@rudderhq/cli 0.7.15 → 0.7.18

package/dist/index.js

@@ -1700,7 +1700,9 @@ var init_rudder_agent_contract_generated = __esm({
         },
         {
           "api": {
-            "transport": "cli-fallback"
+            "method": "GET",
+            "pathTemplate": "/api/issues/{issue}/comments",
+            "transport": "direct"
           },
           "cli": {
             "attachesRunIdWhenAvailable": false,
@@ -1760,7 +1762,9 @@ var init_rudder_agent_contract_generated = __esm({
         },
         {
           "api": {
-            "transport": "cli-fallback"
+            "method": "GET",
+            "pathTemplate": "/api/issues/{issue}/comments/{comment}",
+            "transport": "direct"
           },
           "cli": {
             "attachesRunIdWhenAvailable": false,
@@ -8582,6 +8586,65 @@ var init_rudder_agent_contract_generated = __esm({
             },
             "name": "rudder_runs_retry"
           }
+        },
+        {
+          "api": {
+            "method": "POST",
+            "pathTemplate": "/api/agent-runs/delegation",
+            "transport": "direct"
+          },
+          "cli": {
+            "attachesRunIdWhenAvailable": true,
+            "category": "runs",
+            "command": "rudder runs create --task <text> --idempotency-key <key> [--target-agent-id <id>]",
+            "contract": "agent-v1",
+            "description": "Create an independently governed Delegation Run for the current or another same-organization Agent.",
+            "id": "runs.create",
+            "mutating": true,
+            "requiresAgentId": true,
+            "requiresOrgId": false,
+            "requiresRunId": true
+          },
+          "id": "runs.create",
+          "mcp": {
+            "annotations": {
+              "destructiveHint": false,
+              "idempotentHint": true,
+              "readOnlyHint": false,
+              "title": "Create an independently governed Delegation Run"
+            },
+            "capabilityId": "runs.create",
+            "description": "Create an independently governed Delegation Run for the current or another same-organization Agent. Mutating: yes. Runtime identity and authorization are injected by the Rudder-managed MCP server and are not accepted as tool input. Org context: not required by this tool. Agent context: required from runtime env. Run attribution: attached from runtime env when available.",
+            "inputSchema": {
+              "additionalProperties": false,
+              "properties": {
+                "idempotencyKey": {
+                  "description": "Required stable key for safe replay.",
+                  "maxLength": 500,
+                  "minLength": 1,
+                  "type": "string"
+                },
+                "targetAgentId": {
+                  "description": "Optional same-organization target Agent id.",
+                  "maxLength": 200,
+                  "minLength": 1,
+                  "type": "string"
+                },
+                "task": {
+                  "description": "Delegation task to run independently.",
+                  "maxLength": 2e4,
+                  "minLength": 1,
+                  "type": "string"
+                }
+              },
+              "required": [
+                "task",
+                "idempotencyKey"
+              ],
+              "type": "object"
+            },
+            "name": "rudder_runs_create"
+          }
         }
       ],
       "contractVersion": "rudder.agent-contract/v1",
@@ -16296,6 +16359,50 @@ var init_rudder_mcp_tool_descriptors_generated = __esm({
           ],
           "type": "object"
         }
+      },
+      {
+        "capabilityId": "runs.create",
+        "name": "rudder_runs_create",
+        "description": "Create an independently governed Delegation Run for the current or another same-organization Agent.",
+        "semanticDescription": "Create an independently governed Delegation Run for the current or another same-organization Agent. Mutating: yes. Runtime identity and authorization are injected by the Rudder-managed MCP server and are not accepted as tool input. Org context: not required by this tool. Agent context: required from runtime env. Run attribution: attached from runtime env when available.",
+        "annotations": {
+          "destructiveHint": false,
+          "idempotentHint": true,
+          "readOnlyHint": false,
+          "title": "Create an independently governed Delegation Run"
+        },
+        "mutating": true,
+        "requiresOrgId": false,
+        "requiresAgentId": true,
+        "attachesRunIdWhenAvailable": true,
+        "inputSchema": {
+          "additionalProperties": false,
+          "properties": {
+            "idempotencyKey": {
+              "description": "Required stable key for safe replay.",
+              "maxLength": 500,
+              "minLength": 1,
+              "type": "string"
+            },
+            "targetAgentId": {
+              "description": "Optional same-organization target Agent id.",
+              "maxLength": 200,
+              "minLength": 1,
+              "type": "string"
+            },
+            "task": {
+              "description": "Delegation task to run independently.",
+              "maxLength": 2e4,
+              "minLength": 1,
+              "type": "string"
+            }
+          },
+          "required": [
+            "task",
+            "idempotencyKey"
+          ],
+          "type": "object"
+        }
       }
     ];
   }
@@ -16895,7 +17002,8 @@ var init_constants = __esm({
       "rudder_runs_transcript",
       "rudder_runs_errors",
       "rudder_runs_cancel",
-      "rudder_runs_retry"
+      "rudder_runs_retry",
+      "rudder_runs_create"
     ];
     RUDDER_BROWSER_MCP_TOOL_NAMES2 = RUDDER_AGENT_V1_MCP_TOOL_NAMES.filter((name) => name.startsWith("rudder_browser_"));
     RUDDER_CORE_MCP_TOOL_NAMES2 = RUDDER_AGENT_V1_MCP_TOOL_NAMES.filter((name) => !name.startsWith("rudder_browser_"));
@@ -18532,6 +18640,7 @@ var init_chat = __esm({
     }).strict();
     addChatMessageSchema = z5.object({
       body: z5.string().trim().max(2e4).default(""),
+      clientMutationId: z5.string().trim().min(1).max(120).optional(),
       inlineAnnotations: chatInlineAnnotationsInputSchema.optional(),
       editUserMessageId: z5.string().uuid().optional().nullable(),
       queuedMessageId: z5.string().uuid().optional().nullable(),
@@ -19975,7 +20084,7 @@ var init_resource = __esm({
 
 // ../packages/shared/dist/validators/agent.js
 import { z as z20 } from "zod";
-var agentPermissionsSchema, agentInstructionsBundleModeSchema, updateAgentInstructionsBundleSchema, upsertAgentInstructionsFileSchema, agentRuntimeConfigSchema, optionalAgentNameSchema, uploadedAgentIconSchema, diceBearNotionistsAgentIconSchema, oreoAgentIconSchema, agentIconSchema, createAgentSchema, createAgentHireSchema, updateAgentSchema, updateAgentInstructionsPathSchema, createAgentKeySchema, wakeAgentSchema, resetAgentSessionSchema, testAgentRuntimeEnvironmentSchema, updateAgentPermissionsSchema;
+var agentPermissionsSchema, agentInstructionsBundleModeSchema, updateAgentInstructionsBundleSchema, upsertAgentInstructionsFileSchema, agentRuntimeConfigSchema, optionalAgentNameSchema, uploadedAgentIconSchema, diceBearNotionistsAgentIconSchema, oreoAgentIconSchema, agentIconSchema, createAgentSchema, createAgentHireSchema, updateAgentSchema, updateAgentInstructionsPathSchema, createAgentKeySchema, wakeAgentSchema, delegationTaskSchema, createDelegationRunSchema, resetAgentSessionSchema, testAgentRuntimeEnvironmentSchema, updateAgentPermissionsSchema;
 var init_agent = __esm({
   "../packages/shared/dist/validators/agent.js"() {
     "use strict";
@@ -20072,6 +20181,12 @@ var init_agent = __esm({
       idempotencyKey: z20.string().optional().nullable(),
       forceFreshSession: z20.preprocess((value) => value === null ? void 0 : value, z20.boolean().optional().default(false))
     });
+    delegationTaskSchema = z20.string().trim().min(1).refine((value) => Array.from(value).length <= 2e4, "task must be no more than 20,000 Unicode characters");
+    createDelegationRunSchema = z20.object({
+      task: delegationTaskSchema,
+      targetAgentId: z20.string().trim().min(1).max(200).optional(),
+      idempotencyKey: z20.string().trim().min(1).max(500)
+    });
     resetAgentSessionSchema = z20.object({
       taskKey: z20.string().min(1).optional().nullable()
     });
@@ -20284,7 +20399,7 @@ var init_project = __esm({
 
 // ../packages/shared/dist/validators/issue.js
 import { z as z23 } from "zod";
-var runWorkspaceStrategySchema, issueRunWorkspaceSettingsSchema, issueAssigneeAdapterOverridesSchema, createIssueSchema, createIssueLabelSchema, updateIssueLabelSchema, updateIssueSchema, reorderIssueSchema, checkoutIssueSchema, addIssueCommentSchema, updateIssueCommentSchema, reportIssueCommitSchema, linkIssueApprovalSchema, createIssueAttachmentMetadataSchema, createIssueWorkspaceAttachmentSchema, ISSUE_DOCUMENT_FORMATS, issueDocumentFormatSchema, createLibraryDocumentSchema, updateLibraryDocumentSchema, restoreLibraryDocumentRevisionSchema;
+var runWorkspaceStrategySchema, issueRunWorkspaceSettingsSchema, issueAssigneeAdapterOverridesSchema, createIssueSchema, createRunDebugIssueSchema, createIssueLabelSchema, updateIssueLabelSchema, updateIssueSchema, reorderIssueSchema, checkoutIssueSchema, addIssueCommentSchema, updateIssueCommentSchema, reportIssueCommitSchema, linkIssueApprovalSchema, createIssueAttachmentMetadataSchema, createIssueWorkspaceAttachmentSchema, ISSUE_DOCUMENT_FORMATS, issueDocumentFormatSchema, createLibraryDocumentSchema, updateLibraryDocumentSchema, restoreLibraryDocumentRevisionSchema;
 var init_issue = __esm({
   "../packages/shared/dist/validators/issue.js"() {
     "use strict";
@@ -20347,6 +20462,9 @@ var init_issue = __esm({
       executionWorkspaceSettings: issueRunWorkspaceSettingsSchema.optional().nullable(),
       labelIds: z23.array(z23.string().uuid()).optional()
     });
+    createRunDebugIssueSchema = z23.object({
+      diagnostics: z23.string().trim().min(1).max(32e3)
+    });
     createIssueLabelSchema = z23.object({
       name: z23.string().trim().min(1).max(48),
       color: z23.string().regex(/^#(?:[0-9a-fA-F]{6})$/, "Color must be a 6-digit hex value")
@@ -21530,12 +21648,12 @@ var init_dist2 = __esm({
 });
 
 // src/config/home.ts
-import os from "node:os";
-import path from "node:path";
+import os2 from "node:os";
+import path2 from "node:path";
 function resolveRudderHomeDir() {
   const envHome = process.env.RUDDER_HOME?.trim();
-  if (envHome) return path.resolve(expandHomePrefix(envHome));
-  return path.resolve(os.homedir(), ".rudder");
+  if (envHome) return path2.resolve(expandHomePrefix(envHome));
+  return path2.resolve(os2.homedir(), ".rudder");
 }
 function resolveRudderInstanceId(override) {
   const raw = override?.trim() || process.env.RUDDER_INSTANCE_ID?.trim() || DEFAULT_INSTANCE_ID;
@@ -21548,35 +21666,35 @@ function resolveRudderInstanceId(override) {
 }
 function resolveRudderInstanceRoot(instanceId) {
   const id = resolveRudderInstanceId(instanceId);
-  return path.resolve(resolveRudderHomeDir(), "instances", id);
+  return path2.resolve(resolveRudderHomeDir(), "instances", id);
 }
 function resolveDefaultConfigPath(instanceId) {
-  return path.resolve(resolveRudderInstanceRoot(instanceId), "config.json");
+  return path2.resolve(resolveRudderInstanceRoot(instanceId), "config.json");
 }
 function resolveDefaultContextPath() {
-  return path.resolve(resolveRudderHomeDir(), "context.json");
+  return path2.resolve(resolveRudderHomeDir(), "context.json");
 }
 function resolveDefaultCliAuthPath() {
-  return path.resolve(resolveRudderHomeDir(), "auth.json");
+  return path2.resolve(resolveRudderHomeDir(), "auth.json");
 }
 function resolveDefaultEmbeddedPostgresDir(instanceId) {
-  return path.resolve(resolveRudderInstanceRoot(instanceId), "db");
+  return path2.resolve(resolveRudderInstanceRoot(instanceId), "db");
 }
 function resolveDefaultLogsDir(instanceId) {
-  return path.resolve(resolveRudderInstanceRoot(instanceId), "logs");
+  return path2.resolve(resolveRudderInstanceRoot(instanceId), "logs");
 }
 function resolveDefaultSecretsKeyFilePath(instanceId) {
-  return path.resolve(resolveRudderInstanceRoot(instanceId), "secrets", "master.key");
+  return path2.resolve(resolveRudderInstanceRoot(instanceId), "secrets", "master.key");
 }
 function resolveDefaultStorageDir(instanceId) {
-  return path.resolve(resolveRudderInstanceRoot(instanceId), "data", "storage");
+  return path2.resolve(resolveRudderInstanceRoot(instanceId), "data", "storage");
 }
 function resolveDefaultBackupDir(instanceId) {
-  return path.resolve(resolveRudderInstanceRoot(instanceId), "data", "backups");
+  return path2.resolve(resolveRudderInstanceRoot(instanceId), "data", "backups");
 }
 function expandHomePrefix(value) {
-  if (value === "~") return os.homedir();
-  if (value.startsWith("~/")) return path.resolve(os.homedir(), value.slice(2));
+  if (value === "~") return os2.homedir();
+  if (value.startsWith("~/")) return path2.resolve(os2.homedir(), value.slice(2));
   return value;
 }
 function describeLocalInstancePaths(instanceId) {
@@ -21612,30 +21730,30 @@ var init_schema = __esm({
 });
 
 // src/config/store.ts
-import fs3 from "node:fs";
-import path4 from "node:path";
+import fs4 from "node:fs";
+import path5 from "node:path";
 function findConfigFileFromAncestors(startDir) {
-  const absoluteStartDir = path4.resolve(startDir);
+  const absoluteStartDir = path5.resolve(startDir);
   let currentDir = absoluteStartDir;
   while (true) {
-    const candidate = path4.resolve(currentDir, ".rudder", DEFAULT_CONFIG_BASENAME);
-    if (fs3.existsSync(candidate)) {
+    const candidate = path5.resolve(currentDir, ".rudder", DEFAULT_CONFIG_BASENAME);
+    if (fs4.existsSync(candidate)) {
       return candidate;
     }
-    const nextDir = path4.resolve(currentDir, "..");
+    const nextDir = path5.resolve(currentDir, "..");
     if (nextDir === currentDir) break;
     currentDir = nextDir;
   }
   return null;
 }
 function resolveConfigPath(overridePath) {
-  if (overridePath) return path4.resolve(overridePath);
-  if (process.env.RUDDER_CONFIG) return path4.resolve(process.env.RUDDER_CONFIG);
+  if (overridePath) return path5.resolve(overridePath);
+  if (process.env.RUDDER_CONFIG) return path5.resolve(process.env.RUDDER_CONFIG);
   return findConfigFileFromAncestors(process.cwd()) ?? resolveDefaultConfigPath(resolveRudderInstanceId());
 }
 function parseJson2(filePath) {
   try {
-    return JSON.parse(fs3.readFileSync(filePath, "utf-8"));
+    return JSON.parse(fs4.readFileSync(filePath, "utf-8"));
   } catch (err) {
     throw new Error(`Failed to parse JSON at ${filePath}: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -21674,7 +21792,7 @@ function formatValidationError(err) {
 }
 function readConfig(configPath) {
   const filePath = resolveConfigPath(configPath);
-  if (!fs3.existsSync(filePath)) return null;
+  if (!fs4.existsSync(filePath)) return null;
   const raw = parseJson2(filePath);
   const migrated = migrateLegacyConfig(raw);
   const parsed = rudderConfigSchema.safeParse(migrated);
@@ -21685,19 +21803,19 @@ function readConfig(configPath) {
 }
 function writeConfig(config, configPath) {
   const filePath = resolveConfigPath(configPath);
-  const dir = path4.dirname(filePath);
-  fs3.mkdirSync(dir, { recursive: true });
-  if (fs3.existsSync(filePath)) {
+  const dir = path5.dirname(filePath);
+  fs4.mkdirSync(dir, { recursive: true });
+  if (fs4.existsSync(filePath)) {
     const backupPath = filePath + ".backup";
-    fs3.copyFileSync(filePath, backupPath);
-    fs3.chmodSync(backupPath, 384);
+    fs4.copyFileSync(filePath, backupPath);
+    fs4.chmodSync(backupPath, 384);
   }
-  fs3.writeFileSync(filePath, JSON.stringify(config, null, 2) + "\n", {
+  fs4.writeFileSync(filePath, JSON.stringify(config, null, 2) + "\n", {
     mode: 384
   });
 }
 function configExists(configPath) {
-  return fs3.existsSync(resolveConfigPath(configPath));
+  return fs4.existsSync(resolveConfigPath(configPath));
 }
 var DEFAULT_CONFIG_BASENAME;
 var init_store = __esm({
@@ -21711,7 +21829,7 @@ var init_store = __esm({
 
 // src/version.ts
 import { existsSync, readFileSync } from "node:fs";
-import path5 from "node:path";
+import path6 from "node:path";
 import { fileURLToPath } from "node:url";
 function readPackageVersion(packagePath, expectedName) {
   if (!existsSync(packagePath)) return null;
@@ -21727,12 +21845,12 @@ function resolveCliVersion(moduleUrl = import.meta.url, env = process.env) {
   if (env.npm_package_name === CLI_PACKAGE_NAME && env.npm_package_version) {
     return env.npm_package_version;
   }
-  const moduleDir = path5.dirname(fileURLToPath(moduleUrl));
+  const moduleDir = path6.dirname(fileURLToPath(moduleUrl));
   const candidates = [
-    path5.resolve(moduleDir, CLI_VERSION_MANIFEST),
-    path5.resolve(moduleDir, "package.json"),
-    path5.resolve(moduleDir, "../package.json"),
-    path5.resolve(moduleDir, "../../package.json")
+    path6.resolve(moduleDir, CLI_VERSION_MANIFEST),
+    path6.resolve(moduleDir, "package.json"),
+    path6.resolve(moduleDir, "../package.json"),
+    path6.resolve(moduleDir, "../../package.json")
   ];
   for (const candidate of candidates) {
     const version = readPackageVersion(candidate, CLI_PACKAGE_NAME);
@@ -21782,10 +21900,10 @@ var init_hostnames = __esm({
 // src/config/env.ts
 import { config as loadDotenv, parse as parseEnvFileContents } from "dotenv";
 import { randomBytes } from "node:crypto";
-import fs5 from "node:fs";
-import path7 from "node:path";
+import fs6 from "node:fs";
+import path8 from "node:path";
 function resolveEnvFilePath(configPath) {
-  return path7.resolve(path7.dirname(resolveConfigPath(configPath)), ".env");
+  return path8.resolve(path8.dirname(resolveConfigPath(configPath)), ".env");
 }
 function isNonEmpty(value) {
   return typeof value === "string" && value.trim().length > 0;
@@ -21820,7 +21938,7 @@ function loadRudderEnvFile(configPath) {
 }
 function loadAgentJwtEnvFile(filePath = resolveEnvFilePath()) {
   if (loadedEnvFiles.has(filePath)) return;
-  if (!fs5.existsSync(filePath)) return;
+  if (!fs6.existsSync(filePath)) return;
   loadedEnvFiles.add(filePath);
   loadDotenv({ path: filePath, override: false, quiet: true });
 }
@@ -21830,8 +21948,8 @@ function readAgentJwtSecretFromEnv(configPath) {
   return isNonEmpty(raw) ? raw.trim() : null;
 }
 function readAgentJwtSecretFromEnvFile(filePath = resolveEnvFilePath()) {
-  if (!fs5.existsSync(filePath)) return null;
-  const raw = fs5.readFileSync(filePath, "utf-8");
+  if (!fs6.existsSync(filePath)) return null;
+  const raw = fs6.readFileSync(filePath, "utf-8");
   const values = parseEnvFile(raw);
   const value = values[JWT_SECRET_ENV_KEY];
   return isNonEmpty(value) ? value.trim() : null;
@@ -21854,13 +21972,13 @@ function writeAgentJwtEnv(secret, filePath = resolveEnvFilePath()) {
   mergePaperclipEnvEntries({ [JWT_SECRET_ENV_KEY]: secret }, filePath);
 }
 function readPaperclipEnvEntries(filePath = resolveEnvFilePath()) {
-  if (!fs5.existsSync(filePath)) return {};
-  return parseEnvFile(fs5.readFileSync(filePath, "utf-8"));
+  if (!fs6.existsSync(filePath)) return {};
+  return parseEnvFile(fs6.readFileSync(filePath, "utf-8"));
 }
 function writePaperclipEnvEntries(entries, filePath = resolveEnvFilePath()) {
-  const dir = path7.dirname(filePath);
-  fs5.mkdirSync(dir, { recursive: true });
-  fs5.writeFileSync(filePath, renderEnvFile(entries), {
+  const dir = path8.dirname(filePath);
+  fs6.mkdirSync(dir, { recursive: true });
+  fs6.writeFileSync(filePath, renderEnvFile(entries), {
     mode: 384
   });
 }
@@ -21904,8 +22022,8 @@ var init_npm_command = __esm({
 // src/runtime/native-payload.ts
 import { execFile } from "node:child_process";
 import { existsSync as existsSync3 } from "node:fs";
-import fs6 from "node:fs/promises";
-import path8 from "node:path";
+import fs7 from "node:fs/promises";
+import path9 from "node:path";
 import { performance } from "node:perf_hooks";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { promisify } from "node:util";
@@ -21914,14 +22032,14 @@ function nativeTarget() {
 }
 function resolveNativePayloadBinary() {
   const configured = process.env.RUDDER_NATIVE_PAYLOAD_PATH?.trim() || process.env.RUDDER_NATIVE_PATH?.trim();
-  if (configured) return path8.resolve(configured);
+  if (configured) return path9.resolve(configured);
   const binaryName = process.platform === "win32" ? "rudder-native.exe" : "rudder-native";
-  const moduleDir = path8.dirname(fileURLToPath3(import.meta.url));
+  const moduleDir = path9.dirname(fileURLToPath3(import.meta.url));
   const target = nativeTarget();
   const candidates = [
-    path8.resolve(moduleDir, "../../../native/target/debug", binaryName),
-    path8.resolve(moduleDir, "../../../../native/target/debug", binaryName),
-    path8.resolve(moduleDir, "../../../native", target ?? "unsupported", binaryName)
+    path9.resolve(moduleDir, "../../../native/target/debug", binaryName),
+    path9.resolve(moduleDir, "../../../../native/target/debug", binaryName),
+    path9.resolve(moduleDir, "../../../native", target ?? "unsupported", binaryName)
   ];
   return candidates.find((candidate) => existsSync3(candidate)) ?? candidates[0];
 }
@@ -21994,7 +22112,7 @@ async function verifyNativePayload(archivePath, expectedSha256, maxArchiveBytes,
   return runNativePayload("payload.verify", [
     "payload",
     "verify",
-    path8.resolve(archivePath),
+    path9.resolve(archivePath),
     expectedSha256,
     String(maxArchiveBytes)
   ], false, timeoutMs);
@@ -22004,9 +22122,9 @@ async function extractNativePayload(archivePath, stagingPath, maxArchiveBytes, t
     return await runNativePayload("payload.extract", [
       "payload",
       "extract",
-      path8.resolve(archivePath),
+      path9.resolve(archivePath),
       "auto",
-      path8.resolve(stagingPath),
+      path9.resolve(stagingPath),
       String(maxArchiveBytes),
       String(maxArchiveBytes),
       String(maxArchiveBytes * 2),
@@ -22023,7 +22141,7 @@ async function probeNativePayloadVersion(rootPath, executable, timeoutMs) {
   return runNativePayload("payload.probeVersion", [
     "payload",
     "probe-version",
-    path8.resolve(rootPath),
+    path9.resolve(rootPath),
     executable,
     "PostgreSQL 18.4"
   ], true, timeoutMs);
@@ -22032,8 +22150,8 @@ async function publishNativePayload(stagingPath, destinationPath, timeoutMs) {
   return runNativePayload("payload.publish", [
     "payload",
     "publish",
-    path8.resolve(stagingPath),
-    path8.resolve(destinationPath)
+    path9.resolve(stagingPath),
+    path9.resolve(destinationPath)
   ], true, timeoutMs);
 }
 async function tryInstallNativePayload(input) {
@@ -22132,7 +22250,7 @@ async function tryInstallNativePayload(input) {
       }
     };
   } finally {
-    const cleanup = input.cleanupPublishStaging ?? ((publishStagingPath) => fs6.rm(publishStagingPath, { recursive: true, force: true }));
+    const cleanup = input.cleanupPublishStaging ?? ((publishStagingPath) => fs7.rm(publishStagingPath, { recursive: true, force: true }));
     void cleanup(input.publishStagingPath).catch(() => {
     });
   }
@@ -22173,7 +22291,7 @@ var init_native_payload = __esm({
 });
 
