@skrr-ai/cli 0.1.114 → 0.1.116

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/firstPartyHarnessUpdater.js

@@ -1,945 +1,843 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
 };
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.MAX_ARTIFACT_BYTES = exports.PROVENANCE_SUFFIX = exports.PREVIOUS_SUFFIX = exports.firstPartyHarnessManifestFile = exports.firstPartyHarnessFeedCandidates = exports.firstPartyHarnessFeedBase = exports.FIRST_PARTY_HARNESS_RELEASE_PUBLIC_KEYS = void 0;
-exports.firstPartyHarnessInstallDir = firstPartyHarnessInstallDir;
-exports.firstPartyHarnessBinaryPath = firstPartyHarnessBinaryPath;
-exports.firstPartyHarnessPlatformKey = firstPartyHarnessPlatformKey;
-exports.fetchVerifiedManifest = fetchVerifiedManifest;
-exports.isManagedFirstPartyHarnessReleasePath = isManagedFirstPartyHarnessReleasePath;
-exports.getVerifiedInstalledFirstPartyHarness = getVerifiedInstalledFirstPartyHarness;
-exports.readFirstPartyHarnessUpdateState = readFirstPartyHarnessUpdateState;
-exports.activateVerifiedFirstPartyHarnessArtifact = activateVerifiedFirstPartyHarnessArtifact;
-exports.checkFirstPartyHarnessUpdate = checkFirstPartyHarnessUpdate;
-exports.installFirstPartyHarness = installFirstPartyHarness;
-exports.rollbackFirstPartyHarness = rollbackFirstPartyHarness;
-exports.installedFirstPartyHarnessSize = installedFirstPartyHarnessSize;
-/**
- * One signed engine installation transaction for CLI, Daemon and Desktop.
- * Releases contain both executable and provenance; replacing `current` is the
- * only activation operation. Existing sessions keep their immutable executable.
- * The signing identity is independent of the daemon release identity.
- */
-const node_crypto_1 = require("node:crypto");
-const node_fs_1 = require("node:fs");
-const node_path_1 = __importDefault(require("node:path"));
-const proper_lockfile_1 = __importDefault(require("proper-lockfile"));
-const firstPartyHarness_js_1 = require("./firstPartyHarness.js");
-const firstPartyHarnessHome_js_1 = require("./firstPartyHarnessHome.js");
-const firstPartyHarnessChannels_js_1 = require("./firstPartyHarnessChannels.js");
-const releaseManifest_js_1 = require("./releaseManifest.js");
-const firstPartyHarnessReleaseKeys_js_1 = require("./firstPartyHarnessReleaseKeys.js");
-const releaseVersions_js_1 = require("./releaseVersions.js");
-const releasePolicy_js_1 = require("./releasePolicy.js");
-var firstPartyHarnessReleaseKeys_js_2 = require("./firstPartyHarnessReleaseKeys.js");
-Object.defineProperty(exports, "FIRST_PARTY_HARNESS_RELEASE_PUBLIC_KEYS", { enumerable: true, get: function () { return firstPartyHarnessReleaseKeys_js_2.FIRST_PARTY_HARNESS_RELEASE_PUBLIC_KEYS; } });
-var firstPartyHarnessChannels_js_2 = require("./firstPartyHarnessChannels.js");
-Object.defineProperty(exports, "firstPartyHarnessFeedBase", { enumerable: true, get: function () { return firstPartyHarnessChannels_js_2.firstPartyHarnessFeedBase; } });
-Object.defineProperty(exports, "firstPartyHarnessFeedCandidates", { enumerable: true, get: function () { return firstPartyHarnessChannels_js_2.firstPartyHarnessFeedCandidates; } });
-var firstPartyHarness_js_2 = require("./firstPartyHarness.js");
-Object.defineProperty(exports, "firstPartyHarnessManifestFile", { enumerable: true, get: function () { return firstPartyHarness_js_2.firstPartyHarnessManifestFile; } });
-exports.PREVIOUS_SUFFIX = firstPartyHarnessHome_js_1.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX;
-exports.PROVENANCE_SUFFIX = firstPartyHarnessHome_js_1.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX;
-exports.MAX_ARTIFACT_BYTES = 400 * 1024 * 1024;
-const MANIFEST_FETCH_TIMEOUT_MS = 30_000;
-const ARTIFACT_FETCH_TIMEOUT_MS = 10 * 60_000;
-const LOCK_STALE_MS = 120_000;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var firstPartyHarnessUpdater_exports = {};
+__export(firstPartyHarnessUpdater_exports, {
+  FIRST_PARTY_HARNESS_RELEASE_PUBLIC_KEYS: () => import_firstPartyHarnessReleaseKeys2.FIRST_PARTY_HARNESS_RELEASE_PUBLIC_KEYS,
+  MAX_ARTIFACT_BYTES: () => MAX_ARTIFACT_BYTES,
+  PREVIOUS_SUFFIX: () => PREVIOUS_SUFFIX,
+  PROVENANCE_SUFFIX: () => PROVENANCE_SUFFIX,
+  activateVerifiedFirstPartyHarnessArtifact: () => activateVerifiedFirstPartyHarnessArtifact,
+  checkFirstPartyHarnessUpdate: () => checkFirstPartyHarnessUpdate,
+  fetchVerifiedManifest: () => fetchVerifiedManifest,
+  firstPartyHarnessBinaryPath: () => firstPartyHarnessBinaryPath,
+  firstPartyHarnessFeedBase: () => import_firstPartyHarnessChannels2.firstPartyHarnessFeedBase,
+  firstPartyHarnessFeedCandidates: () => import_firstPartyHarnessChannels2.firstPartyHarnessFeedCandidates,
+  firstPartyHarnessInstallDir: () => firstPartyHarnessInstallDir,
+  firstPartyHarnessManifestFile: () => import_firstPartyHarness2.firstPartyHarnessManifestFile,
+  firstPartyHarnessPlatformKey: () => firstPartyHarnessPlatformKey,
+  getVerifiedInstalledFirstPartyHarness: () => getVerifiedInstalledFirstPartyHarness,
+  installFirstPartyHarness: () => installFirstPartyHarness,
+  installedFirstPartyHarnessSize: () => installedFirstPartyHarnessSize,
+  isManagedFirstPartyHarnessReleasePath: () => isManagedFirstPartyHarnessReleasePath,
+  readFirstPartyHarnessUpdateState: () => readFirstPartyHarnessUpdateState,
+  rollbackFirstPartyHarness: () => rollbackFirstPartyHarness
+});
+module.exports = __toCommonJS(firstPartyHarnessUpdater_exports);
+var import_node_crypto = require("node:crypto");
+var import_node_fs = require("node:fs");
+var import_node_path = __toESM(require("node:path"), 1);
+var import_proper_lockfile = __toESM(require("proper-lockfile"), 1);
+var import_firstPartyHarness = require("./firstPartyHarness.js");
+var import_firstPartyHarnessHome = require("./firstPartyHarnessHome.js");
+var import_firstPartyHarnessChannels = require("./firstPartyHarnessChannels.js");
+var import_releaseManifest = require("./releaseManifest.js");
+var import_firstPartyHarnessReleaseKeys = require("./firstPartyHarnessReleaseKeys.js");
+var import_releaseVersions = require("./releaseVersions.js");
+var import_releasePolicy = require("./releasePolicy.js");
+var import_firstPartyHarnessReleaseKeys2 = require("./firstPartyHarnessReleaseKeys.js");
+var import_firstPartyHarnessChannels2 = require("./firstPartyHarnessChannels.js");
+var import_firstPartyHarness2 = require("./firstPartyHarness.js");
+const PREVIOUS_SUFFIX = import_firstPartyHarnessHome.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX;
+const PROVENANCE_SUFFIX = import_firstPartyHarnessHome.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX;
+const MAX_ARTIFACT_BYTES = 400 * 1024 * 1024;
+const MANIFEST_FETCH_TIMEOUT_MS = 3e4;
+const ARTIFACT_FETCH_TIMEOUT_MS = 10 * 6e4;
+const LOCK_STALE_MS = 12e4;
 function fail(code, error) {
-    return { ok: false, code, error };
+  return { ok: false, code, error };
 }
 function fetchSignal(options, timeout) {
-    return options.signal
-        ? AbortSignal.any([options.signal, AbortSignal.timeout(timeout)])
-        : AbortSignal.timeout(timeout);
+  return options.signal ? AbortSignal.any([options.signal, AbortSignal.timeout(timeout)]) : AbortSignal.timeout(timeout);
 }
 function firstPartyHarnessInstallDir(env = process.env) {
-    return (0, firstPartyHarnessHome_js_1.firstPartyHarnessBinDir)(env);
+  return (0, import_firstPartyHarnessHome.firstPartyHarnessBinDir)(env);
 }
 function firstPartyHarnessBinaryPath(env = process.env) {
-    return (0, firstPartyHarnessHome_js_1.firstPartyHarnessInstalledBinaryPath)(env);
+  return (0, import_firstPartyHarnessHome.firstPartyHarnessInstalledBinaryPath)(env);
 }
 function firstPartyHarnessPlatformKey(platform = process.platform, arch = process.arch) {
-    const cpu = arch === 'arm64' || arch === 'aarch64'
-        ? 'arm64'
-        : arch === 'x64' || arch === 'x86_64'
-            ? 'x64'
-            : null;
-    if (!cpu ||
-        !['darwin', 'linux', 'win32'].includes(platform) ||
-        (platform === 'win32' && cpu !== 'x64'))
-        return null;
-    return `${platform}-${cpu}`;
+  const cpu = arch === "arm64" || arch === "aarch64" ? "arm64" : arch === "x64" || arch === "x86_64" ? "x64" : null;
+  if (!cpu || !["darwin", "linux", "win32"].includes(platform) || platform === "win32" && cpu !== "x64")
+    return null;
+  return `${platform}-${cpu}`;
 }
 async function fetchVerifiedManifest(options = {}) {
-    const env = options.env ?? process.env;
-    const keys = options.keys ?? firstPartyHarnessReleaseKeys_js_1.FIRST_PARTY_HARNESS_RELEASE_PUBLIC_KEYS;
-    const rawFetch = options.fetchImpl ?? globalThis.fetch;
-    if (options.version && (0, releaseVersions_js_1.compareReleaseVersions)(options.version, options.version) === null)
-        return fail('version-invalid', 'requested version is not a semantic release version');
-    if (!keys || keys.length === 0) {
-        // See the header: unlike the daemon's self-update, an unverifiable harness
-        // is refused rather than installed. Provisioning the keypair must never be
-        // the thing that REDUCES what the daemon accepts.
-        return fail('no-pinned-keys', `no pinned ${firstPartyHarness_js_1.FIRST_PARTY_HARNESS.displayName} release keys — refusing to install`);
-    }
-    if (typeof rawFetch !== 'function') {
-        return fail('feed-unreachable', 'no fetch implementation available');
-    }
-    // A host the egress policy blocks must say so, not read as a certificate
-    // error (OSK-11947; see fetch-failure.ts).
-    const doFetch = rawFetch;
-    // WL-6.6 — the channel decides WHICH signed manifest, and nothing else.
