursive: true });
   const metadata = {
     version: 1,
     releaseTag,
@@ -38181,7 +38608,7 @@ async function startCommand(opts) {
     if (!exactDesktopAssetPath || !exactDesktopAssetChecksum || !exactDesktopAssetName || !exactDesktopReleaseDigest) {
       throw new Error("Exact Desktop asset mode requires path, checksum, asset name, and release digest.");
     }
-    if (!path23.isAbsolute(exactDesktopAssetPath) || exactDesktopAssetName.includes("/") || !/^[a-f0-9]{64}$/iu.test(exactDesktopAssetChecksum) || !/^[a-f0-9]{64}$/iu.test(exactDesktopReleaseDigest)) {
+    if (!path24.isAbsolute(exactDesktopAssetPath) || exactDesktopAssetName.includes("/") || !/^[a-f0-9]{64}$/iu.test(exactDesktopAssetChecksum) || !/^[a-f0-9]{64}$/iu.test(exactDesktopReleaseDigest)) {
       throw new Error("Exact Desktop asset mode received invalid candidate identity.");
     }
     if (opts.desktopAssetKind && opts.desktopAssetKind !== "full" && opts.desktopAssetKind !== "shell") {
@@ -38295,9 +38722,9 @@ async function startCommand(opts) {
     const smokeReleaseBaseUrls = resolveDesktopSmokeReleaseBaseUrls();
     const target = resolveDesktopAssetTarget();
     const tag = resolveDesktopReleaseTag(version);
-    const installRoot = opts.desktopInstallDir ? path23.resolve(opts.desktopInstallDir) : resolveDefaultDesktopInstallRoot(target);
+    const installRoot = opts.desktopInstallDir ? path24.resolve(opts.desktopInstallDir) : resolveDefaultDesktopInstallRoot(target);
     const installPaths = resolveDesktopInstallPaths(target, installRoot);
-    const outputDir = opts.outputDir ? path23.resolve(opts.outputDir) : await mkdtemp2(path23.join(tmpdir(), "rudder-desktop-installer."));
+    const outputDir = opts.outputDir ? path24.resolve(opts.outputDir) : await mkdtemp2(path24.join(tmpdir(), "rudder-desktop-installer."));
     p15.log.step("Installing desktop app");
     p15.log.message(`Release: ${pc14.cyan(`${repo}@${tag}`)}`);
     p15.log.message(`Target: ${pc14.cyan(`${target.platform}/${target.arch}`)}`);
@@ -38326,7 +38753,7 @@ async function startCommand(opts) {
         };
         selectedAssetKind = opts.desktopAssetKind ?? "full";
         expectedChecksum = normalizeDesktopAssetChecksum(exactDesktopAssetChecksum);
-        const computedReleaseDigest = createHash4("sha256").update(JSON.stringify({
+        const computedReleaseDigest = createHash5("sha256").update(JSON.stringify({
           releaseTag,
           assetName: selectedAsset.name,
           assetChecksum: expectedChecksum,
@@ -38343,7 +38770,7 @@ async function startCommand(opts) {
         if (linkDescriptor.isSymbolicLink()) throw new Error("Exact Desktop asset must not be a symbolic link.");
         const checksum = await runStartPhase(
           "Verifying staged Desktop checksum...",
-          `Verified ${pc14.cyan(path23.basename(exactDesktopAssetPath))}.`,
+          `Verified ${pc14.cyan(path24.basename(exactDesktopAssetPath))}.`,
           () => assertChecksumMatch(exactDesktopAssetPath, expectedChecksum),
           desktopProgressJson ? "verifying_checksum" : null
         );
@@ -38462,7 +38889,7 @@ async function startCommand(opts) {
         }
         const checksum = await runStartPhase(
           "Verifying Desktop checksum...",
-          `Verified ${pc14.cyan(path23.basename(verifiedAsset.path))}.`,
+          `Verified ${pc14.cyan(path24.basename(verifiedAsset.path))}.`,
           () => assertChecksumMatch(verifiedAsset.path, expectedChecksum),
           desktopProgressJson ? "verifying_checksum" : null
         );
@@ -38474,9 +38901,9 @@ async function startCommand(opts) {
             assetName: selectedAsset.name,
             assetChecksum: checksum,
             assetKind: selectedAssetKind,
-            stagedArtifactPath: path23.resolve(verifiedAsset.path),
+            stagedArtifactPath: path24.resolve(verifiedAsset.path),
             stagedArtifactDigest: checksum,
-            releaseDigest: createHash4("sha256").update(JSON.stringify({
+            releaseDigest: createHash5("sha256").update(JSON.stringify({
               releaseTag,
               assetName: selectedAsset.name,
               assetChecksum: checksum,
@@ -38567,11 +38994,11 @@ async function startCommand(opts) {
 
 // src/config/data-dir.ts
 init_home();
-import path24 from "node:path";
+import path25 from "node:path";
 function applyDataDirOverride(options, support = {}) {
   const rawDataDir = options.dataDir?.trim();
   if (!rawDataDir) return null;
-  const resolvedDataDir = path24.resolve(expandHomePrefix(rawDataDir));
+  const resolvedDataDir = path25.resolve(expandHomePrefix(rawDataDir));
   process.env.RUDDER_HOME = resolvedDataDir;
   if (support.hasConfigOption) {
     const hasConfigOverride = Boolean(options.config?.trim()) || Boolean(process.env.RUDDER_CONFIG?.trim());