@rudderhq/cli 0.7.19 → 0.7.20

package/dist/index.js

@@ -22345,6 +22345,256 @@ var init_native_payload = __esm({
   }
 });
 
+// src/runtime/platform-dependencies.ts
+import { mkdir, readFile, rm } from "node:fs/promises";
+import path10 from "node:path";
+function runtimePackageJsonPath(cacheDir, packageName) {
+  return path10.join(cacheDir, "node_modules", ...packageName.split("/"), "package.json");
+}
+async function readRuntimePackageJson(cacheDir, packageName) {
+  try {
+    return JSON.parse(await readFile(runtimePackageJsonPath(cacheDir, packageName), "utf8"));
+  } catch {
+    return null;
+  }
+}
+async function canResolveRuntimePackage(cacheDir, packageName) {
+  try {
+    await readFile(runtimePackageJsonPath(cacheDir, packageName), "utf8");
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function removeRuntimeInstallLocks(cacheDir) {
+  await Promise.all([
+    rm(path10.join(cacheDir, "package-lock.json"), { force: true }),
+    rm(path10.join(cacheDir, "node_modules", ".package-lock.json"), { force: true })
+  ]);
+}
+function packageNameFromSpec(packageSpec) {
+  if (!packageSpec.startsWith("@")) {
+    const versionSeparator2 = packageSpec.indexOf("@");
+    return versionSeparator2 === -1 ? packageSpec : packageSpec.slice(0, versionSeparator2);
+  }
+  const versionSeparator = packageSpec.indexOf("@", 1);
+  return versionSeparator === -1 ? packageSpec : packageSpec.slice(0, versionSeparator);
+}
+function normalizeOptionalDependencyVersion(versionRange) {
+  const trimmed = versionRange?.trim();
+  if (!trimmed) return null;
+  const exactVersion = /^[~^]\s*([0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?)$/.exec(trimmed);
+  return exactVersion?.[1] ?? trimmed;
+}
+async function installRuntimePackageInStaging(spawnSyncImpl, cacheDir, packageSpec, packageName, options) {
+  const stagingDir = path10.join(cacheDir, `.platform-repair-${process.pid}-${Date.now()}`);
+  await mkdir(stagingDir, { recursive: true });
+  try {
+    const packResult = runNpmPack(spawnSyncImpl, packageSpec, stagingDir, options);
+    if (packResult.status !== 0) return packResult;
+    const packFilename = parseNpmPackFilename(packResult.stdout);
+    if (!packFilename) {
+      return createSyntheticSpawnResult(1, "", `Unable to parse npm pack output for ${packageSpec}.`);
+    }
+    const archivePath = path10.join(stagingDir, packFilename);
+    const targetDir = path10.dirname(runtimePackageJsonPath(cacheDir, packageName));
+    await mkdir(path10.dirname(targetDir), { recursive: true });
+    await rm(targetDir, { recursive: true, force: true });
+    await mkdir(targetDir, { recursive: true });
+    const extractResult = runTarExtract(spawnSyncImpl, archivePath, targetDir, options);
+    return combineSpawnResults(packResult, extractResult);
+  } finally {
+    await rm(stagingDir, { recursive: true, force: true });
+  }
+}
+function runNpmPack(spawnSyncImpl, packageSpec, destinationDir, options) {
+  const timeout = options.remainingMs(options.deadline, options.cacheDir, `npm pack ${packageSpec}`);
+  const npm = resolveNpmCommandInvocation();
+  return spawnSyncImpl(
+    npm.command,
+    [
+      ...npm.args,
+      "pack",
+      packageSpec,
+      "--pack-destination",
+      destinationDir,
+      "--registry",
+      NPM_PUBLIC_REGISTRY_URL,
+      "--silent"
+    ],
+    {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+      env: { ...process.env, ...NPM_PLATFORM_REPAIR_ENV },
+      ...timeout === void 0 ? {} : { timeout },
+      ...process.platform === "win32" ? { windowsHide: true } : {}
+    }
+  );
+}
+function runTarExtract(spawnSyncImpl, archivePath, targetDir, options) {
+  const timeout = options.remainingMs(options.deadline, options.cacheDir, "extract runtime platform package");
+  return spawnSyncImpl(
+    "tar",
+    ["-xzf", archivePath, "-C", targetDir, "--strip-components", "1"],
+    {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+      ...timeout === void 0 ? {} : { timeout },
+      ...process.platform === "win32" ? { windowsHide: true } : {}
+    }
+  );
+}
+function parseNpmPackFilename(stdout) {
+  if (typeof stdout !== "string") return null;
+  const filename = stdout.trim().split(/\r?\n/).filter(Boolean).at(-1);
+  return filename?.endsWith(".tgz") ? filename : null;
+}
+function createSyntheticSpawnResult(status, stdout, stderr) {
+  return { status, stdout, stderr };
+}
+function combineSpawnResults(...results) {
+  const last = results.at(-1);
+  return {
+    status: last?.status ?? 0,
+    stdout: results.map((result) => result.stdout).filter(Boolean).join("\n"),
+    stderr: results.map((result) => result.stderr).filter(Boolean).join("\n"),
+    error: results.find((result) => result.error)?.error
+  };
+}
+function isLinuxGlibcRuntime() {
+  try {
+    const report = process.report?.getReport();
+    return typeof report.header?.glibcVersionRuntime === "string";
+  } catch {
+    return true;
+  }
+}
+function resolveSharpPlatformPackageName(sharpPackage) {
+  const platformPrefixes = process.platform === "linux" ? [
+    isLinuxGlibcRuntime() ? "linux" : "linuxmusl",
+    "linux",
+    "linuxmusl"
+  ] : [process.platform];
+  for (const platformPrefix of platformPrefixes) {
+    const packageName = `@img/sharp-${platformPrefix}-${process.arch}`;
+    if (sharpPackage.optionalDependencies?.[packageName]) return packageName;
+  }
+  return null;
+}
+async function hasRequiredRuntimeNativeDependencies(cacheDir) {
+  const sharpPackage = await readRuntimePackageJson(cacheDir, "sharp");
+  if (!sharpPackage) return true;
+  const platformPackageName = resolveSharpPlatformPackageName(sharpPackage);
+  if (!platformPackageName) return true;
+  const requiredPackages = [{
+    name: platformPackageName,
+    version: normalizeOptionalDependencyVersion(sharpPackage.optionalDependencies?.[platformPackageName])
+  }];
+  for (let index = 0; index < requiredPackages.length; index += 1) {
+    const requiredPackage = requiredPackages[index];
+    const packageJson = await readRuntimePackageJson(cacheDir, requiredPackage.name);
+    if (!packageJson || requiredPackage.version !== null && packageJson.version !== requiredPackage.version) return false;
+    for (const [dependencyName, versionRange] of Object.entries(packageJson.optionalDependencies ?? {})) {
+      if (!requiredPackages.some(({ name }) => name === dependencyName)) {
+        requiredPackages.push({
+          name: dependencyName,
+          version: normalizeOptionalDependencyVersion(versionRange)
+        });
+      }
+    }
+  }
+  return true;
+}
+async function ensureRuntimeNativeDependencies(options) {
+  if (process.env.RUDDER_RUNTIME_INSTALL_OMIT_OPTIONAL !== "true") return "";
+  const sharpPackage = await readRuntimePackageJson(options.cacheDir, "sharp");
+  if (!sharpPackage) return "";
+  const platformPackageName = resolveSharpPlatformPackageName(sharpPackage);
+  if (!platformPackageName) return "";
+  const installOptions = {
+    deadline: options.deadline,
+    cacheDir: options.cacheDir,
+    remainingMs: options.remainingMs
+  };
+  const requiredPackageVersions = /* @__PURE__ */ new Map([
+    [platformPackageName, normalizeOptionalDependencyVersion(sharpPackage.optionalDependencies?.[platformPackageName])]
+  ]);
+  const requiredPackages = /* @__PURE__ */ new Set([platformPackageName]);
+  let output = "";
+  for (let pass = 0; pass < 8; pass += 1) {
+    const missingSpecs = [];
+    for (const packageName of requiredPackages) {
+      const version = requiredPackageVersions.get(packageName) ?? null;
+      const packageJson = await readRuntimePackageJson(options.cacheDir, packageName);
+      if (packageJson && (version === null || packageJson.version === version)) continue;
+      missingSpecs.push(version ? `${packageName}@${version}` : packageName);
+    }
+    if (missingSpecs.length > 0) {
+      await removeRuntimeInstallLocks(options.cacheDir);
+      for (const packageSpec of missingSpecs) {
+        const packageName = packageNameFromSpec(packageSpec);
+        const result = await installRuntimePackageInStaging(
+          options.spawnSyncImpl,
+          options.cacheDir,
+          packageSpec,
+          packageName,
+          installOptions
+        );
+        output = collectOutputParts(output, collectSpawnOutput(result));
+        if (result.status === 0 && await canResolveRuntimePackage(options.cacheDir, packageName)) continue;
+        const command2 = formatRuntimePlatformRepairCommand(options.cacheDir, packageSpec);
+        throw options.createError(
+          `Rudder runtime installation is missing required native package ${packageName}. Re-run manually: ${command2}`,
+          command2,
+          output
+        );
+      }
+    }
+    let discoveredNewPackage = false;
+    for (const packageName of [...requiredPackages]) {
+      const packageJson = await readRuntimePackageJson(options.cacheDir, packageName);
+      for (const [dependencyName, versionRange] of Object.entries(packageJson?.optionalDependencies ?? {})) {
+        if (requiredPackages.has(dependencyName)) continue;
+        requiredPackages.add(dependencyName);
+        requiredPackageVersions.set(dependencyName, normalizeOptionalDependencyVersion(versionRange));
+        discoveredNewPackage = true;
+      }
+    }
+    if (!discoveredNewPackage && await hasRequiredRuntimeNativeDependencies(options.cacheDir)) return output;
+  }
+  const command = [...requiredPackages].map((packageName) => formatRuntimePlatformRepairCommand(
+    options.cacheDir,
+    requiredPackageVersions.get(packageName) ? `${packageName}@${requiredPackageVersions.get(packageName)}` : packageName
+  )).join("; ");
+  throw options.createError(
+    "Rudder runtime native dependency preparation did not converge. Re-run manually: " + command,
+    command,
+    output
+  );
+}
+function formatRuntimePlatformRepairCommand(cacheDir, packageSpec) {
+  return `npm pack ${packageSpec} --registry=${NPM_PUBLIC_REGISTRY_URL} --silent, then extract it into ${path10.join(cacheDir, "node_modules")}`;
+}
+function collectSpawnOutput(result) {
+  return [result.stdout, result.stderr, result.error instanceof Error ? result.error.message : null].filter((value) => typeof value === "string" && value.trim().length > 0).join("\n").trim();
+}
+function collectOutputParts(...parts) {
+  return parts.filter((part) => part.trim().length > 0).join("\n").trim();
+}
+var NPM_PUBLIC_REGISTRY_URL, NPM_PLATFORM_REPAIR_ENV;
+var init_platform_dependencies = __esm({
+  "src/runtime/platform-dependencies.ts"() {
+    "use strict";
+    init_npm_command();
+    NPM_PUBLIC_REGISTRY_URL = "https://registry.npmjs.org";
+    NPM_PLATFORM_REPAIR_ENV = {
+      npm_config_registry: NPM_PUBLIC_REGISTRY_URL,
+      npm_config_update_notifier: "false",
+      NO_UPDATE_NOTIFIER: "1"
+    };
+  }
+});
+
 // src/runtime/postgres-runtime-download.ts
 import { createHash as createHash3 } from "node:crypto";
 import { createReadStream, createWriteStream } from "node:fs";
@@ -22466,12 +22716,22 @@ var init_postgres_runtime_source = __esm({
 // src/runtime/install.ts
 import { execFileSync, spawnSync as spawnSync2 } from "node:child_process";
 import { createReadStream as createReadStream2, createWriteStream as createWriteStream2 } from "node:fs";
-import { chmod, mkdir, mkdtemp, readFile, readdir, realpath, rename, rm, stat, symlink, writeFile } from "node:fs/promises";
+import { chmod, mkdir as mkdir2, mkdtemp, readFile as readFile2, readdir, realpath, rename, rm as rm2, stat, symlink, writeFile } from "node:fs/promises";
 import { createRequire } from "node:module";
-import path10 from "node:path";
+import path11 from "node:path";
 import { performance as performance2 } from "node:perf_hooks";
 import { pipeline as pipeline2 } from "node:stream/promises";
 import { pathToFileURL } from "node:url";
+function omitOptionalRuntimeDependencies() {
+  return process.env.RUDDER_RUNTIME_INSTALL_OMIT_OPTIONAL === "true";
+}
+function runtimeNpmInstallFlags() {
+  return [
+    ...RUNTIME_NPM_INSTALL_BASE_FLAGS,
+    ...omitOptionalRuntimeDependencies() ? ["--omit=optional"] : RUNTIME_NPM_INSTALL_OPTIONAL_FLAGS,
+    ...RUNTIME_NPM_INSTALL_SUFFIX_FLAGS
+  ];
+}
 function createRuntimeInstallDeadline(options) {
   if (options.timeoutMs === void 0) return void 0;
   if (!Number.isFinite(options.timeoutMs) || options.timeoutMs <= 0) {
@@ -22512,7 +22772,7 @@ function resolveRuntimePackageVersion(version) {
   return normalized.length > 0 ? normalized : "latest";
 }
 function resolveRuntimeCacheDir(version, homeDir = resolveRudderHomeDir()) {
-  return path10.join(homeDir, "runtimes", sanitizeRuntimeCacheSegment(resolveRuntimePackageVersion(version)));
+  return path11.join(homeDir, "runtimes", sanitizeRuntimeCacheSegment(resolveRuntimePackageVersion(version)));
 }
 function resolveRuntimePackageSpec(version, packageName = RUNTIME_NPM_PACKAGE_NAME) {
   const packageVersion = resolveRuntimePackageVersion(version);
@@ -22520,7 +22780,7 @@ function resolveRuntimePackageSpec(version, packageName = RUNTIME_NPM_PACKAGE_NA
 }
 async function readRuntimeInstallMetadata(cacheDir) {
   try {
-    const raw = await readFile(path10.join(cacheDir, RUNTIME_METADATA_FILE), "utf8");
+    const raw = await readFile2(path11.join(cacheDir, RUNTIME_METADATA_FILE), "utf8");
     const parsed = JSON.parse(raw);
     if (parsed.version !== 1) return null;
     if (typeof parsed.packageName !== "string" || typeof parsed.packageVersion !== "string") return null;
@@ -22535,7 +22795,7 @@ async function readRuntimeInstallMetadata(cacheDir) {
   }
 }
 async function writeRuntimeInstallMetadata(cacheDir, metadata) {
-  await writeFile(path10.join(cacheDir, RUNTIME_METADATA_FILE), `${JSON.stringify(metadata, null, 2)}
+  await writeFile(path11.join(cacheDir, RUNTIME_METADATA_FILE), `${JSON.stringify(metadata, null, 2)}
 `, "utf8");
 }
 async function touchRuntimeInstallMetadata(cacheDir, postgresRuntime) {
@@ -22561,23 +22821,16 @@ function resolveEmbeddedPostgresPlatformPackage(platform = process.platform, arc
   if (platform === "win32" && arch === "x64") return "@embedded-postgres/windows-x64";
   return null;
 }
-async function canResolveRuntimePackage(cacheDir, packageName) {
-  try {
-    await readFile(path10.join(cacheDir, "node_modules", ...packageName.split("/"), "package.json"), "utf8");
-    return true;
-  } catch {
-    return false;
-  }
-}
 async function hasRequiredRuntimePlatformDependencies(cacheDir, metadata, postgresVersionProbe, deadline) {
+  if (omitOptionalRuntimeDependencies()) return hasRequiredRuntimeNativeDependencies(cacheDir);
   if (!await canResolveRuntimePackage(cacheDir, EMBEDDED_POSTGRES_PACKAGE_NAME)) return true;
   const platformPackage = resolveEmbeddedPostgresPlatformPackage();
   if (!platformPackage) return true;
   if (await canResolveRuntimePackage(cacheDir, platformPackage)) return true;
   const expectedSharedBinDir = resolveSharedRuntimePostgresPayloadBinDir(
-    path10.dirname(path10.dirname(cacheDir))
+    path11.dirname(path11.dirname(cacheDir))
   );
-  return metadata.postgresRuntime?.scope === "shared" && metadata.postgresRuntime.platform === process.platform && metadata.postgresRuntime.arch === process.arch && path10.resolve(metadata.postgresRuntime.binDir) === path10.resolve(expectedSharedBinDir) && await isRuntimePostgresPayloadUsable(
+  return metadata.postgresRuntime?.scope === "shared" && metadata.postgresRuntime.platform === process.platform && metadata.postgresRuntime.arch === process.arch && path11.resolve(metadata.postgresRuntime.binDir) === path11.resolve(expectedSharedBinDir) && await isRuntimePostgresPayloadUsable(
     cacheDir,
     metadata.postgresRuntime.binDir,
     postgresVersionProbe,
@@ -22592,8 +22845,8 @@ async function isRuntimeCacheHitWithinDeadline(options, deadline) {
     return false;
   }
   try {
-    const packageJsonPath = path10.join(options.cacheDir, "node_modules", ...packageName.split("/"), "package.json");
-    const packageJson = JSON.parse(await readFile(packageJsonPath, "utf8"));
+    const packageJsonPath = path11.join(options.cacheDir, "node_modules", ...packageName.split("/"), "package.json");
+    const packageJson = JSON.parse(await readFile2(packageJsonPath, "utf8"));
     const packageVersionMatches = packageVersion === "latest" || packageJson.version === packageVersion;
     return packageVersionMatches && await hasRequiredRuntimePlatformDependencies(
       options.cacheDir,
@@ -22612,7 +22865,7 @@ async function ensureRuntimeInstalled(options) {
   const cacheDir = resolveRuntimeCacheDir(packageVersion, homeDir);
   const deadline = createRuntimeInstallDeadline(options);
   return withRuntimeFilesystemLock(
-    path10.join(homeDir, "runtime-payloads", ".postgres-runtime.lifecycle.lock"),
+    path11.join(homeDir, "runtime-payloads", ".postgres-runtime.lifecycle.lock"),
     async () => withRuntimeFilesystemLock(
       `${cacheDir}.install.lock`,
       async () => {
@@ -22635,7 +22888,7 @@ async function ensureRuntimeInstalled(options) {
   );
 }
 function scheduleIncompleteRuntimeCacheCleanup(options) {
-  const remove = options.remove ?? ((cacheDir) => rm(cacheDir, { recursive: true, force: true }));
+  const remove = options.remove ?? ((cacheDir) => rm2(cacheDir, { recursive: true, force: true }));
   void withRuntimeFilesystemLock(
     `${options.cacheDir}.install.lock`,
     async () => {
@@ -22733,12 +22986,12 @@ async function ensureRuntimeInstalledUnlocked(options, deadline) {
       postgresPayload2
     );
   }
-  await rm(cacheDir, { recursive: true, force: true });
-  await mkdir(cacheDir, { recursive: true });
-  await writeFile(path10.join(cacheDir, "package.json"), `${JSON.stringify(RUNTIME_CACHE_PACKAGE_JSON, null, 2)}
+  await rm2(cacheDir, { recursive: true, force: true });
+  await mkdir2(cacheDir, { recursive: true });
+  await writeFile(path11.join(cacheDir, "package.json"), `${JSON.stringify(RUNTIME_CACHE_PACKAGE_JSON, null, 2)}
 `, "utf8");
   const result = runNpmRuntimeInstall(spawnSyncImpl, cacheDir, packageSpec, deadline);
-  let output = collectSpawnOutput(result);
+  let output = collectSpawnOutput2(result);
   if (result.status !== 0 && packageVersion !== "latest" && options.allowLatestFallback !== false && isVersionNotFoundError(output)) {
     const fallbackVersion = "latest";
     const fallbackCacheDir = resolveRuntimeCacheDir(fallbackVersion, options.homeDir);
@@ -22773,16 +23026,17 @@ async function ensureRuntimeInstalledUnlocked(options, deadline) {
             fallbackPostgresPayload
           );
         }
-        await rm(fallbackCacheDir, { recursive: true, force: true });
-        await mkdir(fallbackCacheDir, { recursive: true });
-        await writeFile(path10.join(fallbackCacheDir, "package.json"), `${JSON.stringify(RUNTIME_CACHE_PACKAGE_JSON, null, 2)}
+        await rm2(fallbackCacheDir, { recursive: true, force: true });
+        await mkdir2(fallbackCacheDir, { recursive: true });
+        await writeFile(path11.join(fallbackCacheDir, "package.json"), `${JSON.stringify(RUNTIME_CACHE_PACKAGE_JSON, null, 2)}
 `, "utf8");
         const fallbackResult = runNpmRuntimeInstall(spawnSyncImpl, fallbackCacheDir, fallbackSpec, deadline);
-        let fallbackOutput = collectSpawnOutput(fallbackResult);
+        let fallbackOutput = collectSpawnOutput2(fallbackResult);
         if (fallbackResult.status !== 0) return null;
-        fallbackOutput = collectOutputParts(
+        fallbackOutput = collectOutputParts2(
           fallbackOutput,
-          await ensureRequiredEmbeddedPostgresPlatformPackage(spawnSyncImpl, fallbackCacheDir, deadline)
+          await ensureRequiredEmbeddedPostgresPlatformPackage(spawnSyncImpl, fallbackCacheDir, deadline),
+          await ensureRuntimeNativeDependenciesForCache(spawnSyncImpl, fallbackCacheDir, deadline)
         );
         const postgresPayload2 = await stageRuntimePostgresPayload(
           fallbackCacheDir,
@@ -22823,9 +23077,10 @@ async function ensureRuntimeInstalledUnlocked(options, deadline) {
       { cacheDir, command, output }
     );
   }
-  output = collectOutputParts(
+  output = collectOutputParts2(
     output,
-    await ensureRequiredEmbeddedPostgresPlatformPackage(spawnSyncImpl, cacheDir, deadline)
+    await ensureRequiredEmbeddedPostgresPlatformPackage(spawnSyncImpl, cacheDir, deadline),
+    await ensureRuntimeNativeDependenciesForCache(spawnSyncImpl, cacheDir, deadline)
   );
   const postgresPayload = await stageRuntimePostgresPayload(
     cacheDir,
@@ -22857,10 +23112,10 @@ async function ensureRuntimeInstalledUnlocked(options, deadline) {
   );
 }
 function resolveRuntimePostgresPayloadBinDir(cacheDir, platform = process.platform, arch = process.arch) {
-  return path10.join(cacheDir, RUNTIME_POSTGRES_PAYLOAD_DIR, runtimePostgresPlatformSegment(platform, arch), "bin");
+  return path11.join(cacheDir, RUNTIME_POSTGRES_PAYLOAD_DIR, runtimePostgresPlatformSegment(platform, arch), "bin");
 }
 function resolveSharedRuntimePostgresPayloadBinDir(homeDir = resolveRudderHomeDir(), platform = process.platform, arch = process.arch) {
-  return path10.join(
+  return path11.join(
     homeDir,
     "runtime-payloads",
     RUNTIME_POSTGRES_PAYLOAD_DIR,
@@ -22869,7 +23124,7 @@ function resolveSharedRuntimePostgresPayloadBinDir(homeDir = resolveRudderHomeDi
   );
 }
 function resolveRuntimeServerEntrypoint(cacheDir, packageName = RUNTIME_NPM_PACKAGE_NAME) {
-  return createRequire(path10.join(cacheDir, "package.json")).resolve(packageName);
+  return createRequire(path11.join(cacheDir, "package.json")).resolve(packageName);
 }
 async function importRuntimeServerModule(cacheDir, packageName = RUNTIME_NPM_PACKAGE_NAME) {
   const entrypoint = resolveRuntimeServerEntrypoint(cacheDir, packageName);
@@ -22880,7 +23135,7 @@ function runNpmRuntimeInstall(spawnSyncImpl, cacheDir, packageSpec, deadline) {
   const npm = resolveNpmCommandInvocation();
   return spawnSyncImpl(
     npm.command,
-    [...npm.args, "install", "--prefix", cacheDir, ...RUNTIME_NPM_INSTALL_FLAGS, packageSpec],
+    [...npm.args, "install", "--prefix", cacheDir, ...runtimeNpmInstallFlags(), packageSpec],
     {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"],
@@ -22890,35 +23145,25 @@ function runNpmRuntimeInstall(spawnSyncImpl, cacheDir, packageSpec, deadline) {
   );
 }
 function formatRuntimeInstallCommand(cacheDir, packageSpec) {
-  return `npm install --prefix ${cacheDir} ${RUNTIME_NPM_INSTALL_FLAGS.join(" ")} ${packageSpec}`;
+  return `npm install --prefix ${cacheDir} ${runtimeNpmInstallFlags().join(" ")} ${packageSpec}`;
 }
-function formatRuntimePlatformRepairCommand(cacheDir, packageSpec) {
-  return `npm pack ${packageSpec} --registry=${NPM_PUBLIC_REGISTRY_URL} --silent, then extract it into ${path10.join(cacheDir, "node_modules")}`;
+function formatRuntimePlatformRepairCommand2(cacheDir, packageSpec) {
+  return `npm pack ${packageSpec} --registry=${NPM_PUBLIC_REGISTRY_URL2} --silent, then extract it into ${path11.join(cacheDir, "node_modules")}`;
 }
-function collectSpawnOutput(result) {
+function collectSpawnOutput2(result) {
   return [result.stdout, result.stderr, result.error instanceof Error ? result.error.message : null].filter((value) => typeof value === "string" && value.trim().length > 0).join("\n").trim();
 }
-function collectOutputParts(...parts) {
+function collectOutputParts2(...parts) {
   return parts.filter((part) => part.trim().length > 0).join("\n").trim();
 }
 function withPostgresPayload(result, postgresPayload) {
   return {
     ...result,
-    output: collectOutputParts(result.output, postgresPayload.output),
+    output: collectOutputParts2(result.output, postgresPayload.output),
     ...postgresPayload.binDir ? { postgresPayloadBinDir: postgresPayload.binDir } : {},
     ...postgresPayload.metadata ? { postgresRuntime: postgresPayload.metadata } : {}
   };
 }
-function runtimePackageJsonPath(cacheDir, packageName) {
-  return path10.join(cacheDir, "node_modules", ...packageName.split("/"), "package.json");
-}
-async function readRuntimePackageJson(cacheDir, packageName) {
-  try {
-    return JSON.parse(await readFile(runtimePackageJsonPath(cacheDir, packageName), "utf8"));
-  } catch {
-    return null;
-  }
-}
 async function tryRepairExistingRuntimePackage(options) {
   const runtimePackage = await readRuntimePackageJson(options.cacheDir, options.packageName);
   if (!runtimePackage) return null;
@@ -22928,9 +23173,24 @@ async function tryRepairExistingRuntimePackage(options) {
     options.cacheDir,
     options.deadline
   );
-  if (!await canResolveRuntimePackage(options.cacheDir, EMBEDDED_POSTGRES_PACKAGE_NAME)) return output;
+  const nativeOutput = await ensureRuntimeNativeDependenciesForCache(
+    options.spawnSyncImpl,
+    options.cacheDir,
+    options.deadline
+  );
+  const combinedOutput = collectOutputParts2(output, nativeOutput);
+  if (!await canResolveRuntimePackage(options.cacheDir, EMBEDDED_POSTGRES_PACKAGE_NAME)) return combinedOutput;
   const platformPackage = resolveEmbeddedPostgresPlatformPackage();
-  return !platformPackage || await canResolveRuntimePackage(options.cacheDir, platformPackage) ? output : null;
+  return !platformPackage || await canResolveRuntimePackage(options.cacheDir, platformPackage) ? combinedOutput : null;
+}
+async function ensureRuntimeNativeDependenciesForCache(spawnSyncImpl, cacheDir, deadline) {
+  return ensureRuntimeNativeDependencies({
+    spawnSyncImpl,
+    cacheDir,
+    deadline,
+    remainingMs: remainingRuntimeInstallMs,
+    createError: (message, command, output) => new RuntimeInstallError(message, { cacheDir, command, output })
+  });
 }
 async function resolveEmbeddedPostgresPlatformPackageSpec(cacheDir) {
   if (!await canResolveRuntimePackage(cacheDir, EMBEDDED_POSTGRES_PACKAGE_NAME)) return null;
@@ -22942,6 +23202,7 @@ async function resolveEmbeddedPostgresPlatformPackageSpec(cacheDir) {
   return packageVersion ? `${packageName}@${packageVersion}` : packageName;
 }
 async function ensureRequiredEmbeddedPostgresPlatformPackage(spawnSyncImpl, cacheDir, deadline) {
+  if (omitOptionalRuntimeDependencies()) return "";
   const packageSpec = await resolveEmbeddedPostgresPlatformPackageSpec(cacheDir);
   if (!packageSpec) return "";
   const packageName = packageNameFromSpec(packageSpec);
@@ -22952,104 +23213,18 @@ async function ensureRequiredEmbeddedPostgresPlatformPackage(spawnSyncImpl, cach
     cacheDir,
     packageSpec,
     packageName,
-    deadline
+    { cacheDir, deadline, remainingMs: remainingRuntimeInstallMs }
   );
-  const output = collectSpawnOutput(result);
+  const output = collectSpawnOutput2(result);
   if (result.status === 0 && packageName && await canResolveRuntimePackage(cacheDir, packageName)) {
     return output;
   }
-  const command = formatRuntimePlatformRepairCommand(cacheDir, packageSpec);
+  const command = formatRuntimePlatformRepairCommand2(cacheDir, packageSpec);
   throw new RuntimeInstallError(
     `Rudder runtime installation is missing required platform package ${packageName || packageSpec}. Re-run manually: ${command}`,
     { cacheDir, command, output }
   );
 }
-async function installRuntimePackageInStaging(spawnSyncImpl, cacheDir, packageSpec, packageName, deadline) {
-  const stagingDir = path10.join(cacheDir, `.platform-repair-${process.pid}-${Date.now()}`);
-  await mkdir(stagingDir, { recursive: true });
-  try {
-    const packResult = runNpmPack(spawnSyncImpl, packageSpec, stagingDir, cacheDir, deadline);
-    if (packResult.status !== 0) return packResult;
-    const packFilename = parseNpmPackFilename(packResult.stdout);
-    if (!packFilename) {
-      return createSyntheticSpawnResult(1, "", `Unable to parse npm pack output for ${packageSpec}.`);
-    }
-    const archivePath = path10.join(stagingDir, packFilename);
-    const targetDir = path10.dirname(runtimePackageJsonPath(cacheDir, packageName));
-    await mkdir(path10.dirname(targetDir), { recursive: true });
-    await rm(targetDir, { recursive: true, force: true });
-    await mkdir(targetDir, { recursive: true });
-    const extractResult = runTarExtract(spawnSyncImpl, archivePath, targetDir, cacheDir, deadline);
-    return combineSpawnResults(packResult, extractResult);
-  } finally {
-    await rm(stagingDir, { recursive: true, force: true });
-  }
-}
-function runNpmPack(spawnSyncImpl, packageSpec, destinationDir, cacheDir, deadline) {
-  const timeout = remainingRuntimeInstallMs(deadline, cacheDir, `npm pack ${packageSpec}`);
-  const npm = resolveNpmCommandInvocation();
-  return spawnSyncImpl(
-    npm.command,
-    [...npm.args, "pack", packageSpec, "--pack-destination", destinationDir, ...RUNTIME_NPM_PACK_FLAGS],
-    {
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "pipe"],
-      env: { ...process.env, ...NPM_PLATFORM_REPAIR_ENV },
-      ...timeout === void 0 ? {} : { timeout },
-      ...process.platform === "win32" ? { windowsHide: true } : {}
-    }
-  );
-}
-function runTarExtract(spawnSyncImpl, archivePath, targetDir, cacheDir, deadline) {
-  const timeout = remainingRuntimeInstallMs(deadline, cacheDir, "extract runtime platform package");
-  return spawnSyncImpl(
-    "tar",
-    ["-xzf", archivePath, "-C", targetDir, "--strip-components", "1"],
-    {
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "pipe"],
-      ...timeout === void 0 ? {} : { timeout },
-      ...process.platform === "win32" ? { windowsHide: true } : {}
-    }
-  );
-}
-function parseNpmPackFilename(stdout) {
-  if (typeof stdout !== "string") return null;
-  const filename = stdout.trim().split(/\r?\n/).filter(Boolean).at(-1);
-  return filename?.endsWith(".tgz") ? filename : null;
-}
-function createSyntheticSpawnResult(status, stdout, stderr) {
-  return { status, stdout, stderr };
-}
-function combineSpawnResults(...results) {
-  const last = results.at(-1);
-  return {
-    status: last?.status ?? 0,
-    stdout: results.map((result) => result.stdout).filter(Boolean).join("\n"),
-    stderr: results.map((result) => result.stderr).filter(Boolean).join("\n"),
-    error: results.find((result) => result.error)?.error
-  };
-}
-async function removeRuntimeInstallLocks(cacheDir) {
-  await Promise.all([
-    rm(path10.join(cacheDir, "package-lock.json"), { force: true }),
-    rm(path10.join(cacheDir, "node_modules", ".package-lock.json"), { force: true })
-  ]);
-}
-function packageNameFromSpec(packageSpec) {
-  if (!packageSpec.startsWith("@")) {
-    const versionSeparator2 = packageSpec.indexOf("@");
-    return versionSeparator2 === -1 ? packageSpec : packageSpec.slice(0, versionSeparator2);
-  }
-  const versionSeparator = packageSpec.indexOf("@", 1);
-  return versionSeparator === -1 ? packageSpec : packageSpec.slice(0, versionSeparator);
-}
-function normalizeOptionalDependencyVersion(versionRange) {
-  const trimmed = versionRange?.trim();
-  if (!trimmed) return null;
-  const exactVersion = /^[~^]\s*([0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?)$/.exec(trimmed);
-  return exactVersion?.[1] ?? trimmed;
-}
 function runtimePostgresPlatformSegment(platform = process.platform, arch = process.arch) {
   return `${platform}-${arch}`;
 }
@@ -23057,25 +23232,25 @@ function runtimePostgresExecutableName(baseName) {
   return process.platform === "win32" ? `${baseName}.exe` : baseName;
 }
 function debianSharedirCandidate(binDir) {
-  const normalized = path10.resolve(binDir);
-  const parts = normalized.split(path10.sep);
+  const normalized = path11.resolve(binDir);
+  const parts = normalized.split(path11.sep);
   const libIndex = parts.lastIndexOf("lib");
   if (libIndex < 0) return null;
   if (parts[libIndex + 1] !== "postgresql") return null;
   const version = parts[libIndex + 2];
   if (!version || parts[libIndex + 3] !== "bin") return null;
-  const prefix = parts.slice(0, libIndex).join(path10.sep) || path10.sep;
-  return path10.join(prefix, "share", "postgresql", version);
+  const prefix = parts.slice(0, libIndex).join(path11.sep) || path11.sep;
+  return path11.join(prefix, "share", "postgresql", version);
 }
 async function resolveRuntimePostgresTemplateDir(binDir, cacheDir = binDir, deadline) {
   for (const candidatePath of [
-    path10.join(binDir, "..", "share", "postgresql", "postgres.bki"),
-    path10.join(binDir, "..", "share", "postgres.bki")
+    path11.join(binDir, "..", "share", "postgresql", "postgres.bki"),
+    path11.join(binDir, "..", "share", "postgres.bki")
   ]) {
     remainingRuntimeInstallMs(deadline, cacheDir, "discover PostgreSQL runtime templates");
     try {
       await stat(candidatePath);
-      return path10.dirname(candidatePath);
+      return path11.dirname(candidatePath);
     } catch {
     }
   }
@@ -23083,12 +23258,12 @@ async function resolveRuntimePostgresTemplateDir(binDir, cacheDir = binDir, dead
   if (debianSharedir) {
     remainingRuntimeInstallMs(deadline, cacheDir, "discover PostgreSQL runtime templates");
     try {
-      await stat(path10.join(debianSharedir, "postgres.bki"));
+      await stat(path11.join(debianSharedir, "postgres.bki"));
       return debianSharedir;
     } catch {
     }
   }
-  const pgConfigPath = path10.join(binDir, process.platform === "win32" ? "pg_config.exe" : "pg_config");
+  const pgConfigPath = path11.join(binDir, process.platform === "win32" ? "pg_config.exe" : "pg_config");
   try {
     remainingRuntimeInstallMs(deadline, cacheDir, "discover PostgreSQL runtime templates");
     await stat(pgConfigPath);
@@ -23107,7 +23282,7 @@ async function resolveRuntimePostgresTemplateDir(binDir, cacheDir = binDir, dead
     }
     if (!sharedir) return null;
     remainingRuntimeInstallMs(deadline, cacheDir, "validate PostgreSQL runtime templates");
-    const candidatePath = path10.join(sharedir, "postgres.bki");
+    const candidatePath = path11.join(sharedir, "postgres.bki");
     await stat(candidatePath);
     return sharedir;
   } catch (error) {
@@ -23116,7 +23291,7 @@ async function resolveRuntimePostgresTemplateDir(binDir, cacheDir = binDir, dead
   }
 }
 function resolveRuntimePostgresShareDir(binDir, templateDir) {
-  const adjacentShareDir = path10.resolve(binDir, "..", "share");
+  const adjacentShareDir = path11.resolve(binDir, "..", "share");
   return pathIsInside(templateDir, adjacentShareDir) ? adjacentShareDir : templateDir;
 }
 async function assertRuntimePostgresBinDirComplete(cacheDir, binDir, deadline) {
@@ -23124,7 +23299,7 @@ async function assertRuntimePostgresBinDirComplete(cacheDir, binDir, deadline) {
   const missing = [];
   for (const binary of requiredBinaries) {
     remainingRuntimeInstallMs(deadline, cacheDir, "validate PostgreSQL runtime binaries");
-    const binaryPath = path10.join(binDir, runtimePostgresExecutableName(binary));
+    const binaryPath = path11.join(binDir, runtimePostgresExecutableName(binary));
     try {