-    //
-    // `latest/` was the only path this installer could read, which left the
-    // channel prefixes provisioned in terraform unreachable by any client. The
-    // channel is resolved here and nowhere else: artifact urls come from INSIDE
-    // the manifest and are never rewritten, because a channel in an artifact url
-    // would enter the signed message and turn every promotion into a re-signing
-    // ceremony.
-    //
-    // An unrecognised channel resolves to `stable` and reports rather than
-    // throwing. A typo must not leave a machine unable to install anything —
-    // that turns a harmless mistake into the outage this installer exists to
-    // avoid.
-    const { channel, invalid, source } = (0, firstPartyHarnessChannels_js_1.resolveFirstPartyHarnessChannel)(env);
-    if (invalid) {
-        options.onProgress?.(`unknown update channel ${JSON.stringify(invalid)} in ${source ?? firstPartyHarness_js_1.FIRST_PARTY_HARNESS_ENV.channel.name}; ` +
-            `using ${channel}. Valid: ${firstPartyHarnessChannels_js_1.FIRST_PARTY_HARNESS_CHANNELS.join(', ')}.`);
-    }
-    // Every place the manifest may be published, canonical spelling first.
-    //
-    // Which spellings depends on what is read. A CHANNEL pointer is current state,
-    // so only the accepted spellings are tried: a former spelling's pointer stopped
-    // moving when publishing stopped writing it, and falling back to one would
-    // install whatever it named on the day of contract. A PINNED release is an
-    // immutable artifact, so former spellings are tried too: a release published
-    // before the canonical prefix existed lives only under the old one, with the
-    // same signed bytes it would have anywhere.
-    //
-    // Move to the next candidate ONLY when this one is not there. A candidate that
-    // answers with a manifest ends the search, whatever that manifest turns out to
-    // be: falling through on a malformed or badly signed canonical manifest would
-    // let anyone who can make the canonical object fail verification steer the
-    // install onto an older spelling's feed — a downgrade by denial.
-    //
-    // "Not there" is 403 as well as 404. A prefix with no manifest answers 403 (the
-    // bucket denies ListBucket, so a missing key cannot be reported as 404).
-    const notFound = [];
-    let body;
-    for (const candidate of (0, firstPartyHarnessChannels_js_1.firstPartyHarnessFeedCandidates)(env, {
-        pinnedRelease: Boolean(options.version),
-    })) {
-        const url = (0, firstPartyHarnessChannels_js_1.resolveChannelManifestUrl)({
-            base: candidate.base,
-            manifestFilename: candidate.manifestFilename,
-            channel,
-            pinnedVersion: options.version ?? null,
-        });
-        try {
-            const res = await doFetch(url, {
-                signal: fetchSignal(options, options.manifestTimeoutMs ?? MANIFEST_FETCH_TIMEOUT_MS),
-                redirect: 'follow',
-            });
-            if (res.status === 403 || res.status === 404) {
-                notFound.push(`HTTP ${res.status} for ${url}`);
-                continue;
-            }
-            if (!res.ok) {
-                return fail('feed-unreachable', `manifest fetch failed: HTTP ${res.status} for ${url}`);
-            }
-            body = await res.text();
-            break;
-        }
-        catch (err) {
-            return fail('feed-unreachable', `manifest fetch failed: ${err.message}`);
-        }
-    }
-    if (body === undefined) {
-        // Name the CHANNEL when the object simply is not there anywhere.
-        //
-        // A 403 reads as "you are not allowed" — the one thing it does not mean,
-        // since this feed is public. A user on the default channel with nothing
-        // published yet would otherwise see a permissions error for a
-        // release-management state, and go looking at their credentials. A PINNED
-        // version keeps the raw failure: `releases/<v>/` missing means that exact
-        // release does not exist, and a channel setting has nothing to do with it.
-        const tried = notFound.join('; ');
-        if (!options.version) {
-            return fail('feed-unreachable', `no ${firstPartyHarness_js_1.FIRST_PARTY_HARNESS.displayName} release published on the '${channel}' channel (${tried}). ` +
-                `Set ${firstPartyHarness_js_1.FIRST_PARTY_HARNESS_ENV.channel.name} to a channel that has one, or pin a version.`);
-        }
-        return fail('feed-unreachable', `manifest fetch failed: ${tried}`);
-    }
-    let manifest;
-    try {
-        manifest = JSON.parse(body);
-    }
-    catch (err) {
-        return fail('manifest-malformed', `manifest is not JSON: ${err.message}`);
-    }
-    if (!manifest ||
-        typeof manifest.version !== 'string' ||
-        !manifest.platforms ||
-        typeof manifest.platforms !== 'object' ||
-        Array.isArray(manifest.platforms) ||
-        (0, releaseVersions_js_1.compareReleaseVersions)(manifest.version, manifest.version) === null) {
-        return fail('manifest-malformed', 'manifest is missing version or platforms');
-    }
-    const verdict = (0, releaseManifest_js_1.verifyManifest)(manifest, keys);
-    if (!('ok' in verdict) || verdict.ok !== true) {
-        const reason = 'reason' in verdict ? verdict.reason : 'verification disabled';
-        return fail('manifest-unverified', `manifest signature rejected: ${reason}`);
-    }
-    if (options.version && manifest.version !== options.version) {
-        return fail('manifest-malformed', 'pinned manifest version does not match requested version');
-    }
-    if ((0, releaseVersions_js_1.compareReleaseVersions)(manifest.minimum, manifest.version) === null ||
-        (0, releaseVersions_js_1.compareReleaseVersions)(manifest.minimum, manifest.version) > 0) {
-        return fail('manifest-malformed', 'manifest minimum is invalid or newer than its release');
-    }
+  const env = options.env ?? process.env;
+  const keys = options.keys ?? import_firstPartyHarnessReleaseKeys.FIRST_PARTY_HARNESS_RELEASE_PUBLIC_KEYS;
+  const rawFetch = options.fetchImpl ?? globalThis.fetch;
+  if (options.version && (0, import_releaseVersions.compareReleaseVersions)(options.version, options.version) === null)
+    return fail("version-invalid", "requested version is not a semantic release version");
+  if (!keys || keys.length === 0) {
+    return fail("no-pinned-keys", `no pinned ${import_firstPartyHarness.FIRST_PARTY_HARNESS.displayName} release keys \u2014 refusing to install`);
+  }
+  if (typeof rawFetch !== "function") {
+    return fail("feed-unreachable", "no fetch implementation available");
+  }
+  const doFetch = rawFetch;
+  const { channel, invalid, source } = (0, import_firstPartyHarnessChannels.resolveFirstPartyHarnessChannel)(env);
+  if (invalid) {
+    options.onProgress?.(`unknown update channel ${JSON.stringify(invalid)} in ${source ?? import_firstPartyHarness.FIRST_PARTY_HARNESS_ENV.channel.name}; using ${channel}. Valid: ${import_firstPartyHarnessChannels.FIRST_PARTY_HARNESS_CHANNELS.join(", ")}.`);
+  }
+  const notFound = [];
+  let body;
+  for (const candidate of (0, import_firstPartyHarnessChannels.firstPartyHarnessFeedCandidates)(env, {
+    pinnedRelease: Boolean(options.version)
+  })) {
+    const url = (0, import_firstPartyHarnessChannels.resolveChannelManifestUrl)({
+      base: candidate.base,
+      manifestFilename: candidate.manifestFilename,
+      channel,
+      pinnedVersion: options.version ?? null
+    });
     try {
-        const policy = validateEnginePolicy(manifest, options);
-        if (policy)
-            return policy;
-    }
-    catch (error) {
-        return fail('policy-rejected', `engine release policy is malformed: ${describe(error)}`);
-    }
-    return { ok: true, manifest };
+      const res = await doFetch(url, {
+        signal: fetchSignal(options, options.manifestTimeoutMs ?? MANIFEST_FETCH_TIMEOUT_MS),
+        redirect: "follow"
+      });
+      if (res.status === 403 || res.status === 404) {
+        notFound.push(`HTTP ${res.status} for ${url}`);
+        continue;
+      }
+      if (!res.ok) {
+        return fail("feed-unreachable", `manifest fetch failed: HTTP ${res.status} for ${url}`);
+      }
+      body = await res.text();
+      break;
+    } catch (err) {
+      return fail("feed-unreachable", `manifest fetch failed: ${err.message}`);
+    }
+  }
+  if (body === void 0) {
+    const tried = notFound.join("; ");
+    if (!options.version) {
+      return fail("feed-unreachable", `no ${import_firstPartyHarness.FIRST_PARTY_HARNESS.displayName} release published on the '${channel}' channel (${tried}). Set ${import_firstPartyHarness.FIRST_PARTY_HARNESS_ENV.channel.name} to a channel that has one, or pin a version.`);
+    }
+    return fail("feed-unreachable", `manifest fetch failed: ${tried}`);
+  }
+  let manifest;
+  try {
+    manifest = JSON.parse(body);
+  } catch (err) {
+    return fail("manifest-malformed", `manifest is not JSON: ${err.message}`);
+  }
+  if (!manifest || typeof manifest.version !== "string" || !manifest.platforms || typeof manifest.platforms !== "object" || Array.isArray(manifest.platforms) || (0, import_releaseVersions.compareReleaseVersions)(manifest.version, manifest.version) === null) {
+    return fail("manifest-malformed", "manifest is missing version or platforms");
+  }
+  const verdict = (0, import_releaseManifest.verifyManifest)(manifest, keys);
+  if (!("ok" in verdict) || verdict.ok !== true) {
+    const reason = "reason" in verdict ? verdict.reason : "verification disabled";
+    return fail("manifest-unverified", `manifest signature rejected: ${reason}`);
+  }
+  if (options.version && manifest.version !== options.version) {
+    return fail("manifest-malformed", "pinned manifest version does not match requested version");
+  }
+  if ((0, import_releaseVersions.compareReleaseVersions)(manifest.minimum, manifest.version) === null || (0, import_releaseVersions.compareReleaseVersions)(manifest.minimum, manifest.version) > 0) {
+    return fail("manifest-malformed", "manifest minimum is invalid or newer than its release");
+  }
+  try {
+    const policy = validateEnginePolicy(manifest, options);
+    if (policy)
+      return policy;
+  } catch (error) {
+    return fail("policy-rejected", `engine release policy is malformed: ${describe(error)}`);
+  }
+  return { ok: true, manifest };
 }
-/** A present policy must explicitly describe this component, never the daemon. */
 function validateEnginePolicy(manifest, options) {
-    if (!manifest.policy)
-        return null;
-    const keys = options.keys ?? firstPartyHarnessReleaseKeys_js_1.FIRST_PARTY_HARNESS_RELEASE_PUBLIC_KEYS;
-    const policy = manifest.policy;
-    const verdict = (0, releasePolicy_js_1.verifyReleasePolicy)(policy, keys);
-    if (!('ok' in verdict) || !verdict.ok)
-        return fail('policy-rejected', 'engine release policy signature/shape rejected');
-    const component = [firstPartyHarness_js_1.FIRST_PARTY_HARNESS.provider, 'firstPartyHarness'].find((name) => policy.components[name]);
-    if (!component)
-        return fail('policy-rejected', 'release policy has no first-party engine component');
-    const assessment = (0, releasePolicy_js_1.assessReleasePolicy)({
-        policy,
-        targetDaemonVersion: manifest.version,