 // src/runtime/postgres-runtime-download.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 import { createReadStream, createWriteStream } from "node:fs";
 import { Readable, Transform } from "node:stream";
 import { pipeline } from "node:stream/promises";
@@ -22192,7 +22310,7 @@ async function downloadRuntimePostgresArchive(url, targetPath, trustedSha256, op
   const controller = new AbortController();
   const timeout = Number.isFinite(parsedTimeout) && parsedTimeout > 0 ? setTimeout(() => controller.abort(), parsedTimeout) : null;
   try {
-    const hash = createHash2("sha256");
+    const hash = createHash3("sha256");
     let bytes = 0;
     const monitor = new Transform({
       transform(chunk, _encoding, callback) {
@@ -22295,7 +22413,7 @@ import { execFileSync, spawnSync as spawnSync2 } from "node:child_process";
 import { createReadStream as createReadStream2, createWriteStream as createWriteStream2 } from "node:fs";
 import { chmod, mkdir, mkdtemp, readFile, readdir, realpath, rename, rm, stat, symlink, writeFile } from "node:fs/promises";
 import { createRequire } from "node:module";
-import path9 from "node:path";
+import path10 from "node:path";
 import { performance as performance2 } from "node:perf_hooks";
 import { pipeline as pipeline2 } from "node:stream/promises";
 import { pathToFileURL } from "node:url";
@@ -22339,7 +22457,7 @@ function resolveRuntimePackageVersion(version) {
   return normalized.length > 0 ? normalized : "latest";
 }
 function resolveRuntimeCacheDir(version, homeDir = resolveRudderHomeDir()) {
-  return path9.join(homeDir, "runtimes", sanitizeRuntimeCacheSegment(resolveRuntimePackageVersion(version)));
+  return path10.join(homeDir, "runtimes", sanitizeRuntimeCacheSegment(resolveRuntimePackageVersion(version)));
 }
 function resolveRuntimePackageSpec(version, packageName = RUNTIME_NPM_PACKAGE_NAME) {
   const packageVersion = resolveRuntimePackageVersion(version);
@@ -22347,7 +22465,7 @@ function resolveRuntimePackageSpec(version, packageName = RUNTIME_NPM_PACKAGE_NA
 }
 async function readRuntimeInstallMetadata(cacheDir) {
   try {
-    const raw = await readFile(path9.join(cacheDir, RUNTIME_METADATA_FILE), "utf8");
+    const raw = await readFile(path10.join(cacheDir, RUNTIME_METADATA_FILE), "utf8");
     const parsed = JSON.parse(raw);
     if (parsed.version !== 1) return null;
     if (typeof parsed.packageName !== "string" || typeof parsed.packageVersion !== "string") return null;
@@ -22362,7 +22480,7 @@ async function readRuntimeInstallMetadata(cacheDir) {
   }
 }
 async function writeRuntimeInstallMetadata(cacheDir, metadata) {
-  await writeFile(path9.join(cacheDir, RUNTIME_METADATA_FILE), `${JSON.stringify(metadata, null, 2)}
+  await writeFile(path10.join(cacheDir, RUNTIME_METADATA_FILE), `${JSON.stringify(metadata, null, 2)}
 `, "utf8");
 }
 async function touchRuntimeInstallMetadata(cacheDir, postgresRuntime) {
@@ -22390,7 +22508,7 @@ function resolveEmbeddedPostgresPlatformPackage(platform = process.platform, arc
 }
 async function canResolveRuntimePackage(cacheDir, packageName) {
   try {
-    await readFile(path9.join(cacheDir, "node_modules", ...packageName.split("/"), "package.json"), "utf8");
+    await readFile(path10.join(cacheDir, "node_modules", ...packageName.split("/"), "package.json"), "utf8");
     return true;
   } catch {
     return false;
@@ -22402,9 +22520,9 @@ async function hasRequiredRuntimePlatformDependencies(cacheDir, metadata, postgr
   if (!platformPackage) return true;
   if (await canResolveRuntimePackage(cacheDir, platformPackage)) return true;
   const expectedSharedBinDir = resolveSharedRuntimePostgresPayloadBinDir(
-    path9.dirname(path9.dirname(cacheDir))
+    path10.dirname(path10.dirname(cacheDir))
   );
-  return metadata.postgresRuntime?.scope === "shared" && metadata.postgresRuntime.platform === process.platform && metadata.postgresRuntime.arch === process.arch && path9.resolve(metadata.postgresRuntime.binDir) === path9.resolve(expectedSharedBinDir) && await isRuntimePostgresPayloadUsable(
+  return metadata.postgresRuntime?.scope === "shared" && metadata.postgresRuntime.platform === process.platform && metadata.postgresRuntime.arch === process.arch && path10.resolve(metadata.postgresRuntime.binDir) === path10.resolve(expectedSharedBinDir) && await isRuntimePostgresPayloadUsable(
     cacheDir,
     metadata.postgresRuntime.binDir,
     postgresVersionProbe,
@@ -22419,7 +22537,7 @@ async function isRuntimeCacheHitWithinDeadline(options, deadline) {
     return false;
   }
   try {
-    const packageJsonPath = path9.join(options.cacheDir, "node_modules", ...packageName.split("/"), "package.json");
+    const packageJsonPath = path10.join(options.cacheDir, "node_modules", ...packageName.split("/"), "package.json");
     const packageJson = JSON.parse(await readFile(packageJsonPath, "utf8"));
     const packageVersionMatches = packageVersion === "latest" || packageJson.version === packageVersion;
     return packageVersionMatches && await hasRequiredRuntimePlatformDependencies(
@@ -22439,7 +22557,7 @@ async function ensureRuntimeInstalled(options) {
   const cacheDir = resolveRuntimeCacheDir(packageVersion, homeDir);
   const deadline = createRuntimeInstallDeadline(options);
   return withRuntimeFilesystemLock(
-    path9.join(homeDir, "runtime-payloads", ".postgres-runtime.lifecycle.lock"),
+    path10.join(homeDir, "runtime-payloads", ".postgres-runtime.lifecycle.lock"),
     async () => withRuntimeFilesystemLock(
       `${cacheDir}.install.lock`,
       async () => {
@@ -22562,7 +22680,7 @@ async function ensureRuntimeInstalledUnlocked(options, deadline) {
   }
   await rm(cacheDir, { recursive: true, force: true });
   await mkdir(cacheDir, { recursive: true });
-  await writeFile(path9.join(cacheDir, "package.json"), `${JSON.stringify(RUNTIME_CACHE_PACKAGE_JSON, null, 2)}
+  await writeFile(path10.join(cacheDir, "package.json"), `${JSON.stringify(RUNTIME_CACHE_PACKAGE_JSON, null, 2)}
 `, "utf8");
   const result = runNpmRuntimeInstall(spawnSyncImpl, cacheDir, packageSpec, deadline);
   let output = collectSpawnOutput(result);
@@ -22602,7 +22720,7 @@ async function ensureRuntimeInstalledUnlocked(options, deadline) {
         }
         await rm(fallbackCacheDir, { recursive: true, force: true });
         await mkdir(fallbackCacheDir, { recursive: true });
-        await writeFile(path9.join(fallbackCacheDir, "package.json"), `${JSON.stringify(RUNTIME_CACHE_PACKAGE_JSON, null, 2)}
+        await writeFile(path10.join(fallbackCacheDir, "package.json"), `${JSON.stringify(RUNTIME_CACHE_PACKAGE_JSON, null, 2)}
 `, "utf8");
         const fallbackResult = runNpmRuntimeInstall(spawnSyncImpl, fallbackCacheDir, fallbackSpec, deadline);
         let fallbackOutput = collectSpawnOutput(fallbackResult);
@@ -22684,10 +22802,10 @@ async function ensureRuntimeInstalledUnlocked(options, deadline) {
   );
 }
 function resolveRuntimePostgresPayloadBinDir(cacheDir, platform = process.platform, arch = process.arch) {
-  return path9.join(cacheDir, RUNTIME_POSTGRES_PAYLOAD_DIR, runtimePostgresPlatformSegment(platform, arch), "bin");
+  return path10.join(cacheDir, RUNTIME_POSTGRES_PAYLOAD_DIR, runtimePostgresPlatformSegment(platform, arch), "bin");
 }
 function resolveSharedRuntimePostgresPayloadBinDir(homeDir = resolveRudderHomeDir(), platform = process.platform, arch = process.arch) {
-  return path9.join(
+  return path10.join(
     homeDir,
     "runtime-payloads",
     RUNTIME_POSTGRES_PAYLOAD_DIR,
@@ -22696,7 +22814,7 @@ function resolveSharedRuntimePostgresPayloadBinDir(homeDir = resolveRudderHomeDi
   );
 }
 function resolveRuntimeServerEntrypoint(cacheDir, packageName = RUNTIME_NPM_PACKAGE_NAME) {
-  return createRequire(path9.join(cacheDir, "package.json")).resolve(packageName);
+  return createRequire(path10.join(cacheDir, "package.json")).resolve(packageName);
 }
 async function importRuntimeServerModule(cacheDir, packageName = RUNTIME_NPM_PACKAGE_NAME) {
   const entrypoint = resolveRuntimeServerEntrypoint(cacheDir, packageName);
@@ -22720,7 +22838,7 @@ function formatRuntimeInstallCommand(cacheDir, packageSpec) {
   return `npm install --prefix ${cacheDir} ${RUNTIME_NPM_INSTALL_FLAGS.join(" ")} ${packageSpec}`;
 }
 function formatRuntimePlatformRepairCommand(cacheDir, packageSpec) {
-  return `npm pack ${packageSpec} --registry=${NPM_PUBLIC_REGISTRY_URL} --silent, then extract it into ${path9.join(cacheDir, "node_modules")}`;
+  return `npm pack ${packageSpec} --registry=${NPM_PUBLIC_REGISTRY_URL} --silent, then extract it into ${path10.join(cacheDir, "node_modules")}`;
 }
 function collectSpawnOutput(result) {
   return [result.stdout, result.stderr, result.error instanceof Error ? result.error.message : null].filter((value) => typeof value === "string" && value.trim().length > 0).join("\n").trim();
@@ -22737,7 +22855,7 @@ function withPostgresPayload(result, postgresPayload) {
   };
 }
 function runtimePackageJsonPath(cacheDir, packageName) {
-  return path9.join(cacheDir, "node_modules", ...packageName.split("/"), "package.json");
+  return path10.join(cacheDir, "node_modules", ...packageName.split("/"), "package.json");
 }
 async function readRuntimePackageJson(cacheDir, packageName) {
   try {
@@ -22792,7 +22910,7 @@ async function ensureRequiredEmbeddedPostgresPlatformPackage(spawnSyncImpl, cach
   );
 }
 async function installRuntimePackageInStaging(spawnSyncImpl, cacheDir, packageSpec, packageName, deadline) {
-  const stagingDir = path9.join(cacheDir, `.platform-repair-${process.pid}-${Date.now()}`);
+  const stagingDir = path10.join(cacheDir, `.platform-repair-${process.pid}-${Date.now()}`);
   await mkdir(stagingDir, { recursive: true });
   try {
     const packResult = runNpmPack(spawnSyncImpl, packageSpec, stagingDir, cacheDir, deadline);
@@ -22801,9 +22919,9 @@ async function installRuntimePackageInStaging(spawnSyncImpl, cacheDir, packageSp
     if (!packFilename) {
       return createSyntheticSpawnResult(1, "", `Unable to parse npm pack output for ${packageSpec}.`);
     }
-    const archivePath = path9.join(stagingDir, packFilename);
-    const targetDir = path9.dirname(runtimePackageJsonPath(cacheDir, packageName));
-    await mkdir(path9.dirname(targetDir), { recursive: true });
+    const archivePath = path10.join(stagingDir, packFilename);
+    const targetDir = path10.dirname(runtimePackageJsonPath(cacheDir, packageName));
+    await mkdir(path10.dirname(targetDir), { recursive: true });
     await rm(targetDir, { recursive: true, force: true });
     await mkdir(targetDir, { recursive: true });
     const extractResult = runTarExtract(spawnSyncImpl, archivePath, targetDir, cacheDir, deadline);
@@ -22859,8 +22977,8 @@ function combineSpawnResults(...results) {
 }
 async function removeRuntimeInstallLocks(cacheDir) {
   await Promise.all([
-    rm(path9.join(cacheDir, "package-lock.json"), { force: true }),
-    rm(path9.join(cacheDir, "node_modules", ".package-lock.json"), { force: true })
+    rm(path10.join(cacheDir, "package-lock.json"), { force: true }),
+    rm(path10.join(cacheDir, "node_modules", ".package-lock.json"), { force: true })
   ]);
 }
 function packageNameFromSpec(packageSpec) {
@@ -22884,25 +23002,25 @@ function runtimePostgresExecutableName(baseName) {
   return process.platform === "win32" ? `${baseName}.exe` : baseName;
 }
 function debianSharedirCandidate(binDir) {
-  const normalized = path9.resolve(binDir);
-  const parts = normalized.split(path9.sep);
+  const normalized = path10.resolve(binDir);
+  const parts = normalized.split(path10.sep);
   const libIndex = parts.lastIndexOf("lib");
   if (libIndex < 0) return null;
   if (parts[libIndex + 1] !== "postgresql") return null;
   const version = parts[libIndex + 2];
   if (!version || parts[libIndex + 3] !== "bin") return null;
-  const prefix = parts.slice(0, libIndex).join(path9.sep) || path9.sep;
-  return path9.join(prefix, "share", "postgresql", version);
+  const prefix = parts.slice(0, libIndex).join(path10.sep) || path10.sep;
+  return path10.join(prefix, "share", "postgresql", version);
 }
 async function resolveRuntimePostgresTemplateDir(binDir, cacheDir = binDir, deadline) {
   for (const candidatePath of [
-    path9.join(binDir, "..", "share", "postgresql", "postgres.bki"),
-    path9.join(binDir, "..", "share", "postgres.bki")
+    path10.join(binDir, "..", "share", "postgresql", "postgres.bki"),
+    path10.join(binDir, "..", "share", "postgres.bki")
   ]) {
     remainingRuntimeInstallMs(deadline, cacheDir, "discover PostgreSQL runtime templates");
     try {
       await stat(candidatePath);
-      return path9.dirname(candidatePath);
+      return path10.dirname(candidatePath);
     } catch {
     }
   }
@@ -22910,12 +23028,12 @@ async function resolveRuntimePostgresTemplateDir(binDir, cacheDir = binDir, dead
   if (debianSharedir) {
     remainingRuntimeInstallMs(deadline, cacheDir, "discover PostgreSQL runtime templates");
     try {
-      await stat(path9.join(debianSharedir, "postgres.bki"));
+      await stat(path10.join(debianSharedir, "postgres.bki"));
       return debianSharedir;
     } catch {
     }
   }
-  const pgConfigPath = path9.join(binDir, process.platform === "win32" ? "pg_config.exe" : "pg_config");
+  const pgConfigPath = path10.join(binDir, process.platform === "win32" ? "pg_config.exe" : "pg_config");
   try {
     remainingRuntimeInstallMs(deadline, cacheDir, "discover PostgreSQL runtime templates");
     await stat(pgConfigPath);
@@ -22934,7 +23052,7 @@ async function resolveRuntimePostgresTemplateDir(binDir, cacheDir = binDir, dead
     }
     if (!sharedir) return null;
     remainingRuntimeInstallMs(deadline, cacheDir, "validate PostgreSQL runtime templates");
-    const candidatePath = path9.join(sharedir, "postgres.bki");
+    const candidatePath = path10.join(sharedir, "postgres.bki");
     await stat(candidatePath);
     return sharedir;
   } catch (error) {
@@ -22943,7 +23061,7 @@ async function resolveRuntimePostgresTemplateDir(binDir, cacheDir = binDir, dead
   }
 }
 function resolveRuntimePostgresShareDir(binDir, templateDir) {
-  const adjacentShareDir = path9.resolve(binDir, "..", "share");
+  const adjacentShareDir = path10.resolve(binDir, "..", "share");
   return pathIsInside(templateDir, adjacentShareDir) ? adjacentShareDir : templateDir;
 }
 async function assertRuntimePostgresBinDirComplete(cacheDir, binDir, deadline) {
@@ -22951,7 +23069,7 @@ async function assertRuntimePostgresBinDirComplete(cacheDir, binDir, deadline) {
   const missing = [];
   for (const binary of requiredBinaries) {
     remainingRuntimeInstallMs(deadline, cacheDir, "validate PostgreSQL runtime binaries");
-    const binaryPath = path9.join(binDir, runtimePostgresExecutableName(binary));
+    const binaryPath = path10.join(binDir, runtimePostgresExecutableName(binary));
     try {
       await stat(binaryPath);
     } catch {
@@ -22960,19 +23078,19 @@ async function assertRuntimePostgresBinDirComplete(cacheDir, binDir, deadline) {
   }
   const templateDir = await resolveRuntimePostgresTemplateDir(binDir, cacheDir, deadline);
   if (!templateDir) {
-    missing.push(path9.join(binDir, "..", "share", "postgresql", "postgres.bki"));
+    missing.push(path10.join(binDir, "..", "share", "postgresql", "postgres.bki"));
   } else {
     try {
-      await stat(path9.join(templateDir, "postgresql.conf.sample"));
+      await stat(path10.join(templateDir, "postgresql.conf.sample"));
     } catch {
-      missing.push(path9.join(templateDir, "postgresql.conf.sample"));
+      missing.push(path10.join(templateDir, "postgresql.conf.sample"));
     }
     const shareDir = resolveRuntimePostgresShareDir(binDir, templateDir);
     const hasTimezoneDir = (await Promise.all([
-      path9.join(templateDir, "timezone"),
-      path9.join(shareDir, "timezone")
+      path10.join(templateDir, "timezone"),
+      path10.join(shareDir, "timezone")
     ].map((candidate) => stat(candidate).catch(() => null)))).some((candidate) => candidate?.isDirectory());
-    if (!hasTimezoneDir) missing.push(path9.join(shareDir, "timezone"));
+    if (!hasTimezoneDir) missing.push(path10.join(shareDir, "timezone"));
   }
   if (missing.length > 0) {
     throw new RuntimeInstallError(
@@ -22997,8 +23115,8 @@ async function isRuntimePostgresPayloadUsable(cacheDir, binDir, postgresVersionP
   }
 }
 function pathIsInside(candidatePath, rootPath) {
-  const relative = path9.relative(path9.resolve(rootPath), path9.resolve(candidatePath));
-  return relative === "" || relative !== ".." && !relative.startsWith(`..${path9.sep}`) && !path9.isAbsolute(relative);
+  const relative = path10.relative(path10.resolve(rootPath), path10.resolve(candidatePath));
+  return relative === "" || relative !== ".." && !relative.startsWith(`..${path10.sep}`) && !path10.isAbsolute(relative);
 }
 async function copyRuntimePayloadEntry(sourcePath, targetPath, cacheDir, deadline, signal, command) {
   if (signal.aborted) throw runtimeInstallDeadlineError(cacheDir, command);
@@ -23011,8 +23129,8 @@ async function copyRuntimePayloadEntry(sourcePath, targetPath, cacheDir, deadlin
     const entries = await readdir(sourcePath);
     for (const entry of entries) {
       await copyRuntimePayloadEntry(
-        path9.join(sourcePath, entry),
-        path9.join(targetPath, entry),
+        path10.join(sourcePath, entry),
+        path10.join(targetPath, entry),
         cacheDir,
         deadline,
         signal,
@@ -23022,7 +23140,7 @@ async function copyRuntimePayloadEntry(sourcePath, targetPath, cacheDir, deadlin
     return;
   }
   if (!sourceStats.isFile()) return;
-  await mkdir(path9.dirname(targetPath), { recursive: true });
+  await mkdir(path10.dirname(targetPath), { recursive: true });
   try {
     await pipeline2(
       createReadStream2(sourcePath),
@@ -23056,11 +23174,11 @@ async function copyRuntimePostgresPayloadWithinDeadline(sourceRuntimeDir, target
   const copyPromise = (async () => {
     await mkdir(targetRuntimeDir, { recursive: true });
     for (const directoryName of ["bin", "lib"]) {
-      const sourceDirectory = path9.join(sourceRuntimeDir, directoryName);
+      const sourceDirectory = path10.join(sourceRuntimeDir, directoryName);
       if (!await stat(sourceDirectory).catch(() => null)) continue;
       await copyRuntimePayloadEntry(
         sourceDirectory,
-        path9.join(targetRuntimeDir, directoryName),
+        path10.join(targetRuntimeDir, directoryName),
         cacheDir,
         deadline,
         controller.signal,
@@ -23069,7 +23187,7 @@ async function copyRuntimePostgresPayloadWithinDeadline(sourceRuntimeDir, target
     }
     await copyRuntimePayloadEntry(
       sourceShareDir,
-      path9.join(targetRuntimeDir, "share"),
+      path10.join(targetRuntimeDir, "share"),
       cacheDir,
       deadline,
       controller.signal,
@@ -23087,15 +23205,15 @@ async function copyRuntimePostgresPayloadWithinDeadline(sourceRuntimeDir, target
 async function withRuntimeFilesystemLock(lockPath, task, options = {}) {
   const deadlineTimeout = remainingRuntimeInstallMs(
     options.deadline,
-    options.cacheDir ?? path9.dirname(lockPath),
+    options.cacheDir ?? path10.dirname(lockPath),
     options.command ?? `wait for runtime lock ${lockPath}`
   );
   const timeoutMs = Math.min(options.timeoutMs ?? 3e4, deadlineTimeout ?? Number.POSITIVE_INFINITY);
   const pollMs = options.pollMs ?? 50;
   const startedAt = Date.now();
   const lockId = `${process.pid}-${startedAt}-${Math.random().toString(16).slice(2)}`;
-  const ownerPath = path9.join(lockPath, "owner.json");
-  await mkdir(path9.dirname(lockPath), { recursive: true });
+  const ownerPath = path10.join(lockPath, "owner.json");
+  await mkdir(path10.dirname(lockPath), { recursive: true });
   while (true) {
     try {
       await mkdir(lockPath);
@@ -23124,12 +23242,12 @@ async function withRuntimeFilesystemLock(lockPath, task, options = {}) {
       if (Date.now() - startedAt >= timeoutMs) {
         throw new RuntimeInstallError(
           `Timed out waiting for PostgreSQL runtime install lock ${lockPath}`,
-          { cacheDir: path9.dirname(lockPath), command: "prepare shared PostgreSQL runtime", output: "" }
+          { cacheDir: path10.dirname(lockPath), command: "prepare shared PostgreSQL runtime", output: "" }
         );
       }
       remainingRuntimeInstallMs(
         options.deadline,
-        options.cacheDir ?? path9.dirname(lockPath),
+        options.cacheDir ?? path10.dirname(lockPath),
         options.command ?? `wait for runtime lock ${lockPath}`
       );
       await new Promise((resolve) => setTimeout(resolve, pollMs));
@@ -23149,29 +23267,29 @@ async function withRuntimeFilesystemLock(lockPath, task, options = {}) {
 }
 function isManagedRuntimePostgresBinDir(binDir, homeDir) {
   const managedBinDir = process.env[RUDDER_DESKTOP_MANAGED_POSTGRES_BIN_DIR_ENV]?.trim();
-  if (managedBinDir && path9.resolve(managedBinDir) === path9.resolve(binDir)) return true;
-  const runtimesRelative = path9.relative(
-    path9.join(homeDir, "runtimes"),
-    path9.resolve(binDir)
+  if (managedBinDir && path10.resolve(managedBinDir) === path10.resolve(binDir)) return true;
+  const runtimesRelative = path10.relative(
+    path10.join(homeDir, "runtimes"),
+    path10.resolve(binDir)
   );
-  const runtimeSegments = runtimesRelative.split(path9.sep);
-  if (runtimesRelative !== "" && runtimesRelative !== ".." && !runtimesRelative.startsWith(`..${path9.sep}`) && !path9.isAbsolute(runtimesRelative) && runtimeSegments.length === 4 && runtimeSegments[0]?.length > 0 && runtimeSegments[1] === RUNTIME_POSTGRES_PAYLOAD_DIR && runtimeSegments[2] === `${process.platform}-${process.arch}` && runtimeSegments[3] === "bin") {
+  const runtimeSegments = runtimesRelative.split(path10.sep);
+  if (runtimesRelative !== "" && runtimesRelative !== ".." && !runtimesRelative.startsWith(`..${path10.sep}`) && !path10.isAbsolute(runtimesRelative) && runtimeSegments.length === 4 && runtimeSegments[0]?.length > 0 && runtimeSegments[1] === RUNTIME_POSTGRES_PAYLOAD_DIR && runtimeSegments[2] === `${process.platform}-${process.arch}` && runtimeSegments[3] === "bin") {
     return true;
   }
-  const payloadsRelative = path9.relative(
-    path9.join(homeDir, "runtime-payloads"),
-    path9.resolve(binDir)
+  const payloadsRelative = path10.relative(
+    path10.join(homeDir, "runtime-payloads"),
+    path10.resolve(binDir)
   );
-  const payloadSegments = payloadsRelative.split(path9.sep);
-  return payloadsRelative !== "" && payloadsRelative !== ".." && !payloadsRelative.startsWith(`..${path9.sep}`) && !path9.isAbsolute(payloadsRelative) && payloadSegments.length === 3 && payloadSegments[0] === RUNTIME_POSTGRES_PAYLOAD_DIR && payloadSegments[1] === `${process.platform}-${process.arch}` && payloadSegments[2] === "bin";
+  const payloadSegments = payloadsRelative.split(path10.sep);
+  return payloadsRelative !== "" && payloadsRelative !== ".." && !payloadsRelative.startsWith(`..${path10.sep}`) && !path10.isAbsolute(payloadsRelative) && payloadSegments.length === 3 && payloadSegments[0] === RUNTIME_POSTGRES_PAYLOAD_DIR && payloadSegments[1] === `${process.platform}-${process.arch}` && payloadSegments[2] === "bin";
 }
 async function findLegacyRuntimePostgresBinDir(cacheDir, homeDir, postgresVersionProbe, deadline) {
-  const runtimesRoot = path9.join(homeDir, "runtimes");
+  const runtimesRoot = path10.join(homeDir, "runtimes");
   const entries = await readdir(runtimesRoot, { withFileTypes: true }).catch(() => []);
   for (const entry of entries) {
     if (!entry.isDirectory() && !entry.isSymbolicLink()) continue;
-    const candidateCacheDir = path9.join(runtimesRoot, entry.name);
-    if (path9.resolve(candidateCacheDir) === path9.resolve(cacheDir)) continue;
+    const candidateCacheDir = path10.join(runtimesRoot, entry.name);
+    if (path10.resolve(candidateCacheDir) === path10.resolve(cacheDir)) continue;
     const candidateBinDir = resolveRuntimePostgresPayloadBinDir(candidateCacheDir);
     remainingRuntimeInstallMs(deadline, cacheDir, "find cached PostgreSQL runtime payload");
     if (await isRuntimePostgresPayloadUsable(cacheDir, candidateBinDir, postgresVersionProbe, deadline)) {
@@ -23181,13 +23299,13 @@ async function findLegacyRuntimePostgresBinDir(cacheDir, homeDir, postgresVersio
   return null;
 }
 async function readLiveRuntimeDescriptors(homeDir) {
-  const instancesRoot = path9.join(homeDir, "instances");
+  const instancesRoot = path10.join(homeDir, "instances");
   const entries = await readdir(instancesRoot, { withFileTypes: true }).catch(() => []);
   const descriptors = [];
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
     try {
-      const raw = JSON.parse(await readFile(path9.join(instancesRoot, entry.name, "runtime", "server.json"), "utf8"));
+      const raw = JSON.parse(await readFile(path10.join(instancesRoot, entry.name, "runtime", "server.json"), "utf8"));
       if (typeof raw.pid !== "number" || !Number.isInteger(raw.pid) || !isPidRunning(raw.pid) || typeof raw.version !== "string") {
         continue;
       }
@@ -23205,13 +23323,13 @@ async function assertSharedPostgresPayloadNotLive(cacheDir, homeDir, sharedBinDi
   const sharedPhysicalBinDir = await realpath(sharedBinDir).catch(() => null);
   const mayReferenceSharedPayload = await Promise.all(liveDescriptors.map(async (descriptor) => {
     if (descriptor.postgresBinDir === void 0) return true;
-    if (path9.resolve(descriptor.postgresBinDir) === path9.resolve(sharedBinDir)) return true;
+    if (path10.resolve(descriptor.postgresBinDir) === path10.resolve(sharedBinDir)) return true;
     const descriptorPhysicalBinDir = await realpath(descriptor.postgresBinDir).catch(() => null);
-    if (descriptorPhysicalBinDir && sharedPhysicalBinDir && path9.resolve(descriptorPhysicalBinDir) === path9.resolve(sharedPhysicalBinDir)) {
+    if (descriptorPhysicalBinDir && sharedPhysicalBinDir && path10.resolve(descriptorPhysicalBinDir) === path10.resolve(sharedPhysicalBinDir)) {
       return true;
     }
     if (!descriptorPhysicalBinDir) {
-      return pathIsInside(descriptor.postgresBinDir, path9.join(homeDir, "runtimes")) || pathIsInside(descriptor.postgresBinDir, path9.join(homeDir, "runtime-payloads"));
+      return pathIsInside(descriptor.postgresBinDir, path10.join(homeDir, "runtimes")) || pathIsInside(descriptor.postgresBinDir, path10.join(homeDir, "runtime-payloads"));
     }
     return false;
   }));
@@ -23226,7 +23344,7 @@ async function validateRuntimePostgresVersion(cacheDir, binDir, postgresVersionP
   await assertRuntimePostgresBinDirComplete(cacheDir, binDir, deadline);
   for (const binary of ["initdb", "pg_ctl", "postgres"]) {
     remainingRuntimeInstallMs(deadline, cacheDir, "validate PostgreSQL runtime version");
-    const binaryPath = path9.join(binDir, runtimePostgresExecutableName(binary));
+    const binaryPath = path10.join(binDir, runtimePostgresExecutableName(binary));
     const result = postgresVersionProbe(binaryPath);
     if (!/\bPostgreSQL\)?\s+18\.4\b/i.test(result)) {
       throw new RuntimeInstallError(
@@ -23266,24 +23384,24 @@ async function findRuntimePostgresBinDir(rootDir, cacheDir, postgresVersionProbe
     if (await isRuntimePostgresPayloadUsable(cacheDir, current, postgresVersionProbe, deadline)) return current;
     const entries = await readdir(current, { withFileTypes: true }).catch(() => []);
     for (const entry of entries) {
-      if (entry.isDirectory()) queue.push(path9.join(current, entry.name));
+      if (entry.isDirectory()) queue.push(path10.join(current, entry.name));
     }
   }
   return null;
 }
 async function reconcileSharedPostgresPayloadGenerations(cacheDir, sharedPlatformRoot, postgresVersionProbe, cleanupDownloads = false, deadline) {
   remainingRuntimeInstallMs(deadline, cacheDir, "reconcile shared PostgreSQL payload");
-  const parentDir = path9.dirname(sharedPlatformRoot);
-  const baseName = path9.basename(sharedPlatformRoot);
+  const parentDir = path10.dirname(sharedPlatformRoot);
+  const baseName = path10.basename(sharedPlatformRoot);
   const entries = await readdir(parentDir, { withFileTypes: true }).catch(() => []);
-  const temporaryRoots = entries.filter((entry) => entry.name.startsWith(`${baseName}.tmp-`)).map((entry) => path9.join(parentDir, entry.name));
-  const previousRoots = entries.filter((entry) => entry.name.startsWith(`${baseName}.previous-`)).map((entry) => path9.join(parentDir, entry.name)).sort().reverse();
-  const downloadsRoot = path9.join(
-    path9.dirname(path9.dirname(sharedPlatformRoot)),
+  const temporaryRoots = entries.filter((entry) => entry.name.startsWith(`${baseName}.tmp-`)).map((entry) => path10.join(parentDir, entry.name));
+  const previousRoots = entries.filter((entry) => entry.name.startsWith(`${baseName}.previous-`)).map((entry) => path10.join(parentDir, entry.name)).sort().reverse();
+  const downloadsRoot = path10.join(
+    path10.dirname(path10.dirname(sharedPlatformRoot)),
     ".downloads"
   );
-  const staleDownloadRoots = cleanupDownloads ? (await readdir(downloadsRoot, { withFileTypes: true }).catch(() => [])).filter((entry) => entry.name.startsWith("postgres-18.4-")).map((entry) => path9.join(downloadsRoot, entry.name)) : [];
-  const canonicalBinDir = path9.join(sharedPlatformRoot, "bin");
+  const staleDownloadRoots = cleanupDownloads ? (await readdir(downloadsRoot, { withFileTypes: true }).catch(() => [])).filter((entry) => entry.name.startsWith("postgres-18.4-")).map((entry) => path10.join(downloadsRoot, entry.name)) : [];
+  const canonicalBinDir = path10.join(sharedPlatformRoot, "bin");
   if (!await isRuntimePostgresPayloadUsable(
     cacheDir,
     canonicalBinDir,
@@ -23293,7 +23411,7 @@ async function reconcileSharedPostgresPayloadGenerations(cacheDir, sharedPlatfor
     for (const previousRoot of previousRoots) {
       if (!await isRuntimePostgresPayloadUsable(
         cacheDir,
-        path9.join(previousRoot, "bin"),
+        path10.join(previousRoot, "bin"),
         postgresVersionProbe,
         deadline
       )) {
@@ -23312,9 +23430,9 @@ async function reconcileSharedPostgresPayloadGenerations(cacheDir, sharedPlatfor
 }
 async function installSharedRuntimePostgresPayload(cacheDir, homeDir, sourceBinDir, postgresVersionProbe, deadline) {
   const sharedBinDir = resolveSharedRuntimePostgresPayloadBinDir(homeDir);
-  const sharedRuntimeDir = path9.dirname(sharedBinDir);
+  const sharedRuntimeDir = path10.dirname(sharedBinDir);
   const sharedPlatformRoot = sharedRuntimeDir;
-  const sourceRuntimeDir = path9.dirname(sourceBinDir);
+  const sourceRuntimeDir = path10.dirname(sourceBinDir);
   const sourceTemplateDir = await resolveRuntimePostgresTemplateDir(sourceBinDir, cacheDir, deadline);
   if (!sourceTemplateDir) {
     throw new RuntimeInstallError(
@@ -23335,7 +23453,7 @@ async function installSharedRuntimePostgresPayload(cacheDir, homeDir, sourceBinD
       return sharedBinDir;
     }
     await assertSharedPostgresPayloadNotLive(cacheDir, homeDir, sharedBinDir);
-    await mkdir(path9.dirname(sharedPlatformRoot), { recursive: true });
+    await mkdir(path10.dirname(sharedPlatformRoot), { recursive: true });
     const temporaryPlatformRoot = `${sharedPlatformRoot}.tmp-${process.pid}-${Date.now()}`;
     const previousPlatformRoot = `${sharedPlatformRoot}.previous-${process.pid}-${Date.now()}`;
     let previousMoved = false;
@@ -23352,7 +23470,7 @@ async function installSharedRuntimePostgresPayload(cacheDir, homeDir, sourceBinD
         cacheDir,
         deadline
       );
-      const temporaryBinDir = path9.join(temporaryRuntimeDir, "bin");
+      const temporaryBinDir = path10.join(temporaryRuntimeDir, "bin");
       await validateRuntimePostgresVersion(cacheDir, temporaryBinDir, postgresVersionProbe, deadline);
       try {
         await rename(sharedPlatformRoot, previousPlatformRoot);
@@ -23388,17 +23506,17 @@ async function downloadSharedRuntimePostgresPayload(cacheDir, homeDir, postgresV
   const archiveUrl = archiveSource?.url ?? null;
   if (!archiveUrl) return null;
   const sharedBinDir = resolveSharedRuntimePostgresPayloadBinDir(homeDir);
-  const sharedPlatformRoot = path9.dirname(sharedBinDir);
+  const sharedPlatformRoot = path10.dirname(sharedBinDir);
   const downloadLockPath = `${sharedPlatformRoot}.download.lock`;
   return withRuntimeFilesystemLock(downloadLockPath, async () => {
     if (await isRuntimePostgresPayloadUsable(cacheDir, sharedBinDir, postgresVersionProbe, deadline)) {
       return sharedBinDir;
     }
-    const workRoot = path9.join(homeDir, "runtime-payloads", ".downloads");
+    const workRoot = path10.join(homeDir, "runtime-payloads", ".downloads");
     await mkdir(workRoot, { recursive: true });
-    const workDir = await mkdtemp(path9.join(workRoot, "postgres-18.4-"));
-    const archivePath = path9.join(workDir, "postgresql-18.4.zip");
-    const extractDir = path9.join(workDir, "extract");
+    const workDir = await mkdtemp(path10.join(workRoot, "postgres-18.4-"));
+    const archivePath = path10.join(workDir, "postgresql-18.4.zip");
+    const extractDir = path10.join(workDir, "extract");
     try {
       await downloadRuntimePostgresArchive(
         archiveUrl,
@@ -23409,7 +23527,7 @@ async function downloadSharedRuntimePostgresPayload(cacheDir, homeDir, postgresV
       const configuredMaxBytes = Number.parseInt(process.env[RUDDER_POSTGRES_RUNTIME_ARCHIVE_MAX_BYTES_ENV2] ?? "", 10);
       const maxArchiveBytes = Number.isSafeInteger(configuredMaxBytes) && configuredMaxBytes > 0 ? configuredMaxBytes : DEFAULT_RUNTIME_POSTGRES_ARCHIVE_MAX_BYTES2;
       const nativePublishStaging = `${sharedPlatformRoot}.tmp-native-${process.pid}-${Date.now()}`;
-      await mkdir(path9.dirname(sharedPlatformRoot), { recursive: true });
+      await mkdir(path10.dirname(sharedPlatformRoot), { recursive: true });
       const nativeInstall = await tryInstallNativePayload({
         archivePath,
         extractPath: extractDir,
@@ -23441,22 +23559,22 @@ async function downloadSharedRuntimePostgresPayload(cacheDir, homeDir, postgresV
             );
           }
           await copyRuntimePostgresPayloadWithinDeadline(
-            path9.dirname(extractedBinDir2),
+            path10.dirname(extractedBinDir2),
             publishStagingPath,
             resolveRuntimePostgresShareDir(extractedBinDir2, templateDir),
             cacheDir,
             deadline,
             context.signal
           );
-          return path9.relative(
+          return path10.relative(
             publishStagingPath,
-            path9.join(publishStagingPath, "bin", runtimePostgresExecutableName("postgres"))
+            path10.join(publishStagingPath, "bin", runtimePostgresExecutableName("postgres"))
           );
         },
         validatePublished: async (destinationPath) => {
           await validateRuntimePostgresVersion(
             cacheDir,
-            path9.join(destinationPath, "bin"),
+            path10.join(destinationPath, "bin"),
             postgresVersionProbe,
             deadline
           );
@@ -23494,20 +23612,20 @@ async function downloadSharedRuntimePostgresPayload(cacheDir, homeDir, postgresV
   }, { deadline, cacheDir, command: "acquire shared PostgreSQL download lock" });
 }
 async function ensureRuntimePostgresCompatibilityLink(cacheDir, homeDir, packageVersion) {
-  const compatibilityRoot = path9.join(cacheDir, RUNTIME_POSTGRES_PAYLOAD_DIR);
-  const sharedPayloadRoot = path9.join(homeDir, "runtime-payloads", RUNTIME_POSTGRES_PAYLOAD_DIR);
+  const compatibilityRoot = path10.join(cacheDir, RUNTIME_POSTGRES_PAYLOAD_DIR);
+  const sharedPayloadRoot = path10.join(homeDir, "runtime-payloads", RUNTIME_POSTGRES_PAYLOAD_DIR);
   const runtimeMetadata = await readRuntimeInstallMetadata(cacheDir);
   const liveDescriptors = await readLiveRuntimeDescriptors(homeDir);
   const compatibilityBinDir = resolveRuntimePostgresPayloadBinDir(cacheDir);
   const isProtected = liveDescriptors.some((descriptor) => descriptor.postgresBinDir && pathIsInside(descriptor.postgresBinDir, compatibilityRoot) || !descriptor.postgresBinDir && descriptor.version === (runtimeMetadata?.packageVersion ?? packageVersion));
   if (isProtected) return;
-  await mkdir(path9.dirname(compatibilityRoot), { recursive: true });
+  await mkdir(path10.dirname(compatibilityRoot), { recursive: true });
   const temporaryRoot = `${compatibilityRoot}.next-${process.pid}-${Date.now()}`;
   const previousRoot = `${compatibilityRoot}.previous-${process.pid}-${Date.now()}`;
   await rm(temporaryRoot, { recursive: true, force: true });
   await rm(previousRoot, { recursive: true, force: true });
   await symlink(
-    process.platform === "win32" ? sharedPayloadRoot : path9.relative(path9.dirname(compatibilityRoot), sharedPayloadRoot),
+    process.platform === "win32" ? sharedPayloadRoot : path10.relative(path10.dirname(compatibilityRoot), sharedPayloadRoot),
     temporaryRoot,
     process.platform === "win32" ? "junction" : "dir"
   );
@@ -23540,7 +23658,7 @@ async function ensureRuntimePostgresCompatibilityLink(cacheDir, homeDir, package
 async function stageRuntimePostgresPayload(cacheDir, homeDir, packageVersion, enabled, postgresVersionProbe, deadline, cleanupDownloadWorkDir) {
   if (!enabled) return { output: "" };
   const explicitSourceBinDir = process.env[RUDDER_POSTGRES_BIN_DIR_ENV]?.trim();
-  const resolvedExplicitSourceBinDir = explicitSourceBinDir ? path9.resolve(explicitSourceBinDir) : null;
+  const resolvedExplicitSourceBinDir = explicitSourceBinDir ? path10.resolve(explicitSourceBinDir) : null;
   if (resolvedExplicitSourceBinDir && !isManagedRuntimePostgresBinDir(resolvedExplicitSourceBinDir, homeDir)) {
     await validateRuntimePostgresVersion(
       cacheDir,
@@ -23561,7 +23679,7 @@ async function stageRuntimePostgresPayload(cacheDir, homeDir, packageVersion, en
     };
   }
   const sharedBinDir = resolveSharedRuntimePostgresPayloadBinDir(homeDir);
-  const sharedPlatformRoot = path9.dirname(sharedBinDir);
+  const sharedPlatformRoot = path10.dirname(sharedBinDir);
   await withRuntimeFilesystemLock(
     `${sharedPlatformRoot}.install.lock`,
     async () => reconcileSharedPostgresPayloadGenerations(
@@ -23673,13 +23791,13 @@ async function pruneRuntimeCache(options = {}) {
   };
 }
 async function scanRuntimeCacheEntries(homeDir) {
-  const runtimesDir = path9.join(homeDir, "runtimes");
+  const runtimesDir = path10.join(homeDir, "runtimes");
   const dirents = await readdir(runtimesDir, { withFileTypes: true }).catch(() => null);
   if (!dirents) return [];
   const entries = [];
   for (const dirent of dirents) {
     if (!dirent.isDirectory()) continue;
-    const cacheDir = path9.join(runtimesDir, dirent.name);
+    const cacheDir = path10.join(runtimesDir, dirent.name);
     const metadata = await readRuntimeInstallMetadata(cacheDir);
     if (!metadata) continue;
     const fallbackStat = await safeStat(cacheDir);
@@ -23712,7 +23830,7 @@ async function directorySizeBytes(targetPath) {
   if (!dirents) return 0;
   let total = 0;
   for (const dirent of dirents) {
-    const entryPath = path9.join(targetPath, dirent.name);
+    const entryPath = path10.join(targetPath, dirent.name);
     if (dirent.isSymbolicLink()) continue;
     if (dirent.isDirectory()) {
       total += await directorySizeBytes(entryPath);
@@ -23724,14 +23842,14 @@ async function directorySizeBytes(targetPath) {
   return total;
 }
 async function readActiveRuntimeVersions(homeDir) {
-  const instancesDir = path9.join(homeDir, "instances");
+  const instancesDir = path10.join(homeDir, "instances");
   const dirents = await readdir(instancesDir, { withFileTypes: true }).catch(() => null);
   if (!dirents) return [];
   const versions = /* @__PURE__ */ new Set();
   for (const dirent of dirents) {
     if (!dirent.isDirectory()) continue;
     try {
-      const descriptorPath = path9.join(instancesDir, dirent.name, "runtime", "server.json");
+      const descriptorPath = path10.join(instancesDir, dirent.name, "runtime", "server.json");
       const parsed = JSON.parse(await readFile(descriptorPath, "utf8"));
       if (typeof parsed.version !== "string") continue;
       if (typeof parsed.pid === "number" && Number.isInteger(parsed.pid) && parsed.pid > 0 && isPidRunning(parsed.pid)) {
@@ -23891,8 +24009,8 @@ var init_install = __esm({
 });
 