       await stat(binaryPath);
     } catch {
@@ -23133,19 +23308,19 @@ async function assertRuntimePostgresBinDirComplete(cacheDir, binDir, deadline) {
   }
   const templateDir = await resolveRuntimePostgresTemplateDir(binDir, cacheDir, deadline);
   if (!templateDir) {
-    missing.push(path10.join(binDir, "..", "share", "postgresql", "postgres.bki"));
+    missing.push(path11.join(binDir, "..", "share", "postgresql", "postgres.bki"));
   } else {
     try {
-      await stat(path10.join(templateDir, "postgresql.conf.sample"));
+      await stat(path11.join(templateDir, "postgresql.conf.sample"));
     } catch {
-      missing.push(path10.join(templateDir, "postgresql.conf.sample"));
+      missing.push(path11.join(templateDir, "postgresql.conf.sample"));
     }
     const shareDir = resolveRuntimePostgresShareDir(binDir, templateDir);
     const hasTimezoneDir = (await Promise.all([
-      path10.join(templateDir, "timezone"),
-      path10.join(shareDir, "timezone")
+      path11.join(templateDir, "timezone"),
+      path11.join(shareDir, "timezone")
     ].map((candidate) => stat(candidate).catch(() => null)))).some((candidate) => candidate?.isDirectory());
-    if (!hasTimezoneDir) missing.push(path10.join(shareDir, "timezone"));
+    if (!hasTimezoneDir) missing.push(path11.join(shareDir, "timezone"));
   }
   if (missing.length > 0) {
     throw new RuntimeInstallError(
@@ -23170,8 +23345,8 @@ async function isRuntimePostgresPayloadUsable(cacheDir, binDir, postgresVersionP
   }
 }
 function pathIsInside(candidatePath, rootPath) {
-  const relative = path10.relative(path10.resolve(rootPath), path10.resolve(candidatePath));
-  return relative === "" || relative !== ".." && !relative.startsWith(`..${path10.sep}`) && !path10.isAbsolute(relative);
+  const relative = path11.relative(path11.resolve(rootPath), path11.resolve(candidatePath));
+  return relative === "" || relative !== ".." && !relative.startsWith(`..${path11.sep}`) && !path11.isAbsolute(relative);
 }
 async function copyRuntimePayloadEntry(sourcePath, targetPath, cacheDir, deadline, signal, command) {
   if (signal.aborted) throw runtimeInstallDeadlineError(cacheDir, command);
@@ -23180,12 +23355,12 @@ async function copyRuntimePayloadEntry(sourcePath, targetPath, cacheDir, deadlin
   if (signal.aborted) throw runtimeInstallDeadlineError(cacheDir, command);
   remainingRuntimeInstallMs(deadline, cacheDir, command);
   if (sourceStats.isDirectory()) {
-    await mkdir(targetPath, { recursive: true });
+    await mkdir2(targetPath, { recursive: true });
     const entries = await readdir(sourcePath);
     for (const entry of entries) {
       await copyRuntimePayloadEntry(
-        path10.join(sourcePath, entry),
-        path10.join(targetPath, entry),
+        path11.join(sourcePath, entry),
+        path11.join(targetPath, entry),
         cacheDir,
         deadline,
         signal,
@@ -23195,7 +23370,7 @@ async function copyRuntimePayloadEntry(sourcePath, targetPath, cacheDir, deadlin
     return;
   }
   if (!sourceStats.isFile()) return;
-  await mkdir(path10.dirname(targetPath), { recursive: true });
+  await mkdir2(path11.dirname(targetPath), { recursive: true });
   try {
     await pipeline2(
       createReadStream2(sourcePath),
@@ -23205,7 +23380,7 @@ async function copyRuntimePayloadEntry(sourcePath, targetPath, cacheDir, deadlin
     await chmod(targetPath, sourceStats.mode);
     remainingRuntimeInstallMs(deadline, cacheDir, command);
   } catch (error) {
-    await rm(targetPath, { force: true });
+    await rm2(targetPath, { force: true });
     if (signal.aborted || isRuntimeInstallDeadlineError(error)) {
       throw runtimeInstallDeadlineError(cacheDir, command);
     }
@@ -23227,13 +23402,13 @@ async function copyRuntimePostgresPayloadWithinDeadline(sourceRuntimeDir, target
     }, timeoutMs);
   });
   const copyPromise = (async () => {
-    await mkdir(targetRuntimeDir, { recursive: true });
+    await mkdir2(targetRuntimeDir, { recursive: true });
     for (const directoryName of ["bin", "lib"]) {
-      const sourceDirectory = path10.join(sourceRuntimeDir, directoryName);
+      const sourceDirectory = path11.join(sourceRuntimeDir, directoryName);
       if (!await stat(sourceDirectory).catch(() => null)) continue;
       await copyRuntimePayloadEntry(
         sourceDirectory,
-        path10.join(targetRuntimeDir, directoryName),
+        path11.join(targetRuntimeDir, directoryName),
         cacheDir,
         deadline,
         controller.signal,
@@ -23242,7 +23417,7 @@ async function copyRuntimePostgresPayloadWithinDeadline(sourceRuntimeDir, target
     }
     await copyRuntimePayloadEntry(
       sourceShareDir,
-      path10.join(targetRuntimeDir, "share"),
+      path11.join(targetRuntimeDir, "share"),
       cacheDir,
       deadline,
       controller.signal,
@@ -23260,18 +23435,18 @@ async function copyRuntimePostgresPayloadWithinDeadline(sourceRuntimeDir, target
 async function withRuntimeFilesystemLock(lockPath, task, options = {}) {
   const deadlineTimeout = remainingRuntimeInstallMs(
     options.deadline,
-    options.cacheDir ?? path10.dirname(lockPath),
+    options.cacheDir ?? path11.dirname(lockPath),
     options.command ?? `wait for runtime lock ${lockPath}`
   );
   const timeoutMs = Math.min(options.timeoutMs ?? 3e4, deadlineTimeout ?? Number.POSITIVE_INFINITY);
   const pollMs = options.pollMs ?? 50;
   const startedAt = Date.now();
   const lockId = `${process.pid}-${startedAt}-${Math.random().toString(16).slice(2)}`;
-  const ownerPath = path10.join(lockPath, "owner.json");
-  await mkdir(path10.dirname(lockPath), { recursive: true });
+  const ownerPath = path11.join(lockPath, "owner.json");
+  await mkdir2(path11.dirname(lockPath), { recursive: true });
   while (true) {
     try {
-      await mkdir(lockPath);
+      await mkdir2(lockPath);
       await writeFile(
         ownerPath,
         `${JSON.stringify({ pid: process.pid, lockId, createdAt: (/* @__PURE__ */ new Date()).toISOString() })}
@@ -23282,27 +23457,27 @@ async function withRuntimeFilesystemLock(lockPath, task, options = {}) {
     } catch (error) {
       if (error.code !== "EEXIST") throw error;
       try {
-        const existing = JSON.parse(await readFile(ownerPath, "utf8"));
+        const existing = JSON.parse(await readFile2(ownerPath, "utf8"));
         if (typeof existing.pid !== "number" || !isPidRunning(existing.pid)) {
-          await rm(lockPath, { recursive: true, force: true });
+          await rm2(lockPath, { recursive: true, force: true });
           continue;
         }
       } catch {
         const lockStats = await stat(lockPath).catch(() => null);
         if (lockStats && Date.now() - lockStats.mtimeMs > 5e3) {
-          await rm(lockPath, { recursive: true, force: true });
+          await rm2(lockPath, { recursive: true, force: true });
           continue;
         }
       }
       if (Date.now() - startedAt >= timeoutMs) {
         throw new RuntimeInstallError(
           `Timed out waiting for PostgreSQL runtime install lock ${lockPath}`,
-          { cacheDir: path10.dirname(lockPath), command: "prepare shared PostgreSQL runtime", output: "" }
+          { cacheDir: path11.dirname(lockPath), command: "prepare shared PostgreSQL runtime", output: "" }
         );
       }
       remainingRuntimeInstallMs(
         options.deadline,
-        options.cacheDir ?? path10.dirname(lockPath),
+        options.cacheDir ?? path11.dirname(lockPath),
         options.command ?? `wait for runtime lock ${lockPath}`
       );
       await new Promise((resolve) => setTimeout(resolve, pollMs));
@@ -23312,9 +23487,9 @@ async function withRuntimeFilesystemLock(lockPath, task, options = {}) {
     return await task();
   } finally {
     try {
-      const existing = JSON.parse(await readFile(ownerPath, "utf8"));
+      const existing = JSON.parse(await readFile2(ownerPath, "utf8"));
       if (existing.lockId === lockId) {
-        await rm(lockPath, { recursive: true, force: true });
+        await rm2(lockPath, { recursive: true, force: true });
       }
     } catch {
     }
@@ -23322,29 +23497,29 @@ async function withRuntimeFilesystemLock(lockPath, task, options = {}) {
 }
 function isManagedRuntimePostgresBinDir(binDir, homeDir) {
   const managedBinDir = process.env[RUDDER_DESKTOP_MANAGED_POSTGRES_BIN_DIR_ENV]?.trim();
-  if (managedBinDir && path10.resolve(managedBinDir) === path10.resolve(binDir)) return true;
-  const runtimesRelative = path10.relative(
-    path10.join(homeDir, "runtimes"),
-    path10.resolve(binDir)
+  if (managedBinDir && path11.resolve(managedBinDir) === path11.resolve(binDir)) return true;
+  const runtimesRelative = path11.relative(
+    path11.join(homeDir, "runtimes"),
+    path11.resolve(binDir)
   );
-  const runtimeSegments = runtimesRelative.split(path10.sep);
-  if (runtimesRelative !== "" && runtimesRelative !== ".." && !runtimesRelative.startsWith(`..${path10.sep}`) && !path10.isAbsolute(runtimesRelative) && runtimeSegments.length === 4 && runtimeSegments[0]?.length > 0 && runtimeSegments[1] === RUNTIME_POSTGRES_PAYLOAD_DIR && runtimeSegments[2] === `${process.platform}-${process.arch}` && runtimeSegments[3] === "bin") {
+  const runtimeSegments = runtimesRelative.split(path11.sep);
+  if (runtimesRelative !== "" && runtimesRelative !== ".." && !runtimesRelative.startsWith(`..${path11.sep}`) && !path11.isAbsolute(runtimesRelative) && runtimeSegments.length === 4 && runtimeSegments[0]?.length > 0 && runtimeSegments[1] === RUNTIME_POSTGRES_PAYLOAD_DIR && runtimeSegments[2] === `${process.platform}-${process.arch}` && runtimeSegments[3] === "bin") {
     return true;
   }
-  const payloadsRelative = path10.relative(
-    path10.join(homeDir, "runtime-payloads"),
-    path10.resolve(binDir)
+  const payloadsRelative = path11.relative(
+    path11.join(homeDir, "runtime-payloads"),
+    path11.resolve(binDir)
   );
-  const payloadSegments = payloadsRelative.split(path10.sep);
-  return payloadsRelative !== "" && payloadsRelative !== ".." && !payloadsRelative.startsWith(`..${path10.sep}`) && !path10.isAbsolute(payloadsRelative) && payloadSegments.length === 3 && payloadSegments[0] === RUNTIME_POSTGRES_PAYLOAD_DIR && payloadSegments[1] === `${process.platform}-${process.arch}` && payloadSegments[2] === "bin";
+  const payloadSegments = payloadsRelative.split(path11.sep);
+  return payloadsRelative !== "" && payloadsRelative !== ".." && !payloadsRelative.startsWith(`..${path11.sep}`) && !path11.isAbsolute(payloadsRelative) && payloadSegments.length === 3 && payloadSegments[0] === RUNTIME_POSTGRES_PAYLOAD_DIR && payloadSegments[1] === `${process.platform}-${process.arch}` && payloadSegments[2] === "bin";
 }
 async function findLegacyRuntimePostgresBinDir(cacheDir, homeDir, postgresVersionProbe, deadline) {
-  const runtimesRoot = path10.join(homeDir, "runtimes");
+  const runtimesRoot = path11.join(homeDir, "runtimes");
   const entries = await readdir(runtimesRoot, { withFileTypes: true }).catch(() => []);
   for (const entry of entries) {
     if (!entry.isDirectory() && !entry.isSymbolicLink()) continue;
-    const candidateCacheDir = path10.join(runtimesRoot, entry.name);
-    if (path10.resolve(candidateCacheDir) === path10.resolve(cacheDir)) continue;
+    const candidateCacheDir = path11.join(runtimesRoot, entry.name);
+    if (path11.resolve(candidateCacheDir) === path11.resolve(cacheDir)) continue;
     const candidateBinDir = resolveRuntimePostgresPayloadBinDir(candidateCacheDir);
     remainingRuntimeInstallMs(deadline, cacheDir, "find cached PostgreSQL runtime payload");
     if (await isRuntimePostgresPayloadUsable(cacheDir, candidateBinDir, postgresVersionProbe, deadline)) {
@@ -23354,13 +23529,13 @@ async function findLegacyRuntimePostgresBinDir(cacheDir, homeDir, postgresVersio
   return null;
 }
 async function readLiveRuntimeDescriptors(homeDir) {
-  const instancesRoot = path10.join(homeDir, "instances");
+  const instancesRoot = path11.join(homeDir, "instances");
   const entries = await readdir(instancesRoot, { withFileTypes: true }).catch(() => []);
   const descriptors = [];
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
     try {
-      const raw = JSON.parse(await readFile(path10.join(instancesRoot, entry.name, "runtime", "server.json"), "utf8"));
+      const raw = JSON.parse(await readFile2(path11.join(instancesRoot, entry.name, "runtime", "server.json"), "utf8"));
       if (typeof raw.pid !== "number" || !Number.isInteger(raw.pid) || !isPidRunning(raw.pid) || typeof raw.version !== "string") {
         continue;
       }
@@ -23378,13 +23553,13 @@ async function assertSharedPostgresPayloadNotLive(cacheDir, homeDir, sharedBinDi
   const sharedPhysicalBinDir = await realpath(sharedBinDir).catch(() => null);
   const mayReferenceSharedPayload = await Promise.all(liveDescriptors.map(async (descriptor) => {
     if (descriptor.postgresBinDir === void 0) return true;
-    if (path10.resolve(descriptor.postgresBinDir) === path10.resolve(sharedBinDir)) return true;
+    if (path11.resolve(descriptor.postgresBinDir) === path11.resolve(sharedBinDir)) return true;
     const descriptorPhysicalBinDir = await realpath(descriptor.postgresBinDir).catch(() => null);
-    if (descriptorPhysicalBinDir && sharedPhysicalBinDir && path10.resolve(descriptorPhysicalBinDir) === path10.resolve(sharedPhysicalBinDir)) {
+    if (descriptorPhysicalBinDir && sharedPhysicalBinDir && path11.resolve(descriptorPhysicalBinDir) === path11.resolve(sharedPhysicalBinDir)) {
       return true;
     }
     if (!descriptorPhysicalBinDir) {
-      return pathIsInside(descriptor.postgresBinDir, path10.join(homeDir, "runtimes")) || pathIsInside(descriptor.postgresBinDir, path10.join(homeDir, "runtime-payloads"));
+      return pathIsInside(descriptor.postgresBinDir, path11.join(homeDir, "runtimes")) || pathIsInside(descriptor.postgresBinDir, path11.join(homeDir, "runtime-payloads"));
     }
     return false;
   }));
@@ -23399,7 +23574,7 @@ async function validateRuntimePostgresVersion(cacheDir, binDir, postgresVersionP
   await assertRuntimePostgresBinDirComplete(cacheDir, binDir, deadline);
   for (const binary of ["initdb", "pg_ctl", "postgres"]) {
     remainingRuntimeInstallMs(deadline, cacheDir, "validate PostgreSQL runtime version");
-    const binaryPath = path10.join(binDir, runtimePostgresExecutableName(binary));
+    const binaryPath = path11.join(binDir, runtimePostgresExecutableName(binary));
     const result = postgresVersionProbe(binaryPath);
     if (!/\bPostgreSQL\)?\s+18\.4\b/i.test(result)) {
       throw new RuntimeInstallError(
@@ -23439,24 +23614,24 @@ async function findRuntimePostgresBinDir(rootDir, cacheDir, postgresVersionProbe
     if (await isRuntimePostgresPayloadUsable(cacheDir, current, postgresVersionProbe, deadline)) return current;
     const entries = await readdir(current, { withFileTypes: true }).catch(() => []);
     for (const entry of entries) {
-      if (entry.isDirectory()) queue.push(path10.join(current, entry.name));
+      if (entry.isDirectory()) queue.push(path11.join(current, entry.name));
     }
   }
   return null;
 }
 async function reconcileSharedPostgresPayloadGenerations(cacheDir, sharedPlatformRoot, postgresVersionProbe, cleanupDownloads = false, deadline) {
   remainingRuntimeInstallMs(deadline, cacheDir, "reconcile shared PostgreSQL payload");
-  const parentDir = path10.dirname(sharedPlatformRoot);
-  const baseName = path10.basename(sharedPlatformRoot);
+  const parentDir = path11.dirname(sharedPlatformRoot);
+  const baseName = path11.basename(sharedPlatformRoot);
   const entries = await readdir(parentDir, { withFileTypes: true }).catch(() => []);
-  const temporaryRoots = entries.filter((entry) => entry.name.startsWith(`${baseName}.tmp-`)).map((entry) => path10.join(parentDir, entry.name));
-  const previousRoots = entries.filter((entry) => entry.name.startsWith(`${baseName}.previous-`)).map((entry) => path10.join(parentDir, entry.name)).sort().reverse();
-  const downloadsRoot = path10.join(
-    path10.dirname(path10.dirname(sharedPlatformRoot)),
+  const temporaryRoots = entries.filter((entry) => entry.name.startsWith(`${baseName}.tmp-`)).map((entry) => path11.join(parentDir, entry.name));
+  const previousRoots = entries.filter((entry) => entry.name.startsWith(`${baseName}.previous-`)).map((entry) => path11.join(parentDir, entry.name)).sort().reverse();
+  const downloadsRoot = path11.join(
+    path11.dirname(path11.dirname(sharedPlatformRoot)),
     ".downloads"
   );
-  const staleDownloadRoots = cleanupDownloads ? (await readdir(downloadsRoot, { withFileTypes: true }).catch(() => [])).filter((entry) => entry.name.startsWith("postgres-18.4-")).map((entry) => path10.join(downloadsRoot, entry.name)) : [];
-  const canonicalBinDir = path10.join(sharedPlatformRoot, "bin");
+  const staleDownloadRoots = cleanupDownloads ? (await readdir(downloadsRoot, { withFileTypes: true }).catch(() => [])).filter((entry) => entry.name.startsWith("postgres-18.4-")).map((entry) => path11.join(downloadsRoot, entry.name)) : [];
+  const canonicalBinDir = path11.join(sharedPlatformRoot, "bin");
   if (!await isRuntimePostgresPayloadUsable(
     cacheDir,
     canonicalBinDir,
@@ -23466,28 +23641,28 @@ async function reconcileSharedPostgresPayloadGenerations(cacheDir, sharedPlatfor
     for (const previousRoot of previousRoots) {
       if (!await isRuntimePostgresPayloadUsable(
         cacheDir,
-        path10.join(previousRoot, "bin"),
+        path11.join(previousRoot, "bin"),
         postgresVersionProbe,
         deadline
       )) {
         continue;
       }
-      await rm(sharedPlatformRoot, { recursive: true, force: true });
+      await rm2(sharedPlatformRoot, { recursive: true, force: true });
       await rename(previousRoot, sharedPlatformRoot);
       break;
     }
   }
   await Promise.all([
-    ...temporaryRoots.map((candidate) => rm(candidate, { recursive: true, force: true })),
-    ...previousRoots.map((candidate) => rm(candidate, { recursive: true, force: true })),
-    ...staleDownloadRoots.map((candidate) => rm(candidate, { recursive: true, force: true }))
+    ...temporaryRoots.map((candidate) => rm2(candidate, { recursive: true, force: true })),
+    ...previousRoots.map((candidate) => rm2(candidate, { recursive: true, force: true })),
+    ...staleDownloadRoots.map((candidate) => rm2(candidate, { recursive: true, force: true }))
   ]);
 }
 async function installSharedRuntimePostgresPayload(cacheDir, homeDir, sourceBinDir, postgresVersionProbe, deadline) {
   const sharedBinDir = resolveSharedRuntimePostgresPayloadBinDir(homeDir);
-  const sharedRuntimeDir = path10.dirname(sharedBinDir);
+  const sharedRuntimeDir = path11.dirname(sharedBinDir);
   const sharedPlatformRoot = sharedRuntimeDir;
-  const sourceRuntimeDir = path10.dirname(sourceBinDir);
+  const sourceRuntimeDir = path11.dirname(sourceBinDir);
   const sourceTemplateDir = await resolveRuntimePostgresTemplateDir(sourceBinDir, cacheDir, deadline);
   if (!sourceTemplateDir) {
     throw new RuntimeInstallError(
@@ -23508,13 +23683,13 @@ async function installSharedRuntimePostgresPayload(cacheDir, homeDir, sourceBinD
       return sharedBinDir;
     }
     await assertSharedPostgresPayloadNotLive(cacheDir, homeDir, sharedBinDir);
-    await mkdir(path10.dirname(sharedPlatformRoot), { recursive: true });
+    await mkdir2(path11.dirname(sharedPlatformRoot), { recursive: true });
     const temporaryPlatformRoot = `${sharedPlatformRoot}.tmp-${process.pid}-${Date.now()}`;
     const previousPlatformRoot = `${sharedPlatformRoot}.previous-${process.pid}-${Date.now()}`;
     let previousMoved = false;
     let published = false;
-    await rm(temporaryPlatformRoot, { recursive: true, force: true });
-    await rm(previousPlatformRoot, { recursive: true, force: true });
+    await rm2(temporaryPlatformRoot, { recursive: true, force: true });
+    await rm2(previousPlatformRoot, { recursive: true, force: true });
     try {
       const temporaryRuntimeDir = temporaryPlatformRoot;
       const sourceShareDir = resolveRuntimePostgresShareDir(sourceBinDir, sourceTemplateDir);
@@ -23525,7 +23700,7 @@ async function installSharedRuntimePostgresPayload(cacheDir, homeDir, sourceBinD
         cacheDir,
         deadline
       );
-      const temporaryBinDir = path10.join(temporaryRuntimeDir, "bin");
+      const temporaryBinDir = path11.join(temporaryRuntimeDir, "bin");
       await validateRuntimePostgresVersion(cacheDir, temporaryBinDir, postgresVersionProbe, deadline);
       try {
         await rename(sharedPlatformRoot, previousPlatformRoot);
@@ -23544,13 +23719,13 @@ async function installSharedRuntimePostgresPayload(cacheDir, homeDir, sourceBinD
         throw error;
       }
       if (previousMoved) {
-        await rm(previousPlatformRoot, { recursive: true, force: true });
+        await rm2(previousPlatformRoot, { recursive: true, force: true });
         previousMoved = false;
       }
     } finally {
-      await rm(temporaryPlatformRoot, { recursive: true, force: true });
+      await rm2(temporaryPlatformRoot, { recursive: true, force: true });
       if (published || !previousMoved) {
-        await rm(previousPlatformRoot, { recursive: true, force: true });
+        await rm2(previousPlatformRoot, { recursive: true, force: true });
       }
     }
     return sharedBinDir;
@@ -23561,17 +23736,17 @@ async function downloadSharedRuntimePostgresPayload(cacheDir, homeDir, postgresV
   const archiveUrl = archiveSource?.url ?? null;
   if (!archiveUrl) return null;
   const sharedBinDir = resolveSharedRuntimePostgresPayloadBinDir(homeDir);
-  const sharedPlatformRoot = path10.dirname(sharedBinDir);
+  const sharedPlatformRoot = path11.dirname(sharedBinDir);
   const downloadLockPath = `${sharedPlatformRoot}.download.lock`;
   return withRuntimeFilesystemLock(downloadLockPath, async () => {
     if (await isRuntimePostgresPayloadUsable(cacheDir, sharedBinDir, postgresVersionProbe, deadline)) {
       return sharedBinDir;
     }
-    const workRoot = path10.join(homeDir, "runtime-payloads", ".downloads");
-    await mkdir(workRoot, { recursive: true });
-    const workDir = await mkdtemp(path10.join(workRoot, "postgres-18.4-"));
-    const archivePath = path10.join(workDir, "postgresql-18.4.zip");
-    const extractDir = path10.join(workDir, "extract");
+    const workRoot = path11.join(homeDir, "runtime-payloads", ".downloads");
+    await mkdir2(workRoot, { recursive: true });
+    const workDir = await mkdtemp(path11.join(workRoot, "postgres-18.4-"));
+    const archivePath = path11.join(workDir, "postgresql-18.4.zip");
+    const extractDir = path11.join(workDir, "extract");
     try {
       await downloadRuntimePostgresArchive(
         archiveUrl,
@@ -23582,7 +23757,7 @@ async function downloadSharedRuntimePostgresPayload(cacheDir, homeDir, postgresV
       const configuredMaxBytes = Number.parseInt(process.env[RUDDER_POSTGRES_RUNTIME_ARCHIVE_MAX_BYTES_ENV2] ?? "", 10);
       const maxArchiveBytes = Number.isSafeInteger(configuredMaxBytes) && configuredMaxBytes > 0 ? configuredMaxBytes : DEFAULT_RUNTIME_POSTGRES_ARCHIVE_MAX_BYTES2;
       const nativePublishStaging = `${sharedPlatformRoot}.tmp-native-${process.pid}-${Date.now()}`;
-      await mkdir(path10.dirname(sharedPlatformRoot), { recursive: true });
+      await mkdir2(path11.dirname(sharedPlatformRoot), { recursive: true });
       const nativeInstall = await tryInstallNativePayload({
         archivePath,
         extractPath: extractDir,
@@ -23614,22 +23789,22 @@ async function downloadSharedRuntimePostgresPayload(cacheDir, homeDir, postgresV
             );
           }
           await copyRuntimePostgresPayloadWithinDeadline(
-            path10.dirname(extractedBinDir2),
+            path11.dirname(extractedBinDir2),
             publishStagingPath,
             resolveRuntimePostgresShareDir(extractedBinDir2, templateDir),
             cacheDir,
             deadline,
             context.signal
           );
-          return path10.relative(
+          return path11.relative(
             publishStagingPath,
-            path10.join(publishStagingPath, "bin", runtimePostgresExecutableName("postgres"))
+            path11.join(publishStagingPath, "bin", runtimePostgresExecutableName("postgres"))
           );
         },
         validatePublished: async (destinationPath) => {
           await validateRuntimePostgresVersion(
             cacheDir,
-            path10.join(destinationPath, "bin"),
+            path11.join(destinationPath, "bin"),
             postgresVersionProbe,
             deadline
           );
@@ -23638,7 +23813,7 @@ async function downloadSharedRuntimePostgresPayload(cacheDir, homeDir, postgresV
       if (nativeInstall.installed) {
         return sharedBinDir;
       }
-      await mkdir(extractDir, { recursive: true });
+      await mkdir2(extractDir, { recursive: true });
       extractRuntimePostgresArchive(archivePath, extractDir, cacheDir, deadline);
       const extractedBinDir = await findRuntimePostgresBinDir(
         extractDir,
@@ -23660,27 +23835,27 @@ async function downloadSharedRuntimePostgresPayload(cacheDir, homeDir, postgresV
         deadline
       );
     } finally {
-      const cleanup = cleanupWorkDir ?? ((candidate) => rm(candidate, { recursive: true, force: true }));
+      const cleanup = cleanupWorkDir ?? ((candidate) => rm2(candidate, { recursive: true, force: true }));
       void cleanup(workDir).catch(() => {
       });
     }
   }, { deadline, cacheDir, command: "acquire shared PostgreSQL download lock" });
 }
 async function ensureRuntimePostgresCompatibilityLink(cacheDir, homeDir, packageVersion) {
-  const compatibilityRoot = path10.join(cacheDir, RUNTIME_POSTGRES_PAYLOAD_DIR);
-  const sharedPayloadRoot = path10.join(homeDir, "runtime-payloads", RUNTIME_POSTGRES_PAYLOAD_DIR);
+  const compatibilityRoot = path11.join(cacheDir, RUNTIME_POSTGRES_PAYLOAD_DIR);
+  const sharedPayloadRoot = path11.join(homeDir, "runtime-payloads", RUNTIME_POSTGRES_PAYLOAD_DIR);
   const runtimeMetadata = await readRuntimeInstallMetadata(cacheDir);
   const liveDescriptors = await readLiveRuntimeDescriptors(homeDir);
   const compatibilityBinDir = resolveRuntimePostgresPayloadBinDir(cacheDir);
   const isProtected = liveDescriptors.some((descriptor) => descriptor.postgresBinDir && pathIsInside(descriptor.postgresBinDir, compatibilityRoot) || !descriptor.postgresBinDir && descriptor.version === (runtimeMetadata?.packageVersion ?? packageVersion));
   if (isProtected) return;
-  await mkdir(path10.dirname(compatibilityRoot), { recursive: true });
+  await mkdir2(path11.dirname(compatibilityRoot), { recursive: true });
   const temporaryRoot = `${compatibilityRoot}.next-${process.pid}-${Date.now()}`;
   const previousRoot = `${compatibilityRoot}.previous-${process.pid}-${Date.now()}`;
-  await rm(temporaryRoot, { recursive: true, force: true });
-  await rm(previousRoot, { recursive: true, force: true });
+  await rm2(temporaryRoot, { recursive: true, force: true });
+  await rm2(previousRoot, { recursive: true, force: true });
   await symlink(
-    process.platform === "win32" ? sharedPayloadRoot : path10.relative(path10.dirname(compatibilityRoot), sharedPayloadRoot),
+    process.platform === "win32" ? sharedPayloadRoot : path11.relative(path11.dirname(compatibilityRoot), sharedPayloadRoot),
     temporaryRoot,
     process.platform === "win32" ? "junction" : "dir"
   );
@@ -23702,18 +23877,18 @@ async function ensureRuntimePostgresCompatibilityLink(cacheDir, homeDir, package
       throw error;
     }
     if (previousMoved) {
-      await rm(previousRoot, { recursive: true, force: true });
+      await rm2(previousRoot, { recursive: true, force: true });
       previousMoved = false;
     }
   } finally {
-    await rm(temporaryRoot, { recursive: true, force: true });
-    if (!previousMoved) await rm(previousRoot, { recursive: true, force: true });
+    await rm2(temporaryRoot, { recursive: true, force: true });
+    if (!previousMoved) await rm2(previousRoot, { recursive: true, force: true });
   }
 }
 async function stageRuntimePostgresPayload(cacheDir, homeDir, packageVersion, enabled, postgresVersionProbe, deadline, cleanupDownloadWorkDir) {
   if (!enabled) return { output: "" };
   const explicitSourceBinDir = process.env[RUDDER_POSTGRES_BIN_DIR_ENV]?.trim();
-  const resolvedExplicitSourceBinDir = explicitSourceBinDir ? path10.resolve(explicitSourceBinDir) : null;
+  const resolvedExplicitSourceBinDir = explicitSourceBinDir ? path11.resolve(explicitSourceBinDir) : null;
   if (resolvedExplicitSourceBinDir && !isManagedRuntimePostgresBinDir(resolvedExplicitSourceBinDir, homeDir)) {
     await validateRuntimePostgresVersion(
       cacheDir,
@@ -23734,7 +23909,7 @@ async function stageRuntimePostgresPayload(cacheDir, homeDir, packageVersion, en
     };
   }
   const sharedBinDir = resolveSharedRuntimePostgresPayloadBinDir(homeDir);
-  const sharedPlatformRoot = path10.dirname(sharedBinDir);
+  const sharedPlatformRoot = path11.dirname(sharedBinDir);
   await withRuntimeFilesystemLock(
     `${sharedPlatformRoot}.install.lock`,
     async () => reconcileSharedPostgresPayloadGenerations(
@@ -23825,7 +24000,7 @@ async function pruneRuntimeCache(options = {}) {
   const warnings = [];
   for (const entry of deletions) {
     try {
-      await rm(entry.cacheDir, { recursive: true, force: true });
+      await rm2(entry.cacheDir, { recursive: true, force: true });
       deleted.push({
         cacheDir: entry.cacheDir,
         packageVersion: entry.packageVersion,
@@ -23846,13 +24021,13 @@ async function pruneRuntimeCache(options = {}) {
   };
 }
 async function scanRuntimeCacheEntries(homeDir) {
-  const runtimesDir = path10.join(homeDir, "runtimes");
+  const runtimesDir = path11.join(homeDir, "runtimes");
   const dirents = await readdir(runtimesDir, { withFileTypes: true }).catch(() => null);
   if (!dirents) return [];
   const entries = [];
   for (const dirent of dirents) {
     if (!dirent.isDirectory()) continue;
-    const cacheDir = path10.join(runtimesDir, dirent.name);
+    const cacheDir = path11.join(runtimesDir, dirent.name);
     const metadata = await readRuntimeInstallMetadata(cacheDir);
     if (!metadata) continue;
     const fallbackStat = await safeStat(cacheDir);
@@ -23885,7 +24060,7 @@ async function directorySizeBytes(targetPath) {
   if (!dirents) return 0;
   let total = 0;
   for (const dirent of dirents) {
-    const entryPath = path10.join(targetPath, dirent.name);
+    const entryPath = path11.join(targetPath, dirent.name);
     if (dirent.isSymbolicLink()) continue;
     if (dirent.isDirectory()) {
       total += await directorySizeBytes(entryPath);
@@ -23897,15 +24072,15 @@ async function directorySizeBytes(targetPath) {
   return total;
 }
 async function readActiveRuntimeVersions(homeDir) {
-  const instancesDir = path10.join(homeDir, "instances");
+  const instancesDir = path11.join(homeDir, "instances");
   const dirents = await readdir(instancesDir, { withFileTypes: true }).catch(() => null);
   if (!dirents) return [];
   const versions = /* @__PURE__ */ new Set();
   for (const dirent of dirents) {
     if (!dirent.isDirectory()) continue;
     try {
-      const descriptorPath = path10.join(instancesDir, dirent.name, "runtime", "server.json");
-      const parsed = JSON.parse(await readFile(descriptorPath, "utf8"));
+      const descriptorPath = path11.join(instancesDir, dirent.name, "runtime", "server.json");
+      const parsed = JSON.parse(await readFile2(descriptorPath, "utf8"));
       if (typeof parsed.version !== "string") continue;
       if (typeof parsed.pid === "number" && Number.isInteger(parsed.pid) && parsed.pid > 0 && isPidRunning(parsed.pid)) {
         versions.add(parsed.version);
@@ -24013,25 +24188,27 @@ function parseRuntimeVersion(version) {
     canaryNumber: canaryMatch ? Number(canaryMatch[1]) : null
   };
 }
-var RUNTIME_NPM_PACKAGE_NAME, NPM_PUBLIC_REGISTRY_URL, RUNTIME_METADATA_FILE, RUNTIME_POSTGRES_PAYLOAD_DIR, DEFAULT_RUNTIME_CACHE_MAX_ENTRIES, DEFAULT_RUNTIME_CACHE_MAX_AGE_MS, DEFAULT_RUNTIME_CACHE_MAX_BYTES, DEFAULT_RUNTIME_CACHE_KEEP_PREVIOUS, RUNTIME_NPM_INSTALL_FLAGS, RUNTIME_NPM_PACK_FLAGS, EMBEDDED_POSTGRES_PACKAGE_NAME, RUDDER_DESKTOP_MANAGED_POSTGRES_BIN_DIR_ENV, RUDDER_POSTGRES_BIN_DIR_ENV, RUDDER_POSTGRES_RUNTIME_ARCHIVE_MAX_BYTES_ENV2, DEFAULT_RUNTIME_POSTGRES_ARCHIVE_MAX_BYTES2, RUNTIME_CACHE_PACKAGE_JSON, NPM_PLATFORM_REPAIR_ENV, RuntimeInstallError;
+var RUNTIME_NPM_PACKAGE_NAME, NPM_PUBLIC_REGISTRY_URL2, RUNTIME_METADATA_FILE, RUNTIME_POSTGRES_PAYLOAD_DIR, DEFAULT_RUNTIME_CACHE_MAX_ENTRIES, DEFAULT_RUNTIME_CACHE_MAX_AGE_MS, DEFAULT_RUNTIME_CACHE_MAX_BYTES, DEFAULT_RUNTIME_CACHE_KEEP_PREVIOUS, RUNTIME_NPM_INSTALL_BASE_FLAGS, RUNTIME_NPM_INSTALL_OPTIONAL_FLAGS, RUNTIME_NPM_INSTALL_SUFFIX_FLAGS, EMBEDDED_POSTGRES_PACKAGE_NAME, RUDDER_DESKTOP_MANAGED_POSTGRES_BIN_DIR_ENV, RUDDER_POSTGRES_BIN_DIR_ENV, RUDDER_POSTGRES_RUNTIME_ARCHIVE_MAX_BYTES_ENV2, DEFAULT_RUNTIME_POSTGRES_ARCHIVE_MAX_BYTES2, RUNTIME_CACHE_PACKAGE_JSON, RuntimeInstallError;
 var init_install = __esm({
   "src/runtime/install.ts"() {
     "use strict";
     init_home();
     init_npm_command();
     init_native_payload();
+    init_platform_dependencies();
     init_postgres_runtime_download();
     init_postgres_runtime_source();
     RUNTIME_NPM_PACKAGE_NAME = "@rudderhq/server";
-    NPM_PUBLIC_REGISTRY_URL = "https://registry.npmjs.org";
+    NPM_PUBLIC_REGISTRY_URL2 = "https://registry.npmjs.org";
     RUNTIME_METADATA_FILE = "runtime.json";
     RUNTIME_POSTGRES_PAYLOAD_DIR = "postgres-18.4";
     DEFAULT_RUNTIME_CACHE_MAX_ENTRIES = 2;
     DEFAULT_RUNTIME_CACHE_MAX_AGE_MS = 14 * 24 * 60 * 60 * 1e3;
     DEFAULT_RUNTIME_CACHE_MAX_BYTES = 2 * 1024 * 1024 * 1024;
     DEFAULT_RUNTIME_CACHE_KEEP_PREVIOUS = 0;
-    RUNTIME_NPM_INSTALL_FLAGS = ["--omit=dev", "--include=optional", "--no-audit", "--no-fund"];
-    RUNTIME_NPM_PACK_FLAGS = ["--registry", NPM_PUBLIC_REGISTRY_URL, "--silent"];
+    RUNTIME_NPM_INSTALL_BASE_FLAGS = ["--omit=dev"];
+    RUNTIME_NPM_INSTALL_OPTIONAL_FLAGS = ["--include=optional"];
+    RUNTIME_NPM_INSTALL_SUFFIX_FLAGS = ["--no-audit", "--no-fund"];
     EMBEDDED_POSTGRES_PACKAGE_NAME = "embedded-postgres";
     RUDDER_DESKTOP_MANAGED_POSTGRES_BIN_DIR_ENV = "RUDDER_DESKTOP_MANAGED_POSTGRES_BIN_DIR";
     RUDDER_POSTGRES_BIN_DIR_ENV = "RUDDER_POSTGRES_BIN_DIR";
@@ -24043,11 +24220,6 @@ var init_install = __esm({
       private: true,
       type: "module"
     };
-    NPM_PLATFORM_REPAIR_ENV = {
-      npm_config_registry: NPM_PUBLIC_REGISTRY_URL,
-      npm_config_update_notifier: "false",
-      NO_UPDATE_NOTIFIER: "1"
-    };
     RuntimeInstallError = class extends Error {
       cacheDir;
       command;
@@ -24065,7 +24237,7 @@ var init_install = __esm({
 