-        targetComponent: component,
-        channel: (0, firstPartyHarnessChannels_js_1.resolveFirstPartyHarnessChannel)(options.env).channel,
-        contracts: options.contracts ?? {},
-        cohortSubject: options.cohortSubject ?? '',
-        autonomous: options.autonomous === true,
-        now: options.now,
-    });
-    if (!assessment.valid || !assessment.eligible)
-        return fail('policy-rejected', assessment.reason ?? 'engine release is not eligible for this policy');
-    const minimum = policy.components[component].minimumVersion;
-    if (minimum &&
-        ((0, releaseVersions_js_1.compareReleaseVersions)(manifest.version, minimum) === null ||
-            (0, releaseVersions_js_1.compareReleaseVersions)(manifest.version, minimum) < 0))
-        return fail('minimum-version', 'engine release is below its signed policy minimum');
+  if (!manifest.policy)
     return null;
+  const keys = options.keys ?? import_firstPartyHarnessReleaseKeys.FIRST_PARTY_HARNESS_RELEASE_PUBLIC_KEYS;
+  const policy = manifest.policy;
+  const verdict = (0, import_releasePolicy.verifyReleasePolicy)(policy, keys);
+  if (!("ok" in verdict) || !verdict.ok)
+    return fail("policy-rejected", "engine release policy signature/shape rejected");
+  const component = [import_firstPartyHarness.FIRST_PARTY_HARNESS.provider, "firstPartyHarness"].find((name) => policy.components[name]);
+  if (!component)
+    return fail("policy-rejected", "release policy has no first-party engine component");
+  const assessment = (0, import_releasePolicy.assessReleasePolicy)({
+    policy,
+    targetDaemonVersion: manifest.version,
+    targetComponent: component,
+    channel: (0, import_firstPartyHarnessChannels.resolveFirstPartyHarnessChannel)(options.env).channel,
+    contracts: options.contracts ?? {},
+    cohortSubject: options.cohortSubject ?? "",
+    autonomous: options.autonomous === true,
+    now: options.now
+  });
+  if (!assessment.valid || !assessment.eligible)
+    return fail("policy-rejected", assessment.reason ?? "engine release is not eligible for this policy");
+  const minimum = policy.components[component].minimumVersion;
+  if (minimum && ((0, import_releaseVersions.compareReleaseVersions)(manifest.version, minimum) === null || (0, import_releaseVersions.compareReleaseVersions)(manifest.version, minimum) < 0))
+    return fail("minimum-version", "engine release is below its signed policy minimum");
+  return null;
 }
 function describe(error) {
-    return error instanceof Error ? error.message : String(error);
+  return error instanceof Error ? error.message : String(error);
 }
 function paths(env) {
-    const home = (0, firstPartyHarnessHome_js_1.firstPartyHarnessHomeDir)(env);
-    return {
-        home,
-        releases: node_path_1.default.join(home, 'releases'),
-        current: node_path_1.default.join(home, 'current'),
-        previous: node_path_1.default.join(home, 'previous'),
-        state: node_path_1.default.join(home, 'update-state.json'),
-        floor: node_path_1.default.join(home, 'minimum-manifest.json'),
-        lock: node_path_1.default.join(node_path_1.default.dirname(home), `.${firstPartyHarness_js_1.FIRST_PARTY_HARNESS.provider}-update`),
-    };
+  const home = (0, import_firstPartyHarnessHome.firstPartyHarnessHomeDir)(env);
+  return {
+    home,
+    releases: import_node_path.default.join(home, "releases"),
+    current: import_node_path.default.join(home, "current"),
+    previous: import_node_path.default.join(home, "previous"),
+    state: import_node_path.default.join(home, "update-state.json"),
+    floor: import_node_path.default.join(home, "minimum-manifest.json"),
+    lock: import_node_path.default.join(import_node_path.default.dirname(home), `.${import_firstPartyHarness.FIRST_PARTY_HARNESS.provider}-update`)
+  };
 }
 function prepareLock(env) {
-    const target = paths(env).lock;
-    (0, node_fs_1.mkdirSync)(node_path_1.default.dirname(target), { recursive: true, mode: 0o700 });
-    (0, node_fs_1.writeFileSync)(target, '', { flag: 'a', mode: 0o600 });
-    return target;
+  const target = paths(env).lock;
+  (0, import_node_fs.mkdirSync)(import_node_path.default.dirname(target), { recursive: true, mode: 448 });
+  (0, import_node_fs.writeFileSync)(target, "", { flag: "a", mode: 384 });
+  return target;
 }
 function atomicJson(file, data) {
-    (0, node_fs_1.mkdirSync)(node_path_1.default.dirname(file), { recursive: true, mode: 0o700 });
-    const staging = `${file}.tmp-${(0, node_crypto_1.randomUUID)()}`;
-    try {
-        (0, node_fs_1.writeFileSync)(staging, `${JSON.stringify(data, null, 2)}\n`, { mode: 0o600 });
-        (0, node_fs_1.renameSync)(staging, file);
-    }
-    finally {
-        (0, node_fs_1.rmSync)(staging, { force: true });
-    }
+  (0, import_node_fs.mkdirSync)(import_node_path.default.dirname(file), { recursive: true, mode: 448 });
+  const staging = `${file}.tmp-${(0, import_node_crypto.randomUUID)()}`;
+  try {
+    (0, import_node_fs.writeFileSync)(staging, `${JSON.stringify(data, null, 2)}
+`, { mode: 384 });
+    (0, import_node_fs.renameSync)(staging, file);
+  } finally {
+    (0, import_node_fs.rmSync)(staging, { force: true });
+  }
 }
 function atomicLink(target, link) {
-    const staging = `${link}.tmp-${(0, node_crypto_1.randomUUID)()}`;
-    try {
-        (0, node_fs_1.symlinkSync)(target, staging);
-        (0, node_fs_1.renameSync)(staging, link);
-    }
-    finally {
-        (0, node_fs_1.rmSync)(staging, { force: true });
-    }
+  const staging = `${link}.tmp-${(0, import_node_crypto.randomUUID)()}`;
+  try {
+    (0, import_node_fs.symlinkSync)(target, staging);
+    (0, import_node_fs.renameSync)(staging, link);
+  } finally {
+    (0, import_node_fs.rmSync)(staging, { force: true });
+  }
 }
 function readLink(file) {
-    try {
-        return (0, node_fs_1.readlinkSync)(file);
-    }
-    catch {
-        return null;
-    }
+  try {
+    return (0, import_node_fs.readlinkSync)(file);
+  } catch {
+    return null;
+  }
 }
 function hasEntry(file) {
-    try {
-        (0, node_fs_1.lstatSync)(file);
-        return true;
-    }
-    catch {
-        return false;
-    }
+  try {
+    (0, import_node_fs.lstatSync)(file);
+    return true;
+  } catch {
+    return false;
+  }
 }
 function isManagedFirstPartyHarnessReleasePath(binaryPath, env = process.env) {
-    const canonical = firstPartyHarnessBinaryPath(env);
-    return (node_path_1.default.resolve(binaryPath) === node_path_1.default.resolve(canonical) &&
-        readLink(canonical) === `../current/${node_path_1.default.basename(canonical)}`);
+  const canonical = firstPartyHarnessBinaryPath(env);
+  return import_node_path.default.resolve(binaryPath) === import_node_path.default.resolve(canonical) && readLink(canonical) === `../current/${import_node_path.default.basename(canonical)}`;
 }
-/** Read a single immutable binary/sidecar pair, never two different `current` targets. */
 function getVerifiedInstalledFirstPartyHarness(options = {}) {
-    const canonical = firstPartyHarnessBinaryPath(options.env);
-    return inspectBinary(canonical, options.keys ?? firstPartyHarnessReleaseKeys_js_1.FIRST_PARTY_HARNESS_RELEASE_PUBLIC_KEYS, firstPartyHarnessPlatformKey(options.platform, options.arch));
+  const canonical = firstPartyHarnessBinaryPath(options.env);
+  return inspectBinary(canonical, options.keys ?? import_firstPartyHarnessReleaseKeys.FIRST_PARTY_HARNESS_RELEASE_PUBLIC_KEYS, firstPartyHarnessPlatformKey(options.platform, options.arch));
 }
 function inspectBinary(binaryPath, keys, expectedPlatform = firstPartyHarnessPlatformKey()) {
-    const result = {
-        binaryPath,
-        version: null,
-        verified: false,
-        exists: (0, node_fs_1.existsSync)(binaryPath),
-        provenance: null,
-    };
-    if (!result.exists || !keys.length)
-        return result;
-    try {
-        const resolved = (0, node_fs_1.realpathSync)(binaryPath);
-        const size = (0, node_fs_1.statSync)(resolved).size;
-        if (size > exports.MAX_ARTIFACT_BYTES)
-            return result;
-        const record = JSON.parse((0, node_fs_1.readFileSync)(resolved + exports.PROVENANCE_SUFFIX, 'utf8'));
-        if (!record ||
-            (0, releaseVersions_js_1.compareReleaseVersions)(record.version, record.version) === null ||
-            typeof record.platform !== 'string' ||
-            typeof record.sha256 !== 'string' ||
-            typeof record.url !== 'string' ||
-            typeof record.sig !== 'string')
-            return result;
-        record.sha256 = record.sha256.toLowerCase();
-        result.provenance = record;
-        if (record.platform !== expectedPlatform)
-            return result;
-        const verdict = (0, releaseManifest_js_1.verifyArtifact)(record.platform, record.version, { ...record, file: node_path_1.default.basename(binaryPath), size }, keys);
-        if (!('ok' in verdict) ||
-            !verdict.ok ||
-            (0, node_crypto_1.createHash)('sha256').update((0, node_fs_1.readFileSync)(resolved)).digest('hex') !==
-                record.sha256.toLowerCase())
-            return result;
-        result.version = record.version;
-        result.verified = true;
-    }
-    catch {
-        /* absent/malformed/tampered provenance is not a version authority */
-    }
+  const result = {
+    binaryPath,
+    version: null,
+    verified: false,
+    exists: (0, import_node_fs.existsSync)(binaryPath),
+    provenance: null
+  };
+  if (!result.exists || !keys.length)
     return result;
+  try {
+    const resolved = (0, import_node_fs.realpathSync)(binaryPath);
+    const size = (0, import_node_fs.statSync)(resolved).size;
+    if (size > MAX_ARTIFACT_BYTES)
+      return result;
+    const record = JSON.parse((0, import_node_fs.readFileSync)(resolved + PROVENANCE_SUFFIX, "utf8"));
+    if (!record || (0, import_releaseVersions.compareReleaseVersions)(record.version, record.version) === null || typeof record.platform !== "string" || typeof record.sha256 !== "string" || typeof record.url !== "string" || typeof record.sig !== "string")
+      return result;
+    record.sha256 = record.sha256.toLowerCase();
+    result.provenance = record;
+    if (record.platform !== expectedPlatform)
+      return result;
+    const verdict = (0, import_releaseManifest.verifyArtifact)(record.platform, record.version, { ...record, file: import_node_path.default.basename(binaryPath), size }, keys);
+    if (!("ok" in verdict) || !verdict.ok || (0, import_node_crypto.createHash)("sha256").update((0, import_node_fs.readFileSync)(resolved)).digest("hex") !== record.sha256.toLowerCase())
+      return result;
+    result.version = record.version;
+    result.verified = true;
+  } catch {
+  }
+  return result;
 }
 function readFirstPartyHarnessUpdateState(env = process.env) {
-    try {
-        const value = JSON.parse((0, node_fs_1.readFileSync)(paths(env).state, 'utf8'));
-        if (!value ||
-            !['install', 'rollback'].includes(value.operation) ||
-            !['running', 'succeeded', 'failed'].includes(value.status) ||
-            !Number.isFinite(value.attemptedAt))
-            return null;
-        // A killed updater cannot finalize its durable running record. Diagnose it
-        // without writing during a status/check command; live lock heartbeats keep
-        // long downloads distinguishable from interrupted transactions.