 // src/runtime/server-entry.ts
-import fs7 from "node:fs";
-import path10 from "node:path";
+import fs8 from "node:fs";
+import path11 from "node:path";
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL2 } from "node:url";
 function formatError(err) {
   if (err instanceof Error) {
@@ -23914,12 +24032,12 @@ function maybeEnableUiDevMiddleware(entrypoint) {
   }
 }
 function resolveDevServerEntry() {
-  const projectRoot = path10.resolve(path10.dirname(fileURLToPath5(import.meta.url)), "../../..");
-  return path10.resolve(projectRoot, "server/src/index.ts");
+  const projectRoot = path11.resolve(path11.dirname(fileURLToPath5(import.meta.url)), "../../..");
+  return path11.resolve(projectRoot, "server/src/index.ts");
 }
 async function loadServerRuntimeModule(options) {
   const devEntry = resolveDevServerEntry();
-  if (fs7.existsSync(devEntry)) {
+  if (fs8.existsSync(devEntry)) {
     maybeEnableUiDevMiddleware(devEntry);
     return await import(pathToFileURL2(devEntry).href);
   }
@@ -23930,7 +24048,7 @@ async function loadServerRuntimeModule(options) {
   };
   const runtime = await ensureRuntimeInstalled(installOptions);
   if (!process.env[RUDDER_POSTGRES_BIN_DIR_ENV2]?.trim()) {
-    if (runtime.postgresPayloadBinDir && fs7.existsSync(runtime.postgresPayloadBinDir)) {
+    if (runtime.postgresPayloadBinDir && fs8.existsSync(runtime.postgresPayloadBinDir)) {
       process.env[RUDDER_POSTGRES_BIN_DIR_ENV2] = runtime.postgresPayloadBinDir;
     }
   }
@@ -24054,24 +24172,24 @@ var init_auth_bootstrap_ceo = __esm({
 });
 