 // src/runtime/server-entry.ts
 import fs8 from "node:fs";
-import path11 from "node:path";
+import path12 from "node:path";
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL2 } from "node:url";
 function formatError(err) {
   if (err instanceof Error) {
@@ -24087,10 +24259,14 @@ function maybeEnableUiDevMiddleware(entrypoint) {
   }
 }
 function resolveDevServerEntry() {
-  const projectRoot = path11.resolve(path11.dirname(fileURLToPath5(import.meta.url)), "../../..");
-  return path11.resolve(projectRoot, "server/src/index.ts");
+  const projectRoot = path12.resolve(path12.dirname(fileURLToPath5(import.meta.url)), "../../..");
+  return path12.resolve(projectRoot, "server/src/index.ts");
 }
 async function loadServerRuntimeModule(options) {
+  const runtimePackageDir = options.runtimePackageDir?.trim();
+  if (runtimePackageDir) {
+    return await importRuntimeServerModule(path12.resolve(runtimePackageDir));
+  }
   const devEntry = resolveDevServerEntry();
   if (fs8.existsSync(devEntry)) {
     maybeEnableUiDevMiddleware(devEntry);
@@ -24113,20 +24289,20 @@ async function loadServerRuntimeModule(options) {
 async function startManagedServerFromRuntime(options) {
   try {
     const mod = await loadServerRuntimeModule(options);
-    return await startServerFromModule(mod);
+    return await startServerFromModule(mod, options);
   } catch (err) {
     throw new Error(`Rudder server failed to start.
 ${formatError(err)}`);
   }
 }
-async function startServerFromModule(mod) {
+async function startServerFromModule(mod, options = {}) {
   const startManagedLocalServer = mod.startManagedLocalServer;
   if (typeof startManagedLocalServer !== "function") {
     throw new Error("Rudder server runtime did not export startManagedLocalServer().");
   }
   return await startManagedLocalServer({
     ownerKind: "cli",
-    takeoverOnVersionMismatch: true
+    takeoverOnVersionMismatch: options.takeoverOnVersionMismatch ?? true
   });
 }
 var RUDDER_POSTGRES_BIN_DIR_ENV2;
@@ -24226,23 +24402,85 @@ var init_auth_bootstrap_ceo = __esm({
   }
 });
 