-        if (value.status === 'running' &&
-            !proper_lockfile_1.default.checkSync(paths(env).lock, { realpath: false, stale: LOCK_STALE_MS })) {
-            return {
-                ...value,
-                status: 'failed',
-                code: 'install-failed',
-                error: 'The previous update was interrupted. Run `skrr code update` to retry.',
-            };
-        }
-        return value;
-    }
-    catch {
-        return null;
-    }
-}
-function finishState(env, operation, attemptedAt, result, targetVersion, keys = firstPartyHarnessReleaseKeys_js_1.FIRST_PARTY_HARNESS_RELEASE_PUBLIC_KEYS) {
-    atomicJson(paths(env).state, {
-        operation,
-        status: result.ok ? 'succeeded' : 'failed',
-        attemptedAt,
-        completedAt: Date.now(),
-        targetVersion,
-        installedVersion: result.version ?? getVerifiedInstalledFirstPartyHarness({ env, keys }).version ?? undefined,
-        code: result.code,
-        error: result.error,
-        changed: result.changed,
-    });
+  try {
+    const value = JSON.parse((0, import_node_fs.readFileSync)(paths(env).state, "utf8"));
+    if (!value || !["install", "rollback"].includes(value.operation) || !["running", "succeeded", "failed"].includes(value.status) || !Number.isFinite(value.attemptedAt))
+      return null;
+    if (value.status === "running" && !import_proper_lockfile.default.checkSync(paths(env).lock, { realpath: false, stale: LOCK_STALE_MS })) {
+      return {
+        ...value,
+        status: "failed",
+        code: "install-failed",
+        error: "The previous update was interrupted. Run `skrr code update` to retry."
+      };
+    }
+    return value;
+  } catch {
+    return null;
+  }
+}
+function finishState(env, operation, attemptedAt, result, targetVersion, keys = import_firstPartyHarnessReleaseKeys.FIRST_PARTY_HARNESS_RELEASE_PUBLIC_KEYS) {
+  atomicJson(paths(env).state, {
+    operation,
+    status: result.ok ? "succeeded" : "failed",
+    attemptedAt,
+    completedAt: Date.now(),
+    targetVersion,
+    installedVersion: result.version ?? getVerifiedInstalledFirstPartyHarness({ env, keys }).version ?? void 0,
+    code: result.code,
+    error: result.error,
+    changed: result.changed
+  });
 }
 function retainedManifest(env, keys) {
-    try {
-        const manifest = JSON.parse((0, node_fs_1.readFileSync)(paths(env).floor, 'utf8'));
-        const verdict = (0, releaseManifest_js_1.verifyManifest)(manifest, keys);
-        if (!('ok' in verdict) ||
-            !verdict.ok ||
-            (0, releaseVersions_js_1.compareReleaseVersions)(manifest.minimum, manifest.version) === null ||
-            (0, releaseVersions_js_1.compareReleaseVersions)(manifest.minimum, manifest.version) > 0)
-            throw new Error('retained minimum manifest is invalid; refusing to discard the signed floor');
-        return manifest;
-    }
-    catch (error) {
-        if (hasEntry(paths(env).floor))
-            throw error;
-        return null;
-    }
+  try {
+    const manifest = JSON.parse((0, import_node_fs.readFileSync)(paths(env).floor, "utf8"));
+    const verdict = (0, import_releaseManifest.verifyManifest)(manifest, keys);
+    if (!("ok" in verdict) || !verdict.ok || (0, import_releaseVersions.compareReleaseVersions)(manifest.minimum, manifest.version) === null || (0, import_releaseVersions.compareReleaseVersions)(manifest.minimum, manifest.version) > 0)
+      throw new Error("retained minimum manifest is invalid; refusing to discard the signed floor");
+    return manifest;
+  } catch (error) {
+    if (hasEntry(paths(env).floor))
+      throw error;
+    return null;
+  }
 }
 function effectiveMinimum(manifest, keys) {
-    let minimum = manifest.minimum;
-    if (manifest.policy) {
-        const policy = manifest.policy;
-        const verdict = (0, releasePolicy_js_1.verifyReleasePolicy)(policy, keys);
-        if (!('ok' in verdict) || !verdict.ok)
-            throw new Error('retained signed policy is invalid');
-        const component = [firstPartyHarness_js_1.FIRST_PARTY_HARNESS.provider, 'firstPartyHarness'].find((name) => policy.components[name]);
-        const floor = component ? policy.components[component].minimumVersion : undefined;
-        if (floor && (0, releaseVersions_js_1.compareReleaseVersions)(floor, minimum) === null)
-            throw new Error('signed policy minimum is invalid');
-        if (floor && (0, releaseVersions_js_1.compareReleaseVersions)(floor, minimum) === 1)
-            minimum = floor;
-    }
-    return minimum;
+  let minimum = manifest.minimum;
+  if (manifest.policy) {
+    const policy = manifest.policy;
+    const verdict = (0, import_releasePolicy.verifyReleasePolicy)(policy, keys);
+    if (!("ok" in verdict) || !verdict.ok)
+      throw new Error("retained signed policy is invalid");
+    const component = [import_firstPartyHarness.FIRST_PARTY_HARNESS.provider, "firstPartyHarness"].find((name) => policy.components[name]);
+    const floor = component ? policy.components[component].minimumVersion : void 0;
+    if (floor && (0, import_releaseVersions.compareReleaseVersions)(floor, minimum) === null)
+      throw new Error("signed policy minimum is invalid");
+    if (floor && (0, import_releaseVersions.compareReleaseVersions)(floor, minimum) === 1)
+      minimum = floor;
+  }
+  return minimum;
 }
 function retainedMinimum(env, keys) {
-    const manifest = retainedManifest(env, keys);
-    return manifest ? effectiveMinimum(manifest, keys) : null;
+  const manifest = retainedManifest(env, keys);
+  return manifest ? effectiveMinimum(manifest, keys) : null;
 }
 function preserveMinimum(env, keys, manifest) {
-    if (!manifest)
-        return;
-    const previous = retainedManifest(env, keys);
-    if (!previous ||
-        (0, releaseVersions_js_1.compareReleaseVersions)(effectiveMinimum(manifest, keys), effectiveMinimum(previous, keys)) === 1)
-        atomicJson(paths(env).floor, manifest);
+  if (!manifest)
+    return;
+  const previous = retainedManifest(env, keys);
+  if (!previous || (0, import_releaseVersions.compareReleaseVersions)(effectiveMinimum(manifest, keys), effectiveMinimum(previous, keys)) === 1)
+    atomicJson(paths(env).floor, manifest);
 }
 function createAliases(env) {
-    const canonical = firstPartyHarnessBinaryPath(env);
-    for (const spelling of (0, firstPartyHarness_js_1.firstPartyHarnessArtifactSpellings)()) {
-        const alias = node_path_1.default.join(node_path_1.default.dirname(canonical), (0, firstPartyHarness_js_1.firstPartyHarnessBinaryName)(spelling));
-        if (alias === canonical)
-            continue;
-        for (const suffix of [exports.PROVENANCE_SUFFIX, '']) {
-            if (!hasEntry(alias + suffix)) {
-                try {
-                    (0, node_fs_1.symlinkSync)(node_path_1.default.basename(canonical) + suffix, alias + suffix);
-                }
-                catch {
-                    /* compatibility aliases must not invalidate an activated release */
-                }
-            }
+  const canonical = firstPartyHarnessBinaryPath(env);
+  for (const spelling of (0, import_firstPartyHarness.firstPartyHarnessArtifactSpellings)()) {
+    const alias = import_node_path.default.join(import_node_path.default.dirname(canonical), (0, import_firstPartyHarness.firstPartyHarnessBinaryName)(spelling));
+    if (alias === canonical)
+      continue;
+    for (const suffix of [PROVENANCE_SUFFIX, ""]) {
+      if (!hasEntry(alias + suffix)) {
+        try {
+          (0, import_node_fs.symlinkSync)(import_node_path.default.basename(canonical) + suffix, alias + suffix);
+        } catch {
         }
+      }
     }
+  }
 }
 function stableLinks(env) {
-    const binary = firstPartyHarnessBinaryPath(env);
-    (0, node_fs_1.mkdirSync)(node_path_1.default.dirname(binary), { recursive: true, mode: 0o700 });
-    for (const suffix of [exports.PROVENANCE_SUFFIX, '']) {
-        const target = `../current/${node_path_1.default.basename(binary)}${suffix}`;
-        if (readLink(binary + suffix) !== target)
-            atomicLink(target, binary + suffix);
-    }
-    if (hasEntry(paths(env).previous)) {
-        for (const suffix of [exports.PROVENANCE_SUFFIX, '']) {
-            const target = `../previous/${node_path_1.default.basename(binary)}${suffix}`;
-            if (readLink(binary + exports.PREVIOUS_SUFFIX + suffix) !== target)
-                atomicLink(target, binary + exports.PREVIOUS_SUFFIX + suffix);
-        }
-    }
-    createAliases(env);
+  const binary = firstPartyHarnessBinaryPath(env);
+  (0, import_node_fs.mkdirSync)(import_node_path.default.dirname(binary), { recursive: true, mode: 448 });
+  for (const suffix of [PROVENANCE_SUFFIX, ""]) {
+    const target = `../current/${import_node_path.default.basename(binary)}${suffix}`;
+    if (readLink(binary + suffix) !== target)
+      atomicLink(target, binary + suffix);
+  }
+  if (hasEntry(paths(env).previous)) {
+    for (const suffix of [PROVENANCE_SUFFIX, ""]) {
+      const target = `../previous/${import_node_path.default.basename(binary)}${suffix}`;
+      if (readLink(binary + PREVIOUS_SUFFIX + suffix) !== target)
+        atomicLink(target, binary + PREVIOUS_SUFFIX + suffix);
+    }
+  }
+  createAliases(env);
 }
 function migrateFlatLayout(env, _progress) {
-    const p = paths(env);
-    const binary = firstPartyHarnessBinaryPath(env);
-    (0, node_fs_1.mkdirSync)(p.releases, { recursive: true, mode: 0o700 });
-    if (isManagedFirstPartyHarnessReleasePath(binary, env) || !(0, node_fs_1.existsSync)(binary))
-        return;
-    // Adopt flat bytes without pretending an unsigned legacy binary is trusted.