 // src/utils/path-resolver.ts
-import fs10 from "node:fs";
-import path18 from "node:path";
+import fs11 from "node:fs";
+import path19 from "node:path";
 function unique(items) {
   return Array.from(new Set(items));
 }
 function resolveRuntimeLikePath(value, configPath) {
   const expanded = expandHomePrefix(value);
-  if (path18.isAbsolute(expanded)) return path18.resolve(expanded);
+  if (path19.isAbsolute(expanded)) return path19.resolve(expanded);
   const cwd = process.cwd();
-  const configDir = configPath ? path18.dirname(configPath) : null;
-  const workspaceRoot = configDir ? path18.resolve(configDir, "..") : cwd;
+  const configDir = configPath ? path19.dirname(configPath) : null;
+  const workspaceRoot = configDir ? path19.resolve(configDir, "..") : cwd;
   const candidates = unique([
-    ...configDir ? [path18.resolve(configDir, expanded)] : [],
-    path18.resolve(workspaceRoot, "server", expanded),
-    path18.resolve(workspaceRoot, expanded),
-    path18.resolve(cwd, expanded)
+    ...configDir ? [path19.resolve(configDir, expanded)] : [],
+    path19.resolve(workspaceRoot, "server", expanded),
+    path19.resolve(workspaceRoot, expanded),
+    path19.resolve(cwd, expanded)
   ]);
-  return candidates.find((candidate) => fs10.existsSync(candidate)) ?? candidates[0];
+  return candidates.find((candidate) => fs11.existsSync(candidate)) ?? candidates[0];
 }
 var init_path_resolver = __esm({
   "src/utils/path-resolver.ts"() {
@@ -24082,8 +24200,8 @@ var init_path_resolver = __esm({
 
 // src/config/secrets-key.ts
 import { randomBytes as randomBytes2 } from "node:crypto";
-import fs11 from "node:fs";
-import path19 from "node:path";
+import fs12 from "node:fs";
+import path20 from "node:path";
 function ensureLocalSecretsKeyFile(config, configPath) {
   if (config.secrets.provider !== "local_encrypted") {
     return { status: "skipped_provider", path: null };
@@ -24095,16 +24213,16 @@ function ensureLocalSecretsKeyFile(config, configPath) {
   const keyFileOverride = process.env.RUDDER_SECRETS_MASTER_KEY_FILE;
   const configuredPath = keyFileOverride && keyFileOverride.trim().length > 0 ? keyFileOverride.trim() : config.secrets.localEncrypted.keyFilePath;
   const keyFilePath = resolveRuntimeLikePath(configuredPath, configPath);
-  if (fs11.existsSync(keyFilePath)) {
+  if (fs12.existsSync(keyFilePath)) {
     return { status: "existing", path: keyFilePath };
   }
-  fs11.mkdirSync(path19.dirname(keyFilePath), { recursive: true });
-  fs11.writeFileSync(keyFilePath, randomBytes2(32).toString("base64"), {
+  fs12.mkdirSync(path20.dirname(keyFilePath), { recursive: true });
+  fs12.writeFileSync(keyFilePath, randomBytes2(32).toString("base64"), {
     encoding: "utf8",
     mode: 384
   });
   try {
-    fs11.chmodSync(keyFilePath, 384);
+    fs12.chmodSync(keyFilePath, 384);
   } catch {
   }
   return { status: "created", path: keyFilePath };
@@ -24871,7 +24989,7 @@ var init_path_resolver2 = __esm({
 });
 
 // src/checks/database-check.ts
-import fs12 from "node:fs";
+import fs13 from "node:fs";
 async function databaseCheck(config, configPath) {
   if (config.database.mode === "postgres") {
     if (!config.database.connectionString) {
@@ -24903,8 +25021,8 @@ async function databaseCheck(config, configPath) {
   if (config.database.mode === "embedded-postgres") {
     const dataDir = resolveRuntimeLikePath(config.database.embeddedPostgresDataDir, configPath);
     const reportedPath = dataDir;
-    if (!fs12.existsSync(dataDir)) {
-      fs12.mkdirSync(reportedPath, { recursive: true });
+    if (!fs13.existsSync(dataDir)) {
+      fs13.mkdirSync(reportedPath, { recursive: true });
     }
     return {
       name: "Database",
@@ -25100,15 +25218,15 @@ var init_llm_check = __esm({
 });
 
 // src/checks/log-check.ts
-import fs13 from "node:fs";
+import fs14 from "node:fs";
 function logCheck(config, configPath) {
   const logDir = resolveRuntimeLikePath(config.logging.logDir, configPath);
   const reportedDir = logDir;
-  if (!fs13.existsSync(logDir)) {
-    fs13.mkdirSync(reportedDir, { recursive: true });
+  if (!fs14.existsSync(logDir)) {
+    fs14.mkdirSync(reportedDir, { recursive: true });
   }
   try {
-    fs13.accessSync(reportedDir, fs13.constants.W_OK);
+    fs14.accessSync(reportedDir, fs14.constants.W_OK);
     return {
       name: "Log directory",
       status: "pass",
@@ -25183,8 +25301,8 @@ var init_port_check = __esm({
 
 // src/checks/secrets-check.ts
 import { randomBytes as randomBytes3 } from "node:crypto";
-import fs14 from "node:fs";
-import path20 from "node:path";
+import fs15 from "node:fs";
+import path21 from "node:path";
 function decodeMasterKey(raw) {
   const trimmed = raw.trim();
   if (!trimmed) return null;
@@ -25246,7 +25364,7 @@ function secretsCheck(config, configPath) {
   const keyFileOverride = process.env.RUDDER_SECRETS_MASTER_KEY_FILE;
   const configuredPath = keyFileOverride && keyFileOverride.trim().length > 0 ? keyFileOverride.trim() : config.secrets.localEncrypted.keyFilePath;
   const keyFilePath = resolveRuntimeLikePath(configuredPath, configPath);
-  if (!fs14.existsSync(keyFilePath)) {
+  if (!fs15.existsSync(keyFilePath)) {
     return withStrictModeNote(
       {
         name: "Secrets adapter",
@@ -25254,13 +25372,13 @@ function secretsCheck(config, configPath) {
         message: `Secrets key file does not exist yet: ${keyFilePath}`,
         canRepair: true,
         repair: () => {
-          fs14.mkdirSync(path20.dirname(keyFilePath), { recursive: true });
-          fs14.writeFileSync(keyFilePath, randomBytes3(32).toString("base64"), {
+          fs15.mkdirSync(path21.dirname(keyFilePath), { recursive: true });
+          fs15.writeFileSync(keyFilePath, randomBytes3(32).toString("base64"), {
             encoding: "utf8",
             mode: 384
           });
           try {
-            fs14.chmodSync(keyFilePath, 384);
+            fs15.chmodSync(keyFilePath, 384);
           } catch {
           }
         },
@@ -25271,7 +25389,7 @@ function secretsCheck(config, configPath) {
   }
   let raw;
   try {
-    raw = fs14.readFileSync(keyFilePath, "utf8");
+    raw = fs15.readFileSync(keyFilePath, "utf8");
   } catch (err) {
     return {
       name: "Secrets adapter",
@@ -25307,15 +25425,15 @@ var init_secrets_check = __esm({
 });
 
 // src/checks/storage-check.ts
-import fs15 from "node:fs";
+import fs16 from "node:fs";
 function storageCheck(config, configPath) {
   if (config.storage.provider === "local_disk") {
     const baseDir = resolveRuntimeLikePath(config.storage.localDisk.baseDir, configPath);
-    if (!fs15.existsSync(baseDir)) {
-      fs15.mkdirSync(baseDir, { recursive: true });
+    if (!fs16.existsSync(baseDir)) {
+      fs16.mkdirSync(baseDir, { recursive: true });
     }
     try {
-      fs15.accessSync(baseDir, fs15.constants.W_OK);
+      fs16.accessSync(baseDir, fs16.constants.W_OK);
       return {
         name: "Storage",
         status: "pass",
@@ -25721,7 +25839,7 @@ __export(run_exports, {
   runCommand: () => runCommand
 });
 import * as p13 from "@clack/prompts";
-import fs16 from "node:fs";
+import fs17 from "node:fs";
 import pc12 from "picocolors";
 async function runCommand(opts) {
   let localEnvProfile = resolveActiveLocalEnvProfile();
@@ -25731,9 +25849,9 @@ async function runCommand(opts) {
   const instanceId = resolveRudderInstanceId(opts.instance);
   process.env.RUDDER_INSTANCE_ID = instanceId;
   const homeDir = resolveRudderHomeDir();
-  fs16.mkdirSync(homeDir, { recursive: true });
+  fs17.mkdirSync(homeDir, { recursive: true });
   const paths = describeLocalInstancePaths(instanceId);
-  fs16.mkdirSync(paths.instanceRoot, { recursive: true });
+  fs17.mkdirSync(paths.instanceRoot, { recursive: true });
   const configPath = resolveConfigPath(opts.config);
   process.env.RUDDER_CONFIG = configPath;
   loadRudderEnvFile(configPath);
@@ -25830,7 +25948,7 @@ var init_run = __esm({
 
 // src/commands/onboard.ts
 import * as p14 from "@clack/prompts";
-import path21 from "node:path";
+import path22 from "node:path";
 import pc13 from "picocolors";
 function parseBooleanFromEnv(rawValue) {
   if (rawValue === void 0) return null;
@@ -25863,7 +25981,7 @@ function parseEnumFromEnv(rawValue, allowedValues) {
 }
 function resolvePathFromEnv(rawValue) {
   if (!rawValue || rawValue.trim().length === 0) return null;
-  return path21.resolve(expandHomePrefix(rawValue.trim()));
+  return path22.resolve(expandHomePrefix(rawValue.trim()));
 }
 function quickstartDefaultsFromEnv() {
   const instanceId = resolveRudderInstanceId();
@@ -26324,9 +26442,9 @@ function fingerprintRudderMcpToolManifest(tools) {
 init_dist2();
 import { spawn as spawn2, spawnSync } from "node:child_process";
 import { existsSync as existsSync2 } from "node:fs";
-import fs4 from "node:fs/promises";
-import os2 from "node:os";
-import path6 from "node:path";
+import fs5 from "node:fs/promises";
+import os3 from "node:os";
+import path7 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/agent-v1-registry.ts
@@ -27737,6 +27855,18 @@ var AGENT_CLI_CAPABILITIES = [
     "requiresAgentId": false,
     "requiresOrgId": false,
     "requiresRunId": false
+  },
+  {
+    "attachesRunIdWhenAvailable": true,
+    "category": "runs",
+    "command": "rudder runs create --task <text> --idempotency-key <key> [--target-agent-id <id>]",
+    "contract": "agent-v1",
+    "description": "Create an independently governed Delegation Run for the current or another same-organization Agent.",
+    "id": "runs.create",
+    "mutating": true,
+    "requiresAgentId": true,
+    "requiresOrgId": false,
+    "requiresRunId": true
   }
 ];
 
@@ -27839,6 +27969,8 @@ function formatAgentCliCapabilitiesHumanReadable(capabilities = getAgentCliCapab
 