+// src/config/local-env.ts
+function parseLocalEnvName(value) {
+  if (!value) return null;
+  const normalized = value.trim().toLowerCase().replace(/-/g, "_");
+  return LOCAL_ENV_NAMES.includes(normalized) ? normalized : null;
+}
+function resolveLocalEnvProfile(value) {
+  const name = parseLocalEnvName(value);
+  return name ? LOCAL_ENV_PROFILES[name] : null;
+}
+function resolveActiveLocalEnvProfile() {
+  return resolveLocalEnvProfile(process.env.RUDDER_LOCAL_ENV);
+}
+function applyLocalEnvProfile(input) {
+  const profile = resolveLocalEnvProfile(input.localEnv ?? process.env.RUDDER_LOCAL_ENV);
+  if (!profile) return null;
+  process.env.RUDDER_LOCAL_ENV = profile.name;
+  if (!input.instance?.trim()) {
+    process.env.RUDDER_INSTANCE_ID = profile.instanceId;
+  }
+  if (!process.env.PORT?.trim()) {
+    process.env.PORT = String(profile.port);
+  }
+  if (!process.env.RUDDER_EMBEDDED_POSTGRES_PORT?.trim()) {
+    process.env.RUDDER_EMBEDDED_POSTGRES_PORT = String(profile.embeddedPostgresPort);
+  }
+  return profile;
+}
+var LOCAL_ENV_NAMES, LOCAL_ENV_PROFILES;
+var init_local_env = __esm({
+  "src/config/local-env.ts"() {
+    "use strict";
+    LOCAL_ENV_NAMES = ["dev", "prod_local", "e2e"];
+    LOCAL_ENV_PROFILES = {
+      dev: {
+        name: "dev",
+        instanceId: "dev",
+        port: 3100,
+        embeddedPostgresPort: 54329,
+        resettable: true,
+        description: "Disposable local development instance"
+      },
+      prod_local: {
+        name: "prod_local",
+        instanceId: "default",
+        port: 3200,
+        embeddedPostgresPort: 54339,
+        resettable: false,
+        description: "Persistent local instance"
+      },
+      e2e: {
+        name: "e2e",
+        instanceId: "e2e",
+        port: 3300,
+        embeddedPostgresPort: 54349,
+        resettable: true,
+        description: "Isolated end-to-end test instance"
+      }
+    };
+  }
+});
+
 // src/utils/path-resolver.ts
 import fs11 from "node:fs";
-import path19 from "node:path";
+import path22 from "node:path";
 function unique(items) {
   return Array.from(new Set(items));
 }
 function resolveRuntimeLikePath(value, configPath) {
   const expanded = expandHomePrefix(value);
-  if (path19.isAbsolute(expanded)) return path19.resolve(expanded);
+  if (path22.isAbsolute(expanded)) return path22.resolve(expanded);
   const cwd = process.cwd();
-  const configDir = configPath ? path19.dirname(configPath) : null;
-  const workspaceRoot = configDir ? path19.resolve(configDir, "..") : cwd;
+  const configDir = configPath ? path22.dirname(configPath) : null;
+  const workspaceRoot = configDir ? path22.resolve(configDir, "..") : cwd;
   const candidates = unique([
-    ...configDir ? [path19.resolve(configDir, expanded)] : [],
-    path19.resolve(workspaceRoot, "server", expanded),
-    path19.resolve(workspaceRoot, expanded),
-    path19.resolve(cwd, expanded)
+    ...configDir ? [path22.resolve(configDir, expanded)] : [],
+    path22.resolve(workspaceRoot, "server", expanded),
+    path22.resolve(workspaceRoot, expanded),
+    path22.resolve(cwd, expanded)
   ]);
   return candidates.find((candidate) => fs11.existsSync(candidate)) ?? candidates[0];
 }
@@ -24256,7 +24494,7 @@ var init_path_resolver = __esm({
 // src/config/secrets-key.ts
 import { randomBytes as randomBytes2 } from "node:crypto";
 import fs12 from "node:fs";
-import path20 from "node:path";
+import path23 from "node:path";
 function ensureLocalSecretsKeyFile(config, configPath) {
   if (config.secrets.provider !== "local_encrypted") {
     return { status: "skipped_provider", path: null };
@@ -24271,7 +24509,7 @@ function ensureLocalSecretsKeyFile(config, configPath) {
   if (fs12.existsSync(keyFilePath)) {
     return { status: "existing", path: keyFilePath };
   }
-  fs12.mkdirSync(path20.dirname(keyFilePath), { recursive: true });
+  fs12.mkdirSync(path23.dirname(keyFilePath), { recursive: true });
   fs12.writeFileSync(keyFilePath, randomBytes2(32).toString("base64"), {
     encoding: "utf8",
     mode: 384
@@ -25357,7 +25595,7 @@ var init_port_check = __esm({
 // src/checks/secrets-check.ts
 import { randomBytes as randomBytes3 } from "node:crypto";
 import fs15 from "node:fs";
-import path21 from "node:path";
+import path24 from "node:path";
 function decodeMasterKey(raw) {
   const trimmed = raw.trim();
   if (!trimmed) return null;
@@ -25427,7 +25665,7 @@ function secretsCheck(config, configPath) {
         message: `Secrets key file does not exist yet: ${keyFilePath}`,
         canRepair: true,
         repair: () => {
-          fs15.mkdirSync(path21.dirname(keyFilePath), { recursive: true });
+          fs15.mkdirSync(path24.dirname(keyFilePath), { recursive: true });
           fs15.writeFileSync(keyFilePath, randomBytes3(32).toString("base64"), {
             encoding: "utf8",
             mode: 384
@@ -25697,7 +25935,8 @@ var init_doctor = __esm({
 });
 
 // src/install.ts
-import { execFileSync as execFileSync2, spawnSync as spawnSync3 } from "node:child_process";
+import { execFileSync as execFileSync2, spawnSync as spawnSync4 } from "node:child_process";
+import path25 from "node:path";
 function normalizePath(value) {
   return (value ?? "").replaceAll("\\", "/").toLowerCase();
 }
@@ -25746,6 +25985,26 @@ function getGlobalInstalledPackageVersion(packageName, execFileSyncImpl = execFi
     return null;
   }
 }
+function resolveGlobalInstalledCliEntry(execFileSyncImpl = execFileSync2) {
+  let globalRoot;
+  try {
+    const npm = resolveNpmCommandInvocation();
+    globalRoot = execFileSyncImpl(
+      npm.command,
+      [...npm.args, "root", "--global"],
+      {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"]
+      }
+    ).trim();
+  } catch {
+    throw new Error("Could not resolve the global npm package directory for the Rudder browser app.");
+  }
+  if (!globalRoot) {
+    throw new Error("npm returned an empty global package directory for the Rudder browser app.");
+  }
+  return path25.join(globalRoot, "@rudderhq", "cli", "dist", "index.js");
+}
 function hasPersistentBinaryOnPath(execFileSyncImpl = execFileSync2) {
   const { command, args } = resolveCommandLookupExecutable();
   try {
@@ -25781,10 +26040,10 @@ function detectPersistentCliState(options = {}) {
   };
 }
 function installPersistentCli(options) {
-  const spawnSyncImpl = options.spawnSyncImpl ?? spawnSync3;
+  const spawnSyncImpl = options.spawnSyncImpl ?? spawnSync4;
   const command = `npm install --global ${options.installSpec}`;
   const initialResult = runNpmGlobalInstall(spawnSyncImpl, ["install", "--global", options.installSpec]);
-  const initialOutput = collectSpawnOutput2(initialResult);
+  const initialOutput = collectSpawnOutput3(initialResult);
   if (initialResult.status === 0 || !isRudderBinConflict(initialOutput)) {
     return {
       ok: initialResult.status === 0,
@@ -25794,7 +26053,7 @@ function installPersistentCli(options) {
   }
   const forcedCommand = `npm install --global --force ${options.installSpec}`;
   const forcedResult = runNpmGlobalInstall(spawnSyncImpl, ["install", "--global", "--force", options.installSpec]);
-  const forcedOutput = collectSpawnOutput2(forcedResult);
+  const forcedOutput = collectSpawnOutput3(forcedResult);
   return {
     ok: forcedResult.status === 0,
     command: forcedCommand,
@@ -25806,85 +26065,23 @@ function runNpmGlobalInstall(spawnSyncImpl, args) {
   return spawnSyncImpl(npm.command, [...npm.args, ...args], {
     encoding: "utf8",
     stdio: ["inherit", "pipe", "pipe"],
-    ...process.platform === "win32" ? { windowsHide: true } : {}
-  });
-}
-function collectSpawnOutput2(result) {
-  return [result.stdout, result.stderr, result.error instanceof Error ? result.error.message : null].filter((value) => typeof value === "string" && value.trim().length > 0).join("\n").trim();
-}
-function isRudderBinConflict(output) {
-  const normalized = output.toLowerCase().replaceAll("\\", "/");
-  return normalized.includes("eexist") && (normalized.includes(`/${CLI_BIN_NAME}`) || normalized.includes(`/${CLI_BIN_NAME}.cmd`) || normalized.includes(`/${CLI_BIN_NAME}.ps1`));
-}
-var CLI_NPM_PACKAGE_NAME, CLI_BIN_NAME;
-var init_install2 = __esm({
-  "src/install.ts"() {
-    "use strict";
-    init_npm_command();
-    CLI_NPM_PACKAGE_NAME = "@rudderhq/cli";
-    CLI_BIN_NAME = "rudder";
-  }
-});
-
-// src/config/local-env.ts
-function parseLocalEnvName(value) {
-  if (!value) return null;
-  const normalized = value.trim().toLowerCase().replace(/-/g, "_");
-  return LOCAL_ENV_NAMES.includes(normalized) ? normalized : null;
-}
-function resolveLocalEnvProfile(value) {
-  const name = parseLocalEnvName(value);
-  return name ? LOCAL_ENV_PROFILES[name] : null;
+    ...process.platform === "win32" ? { windowsHide: true } : {}
+  });
 }
-function resolveActiveLocalEnvProfile() {
-  return resolveLocalEnvProfile(process.env.RUDDER_LOCAL_ENV);
+function collectSpawnOutput3(result) {
+  return [result.stdout, result.stderr, result.error instanceof Error ? result.error.message : null].filter((value) => typeof value === "string" && value.trim().length > 0).join("\n").trim();
 }
-function applyLocalEnvProfile(input) {
-  const profile = resolveLocalEnvProfile(input.localEnv ?? process.env.RUDDER_LOCAL_ENV);
-  if (!profile) return null;
-  process.env.RUDDER_LOCAL_ENV = profile.name;
-  if (!input.instance?.trim()) {
-    process.env.RUDDER_INSTANCE_ID = profile.instanceId;
-  }
-  if (!process.env.PORT?.trim()) {
-    process.env.PORT = String(profile.port);
-  }
-  if (!process.env.RUDDER_EMBEDDED_POSTGRES_PORT?.trim()) {
-    process.env.RUDDER_EMBEDDED_POSTGRES_PORT = String(profile.embeddedPostgresPort);
-  }
-  return profile;
+function isRudderBinConflict(output) {
+  const normalized = output.toLowerCase().replaceAll("\\", "/");
+  return normalized.includes("eexist") && (normalized.includes(`/${CLI_BIN_NAME}`) || normalized.includes(`/${CLI_BIN_NAME}.cmd`) || normalized.includes(`/${CLI_BIN_NAME}.ps1`));
 }
-var LOCAL_ENV_NAMES, LOCAL_ENV_PROFILES;
-var init_local_env = __esm({
-  "src/config/local-env.ts"() {
+var CLI_NPM_PACKAGE_NAME, CLI_BIN_NAME;
+var init_install2 = __esm({
+  "src/install.ts"() {
     "use strict";
-    LOCAL_ENV_NAMES = ["dev", "prod_local", "e2e"];
-    LOCAL_ENV_PROFILES = {
-      dev: {
-        name: "dev",
-        instanceId: "dev",
-        port: 3100,
-        embeddedPostgresPort: 54329,
-        resettable: true,
-        description: "Disposable local development instance"
-      },
-      prod_local: {
-        name: "prod_local",
-        instanceId: "default",
-        port: 3200,
-        embeddedPostgresPort: 54339,
-        resettable: false,
-        description: "Persistent local instance"
-      },
-      e2e: {
-        name: "e2e",
-        instanceId: "e2e",
-        port: 3300,
-        embeddedPostgresPort: 54349,
-        resettable: true,
-        description: "Isolated end-to-end test instance"
-      }
-    };
+    init_npm_command();
+    CLI_NPM_PACKAGE_NAME = "@rudderhq/cli";
+    CLI_BIN_NAME = "rudder";
   }
 });
 