-    // Copies leave the original runnable throughout the one-time layout change.
-    const dir = node_path_1.default.join(p.releases, `legacy-${(0, node_crypto_1.randomUUID)()}`);
-    (0, node_fs_1.mkdirSync)(dir, { mode: 0o700 });
-    const adopted = node_path_1.default.join(dir, node_path_1.default.basename(binary));
-    (0, node_fs_1.copyFileSync)(binary, adopted);
-    (0, node_fs_1.chmodSync)(adopted, 0o555);
-    if ((0, node_fs_1.existsSync)(binary + exports.PROVENANCE_SUFFIX)) {
-        (0, node_fs_1.copyFileSync)(binary + exports.PROVENANCE_SUFFIX, adopted + exports.PROVENANCE_SUFFIX);
-        (0, node_fs_1.chmodSync)(adopted + exports.PROVENANCE_SUFFIX, 0o444);
-    }
-    (0, node_fs_1.chmodSync)(dir, 0o700);
-    const outgoing = readLink(p.current);
-    if (outgoing)
-        atomicLink(outgoing, p.previous);
-    atomicLink(node_path_1.default.relative(p.home, dir), p.current);
-    stableLinks(env);
+  const p = paths(env);
+  const binary = firstPartyHarnessBinaryPath(env);
+  (0, import_node_fs.mkdirSync)(p.releases, { recursive: true, mode: 448 });
+  if (isManagedFirstPartyHarnessReleasePath(binary, env) || !(0, import_node_fs.existsSync)(binary))
+    return;
+  const dir = import_node_path.default.join(p.releases, `legacy-${(0, import_node_crypto.randomUUID)()}`);
+  (0, import_node_fs.mkdirSync)(dir, { mode: 448 });
+  const adopted = import_node_path.default.join(dir, import_node_path.default.basename(binary));
+  (0, import_node_fs.copyFileSync)(binary, adopted);
+  (0, import_node_fs.chmodSync)(adopted, 365);
+  if ((0, import_node_fs.existsSync)(binary + PROVENANCE_SUFFIX)) {
+    (0, import_node_fs.copyFileSync)(binary + PROVENANCE_SUFFIX, adopted + PROVENANCE_SUFFIX);
+    (0, import_node_fs.chmodSync)(adopted + PROVENANCE_SUFFIX, 292);
+  }
+  (0, import_node_fs.chmodSync)(dir, 448);
+  const outgoing = readLink(p.current);
+  if (outgoing)
+    atomicLink(outgoing, p.previous);
+  atomicLink(import_node_path.default.relative(p.home, dir), p.current);
+  stableLinks(env);
 }
 function validateArtifact(options) {
-    const keys = options.keys ?? firstPartyHarnessReleaseKeys_js_1.FIRST_PARTY_HARNESS_RELEASE_PUBLIC_KEYS;
-    const record = options.provenance;
-    if (!record ||
-        typeof record !== 'object' ||
-        typeof record.version !== 'string' ||
-        typeof record.platform !== 'string' ||
-        typeof record.sha256 !== 'string' ||
-        !/^[a-fA-F0-9]{64}$/.test(record.sha256) ||
-        typeof record.url !== 'string' ||
-        typeof record.sig !== 'string' ||
-        !Buffer.isBuffer(options.binary))
-        return fail('artifact-unverified', 'artifact provenance is malformed');
-    if (!keys.length)
-        return fail('no-pinned-keys', 'no pinned engine release keys; refusing activation');
-    if ((0, releaseVersions_js_1.compareReleaseVersions)(record.version, record.version) === null)
-        return fail('version-invalid', 'artifact version is not a semantic release version');
-    if (record.platform !== firstPartyHarnessPlatformKey(options.platform, options.arch))
-        return fail('unsupported-platform', `artifact ${record.platform} does not match this host`);
-    if ((options.platform ?? process.platform) === 'win32')
-        return fail('unsupported-platform', 'managed engine release activation currently requires macOS or Linux');
-    const verdict = (0, releaseManifest_js_1.verifyArtifact)(record.platform, record.version, {
-        ...record,
-        file: (0, firstPartyHarness_js_1.firstPartyHarnessBinaryName)(),
-        size: options.binary.length,
-    }, keys);
-    if (!('ok' in verdict) || !verdict.ok)
-        return fail('artifact-unverified', 'artifact provenance signature rejected');
-    if (options.binary.length > exports.MAX_ARTIFACT_BYTES)
-        return fail('too-large', 'artifact exceeds the download ceiling');
-    if ((0, node_crypto_1.createHash)('sha256').update(options.binary).digest('hex') !== record.sha256.toLowerCase())
-        return fail('hash-mismatch', 'artifact bytes do not match signed provenance');
-    if (options.manifest) {
-        const policyFailure = validateEnginePolicy(options.manifest, options);
-        if (policyFailure)
-            return policyFailure;
-        const manifestVerdict = (0, releaseManifest_js_1.verifyManifest)(options.manifest, keys);
-        const artifact = options.manifest.platforms?.[record.platform];
-        if (!('ok' in manifestVerdict) ||
-            !manifestVerdict.ok ||
-            options.manifest.version !== record.version ||
-            artifact?.sha256?.toLowerCase() !== record.sha256.toLowerCase() ||
-            (0, releaseVersions_js_1.compareReleaseVersions)(options.manifest.minimum, record.version) === null)
-            return fail('manifest-unverified', 'activation manifest does not authenticate this artifact');
-    }
-    return null;
+  const keys = options.keys ?? import_firstPartyHarnessReleaseKeys.FIRST_PARTY_HARNESS_RELEASE_PUBLIC_KEYS;
+  const record = options.provenance;
+  if (!record || typeof record !== "object" || typeof record.version !== "string" || typeof record.platform !== "string" || typeof record.sha256 !== "string" || !/^[a-fA-F0-9]{64}$/.test(record.sha256) || typeof record.url !== "string" || typeof record.sig !== "string" || !Buffer.isBuffer(options.binary))
+    return fail("artifact-unverified", "artifact provenance is malformed");
+  if (!keys.length)
+    return fail("no-pinned-keys", "no pinned engine release keys; refusing activation");
+  if ((0, import_releaseVersions.compareReleaseVersions)(record.version, record.version) === null)
+    return fail("version-invalid", "artifact version is not a semantic release version");
+  if (record.platform !== firstPartyHarnessPlatformKey(options.platform, options.arch))
+    return fail("unsupported-platform", `artifact ${record.platform} does not match this host`);
+  if ((options.platform ?? process.platform) === "win32")
+    return fail("unsupported-platform", "managed engine release activation currently requires macOS or Linux");
+  const verdict = (0, import_releaseManifest.verifyArtifact)(record.platform, record.version, {
+    ...record,
+    file: (0, import_firstPartyHarness.firstPartyHarnessBinaryName)(),
+    size: options.binary.length
+  }, keys);
+  if (!("ok" in verdict) || !verdict.ok)
+    return fail("artifact-unverified", "artifact provenance signature rejected");
+  if (options.binary.length > MAX_ARTIFACT_BYTES)
+    return fail("too-large", "artifact exceeds the download ceiling");
+  if ((0, import_node_crypto.createHash)("sha256").update(options.binary).digest("hex") !== record.sha256.toLowerCase())
+    return fail("hash-mismatch", "artifact bytes do not match signed provenance");
+  if (options.manifest) {
+    const policyFailure = validateEnginePolicy(options.manifest, options);
+    if (policyFailure)
+      return policyFailure;
+    const manifestVerdict = (0, import_releaseManifest.verifyManifest)(options.manifest, keys);
+    const artifact = options.manifest.platforms?.[record.platform];
+    if (!("ok" in manifestVerdict) || !manifestVerdict.ok || options.manifest.version !== record.version || artifact?.sha256?.toLowerCase() !== record.sha256.toLowerCase() || (0, import_releaseVersions.compareReleaseVersions)(options.manifest.minimum, record.version) === null)
+      return fail("manifest-unverified", "activation manifest does not authenticate this artifact");
+  }
+  return null;
 }
 function activateLocked(options) {
-    const env = options.env ?? process.env;
-    const keys = options.keys ?? firstPartyHarnessReleaseKeys_js_1.FIRST_PARTY_HARNESS_RELEASE_PUBLIC_KEYS;
-    const progress = options.onProgress ?? (() => { });
-    const p = paths(env);
-    const binary = firstPartyHarnessBinaryPath(env);
-    const canonicalLink = readLink(binary);
-    // Older spelling links are migration inputs; arbitrary symlinks belong to
-    // an external install and are never followed for writes.