 // src/client/http.ts
 import { URL as URL2 } from "node:url";
+
+// src/client/api-request-error.ts
 var ApiRequestError = class extends Error {
   status;
   code;
@@ -27852,6 +27984,294 @@ var ApiRequestError = class extends Error {
     this.body = body;
   }
 };
+
+// src/client/issue-transport-budget.ts
+import { createHash as createHash2 } from "node:crypto";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+var DEFAULT_BACKOFF_MS = 6e4;
+var LOCK_RETRY_MS = 5;
+var LOCK_TIMEOUT_MS = 250;
+var IssueTransportBudget = class {
+  runId;
+  surface;
+  stateDir;
+  backoffMs;
+  now;
+  constructor(options) {
+    this.runId = options.runId?.trim() || void 0;
+    this.surface = options.surface ?? transportSurfaceFromEnv();
+    this.stateDir = options.stateDir ?? process.env.RUDDER_RUNTIME_TMPDIR?.trim() ?? path.join(os.tmpdir(), "rudder-issue-transport");
+    this.backoffMs = options.backoffMs ?? DEFAULT_BACKOFF_MS;
+    this.now = options.now ?? Date.now;
+  }
+  async reserve(method, requestPath) {
+    if (!this.runId) return null;
+    const scope = issueTransportScope(method, requestPath);
+    if (!scope) return null;
+    const filePath = this.stateFilePath(scope);
+    try {
+      return await this.withLock(filePath, async () => {
+        const now = this.now();
+        let state = await readState(filePath);
+        if (state && state.expiresAt <= now) {
+          await fs.rm(filePath, { force: true });
+          state = null;
+        }
+        if (!state) {
+          return { filePath, scope, surface: this.surface, attempt: "initial" };
+        }
+        if (state.phase === "fallback_available" && state.initialSurface !== this.surface) {
+          await writeState(filePath, {
+            ...state,
+            phase: "fallback_in_flight",
+            fallbackSurface: this.surface
+          });
+          return { filePath, scope, surface: this.surface, attempt: "fallback" };
+        }
+        throw issueTransportUnavailable(state, now, scope);
+      });
+    } catch (error) {
+      if (error instanceof ApiRequestError) throw error;
+      return null;
+    }
+  }
+  async succeed(reservation) {
+    if (!reservation) return;
+    await this.tryWithLock(reservation.filePath, async () => {
+      await fs.rm(reservation.filePath, { force: true });
+    });
+  }
+  async fail(reservation, error) {
+    if (!reservation) return;
+    if (error.status < 500 || error.status > 599) {
+      await this.succeed(reservation);
+      return;
+    }
+    const failure = buildFingerprint(reservation.scope, error);
+    const now = this.now();
+    await this.tryWithLock(reservation.filePath, async () => {
+      const current = await readState(reservation.filePath);
+      const concurrentMatchingFailure = reservation.attempt === "initial" && current?.failure?.fingerprint === failure.fingerprint;
+      const budgetExhausted = reservation.attempt === "fallback" || concurrentMatchingFailure;
+      const state = {
+        ...reservation.scope,
+        phase: budgetExhausted ? "blocked" : "fallback_available",
+        initialSurface: current?.initialSurface ?? reservation.surface,
+        fallbackSurface: reservation.attempt === "fallback" ? reservation.surface : void 0,
+        fallbackMatchedFingerprint: budgetExhausted ? current?.failure?.fingerprint === failure.fingerprint : void 0,
+        failure,
+        observedAt: now,
+        expiresAt: now + this.backoffMs
+      };
+      await writeState(reservation.filePath, state);
+      attachTransportDiagnostic(error, state, now, reservation.scope);
+      appendFallbackGuidance(error, state, reservation.scope);
+      if (budgetExhausted) {
+        error.code = "issue_transport_unavailable";
+        error.message = "Issue transport unavailable";
+      }
+    });
+  }
+  stateFilePath(scope) {
+    const key = [this.runId, scope.operation, scope.issueId].join("\n");
+    const digest = createHash2("sha256").update(key).digest("hex");
+    return path.join(this.stateDir, "issue-transport-budget", `${digest}.json`);
+  }
+  async tryWithLock(filePath, action) {
+    try {
+      return await this.withLock(filePath, action);
+    } catch {
+      return void 0;
+    }
+  }
+  async withLock(filePath, action) {
+    await fs.mkdir(path.dirname(filePath), { recursive: true, mode: 448 });
+    const lockPath = `${filePath}.lock`;
+    const deadline = Date.now() + LOCK_TIMEOUT_MS;
+    let lock = null;
+    while (!lock) {
+      try {
+        lock = await fs.open(lockPath, "wx", 384);
+      } catch (error) {
+        if (!isAlreadyExists(error) || Date.now() >= deadline) throw error;
+        await new Promise((resolve) => setTimeout(resolve, LOCK_RETRY_MS));
+      }
+    }
+    try {
+      return await action();
+    } finally {
+      await lock.close();
+      await fs.rm(lockPath, { force: true });
+    }
+  }
+};
+function issueTransportScope(method, requestPath) {
+  const normalizedMethod = String(method ?? "GET").toUpperCase();
+  const [pathname, queryString] = requestPath.split("?", 2);
+  const match = /^\/api\/issues\/([^/]+)(?:\/(heartbeat-context|comments)(?:\/([^/]+))?)?$/.exec(pathname);
+  if (!match) return null;
+  const issueId = decodeURIComponent(match[1] ?? "");
+  const resource = match[2];
+  const commentId = match[3];
+  let operation = null;
+  if (normalizedMethod === "GET" && !resource) operation = "issue.get";
+  if (normalizedMethod === "GET" && resource === "heartbeat-context") operation = "issue.context";
+  if (normalizedMethod === "GET" && resource === "comments" && !commentId) operation = "issue.comments.list";
+  if (normalizedMethod === "GET" && resource === "comments" && commentId) operation = "issue.comments.get";
+  if (normalizedMethod === "POST" && resource === "comments" && !commentId) operation = "issue.comment";
+  if (!operation) return null;
+  const query = new URLSearchParams(queryString ?? "");
+  return {
+    operation,
+    issueId,
+    fallbackCommand: buildCliFallbackCommand(operation, issueId, commentId, query)
+  };
+}
+function buildFingerprint(scope, error) {
+  const normalizedMessage = error.message.trim().replace(/\s+/g, " ").toLowerCase().slice(0, 256);
+  const code = error.code?.trim() || "api_request_error";
+  const value = [scope.operation, scope.issueId, error.status, code, normalizedMessage].join("\n");
+  return {
+    fingerprint: createHash2("sha256").update(value).digest("hex"),
+    status: error.status,
+    code,
+    normalizedMessage
+  };
+}
+function issueTransportUnavailable(state, now, requestScope = state) {
+  const details = { issueTransport: transportDiagnostic(state, now, requestScope) };
+  return new ApiRequestError(
+    503,
+    issueTransportErrorMessage(state, requestScope),
+    details,
+    { error: "Issue transport unavailable", code: "issue_transport_unavailable", details },
+    "issue_transport_unavailable"
+  );
+}
+function attachTransportDiagnostic(error, state, now, requestScope = state) {
+  const upstreamDetails = error.details;
+  error.details = {
+    ...isRecord2(upstreamDetails) ? upstreamDetails : upstreamDetails === void 0 ? {} : { upstreamDetails },
+    issueTransport: transportDiagnostic(state, now, requestScope)
+  };
+}
+function appendFallbackGuidance(error, state, requestScope) {
+  const fallback = issueTransportFallbackAction(state, requestScope);
+  if (!fallback) return;
+  error.message = `${error.message}; use the equivalent ${fallbackSurfaceLabel(fallback.surface)} fallback once: ${fallbackTarget(fallback)}`;
+}
+function issueTransportErrorMessage(state, requestScope = state) {
+  const base = state.phase === "fallback_in_flight" ? "Issue transport probe already in flight" : "Issue transport unavailable";
+  const fallback = issueTransportFallbackAction(state, requestScope);
+  return fallback ? `${base}; use the equivalent ${fallbackSurfaceLabel(fallback.surface)} fallback once: ${fallbackTarget(fallback)}` : base;
+}
+function transportDiagnostic(state, now, requestScope = state) {
+  return {
+    state: state.phase,
+    fingerprint: state.failure?.fingerprint ?? null,
+    operation: state.operation,
+    issueId: state.issueId,
+    upstreamStatus: state.failure?.status ?? null,
+    upstreamCode: state.failure?.code ?? null,
+    normalizedServerMessage: state.failure?.normalizedMessage ?? null,
+    initialSurface: state.initialSurface,
+    fallbackSurface: state.fallbackSurface ?? null,
+    fallbackMatchedFingerprint: state.fallbackMatchedFingerprint ?? null,
+    fallbackBudgetRemaining: state.phase === "fallback_available" ? 1 : 0,
+    fallbackAction: issueTransportFallbackAction(state, requestScope),
+    retryAfterMs: Math.max(0, state.expiresAt - now),
+    checkpoint: "Issue transport unavailable"
+  };
+}
+function issueTransportFallbackAction(state, requestScope = state) {
+  if (state.phase !== "fallback_available") return null;
+  if (state.initialSurface === "mcp") {
+    return {
+      surface: "cli",
+      command: requestScope.fallbackCommand ?? state.fallbackCommand ?? buildCliFallbackCommand(state.operation, state.issueId, void 0, new URLSearchParams())
+    };
+  }
+  return {
+    surface: "mcp",
+    tool: mcpToolNameForOperation(state.operation)
+  };
+}
+function fallbackSurfaceLabel(surface) {
+  return surface === "cli" ? "Rudder CLI" : "Rudder MCP";
+}
+function fallbackTarget(fallback) {
+  return fallback.command ?? fallback.tool ?? "the alternate Rudder transport";
+}
+function mcpToolNameForOperation(operation) {
+  return `rudder_${operation.replace(/\./g, "_")}`;
+}
+function buildCliFallbackCommand(operation, issueId, commentId, query) {
+  const issue = shellQuote(issueId);
+  switch (operation) {
+    case "issue.get":
+      return `rudder issue get ${issue} --json`;
+    case "issue.context": {
+      const command = [`rudder issue context ${issue}`];
+      appendCliOption(command, "--wake-comment-id", query.get("wakeCommentId"));
+      return `${command.join(" ")} --json`;
+    }
+    case "issue.comments.list": {
+      const command = [`rudder issue comments list ${issue}`];
+      appendCliOption(command, "--after", query.get("after"));
+      appendCliOption(command, "--order", query.get("order"));
+      return `${command.join(" ")} --json`;
+    }
+    case "issue.comments.get":
+      return `rudder issue comments get ${issue} ${shellQuote(commentId ?? "<comment-id>")} --json`;
+    case "issue.comment":
+      return `rudder issue comment ${issue} --body-file ./issue-comment.md --json`;
+    default:
+      return `rudder issue ${shellQuote(operation)} ${issue} --json`;
+  }
+}
+function appendCliOption(command, option, value) {
+  if (value === null || value.trim().length === 0) return;
+  command.push(option, shellQuote(value));
+}
+function shellQuote(value) {
+  if (/^[A-Za-z0-9_./:-]+$/.test(value)) return value;
+  return `'${value.replace(/'/g, "'\\''")}'`;
+}
+async function readState(filePath) {
+  try {
+    const parsed = JSON.parse(await fs.readFile(filePath, "utf8"));
+    return isIssueTransportState(parsed) ? parsed : null;
+  } catch (error) {
+    if (isNotFound(error) || error instanceof SyntaxError) return null;
+    throw error;
+  }
+}
+async function writeState(filePath, state) {
+  const tempPath = `${filePath}.${process.pid}.${Math.random().toString(16).slice(2)}.tmp`;
+  await fs.writeFile(tempPath, `${JSON.stringify(state)}
+`, { encoding: "utf8", mode: 384 });
+  await fs.rename(tempPath, filePath);
+}
+function isIssueTransportState(value) {
+  if (!isRecord2(value)) return false;
+  return typeof value.operation === "string" && typeof value.issueId === "string" && ["fallback_available", "fallback_in_flight", "blocked"].includes(String(value.phase)) && (value.initialSurface === "cli" || value.initialSurface === "mcp") && typeof value.observedAt === "number" && typeof value.expiresAt === "number";
+}
+function transportSurfaceFromEnv() {
+  return process.env.RUDDER_TOOL_TRANSPORT_SURFACE === "mcp" ? "mcp" : "cli";
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isAlreadyExists(error) {
+  return isRecord2(error) && error.code === "EEXIST";
+}
+function isNotFound(error) {
+  return isRecord2(error) && error.code === "ENOENT";
+}
+
+// src/client/http.ts
 var RudderApiClient = class {
   apiBase;
   apiKey;
@@ -27859,6 +28279,7 @@ var RudderApiClient = class {
   runId;
   signal;
   recoverAuth;
+  issueTransportBudget;
   constructor(opts) {
     this.apiBase = opts.apiBase.replace(/\/+$/, "");
     this.apiKey = opts.apiKey?.trim() || void 0;
@@ -27866,42 +28287,50 @@ var RudderApiClient = class {
     this.runId = opts.runId?.trim() || void 0;
     this.signal = opts.signal;
     this.recoverAuth = opts.recoverAuth;
+    this.issueTransportBudget = new IssueTransportBudget({
+      runId: this.runId,
+      surface: opts.transportSurface,
+      stateDir: opts.transportStateDir,
+      backoffMs: opts.transportBackoffMs,
+      now: opts.now
+    });
   }
-  get(path25, opts) {
-    return this.request(path25, { method: "GET" }, opts);
+  get(path26, opts) {
+    return this.request(path26, { method: "GET" }, opts);
   }
-  post(path25, body, opts) {
-    return this.request(path25, {
+  post(path26, body, opts) {
+    return this.request(path26, {
       method: "POST",
       body: body === void 0 ? void 0 : JSON.stringify(body)
     }, opts);
   }
-  postForm(path25, form, opts) {
-    return this.request(path25, {
+  postForm(path26, form, opts) {
+    return this.request(path26, {
       method: "POST",
       body: form
     }, opts);
   }
-  patch(path25, body, opts) {
-    return this.request(path25, {
+  patch(path26, body, opts) {
+    return this.request(path26, {
       method: "PATCH",
       body: body === void 0 ? void 0 : JSON.stringify(body)
     }, opts);
   }
-  put(path25, body, opts) {
-    return this.request(path25, {
+  put(path26, body, opts) {
+    return this.request(path26, {
       method: "PUT",
       body: body === void 0 ? void 0 : JSON.stringify(body)
     }, opts);
   }
-  delete(path25, opts) {
-    return this.request(path25, { method: "DELETE" }, opts);
+  delete(path26, opts) {
+    return this.request(path26, { method: "DELETE" }, opts);
   }
   setApiKey(apiKey) {
     this.apiKey = apiKey?.trim() || void 0;
   }
-  async request(path25, init, opts, hasRetriedAuth = false) {
-    const url = buildUrl(this.apiBase, path25);
+  async request(path26, init, opts, hasRetriedAuth = false) {
+    const url = buildUrl(this.apiBase, path26);
+    const reservation = await this.issueTransportBudget.reserve(init.method, path26);
     const headers = {
       accept: "application/json",
       ...toStringRecord(init.headers)
@@ -27920,29 +28349,39 @@ var RudderApiClient = class {
         headers["x-rudder-run-id"] = this.runId;
       }
     }
-    const response = await fetch(url, {
-      ...init,
-      headers,
-      signal: init.signal ?? this.signal
-    });
+    let response;
+    try {
+      response = await fetch(url, {
+        ...init,
+        headers,
+        signal: init.signal ?? this.signal
+      });
+    } catch (error) {
+      await this.issueTransportBudget.succeed(reservation);
+      throw error;
+    }
     if (opts?.ignoreNotFound && response.status === 404) {
+      await this.issueTransportBudget.succeed(reservation);
       return null;
     }
     if (!response.ok) {
       const apiError = await toApiError(response);
       if (!hasRetriedAuth && this.recoverAuth) {
         const recoveredToken = await this.recoverAuth({
-          path: path25,
+          path: path26,
           method: String(init.method ?? "GET").toUpperCase(),
           error: apiError
         });
         if (recoveredToken) {
+          await this.issueTransportBudget.succeed(reservation);
           this.setApiKey(recoveredToken);
-          return this.request(path25, init, opts, true);
+          return this.request(path26, init, opts, true);
         }
       }
+      await this.issueTransportBudget.fail(reservation, apiError);
       throw apiError;
     }
+    await this.issueTransportBudget.succeed(reservation);
     if (response.status === 204) {
       return null;
     }
@@ -27957,8 +28396,8 @@ function shouldAttachAgentContext(method) {
   const normalized = String(method ?? "GET").toUpperCase();
   return normalized !== "GET" && normalized !== "HEAD";
 }
-function buildUrl(apiBase, path25) {
-  const normalizedPath = path25.startsWith("/") ? path25 : `/${path25}`;
+function buildUrl(apiBase, path26) {
+  const normalizedPath = path26.startsWith("/") ? path26 : `/${path26}`;
   const [pathname, query] = normalizedPath.split("?");
   const url = new URL2(apiBase);
   url.pathname = `${url.pathname.replace(/\/+$/, "")}${pathname}`;
@@ -28009,8 +28448,8 @@ import pc2 from "picocolors";
 // src/client/board-auth.ts
 init_home();
 import { spawn } from "node:child_process";
-import fs from "node:fs";
-import path2 from "node:path";
+import fs2 from "node:fs";
+import path3 from "node:path";
 import pc from "picocolors";
 
 // src/client/command-label.ts
@@ -28033,14 +28472,14 @@ function normalizeApiBase(apiBase) {
   return apiBase.trim().replace(/\/+$/, "");
 }
 function resolveBoardAuthStorePath(overridePath) {
-  if (overridePath?.trim()) return path2.resolve(overridePath.trim());
-  if (process.env.RUDDER_AUTH_STORE?.trim()) return path2.resolve(process.env.RUDDER_AUTH_STORE.trim());
+  if (overridePath?.trim()) return path3.resolve(overridePath.trim());
+  if (process.env.RUDDER_AUTH_STORE?.trim()) return path3.resolve(process.env.RUDDER_AUTH_STORE.trim());
   return resolveDefaultCliAuthPath();
 }
 function readBoardAuthStore(storePath) {
   const filePath = resolveBoardAuthStorePath(storePath);
-  if (!fs.existsSync(filePath)) return defaultBoardAuthStore();
-  const raw = JSON.parse(fs.readFileSync(filePath, "utf8"));
+  if (!fs2.existsSync(filePath)) return defaultBoardAuthStore();
+  const raw = JSON.parse(fs2.readFileSync(filePath, "utf8"));
   const credentials = raw?.credentials && typeof raw.credentials === "object" ? raw.credentials : {};
   const normalized = {};
   for (const [key, value] of Object.entries(credentials)) {
@@ -28066,8 +28505,8 @@ function readBoardAuthStore(storePath) {
 }
 function writeBoardAuthStore(store, storePath) {
   const filePath = resolveBoardAuthStorePath(storePath);
-  fs.mkdirSync(path2.dirname(filePath), { recursive: true });
-  fs.writeFileSync(filePath, `${JSON.stringify(store, null, 2)}
+  fs2.mkdirSync(path3.dirname(filePath), { recursive: true });
+  fs2.writeFileSync(filePath, `${JSON.stringify(store, null, 2)}
 `, { mode: 384 });
 }
 function getStoredBoardCredential(apiBase, storePath) {
@@ -28213,27 +28652,27 @@ async function revokeStoredBoardCredential(params) {
 