@@ -26003,7 +26200,7 @@ var init_run = __esm({
 
 // src/commands/onboard.ts
 import * as p14 from "@clack/prompts";
-import path22 from "node:path";
+import path26 from "node:path";
 import pc13 from "picocolors";
 function parseBooleanFromEnv(rawValue) {
   if (rawValue === void 0) return null;
@@ -26036,7 +26233,7 @@ function parseEnumFromEnv(rawValue, allowedValues) {
 }
 function resolvePathFromEnv(rawValue) {
   if (!rawValue || rawValue.trim().length === 0) return null;
-  return path22.resolve(expandHomePrefix(rawValue.trim()));
+  return path26.resolve(expandHomePrefix(rawValue.trim()));
 }
 function quickstartDefaultsFromEnv() {
   const instanceId = resolveRudderInstanceId();
@@ -28823,42 +29020,42 @@ var RudderApiClient = class {
       now: opts.now
     });
   }
-  get(path26, opts) {
-    return this.request(path26, { method: "GET" }, opts);
+  get(path29, opts) {
+    return this.request(path29, { method: "GET" }, opts);
   }
-  post(path26, body, opts) {
-    return this.request(path26, {
+  post(path29, body, opts) {
+    return this.request(path29, {
       method: "POST",
       body: body === void 0 ? void 0 : JSON.stringify(body)
     }, opts);
   }
-  postForm(path26, form, opts) {
-    return this.request(path26, {
+  postForm(path29, form, opts) {
+    return this.request(path29, {
       method: "POST",
       body: form
     }, opts);
   }
-  patch(path26, body, opts) {
-    return this.request(path26, {
+  patch(path29, body, opts) {
+    return this.request(path29, {
       method: "PATCH",
       body: body === void 0 ? void 0 : JSON.stringify(body)
     }, opts);
   }
-  put(path26, body, opts) {
-    return this.request(path26, {
+  put(path29, body, opts) {
+    return this.request(path29, {
       method: "PUT",
       body: body === void 0 ? void 0 : JSON.stringify(body)
     }, opts);
   }
-  delete(path26, opts) {
-    return this.request(path26, { method: "DELETE" }, opts);
+  delete(path29, opts) {
+    return this.request(path29, { method: "DELETE" }, opts);
   }
   setApiKey(apiKey) {
     this.apiKey = apiKey?.trim() || void 0;
   }
-  async request(path26, init, opts, hasRetriedAuth = false) {
-    const url = buildUrl(this.apiBase, path26);
-    const reservation = await this.issueTransportBudget.reserve(init.method, path26, init.body);
+  async request(path29, init, opts, hasRetriedAuth = false) {
+    const url = buildUrl(this.apiBase, path29);
+    const reservation = await this.issueTransportBudget.reserve(init.method, path29, init.body);
     const headers = {
       accept: "application/json",
       ...toStringRecord(init.headers)
@@ -28896,14 +29093,14 @@ var RudderApiClient = class {
       const apiError = await toApiError(response);
       if (!hasRetriedAuth && this.recoverAuth) {
         const recoveredToken = await this.recoverAuth({
-          path: path26,
+          path: path29,
           method: String(init.method ?? "GET").toUpperCase(),
           error: apiError
         });
         if (recoveredToken) {
           await this.issueTransportBudget.succeed(reservation);
           this.setApiKey(recoveredToken);
-          return this.request(path26, init, opts, true);
+          return this.request(path29, init, opts, true);
         }
       }
       await this.issueTransportBudget.fail(reservation, apiError);
@@ -28924,8 +29121,8 @@ function shouldAttachAgentContext(method) {
   const normalized = String(method ?? "GET").toUpperCase();
   return normalized !== "GET" && normalized !== "HEAD";
 }
-function buildUrl(apiBase, path26) {
-  const normalizedPath = path26.startsWith("/") ? path26 : `/${path26}`;
+function buildUrl(apiBase, path29) {
+  const normalizedPath = path29.startsWith("/") ? path29 : `/${path29}`;
   const [pathname, query] = normalizedPath.split("?");
   const url = new URL3(apiBase);
   url.pathname = `${url.pathname.replace(/\/+$/, "")}${pathname}`;
@@ -31510,67 +31707,586 @@ function hasRunnableRudderOnPath(env) {
 function rpcResult(id, result) {
   return { jsonrpc: "2.0", id, result };
 }
-function rpcError(id, code, message, data) {
-  return { jsonrpc: "2.0", id, error: { code, message, ...data === void 0 ? {} : { data } } };
+function rpcError(id, code, message, data) {
+  return { jsonrpc: "2.0", id, error: { code, message, ...data === void 0 ? {} : { data } } };
+}
+function errorMessage(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function errorDetails(err) {
+  if (!(err instanceof Error)) return void 0;
+  if (err instanceof ApiRequestError) {
+    const details = isRecord3(err.details) ? err.details : err.details === void 0 ? {} : { upstreamDetails: err.details };
+    return {
+      code: err.code ?? "api_request_error",
+      status: err.status,
+      ...details
+    };
+  }
+  const code = err.code;
+  return code ? { code } : void 0;
+}
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/commands/allowed-hostname.ts
+init_hostnames();
+init_store();
+import * as p from "@clack/prompts";
+import pc3 from "picocolors";
+async function addAllowedHostname(host, opts) {
+  const configPath = resolveConfigPath(opts.config);
+  const config = readConfig(opts.config);
+  if (!config) {
+    p.log.error(`No config found at ${configPath}. Run ${pc3.cyan("rudder onboard")} first.`);
+    return;
+  }
+  const normalized = normalizeHostnameInput(host);
+  const current = new Set((config.server.allowedHostnames ?? []).map((value) => value.trim().toLowerCase()).filter(Boolean));
+  const existed = current.has(normalized);
+  current.add(normalized);
+  config.server.allowedHostnames = Array.from(current).sort();
+  config.$meta.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+  config.$meta.source = "configure";
+  writeConfig(config, opts.config);
+  if (existed) {
+    p.log.info(`Hostname ${pc3.cyan(normalized)} is already allowed.`);
+  } else {
+    p.log.success(`Added allowed hostname: ${pc3.cyan(normalized)}`);
+    p.log.message(
+      pc3.dim("Restart the Rudder server for this change to take effect.")
+    );
+  }
+  if (!(config.server.deploymentMode === "authenticated" && config.server.exposure === "private")) {
+    p.log.message(
+      pc3.dim("Note: allowed hostnames are enforced only in authenticated/private mode.")
+    );
+  }
+}
+
+// src/program.ts
+init_auth_bootstrap_ceo();
+
+// src/commands/browser-app.ts
+import { spawn as spawn3, spawnSync as spawnSync3 } from "node:child_process";
+import { randomUUID as randomUUID2 } from "node:crypto";
+import { closeSync, existsSync as existsSync4, mkdirSync, openSync, readFileSync as readFileSync2, rmdirSync, statSync as statSync2, unlinkSync, writeFileSync } from "node:fs";
+import { readFile as readFile3, rm as rm3, writeFile as writeFile2 } from "node:fs/promises";
+import { homedir, tmpdir } from "node:os";
+import path14 from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
+
+// src/config/data-dir.ts
+init_home();
+import path13 from "node:path";
+function applyDataDirOverride(options, support = {}) {
+  const rawDataDir = options.dataDir?.trim();
+  if (!rawDataDir) return null;
+  const resolvedDataDir = path13.resolve(expandHomePrefix(rawDataDir));
+  process.env.RUDDER_HOME = resolvedDataDir;
+  if (support.hasConfigOption) {
+    const hasConfigOverride = Boolean(options.config?.trim()) || Boolean(process.env.RUDDER_CONFIG?.trim());
+    if (!hasConfigOverride) {
+      const instanceId = resolveRudderInstanceId(options.instance);
+      process.env.RUDDER_INSTANCE_ID = instanceId;
+      process.env.RUDDER_CONFIG = resolveDefaultConfigPath(instanceId);
+    }
+  }
+  if (support.hasContextOption) {
+    const hasContextOverride = Boolean(options.context?.trim()) || Boolean(process.env.RUDDER_CONTEXT?.trim());
+    if (!hasContextOverride) {
+      process.env.RUDDER_CONTEXT = resolveDefaultContextPath();
+    }
+  }
+  return resolvedDataDir;
+}
+
+// src/commands/browser-app.ts
+init_home();
+init_local_env();
+init_server_entry();
+init_version();
+var SMART_APP_CONTROL_REGISTRY_KEY = String.raw`HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy`;
+var SMART_APP_CONTROL_REGISTRY_VALUE = "VerifiedAndReputablePolicyState";
+var BROWSER_APP_READY_TIMEOUT_MS = 9e4;
+var RUNTIME_HEALTH_POLL_MS = 2e3;
+var DESKTOP_TAKEOVER_LEASE_DIR = "browser-app-desktop-takeover.lock";
+var DESKTOP_TAKEOVER_PARTIAL_LEASE_GRACE_MS = 3e4;
+function resolveBrowserAppRuntimeVersion(env = process.env) {
+  const version = resolveCliVersion(import.meta.url, env);
+  return version === "0.0.0" ? "latest" : version;
+}
+function parseSmartAppControlState(output) {
+  const line = output.split(/\r?\n/).find((candidate) => candidate.toLowerCase().includes(SMART_APP_CONTROL_REGISTRY_VALUE.toLowerCase()));
+  if (!line) return "unknown";
+  const match = line.match(/REG_DWORD\s+0x([0-9a-f]+)/iu);
+  if (!match) return "unknown";
+  const value = Number.parseInt(match[1], 16);
+  if (value === 0) return "off";
+  if (value === 1) return "on";
+  if (value === 2) return "evaluation";
+  return "unknown";
+}
+function detectSmartAppControlState(platform = process.platform, spawnSyncImpl = spawnSync3) {
+  if (platform !== "win32") return "unknown";
+  const result = spawnSyncImpl("reg.exe", [
+    "query",
+    SMART_APP_CONTROL_REGISTRY_KEY,
+    "/v",
+    SMART_APP_CONTROL_REGISTRY_VALUE
+  ], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "ignore"],
+    windowsHide: true
+  });
+  if (result.status !== 0 || typeof result.stdout !== "string") return "unknown";
+  return parseSmartAppControlState(result.stdout);
+}
+function parseDesktopLaunchMode(value) {
+  const normalized = value?.trim().toLowerCase() || "auto";
+  if (normalized === "auto" || normalized === "native" || normalized === "browser") return normalized;
+  throw new Error(`Desktop mode must be auto, native, or browser. Received ${value}.`);
+}
+function resolveDesktopLaunchMode(options = {}) {
+  const requested = parseDesktopLaunchMode(options.requested);
+  if (requested !== "auto") return requested;
+  const platform = options.platform ?? process.platform;
+  const state = options.smartAppControlState ?? detectSmartAppControlState(platform);
+  return platform === "win32" && state === "on" ? "browser" : "native";
+}
+function resolveEdgeExecutable(env = process.env, pathExists3 = existsSync4) {
+  const candidates = [
+    env["PROGRAMFILES(X86)"] && path14.join(env["PROGRAMFILES(X86)"], "Microsoft", "Edge", "Application", "msedge.exe"),
+    env.ProgramFiles && path14.join(env.ProgramFiles, "Microsoft", "Edge", "Application", "msedge.exe"),
+    env.LOCALAPPDATA && path14.join(env.LOCALAPPDATA, "Microsoft", "Edge", "Application", "msedge.exe")
+  ].filter((candidate) => Boolean(candidate));
+  return candidates.find(pathExists3) ?? null;
+}
+function buildEdgeBrowserAppArgs(boardUrl) {
+  return [
+    `--app=${boardUrl}`,
+    "--start-maximized",
+    "--no-first-run"
+  ];
+}
+function quoteWindowsArgument(value) {
+  if (!/[\s"]/u.test(value)) return value;
+  return `"${value.replace(/(\\*)"/gu, '$1$1\\"').replace(/(\\+)$/u, "$1$1")}"`;
+}
+function quotePowerShellString(value) {
+  return `'${value.replaceAll("'", "''")}'`;
+}
+function buildWindowsBrowserAppShortcutScript(options) {
+  const args = [
+    options.cliEntryPath,
+    "--local-env",
+    options.localEnv,
+    "browser-app",
+    "--data-dir",
+    options.dataDir,
+    "--runtime-version",
+    options.runtimeVersion
+  ].map(quoteWindowsArgument).join(" ");
+  return [
+    "$shell = New-Object -ComObject WScript.Shell",
+    `$shortcut = $shell.CreateShortcut(${quotePowerShellString(options.shortcutPath)})`,
+    `$shortcut.TargetPath = ${quotePowerShellString(options.nodePath)}`,
+    `$shortcut.Arguments = ${quotePowerShellString(args)}`,
+    `$shortcut.WorkingDirectory = ${quotePowerShellString(options.workingDirectory)}`,
+    "$shortcut.WindowStyle = 7",
+    ...options.iconPath ? [`$shortcut.IconLocation = ${quotePowerShellString(options.iconPath)}`] : [],
+    "$shortcut.Save()"
+  ].join("; ");
+}
+function createWindowsBrowserAppShortcut(options) {
+  const env = options.env ?? process.env;
+  const appData = env.APPDATA?.trim() || path14.join(homedir(), "AppData", "Roaming");
+  const shortcutPath = path14.join(appData, "Microsoft", "Windows", "Start Menu", "Programs", "Rudder.lnk");
+  mkdirSync(path14.dirname(shortcutPath), { recursive: true });
+  const result = (options.spawnSyncImpl ?? spawnSync3)("powershell.exe", [
+    "-NoProfile",
+    "-Command",
+    buildWindowsBrowserAppShortcutScript({
+      shortcutPath,
+      nodePath: options.nodePath,
+      cliEntryPath: options.cliEntryPath,
+      localEnv: options.localEnv,
+      dataDir: path14.resolve(options.dataDir),
+      runtimeVersion: options.runtimeVersion,
+      workingDirectory: options.workingDirectory,
+      iconPath: options.iconPath
+    })
+  ], { stdio: "ignore", windowsHide: true });
+  if (result.status !== 0) throw new Error("Could not create the Windows Rudder browser-app shortcut.");
+  return shortcutPath;
+}
+function launchBrowserAppWindow(boardUrl, options = {}) {
+  const env = options.env ?? process.env;
+  const spawnImpl = options.spawnImpl ?? spawn3;
+  const edge = resolveEdgeExecutable(env, options.pathExists);
+  if (edge) {
+    spawnImpl(edge, buildEdgeBrowserAppArgs(boardUrl), {
+      detached: true,
+      stdio: "ignore",
+      windowsHide: false
+    }).unref();
+    return "edge";
+  }
+  spawnImpl("cmd.exe", ["/c", "start", "", boardUrl], {
+    detached: true,
+    stdio: "ignore",
+    windowsHide: true
+  }).unref();
+  return "default";
+}
+function terminateDetachedBrowserAppProcess(child, options = {}) {
+  const pid = child.pid;
+  if (!Number.isSafeInteger(pid) || !pid || pid <= 0) {
+    child.kill?.("SIGKILL");
+    return;
+  }
+  if ((options.platform ?? process.platform) === "win32") {
+    (options.spawnSyncImpl ?? spawnSync3)("taskkill.exe", ["/PID", String(pid), "/T", "/F"], {
+      stdio: "ignore",
+      windowsHide: true
+    });
+    return;
+  }
+  const processKill = options.processKill ?? ((targetPid, signal) => {
+    process.kill(targetPid, signal);
+  });
+  try {
+    processKill(-pid, "SIGKILL");
+  } catch {
+    try {
+      processKill(pid, "SIGKILL");
+    } catch {
+    }
+  }
+  child.kill?.("SIGKILL");
+}
+function applyBrowserAppEnvironment(options = {}) {
+  applyLocalEnvProfile(options);
+  applyDataDirOverride(options);
+  const profile = resolveActiveLocalEnvProfile() ?? applyLocalEnvProfile({ localEnv: "prod_local" });
+  if (!profile) throw new Error("Rudder browser-app requires a local environment profile.");
+  process.env.RUDDER_LOCAL_ENV = profile.name;
+  process.env.RUDDER_INSTANCE_ID = profile.instanceId;
+  process.env.PORT = String(profile.port);
+  process.env.RUDDER_EMBEDDED_POSTGRES_PORT = String(profile.embeddedPostgresPort);
+  process.env.RUDDER_DEPLOYMENT_MODE = "local_trusted";
+  process.env.RUDDER_DEPLOYMENT_EXPOSURE = "private";
+  process.env.HOST = "127.0.0.1";
+  process.env.SERVE_UI = "true";
+  process.env.RUDDER_UI_DEV_MIDDLEWARE = "false";
+  process.env.RUDDER_OPEN_ON_LISTEN = "false";
+}
+async function writeReadyRecord(readyFile, record) {
+  if (!readyFile) return;
+  await writeFile2(readyFile, `${JSON.stringify(record)}
+`, "utf8");
+}
+function boardUrlFromServer(startedServer) {
+  return startedServer.apiUrl.replace(/\/api\/?$/u, "");
+}
+async function waitForShutdownSignal() {
+  await new Promise((resolve) => {
+    const finish = () => resolve();
+    process.once("SIGINT", finish);
+    process.once("SIGTERM", finish);
+  });
+}
+async function runtimeStillHealthy(apiUrl) {
+  try {
+    const response = await fetch(new URL("/api/health", apiUrl), {
+      signal: AbortSignal.timeout(1e3),
+      headers: { Accept: "application/json" }
+    });
+    return response.ok;
+  } catch {
+    return false;
+  }
+}
+function processIsAlive(pid) {
+  if (!Number.isSafeInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+function acquireDesktopTakeoverLease(instanceId) {
+  const instanceRoot = describeLocalInstancePaths(instanceId).instanceRoot;
+  mkdirSync(instanceRoot, { recursive: true });
+  const leaseDir = path14.join(instanceRoot, DESKTOP_TAKEOVER_LEASE_DIR);
+  const leaseRecordPath = path14.join(leaseDir, "owner.json");
+  const token = randomUUID2();
+  const processStartedAt = Math.round(Date.now() - process.uptime() * 1e3);
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    try {
+      mkdirSync(leaseDir);
+      try {
+        writeFileSync(
+          leaseRecordPath,
+          `${JSON.stringify({ pid: process.pid, processStartedAt, token })}
+`,
+          { encoding: "utf8", flag: "wx" }
+        );
+      } catch (error) {
+        try {
+          rmdirSync(leaseDir);
+        } catch {
+        }
+        throw error;
+      }
+      return () => {
+        try {
+          const current = JSON.parse(readFileSync2(leaseRecordPath, "utf8"));
+          if (current.pid !== process.pid || current.token !== token) return;
+          unlinkSync(leaseRecordPath);
+          rmdirSync(leaseDir);
+        } catch {
+        }
+      };
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      let existingPid = null;
+      let existingProcessStartedAt = null;
+      try {
+        const existing = JSON.parse(readFileSync2(leaseRecordPath, "utf8"));
+        existingPid = typeof existing.pid === "number" ? existing.pid : null;
+        existingProcessStartedAt = typeof existing.processStartedAt === "number" ? existing.processStartedAt : null;
+      } catch {
+        let ageMs;
+        try {
+          ageMs = Date.now() - statSync2(leaseDir).mtimeMs;
+        } catch (statError) {
+          if (statError.code === "ENOENT") continue;
+          throw statError;
+        }
+        if (ageMs < DESKTOP_TAKEOVER_PARTIAL_LEASE_GRACE_MS) return null;
+      }
+      const sameProcess = existingPid === process.pid && existingProcessStartedAt !== null && Math.abs(existingProcessStartedAt - processStartedAt) < 2e3;
+      if (sameProcess || existingPid !== null && existingPid !== process.pid && processIsAlive(existingPid)) {
+        return null;
+      }
+      try {
+        unlinkSync(leaseRecordPath);
+      } catch (unlinkError) {
+        if (unlinkError.code !== "ENOENT") return null;
+      }
+      try {
+        rmdirSync(leaseDir);
+      } catch {
+        return null;
+      }
+    }
+  }
+  return null;
+}
+async function runBrowserAppChild(options) {
+  applyBrowserAppEnvironment(options);
+  const runtimeVersion = options.runtimeVersion?.trim() || resolveBrowserAppRuntimeVersion();
+  let startedServer = null;
+  let readyWritten = false;
+  let releaseDesktopTakeoverLease = null;
+  const runtimePackageDir = process.env.RUDDER_BROWSER_APP_RUNTIME_PACKAGE_DIR?.trim();
+  try {
+    while (true) {
+      startedServer = await startManagedServerFromRuntime({
+        version: runtimeVersion,
+        ...runtimePackageDir ? { runtimePackageDir } : {},
+        // A native Desktop runtime owns the process while it is alive. Never
+        // terminate it just to replace a mismatched browser-app version.
+        takeoverOnVersionMismatch: false
+      });
+      const boardUrl = boardUrlFromServer(startedServer);
+      if (!readyWritten) {
+        await writeReadyRecord(options.readyFile, {
+          ok: true,
+          apiUrl: startedServer.apiUrl,
+          boardUrl,
+          runtimeMode: startedServer.runtime.mode
+        });
+        readyWritten = true;
+        if (options.open !== false) launchBrowserAppWindow(boardUrl);
+      }
+      if (startedServer.runtime.mode === "owned") {
+        releaseDesktopTakeoverLease?.();
+        releaseDesktopTakeoverLease = null;
+        await waitForShutdownSignal();
+        await startedServer.dispose();
+        return;
+      }
+      if (startedServer.runtime.ownerKind !== "desktop") return;
+      releaseDesktopTakeoverLease ??= acquireDesktopTakeoverLease(startedServer.runtime.instanceId);
+      if (!releaseDesktopTakeoverLease) return;
+      while (await runtimeStillHealthy(startedServer.apiUrl)) {
+        await delay(RUNTIME_HEALTH_POLL_MS);
+      }
+      await delay(500);
+    }
+  } catch (error) {
+    if (!readyWritten) {
+      await writeReadyRecord(options.readyFile, {
+        ok: false,
+        error: error instanceof Error ? error.message : String(error)
+      });
+    }
+    throw error;
+  } finally {
+    releaseDesktopTakeoverLease?.();
+  }
+}
+async function readReadyRecord(readyFile) {
+  return JSON.parse(await readFile3(readyFile, "utf8"));
 }
-function errorMessage(err) {
-  return err instanceof Error ? err.message : String(err);
+async function waitForReadyRecord(options) {
+  const timeoutMs = options.timeoutMs ?? BROWSER_APP_READY_TIMEOUT_MS;
+  const startedAt = Date.now();
+  const childState = { stopped: null };
+  const onExit = (code, signal) => {
+    childState.stopped = { code, signal };
+  };
+  const onError = (error) => {
+    childState.stopped = { code: null, signal: null, error };
+  };
+  options.child.once("exit", onExit);
+  options.child.once("error", onError);
+  try {
+    while (Date.now() - startedAt < timeoutMs) {
+      try {
+        return await readReadyRecord(options.readyFile);
+      } catch {
+        const stopped = childState.stopped;
+        if (stopped) {
+          if (stopped.error) {
+            throw new Error(`Rudder browser-app process failed before it was ready. See ${options.logPath}.`, {
+              cause: stopped.error
+            });
+          }
+          const outcome = stopped.signal ? `signal ${stopped.signal}` : `exit code ${stopped.code ?? "unknown"}`;
+          throw new Error(
+            `Rudder browser-app process stopped before it was ready (${outcome}). See ${options.logPath}.`
+          );
+        }
+        await delay(200);
+      }
+    }
+    throw new Error("Rudder browser-app did not become ready in time.");
+  } finally {
+    options.child.off("exit", onExit);
+    options.child.off("error", onError);
+  }
 }
-function errorDetails(err) {
-  if (!(err instanceof Error)) return void 0;
-  if (err instanceof ApiRequestError) {
-    const details = isRecord3(err.details) ? err.details : err.details === void 0 ? {} : { upstreamDetails: err.details };
+async function launchDetachedBrowserApp(options) {
+  applyLocalEnvProfile(options);
+  applyDataDirOverride(options);
+  const localProfile = resolveActiveLocalEnvProfile() ?? applyLocalEnvProfile({ localEnv: "prod_local" });
+  if (!localProfile) throw new Error("Rudder browser-app requires a local environment profile.");
+  const dataDir = resolveRudderHomeDir();
+  const instanceId = resolveRudderInstanceId(localProfile.instanceId);
+  const paths = describeLocalInstancePaths(instanceId);
+  const logDir = path14.join(paths.instanceRoot, "logs");
+  mkdirSync(logDir, { recursive: true });
+  const logPath = path14.join(logDir, "browser-app.log");
+  const readyFile = path14.join(tmpdir(), `rudder-browser-app-${process.pid}-${randomUUID2()}.json`);
+  const logFd = openSync(logPath, "a");
+  const spawnImpl = options.spawnImpl ?? spawn3;
+  let child = null;
+  let launchSucceeded = false;
+  try {
+    const spawnedChild = spawnImpl(options.nodePath ?? process.execPath, [
+      options.cliEntryPath,
+      "--local-env",
+      localProfile.name,
+      "browser-app",
+      "--data-dir",
+      dataDir,
+      "--child",
+      "--no-open",
+      "--ready-file",
+      readyFile,
+      "--runtime-version",
+      options.runtimeVersion
+    ], {
+      detached: true,
+      windowsHide: true,
+      stdio: ["ignore", logFd, logFd]
+    });
+    child = spawnedChild;
+    await new Promise((resolve, reject) => {
+      spawnedChild.once("spawn", resolve);
+      spawnedChild.once("error", reject);
+    });
+    spawnedChild.unref();
+  } catch (error) {
+    if (child) {
+      terminateDetachedBrowserAppProcess(child, {
+        platform: options.platform,
+        processKill: options.processKill,
+        spawnSyncImpl: options.spawnSyncImpl
+      });
+    }
+    throw error;
+  } finally {
+    closeSync(logFd);
+  }
+  try {
+    const ready = await waitForReadyRecord({
+      readyFile,
+      child,
+      logPath,
+      timeoutMs: options.readyTimeoutMs
+    });
+    if (!ready.ok || !ready.apiUrl || !ready.boardUrl || !ready.runtimeMode) {
+      throw new Error(ready.error || `Rudder browser-app failed to start. See ${logPath}.`);
+    }
+    const browser = options.open === false ? null : launchBrowserAppWindow(ready.boardUrl);
+    launchSucceeded = true;
     return {
-      code: err.code ?? "api_request_error",
-      status: err.status,
-      ...details
+      apiUrl: ready.apiUrl,
+      boardUrl: ready.boardUrl,
+      browser,
+      logPath,
+      runtimeMode: ready.runtimeMode
     };
+  } finally {
+    await rm3(readyFile, { force: true });
+    if (!launchSucceeded && child) {
+      terminateDetachedBrowserAppProcess(child, {
+        platform: options.platform,
+        processKill: options.processKill,
+        spawnSyncImpl: options.spawnSyncImpl
+      });
+    }
   }
-  const code = err.code;
-  return code ? { code } : void 0;
-}
-function isRecord3(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-
-// src/commands/allowed-hostname.ts
-init_hostnames();
-init_store();
-import * as p from "@clack/prompts";
-import pc3 from "picocolors";
-async function addAllowedHostname(host, opts) {
-  const configPath = resolveConfigPath(opts.config);
-  const config = readConfig(opts.config);
-  if (!config) {
-    p.log.error(`No config found at ${configPath}. Run ${pc3.cyan("rudder onboard")} first.`);
-    return;
-  }
-  const normalized = normalizeHostnameInput(host);
-  const current = new Set((config.server.allowedHostnames ?? []).map((value) => value.trim().toLowerCase()).filter(Boolean));
-  const existed = current.has(normalized);
-  current.add(normalized);
-  config.server.allowedHostnames = Array.from(current).sort();
-  config.$meta.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-  config.$meta.source = "configure";
-  writeConfig(config, opts.config);
-  if (existed) {
-    p.log.info(`Hostname ${pc3.cyan(normalized)} is already allowed.`);
-  } else {
-    p.log.success(`Added allowed hostname: ${pc3.cyan(normalized)}`);
-    p.log.message(
-      pc3.dim("Restart the Rudder server for this change to take effect.")
-    );
+async function browserAppCommand(options) {
+  if (process.platform !== "win32") {
+    throw new Error("Rudder browser-app compatibility mode is currently available on Windows only.");
   }
-  if (!(config.server.deploymentMode === "authenticated" && config.server.exposure === "private")) {
-    p.log.message(
-      pc3.dim("Note: allowed hostnames are enforced only in authenticated/private mode.")
-    );
+  const runtimeVersion = options.runtimeVersion?.trim() || resolveBrowserAppRuntimeVersion();
+  if (options.child) {
+    await runBrowserAppChild({ ...options, runtimeVersion });
+    return;
   }
+  const result = await launchDetachedBrowserApp({
+    cliEntryPath: process.argv[1],
+    localEnv: options.localEnv,
+    dataDir: options.dataDir,
+    runtimeVersion,
+    open: options.open !== false
+  });
+  process.stdout.write(
+    options.open === false ? `Rudder browser-app runtime is ready at ${result.boardUrl} (${result.runtimeMode})
+` : `Rudder browser app opened at ${result.boardUrl} (${result.runtimeMode})
+`
+  );
 }
 
-// src/program.ts
-init_auth_bootstrap_ceo();
-
 // src/commands/client/activity.ts
 function registerActivityCommands(program) {
   const activity = program.command("activity").description("Activity log operations");
@@ -31583,8 +32299,8 @@ function registerActivityCommands(program) {
         if (opts.entityType) params.set("entityType", opts.entityType);
         if (opts.entityId) params.set("entityId", opts.entityId);
         const query = params.toString();
-        const path26 = `/api/orgs/${ctx.orgId}/activity${query ? `?${query}` : ""}`;
-        const rows = await ctx.api.get(path26) ?? [];
+        const path29 = `/api/orgs/${ctx.orgId}/activity${query ? `?${query}` : ""}`;
+        const rows = await ctx.api.get(path29) ?? [];
         if (ctx.json) {
           printOutput(rows, { json: true });
           return;
@@ -31616,7 +32332,7 @@ function registerActivityCommands(program) {
 
 // ../packages/agent-runtime-utils/dist/server-utils.cli.js
 import { promises as fs9 } from "node:fs";
-import path12 from "node:path";
+import path15 from "node:path";
 
 // ../packages/agent-runtime-utils/dist/native-process-runner.js
 init_dist2();
@@ -32122,8 +32838,8 @@ var RUDDER_AGENT_HEARTBEAT_INSTRUCTION = [
 // ../packages/agent-runtime-utils/dist/server-utils.cli.js
 async function resolveRudderSkillsDir(moduleDir, additionalCandidates = []) {
   const candidates = [
-    ...RUDDER_SKILL_ROOT_RELATIVE_CANDIDATES.map((relativePath) => path12.resolve(moduleDir, relativePath)),
-    ...additionalCandidates.map((candidate) => path12.resolve(candidate))
+    ...RUDDER_SKILL_ROOT_RELATIVE_CANDIDATES.map((relativePath) => path15.resolve(moduleDir, relativePath)),
+    ...additionalCandidates.map((candidate) => path15.resolve(candidate))
   ];
   const seenRoots = /* @__PURE__ */ new Set();
   for (const root of candidates) {
@@ -32140,26 +32856,26 @@ async function removeMaintainerOnlySkillSymlinks(skillsHome, allowedSkillNames)
   return removeUnselectedRudderSkillSymlinks(skillsHome, allowedSkillNames);
 }
 async function readRudderMaterializedSkillSource(target) {
-  const manifestPath = path12.join(target, ".rudder", "materialized-skill.json");
+  const manifestPath = path15.join(target, ".rudder", "materialized-skill.json");
   const raw = await fs9.readFile(manifestPath, "utf8").catch(() => null);
   if (!raw)
     return null;
   try {
     const parsed = parseObject(JSON.parse(raw));
     const sourcePath = asString(parsed.sourcePath, "").trim();
-    return sourcePath.length > 0 ? path12.resolve(sourcePath) : null;
+    return sourcePath.length > 0 ? path15.resolve(sourcePath) : null;
   } catch {
     return null;
   }
 }
 async function removeUnselectedRudderSkillSymlinks(skillsHome, allowedSkillNames, knownSkillSources = []) {
   const allowed = new Set(Array.from(allowedSkillNames));
-  const knownSources = new Set(Array.from(knownSkillSources).map((value) => value.trim()).filter(Boolean).map((value) => path12.resolve(value)));
+  const knownSources = new Set(Array.from(knownSkillSources).map((value) => value.trim()).filter(Boolean).map((value) => path15.resolve(value)));
   try {
     const entries = await fs9.readdir(skillsHome, { withFileTypes: true });
     const removed = [];
     for (const entry of entries) {
-      const target = path12.join(skillsHome, entry.name);
+      const target = path15.join(skillsHome, entry.name);
       const existing = await fs9.lstat(target).catch(() => null);
       if (!existing)
         continue;
@@ -32168,8 +32884,8 @@ async function removeUnselectedRudderSkillSymlinks(skillsHome, allowedSkillNames
         const linkedPath = await fs9.readlink(target).catch(() => null);
         if (!linkedPath)
           continue;
-        const resolvedLinkedPath = path12.isAbsolute(linkedPath) ? linkedPath : path12.resolve(path12.dirname(target), linkedPath);
-        isRudderManagedSkill = knownSources.has(path12.resolve(resolvedLinkedPath)) || isMaintainerOnlySkillTarget(linkedPath) || isMaintainerOnlySkillTarget(resolvedLinkedPath);
+        const resolvedLinkedPath = path15.isAbsolute(linkedPath) ? linkedPath : path15.resolve(path15.dirname(target), linkedPath);
+        isRudderManagedSkill = knownSources.has(path15.resolve(resolvedLinkedPath)) || isMaintainerOnlySkillTarget(linkedPath) || isMaintainerOnlySkillTarget(resolvedLinkedPath);
       } else if (existing.isDirectory()) {
         const materializedSource = await readRudderMaterializedSkillSource(target);
         isRudderManagedSkill = materializedSource !== null && knownSources.has(materializedSource);
@@ -32191,7 +32907,7 @@ async function removeUnselectedRudderSkillSymlinks(skillsHome, allowedSkillNames
 init_dist2();
 import fs10 from "node:fs/promises";
 import os4 from "node:os";
-import path13 from "node:path";
+import path16 from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 
 // src/commands/client/help.ts
@@ -32215,16 +32931,16 @@ function formatHelpExample(example) {
 }
 