-    const legacyLinks = (0, firstPartyHarness_js_1.firstPartyHarnessArtifactSpellings)().map((spelling) => (0, firstPartyHarness_js_1.firstPartyHarnessBinaryName)(spelling));
-    if (canonicalLink &&
-        !isManagedFirstPartyHarnessReleasePath(binary, env) &&
-        !legacyLinks.includes(canonicalLink)) {
-        return options.preserveExternalLink
-            ? {
-                ok: true,
-                changed: false,
-                binaryPath: binary,
-                reason: 'canonical engine is an externally owned symlink',
-            }
-            : fail('install-failed', 'managed engine path is an external symlink; update its owning installation');
-    }
-    if (options.preserveExternalLink && !hasEntry(binary)) {
-        for (const spelling of (0, firstPartyHarness_js_1.firstPartyHarnessArtifactSpellings)()) {
-            const alias = node_path_1.default.join(node_path_1.default.dirname(binary), (0, firstPartyHarness_js_1.firstPartyHarnessBinaryName)(spelling));
-            const aliasLink = readLink(alias);
-            if (aliasLink && aliasLink !== node_path_1.default.basename(binary))
-                return {
-                    ok: true,
-                    changed: false,
-                    binaryPath: binary,
-                    reason: `legacy engine at ${alias} is an externally owned symlink`,
-                };
-        }
-    }
-    const migration = (0, firstPartyHarnessHome_js_1.migrateFirstPartyHarnessHome)({ env });
-    for (const change of migration.moved)
-        progress(`engine home migration: ${change}`);
-    for (const error of migration.errors)
-        progress(`engine home migration: ${error}`);
-    const installed = getVerifiedInstalledFirstPartyHarness({
-        env,
-        keys,
-        platform: options.platform,
-        arch: options.arch,
-    });
-    const record = { ...options.provenance, sha256: options.provenance.sha256.toLowerCase() };
-    const floor = retainedMinimum(env, keys);
-    if (floor && (0, releaseVersions_js_1.compareReleaseVersions)(record.version, floor) < 0)
-        return fail('minimum-version', `release ${record.version} is below the retained signed minimum ${floor}`);
-    if (options.manifest && (0, releaseVersions_js_1.compareReleaseVersions)(record.version, options.manifest.minimum) < 0)
-        return fail('minimum-version', 'release is below its signed minimum');
-    if (installed.exists && !installed.verified && options.preserveUnknownInstalled)
+  const env = options.env ?? process.env;
+  const keys = options.keys ?? import_firstPartyHarnessReleaseKeys.FIRST_PARTY_HARNESS_RELEASE_PUBLIC_KEYS;
+  const progress = options.onProgress ?? (() => {
+  });
+  const p = paths(env);
+  const binary = firstPartyHarnessBinaryPath(env);
+  const canonicalLink = readLink(binary);
+  const legacyLinks = (0, import_firstPartyHarness.firstPartyHarnessArtifactSpellings)().map((spelling) => (0, import_firstPartyHarness.firstPartyHarnessBinaryName)(spelling));
+  if (canonicalLink && !isManagedFirstPartyHarnessReleasePath(binary, env) && !legacyLinks.includes(canonicalLink)) {
+    return options.preserveExternalLink ? {
+      ok: true,
+      changed: false,
+      binaryPath: binary,
+      reason: "canonical engine is an externally owned symlink"
+    } : fail("install-failed", "managed engine path is an external symlink; update its owning installation");
+  }
+  if (options.preserveExternalLink && !hasEntry(binary)) {
+    for (const spelling of (0, import_firstPartyHarness.firstPartyHarnessArtifactSpellings)()) {
+      const alias = import_node_path.default.join(import_node_path.default.dirname(binary), (0, import_firstPartyHarness.firstPartyHarnessBinaryName)(spelling));
+      const aliasLink = readLink(alias);
+      if (aliasLink && aliasLink !== import_node_path.default.basename(binary))
         return {
-            ok: true,
-            changed: false,
-            binaryPath: binary,
-            reason: 'installed engine has no verified provenance',
+          ok: true,
+          changed: false,
+          binaryPath: binary,
+          reason: `legacy engine at ${alias} is an externally owned symlink`
         };
-    if (installed.version) {
-        const comparison = (0, releaseVersions_js_1.compareReleaseVersions)(record.version, installed.version);
-        if (comparison === 0 && installed.provenance?.sha256 !== record.sha256)
-            return fail('manifest-malformed', 'release version is immutable but signed artifact digest changed');
-        if (comparison === 0 || (comparison < 0 && !options.allowDowngrade)) {
-            preserveMinimum(env, keys, options.manifest);
-            return {
-                ok: true,
-                changed: false,
-                replaced: true,
-                version: installed.version,
-                platform: installed.provenance?.platform,
-                binaryPath: binary,
-            };
-        }
     }
-    migrateFlatLayout(env, progress);
-    const slot = node_path_1.default.join(p.releases, `${record.version}-${record.sha256.toLowerCase()}`);
-    const slotBinary = node_path_1.default.join(slot, node_path_1.default.basename(binary));
-    if (hasEntry(slot)) {
-        if ((0, node_fs_1.lstatSync)(slot).isSymbolicLink())
-            return fail('install-failed', 'release directory must be locally owned, not a symlink');
-        const existing = inspectBinary(slotBinary, keys, firstPartyHarnessPlatformKey(options.platform, options.arch));
-        if (!existing.verified || existing.provenance?.sha256 !== record.sha256)
-            return fail('install-failed', 'immutable release directory already exists with invalid bytes');
-    }
-    else {
-        const staging = node_path_1.default.join(p.releases, `.staging-${(0, node_crypto_1.randomUUID)()}`);
-        (0, node_fs_1.mkdirSync)(staging, { mode: 0o700 });
-        try {
-            (0, node_fs_1.writeFileSync)(node_path_1.default.join(staging, node_path_1.default.basename(binary)), options.binary, { mode: 0o755 });
-            (0, node_fs_1.writeFileSync)(node_path_1.default.join(staging, node_path_1.default.basename(binary) + exports.PROVENANCE_SUFFIX), `${JSON.stringify(record, null, 2)}\n`, { mode: 0o600 });
-            (0, node_fs_1.chmodSync)(node_path_1.default.join(staging, node_path_1.default.basename(binary)), 0o555);
-            (0, node_fs_1.chmodSync)(node_path_1.default.join(staging, node_path_1.default.basename(binary) + exports.PROVENANCE_SUFFIX), 0o444);
-            (0, node_fs_1.chmodSync)(staging, 0o700);
-            (0, node_fs_1.renameSync)(staging, slot);
-        }
-        finally {
-            if (hasEntry(staging)) {
-                (0, node_fs_1.chmodSync)(staging, 0o700);
-                (0, node_fs_1.rmSync)(staging, { recursive: true, force: true });
-            }
-        }
-    }
-    const previous = readLink(p.current);
-    const target = node_path_1.default.relative(p.home, slot);
-    if (previous && previous !== target)
-        atomicLink(previous, p.previous);
-    // Prepare the stable entry points while the original release still runs.
-    // Subsequent installations only change this ONE pointer.
-    stableLinks(env);
-    preserveMinimum(env, keys, options.manifest);
-    atomicLink(target, p.current);
-    progress(`${firstPartyHarness_js_1.FIRST_PARTY_HARNESS.displayName} ${record.version} installed; existing sessions keep their current release.`);
+  }
+  const migration = (0, import_firstPartyHarnessHome.migrateFirstPartyHarnessHome)({ env });
+  for (const change of migration.moved)
+    progress(`engine home migration: ${change}`);
+  for (const error of migration.errors)
+    progress(`engine home migration: ${error}`);
+  const installed = getVerifiedInstalledFirstPartyHarness({
+    env,
+    keys,
+    platform: options.platform,
+    arch: options.arch
+  });
+  const record = { ...options.provenance, sha256: options.provenance.sha256.toLowerCase() };
+  const floor = retainedMinimum(env, keys);
+  if (floor && (0, import_releaseVersions.compareReleaseVersions)(record.version, floor) < 0)
+    return fail("minimum-version", `release ${record.version} is below the retained signed minimum ${floor}`);
+  if (options.manifest && (0, import_releaseVersions.compareReleaseVersions)(record.version, options.manifest.minimum) < 0)
+    return fail("minimum-version", "release is below its signed minimum");
+  if (installed.exists && !installed.verified && options.preserveUnknownInstalled)
     return {
-        ok: true,
-        changed: true,
-        replaced: installed.exists,
-        version: record.version,
-        platform: record.platform,
-        binaryPath: binary,
+      ok: true,
+      changed: false,
+      binaryPath: binary,
+      reason: "installed engine has no verified provenance"
     };
+  if (installed.version) {
+    const comparison = (0, import_releaseVersions.compareReleaseVersions)(record.version, installed.version);
+    if (comparison === 0 && installed.provenance?.sha256 !== record.sha256)
+      return fail("manifest-malformed", "release version is immutable but signed artifact digest changed");
+    if (comparison === 0 || comparison < 0 && !options.allowDowngrade) {
+      preserveMinimum(env, keys, options.manifest);
+      return {
+        ok: true,
+        changed: false,
+        replaced: true,
+        version: installed.version,
+        platform: installed.provenance?.platform,
+        binaryPath: binary
+      };
+    }
+  }
+  migrateFlatLayout(env, progress);
+  const slot = import_node_path.default.join(p.releases, `${record.version}-${record.sha256.toLowerCase()}`);
+  const slotBinary = import_node_path.default.join(slot, import_node_path.default.basename(binary));
+  if (hasEntry(slot)) {
+    if ((0, import_node_fs.lstatSync)(slot).isSymbolicLink())
+      return fail("install-failed", "release directory must be locally owned, not a symlink");
+    const existing = inspectBinary(slotBinary, keys, firstPartyHarnessPlatformKey(options.platform, options.arch));
+    if (!existing.verified || existing.provenance?.sha256 !== record.sha256)
+      return fail("install-failed", "immutable release directory already exists with invalid bytes");
+  } else {
+    const staging = import_node_path.default.join(p.releases, `.staging-${(0, import_node_crypto.randomUUID)()}`);
+    (0, import_node_fs.mkdirSync)(staging, { mode: 448 });
+    try {
+      (0, import_node_fs.writeFileSync)(import_node_path.default.join(staging, import_node_path.default.basename(binary)), options.binary, { mode: 493 });
+      (0, import_node_fs.writeFileSync)(import_node_path.default.join(staging, import_node_path.default.basename(binary) + PROVENANCE_SUFFIX), `${JSON.stringify(record, null, 2)}
+`, { mode: 384 });
+      (0, import_node_fs.chmodSync)(import_node_path.default.join(staging, import_node_path.default.basename(binary)), 365);
+      (0, import_node_fs.chmodSync)(import_node_path.default.join(staging, import_node_path.default.basename(binary) + PROVENANCE_SUFFIX), 292);
+      (0, import_node_fs.chmodSync)(staging, 448);
+      (0, import_node_fs.renameSync)(staging, slot);
+    } finally {
+      if (hasEntry(staging)) {
+        (0, import_node_fs.chmodSync)(staging, 448);
+        (0, import_node_fs.rmSync)(staging, { recursive: true, force: true });
+      }
+    }
+  }
+  const previous = readLink(p.current);
+  const target = import_node_path.default.relative(p.home, slot);
+  if (previous && previous !== target)
+    atomicLink(previous, p.previous);
+  stableLinks(env);
+  preserveMinimum(env, keys, options.manifest);
+  atomicLink(target, p.current);
+  progress(`${import_firstPartyHarness.FIRST_PARTY_HARNESS.displayName} ${record.version} installed; existing sessions keep their current release.`);
+  return {
+    ok: true,
+    changed: true,
+    replaced: installed.exists,
+    version: record.version,
+    platform: record.platform,
+    binaryPath: binary
+  };
 }
-/** Desktop's already-downloaded signed artifact uses the exact same transaction. */
 function activateVerifiedFirstPartyHarnessArtifact(options) {
-    const invalid = validateArtifact(options);
-    const env = options.env ?? process.env;
-    const attemptedAt = Date.now();
-    let release;
-    try {
-        release = proper_lockfile_1.default.lockSync(prepareLock(env), { realpath: false, stale: LOCK_STALE_MS });
-        const result = invalid ?? activateLocked(options);
-        finishState(env, 'install', attemptedAt, result, options.provenance?.version, options.keys);
-        return result;
-    }
-    catch (error) {
-        const result = fail(error.code === 'ELOCKED' ? 'lock-busy' : 'install-failed', describe(error));
-        if (release) {
-            try {
-                finishState(env, 'install', attemptedAt, result, options.provenance?.version, options.keys);
-            }
-            catch {
-                // Preserve the activation failure if its diagnostic journal is also unwritable.