 // src/client/context.ts
 init_home();
-import fs2 from "node:fs";
-import path3 from "node:path";
+import fs3 from "node:fs";
+import path4 from "node:path";
 var DEFAULT_CONTEXT_BASENAME = "context.json";
 var DEFAULT_PROFILE = "default";
 function findContextFileFromAncestors(startDir) {
-  const absoluteStartDir = path3.resolve(startDir);
+  const absoluteStartDir = path4.resolve(startDir);
   let currentDir = absoluteStartDir;
   while (true) {
-    const candidate = path3.resolve(currentDir, ".rudder", DEFAULT_CONTEXT_BASENAME);
-    if (fs2.existsSync(candidate)) {
+    const candidate = path4.resolve(currentDir, ".rudder", DEFAULT_CONTEXT_BASENAME);
+    if (fs3.existsSync(candidate)) {
       return candidate;
     }
-    const nextDir = path3.resolve(currentDir, "..");
+    const nextDir = path4.resolve(currentDir, "..");
     if (nextDir === currentDir) break;
     currentDir = nextDir;
   }
   return null;
 }
 function resolveContextPath(overridePath) {
-  if (overridePath) return path3.resolve(overridePath);
-  if (process.env.RUDDER_CONTEXT) return path3.resolve(process.env.RUDDER_CONTEXT);
+  if (overridePath) return path4.resolve(overridePath);
+  if (process.env.RUDDER_CONTEXT) return path4.resolve(process.env.RUDDER_CONTEXT);
   return findContextFileFromAncestors(process.cwd()) ?? resolveDefaultContextPath();
 }
 function defaultClientContext() {
@@ -28247,7 +28686,7 @@ function defaultClientContext() {
 }
 function parseJson(filePath) {
   try {
-    return JSON.parse(fs2.readFileSync(filePath, "utf-8"));
+    return JSON.parse(fs3.readFileSync(filePath, "utf-8"));
   } catch (err) {
     throw new Error(`Failed to parse JSON at ${filePath}: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -28293,7 +28732,7 @@ function normalizeContext(raw) {
 }
 function readContext(contextPath) {
   const filePath = resolveContextPath(contextPath);
-  if (!fs2.existsSync(filePath)) {
+  if (!fs3.existsSync(filePath)) {
     return defaultClientContext();
   }
   const raw = parseJson(filePath);
@@ -28301,10 +28740,10 @@ function readContext(contextPath) {
 }
 function writeContext(context, contextPath) {
   const filePath = resolveContextPath(contextPath);
-  const dir = path3.dirname(filePath);
-  fs2.mkdirSync(dir, { recursive: true });
+  const dir = path4.dirname(filePath);
+  fs3.mkdirSync(dir, { recursive: true });
   const normalized = normalizeContext(context);
-  fs2.writeFileSync(filePath, `${JSON.stringify(normalized, null, 2)}
+  fs3.writeFileSync(filePath, `${JSON.stringify(normalized, null, 2)}
 `, { mode: 384 });
 }
 function upsertProfile(profileName, patch, contextPath) {
@@ -28750,7 +29189,8 @@ function buildMcpServerEnv(env = process.env) {
     RUDDER_BROWSER_ENABLED: env.RUDDER_BROWSER_ENABLED,
     RUDDER_COMPUTER_ENABLED: env.RUDDER_COMPUTER_ENABLED,
     RUDDER_PROJECT_LIBRARY_PATH: env.RUDDER_PROJECT_LIBRARY_PATH,
-    RUDDER_MCP_RUDDER_BIN: env.RUDDER_MCP_RUDDER_BIN
+    RUDDER_MCP_RUDDER_BIN: env.RUDDER_MCP_RUDDER_BIN,
+    RUDDER_TOOL_TRANSPORT_SURFACE: env.RUDDER_TOOL_TRANSPORT_SURFACE
   };
 }
 function buildAgentV1ToolCallPlan(toolName, rawArgs, env = buildMcpServerEnv()) {
@@ -28758,10 +29198,10 @@ function buildAgentV1ToolCallPlan(toolName, rawArgs, env = buildMcpServerEnv())
   if (!capabilityId) {
     throw new Error(`Unknown Rudder MCP tool: ${toolName}`);
   }
-  if (rawArgs !== void 0 && rawArgs !== null && !isRecord2(rawArgs)) {
+  if (rawArgs !== void 0 && rawArgs !== null && !isRecord3(rawArgs)) {
     throwInvalidMcpArgument(toolName, "arguments", "must be object");
   }
-  const input = normalizeLegacyToolArguments(capabilityId, isRecord2(rawArgs) ? rawArgs : {});
+  const input = normalizeLegacyToolArguments(capabilityId, isRecord3(rawArgs) ? rawArgs : {});
   const capability = getAgentCliCapabilityById(capabilityId);
   rejectModelProvidedRuntimeIdentity(input);
   rejectUnsupportedToolArguments(toolName, input);
@@ -28784,7 +29224,8 @@ function buildAgentV1ToolCallPlan(toolName, rawArgs, env = buildMcpServerEnv())
       RUDDER_RUN_ID: env.RUDDER_RUN_ID,
       RUDDER_BROWSER_ENABLED: env.RUDDER_BROWSER_ENABLED,
       RUDDER_COMPUTER_ENABLED: env.RUDDER_COMPUTER_ENABLED,
-      RUDDER_PROJECT_LIBRARY_PATH: env.RUDDER_PROJECT_LIBRARY_PATH
+      RUDDER_PROJECT_LIBRARY_PATH: env.RUDDER_PROJECT_LIBRARY_PATH,
+      RUDDER_TOOL_TRANSPORT_SURFACE: "mcp"
     },
     tempFiles
   };
@@ -28870,7 +29311,7 @@ async function runAgentV1McpJsonRpcMessage(message, env = buildMcpServerEnv(), s
       case "tools/list": {
         const tools = surface === "computer" ? computerCapabilityEnabled(env) ? COMPUTER_USE_MCP_TOOLS : [] : surface === "browser" && !browserCapabilityEnabled(env) ? [] : buildAgentV1McpToolsManifest("agent-v1", { surface }).tools.map(toMcpToolListEntry);
         if (isModernMcpRequest(message.params)) {
-          const cursor = isRecord2(message.params) ? message.params.cursor : void 0;
+          const cursor = isRecord3(message.params) ? message.params.cursor : void 0;
           if (typeof cursor === "string" && parseMcpToolCursor(cursor) === null) {
             return rpcError(id, -32602, "Invalid tools/list cursor");
           }
@@ -29024,7 +29465,7 @@ async function callToolSafely(params, env, surface, signal) {
     const details = errorDetails(err);
     const payload = {
       status: "error",
-      code: isRecord2(details) && typeof details.code === "string" ? details.code : "rudder_mcp_tool_error",
+      code: isRecord3(details) && typeof details.code === "string" ? details.code : "rudder_mcp_tool_error",
       message: errorMessage(err),
       details: details ?? null
     };
@@ -29039,7 +29480,7 @@ async function callToolSafely(params, env, surface, signal) {
   }
 }
 async function callTool(params, env, surface, signal) {
-  const record = isRecord2(params) ? params : {};
+  const record = isRecord3(params) ? params : {};
   const toolName = typeof record.name === "string" ? record.name : "";
   if (surface === "computer") {
     if (!computerCapabilityEnabled(env)) {
@@ -29054,7 +29495,7 @@ async function callTool(params, env, surface, signal) {
       error.code = "rudder_mcp_tool_not_available";
       throw error;
     }
-    const rawArgs2 = isRecord2(record.arguments) ? record.arguments : {};
+    const rawArgs2 = isRecord3(record.arguments) ? record.arguments : {};
     rejectModelProvidedRuntimeIdentity(rawArgs2);
     const parsed = computerUseActionSchemas[action].safeParse(rawArgs2);
     if (!parsed.success) {
@@ -29073,17 +29514,17 @@ async function callTool(params, env, surface, signal) {
     throw err;
   }
   const rawArgs = record.arguments;
-  const args = isRecord2(rawArgs) ? normalizeLegacyToolArguments(toolNameToCapabilityId(toolName) ?? "", rawArgs) : rawArgs;
+  const args = isRecord3(rawArgs) ? normalizeLegacyToolArguments(toolNameToCapabilityId(toolName) ?? "", rawArgs) : rawArgs;
   const plan = buildAgentV1ToolCallPlan(toolName, args, env);
   const directResult = await callToolDirectlyIfSupported(toolName, args, env, signal);
   if (directResult) return directResult;
-  const tempDir = plan.tempFiles.length > 0 ? await fs4.mkdtemp(path6.join(os2.tmpdir(), "rudder-mcp-")) : null;
+  const tempDir = plan.tempFiles.length > 0 ? await fs5.mkdtemp(path7.join(os3.tmpdir(), "rudder-mcp-")) : null;
   const materializedArgs = [...plan.args];
   try {
     if (tempDir) {
       for (const tempFile of plan.tempFiles) {
-        const tempPath = path6.join(tempDir, `${tempFile.flag.replace(/^-+/, "")}.md`);
-        await fs4.writeFile(tempPath, tempFile.contents, "utf8");
+        const tempPath = path7.join(tempDir, `${tempFile.flag.replace(/^-+/, "")}.md`);
+        await fs5.writeFile(tempPath, tempFile.contents, "utf8");
         const index = materializedArgs.indexOf(tempFile.flag);
         if (index >= 0) materializedArgs[index + 1] = tempPath;
       }
@@ -29111,13 +29552,13 @@ async function callTool(params, env, surface, signal) {
       isError: true
     };
   } finally {
-    if (tempDir) await fs4.rm(tempDir, { recursive: true, force: true });
+    if (tempDir) await fs5.rm(tempDir, { recursive: true, force: true });
   }
 }
 async function callToolDirectlyIfSupported(toolName, rawArgs, env, signal) {
   const capabilityId = toolNameToCapabilityId(toolName);
   if (!capabilityId) return null;
-  const input = isRecord2(rawArgs) ? rawArgs : {};
+  const input = isRecord3(rawArgs) ? rawArgs : {};
   if (hasLocalImageInputs(input.images)) return null;
   const api = mcpApiClient(env, signal);
   const success = (data) => mcpSuccess(
@@ -29242,6 +29683,18 @@ async function callToolDirectlyIfSupported(toolName, rawArgs, env, signal) {
         `/api/issues/${encodeURIComponent(requiredAnyString(input, ["issue", "issueId"]))}/heartbeat-context${query ? `?${query}` : ""}`
       ));
     }
+    case "issue.comments.list": {
+      const params = new URLSearchParams();
+      appendOptionalQuery(params, "after", input.after);
+      appendOptionalQuery(params, "order", input.order ?? "desc");
+      return success(await api.get(
+        `/api/issues/${encodeURIComponent(requiredAnyString(input, ["issue", "issueId"]))}/comments?${params}`
+      ));
+    }
+    case "issue.comments.get":
+      return success(await api.get(
+        `/api/issues/${encodeURIComponent(requiredAnyString(input, ["issue", "issueId"]))}/comments/${encodeURIComponent(requiredAnyString(input, ["comment", "commentId"]))}`
+      ));
     case "issue.checkout": {
       const expectedStatuses = parseCsvInput(input.expectedStatuses, "todo,backlog,blocked");
       const payload = checkoutIssueSchema.parse({
@@ -29270,6 +29723,12 @@ async function callToolDirectlyIfSupported(toolName, rawArgs, env, signal) {
         { status: "done", comment }
       ));
     }
+    case "runs.create":
+      return success(await api.post("/api/agent-runs/delegation", {
+        task: requiredString(input, "task"),
+        ...optionalString(input.targetAgentId) ? { targetAgentId: optionalString(input.targetAgentId) } : {},
+        idempotencyKey: requiredString(input, "idempotencyKey")
+      }));
     case "runs.list":
       return success(await api.get(
         `/api/run-intelligence/orgs/${encodeURIComponent(requiredRuntimeString(env, "RUDDER_ORG_ID"))}/runs?${buildDirectRunsListQuery(input)}`
@@ -29452,11 +29911,12 @@ function mcpApiClient(env, signal) {
     apiKey: optionalString(env.RUDDER_API_KEY) ?? void 0,
     agentId: optionalString(env.RUDDER_AGENT_ID) ?? void 0,
     runId: optionalString(env.RUDDER_RUN_ID) ?? void 0,
+    transportSurface: "mcp",
     signal
   });
 }
 function mcpSuccess(data, maxResultBytes = RUDDER_MCP_MAX_TOOL_RESULT_BYTES) {
-  if (isRecord2(data) && (data.mimeType === "image/png" || data.mimeType === "image/jpeg") && typeof data.base64 === "string" && data.base64.length > 0) {
+  if (isRecord3(data) && (data.mimeType === "image/png" || data.mimeType === "image/jpeg") && typeof data.base64 === "string" && data.base64.length > 0) {
     const { base64, ...metadata } = data;
     return {
       content: [{ type: "image", data: base64, mimeType: data.mimeType }],
@@ -29467,9 +29927,9 @@ function mcpSuccess(data, maxResultBytes = RUDDER_MCP_MAX_TOOL_RESULT_BYTES) {
   return mcpSuccessFromJsonText(JSON.stringify(data ?? {}), maxResultBytes);
 }
 function mcpSuccessWithImages(data, maxResultBytes) {
-  if (!isRecord2(data) || !Array.isArray(data.images)) return mcpSuccess(data, maxResultBytes);
+  if (!isRecord3(data) || !Array.isArray(data.images)) return mcpSuccess(data, maxResultBytes);
   const images = data.images.filter(
-    (entry) => isRecord2(entry) && (entry.mimeType === "image/png" || entry.mimeType === "image/jpeg") && typeof entry.base64 === "string" && entry.base64.length > 0
+    (entry) => isRecord3(entry) && (entry.mimeType === "image/png" || entry.mimeType === "image/jpeg") && typeof entry.base64 === "string" && entry.base64.length > 0
   );
   if (images.length === 0) return mcpSuccess(data, maxResultBytes);
   const metadata = { ...data };
@@ -30073,6 +30533,11 @@ function cliArgsForCapability(capabilityId, input, tempFiles, env) {
     }
     case "chat.archive":
       return ["chat", "archive", requiredAnyString(input, ["chat", "chatId"])];
+    case "runs.create": {
+      const args = ["runs", "create", "--task", requiredString(input, "task"), "--idempotency-key", requiredString(input, "idempotencyKey")];
+      pushOptional(args, "--target-agent-id", input.targetAgentId);
+      return args;
+    }
     case "runs.list": {
       const args = ["runs", "list"];
       pushOptional(args, "--updated-after", input.updatedAfter);
@@ -30162,7 +30627,7 @@ function modernOrLegacyResult(params, result, options) {
 }
 function paginateMcpTools(tools, params) {
   if (!isModernMcpRequest(params)) return { tools };
-  const record = isRecord2(params) ? params : {};
+  const record = isRecord3(params) ? params : {};
   const cursor = typeof record.cursor === "string" ? record.cursor : null;
   const offset = cursor === null ? 0 : parseMcpToolCursor(cursor) ?? 0;
   const page = tools.slice(offset, offset + RUDDER_MCP_TOOL_PAGE_SIZE);
@@ -30185,7 +30650,7 @@ function parseMcpToolCursor(cursor) {
   return null;
 }
 function requestedProtocolVersion(params) {
-  if (!isRecord2(params)) return null;
+  if (!isRecord3(params)) return null;
   return typeof params.protocolVersion === "string" && params.protocolVersion.trim().length > 0 ? params.protocolVersion.trim() : null;
 }
 function toolNameToCapabilityId(toolName) {
@@ -30230,7 +30695,7 @@ function pushJson(args, flag, value) {
     args.push(flag, value.trim());
     return;
   }
-  if (isRecord2(value) || Array.isArray(value)) {
+  if (isRecord3(value) || Array.isArray(value)) {
     args.push(flag, JSON.stringify(value));
   }
 }
@@ -30299,20 +30764,20 @@ function validateMcpToolArguments(toolName, input) {
   }
   if (Array.isArray(schema.anyOf)) {
     const matches = schema.anyOf.some((candidate) => {
-      if (!isRecord2(candidate) || !Array.isArray(candidate.required)) return false;
+      if (!isRecord3(candidate) || !Array.isArray(candidate.required)) return false;
       return candidate.required.every((key) => {
         const value = input[String(key)];
         return value !== void 0 && value !== null && !(typeof value === "string" && value.trim().length === 0) && !(Array.isArray(value) && value.length === 0);
       });
     });
     if (!matches) {
-      const alternatives = schema.anyOf.flatMap((candidate) => isRecord2(candidate) && Array.isArray(candidate.required) ? candidate.required : []).map(String);
+      const alternatives = schema.anyOf.flatMap((candidate) => isRecord3(candidate) && Array.isArray(candidate.required) ? candidate.required : []).map(String);
       throwInvalidMcpArgument(toolName, alternatives.join(" or "), "is required");
     }
   }
   for (const [key, value] of Object.entries(input)) {
     const property = schema.properties[key];
-    if (!isRecord2(property) || value === void 0) continue;
+    if (!isRecord3(property) || value === void 0) continue;
     const violation = jsonSchemaViolation(value, property);
     if (violation) throwInvalidMcpArgument(toolName, key, violation);
   }
@@ -30320,20 +30785,21 @@ function validateMcpToolArguments(toolName, input) {
 function jsonSchemaViolation(value, schema) {
   if (Array.isArray(schema.oneOf)) {
     const matches = schema.oneOf.some(
-      (candidate) => isRecord2(candidate) && jsonSchemaViolation(value, candidate) === null
+      (candidate) => isRecord3(candidate) && jsonSchemaViolation(value, candidate) === null
     );
     if (!matches) return "does not match any allowed shape";
   }
   const types = Array.isArray(schema.type) ? schema.type : schema.type === void 0 ? [] : [schema.type];
   if (types.length > 0) {
-    const validType = types.some((type) => type === "string" ? typeof value === "string" : type === "number" ? typeof value === "number" && Number.isFinite(value) : type === "boolean" ? typeof value === "boolean" : type === "array" ? Array.isArray(value) : type === "object" ? isRecord2(value) : false);
+    const validType = types.some((type) => type === "string" ? typeof value === "string" : type === "number" ? typeof value === "number" && Number.isFinite(value) : type === "boolean" ? typeof value === "boolean" : type === "array" ? Array.isArray(value) : type === "object" ? isRecord3(value) : false);
     if (!validType) return `must be ${types.join(" or ")}`;
   }
   if (typeof value === "string") {
-    if (typeof schema.minLength === "number" && value.length < schema.minLength) {
+    const characterLength = Array.from(value).length;
+    if (typeof schema.minLength === "number" && characterLength < schema.minLength) {
       return `must contain at least ${schema.minLength} character(s)`;
     }
-    if (typeof schema.maxLength === "number" && value.length > schema.maxLength) {
+    if (typeof schema.maxLength === "number" && characterLength > schema.maxLength) {
       return `must contain at most ${schema.maxLength} characters`;
     }
     if (Array.isArray(schema.enum) && !schema.enum.includes(value)) {
@@ -30355,15 +30821,15 @@ function jsonSchemaViolation(value, schema) {
     if (typeof schema.maxItems === "number" && value.length > schema.maxItems) {
       return `must contain at most ${schema.maxItems} items`;
     }
-    if (isRecord2(schema.items)) {
+    if (isRecord3(schema.items)) {
       for (const [index, item] of value.entries()) {
         const violation = jsonSchemaViolation(item, schema.items);
         if (violation) return `item ${index} ${violation}`;
       }
     }
   }
-  if (isRecord2(value) && schema.type === "object") {
-    const properties = isRecord2(schema.properties) ? schema.properties : {};
+  if (isRecord3(value) && schema.type === "object") {
+    const properties = isRecord3(schema.properties) ? schema.properties : {};
     const required = Array.isArray(schema.required) ? schema.required.map(String) : [];
     for (const key of required) {
       if (!(key in value)) return `field ${key} is required`;
@@ -30374,7 +30840,7 @@ function jsonSchemaViolation(value, schema) {
     }
     for (const [key, child] of Object.entries(value)) {
       const childSchema = properties[key];
-      if (!isRecord2(childSchema)) continue;
+      if (!isRecord3(childSchema)) continue;
       const violation = jsonSchemaViolation(child, childSchema);
       if (violation) return `field ${key} ${violation}`;
     }
@@ -30436,7 +30902,7 @@ function assertBrowserCapabilityEnabled(capabilityId, env) {
 function structuredContentFromJsonText(text6) {
   try {
     const parsed = JSON.parse(text6);
-    if (isRecord2(parsed)) return { structuredContent: parsed };
+    if (isRecord3(parsed)) return { structuredContent: parsed };
     return { structuredContent: { result: parsed } };
   } catch {
     return {};
@@ -30497,10 +30963,18 @@ function errorMessage(err) {
 }
 function errorDetails(err) {
   if (!(err instanceof Error)) return void 0;
+  if (err instanceof ApiRequestError) {
+    const details = isRecord3(err.details) ? err.details : err.details === void 0 ? {} : { upstreamDetails: err.details };
+    return {
+      code: err.code ?? "api_request_error",
+      status: err.status,
+      ...details
+    };
+  }
   const code = err.code;
   return code ? { code } : void 0;
 }
-function isRecord2(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -30554,8 +31028,8 @@ function registerActivityCommands(program) {
         if (opts.entityType) params.set("entityType", opts.entityType);
         if (opts.entityId) params.set("entityId", opts.entityId);
         const query = params.toString();
-        const path25 = `/api/orgs/${ctx.orgId}/activity${query ? `?${query}` : ""}`;
-        const rows = await ctx.api.get(path25) ?? [];
+        const path26 = `/api/orgs/${ctx.orgId}/activity${query ? `?${query}` : ""}`;
+        const rows = await ctx.api.get(path26) ?? [];
         if (ctx.json) {
           printOutput(rows, { json: true });
           return;
@@ -30586,8 +31060,8 @@ function registerActivityCommands(program) {
 }
 
 // ../packages/agent-runtime-utils/dist/server-utils.cli.js
-import { promises as fs8 } from "node:fs";
-import path11 from "node:path";
+import { promises as fs9 } from "node:fs";
+import path12 from "node:path";
 
 // ../packages/agent-runtime-utils/dist/native-process-runner.js
 init_dist2();
@@ -31008,17 +31482,21 @@ Reason: {{context.passiveFollowup.reason}}
 Before changing the issue, continue to progress the current issue, then inspect the current issue state and any side effects from the previous run. Finally, do exactly one close-out action: add a progress comment, mark the issue done, block it with a reason, or hand it off explicitly with explanation.
 ${ISSUE_ASSIGNEE_EXECUTION_RAIL}`;
 var RUDDER_AGENT_OPERATING_CONTRACT = [
-  "You are a helpful assistant running inside Rudder. Your home directory is `$AGENT_HOME`. Everything personal to you -- life, memory, knowledge -- lives there. Other agents may have their own folders and you may update them when necessary.",
+  "You are a helpful assistant running inside Rudder. Your home directory is `$AGENT_HOME`. Everything personal to you -- life, memory, knowledge -- lives there. Every agent has its own folders and you may update them when necessary.",
   "",
-  "Read Rudder mcp tools to firstly.",
-  "Use these paths consistently:",
+  "## Basic Rules",
+  "- If you want to perform any Rudder-related operation such as issue, chat, agent run, automation, or projects, you can use rudder-mcp.",
+  "- When working in an issue, the only scenario for user feedback and communication is via issue comments. Whenever there is progress, changes, or responses, always post an issue comment. Users do not see the entire trajectory of your agent run by default.",
+  "- Another scenario is when you need to request something from the user. In such cases, use a request approval to seek the user's assistance.",
+  "- Before taking action, deeply analyze and research the existing information to ensure you have comprehensive context information before proceeding with the next action. You have your own goal, memory, skills, automation, library, project, org, use these resources to make better decisions.",
+  "- When the user explicitly mentions previously handled issue, tasks or conversations, retrieve the relevant tasks first before proceeding with the next action.",
   "",
+  "## Basic Paths",
   "- Your personal instructions live under `$AGENT_HOME/instructions`.",
   "- Personal memory lives under `$AGENT_HOME/memory`.",
   "- Tacit memory instruction lives at `$AGENT_HOME/instructions/MEMORY.md` and is automatically loaded when present.",
   "- Personal skills live under `$AGENT_HOME/skills`.",
-  "- Shared organization workspace root lives under `$RUDDER_ORG_WORKSPACE_ROOT`.",
-  "- Shared organization skills live under `$RUDDER_ORG_SKILLS_DIR`.",
+  "- Shared organization workspace root lives under `$RUDDER_ORG_WORKSPACE_ROOT` and shared org's skills live under `$RUDDER_ORG_SKILLS_DIR`.",
   "- Project Library root lives under `$RUDDER_PROJECT_LIBRARY_ROOT` when the run has project context.",
   "- Project Library locator lives in `$RUDDER_PROJECT_LIBRARY_PATH` when the run has project context, for example `projects/<project-key>`.",
   '- Library-backed project resources use `sourceType: "library"`; their `locator` points into `library:projects/<project-key>/`.',
@@ -31034,11 +31512,8 @@ var RUDDER_AGENT_OPERATING_CONTRACT = [
   "When you create or copy a skill under `$AGENT_HOME/skills/<slug>/`, check the agent's Skills snapshot before claiming it will load in future runs. If it is installed but not enabled, say exactly that future runs will not load it until enabled, and offer to enable it with `rudder agent skills enable <agent-id> <selection-ref>` when you have permission.",
   "If there is an AGENTS.md file in the project you're working on, please read it first and follow the project's development guidelines.",
   "",
-  "When you write issue comments or chat replies, match the language of the user's or board's most recent substantive message unless they explicitly ask for a different language.",
-  "When you mention a web page, issue URL, external dashboard, or other user-openable target in an issue comment or chat reply, write it as a clickable Markdown link with a descriptive label, for example `[NameSilo transfer page](https://www.namesilo.com/account_domain_manage_transfer.php)`. Do not put action URLs in backticks or code blocks unless you are showing literal code or a command.",
   "",
   "## Rudder Renderable Links",
-  "",
   "When you mention Rudder entities in any user-visible Markdown output, prefer Rudder's renderable Markdown link syntax over plain IDs, bare URLs, or backticked references so the UI can render chips and navigate correctly.",
   "",
   "- Issues: use `[](issue://<issue-id>)`; include `?c=<comment-id>` when linking to a specific comment.",
@@ -31048,6 +31523,7 @@ var RUDDER_AGENT_OPERATING_CONTRACT = [
   "- Chat threads: use `[](chat://<conversation-id>)` when citing a Rudder chat conversation.",
   "- Skills: use `[](skill://<skill-ref>)` when citing a Rudder skill reference. The skill ref may be an org skill, agent skill, bundled Rudder skill, or local-machine skill ref; the UI resolves the display label when metadata is available.",
   '- Library files: use the `markdownLink` returned by `rudder library file ref "$RUDDER_PROJECT_LIBRARY_PATH/<relative-file>" --json` with project context, or `rudder library file ref "artifacts/YYYY-MM-DD/<conversation-title>/<relative-file>" --json` without project context; do not hand-write `library-entry://...` links, and treat `library-file://...` as legacy path syntax only.',
+  "- Web page, issue URL, external dashboard, or other user-openable target: write it as a clickable Markdown link with a descriptive label, eg: [NameSilo transfer page](https://www.namesilo.com/account_domain_manage_transfer.php). Do not put action URLs in backticks or code blocks unless you are showing literal code or a command.",
   "",
   "Write these as normal Markdown links, not inside code spans or code blocks, unless you are literally documenting the syntax.",
   "",
@@ -31055,17 +31531,19 @@ var RUDDER_AGENT_OPERATING_CONTRACT = [
   "",
   "When an issue comment, done comment, or blocker comment cites visual evidence from a local screenshot/image path, attach the image with the Rudder CLI `--image <path>` option instead of leaving only the filesystem path in the text.",
   "",
+  "## Rudder Issue Transport Failures",
+  "",
+  "For Issue read/comment operations, treat typed Rudder MCP and the `rudder issue` CLI as one backend failure domain. Build the failure fingerprint from operation, Issue id, HTTP status/code, and normalized server message.",
+  "After the typed MCP surface returns a 5xx failure, make at most one recorded fallback through the CLI. If that fallback returns the same fingerprint or reports `issue_transport_unavailable`, stop all Issue transport probes for the reported backoff: do not switch profiles, repeat either surface, or call the API directly.",
+  "When the Issue transport budget is exhausted but local task work can continue, record the checkpoint `Issue transport unavailable` in the run outcome and keep Issue ownership, reviewer, and lifecycle state unchanged. Retry only after the diagnostic backoff expires or an explicit prerequisite changes.",
+  "",
   "## Memory and Shared Work Notes",
   "",
   "You MUST use the `para-memory-files` skill for all memory operations: storing facts, writing daily notes, creating entities, running weekly synthesis, recalling past context, and managing shared work notes. The skill defines your three-layer memory system (knowledge graph, daily notes, tacit knowledge), the PARA folder structure, atomic fact schemas, memory decay rules, and recall conventions.",
   "",
-  "Keep stable preferences and operating lessons in `$AGENT_HOME/instructions/MEMORY.md`. Use `$AGENT_HOME/memory/YYYY-MM-DD.md` for daily notes and `$AGENT_HOME/life/` for structured long-term memory. Rudder injects bounded today/yesterday daily-memory excerpts in the startup context bundle; open the files directly when you need full detail.",
+  "Keep stable preferences and operating lessons in `$AGENT_HOME/instructions/MEMORY.md`. Use `$AGENT_HOME/memory/YYYY-MM-DD.md` for daily notes and `$AGENT_HOME/life/` for structured long-term memory. ",
   "",
-  "Invoke it whenever you need to remember, retrieve, or organize anything.",
-  "",
-  "## Other",
-  "- Before taking action, deeply analyze and research the existing information to ensure you have comprehensive context information before proceeding with the next action. You have your own goal, memory, skills, automation, library, project, org, use these resources to make better decisions.",
-  "- When the user explicitly mentions previously handled issue, tasks or conversations, you need to retrieve the relevant tasks first before proceeding with the next action."
+  "Invoke it whenever you need to remember, retrieve, or organize anything."
 ].join("\n");
 var RUDDER_AGENT_HEARTBEAT_INSTRUCTION = [
   "This section is injected by Rudder only for heartbeat scene runs. It is the platform-owned heartbeat/self-check pipeline.",
@@ -31093,15 +31571,15 @@ var RUDDER_AGENT_HEARTBEAT_INSTRUCTION = [
 // ../packages/agent-runtime-utils/dist/server-utils.cli.js
 async function resolveRudderSkillsDir(moduleDir, additionalCandidates = []) {
   const candidates = [
-    ...RUDDER_SKILL_ROOT_RELATIVE_CANDIDATES.map((relativePath) => path11.resolve(moduleDir, relativePath)),
-    ...additionalCandidates.map((candidate) => path11.resolve(candidate))
+    ...RUDDER_SKILL_ROOT_RELATIVE_CANDIDATES.map((relativePath) => path12.resolve(moduleDir, relativePath)),
+    ...additionalCandidates.map((candidate) => path12.resolve(candidate))
   ];
   const seenRoots = /* @__PURE__ */ new Set();
   for (const root of candidates) {
     if (seenRoots.has(root))
       continue;
     seenRoots.add(root);
-    const isDirectory = await fs8.stat(root).then((stats) => stats.isDirectory()).catch(() => false);
+    const isDirectory = await fs9.stat(root).then((stats) => stats.isDirectory()).catch(() => false);
     if (isDirectory)
       return root;
   }
@@ -31111,36 +31589,36 @@ async function removeMaintainerOnlySkillSymlinks(skillsHome, allowedSkillNames)
   return removeUnselectedRudderSkillSymlinks(skillsHome, allowedSkillNames);
 }
 async function readRudderMaterializedSkillSource(target) {
-  const manifestPath = path11.join(target, ".rudder", "materialized-skill.json");
-  const raw = await fs8.readFile(manifestPath, "utf8").catch(() => null);
+  const manifestPath = path12.join(target, ".rudder", "materialized-skill.json");
+  const raw = await fs9.readFile(manifestPath, "utf8").catch(() => null);
   if (!raw)
     return null;
   try {
     const parsed = parseObject(JSON.parse(raw));
     const sourcePath = asString(parsed.sourcePath, "").trim();
-    return sourcePath.length > 0 ? path11.resolve(sourcePath) : null;
+    return sourcePath.length > 0 ? path12.resolve(sourcePath) : null;
   } catch {
     return null;
   }
 }
 async function removeUnselectedRudderSkillSymlinks(skillsHome, allowedSkillNames, knownSkillSources = []) {
   const allowed = new Set(Array.from(allowedSkillNames));
-  const knownSources = new Set(Array.from(knownSkillSources).map((value) => value.trim()).filter(Boolean).map((value) => path11.resolve(value)));
+  const knownSources = new Set(Array.from(knownSkillSources).map((value) => value.trim()).filter(Boolean).map((value) => path12.resolve(value)));
   try {
-    const entries = await fs8.readdir(skillsHome, { withFileTypes: true });
+    const entries = await fs9.readdir(skillsHome, { withFileTypes: true });
     const removed = [];
     for (const entry of entries) {
-      const target = path11.join(skillsHome, entry.name);
-      const existing = await fs8.lstat(target).catch(() => null);
+      const target = path12.join(skillsHome, entry.name);
+      const existing = await fs9.lstat(target).catch(() => null);
       if (!existing)
         continue;
       let isRudderManagedSkill = false;
       if (existing.isSymbolicLink()) {
-        const linkedPath = await fs8.readlink(target).catch(() => null);
+        const linkedPath = await fs9.readlink(target).catch(() => null);
         if (!linkedPath)
           continue;
-        const resolvedLinkedPath = path11.isAbsolute(linkedPath) ? linkedPath : path11.resolve(path11.dirname(target), linkedPath);
-        isRudderManagedSkill = knownSources.has(path11.resolve(resolvedLinkedPath)) || isMaintainerOnlySkillTarget(linkedPath) || isMaintainerOnlySkillTarget(resolvedLinkedPath);
+        const resolvedLinkedPath = path12.isAbsolute(linkedPath) ? linkedPath : path12.resolve(path12.dirname(target), linkedPath);
+        isRudderManagedSkill = knownSources.has(path12.resolve(resolvedLinkedPath)) || isMaintainerOnlySkillTarget(linkedPath) || isMaintainerOnlySkillTarget(resolvedLinkedPath);
       } else if (existing.isDirectory()) {
         const materializedSource = await readRudderMaterializedSkillSource(target);
         isRudderManagedSkill = materializedSource !== null && knownSources.has(materializedSource);
@@ -31149,7 +31627,7 @@ async function removeUnselectedRudderSkillSymlinks(skillsHome, allowedSkillNames
         continue;
       if (allowed.has(entry.name))
         continue;
-      await fs8.rm(target, { recursive: true, force: true });
+      await fs9.rm(target, { recursive: true, force: true });
       removed.push(entry.name);
     }
     return removed;
@@ -31160,9 +31638,9 @@ async function removeUnselectedRudderSkillSymlinks(skillsHome, allowedSkillNames
 