 // src/commands/client/agent.ts
-var __moduleDir = path13.dirname(fileURLToPath6(import.meta.url));
+var __moduleDir = path16.dirname(fileURLToPath6(import.meta.url));
 function codexSkillsHome() {
   const fromEnv = process.env.CODEX_HOME?.trim();
-  const base = fromEnv && fromEnv.length > 0 ? fromEnv : path13.join(os4.homedir(), ".codex");
-  return path13.join(base, "skills");
+  const base = fromEnv && fromEnv.length > 0 ? fromEnv : path16.join(os4.homedir(), ".codex");
+  return path16.join(base, "skills");
 }
 function claudeSkillsHome() {
   const fromEnv = process.env.CLAUDE_HOME?.trim();
-  const base = fromEnv && fromEnv.length > 0 ? fromEnv : path13.join(os4.homedir(), ".claude");
-  return path13.join(base, "skills");
+  const base = fromEnv && fromEnv.length > 0 ? fromEnv : path16.join(os4.homedir(), ".claude");
+  return path16.join(base, "skills");
 }
 async function installSkillsForTarget(sourceSkillsDir, targetSkillsDir, tool2) {
   const summary = {
@@ -32243,8 +32959,8 @@ async function installSkillsForTarget(sourceSkillsDir, targetSkillsDir, tool2) {
   );
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    const source = path13.join(sourceSkillsDir, entry.name);
-    const target = path13.join(targetSkillsDir, entry.name);
+    const source = path16.join(sourceSkillsDir, entry.name);
+    const target = path16.join(targetSkillsDir, entry.name);
     const existing = await fs10.lstat(target).catch(() => null);
     if (existing) {
       if (existing.isSymbolicLink()) {
@@ -32265,7 +32981,7 @@ async function installSkillsForTarget(sourceSkillsDir, targetSkillsDir, tool2) {
             continue;
           }
         }
-        const resolvedLinkedPath = path13.isAbsolute(linkedPath) ? linkedPath : path13.resolve(path13.dirname(target), linkedPath);
+        const resolvedLinkedPath = path16.isAbsolute(linkedPath) ? linkedPath : path16.resolve(path16.dirname(target), linkedPath);
         const linkedTargetExists = await fs10.stat(resolvedLinkedPath).then(() => true).catch(() => false);
         if (!linkedTargetExists) {
           await fs10.unlink(target);
@@ -32490,7 +33206,7 @@ function registerAgentCommands(program) {
         if (opts.markdown && opts.markdownFile) {
           throw new Error("Pass only one of --markdown or --markdown-file.");
         }
-        const markdown = opts.markdownFile ? await fs10.readFile(path13.resolve(opts.markdownFile), "utf8") : opts.markdown;
+        const markdown = opts.markdownFile ? await fs10.readFile(path16.resolve(opts.markdownFile), "utf8") : opts.markdown;
         const payload = organizationSkillCreateSchema.parse({
           name: opts.name,
           slug: opts.slug?.trim() || null,
@@ -32669,7 +33385,7 @@ function registerAgentCommands(program) {
         }
         const installSummaries = [];
         if (opts.installSkills !== false) {
-          const skillsDir = await resolveRudderSkillsDir(__moduleDir, [path13.resolve(process.cwd(), "skills")]);
+          const skillsDir = await resolveRudderSkillsDir(__moduleDir, [path16.resolve(process.cwd(), "skills")]);
           if (!skillsDir) {
             throw new Error(
               "Could not locate local Rudder skills directory. Expected ./skills in the repo checkout."
@@ -32757,10 +33473,10 @@ async function buildAgentUpdatePatch(opts) {
   if (opts.capabilities !== void 0) rawPatch.capabilities = opts.capabilities;
   if (opts.description !== void 0) rawPatch.capabilities = opts.description;
   if (opts.capabilitiesFile !== void 0) {
-    rawPatch.capabilities = await fs10.readFile(path13.resolve(opts.capabilitiesFile), "utf8");
+    rawPatch.capabilities = await fs10.readFile(path16.resolve(opts.capabilitiesFile), "utf8");
   }
   if (opts.descriptionFile !== void 0) {
-    rawPatch.capabilities = await fs10.readFile(path13.resolve(opts.descriptionFile), "utf8");
+    rawPatch.capabilities = await fs10.readFile(path16.resolve(opts.descriptionFile), "utf8");
   }
   if (clearCapabilities) rawPatch.capabilities = null;
   return updateAgentSchema.parse(rawPatch);
@@ -32783,8 +33499,8 @@ function parseJsonObject(value, name) {
 
 // src/commands/client/approval.ts
 init_dist2();
-import { readFile as readFile2 } from "node:fs/promises";
-import path14 from "node:path";
+import { readFile as readFile4 } from "node:fs/promises";
+import path17 from "node:path";
 function registerApprovalCommands(program) {
   const approval = program.command("approval").description("Approval operations");
   addCommonClientOptions(
@@ -32975,8 +33691,8 @@ async function readTextInputFile(inputPath, optionName) {
   if (inputPath === "-") {
     return readStdinText();
   }
-  const resolvedPath = path14.resolve(process.cwd(), inputPath);
-  return readFile2(resolvedPath, "utf8").catch((err) => {
+  const resolvedPath = path17.resolve(process.cwd(), inputPath);
+  return readFile4(resolvedPath, "utf8").catch((err) => {
     throw new Error(`Unable to read ${optionName} ${inputPath}: ${err instanceof Error ? err.message : String(err)}`);
   });
 }
@@ -33812,12 +34528,12 @@ async function readStdin() {
 
 // src/commands/client/company.ts
 import * as p3 from "@clack/prompts";
-import { mkdir as mkdir2, readdir as readdir2, readFile as readFile3, stat as stat2, writeFile as writeFile2 } from "node:fs/promises";
-import path16 from "node:path";
+import { mkdir as mkdir3, readdir as readdir2, readFile as readFile5, stat as stat2, writeFile as writeFile3 } from "node:fs/promises";
+import path19 from "node:path";
 import pc5 from "picocolors";
 
 // src/commands/client/zip.ts
-import path15 from "node:path";
+import path18 from "node:path";
 import { inflateRawSync } from "node:zlib";
 var textDecoder = new TextDecoder();
 var binaryContentTypeByExtension = {
@@ -33845,7 +34561,7 @@ function sharedArchiveRoot(paths) {
   return firstSegments.every((parts) => parts.length > 1 && parts[0] === candidate) ? candidate : null;
 }
 function bytesToPortableFileEntry(pathValue, bytes) {
-  const contentType = binaryContentTypeByExtension[path15.extname(pathValue).toLowerCase()];
+  const contentType = binaryContentTypeByExtension[path18.extname(pathValue).toLowerCase()];
   if (!contentType) return textDecoder.decode(bytes);
   return {
     encoding: "base64",
@@ -33933,7 +34649,7 @@ var IMPORT_INCLUDE_OPTIONS = [
 ];
 var IMPORT_PREVIEW_SAMPLE_LIMIT = 6;
 function readPortableFileEntry(filePath, contents) {
-  const contentType = binaryContentTypeByExtension[path16.extname(filePath).toLowerCase()];
+  const contentType = binaryContentTypeByExtension[path19.extname(filePath).toLowerCase()];
   if (!contentType) return contents.toString("utf8");
   return {
     encoding: "base64",
@@ -33988,10 +34704,10 @@ function normalizePortablePath(filePath) {
   return filePath.replace(/\\/g, "/");
 }
 function shouldIncludePortableFile(filePath) {
-  const baseName = path16.basename(filePath);
+  const baseName = path19.basename(filePath);
   const isMarkdown = baseName.endsWith(".md");
   const isPaperclipYaml = baseName === ".rudder.yaml" || baseName === ".rudder.yml";
-  const contentType = binaryContentTypeByExtension[path16.extname(baseName).toLowerCase()];
+  const contentType = binaryContentTypeByExtension[path19.extname(baseName).toLowerCase()];
   return isMarkdown || isPaperclipYaml || Boolean(contentType);
 }
 function findPortableExtensionPath(files) {
@@ -34546,7 +35262,7 @@ function normalizeGithubImportSource(input, refOverride) {
 }
 async function pathExists(inputPath) {
   try {
-    await stat2(path16.resolve(inputPath));
+    await stat2(path19.resolve(inputPath));
     return true;
   } catch {
     return false;
@@ -34556,55 +35272,55 @@ async function collectPackageFiles(root, current, files) {
   const entries = await readdir2(current, { withFileTypes: true });
   for (const entry of entries) {
     if (entry.name.startsWith(".git")) continue;
-    const absolutePath = path16.join(current, entry.name);
+    const absolutePath = path19.join(current, entry.name);
     if (entry.isDirectory()) {
       await collectPackageFiles(root, absolutePath, files);
       continue;
     }
     if (!entry.isFile()) continue;
-    const relativePath = path16.relative(root, absolutePath).replace(/\\/g, "/");
+    const relativePath = path19.relative(root, absolutePath).replace(/\\/g, "/");
     if (!shouldIncludePortableFile(relativePath)) continue;
-    files[relativePath] = readPortableFileEntry(relativePath, await readFile3(absolutePath));
+    files[relativePath] = readPortableFileEntry(relativePath, await readFile5(absolutePath));
   }
 }
 async function resolveInlineSourceFromPath(inputPath) {
-  const resolved = path16.resolve(inputPath);
+  const resolved = path19.resolve(inputPath);
   const resolvedStat = await stat2(resolved);
-  if (resolvedStat.isFile() && path16.extname(resolved).toLowerCase() === ".zip") {
-    const archive = await readZipArchive(await readFile3(resolved));
+  if (resolvedStat.isFile() && path19.extname(resolved).toLowerCase() === ".zip") {
+    const archive = await readZipArchive(await readFile5(resolved));
     const filteredFiles = Object.fromEntries(
       Object.entries(archive.files).filter(([relativePath]) => shouldIncludePortableFile(relativePath))
     );
     return {
-      rootPath: archive.rootPath ?? path16.basename(resolved, ".zip"),
+      rootPath: archive.rootPath ?? path19.basename(resolved, ".zip"),
       files: filteredFiles
     };
   }
-  const rootDir = resolvedStat.isDirectory() ? resolved : path16.dirname(resolved);
+  const rootDir = resolvedStat.isDirectory() ? resolved : path19.dirname(resolved);
   const files = {};
   await collectPackageFiles(rootDir, rootDir, files);
   return {
-    rootPath: path16.basename(rootDir),
+    rootPath: path19.basename(rootDir),
     files
   };
 }
 async function writeExportToFolder(outDir, exported) {
-  const root = path16.resolve(outDir);
-  await mkdir2(root, { recursive: true });
+  const root = path19.resolve(outDir);
+  await mkdir3(root, { recursive: true });
   for (const [relativePath, content] of Object.entries(exported.files)) {
     const normalized = relativePath.replace(/\\/g, "/");
-    const filePath = path16.join(root, normalized);
-    await mkdir2(path16.dirname(filePath), { recursive: true });
+    const filePath = path19.join(root, normalized);
+    await mkdir3(path19.dirname(filePath), { recursive: true });
     const writeValue = portableFileEntryToWriteValue(content);
     if (typeof writeValue === "string") {
-      await writeFile2(filePath, writeValue, "utf8");
+      await writeFile3(filePath, writeValue, "utf8");
     } else {
-      await writeFile2(filePath, writeValue);
+      await writeFile3(filePath, writeValue);
     }
   }
 }
 async function confirmOverwriteExportDirectory(outDir) {
-  const root = path16.resolve(outDir);
+  const root = path19.resolve(outDir);
   const stats = await stat2(root).catch(() => null);
   if (!stats) return;
   if (!stats.isDirectory()) {
@@ -34786,7 +35502,7 @@ function registerCompanyCommands(program) {
         printOutput(
           {
             ok: true,
-            out: path16.resolve(opts.out),
+            out: path19.resolve(opts.out),
             rootPath: exported.rootPath,
             filesWritten: Object.keys(exported.files).length,
             rudderExtensionPath: exported.rudderExtensionPath,
@@ -35284,8 +36000,8 @@ function parseResultValue(value) {
 
 // src/commands/client/issue.ts
 init_dist2();
-import { readFile as readFile4, stat as stat3 } from "node:fs/promises";
-import path17 from "node:path";
+import { readFile as readFile6, stat as stat3 } from "node:fs/promises";
+import path20 from "node:path";
 function registerIssueCommands(program) {
   const issue = program.command("issue").description("Issue operations");
   addCommonClientOptions(
@@ -35649,8 +36365,8 @@ async function readTextInputFile2(inputPath, optionName) {
   if (inputPath === "-") {
     return readStdinText2();
   }
-  const resolvedPath = path17.resolve(process.cwd(), inputPath);
-  return readFile4(resolvedPath, "utf8").catch((err) => {
+  const resolvedPath = path20.resolve(process.cwd(), inputPath);
+  return readFile6(resolvedPath, "utf8").catch((err) => {
     throw new Error(`Unable to read ${optionName} ${inputPath}: ${err instanceof Error ? err.message : String(err)}`);
   });
 }
@@ -35706,16 +36422,16 @@ async function appendUploadedIssueImages(ctx, issueId, body, imagePaths) {
 ${imageBlock}` : imageBlock;
 }
 async function uploadIssueCommentImage(ctx, issue, imagePath) {
-  const resolvedPath = path17.resolve(process.cwd(), imagePath);
+  const resolvedPath = path20.resolve(process.cwd(), imagePath);
   const stats = await stat3(resolvedPath).catch((err) => {
     throw new Error(`Unable to read image ${imagePath}: ${err instanceof Error ? err.message : String(err)}`);
   });
   if (!stats.isFile()) {
     throw new Error(`Image path must be a file: ${imagePath}`);
   }
-  const filename = path17.basename(resolvedPath);
+  const filename = path20.basename(resolvedPath);
   const contentType = inferCommentImageContentType(filename);
-  const buffer = await readFile4(resolvedPath);
+  const buffer = await readFile6(resolvedPath);
   if (buffer.length <= 0) {
     throw new Error(`Image is empty: ${imagePath}`);
   }
@@ -35732,7 +36448,7 @@ async function uploadIssueCommentImage(ctx, issue, imagePath) {
   return attachment;
 }
 function inferCommentImageContentType(filename) {
-  const ext = path17.extname(filename).toLowerCase();
+  const ext = path20.extname(filename).toLowerCase();
   switch (ext) {
     case ".png":
       return "image/png";
@@ -35835,8 +36551,8 @@ function formatIssueSearchMatch(match) {
 }
 
 // src/commands/client/library.ts
-import { readFile as readFile5 } from "node:fs/promises";
-import path18 from "node:path";
+import { readFile as readFile7 } from "node:fs/promises";
+import path21 from "node:path";
 function toLibraryFileLinkResult(detail) {
   return {
     filePath: detail.filePath,
@@ -35981,8 +36697,8 @@ async function resolveBodyFileInput(inputPath) {
   if (inputPath === "-") {
     return readStdinText3();
   }
-  const resolvedPath = path18.resolve(process.cwd(), inputPath);
-  return readFile5(resolvedPath, "utf8").catch((err) => {
+  const resolvedPath = path21.resolve(process.cwd(), inputPath);
+  return readFile7(resolvedPath, "utf8").catch((err) => {
     throw new Error(`Unable to read --body-file ${inputPath}: ${err instanceof Error ? err.message : String(err)}`);
   });
 }
@@ -36850,8 +37566,8 @@ function registerUserCommands(program) {
         appendParam(params, "limit", opts.limit);
         appendParam(params, "cursor", opts.cursor);
         const query = params.toString();
-        const path26 = `/api/orgs/${ctx.orgId}/users/${encodeURIComponent(userId)}/activity-ledger${query ? `?${query}` : ""}`;
-        const result = await ctx.api.get(path26);
+        const path29 = `/api/orgs/${ctx.orgId}/users/${encodeURIComponent(userId)}/activity-ledger${query ? `?${query}` : ""}`;
+        const result = await ctx.api.get(path29);
         if (ctx.json) {
           printOutput(result, { json: true });
           return;
@@ -37351,7 +38067,7 @@ function quoteShellValue(value) {
 }
 
 // src/commands/heartbeat-run.ts
-import { setTimeout as delay } from "node:timers/promises";
+import { setTimeout as delay2 } from "node:timers/promises";
 import pc11 from "picocolors";
 
 // src/agent-runtimes/http/format-event.ts
@@ -37596,7 +38312,7 @@ async function heartbeatRun(opts) {
         logOffset += Buffer.byteLength(logResult.content, "utf8");
       }
     }
-    await delay(POLL_INTERVAL_MS);
+    await delay2(POLL_INTERVAL_MS);
   }
   if (finalStatus) {
     if (!debug && stdoutJsonBuffer.trim()) {
@@ -37665,14 +38381,14 @@ init_run();
 
 // src/commands/start.ts
 import * as p15 from "@clack/prompts";
-import { spawn as spawn3, spawnSync as spawnSync4 } from "node:child_process";
-import { createHash as createHash5, randomUUID as randomUUID2 } from "node:crypto";
-import { constants as fsConstants, mkdirSync as mkdirSync2, readFileSync as readFileSync2 } from "node:fs";
-import { access, chmod as chmod2, copyFile, cp, lstat, mkdir as mkdir3, mkdtemp as mkdtemp2, readdir as readdir3, readFile as readFile6, rm as rm3, stat as stat4, utimes, writeFile as writeFile3 } from "node:fs/promises";
-import { homedir, tmpdir } from "node:os";
-import path24 from "node:path";
-import { clearTimeout as clearTimeout3, setTimeout as setTimeout3 } from "node:timers";
-import { setTimeout as delay2 } from "node:timers/promises";
+import { spawn as spawn4, spawnSync as spawnSync5 } from "node:child_process";
+import { createHash as createHash5, randomUUID as randomUUID3 } from "node:crypto";
+import { constants as fsConstants, mkdirSync as mkdirSync3, readFileSync as readFileSync3 } from "node:fs";
+import { access, chmod as chmod2, copyFile, cp, lstat, mkdir as mkdir4, mkdtemp as mkdtemp2, readdir as readdir3, readFile as readFile8, rm as rm5, stat as stat4, utimes, writeFile as writeFile4 } from "node:fs/promises";
+import { homedir as homedir2, tmpdir as tmpdir2 } from "node:os";
+import path28 from "node:path";
+import { clearTimeout as clearTimeout4, setTimeout as setTimeout4 } from "node:timers";
+import { setTimeout as delay3 } from "node:timers/promises";
 import pc14 from "picocolors";
 
 // src/checksum-manifest.ts
@@ -37696,12 +38412,13 @@ function parseChecksumFile(contents) {
 
 // src/commands/start.ts
 init_home();
+init_local_env();
 
 // src/desktop-download.ts
 import { createHash as createHash4 } from "node:crypto";
-import { createWriteStream as createWriteStream3, mkdirSync } from "node:fs";
-import { rm as rm2 } from "node:fs/promises";
-import path23 from "node:path";
+import { createWriteStream as createWriteStream3, mkdirSync as mkdirSync2 } from "node:fs";
+import { rm as rm4 } from "node:fs/promises";
+import path27 from "node:path";
 import { Readable as Readable2, Transform as Transform2 } from "node:stream";
 import { pipeline as pipeline3 } from "node:stream/promises";
 import { clearTimeout as clearTimeout2, setTimeout as setTimeout2 } from "node:timers";
@@ -37940,8 +38657,8 @@ async function resolveDesktopDownloadOrigins(options) {
   return mirrorElapsed === null ? ["github"] : ["github", "mirror"];
 }
 async function downloadAsset(asset, outputDir, progressFactory = createByteProgress, expectedChecksum, timeouts = {}) {
-  mkdirSync(outputDir, { recursive: true });
-  const outputPath = path23.join(outputDir, path23.basename(asset.name));
+  mkdirSync2(outputDir, { recursive: true });
+  const outputPath = path27.join(outputDir, path27.basename(asset.name));
   const idleTimeoutMs = timeouts.idleMs ?? DESKTOP_ASSET_IDLE_TIMEOUT_MS;
   const responseTimeoutMs = timeouts.responseMs ?? DESKTOP_ASSET_RESPONSE_TIMEOUT_MS;
   const failures = [];
@@ -37988,7 +38705,7 @@ async function downloadAsset(asset, outputDir, progressFactory = createByteProgr
       if (expectedChecksum && actualChecksum !== expectedChecksum.toLowerCase()) {
         progress.fail();
         progress = null;
-        await rm2(outputPath, { force: true });
+        await rm4(outputPath, { force: true });
         failures.push(`Checksum mismatch for ${asset.name} from ${url}.`);
         continue;
       }
@@ -37997,7 +38714,7 @@ async function downloadAsset(asset, outputDir, progressFactory = createByteProgr
     } catch (error) {
       if (idleTimeout) clearTimeout2(idleTimeout);
       progress?.fail();
-      await rm2(outputPath, { force: true });
+      await rm4(outputPath, { force: true });
       failures.push(`Failed to download ${asset.name} from ${url}: ${formatFetchError(error)}.`);
     }
   }
@@ -38009,51 +38726,8 @@ init_install2();
 init_install();
 init_version();
 