-            }
-        }
-        return result;
-    }
-    finally {
-        release?.();
+  const invalid = validateArtifact(options);
+  const env = options.env ?? process.env;
+  const attemptedAt = Date.now();
+  let release;
+  try {
+    release = import_proper_lockfile.default.lockSync(prepareLock(env), { realpath: false, stale: LOCK_STALE_MS });
+    const result = invalid ?? activateLocked(options);
+    finishState(env, "install", attemptedAt, result, options.provenance?.version, options.keys);
+    return result;
+  } catch (error) {
+    const result = fail(error.code === "ELOCKED" ? "lock-busy" : "install-failed", describe(error));
+    if (release) {
+      try {
+        finishState(env, "install", attemptedAt, result, options.provenance?.version, options.keys);
+      } catch {
+      }
     }
+    return result;
+  } finally {
+    release?.();
+  }
 }
-/** Signed-manifest check reads only; no lock, migration, state writes or login. */
 async function checkFirstPartyHarnessUpdate(options = {}) {
+  const fetched = await fetchVerifiedManifest(options);
+  if (!fetched.ok)
+    return fetched;
+  const env = options.env ?? process.env;
+  const keys = options.keys ?? import_firstPartyHarnessReleaseKeys.FIRST_PARTY_HARNESS_RELEASE_PUBLIC_KEYS;
+  const platform = firstPartyHarnessPlatformKey(options.platform, options.arch);
+  if (!platform || (options.platform ?? process.platform) === "win32")
+    return fail("unsupported-platform", "this host has no managed engine artifact");
+  const artifact = fetched.manifest.platforms[platform];
+  if (!artifact)
+    return fail("artifact-missing", `release has no ${platform} artifact`);
+  const verdict = (0, import_releaseManifest.verifyArtifact)(platform, fetched.manifest.version, artifact, keys);
+  if (!("ok" in verdict) || !verdict.ok)
+    return fail("artifact-unverified", "offered artifact signature rejected");
+  let minimum = effectiveMinimum(fetched.manifest, keys);
+  try {
+    const floor = retainedMinimum(env, keys);
+    if (floor && (0, import_releaseVersions.compareReleaseVersions)(fetched.manifest.version, floor) < 0)
+      return fail("minimum-version", "offered release is below the retained signed minimum");
+    if (floor && (0, import_releaseVersions.compareReleaseVersions)(floor, minimum) === 1)
+      minimum = floor;
+  } catch (error) {
+    return fail("minimum-version", describe(error));
+  }
+  const installed = getVerifiedInstalledFirstPartyHarness(options);
+  if (installed.version === fetched.manifest.version && installed.provenance?.sha256 !== artifact.sha256.toLowerCase())
+    return fail("manifest-malformed", "same release version offers a different signed artifact digest");
+  const override = (0, import_firstPartyHarness.readFirstPartyHarnessEnv)(env, "path").value;
+  return {
+    ok: true,
+    installedVersion: installed.version,
+    latestVersion: fetched.manifest.version,
+    channel: (0, import_firstPartyHarnessChannels.resolveFirstPartyHarnessChannel)(env).channel,
+    updateAvailable: !installed.version || (0, import_releaseVersions.compareReleaseVersions)(installed.version, fetched.manifest.version) === -1,
+    binaryPath: installed.binaryPath,
+    owner: override && import_node_path.default.resolve(override) !== import_node_path.default.resolve(installed.binaryPath) ? "external" : "managed",
+    installedVerified: installed.verified,
+    minimumVersion: minimum,
+    lastUpdate: readFirstPartyHarnessUpdateState(env)
+  };
+}
+async function installFirstPartyHarness(options = {}) {
+  const env = options.env ?? process.env;
+  const keys = options.keys ?? import_firstPartyHarnessReleaseKeys.FIRST_PARTY_HARNESS_RELEASE_PUBLIC_KEYS;
+  const progress = options.onProgress ?? (() => {
+  });
+  const platform = firstPartyHarnessPlatformKey(options.platform, options.arch);
+  if (!platform || (options.platform ?? process.platform) === "win32")
+    return fail("unsupported-platform", "no managed engine activation for this platform");
+  if (options.version && (0, import_releaseVersions.compareReleaseVersions)(options.version, options.version) === null)
+    return fail("version-invalid", "requested version is not a semantic release version");
+  if (options.allowDowngrade && !options.version)
+    return fail("downgrade-refused", "a downgrade requires an explicit pinned version");
+  const attemptedAt = Date.now();
+  let release;
+  let result;
+  try {
+    release = await import_proper_lockfile.default.lock(prepareLock(env), {
+      realpath: false,
+      stale: LOCK_STALE_MS,
+      update: 1e4,
+      retries: { retries: 20, minTimeout: 100, maxTimeout: 500, factor: 1.2 }
+    });
+    atomicJson(paths(env).state, {
+      operation: "install",
+      status: "running",
+      attemptedAt,
+      targetVersion: options.version
+    });
+    result = await downloadAndActivate();
+    finishState(env, "install", attemptedAt, result, result.version ?? options.version, keys);
+    return result;
+  } catch (error) {
+    result = fail(error.code === "ELOCKED" ? "lock-busy" : "install-failed", describe(error));
+    if (release) {
+      try {
+        finishState(env, "install", attemptedAt, result, options.version, keys);
+      } catch {
+      }
+    }
+    return result;
+  } finally {
+    await release?.();
+  }
+  async function downloadAndActivate() {
+    progress("Fetching signed release manifest\u2026");
     const fetched = await fetchVerifiedManifest(options);
     if (!fetched.ok)
-        return fetched;
-    const env = options.env ?? process.env;
-    const keys = options.keys ?? firstPartyHarnessReleaseKeys_js_1.FIRST_PARTY_HARNESS_RELEASE_PUBLIC_KEYS;
-    const platform = firstPartyHarnessPlatformKey(options.platform, options.arch);
-    if (!platform || (options.platform ?? process.platform) === 'win32')
-        return fail('unsupported-platform', 'this host has no managed engine artifact');
-    const artifact = fetched.manifest.platforms[platform];
+      return fetched;
+    const { manifest } = fetched;
+    const artifact = manifest.platforms[platform];
     if (!artifact)
-        return fail('artifact-missing', `release has no ${platform} artifact`);
-    const verdict = (0, releaseManifest_js_1.verifyArtifact)(platform, fetched.manifest.version, artifact, keys);
-    if (!('ok' in verdict) || !verdict.ok)
-        return fail('artifact-unverified', 'offered artifact signature rejected');
-    let minimum = effectiveMinimum(fetched.manifest, keys);
-    try {
-        const floor = retainedMinimum(env, keys);
-        if (floor && (0, releaseVersions_js_1.compareReleaseVersions)(fetched.manifest.version, floor) < 0)
-            return fail('minimum-version', 'offered release is below the retained signed minimum');
-        if (floor && (0, releaseVersions_js_1.compareReleaseVersions)(floor, minimum) === 1)
-            minimum = floor;
-    }
-    catch (error) {
-        return fail('minimum-version', describe(error));
-    }
-    const installed = getVerifiedInstalledFirstPartyHarness(options);
-    if (installed.version === fetched.manifest.version &&
-        installed.provenance?.sha256 !== artifact.sha256.toLowerCase())
-        return fail('manifest-malformed', 'same release version offers a different signed artifact digest');
-    const override = (0, firstPartyHarness_js_1.readFirstPartyHarnessEnv)(env, 'path').value;
-    return {
+      return fail("artifact-missing", `release ${manifest.version} has no ${platform} artifact`);
+    const verdict = (0, import_releaseManifest.verifyArtifact)(platform, manifest.version, artifact, keys);
+    if (!("ok" in verdict) || !verdict.ok)
+      return fail("artifact-unverified", "artifact signature rejected");
+    if (typeof artifact.size === "number" && artifact.size > MAX_ARTIFACT_BYTES)
+      return fail("too-large", "artifact declares bytes above the ceiling");
+    const installed = getVerifiedInstalledFirstPartyHarness({
+      env,
+      keys,
+      platform: options.platform,
+      arch: options.arch
+    });
+    const floor = retainedMinimum(env, keys);
+    if (floor && (0, import_releaseVersions.compareReleaseVersions)(manifest.version, floor) < 0)
+      return fail("minimum-version", `offered release is below the retained signed minimum ${floor}`);
+    if (installed.version && (0, import_releaseVersions.compareReleaseVersions)(manifest.version, installed.version) < 0 && !options.allowDowngrade) {
+      return fail("downgrade-refused", `offered ${manifest.version} is older than installed ${installed.version}; pin a version and use --allow-downgrade for recovery`);
+    }
+    if (installed.version === manifest.version) {
+      if (installed.provenance?.sha256 !== artifact.sha256.toLowerCase())
+        return fail("manifest-malformed", "same release version offers a different signed artifact digest");
+      preserveMinimum(env, keys, manifest);
+      return {
         ok: true,
-        installedVersion: installed.version,
-        latestVersion: fetched.manifest.version,
-        channel: (0, firstPartyHarnessChannels_js_1.resolveFirstPartyHarnessChannel)(env).channel,
-        updateAvailable: !installed.version ||
-            (0, releaseVersions_js_1.compareReleaseVersions)(installed.version, fetched.manifest.version) === -1,
+        changed: false,
+        version: installed.version,
         binaryPath: installed.binaryPath,
-        owner: override && node_path_1.default.resolve(override) !== node_path_1.default.resolve(installed.binaryPath)
-            ? 'external'
-            : 'managed',
-        installedVerified: installed.verified,
-        minimumVersion: minimum,
-        lastUpdate: readFirstPartyHarnessUpdateState(env),
-    };
-}
-async function installFirstPartyHarness(options = {}) {
-    const env = options.env ?? process.env;
-    const keys = options.keys ?? firstPartyHarnessReleaseKeys_js_1.FIRST_PARTY_HARNESS_RELEASE_PUBLIC_KEYS;
-    const progress = options.onProgress ?? (() => { });
-    const platform = firstPartyHarnessPlatformKey(options.platform, options.arch);
-    if (!platform || (options.platform ?? process.platform) === 'win32')
-        return fail('unsupported-platform', 'no managed engine activation for this platform');
-    if (options.version && (0, releaseVersions_js_1.compareReleaseVersions)(options.version, options.version) === null)
-        return fail('version-invalid', 'requested version is not a semantic release version');
-    if (options.allowDowngrade && !options.version)
-        return fail('downgrade-refused', 'a downgrade requires an explicit pinned version');
-    const attemptedAt = Date.now();
-    let release;
-    let result;
-    try {
-        release = await proper_lockfile_1.default.lock(prepareLock(env), {
-            realpath: false,
-            stale: LOCK_STALE_MS,
-            update: 10_000,
-            retries: { retries: 20, minTimeout: 100, maxTimeout: 500, factor: 1.2 },
-        });
-        atomicJson(paths(env).state, {
-            operation: 'install',
-            status: 'running',
-            attemptedAt,
-            targetVersion: options.version,
-        });
-        result = await downloadAndActivate();
-        finishState(env, 'install', attemptedAt, result, result.version ?? options.version, keys);
-        return result;
+        platform: installed.provenance?.platform,
+        replaced: true
+      };
     }
-    catch (error) {
-        result = fail(error.code === 'ELOCKED' ? 'lock-busy' : 'install-failed', describe(error));
-        if (release) {
-            try {
-                finishState(env, 'install', attemptedAt, result, options.version, keys);
-            }
-            catch {
-                /* preserve original error */
-            }
-        }
-        return result;
-    }
-    finally {
-        await release?.();
-    }
-    async function downloadAndActivate() {
-        progress('Fetching signed release manifest…');
-        const fetched = await fetchVerifiedManifest(options);
-        if (!fetched.ok)
-            return fetched;
-        const { manifest } = fetched;