 // src/commands/client/agent.ts
 init_dist2();
-import fs9 from "node:fs/promises";
-import os3 from "node:os";
-import path12 from "node:path";
+import fs10 from "node:fs/promises";
+import os4 from "node:os";
+import path13 from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 
 // src/commands/client/help.ts
@@ -31186,16 +31664,16 @@ function formatHelpExample(example) {
 }
 
 // src/commands/client/agent.ts
-var __moduleDir = path12.dirname(fileURLToPath6(import.meta.url));
+var __moduleDir = path13.dirname(fileURLToPath6(import.meta.url));
 function codexSkillsHome() {
   const fromEnv = process.env.CODEX_HOME?.trim();
-  const base = fromEnv && fromEnv.length > 0 ? fromEnv : path12.join(os3.homedir(), ".codex");
-  return path12.join(base, "skills");
+  const base = fromEnv && fromEnv.length > 0 ? fromEnv : path13.join(os4.homedir(), ".codex");
+  return path13.join(base, "skills");
 }
 function claudeSkillsHome() {
   const fromEnv = process.env.CLAUDE_HOME?.trim();
-  const base = fromEnv && fromEnv.length > 0 ? fromEnv : path12.join(os3.homedir(), ".claude");
-  return path12.join(base, "skills");
+  const base = fromEnv && fromEnv.length > 0 ? fromEnv : path13.join(os4.homedir(), ".claude");
+  return path13.join(base, "skills");
 }
 async function installSkillsForTarget(sourceSkillsDir, targetSkillsDir, tool2) {
   const summary = {
@@ -31206,26 +31684,26 @@ async function installSkillsForTarget(sourceSkillsDir, targetSkillsDir, tool2) {
     skipped: [],
     failed: []
   };
-  await fs9.mkdir(targetSkillsDir, { recursive: true });
-  const entries = await fs9.readdir(sourceSkillsDir, { withFileTypes: true });
+  await fs10.mkdir(targetSkillsDir, { recursive: true });
+  const entries = await fs10.readdir(sourceSkillsDir, { withFileTypes: true });
   summary.removed = await removeMaintainerOnlySkillSymlinks(
     targetSkillsDir,
     entries.filter((entry) => entry.isDirectory()).map((entry) => entry.name)
   );
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    const source = path12.join(sourceSkillsDir, entry.name);
-    const target = path12.join(targetSkillsDir, entry.name);
-    const existing = await fs9.lstat(target).catch(() => null);
+    const source = path13.join(sourceSkillsDir, entry.name);
+    const target = path13.join(targetSkillsDir, entry.name);
+    const existing = await fs10.lstat(target).catch(() => null);
     if (existing) {
       if (existing.isSymbolicLink()) {
         let linkedPath = null;
         try {
-          linkedPath = await fs9.readlink(target);
+          linkedPath = await fs10.readlink(target);
         } catch (err) {
-          await fs9.unlink(target);
+          await fs10.unlink(target);
           try {
-            await fs9.symlink(source, target);
+            await fs10.symlink(source, target);
             summary.linked.push(entry.name);
             continue;
           } catch (linkErr) {
@@ -31236,10 +31714,10 @@ async function installSkillsForTarget(sourceSkillsDir, targetSkillsDir, tool2) {
             continue;
           }
         }
-        const resolvedLinkedPath = path12.isAbsolute(linkedPath) ? linkedPath : path12.resolve(path12.dirname(target), linkedPath);
-        const linkedTargetExists = await fs9.stat(resolvedLinkedPath).then(() => true).catch(() => false);
+        const resolvedLinkedPath = path13.isAbsolute(linkedPath) ? linkedPath : path13.resolve(path13.dirname(target), linkedPath);
+        const linkedTargetExists = await fs10.stat(resolvedLinkedPath).then(() => true).catch(() => false);
         if (!linkedTargetExists) {
-          await fs9.unlink(target);
+          await fs10.unlink(target);
         } else {
           summary.skipped.push(entry.name);
           continue;
@@ -31250,7 +31728,7 @@ async function installSkillsForTarget(sourceSkillsDir, targetSkillsDir, tool2) {
       }
     }
     try {
-      await fs9.symlink(source, target);
+      await fs10.symlink(source, target);
       summary.linked.push(entry.name);
     } catch (err) {
       summary.failed.push({
@@ -31461,7 +31939,7 @@ function registerAgentCommands(program) {
         if (opts.markdown && opts.markdownFile) {
           throw new Error("Pass only one of --markdown or --markdown-file.");
         }
-        const markdown = opts.markdownFile ? await fs9.readFile(path12.resolve(opts.markdownFile), "utf8") : opts.markdown;
+        const markdown = opts.markdownFile ? await fs10.readFile(path13.resolve(opts.markdownFile), "utf8") : opts.markdown;
         const payload = organizationSkillCreateSchema.parse({
           name: opts.name,
           slug: opts.slug?.trim() || null,
@@ -31640,7 +32118,7 @@ function registerAgentCommands(program) {
         }
         const installSummaries = [];
         if (opts.installSkills !== false) {
-          const skillsDir = await resolveRudderSkillsDir(__moduleDir, [path12.resolve(process.cwd(), "skills")]);
+          const skillsDir = await resolveRudderSkillsDir(__moduleDir, [path13.resolve(process.cwd(), "skills")]);
           if (!skillsDir) {
             throw new Error(
               "Could not locate local Rudder skills directory. Expected ./skills in the repo checkout."
@@ -31728,10 +32206,10 @@ async function buildAgentUpdatePatch(opts) {
   if (opts.capabilities !== void 0) rawPatch.capabilities = opts.capabilities;
   if (opts.description !== void 0) rawPatch.capabilities = opts.description;
   if (opts.capabilitiesFile !== void 0) {
-    rawPatch.capabilities = await fs9.readFile(path12.resolve(opts.capabilitiesFile), "utf8");
+    rawPatch.capabilities = await fs10.readFile(path13.resolve(opts.capabilitiesFile), "utf8");
   }
   if (opts.descriptionFile !== void 0) {
-    rawPatch.capabilities = await fs9.readFile(path12.resolve(opts.descriptionFile), "utf8");
+    rawPatch.capabilities = await fs10.readFile(path13.resolve(opts.descriptionFile), "utf8");
   }
   if (clearCapabilities) rawPatch.capabilities = null;
   return updateAgentSchema.parse(rawPatch);
@@ -31755,7 +32233,7 @@ function parseJsonObject(value, name) {
 // src/commands/client/approval.ts
 init_dist2();
 import { readFile as readFile2 } from "node:fs/promises";
-import path13 from "node:path";
+import path14 from "node:path";
 function registerApprovalCommands(program) {
   const approval = program.command("approval").description("Approval operations");
   addCommonClientOptions(
@@ -31946,7 +32424,7 @@ async function readTextInputFile(inputPath, optionName) {
   if (inputPath === "-") {
     return readStdinText();
   }
-  const resolvedPath = path13.resolve(process.cwd(), inputPath);
+  const resolvedPath = path14.resolve(process.cwd(), inputPath);
   return readFile2(resolvedPath, "utf8").catch((err) => {
     throw new Error(`Unable to read ${optionName} ${inputPath}: ${err instanceof Error ? err.message : String(err)}`);
   });
@@ -32784,11 +33262,11 @@ async function readStdin() {
 // src/commands/client/company.ts
 import * as p3 from "@clack/prompts";
 import { mkdir as mkdir2, readdir as readdir2, readFile as readFile3, stat as stat2, writeFile as writeFile2 } from "node:fs/promises";
-import path15 from "node:path";
+import path16 from "node:path";
 import pc5 from "picocolors";
 
 // src/commands/client/zip.ts
-import path14 from "node:path";
+import path15 from "node:path";
 import { inflateRawSync } from "node:zlib";
 var textDecoder = new TextDecoder();
 var binaryContentTypeByExtension = {
@@ -32816,7 +33294,7 @@ function sharedArchiveRoot(paths) {
   return firstSegments.every((parts) => parts.length > 1 && parts[0] === candidate) ? candidate : null;
 }
 function bytesToPortableFileEntry(pathValue, bytes) {
-  const contentType = binaryContentTypeByExtension[path14.extname(pathValue).toLowerCase()];
+  const contentType = binaryContentTypeByExtension[path15.extname(pathValue).toLowerCase()];
   if (!contentType) return textDecoder.decode(bytes);
   return {
     encoding: "base64",
@@ -32904,7 +33382,7 @@ var IMPORT_INCLUDE_OPTIONS = [
 ];
 var IMPORT_PREVIEW_SAMPLE_LIMIT = 6;
 function readPortableFileEntry(filePath, contents) {
-  const contentType = binaryContentTypeByExtension[path15.extname(filePath).toLowerCase()];
+  const contentType = binaryContentTypeByExtension[path16.extname(filePath).toLowerCase()];
   if (!contentType) return contents.toString("utf8");
   return {
     encoding: "base64",
@@ -32959,10 +33437,10 @@ function normalizePortablePath(filePath) {
   return filePath.replace(/\\/g, "/");
 }
 function shouldIncludePortableFile(filePath) {
-  const baseName = path15.basename(filePath);
+  const baseName = path16.basename(filePath);
   const isMarkdown = baseName.endsWith(".md");
   const isPaperclipYaml = baseName === ".rudder.yaml" || baseName === ".rudder.yml";
-  const contentType = binaryContentTypeByExtension[path15.extname(baseName).toLowerCase()];
+  const contentType = binaryContentTypeByExtension[path16.extname(baseName).toLowerCase()];
   return isMarkdown || isPaperclipYaml || Boolean(contentType);
 }
 function findPortableExtensionPath(files) {
@@ -33517,7 +33995,7 @@ function normalizeGithubImportSource(input, refOverride) {
 }
 async function pathExists(inputPath) {
   try {
-    await stat2(path15.resolve(inputPath));
+    await stat2(path16.resolve(inputPath));
     return true;
   } catch {
     return false;
@@ -33527,45 +34005,45 @@ async function collectPackageFiles(root, current, files) {
   const entries = await readdir2(current, { withFileTypes: true });
   for (const entry of entries) {
     if (entry.name.startsWith(".git")) continue;
-    const absolutePath = path15.join(current, entry.name);
+    const absolutePath = path16.join(current, entry.name);
     if (entry.isDirectory()) {
       await collectPackageFiles(root, absolutePath, files);
       continue;
     }
     if (!entry.isFile()) continue;
-    const relativePath = path15.relative(root, absolutePath).replace(/\\/g, "/");
+    const relativePath = path16.relative(root, absolutePath).replace(/\\/g, "/");
     if (!shouldIncludePortableFile(relativePath)) continue;
     files[relativePath] = readPortableFileEntry(relativePath, await readFile3(absolutePath));
   }
 }
 async function resolveInlineSourceFromPath(inputPath) {
-  const resolved = path15.resolve(inputPath);
+  const resolved = path16.resolve(inputPath);
   const resolvedStat = await stat2(resolved);
-  if (resolvedStat.isFile() && path15.extname(resolved).toLowerCase() === ".zip") {
+  if (resolvedStat.isFile() && path16.extname(resolved).toLowerCase() === ".zip") {
     const archive = await readZipArchive(await readFile3(resolved));
     const filteredFiles = Object.fromEntries(
       Object.entries(archive.files).filter(([relativePath]) => shouldIncludePortableFile(relativePath))
     );
     return {
-      rootPath: archive.rootPath ?? path15.basename(resolved, ".zip"),
+      rootPath: archive.rootPath ?? path16.basename(resolved, ".zip"),
       files: filteredFiles
     };
   }
-  const rootDir = resolvedStat.isDirectory() ? resolved : path15.dirname(resolved);
+  const rootDir = resolvedStat.isDirectory() ? resolved : path16.dirname(resolved);
   const files = {};
   await collectPackageFiles(rootDir, rootDir, files);
   return {
-    rootPath: path15.basename(rootDir),
+    rootPath: path16.basename(rootDir),
     files
   };
 }
 async function writeExportToFolder(outDir, exported) {
-  const root = path15.resolve(outDir);
+  const root = path16.resolve(outDir);
   await mkdir2(root, { recursive: true });
   for (const [relativePath, content] of Object.entries(exported.files)) {
     const normalized = relativePath.replace(/\\/g, "/");
-    const filePath = path15.join(root, normalized);
-    await mkdir2(path15.dirname(filePath), { recursive: true });
+    const filePath = path16.join(root, normalized);
+    await mkdir2(path16.dirname(filePath), { recursive: true });
     const writeValue = portableFileEntryToWriteValue(content);
     if (typeof writeValue === "string") {
       await writeFile2(filePath, writeValue, "utf8");
@@ -33575,7 +34053,7 @@ async function writeExportToFolder(outDir, exported) {
   }
 }
 async function confirmOverwriteExportDirectory(outDir) {
-  const root = path15.resolve(outDir);
+  const root = path16.resolve(outDir);
   const stats = await stat2(root).catch(() => null);
   if (!stats) return;
   if (!stats.isDirectory()) {
@@ -33757,7 +34235,7 @@ function registerCompanyCommands(program) {
         printOutput(
           {
             ok: true,
-            out: path15.resolve(opts.out),
+            out: path16.resolve(opts.out),
             rootPath: exported.rootPath,
             filesWritten: Object.keys(exported.files).length,
             rudderExtensionPath: exported.rudderExtensionPath,
@@ -34256,7 +34734,7 @@ function parseResultValue(value) {
 // src/commands/client/issue.ts
 init_dist2();
 import { readFile as readFile4, stat as stat3 } from "node:fs/promises";
-import path16 from "node:path";
+import path17 from "node:path";
 function registerIssueCommands(program) {
   const issue = program.command("issue").description("Issue operations");
   addCommonClientOptions(
@@ -34620,7 +35098,7 @@ async function readTextInputFile2(inputPath, optionName) {
   if (inputPath === "-") {
     return readStdinText2();
   }
-  const resolvedPath = path16.resolve(process.cwd(), inputPath);
+  const resolvedPath = path17.resolve(process.cwd(), inputPath);
   return readFile4(resolvedPath, "utf8").catch((err) => {
     throw new Error(`Unable to read ${optionName} ${inputPath}: ${err instanceof Error ? err.message : String(err)}`);
   });
@@ -34677,14 +35155,14 @@ async function appendUploadedIssueImages(ctx, issueId, body, imagePaths) {
 ${imageBlock}` : imageBlock;
 }
 async function uploadIssueCommentImage(ctx, issue, imagePath) {
-  const resolvedPath = path16.resolve(process.cwd(), imagePath);
+  const resolvedPath = path17.resolve(process.cwd(), imagePath);
   const stats = await stat3(resolvedPath).catch((err) => {
     throw new Error(`Unable to read image ${imagePath}: ${err instanceof Error ? err.message : String(err)}`);
   });
   if (!stats.isFile()) {
     throw new Error(`Image path must be a file: ${imagePath}`);
   }
-  const filename = path16.basename(resolvedPath);
+  const filename = path17.basename(resolvedPath);
   const contentType = inferCommentImageContentType(filename);
   const buffer = await readFile4(resolvedPath);
   if (buffer.length <= 0) {
@@ -34703,7 +35181,7 @@ async function uploadIssueCommentImage(ctx, issue, imagePath) {
   return attachment;
 }
 function inferCommentImageContentType(filename) {
-  const ext = path16.extname(filename).toLowerCase();
+  const ext = path17.extname(filename).toLowerCase();
   switch (ext) {
     case ".png":
       return "image/png";
@@ -34807,7 +35285,7 @@ function formatIssueSearchMatch(match) {
 
 // src/commands/client/library.ts
 import { readFile as readFile5 } from "node:fs/promises";
-import path17 from "node:path";
+import path18 from "node:path";
 function toLibraryFileLinkResult(detail) {
   return {
     filePath: detail.filePath,
@@ -34952,7 +35430,7 @@ async function resolveBodyFileInput(inputPath) {
   if (inputPath === "-") {
     return readStdinText3();
   }
-  const resolvedPath = path17.resolve(process.cwd(), inputPath);
+  const resolvedPath = path18.resolve(process.cwd(), inputPath);
   return readFile5(resolvedPath, "utf8").catch((err) => {
     throw new Error(`Unable to read --body-file ${inputPath}: ${err instanceof Error ? err.message : String(err)}`);
   });
@@ -35154,6 +35632,21 @@ function projectPath(projectRef, orgId) {
 // src/commands/client/runs.ts
 function registerRunsCommands(program) {
   const runs = program.command("runs").description("Run debugging operations");
+  addCommonClientOptions(
+    runs.command("create").description(getAgentCliCapabilityById("runs.create").description).requiredOption("--task <text>", "Delegation task text").option("--target-agent-id <id>", "Same-organization target Agent; defaults to the current Agent").requiredOption("--idempotency-key <key>", "Stable key for safe replay").action(async (opts) => {
+      try {
+        const ctx = resolveCommandContext(opts);
+        const row = await ctx.api.post("/api/agent-runs/delegation", {
+          task: opts.task,
+          ...opts.targetAgentId ? { targetAgentId: opts.targetAgentId } : {},
+          idempotencyKey: opts.idempotencyKey
+        });
+        printOutput(row, { json: ctx.json });
+      } catch (err) {
+        handleCommandError(err);
+      }
+    })
+  );
   addCommonClientOptions(
     runs.command("list").description(getAgentCliCapabilityById("runs.list").description).option("-O, --org-id <id>", "Organization ID").option("--updated-after <iso>", "Only runs updated after this timestamp").option("--run-id-prefix <prefix>", "Filter by run ID prefix").option("--agent-id <id>", "Filter by agent ID").option("--status <status>", "Filter by run status").option("--runtime <type>", "Filter by runtime type").option("--issue-id <id>", "Filter by linked issue ID").option("--used-skill <key-or-name>", "Filter by skill actually used during the run").option("--loaded-skill <key-or-name>", "Filter by skill loaded for the run").option("--created-before <iso>", "Only runs created before this timestamp").option("--cursor <cursor>", "Stable summary cursor returned in page.nextCursor").option("--limit <n>", "Maximum rows; defaults to 50 summaries or 200 full rows").option("--full", "Use the legacy full-row list response for compatibility").addHelpText("after", formatExamplesAndCautions({
       examples: [
@@ -35806,8 +36299,8 @@ function registerUserCommands(program) {
         appendParam(params, "limit", opts.limit);
         appendParam(params, "cursor", opts.cursor);
         const query = params.toString();
-        const path25 = `/api/orgs/${ctx.orgId}/users/${encodeURIComponent(userId)}/activity-ledger${query ? `?${query}` : ""}`;
-        const result = await ctx.api.get(path25);
+        const path26 = `/api/orgs/${ctx.orgId}/users/${encodeURIComponent(userId)}/activity-ledger${query ? `?${query}` : ""}`;
+        const result = await ctx.api.get(path26);
         if (ctx.json) {
           printOutput(result, { json: true });
           return;
@@ -36622,11 +37115,11 @@ init_run();
 // src/commands/start.ts
 import * as p15 from "@clack/prompts";
 import { spawn as spawn3, spawnSync as spawnSync4 } from "node:child_process";
-import { createHash as createHash4, randomUUID } from "node:crypto";
+import { createHash as createHash5, randomUUID } from "node:crypto";
 import { constants as fsConstants, mkdirSync as mkdirSync2, readFileSync as readFileSync2 } from "node:fs";
 import { access, chmod as chmod2, copyFile, cp, lstat, mkdir as mkdir3, mkdtemp as mkdtemp2, readdir as readdir3, readFile as readFile6, rm as rm3, stat as stat4, utimes, writeFile as writeFile3 } from "node:fs/promises";
 import { homedir, tmpdir } from "node:os";
-import path23 from "node:path";
+import path24 from "node:path";
 import { clearTimeout as clearTimeout3, setTimeout as setTimeout3 } from "node:timers";
 import { setTimeout as delay2 } from "node:timers/promises";
 import pc14 from "picocolors";
@@ -36654,10 +37147,10 @@ function parseChecksumFile(contents) {
 init_home();
 