-// src/commands/start-windows.ts
-function powershellQuote(value) {
-  return `'${value.replaceAll("'", "''")}'`;
-}
-function buildWindowsZipExtractCommand(zipPath, outputDir) {
-  return {
-    command: "powershell.exe",
-    args: [
-      "-NoProfile",
-      "-NonInteractive",
-      "-ExecutionPolicy",
-      "Bypass",
-      "-Command",
-      `$ErrorActionPreference='Stop'; Expand-Archive -LiteralPath ${powershellQuote(zipPath)} -DestinationPath ${powershellQuote(outputDir)} -Force`
-    ]
-  };
-}
-
-// src/commands/start.ts
-var DESKTOP_UPDATE_QUIT_ARG = "--rudder-update-quit";
-var DESKTOP_UPDATE_FORCE_ARG = "--rudder-update-force";
-var STABLE_SEMVER_RE = /^[0-9]+\.[0-9]+\.[0-9]+$/;
-var CANARY_SEMVER_RE = /^[0-9]+\.[0-9]+\.[0-9]+-canary\.[0-9]+$/;
-var CLI_REGISTRY_LATEST_URL = "https://registry.npmjs.org/@rudderhq%2fcli/latest";
-var LEGACY_UPDATE_QUIT_GRACE_MS = 1e4;
-var UPDATE_QUIT_FORCE_DELAY_MS = 1e3;
-var DESKTOP_APP_NAME = "Rudder";
-var DESKTOP_METADATA_FILE = ".rudder-desktop-install.json";
-var DESKTOP_CHECKSUM_ASSET_NAME = "SHASUMS256.txt";
-var DESKTOP_ASSET_CACHE_DIR = "desktop-assets";
-var DEFAULT_DESKTOP_ASSET_CACHE_MAX_ENTRIES = 2;
-var DEFAULT_DESKTOP_ASSET_CACHE_MAX_AGE_MS = 14 * 24 * 60 * 60 * 1e3;
-var DEFAULT_DESKTOP_ASSET_CACHE_MAX_BYTES = 768 * 1024 * 1024;
-var DEFAULT_DESKTOP_ASSET_CACHE_KEEP_PREVIOUS = 1;
-var DESKTOP_INSTALL_LOCK_TIMEOUT_MS = 60 * 60 * 1e3;
-var DESKTOP_INSTALL_LOCK_POLL_MS = 250;
-var DESKTOP_RUNTIME_PREPARE_TIMEOUT_MS = 9e4;
-async function waitForDesktopRuntimeSmokeEvidence(envName) {
-  if (process.env.RUDDER_DESKTOP_SMOKE_AUTO_UPDATE_PUBLIC !== "1") return;
-  const value = Number(process.env[envName]);
-  if (!Number.isFinite(value) || value <= 0) return;
-  await delay2(Math.min(value, 1e4));
-}
-var DEFAULT_GITHUB_API_BASE_URL = "https://api.github.com";
-var DEFAULT_GITHUB_DOWNLOAD_BASE_URL = "https://github.com";
+// src/commands/desktop-update-progress.ts
+import { clearTimeout as clearTimeout3, setTimeout as setTimeout3 } from "node:timers";
 function normalizeProgressTotal(totalBytes) {
   return typeof totalBytes === "number" && Number.isFinite(totalBytes) && totalBytes > 0 ? totalBytes : null;
 }
@@ -38201,6 +38875,52 @@ function createDesktopApplySignalController(input = process.stdin) {
     close: cleanup
   };
 }
+
+// src/commands/start-windows.ts
+function powershellQuote(value) {
+  return `'${value.replaceAll("'", "''")}'`;
+}
+function buildWindowsZipExtractCommand(zipPath, outputDir) {
+  return {
+    command: "powershell.exe",
+    args: [
+      "-NoProfile",
+      "-NonInteractive",
+      "-ExecutionPolicy",
+      "Bypass",
+      "-Command",
+      `$ErrorActionPreference='Stop'; Expand-Archive -LiteralPath ${powershellQuote(zipPath)} -DestinationPath ${powershellQuote(outputDir)} -Force`
+    ]
+  };
+}
+
+// src/commands/start.ts
+var DESKTOP_UPDATE_QUIT_ARG = "--rudder-update-quit";
+var DESKTOP_UPDATE_FORCE_ARG = "--rudder-update-force";
+var STABLE_SEMVER_RE = /^[0-9]+\.[0-9]+\.[0-9]+$/;
+var CANARY_SEMVER_RE = /^[0-9]+\.[0-9]+\.[0-9]+-canary\.[0-9]+$/;
+var CLI_REGISTRY_LATEST_URL = "https://registry.npmjs.org/@rudderhq%2fcli/latest";
+var LEGACY_UPDATE_QUIT_GRACE_MS = 1e4;
+var UPDATE_QUIT_FORCE_DELAY_MS = 1e3;
+var DESKTOP_APP_NAME = "Rudder";
+var DESKTOP_METADATA_FILE = ".rudder-desktop-install.json";
+var DESKTOP_CHECKSUM_ASSET_NAME = "SHASUMS256.txt";
+var DESKTOP_ASSET_CACHE_DIR = "desktop-assets";
+var DEFAULT_DESKTOP_ASSET_CACHE_MAX_ENTRIES = 2;
+var DEFAULT_DESKTOP_ASSET_CACHE_MAX_AGE_MS = 14 * 24 * 60 * 60 * 1e3;
+var DEFAULT_DESKTOP_ASSET_CACHE_MAX_BYTES = 768 * 1024 * 1024;
+var DEFAULT_DESKTOP_ASSET_CACHE_KEEP_PREVIOUS = 1;
+var DESKTOP_INSTALL_LOCK_TIMEOUT_MS = 60 * 60 * 1e3;
+var DESKTOP_INSTALL_LOCK_POLL_MS = 250;
+var DESKTOP_RUNTIME_PREPARE_TIMEOUT_MS = 9e4;
+async function waitForDesktopRuntimeSmokeEvidence(envName) {
+  if (process.env.RUDDER_DESKTOP_SMOKE_AUTO_UPDATE_PUBLIC !== "1") return;
+  const value = Number(process.env[envName]);
+  if (!Number.isFinite(value) || value <= 0) return;
+  await delay3(Math.min(value, 1e4));
+}
+var DEFAULT_GITHUB_API_BASE_URL = "https://api.github.com";
+var DEFAULT_GITHUB_DOWNLOAD_BASE_URL = "https://github.com";
 function resolveCurrentCliVersion(env = process.env) {
   const version = resolveCliVersion(import.meta.url, env);
   return version === "0.0.0" ? "latest" : version;
@@ -38224,7 +38944,7 @@ function compareStableSemver(a, b) {
 }
 async function fetchLatestCliVersion() {
   const controller = new AbortController();
-  const timeout = setTimeout3(() => controller.abort(), 2e3);
+  const timeout = setTimeout4(() => controller.abort(), 2e3);
   try {
     const response = await fetch(CLI_REGISTRY_LATEST_URL, {
       signal: controller.signal,
@@ -38236,7 +38956,7 @@ async function fetchLatestCliVersion() {
   } catch {
     return null;
   } finally {
-    clearTimeout3(timeout);
+    clearTimeout4(timeout);
   }
 }
 async function getCliUpdateNotice(currentVersion) {
@@ -38276,39 +38996,39 @@ function resolveDesktopAssetTarget(platform = process.platform, arch = process.a
   }
   throw new Error(`Rudder Desktop does not publish portable assets for ${platform}.`);
 }
-function resolveDefaultDesktopInstallRoot(target, env = process.env, homeDir = homedir()) {
-  if (target.platform === "macos") return path24.join(homeDir, "Applications");
+function resolveDefaultDesktopInstallRoot(target, env = process.env, homeDir = homedir2()) {
+  if (target.platform === "macos") return path28.join(homeDir, "Applications");
   if (target.platform === "windows") {
-    const localAppData = env.LOCALAPPDATA?.trim() || path24.join(homeDir, "AppData", "Local");
-    return path24.join(localAppData, "Programs", DESKTOP_APP_NAME);
+    const localAppData = env.LOCALAPPDATA?.trim() || path28.join(homeDir, "AppData", "Local");
+    return path28.join(localAppData, "Programs", DESKTOP_APP_NAME);
   }
-  return path24.join(homeDir, ".local", "share", "rudder");
+  return path28.join(homeDir, ".local", "share", "rudder");
 }
 function resolveDesktopInstallPaths(target, installRoot) {
-  const root = path24.resolve(installRoot);
+  const root = path28.resolve(installRoot);
   if (target.platform === "macos") {
-    const appPath2 = path24.join(root, `${DESKTOP_APP_NAME}.app`);
+    const appPath2 = path28.join(root, `${DESKTOP_APP_NAME}.app`);
     return {
       installRoot: root,
       appPath: appPath2,
-      executablePath: path24.join(appPath2, "Contents", "MacOS", DESKTOP_APP_NAME),
-      metadataPath: path24.join(root, DESKTOP_METADATA_FILE)
+      executablePath: path28.join(appPath2, "Contents", "MacOS", DESKTOP_APP_NAME),
+      metadataPath: path28.join(root, DESKTOP_METADATA_FILE)
     };
   }
   if (target.platform === "windows") {
     return {
       installRoot: root,
       appPath: root,
-      executablePath: path24.join(root, `${DESKTOP_APP_NAME}.exe`),
-      metadataPath: path24.join(root, DESKTOP_METADATA_FILE)
+      executablePath: path28.join(root, `${DESKTOP_APP_NAME}.exe`),
+      metadataPath: path28.join(root, DESKTOP_METADATA_FILE)
     };
   }
-  const appPath = path24.join(root, `${DESKTOP_APP_NAME}.AppImage`);
+  const appPath = path28.join(root, `${DESKTOP_APP_NAME}.AppImage`);
   return {
     installRoot: root,
     appPath,
     executablePath: appPath,
-    metadataPath: path24.join(root, DESKTOP_METADATA_FILE)
+    metadataPath: path28.join(root, DESKTOP_METADATA_FILE)
   };
 }
 function normalizeAssetName(name) {
@@ -38410,11 +39130,11 @@ function selectChecksumAsset(assets) {
 }
 async function fetchWithTimeout2(url, init, timeoutMs) {
   const controller = new AbortController();
-  const timeout = setTimeout3(() => controller.abort(), timeoutMs);
+  const timeout = setTimeout4(() => controller.abort(), timeoutMs);
   try {
     return await fetch(url, { ...init, signal: controller.signal });
   } finally {
-    clearTimeout3(timeout);
+    clearTimeout4(timeout);
   }
 }
 function githubApiHeaders() {
@@ -38492,20 +39212,20 @@ function buildGithubReleaseAsset(repo, tag, assetName, downloadBaseUrl) {
 }
 function checksumForFile(filePath) {
   const hash = createHash5("sha256");
-  hash.update(readFileSync2(filePath));
+  hash.update(readFileSync3(filePath));
   return hash.digest("hex");
 }
 function resolveAssetChecksum(checksums, assetName) {
-  const expected = checksums.get(path24.basename(assetName));
+  const expected = checksums.get(path28.basename(assetName));
   if (!expected) {
-    throw new Error(`Desktop release checksums do not include ${path24.basename(assetName)}.`);
+    throw new Error(`Desktop release checksums do not include ${path28.basename(assetName)}.`);
   }
   return expected;
 }
 function assertChecksumMatch(filePath, expected) {
   const actual = checksumForFile(filePath);
   if (actual !== expected.toLowerCase()) {
-    throw new Error(`Checksum mismatch for ${path24.basename(filePath)}.`);
+    throw new Error(`Checksum mismatch for ${path28.basename(filePath)}.`);
   }
   return actual;
 }
@@ -38514,7 +39234,7 @@ async function downloadChecksums(checksumAsset, outputDir, progressFactory = cre
     throw new Error("Desktop release is missing SHASUMS256.txt.");
   }
   const checksumPath = await downloadAsset(checksumAsset, outputDir, progressFactory);
-  return parseChecksumFile(readFileSync2(checksumPath, "utf8"));
+  return parseChecksumFile(readFileSync3(checksumPath, "utf8"));
 }
 function normalizeDesktopAssetChecksum(checksum) {
   const normalized = checksum.trim().toLowerCase();
@@ -38524,10 +39244,10 @@ function normalizeDesktopAssetChecksum(checksum) {
   return normalized;
 }
 function resolveDesktopAssetCacheDir(assetChecksum, homeDir = resolveRudderHomeDir()) {
-  return path24.join(homeDir, DESKTOP_ASSET_CACHE_DIR, normalizeDesktopAssetChecksum(assetChecksum));
+  return path28.join(homeDir, DESKTOP_ASSET_CACHE_DIR, normalizeDesktopAssetChecksum(assetChecksum));
 }
 function resolveDesktopCachedAssetPath(assetName, assetChecksum, homeDir = resolveRudderHomeDir()) {
-  return path24.join(resolveDesktopAssetCacheDir(assetChecksum, homeDir), path24.basename(assetName));
+  return path28.join(resolveDesktopAssetCacheDir(assetChecksum, homeDir), path28.basename(assetName));
 }
 async function pruneDesktopAssetCache(options = {}) {
   const homeDir = options.homeDir ?? resolveRudderHomeDir();
@@ -38548,7 +39268,7 @@ async function pruneDesktopAssetCache(options = {}) {
   const warnings = [];
   for (const entry of deletions) {
     try {
-      await rm3(entry.cacheDir, { recursive: true, force: true });
+      await rm5(entry.cacheDir, { recursive: true, force: true });
       deleted.push({
         cacheDir: entry.cacheDir,
         checksum: entry.checksum,
@@ -38573,7 +39293,7 @@ async function maybePruneDesktopAssetCache(options) {
   return result.deleted.length > 0 || result.warnings.length > 0 ? result : null;
 }
 async function scanDesktopAssetCacheEntries(homeDir) {
-  const cacheRoot = path24.join(homeDir, DESKTOP_ASSET_CACHE_DIR);
+  const cacheRoot = path28.join(homeDir, DESKTOP_ASSET_CACHE_DIR);
   const dirents = await readdir3(cacheRoot, { withFileTypes: true }).catch(() => null);
   if (!dirents) return [];
   const entries = [];
@@ -38585,7 +39305,7 @@ async function scanDesktopAssetCacheEntries(homeDir) {
     } catch {
       continue;
     }
-    const cacheDir = path24.join(cacheRoot, dirent.name);
+    const cacheDir = path28.join(cacheRoot, dirent.name);
     const stats = await desktopCacheDirectoryStats(cacheDir);
     entries.push({
       cacheDir,
@@ -38609,7 +39329,7 @@ async function desktopCacheDirectoryStats(targetPath) {
   let lastUsedAtMs = Number(fallbackStat?.mtimeMs ?? 0);
   for (const dirent of dirents) {
     if (dirent.isSymbolicLink()) continue;
-    const entryPath = path24.join(targetPath, dirent.name);
+    const entryPath = path28.join(targetPath, dirent.name);
     const entryStat = await stat4(entryPath).catch(() => null);
     if (!entryStat) continue;
     lastUsedAtMs = Math.max(lastUsedAtMs, Number(entryStat.mtimeMs ?? 0));
@@ -38683,21 +39403,21 @@ async function downloadDesktopAssetWithCache(asset, expectedChecksum, options =
       await touchDesktopCachedAsset(cachePath);
       return { path: cachePath, checksum, cacheStatus: "hit" };
     } catch {
-      await rm3(cachePath, { force: true });
+      await rm5(cachePath, { force: true });
     }
   }
-  const outputDir = options.outputDir ?? await mkdtemp2(path24.join(tmpdir(), "rudder-desktop-installer."));
+  const outputDir = options.outputDir ?? await mkdtemp2(path28.join(tmpdir2(), "rudder-desktop-installer."));
   const removeOutputDir = options.outputDir ? false : true;
   try {
     const downloadedPath = await downloadAsset(asset, outputDir, options.progressFactory, normalizedChecksum);
     const checksum = assertChecksumMatch(downloadedPath, normalizedChecksum);
-    await mkdir3(path24.dirname(cachePath), { recursive: true });
-    if (path24.resolve(downloadedPath) !== path24.resolve(cachePath)) {
+    await mkdir4(path28.dirname(cachePath), { recursive: true });
+    if (path28.resolve(downloadedPath) !== path28.resolve(cachePath)) {
       await copyFile(downloadedPath, cachePath);
     }
     return { path: cachePath, checksum, cacheStatus: "miss" };
   } finally {
-    if (removeOutputDir) await rm3(outputDir, { recursive: true, force: true });
+    if (removeOutputDir) await rm5(outputDir, { recursive: true, force: true });
   }
 }
 async function pathExists2(targetPath) {
@@ -38709,12 +39429,12 @@ async function pathExists2(targetPath) {
   }
 }
 function resolveDesktopInstallLockPath(paths) {
-  const installRootHash = createHash5("sha256").update(path24.resolve(paths.installRoot)).digest("hex").slice(0, 16);
-  return path24.join(path24.dirname(paths.appPath), `.rudder-desktop-install-${installRootHash}.lock`);
+  const installRootHash = createHash5("sha256").update(path28.resolve(paths.installRoot)).digest("hex").slice(0, 16);
+  return path28.join(path28.dirname(paths.appPath), `.rudder-desktop-install-${installRootHash}.lock`);
 }
 async function readDesktopInstallLock(lockPath) {
   try {
-    const parsed = JSON.parse(await readFile6(lockPath, "utf8"));
+    const parsed = JSON.parse(await readFile8(lockPath, "utf8"));
     if (typeof parsed.pid !== "number" || !Number.isInteger(parsed.pid) || parsed.pid <= 0 || typeof parsed.lockId !== "string" || typeof parsed.installRoot !== "string" || typeof parsed.createdAt !== "string") {
       return null;
     }
@@ -38730,20 +39450,20 @@ async function readDesktopInstallLock(lockPath) {
 }
 async function withDesktopInstallLock(paths, fn, options = {}) {
   const lockPath = resolveDesktopInstallLockPath(paths);
-  const lockDir = path24.dirname(lockPath);
+  const lockDir = path28.dirname(lockPath);
   const timeoutMs = options.timeoutMs ?? DESKTOP_INSTALL_LOCK_TIMEOUT_MS;
   const pollMs = options.pollMs ?? DESKTOP_INSTALL_LOCK_POLL_MS;
   const startedAt = Date.now();
   const payload = {
-    lockId: randomUUID2(),
+    lockId: randomUUID3(),
     pid: process.pid,
-    installRoot: path24.resolve(paths.installRoot),
+    installRoot: path28.resolve(paths.installRoot),
     createdAt: (/* @__PURE__ */ new Date()).toISOString()
   };
-  await mkdir3(lockDir, { recursive: true });
+  await mkdir4(lockDir, { recursive: true });
   while (true) {
     try {
-      await writeFile3(lockPath, `${JSON.stringify(payload, null, 2)}
+      await writeFile4(lockPath, `${JSON.stringify(payload, null, 2)}
 `, { encoding: "utf8", flag: "wx" });
       break;
     } catch (error) {
@@ -38752,7 +39472,7 @@ async function withDesktopInstallLock(paths, fn, options = {}) {
       const existing = await readDesktopInstallLock(lockPath);
       const stale = !existing || !processExists(existing.pid);
       if (stale) {
-        await rm3(lockPath, { force: true });
+        await rm5(lockPath, { force: true });
         continue;
       }
       if (Date.now() - startedAt >= timeoutMs) {
@@ -38760,7 +39480,7 @@ async function withDesktopInstallLock(paths, fn, options = {}) {
           `Timed out waiting for Rudder Desktop install lock for ${paths.appPath}. Held by pid ${existing.pid} for ${existing.installRoot}.`
         );
       }
-      await delay2(pollMs);
+      await delay3(pollMs);
     }
   }
   try {
@@ -38768,12 +39488,12 @@ async function withDesktopInstallLock(paths, fn, options = {}) {
   } finally {
     const existing = await readDesktopInstallLock(lockPath);
     if (existing?.lockId === payload.lockId) {
-      await rm3(lockPath, { force: true });
+      await rm5(lockPath, { force: true });
     }
   }
 }
 function runChecked(command, args, options = {}) {
-  const result = spawnSync4(command, args, {
+  const result = spawnSync5(command, args, {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"],
     ...options
@@ -38796,8 +39516,8 @@ function isSuccessfulRobocopyExitCode(status) {
   return typeof status === "number" && status >= 0 && status <= 7;
 }
 async function extractZip(zipPath, outputDir, target) {
-  await rm3(outputDir, { recursive: true, force: true });
-  await mkdir3(outputDir, { recursive: true });
+  await rm5(outputDir, { recursive: true, force: true });
+  await mkdir4(outputDir, { recursive: true });
   if (target.platform === "macos") {
     runChecked("ditto", ["-x", "-k", zipPath, outputDir]);
     return;
@@ -38813,7 +39533,7 @@ async function findPath(root, predicate, maxDepth = 5) {
   async function visit(dir, depth) {
     const entries = await readdir3(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = path24.join(dir, entry.name);
+      const fullPath = path28.join(dir, entry.name);
       if (predicate(fullPath, entry.isDirectory())) return fullPath;
       if (entry.isDirectory() && depth < maxDepth) {
         const nested = await visit(fullPath, depth + 1);
@@ -38825,22 +39545,22 @@ async function findPath(root, predicate, maxDepth = 5) {
   return await visit(root, 0);
 }
 async function findMacApp(extractDir) {
-  const direct = path24.join(extractDir, `${DESKTOP_APP_NAME}.app`);
+  const direct = path28.join(extractDir, `${DESKTOP_APP_NAME}.app`);
   if (await pathExists2(direct)) return direct;
-  const found = await findPath(extractDir, (filePath, isDirectory) => isDirectory && path24.basename(filePath) === `${DESKTOP_APP_NAME}.app`);
+  const found = await findPath(extractDir, (filePath, isDirectory) => isDirectory && path28.basename(filePath) === `${DESKTOP_APP_NAME}.app`);
   if (!found) throw new Error(`Portable macOS archive did not contain ${DESKTOP_APP_NAME}.app.`);
   return found;
 }
 async function findWindowsAppDir(extractDir) {
-  const direct = path24.join(extractDir, `${DESKTOP_APP_NAME}.exe`);
+  const direct = path28.join(extractDir, `${DESKTOP_APP_NAME}.exe`);
   if (await pathExists2(direct)) return extractDir;
-  const executable = await findPath(extractDir, (filePath, isDirectory) => !isDirectory && path24.basename(filePath).toLowerCase() === `${DESKTOP_APP_NAME.toLowerCase()}.exe`);
+  const executable = await findPath(extractDir, (filePath, isDirectory) => !isDirectory && path28.basename(filePath).toLowerCase() === `${DESKTOP_APP_NAME.toLowerCase()}.exe`);
   if (!executable) throw new Error(`Portable Windows archive did not contain ${DESKTOP_APP_NAME}.exe.`);
-  return path24.dirname(executable);
+  return path28.dirname(executable);
 }
 async function readInstallMetadata(metadataPath) {
   try {
-    const parsed = JSON.parse(await readFile6(metadataPath, "utf8"));
+    const parsed = JSON.parse(await readFile8(metadataPath, "utf8"));
     if (parsed.version !== 1) return null;
     return parsed;
   } catch {
@@ -38854,7 +39574,7 @@ function isInstalledDesktopCurrent(metadata, releaseTag, assetName, assetChecksu
 }
 function forceQuitDesktopProcess(pid, target) {
   if (target.platform === "windows") {
-    spawnSync4("taskkill.exe", ["/PID", String(pid), "/T", "/F"], { stdio: "ignore" });
+    spawnSync5("taskkill.exe", ["/PID", String(pid), "/T", "/F"], { stdio: "ignore" });
     return;
   }
   try {
@@ -38862,15 +39582,15 @@ function forceQuitDesktopProcess(pid, target) {
   } catch {
   }
 }
-function quotePowerShellString(value) {
+function quotePowerShellString2(value) {
   return `'${value.replaceAll("'", "''")}'`;
 }
 function findDesktopExecutablePids(executablePath, target) {
   if (target.platform === "windows") {
-    const result2 = spawnSync4("powershell.exe", [
+    const result2 = spawnSync5("powershell.exe", [
       "-NoProfile",
       "-Command",
-      `Get-CimInstance Win32_Process | Where-Object { $_.ExecutablePath -eq ${quotePowerShellString(executablePath)} } | Select-Object -ExpandProperty ProcessId`
+      `Get-CimInstance Win32_Process | Where-Object { $_.ExecutablePath -eq ${quotePowerShellString2(executablePath)} } | Select-Object -ExpandProperty ProcessId`
     ], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"]
@@ -38878,7 +39598,7 @@ function findDesktopExecutablePids(executablePath, target) {
     if (result2.status !== 0) return [];
     return result2.stdout.split(/\r?\n/).map((line) => Number.parseInt(line.trim(), 10)).filter((pid) => Number.isInteger(pid) && pid > 0 && pid !== process.pid);
   }
-  const result = spawnSync4("ps", ["-eo", "pid=,args="], {
+  const result = spawnSync5("ps", ["-eo", "pid=,args="], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "ignore"]
   });
@@ -38901,16 +39621,16 @@ async function waitForUpdateQuitResponse(responsePath, timeoutMs = 8e3) {
   const startedAt = Date.now();
   while (Date.now() - startedAt < timeoutMs) {
     if (await pathExists2(responsePath)) {
-      return JSON.parse(await readFile6(responsePath, "utf8"));
+      return JSON.parse(await readFile8(responsePath, "utf8"));
     }
-    await delay2(200);
+    await delay3(200);
   }
   return null;
 }
 async function requestDesktopQuit(executablePath, target, options = {}) {
   if (!await pathExists2(executablePath)) return { ok: true, status: "not_running" };
-  const responsePath = path24.join(tmpdir(), `rudder-update-quit-${process.pid}-${Date.now()}.json`);
-  const result = spawnSync4(executablePath, [
+  const responsePath = path28.join(tmpdir2(), `rudder-update-quit-${process.pid}-${Date.now()}.json`);
+  const result = spawnSync5(executablePath, [
     `${DESKTOP_UPDATE_QUIT_ARG}=${responsePath}`,
     ...options.forceUpdate ? [DESKTOP_UPDATE_FORCE_ARG] : []
   ], {
@@ -38924,7 +39644,7 @@ async function requestDesktopQuit(executablePath, target, options = {}) {
   try {
     return await waitForUpdateQuitResponse(responsePath, options.responseTimeoutMs);
   } finally {
-    await rm3(responsePath, { force: true });
+    await rm5(responsePath, { force: true });
   }
 }
 function processExists(pid) {
@@ -38947,7 +39667,7 @@ async function waitForProcessExit(pid, timeoutMs = 2e4, intervalMs = 250) {
   const startedAt = Date.now();
   while (Date.now() - startedAt < timeoutMs) {
     if (!processExists(pid)) return true;
-    await delay2(intervalMs);
+    await delay3(intervalMs);
   }
   return !processExists(pid);
 }
@@ -38960,11 +39680,11 @@ async function waitForProcessesExit(pids, waitForExit) {
 async function removePathWithRetry(targetPath, attempts = 5) {
   for (let attempt = 0; attempt < attempts; attempt += 1) {
     try {
-      await rm3(targetPath, { recursive: true, force: true });
+      await rm5(targetPath, { recursive: true, force: true });
       if (!await pathExists2(targetPath)) return true;
     } catch {
     }
-    await delay2(500);
+    await delay3(500);
   }
   return false;
 }
@@ -38974,7 +39694,7 @@ async function prepareForDesktopReplace(paths, target, options = {}) {
   const findPids = options.findDesktopExecutablePids ?? findDesktopExecutablePids;
   async function forceQuitPidAndConfirm(pid) {
     forceQuitPid(pid, target);
-    await delay2(options.updateQuitForceDelayMs ?? UPDATE_QUIT_FORCE_DELAY_MS);
+    await delay3(options.updateQuitForceDelayMs ?? UPDATE_QUIT_FORCE_DELAY_MS);
     if (!await waitForExit(pid)) {
       throw new Error(`Rudder Desktop process ${pid} did not exit after force-quit fallback. Close Rudder and rerun start.`);
     }
@@ -38984,7 +39704,7 @@ async function prepareForDesktopReplace(paths, target, options = {}) {
     for (const pid of uniquePids) {
       forceQuitPid(pid, target);
     }
-    await delay2(options.updateQuitForceDelayMs ?? UPDATE_QUIT_FORCE_DELAY_MS);
+    await delay3(options.updateQuitForceDelayMs ?? UPDATE_QUIT_FORCE_DELAY_MS);
     if (!await waitForProcessesExit(uniquePids, waitForExit)) {
       throw new Error(`Rudder Desktop process${uniquePids.length === 1 ? "" : "es"} ${uniquePids.join(", ")} did not exit after force-quit fallback. Close Rudder and rerun start.`);
     }
@@ -39006,7 +39726,7 @@ async function prepareForDesktopReplace(paths, target, options = {}) {
       );
       options.onActiveRunsWaiting?.(quitResponse.totalRuns);
       const pollIntervalMs = options.activeRunPollIntervalMs ?? 15e3;
-      forceUpdate = options.waitForForceUpdate ? await options.waitForForceUpdate(pollIntervalMs) : (await delay2(pollIntervalMs), false);
+      forceUpdate = options.waitForForceUpdate ? await options.waitForForceUpdate(pollIntervalMs) : (await delay3(pollIntervalMs), false);
       quitResponse = await requestQuit();
     }
     if (quitResponse && !quitResponse.ok && quitResponse.status === "active_runs") {
@@ -39034,7 +39754,7 @@ async function prepareForDesktopReplace(paths, target, options = {}) {
       p15.log.warn(
         `Existing Rudder Desktop acknowledged update quit without a process id; waiting ${Math.ceil(graceMs / 1e3)}s before replacement.`
       );
-      await delay2(graceMs);
+      await delay3(graceMs);
       if (managedExecutablePids.length > 0 && !await waitForProcessesExit(managedExecutablePids, waitForExit)) {
         p15.log.warn(
           `Existing Rudder Desktop did not exit after acknowledging update quit; attempting path-scoped force-quit for process${managedExecutablePids.length === 1 ? "" : "es"} ${managedExecutablePids.join(", ")}.`
@@ -39051,7 +39771,7 @@ async function prepareForDesktopReplace(paths, target, options = {}) {
         throw new Error("Existing Rudder Desktop did not respond to the update quit request. Close Rudder and rerun start.");
       }
     } else {
-      await delay2(options.updateQuitForceDelayMs ?? UPDATE_QUIT_FORCE_DELAY_MS);
+      await delay3(options.updateQuitForceDelayMs ?? UPDATE_QUIT_FORCE_DELAY_MS);
     }
   }
   const replacePath = target.platform === "windows" ? paths.installRoot : paths.appPath;
@@ -39068,13 +39788,13 @@ async function prepareForDesktopReplace(paths, target, options = {}) {
   throw new Error(`Failed to replace existing Rudder Desktop at ${replacePath}. Close Rudder and rerun start.`);
 }
 async function installPortableDesktop(installerPath, paths, target) {
-  await mkdir3(paths.installRoot, { recursive: true });
+  await mkdir4(paths.installRoot, { recursive: true });
   if (target.platform === "linux") {
     await copyFile(installerPath, paths.appPath);
     await chmod2(paths.appPath, 493);
     return;
   }
-  const extractDir = await mkdtemp2(path24.join(tmpdir(), "rudder-desktop-extract."));
+  const extractDir = await mkdtemp2(path28.join(tmpdir2(), "rudder-desktop-extract."));
   try {
     await extractZip(installerPath, extractDir, target);
     if (target.platform === "macos") {
@@ -39083,17 +39803,17 @@ async function installPortableDesktop(installerPath, paths, target) {
       return;
     }
     const appSource = await findWindowsAppDir(extractDir);
-    await mkdir3(path24.dirname(paths.installRoot), { recursive: true });
+    await mkdir4(path28.dirname(paths.installRoot), { recursive: true });
     await copyPortableAppBundle(appSource, paths.installRoot);
   } finally {
-    await rm3(extractDir, { recursive: true, force: true });
+    await rm5(extractDir, { recursive: true, force: true });
   }
 }
 async function copyPortableAppBundle(sourcePath, destinationPath) {
   if (process.platform === "win32") {
-    await mkdir3(destinationPath, { recursive: true });
+    await mkdir4(destinationPath, { recursive: true });
     const command = buildWindowsRobocopyMirrorCommand(sourcePath, destinationPath);
-    const result = spawnSync4(command.command, command.args, {
+    const result = spawnSync5(command.command, command.args, {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -39104,7 +39824,7 @@ async function copyPortableAppBundle(sourcePath, destinationPath) {
 }
 async function removeMacQuarantine(paths, target) {
   if (target.platform !== "macos") return;
-  const result = spawnSync4("xattr", ["-dr", "com.apple.quarantine", paths.appPath], { stdio: "ignore" });
+  const result = spawnSync5("xattr", ["-dr", "com.apple.quarantine", paths.appPath], { stdio: "ignore" });
   if (result.status !== 0) {
     p15.log.warn(`Could not remove macOS quarantine attributes from ${paths.appPath}.`);
   }
@@ -39124,26 +39844,26 @@ function buildLinuxDesktopEntry(executablePath) {
   ].join("\n");
 }
 async function writeLinuxLaunchers(paths) {
-  const desktopDir = path24.join(homedir(), ".local", "share", "applications");
-  await mkdir3(desktopDir, { recursive: true });
-  await writeFile3(path24.join(desktopDir, "rudder.desktop"), buildLinuxDesktopEntry(paths.executablePath), "utf8");
-  const binDir = path24.join(homedir(), ".local", "bin");
-  await mkdir3(binDir, { recursive: true });
-  const wrapperPath = path24.join(binDir, "rudder-desktop");
+  const desktopDir = path28.join(homedir2(), ".local", "share", "applications");
+  await mkdir4(desktopDir, { recursive: true });
+  await writeFile4(path28.join(desktopDir, "rudder.desktop"), buildLinuxDesktopEntry(paths.executablePath), "utf8");
+  const binDir = path28.join(homedir2(), ".local", "bin");
+  await mkdir4(binDir, { recursive: true });
+  const wrapperPath = path28.join(binDir, "rudder-desktop");
   const escaped = paths.executablePath.replaceAll("'", `'"'"'`);
-  await writeFile3(wrapperPath, `#!/bin/sh
+  await writeFile4(wrapperPath, `#!/bin/sh
 exec '${escaped}' "$@"
 `, "utf8");
   await chmod2(wrapperPath, 493);
 }
 function buildWindowsShortcutScript(executablePath) {
-  const appData = process.env.APPDATA?.trim() || path24.join(homedir(), "AppData", "Roaming");
-  const shortcutPath = path24.join(appData, "Microsoft", "Windows", "Start Menu", "Programs", "Rudder.lnk");
+  const appData = process.env.APPDATA?.trim() || path28.join(homedir2(), "AppData", "Roaming");
+  const shortcutPath = path28.join(appData, "Microsoft", "Windows", "Start Menu", "Programs", "Rudder.lnk");
   return [
     "$shell = New-Object -ComObject WScript.Shell",
     `$shortcut = $shell.CreateShortcut(${powershellQuote(shortcutPath)})`,
     `$shortcut.TargetPath = ${powershellQuote(executablePath)}`,
-    `$shortcut.WorkingDirectory = ${powershellQuote(path24.dirname(executablePath))}`,
+    `$shortcut.WorkingDirectory = ${powershellQuote(path28.dirname(executablePath))}`,
     "$shortcut.Save()"
   ].join("; ");
 }
@@ -39153,7 +39873,7 @@ async function createPlatformLaunchers(paths, target) {
     return;
   }
   if (target.platform === "windows") {
-    const result = spawnSync4("powershell.exe", [
+    const result = spawnSync5("powershell.exe", [
       "-NoProfile",
       "-ExecutionPolicy",
       "Bypass",
@@ -39165,17 +39885,17 @@ async function createPlatformLaunchers(paths, target) {
 }
 function launchDesktop(paths, target) {
   if (target.platform === "macos") {
-    spawn3("open", [paths.appPath], { detached: true, stdio: "ignore" }).unref();
+    spawn4("open", [paths.appPath], { detached: true, stdio: "ignore" }).unref();
     return;
   }
   if (target.platform === "windows") {
-    spawn3("cmd.exe", ["/c", "start", "", paths.executablePath], { detached: true, stdio: "ignore" }).unref();
+    spawn4("cmd.exe", ["/c", "start", "", paths.executablePath], { detached: true, stdio: "ignore" }).unref();
     return;
   }
-  spawn3(paths.executablePath, [], { detached: true, stdio: "ignore" }).unref();
+  spawn4(paths.executablePath, [], { detached: true, stdio: "ignore" }).unref();
 }
 async function writeInstallMetadata(paths, releaseTag, assetName, assetChecksum, assetKind = "full") {
-  mkdirSync2(path24.dirname(paths.metadataPath), { recursive: true });
+  mkdirSync3(path28.dirname(paths.metadataPath), { recursive: true });
   const metadata = {
     version: 1,
     releaseTag,
@@ -39184,8 +39904,8 @@ async function writeInstallMetadata(paths, releaseTag, assetName, assetChecksum,
     assetKind,
     installedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
-  mkdirSync2(paths.installRoot, { recursive: true });
-  await writeFile3(paths.metadataPath, `${JSON.stringify(metadata, null, 2)}
+  mkdirSync3(paths.installRoot, { recursive: true });
+  await writeFile4(paths.metadataPath, `${JSON.stringify(metadata, null, 2)}
 `, "utf8");
 }
 async function runStartPhase(message, successMessage, task, progressPhase) {
@@ -39214,10 +39934,27 @@ async function runStartPhase(message, successMessage, task, progressPhase) {
   }
 }
 async function startCommand(opts) {
-  const installCli = opts.cli !== false;
+  applyLocalEnvProfile(opts);
+  applyDataDirOverride(opts);
   const serverOnly = opts.serverOnly === true;
-  const installDesktop = !serverOnly && opts.desktop !== false;
-  const installRuntime = opts.runtime !== false;
+  const installApp = !serverOnly && opts.desktop !== false;
+  const requestedDesktopMode = parseDesktopLaunchMode(opts.desktopMode);
+  const desktopTarget = installApp ? resolveDesktopAssetTarget() : null;
+  const automaticCompatibilityCheck = requestedDesktopMode === "auto" && opts.desktopMode !== void 0;
+  const smartAppControlState = desktopTarget?.platform === "windows" && automaticCompatibilityCheck ? detectSmartAppControlState() : "unknown";
+  const desktopMode = installApp ? resolveDesktopLaunchMode({
+    requested: requestedDesktopMode,
+    platform: process.platform,
+    smartAppControlState
+  }) : "native";
+  if (desktopMode === "browser" && desktopTarget?.platform !== "windows") {
+    throw new Error("Rudder browser-app compatibility mode is currently available only on Windows.");
+  }
+  const installDesktop = installApp && desktopMode === "native";
+  const installBrowserApp = installApp && desktopMode === "browser";
+  const browserLocalProfile = installBrowserApp ? resolveActiveLocalEnvProfile() ?? applyLocalEnvProfile({ localEnv: "prod_local" }) : null;
+  const installCli = opts.cli !== false || installBrowserApp;
+  const installRuntime = opts.runtime !== false || installBrowserApp;
   const repo = opts.repo?.trim() || DEFAULT_DESKTOP_RELEASE_REPO;
   const version = opts.targetVersion?.trim() || opts.version?.trim() || resolveCurrentCliVersion();
   const dryRun = opts.dryRun === true;
@@ -39231,7 +39968,7 @@ async function startCommand(opts) {
     if (!exactDesktopAssetPath || !exactDesktopAssetChecksum || !exactDesktopAssetName || !exactDesktopReleaseDigest) {
       throw new Error("Exact Desktop asset mode requires path, checksum, asset name, and release digest.");
     }
-    if (!path24.isAbsolute(exactDesktopAssetPath) || exactDesktopAssetName.includes("/") || !/^[a-f0-9]{64}$/iu.test(exactDesktopAssetChecksum) || !/^[a-f0-9]{64}$/iu.test(exactDesktopReleaseDigest)) {
+    if (!path28.isAbsolute(exactDesktopAssetPath) || exactDesktopAssetName.includes("/") || !/^[a-f0-9]{64}$/iu.test(exactDesktopAssetChecksum) || !/^[a-f0-9]{64}$/iu.test(exactDesktopReleaseDigest)) {
       throw new Error("Exact Desktop asset mode received invalid candidate identity.");
     }
     if (opts.desktopAssetKind && opts.desktopAssetKind !== "full" && opts.desktopAssetKind !== "shell") {
@@ -39244,10 +39981,20 @@ async function startCommand(opts) {
       if (error.code !== "EPIPE") throw error;
     });
   }
-  if (!installCli && !installDesktop && !installRuntime) {
+  if (!installCli && !installApp && !installRuntime) {
     throw new Error("Nothing to start. Remove --no-cli, --no-runtime, --no-desktop, or --server-only.");
   }
   p15.intro(pc14.bgCyan(pc14.black(serverOnly ? " rudder start --server-only " : " rudder start ")));
+  if (installBrowserApp) {
+    p15.log.warn(
+      requestedDesktopMode === "browser" ? "Using the requested Windows browser-app compatibility mode." : "Windows Smart App Control is on, so Rudder will use browser-app compatibility mode instead of the unsigned Desktop executable."
+    );
+    p15.log.message(
+      pc14.dim(
+        "This is a loopback-only local_trusted client without the packaged Desktop Account Gate. Local data stays in place; Electron-only Browser and App Builder bridges are unavailable."
+      )
+    );
+  }
   if (opts.versionCheck !== false) {
     const updateNotice = await getCliUpdateNotice(version);
     if (updateNotice) p15.log.warn(updateNotice);
@@ -39339,15 +40086,86 @@ async function startCommand(opts) {
       spinner3.stop(`${pc14.cyan("rudder")} CLI installed.`);
     }
   }
+  if (installBrowserApp) {
+    const target = desktopTarget;
+    const installRoot = opts.desktopInstallDir ? path28.resolve(opts.desktopInstallDir) : resolveDefaultDesktopInstallRoot(target);
+    const installPaths = resolveDesktopInstallPaths(target, installRoot);
+    const runtimeVersion = version;
+    if (!browserLocalProfile) throw new Error("Rudder browser-app requires a local environment profile.");
+    const dataDir = resolveRudderHomeDir();
+    p15.log.step("Preparing Windows browser app");
+    p15.log.message(`Runtime: ${pc14.cyan(runtimeVersion)}`);
+    p15.log.message(`Workspace: ${pc14.cyan(`${browserLocalProfile.name}/${browserLocalProfile.instanceId}`)}`);
+    if (dryRun) {
+      p15.log.message(
+        `[dry-run] Would create a Rudder Start Menu shortcut backed by Node and open the local workspace in Microsoft Edge app mode.`
+      );
+      p15.outro(pc14.green("Dry run complete."));
+      return;
+    }
+    const cliEntryPath = resolveGlobalInstalledCliEntry();
+    if (!await pathExists2(cliEntryPath)) {
+      throw new Error(`Persistent Rudder CLI entry was not found at ${cliEntryPath}.`);
+    }
+    await mkdir4(installRoot, { recursive: true });
+    const edgePath = resolveEdgeExecutable();
+    const nativeIconPath = await pathExists2(installPaths.executablePath) ? installPaths.executablePath : null;
+    const shortcutPath = createWindowsBrowserAppShortcut({
+      nodePath: process.execPath,
+      cliEntryPath,
+      localEnv: browserLocalProfile.name,
+      dataDir,
+      runtimeVersion,
+      workingDirectory: installRoot,
+      iconPath: nativeIconPath ?? edgePath
+    });
+    p15.log.success(`Rudder browser-app shortcut is ready at ${pc14.cyan(shortcutPath)}.`);
+    let applySignalController = null;
+    if (desktopProgressJson && opts.desktopWaitForApply === true) {
+      writeDesktopProgress({
+        phase: "ready_to_install",
+        message: "Windows browser-app compatibility mode is ready.",
+        percent: 100
+      });
+      applySignalController = createDesktopApplySignalController();
+      await applySignalController.waitForInitialSignal();
+      applySignalController.close();
+      writeDesktopProgress({
+        phase: "preparing_restart",
+        message: "Starting the Windows browser app...",
+        percent: 100
+      });
+    }
+    if (opts.open !== false) {
+      const launch = await launchDetachedBrowserApp({
+        cliEntryPath,
+        localEnv: browserLocalProfile.name,
+        dataDir,
+        runtimeVersion,
+        open: true
+      });
+      p15.log.success(`Rudder browser app opened at ${pc14.cyan(launch.boardUrl)}.`);
+      p15.log.message(pc14.dim(`Background runtime log: ${launch.logPath}`));
+      if (desktopProgressJson) {
+        writeDesktopProgress({
+          phase: "closing",
+          message: "Rudder browser app is ready. You can close the native Desktop window.",
+          percent: 100
+        });
+      }
+    }
+    p15.outro(pc14.green("Rudder start complete."));
+    return;
+  }
   if (installDesktop) {
     const downloadSource = resolveDesktopDownloadSource(opts.downloadSource);
     const mirrorBaseUrl = resolveDesktopReleaseMirrorBaseUrl(repo);
     const smokeReleaseBaseUrls = resolveDesktopSmokeReleaseBaseUrls();
-    const target = resolveDesktopAssetTarget();
+    const target = desktopTarget;
     const tag = resolveDesktopReleaseTag(version);
-    const installRoot = opts.desktopInstallDir ? path24.resolve(opts.desktopInstallDir) : resolveDefaultDesktopInstallRoot(target);
+    const installRoot = opts.desktopInstallDir ? path28.resolve(opts.desktopInstallDir) : resolveDefaultDesktopInstallRoot(target);
     const installPaths = resolveDesktopInstallPaths(target, installRoot);
-    const outputDir = opts.outputDir ? path24.resolve(opts.outputDir) : await mkdtemp2(path24.join(tmpdir(), "rudder-desktop-installer."));
+    const outputDir = opts.outputDir ? path28.resolve(opts.outputDir) : await mkdtemp2(path28.join(tmpdir2(), "rudder-desktop-installer."));
     p15.log.step("Installing desktop app");
     p15.log.message(`Release: ${pc14.cyan(`${repo}@${tag}`)}`);
     p15.log.message(`Target: ${pc14.cyan(`${target.platform}/${target.arch}`)}`);
@@ -39393,7 +40211,7 @@ async function startCommand(opts) {
         if (linkDescriptor.isSymbolicLink()) throw new Error("Exact Desktop asset must not be a symbolic link.");
         const checksum = await runStartPhase(
           "Verifying staged Desktop checksum...",
-          `Verified ${pc14.cyan(path24.basename(exactDesktopAssetPath))}.`,
+          `Verified ${pc14.cyan(path28.basename(exactDesktopAssetPath))}.`,
           () => assertChecksumMatch(exactDesktopAssetPath, expectedChecksum),
           desktopProgressJson ? "verifying_checksum" : null
         );
@@ -39512,7 +40330,7 @@ async function startCommand(opts) {
         }
         const checksum = await runStartPhase(
           "Verifying Desktop checksum...",
-          `Verified ${pc14.cyan(path24.basename(verifiedAsset.path))}.`,
+          `Verified ${pc14.cyan(path28.basename(verifiedAsset.path))}.`,
           () => assertChecksumMatch(verifiedAsset.path, expectedChecksum),
           desktopProgressJson ? "verifying_checksum" : null
         );
@@ -39524,7 +40342,7 @@ async function startCommand(opts) {
             assetName: selectedAsset.name,
             assetChecksum: checksum,
             assetKind: selectedAssetKind,
-            stagedArtifactPath: path24.resolve(verifiedAsset.path),
+            stagedArtifactPath: path28.resolve(verifiedAsset.path),
             stagedArtifactDigest: checksum,
             releaseDigest: createHash5("sha256").update(JSON.stringify({
               releaseTag,
@@ -39615,31 +40433,6 @@ async function startCommand(opts) {
   p15.outro(pc14.green("Rudder start complete."));
 }
 