 // src/desktop-download.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 import { createWriteStream as createWriteStream3, mkdirSync } from "node:fs";
 import { rm as rm2 } from "node:fs/promises";
-import path22 from "node:path";
+import path23 from "node:path";
 import { Readable as Readable2, Transform as Transform2 } from "node:stream";
 import { pipeline as pipeline3 } from "node:stream/promises";
 import { clearTimeout as clearTimeout2, setTimeout as setTimeout2 } from "node:timers";
@@ -36897,7 +37390,7 @@ async function resolveDesktopDownloadOrigins(options) {
 }
 async function downloadAsset(asset, outputDir, progressFactory = createByteProgress, expectedChecksum, timeouts = {}) {
   mkdirSync(outputDir, { recursive: true });
-  const outputPath = path22.join(outputDir, path22.basename(asset.name));
+  const outputPath = path23.join(outputDir, path23.basename(asset.name));
   const idleTimeoutMs = timeouts.idleMs ?? DESKTOP_ASSET_IDLE_TIMEOUT_MS;
   const responseTimeoutMs = timeouts.responseMs ?? DESKTOP_ASSET_RESPONSE_TIMEOUT_MS;
   const failures = [];
@@ -36917,7 +37410,7 @@ async function downloadAsset(asset, outputDir, progressFactory = createByteProgr
       const totalBytes = contentLengthFromHeaders(response.headers);
       progress = progressFactory(`Downloading ${asset.name}`);
       let receivedBytes = 0;
-      const hash = createHash3("sha256");
+      const hash = createHash4("sha256");
       let monitor;
       const armIdleTimeout = () => {
         if (idleTimeout) clearTimeout2(idleTimeout);
@@ -37233,38 +37726,38 @@ function resolveDesktopAssetTarget(platform = process.platform, arch = process.a
   throw new Error(`Rudder Desktop does not publish portable assets for ${platform}.`);
 }
 function resolveDefaultDesktopInstallRoot(target, env = process.env, homeDir = homedir()) {
-  if (target.platform === "macos") return path23.join(homeDir, "Applications");
+  if (target.platform === "macos") return path24.join(homeDir, "Applications");
   if (target.platform === "windows") {
-    const localAppData = env.LOCALAPPDATA?.trim() || path23.join(homeDir, "AppData", "Local");
-    return path23.join(localAppData, "Programs", DESKTOP_APP_NAME);
+    const localAppData = env.LOCALAPPDATA?.trim() || path24.join(homeDir, "AppData", "Local");
+    return path24.join(localAppData, "Programs", DESKTOP_APP_NAME);
   }
-  return path23.join(homeDir, ".local", "share", "rudder");
+  return path24.join(homeDir, ".local", "share", "rudder");
 }
 function resolveDesktopInstallPaths(target, installRoot) {
-  const root = path23.resolve(installRoot);
+  const root = path24.resolve(installRoot);
   if (target.platform === "macos") {
-    const appPath2 = path23.join(root, `${DESKTOP_APP_NAME}.app`);
+    const appPath2 = path24.join(root, `${DESKTOP_APP_NAME}.app`);
     return {
       installRoot: root,
       appPath: appPath2,
-      executablePath: path23.join(appPath2, "Contents", "MacOS", DESKTOP_APP_NAME),
-      metadataPath: path23.join(root, DESKTOP_METADATA_FILE)
+      executablePath: path24.join(appPath2, "Contents", "MacOS", DESKTOP_APP_NAME),
+      metadataPath: path24.join(root, DESKTOP_METADATA_FILE)
     };
   }
   if (target.platform === "windows") {
     return {
       installRoot: root,
       appPath: root,
-      executablePath: path23.join(root, `${DESKTOP_APP_NAME}.exe`),
-      metadataPath: path23.join(root, DESKTOP_METADATA_FILE)
+      executablePath: path24.join(root, `${DESKTOP_APP_NAME}.exe`),
+      metadataPath: path24.join(root, DESKTOP_METADATA_FILE)
     };
   }
-  const appPath = path23.join(root, `${DESKTOP_APP_NAME}.AppImage`);
+  const appPath = path24.join(root, `${DESKTOP_APP_NAME}.AppImage`);
   return {
     installRoot: root,
     appPath,
     executablePath: appPath,
-    metadataPath: path23.join(root, DESKTOP_METADATA_FILE)
+    metadataPath: path24.join(root, DESKTOP_METADATA_FILE)
   };
 }
 function normalizeAssetName(name) {
@@ -37447,21 +37940,21 @@ function buildGithubReleaseAsset(repo, tag, assetName, downloadBaseUrl) {
   };
 }
 function checksumForFile(filePath) {
-  const hash = createHash4("sha256");
+  const hash = createHash5("sha256");
   hash.update(readFileSync2(filePath));
   return hash.digest("hex");
 }
 function resolveAssetChecksum(checksums, assetName) {
-  const expected = checksums.get(path23.basename(assetName));
+  const expected = checksums.get(path24.basename(assetName));
   if (!expected) {
-    throw new Error(`Desktop release checksums do not include ${path23.basename(assetName)}.`);
+    throw new Error(`Desktop release checksums do not include ${path24.basename(assetName)}.`);
   }
   return expected;
 }
 function assertChecksumMatch(filePath, expected) {
   const actual = checksumForFile(filePath);
   if (actual !== expected.toLowerCase()) {
-    throw new Error(`Checksum mismatch for ${path23.basename(filePath)}.`);
+    throw new Error(`Checksum mismatch for ${path24.basename(filePath)}.`);
   }
   return actual;
 }
@@ -37480,10 +37973,10 @@ function normalizeDesktopAssetChecksum(checksum) {
   return normalized;
 }
 function resolveDesktopAssetCacheDir(assetChecksum, homeDir = resolveRudderHomeDir()) {
-  return path23.join(homeDir, DESKTOP_ASSET_CACHE_DIR, normalizeDesktopAssetChecksum(assetChecksum));
+  return path24.join(homeDir, DESKTOP_ASSET_CACHE_DIR, normalizeDesktopAssetChecksum(assetChecksum));
 }
 function resolveDesktopCachedAssetPath(assetName, assetChecksum, homeDir = resolveRudderHomeDir()) {
-  return path23.join(resolveDesktopAssetCacheDir(assetChecksum, homeDir), path23.basename(assetName));
+  return path24.join(resolveDesktopAssetCacheDir(assetChecksum, homeDir), path24.basename(assetName));
 }
 async function pruneDesktopAssetCache(options = {}) {
   const homeDir = options.homeDir ?? resolveRudderHomeDir();
@@ -37529,7 +38022,7 @@ async function maybePruneDesktopAssetCache(options) {
   return result.deleted.length > 0 || result.warnings.length > 0 ? result : null;
 }
 async function scanDesktopAssetCacheEntries(homeDir) {
-  const cacheRoot = path23.join(homeDir, DESKTOP_ASSET_CACHE_DIR);
+  const cacheRoot = path24.join(homeDir, DESKTOP_ASSET_CACHE_DIR);
   const dirents = await readdir3(cacheRoot, { withFileTypes: true }).catch(() => null);
   if (!dirents) return [];
   const entries = [];
@@ -37541,7 +38034,7 @@ async function scanDesktopAssetCacheEntries(homeDir) {
     } catch {
       continue;
     }
-    const cacheDir = path23.join(cacheRoot, dirent.name);
+    const cacheDir = path24.join(cacheRoot, dirent.name);
     const stats = await desktopCacheDirectoryStats(cacheDir);
     entries.push({
       cacheDir,
@@ -37565,7 +38058,7 @@ async function desktopCacheDirectoryStats(targetPath) {
   let lastUsedAtMs = Number(fallbackStat?.mtimeMs ?? 0);
   for (const dirent of dirents) {
     if (dirent.isSymbolicLink()) continue;
-    const entryPath = path23.join(targetPath, dirent.name);
+    const entryPath = path24.join(targetPath, dirent.name);
     const entryStat = await stat4(entryPath).catch(() => null);
     if (!entryStat) continue;
     lastUsedAtMs = Math.max(lastUsedAtMs, Number(entryStat.mtimeMs ?? 0));
@@ -37642,13 +38135,13 @@ async function downloadDesktopAssetWithCache(asset, expectedChecksum, options =
       await rm3(cachePath, { force: true });
     }
   }
-  const outputDir = options.outputDir ?? await mkdtemp2(path23.join(tmpdir(), "rudder-desktop-installer."));
+  const outputDir = options.outputDir ?? await mkdtemp2(path24.join(tmpdir(), "rudder-desktop-installer."));
   const removeOutputDir = options.outputDir ? false : true;
   try {
     const downloadedPath = await downloadAsset(asset, outputDir, options.progressFactory, normalizedChecksum);
     const checksum = assertChecksumMatch(downloadedPath, normalizedChecksum);
-    await mkdir3(path23.dirname(cachePath), { recursive: true });
-    if (path23.resolve(downloadedPath) !== path23.resolve(cachePath)) {
+    await mkdir3(path24.dirname(cachePath), { recursive: true });
+    if (path24.resolve(downloadedPath) !== path24.resolve(cachePath)) {
       await copyFile(downloadedPath, cachePath);
     }
     return { path: cachePath, checksum, cacheStatus: "miss" };
@@ -37665,8 +38158,8 @@ async function pathExists2(targetPath) {
   }
 }
 function resolveDesktopInstallLockPath(paths) {
-  const installRootHash = createHash4("sha256").update(path23.resolve(paths.installRoot)).digest("hex").slice(0, 16);
-  return path23.join(path23.dirname(paths.appPath), `.rudder-desktop-install-${installRootHash}.lock`);
+  const installRootHash = createHash5("sha256").update(path24.resolve(paths.installRoot)).digest("hex").slice(0, 16);
+  return path24.join(path24.dirname(paths.appPath), `.rudder-desktop-install-${installRootHash}.lock`);
 }
 async function readDesktopInstallLock(lockPath) {
   try {
@@ -37686,14 +38179,14 @@ async function readDesktopInstallLock(lockPath) {
 }
 async function withDesktopInstallLock(paths, fn, options = {}) {
   const lockPath = resolveDesktopInstallLockPath(paths);
-  const lockDir = path23.dirname(lockPath);
+  const lockDir = path24.dirname(lockPath);
   const timeoutMs = options.timeoutMs ?? DESKTOP_INSTALL_LOCK_TIMEOUT_MS;
   const pollMs = options.pollMs ?? DESKTOP_INSTALL_LOCK_POLL_MS;
   const startedAt = Date.now();
   const payload = {
     lockId: randomUUID(),
     pid: process.pid,
-    installRoot: path23.resolve(paths.installRoot),
+    installRoot: path24.resolve(paths.installRoot),
     createdAt: (/* @__PURE__ */ new Date()).toISOString()
   };
   await mkdir3(lockDir, { recursive: true });
@@ -37769,7 +38262,7 @@ async function findPath(root, predicate, maxDepth = 5) {
   async function visit(dir, depth) {
     const entries = await readdir3(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = path23.join(dir, entry.name);
+      const fullPath = path24.join(dir, entry.name);
       if (predicate(fullPath, entry.isDirectory())) return fullPath;
       if (entry.isDirectory() && depth < maxDepth) {
         const nested = await visit(fullPath, depth + 1);
@@ -37781,18 +38274,18 @@ async function findPath(root, predicate, maxDepth = 5) {
   return await visit(root, 0);
 }
 async function findMacApp(extractDir) {
-  const direct = path23.join(extractDir, `${DESKTOP_APP_NAME}.app`);
+  const direct = path24.join(extractDir, `${DESKTOP_APP_NAME}.app`);
   if (await pathExists2(direct)) return direct;
-  const found = await findPath(extractDir, (filePath, isDirectory) => isDirectory && path23.basename(filePath) === `${DESKTOP_APP_NAME}.app`);
+  const found = await findPath(extractDir, (filePath, isDirectory) => isDirectory && path24.basename(filePath) === `${DESKTOP_APP_NAME}.app`);
   if (!found) throw new Error(`Portable macOS archive did not contain ${DESKTOP_APP_NAME}.app.`);
   return found;
 }
 async function findWindowsAppDir(extractDir) {
-  const direct = path23.join(extractDir, `${DESKTOP_APP_NAME}.exe`);
+  const direct = path24.join(extractDir, `${DESKTOP_APP_NAME}.exe`);
   if (await pathExists2(direct)) return extractDir;
-  const executable = await findPath(extractDir, (filePath, isDirectory) => !isDirectory && path23.basename(filePath).toLowerCase() === `${DESKTOP_APP_NAME.toLowerCase()}.exe`);
+  const executable = await findPath(extractDir, (filePath, isDirectory) => !isDirectory && path24.basename(filePath).toLowerCase() === `${DESKTOP_APP_NAME.toLowerCase()}.exe`);
   if (!executable) throw new Error(`Portable Windows archive did not contain ${DESKTOP_APP_NAME}.exe.`);
-  return path23.dirname(executable);
+  return path24.dirname(executable);
 }
 async function readInstallMetadata(metadataPath) {
   try {
@@ -37848,6 +38341,11 @@ function findDesktopExecutablePids(executablePath, target) {
     return matchesExecutable && pid !== process.pid ? [pid] : [];
   });
 }
+function desktopApplicationEnvironment() {
+  const env = { ...process.env };
+  delete env.ELECTRON_RUN_AS_NODE;
+  return env;
+}
 async function waitForUpdateQuitResponse(responsePath, timeoutMs = 8e3) {
   const startedAt = Date.now();
   while (Date.now() - startedAt < timeoutMs) {
@@ -37860,11 +38358,12 @@ async function waitForUpdateQuitResponse(responsePath, timeoutMs = 8e3) {
 }
 async function requestDesktopQuit(executablePath, target, options = {}) {
   if (!await pathExists2(executablePath)) return { ok: true, status: "not_running" };
-  const responsePath = path23.join(tmpdir(), `rudder-update-quit-${process.pid}-${Date.now()}.json`);
+  const responsePath = path24.join(tmpdir(), `rudder-update-quit-${process.pid}-${Date.now()}.json`);
   const result = spawnSync4(executablePath, [
     `${DESKTOP_UPDATE_QUIT_ARG}=${responsePath}`,
     ...options.forceUpdate ? [DESKTOP_UPDATE_FORCE_ARG] : []
   ], {
+    env: desktopApplicationEnvironment(),
     stdio: "ignore",
     timeout: 5e3
   });
@@ -38024,7 +38523,7 @@ async function installPortableDesktop(installerPath, paths, target) {
     await chmod2(paths.appPath, 493);
     return;
   }
-  const extractDir = await mkdtemp2(path23.join(tmpdir(), "rudder-desktop-extract."));
+  const extractDir = await mkdtemp2(path24.join(tmpdir(), "rudder-desktop-extract."));
   try {
     await extractZip(installerPath, extractDir, target);
     if (target.platform === "macos") {
@@ -38033,7 +38532,7 @@ async function installPortableDesktop(installerPath, paths, target) {
       return;
     }
     const appSource = await findWindowsAppDir(extractDir);
-    await mkdir3(path23.dirname(paths.installRoot), { recursive: true });
+    await mkdir3(path24.dirname(paths.installRoot), { recursive: true });
     await copyPortableAppBundle(appSource, paths.installRoot);
   } finally {
     await rm3(extractDir, { recursive: true, force: true });
@@ -38074,12 +38573,12 @@ function buildLinuxDesktopEntry(executablePath) {
   ].join("\n");
 }
 async function writeLinuxLaunchers(paths) {
-  const desktopDir = path23.join(homedir(), ".local", "share", "applications");
+  const desktopDir = path24.join(homedir(), ".local", "share", "applications");
   await mkdir3(desktopDir, { recursive: true });
-  await writeFile3(path23.join(desktopDir, "rudder.desktop"), buildLinuxDesktopEntry(paths.executablePath), "utf8");
-  const binDir = path23.join(homedir(), ".local", "bin");
+  await writeFile3(path24.join(desktopDir, "rudder.desktop"), buildLinuxDesktopEntry(paths.executablePath), "utf8");
+  const binDir = path24.join(homedir(), ".local", "bin");
   await mkdir3(binDir, { recursive: true });
-  const wrapperPath = path23.join(binDir, "rudder-desktop");
+  const wrapperPath = path24.join(binDir, "rudder-desktop");
   const escaped = paths.executablePath.replaceAll("'", `'"'"'`);
   await writeFile3(wrapperPath, `#!/bin/sh
 exec '${escaped}' "$@"
@@ -38087,13 +38586,13 @@ exec '${escaped}' "$@"
   await chmod2(wrapperPath, 493);
 }
 function buildWindowsShortcutScript(executablePath) {
-  const appData = process.env.APPDATA?.trim() || path23.join(homedir(), "AppData", "Roaming");
-  const shortcutPath = path23.join(appData, "Microsoft", "Windows", "Start Menu", "Programs", "Rudder.lnk");
+  const appData = process.env.APPDATA?.trim() || path24.join(homedir(), "AppData", "Roaming");
+  const shortcutPath = path24.join(appData, "Microsoft", "Windows", "Start Menu", "Programs", "Rudder.lnk");
   return [
     "$shell = New-Object -ComObject WScript.Shell",
     `$shortcut = $shell.CreateShortcut(${powershellQuote(shortcutPath)})`,
     `$shortcut.TargetPath = ${powershellQuote(executablePath)}`,
-    `$shortcut.WorkingDirectory = ${powershellQuote(path23.dirname(executablePath))}`,
+    `$shortcut.WorkingDirectory = ${powershellQuote(path24.dirname(executablePath))}`,
     "$shortcut.Save()"
   ].join("; ");
 }
@@ -38125,7 +38624,7 @@ function launchDesktop(paths, target) {
   spawn3(paths.executablePath, [], { detached: true, stdio: "ignore" }).unref();
 }
 async function writeInstallMetadata(paths, releaseTag, assetName, assetChecksum, assetKind = "full") {
-  mkdirSync2(path23.dirname(paths.metadataPath), { recursive: true });
+  mkdirSync2(path24.dirname(paths.metadataPath), { recursive: true });
   const metadata = {
     version: 1,
     releaseTag,
@@ -38181,7 +38680,7 @@ async function startCommand(opts) {
     if (!exactDesktopAssetPath || !exactDesktopAssetChecksum || !exactDesktopAssetName || !exactDesktopReleaseDigest) {
       throw new Error("Exact Desktop asset mode requires path, checksum, asset name, and release digest.");
     }
-    if (!path23.isAbsolute(exactDesktopAssetPath) || exactDesktopAssetName.includes("/") || !/^[a-f0-9]{64}$/iu.test(exactDesktopAssetChecksum) || !/^[a-f0-9]{64}$/iu.test(exactDesktopReleaseDigest)) {
+    if (!path24.isAbsolute(exactDesktopAssetPath) || exactDesktopAssetName.includes("/") || !/^[a-f0-9]{64}$/iu.test(exactDesktopAssetChecksum) || !/^[a-f0-9]{64}$/iu.test(exactDesktopReleaseDigest)) {
       throw new Error("Exact Desktop asset mode received invalid candidate identity.");
     }
     if (opts.desktopAssetKind && opts.desktopAssetKind !== "full" && opts.desktopAssetKind !== "shell") {
@@ -38295,9 +38794,9 @@ async function startCommand(opts) {
     const smokeReleaseBaseUrls = resolveDesktopSmokeReleaseBaseUrls();
     const target = resolveDesktopAssetTarget();
     const tag = resolveDesktopReleaseTag(version);
-    const installRoot = opts.desktopInstallDir ? path23.resolve(opts.desktopInstallDir) : resolveDefaultDesktopInstallRoot(target);
+    const installRoot = opts.desktopInstallDir ? path24.resolve(opts.desktopInstallDir) : resolveDefaultDesktopInstallRoot(target);
     const installPaths = resolveDesktopInstallPaths(target, installRoot);
-    const outputDir = opts.outputDir ? path23.resolve(opts.outputDir) : await mkdtemp2(path23.join(tmpdir(), "rudder-desktop-installer."));
+    const outputDir = opts.outputDir ? path24.resolve(opts.outputDir) : await mkdtemp2(path24.join(tmpdir(), "rudder-desktop-installer."));
     p15.log.step("Installing desktop app");
     p15.log.message(`Release: ${pc14.cyan(`${repo}@${tag}`)}`);
     p15.log.message(`Target: ${pc14.cyan(`${target.platform}/${target.arch}`)}`);
@@ -38326,7 +38825,7 @@ async function startCommand(opts) {
         };
         selectedAssetKind = opts.desktopAssetKind ?? "full";
         expectedChecksum = normalizeDesktopAssetChecksum(exactDesktopAssetChecksum);
-        const computedReleaseDigest = createHash4("sha256").update(JSON.stringify({
+        const computedReleaseDigest = createHash5("sha256").update(JSON.stringify({
           releaseTag,
           assetName: selectedAsset.name,
           assetChecksum: expectedChecksum,
@@ -38343,7 +38842,7 @@ async function startCommand(opts) {
         if (linkDescriptor.isSymbolicLink()) throw new Error("Exact Desktop asset must not be a symbolic link.");
         const checksum = await runStartPhase(
           "Verifying staged Desktop checksum...",
-          `Verified ${pc14.cyan(path23.basename(exactDesktopAssetPath))}.`,
+          `Verified ${pc14.cyan(path24.basename(exactDesktopAssetPath))}.`,
           () => assertChecksumMatch(exactDesktopAssetPath, expectedChecksum),
           desktopProgressJson ? "verifying_checksum" : null
         );
@@ -38462,7 +38961,7 @@ async function startCommand(opts) {
         }
         const checksum = await runStartPhase(
           "Verifying Desktop checksum...",
-          `Verified ${pc14.cyan(path23.basename(verifiedAsset.path))}.`,
+          `Verified ${pc14.cyan(path24.basename(verifiedAsset.path))}.`,
           () => assertChecksumMatch(verifiedAsset.path, expectedChecksum),
           desktopProgressJson ? "verifying_checksum" : null
         );
@@ -38474,9 +38973,9 @@ async function startCommand(opts) {
             assetName: selectedAsset.name,
             assetChecksum: checksum,
             assetKind: selectedAssetKind,
-            stagedArtifactPath: path23.resolve(verifiedAsset.path),
+            stagedArtifactPath: path24.resolve(verifiedAsset.path),
             stagedArtifactDigest: checksum,
-            releaseDigest: createHash4("sha256").update(JSON.stringify({
+            releaseDigest: createHash5("sha256").update(JSON.stringify({
               releaseTag,
               assetName: selectedAsset.name,
               assetChecksum: checksum,
@@ -38490,12 +38989,12 @@ async function startCommand(opts) {
         let applySignal = null;
         let applySignalController = null;
         if (desktopProgressJson && opts.desktopWaitForApply === true) {
+          applySignalController = createDesktopApplySignalController();
           writeDesktopProgress({
             phase: "ready_to_install",
             message: "Desktop update is downloaded and verified.",
             percent: 100
           });
-          applySignalController = createDesktopApplySignalController();
           applySignal = await applySignalController.waitForInitialSignal();
           writeDesktopProgress({
             phase: "preparing_restart",
@@ -38567,11 +39066,11 @@ async function startCommand(opts) {
 
 // src/config/data-dir.ts
 init_home();
-import path24 from "node:path";
+import path25 from "node:path";
 function applyDataDirOverride(options, support = {}) {
   const rawDataDir = options.dataDir?.trim();
   if (!rawDataDir) return null;
-  const resolvedDataDir = path24.resolve(expandHomePrefix(rawDataDir));
+  const resolvedDataDir = path25.resolve(expandHomePrefix(rawDataDir));
   process.env.RUDDER_HOME = resolvedDataDir;
   if (support.hasConfigOption) {
     const hasConfigOverride = Boolean(options.config?.trim()) || Boolean(process.env.RUDDER_CONFIG?.trim());