-// src/config/data-dir.ts
-init_home();
-import path25 from "node:path";
-function applyDataDirOverride(options, support = {}) {
-  const rawDataDir = options.dataDir?.trim();
-  if (!rawDataDir) return null;
-  const resolvedDataDir = path25.resolve(expandHomePrefix(rawDataDir));
-  process.env.RUDDER_HOME = resolvedDataDir;
-  if (support.hasConfigOption) {
-    const hasConfigOverride = Boolean(options.config?.trim()) || Boolean(process.env.RUDDER_CONFIG?.trim());
-    if (!hasConfigOverride) {
-      const instanceId = resolveRudderInstanceId(options.instance);
-      process.env.RUDDER_INSTANCE_ID = instanceId;
-      process.env.RUDDER_CONFIG = resolveDefaultConfigPath(instanceId);
-    }
-  }
-  if (support.hasContextOption) {
-    const hasContextOverride = Boolean(options.context?.trim()) || Boolean(process.env.RUDDER_CONTEXT?.trim());
-    if (!hasContextOverride) {
-      process.env.RUDDER_CONTEXT = resolveDefaultContextPath();
-    }
-  }
-  return resolvedDataDir;
-}
-
 // src/program.ts
 init_env();
 init_local_env();
@@ -39681,7 +40474,8 @@ function createProgram() {
     });
     loadRudderEnvFile(options.config);
   });
-  program.command("start").description("Start Rudder Desktop and prepare the matching persistent CLI").option("--server-only", "Prepare the Rudder server runtime and persistent CLI without installing Desktop").option("--no-cli", "Skip persistent CLI installation").option("--no-runtime", "Skip Rudder runtime installation").option("--no-desktop", "Skip desktop app installation").option("--version <version>", "Rudder version to start (default: current CLI version)").option("--target-version <version>", "Rudder version to start; avoids the root CLI version flag").option("--repo <owner/repo>", "GitHub repository that hosts desktop releases").option("--download-source <source>", "Desktop download source: auto, cn, or global").option("--output-dir <path>", "Directory for downloaded desktop release assets").option("--desktop-install-dir <path>", "Directory for the portable Desktop install").option("--no-open", "Install Desktop without launching it").option("--wait-for-active-runs", "Wait for active Rudder runs to finish before replacing Desktop", false).option("--desktop-progress-json", "Emit newline-delimited Desktop update progress events").option("--desktop-wait-for-apply", "Wait for an apply signal after downloading and verifying the Desktop update", false).option("--desktop-prepare-only", "Download and verify the Desktop update without installing or launching it", false).option("--desktop-asset-path <path>", "Use one previously staged, exact Desktop asset path").option("--desktop-asset-checksum <sha256>", "SHA-256 for the exact staged Desktop asset").option("--desktop-asset-name <name>", "Asset name bound to the exact staged Desktop candidate").option("--desktop-asset-kind <kind>", "Asset kind bound to the exact staged Desktop candidate (full or shell)").option("--desktop-release-digest <sha256>", "Release digest bound to the exact staged Desktop candidate").addOption(new Option("--desktop-runtime-best-effort").hideHelp()).option("--no-version-check", "Skip checking npm for a newer Rudder CLI version").option("--dry-run", "Print the start actions without changing the machine", false).action(startCommand);
+  program.command("start").description("Start Rudder Desktop and prepare the matching persistent CLI").option("--server-only", "Prepare the Rudder server runtime and persistent CLI without installing Desktop").option("--no-cli", "Skip persistent CLI installation").option("--no-runtime", "Skip Rudder runtime installation").option("--no-desktop", "Skip desktop app installation").option("--version <version>", "Rudder version to start (default: current CLI version)").option("--target-version <version>", "Rudder version to start; avoids the root CLI version flag").option("--repo <owner/repo>", "GitHub repository that hosts desktop releases").option("--download-source <source>", "Desktop download source: auto, cn, or global").option("--output-dir <path>", "Directory for downloaded desktop release assets").option("--desktop-install-dir <path>", "Directory for the portable Desktop install").option("--desktop-mode <mode>", "Desktop launch mode: auto, native, or browser", "auto").option("-d, --data-dir <path>", DATA_DIR_OPTION_HELP).option("--no-open", "Install Desktop without launching it").option("--wait-for-active-runs", "Wait for active Rudder runs to finish before replacing Desktop", false).option("--desktop-progress-json", "Emit newline-delimited Desktop update progress events").option("--desktop-wait-for-apply", "Wait for an apply signal after downloading and verifying the Desktop update", false).option("--desktop-prepare-only", "Download and verify the Desktop update without installing or launching it", false).option("--desktop-asset-path <path>", "Use one previously staged, exact Desktop asset path").option("--desktop-asset-checksum <sha256>", "SHA-256 for the exact staged Desktop asset").option("--desktop-asset-name <name>", "Asset name bound to the exact staged Desktop candidate").option("--desktop-asset-kind <kind>", "Asset kind bound to the exact staged Desktop candidate (full or shell)").option("--desktop-release-digest <sha256>", "Release digest bound to the exact staged Desktop candidate").addOption(new Option("--desktop-runtime-best-effort").hideHelp()).option("--no-version-check", "Skip checking npm for a newer Rudder CLI version").option("--dry-run", "Print the start actions without changing the machine", false).action(startCommand);
+  program.command("browser-app").description("Open Rudder in a system browser app window").option("--runtime-version <version>", "Rudder server runtime version").option("-d, --data-dir <path>", DATA_DIR_OPTION_HELP).option("--child", "Run the hidden browser-app server child", false).option("--ready-file <path>", "Internal startup handoff file").option("--no-open", "Start or attach to the local runtime without opening the app window").action(browserAppCommand);
   program.command("onboard").description("Interactive first-run setup wizard").option("-c, --config <path>", "Path to config file").option("-d, --data-dir <path>", DATA_DIR_OPTION_HELP).option("-y, --yes", "Accept defaults (quickstart + start immediately)", false).option("--run", "Start Rudder immediately after saving config", false).action(onboard);
   program.command("doctor").description("Run diagnostic checks on your Rudder setup").option("-c, --config <path>", "Path to config file").option("-d, --data-dir <path>", DATA_DIR_OPTION_HELP).option("--repair", "Attempt to repair issues automatically").alias("--fix").option("-y, --yes", "Skip repair confirmation prompts").action(async (opts) => {
     await doctor(opts);