-        const artifact = manifest.platforms[platform];
-        if (!artifact)
-            return fail('artifact-missing', `release ${manifest.version} has no ${platform} artifact`);
-        const verdict = (0, releaseManifest_js_1.verifyArtifact)(platform, manifest.version, artifact, keys);
-        if (!('ok' in verdict) || !verdict.ok)
-            return fail('artifact-unverified', 'artifact signature rejected');
-        if (typeof artifact.size === 'number' && artifact.size > exports.MAX_ARTIFACT_BYTES)
-            return fail('too-large', 'artifact declares bytes above the ceiling');
-        const installed = getVerifiedInstalledFirstPartyHarness({
-            env,
-            keys,
-            platform: options.platform,
-            arch: options.arch,
-        });
-        const floor = retainedMinimum(env, keys);
-        if (floor && (0, releaseVersions_js_1.compareReleaseVersions)(manifest.version, floor) < 0)
-            return fail('minimum-version', `offered release is below the retained signed minimum ${floor}`);
-        if (installed.version &&
-            (0, releaseVersions_js_1.compareReleaseVersions)(manifest.version, installed.version) < 0 &&
-            !options.allowDowngrade) {
-            return fail('downgrade-refused', `offered ${manifest.version} is older than installed ${installed.version}; pin a version and use --allow-downgrade for recovery`);
-        }
-        if (installed.version === manifest.version) {
-            if (installed.provenance?.sha256 !== artifact.sha256.toLowerCase())
-                return fail('manifest-malformed', 'same release version offers a different signed artifact digest');
-            preserveMinimum(env, keys, manifest);
-            return {
-                ok: true,
-                changed: false,
-                version: installed.version,
-                binaryPath: installed.binaryPath,
-                platform: installed.provenance?.platform,
-                replaced: true,
-            };
-        }
-        progress(`Downloading ${firstPartyHarness_js_1.FIRST_PARTY_HARNESS.displayName} ${manifest.version} (${platform})…`);
-        let binary;
-        try {
-            const response = await (options.fetchImpl ?? globalThis.fetch)(artifact.url, {
-                signal: fetchSignal(options, ARTIFACT_FETCH_TIMEOUT_MS),
-                redirect: 'follow',
-            });
-            if (!response.ok)
-                return fail('download-failed', `HTTP ${response.status} for ${artifact.url}`);
-            const contentLength = Number(response.headers.get('content-length'));
-            if (Number.isFinite(contentLength) && contentLength > exports.MAX_ARTIFACT_BYTES)
-                return fail('too-large', 'response declares bytes above the ceiling');
-            const chunks = [];
-            let size = 0;
-            if (!response.body)
-                return fail('download-failed', 'artifact response has no body');
-            const reader = response.body.getReader();
-            try {
-                while (true) {
-                    const part = await reader.read();
-                    if (part.done)
-                        break;
-                    size += part.value.byteLength;
-                    if (size > exports.MAX_ARTIFACT_BYTES) {
-                        await reader.cancel();
-                        return fail('too-large', 'download exceeds the ceiling');
-                    }
-                    chunks.push(part.value);
-                }
-            }
-            finally {
-                reader.releaseLock();
-            }
-            binary = Buffer.concat(chunks, size);
-        }
-        catch (error) {
-            return fail('download-failed', `download failed: ${describe(error)}`);
+    progress(`Downloading ${import_firstPartyHarness.FIRST_PARTY_HARNESS.displayName} ${manifest.version} (${platform})\u2026`);
+    let binary;
+    try {
+      const response = await (options.fetchImpl ?? globalThis.fetch)(artifact.url, {
+        signal: fetchSignal(options, ARTIFACT_FETCH_TIMEOUT_MS),
+        redirect: "follow"
+      });
+      if (!response.ok)
+        return fail("download-failed", `HTTP ${response.status} for ${artifact.url}`);
+      const contentLength = Number(response.headers.get("content-length"));
+      if (Number.isFinite(contentLength) && contentLength > MAX_ARTIFACT_BYTES)
+        return fail("too-large", "response declares bytes above the ceiling");
+      const chunks = [];
+      let size = 0;
+      if (!response.body)
+        return fail("download-failed", "artifact response has no body");
+      const reader = response.body.getReader();
+      try {
+        while (true) {
+          const part = await reader.read();
+          if (part.done)
+            break;
+          size += part.value.byteLength;
+          if (size > MAX_ARTIFACT_BYTES) {
+            await reader.cancel();
+            return fail("too-large", "download exceeds the ceiling");
+          }
+          chunks.push(part.value);
         }
-        const provenance = {
-            version: manifest.version,
-            platform: platform,
-            sha256: artifact.sha256.toLowerCase(),
-            url: artifact.url,
-            sig: artifact.sig,
-            ...(artifact.sigs ? { sigs: artifact.sigs } : {}),
-            ...(manifest.keyId ? { keyId: manifest.keyId } : {}),
-        };
-        const activation = { ...options, binary, provenance, manifest };
-        const invalid = validateArtifact(activation);
-        return invalid ?? activateLocked(activation);
-    }
+      } finally {
+        reader.releaseLock();
+      }
+      binary = Buffer.concat(chunks, size);
+    } catch (error) {
+      return fail("download-failed", `download failed: ${describe(error)}`);
+    }
+    const provenance = {
+      version: manifest.version,
+      platform,
+      sha256: artifact.sha256.toLowerCase(),
+      url: artifact.url,
+      sig: artifact.sig,
+      ...artifact.sigs ? { sigs: artifact.sigs } : {},
+      ...manifest.keyId ? { keyId: manifest.keyId } : {}
+    };
+    const activation = { ...options, binary, provenance, manifest };
+    const invalid = validateArtifact(activation);
+    return invalid ?? activateLocked(activation);
+  }
 }
-/** Rollback validates the retained immutable release and preserves its signature. */
 function rollbackFirstPartyHarness(env = process.env, options = {}) {
-    const keys = options.keys ?? firstPartyHarnessReleaseKeys_js_1.FIRST_PARTY_HARNESS_RELEASE_PUBLIC_KEYS;
-    const p = paths(env);
-    const attemptedAt = Date.now();
-    let release;
-    try {
-        release = proper_lockfile_1.default.lockSync(prepareLock(env), { realpath: false, stale: LOCK_STALE_MS });
-        const result = performRollback();
-        finishState(env, 'rollback', attemptedAt, result, result.version, keys);
-        return result;
-    }
-    catch (error) {
-        const result = fail(error.code === 'ELOCKED' ? 'lock-busy' : 'install-failed', `rollback failed: ${describe(error)}`);
-        if (release) {
-            try {
-                finishState(env, 'rollback', attemptedAt, result, undefined, keys);
-            }
-            catch {
-                // Preserve the rollback failure if its diagnostic journal is also unwritable.
-            }
-        }
-        return result;
-    }
-    finally {
-        release?.();
-    }
-    function performRollback() {
-        if (!isManagedFirstPartyHarnessReleasePath(firstPartyHarnessBinaryPath(env), env))
-            return fail('install-failed', 'active engine is outside the managed release store; install an explicitly pinned signed release before rolling back');
-        const previous = readLink(p.previous);
-        const current = readLink(p.current);
-        if (!previous ||
-            !current ||
-            !previous.startsWith('releases/') ||
-            node_path_1.default.resolve(p.home, previous).startsWith(p.releases + node_path_1.default.sep) === false)
-            return fail('install-failed', 'no managed previous release to roll back to');
-        const restored = inspectBinary(node_path_1.default.join(p.home, previous, node_path_1.default.basename(firstPartyHarnessBinaryPath(env))), keys);
-        if (!restored.verified || !restored.version)
-            return fail('artifact-unverified', 'previous release provenance is missing or invalid; install an explicitly pinned signed release for recovery');
-        const floor = retainedMinimum(env, keys);
-        if (floor && (0, releaseVersions_js_1.compareReleaseVersions)(restored.version, floor) < 0)
-            return fail('minimum-version', `previous release is below the retained signed minimum ${floor}`);
-        // Preserve the outgoing target only after activation. A crash between these
-        // operations still leaves `current` on a complete verified release.
-        atomicLink(previous, p.current);
-        atomicLink(current, p.previous);
-        stableLinks(env);
-        return {
-            ok: true,
-            changed: true,
-            replaced: true,
-            binaryPath: firstPartyHarnessBinaryPath(env),
-            version: restored.version,
-            platform: restored.provenance?.platform,
-        };
+  const keys = options.keys ?? import_firstPartyHarnessReleaseKeys.FIRST_PARTY_HARNESS_RELEASE_PUBLIC_KEYS;
+  const p = paths(env);
+  const attemptedAt = Date.now();
+  let release;
+  try {
+    release = import_proper_lockfile.default.lockSync(prepareLock(env), { realpath: false, stale: LOCK_STALE_MS });
+    const result = performRollback();
+    finishState(env, "rollback", attemptedAt, result, result.version, keys);
+    return result;
+  } catch (error) {
+    const result = fail(error.code === "ELOCKED" ? "lock-busy" : "install-failed", `rollback failed: ${describe(error)}`);
+    if (release) {
+      try {
+        finishState(env, "rollback", attemptedAt, result, void 0, keys);
+      } catch {
+      }
     }
+    return result;
+  } finally {
+    release?.();
+  }
+  function performRollback() {
+    if (!isManagedFirstPartyHarnessReleasePath(firstPartyHarnessBinaryPath(env), env))
+      return fail("install-failed", "active engine is outside the managed release store; install an explicitly pinned signed release before rolling back");
+    const previous = readLink(p.previous);
+    const current = readLink(p.current);
+    if (!previous || !current || !previous.startsWith("releases/") || import_node_path.default.resolve(p.home, previous).startsWith(p.releases + import_node_path.default.sep) === false)
+      return fail("install-failed", "no managed previous release to roll back to");
+    const restored = inspectBinary(import_node_path.default.join(p.home, previous, import_node_path.default.basename(firstPartyHarnessBinaryPath(env))), keys);
+    if (!restored.verified || !restored.version)
+      return fail("artifact-unverified", "previous release provenance is missing or invalid; install an explicitly pinned signed release for recovery");
+    const floor = retainedMinimum(env, keys);
+    if (floor && (0, import_releaseVersions.compareReleaseVersions)(restored.version, floor) < 0)
+      return fail("minimum-version", `previous release is below the retained signed minimum ${floor}`);
+    atomicLink(previous, p.current);
+    atomicLink(current, p.previous);
+    stableLinks(env);
+    return {
+      ok: true,
+      changed: true,
+      replaced: true,
+      binaryPath: firstPartyHarnessBinaryPath(env),
+      version: restored.version,
+      platform: restored.provenance?.platform
+    };
+  }
 }
 function installedFirstPartyHarnessSize(env = process.env) {
-    try {
-        return (0, node_fs_1.statSync)(firstPartyHarnessBinaryPath(env)).size;
-    }
-    catch {
-        return null;
-    }
-}
+  try {
+    return (0, import_node_fs.statSync)(firstPartyHarnessBinaryPath(env)).size;
+  } catch {
+    return null;
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  FIRST_PARTY_HARNESS_RELEASE_PUBLIC_KEYS,
+  MAX_ARTIFACT_BYTES,
+  PREVIOUS_SUFFIX,
+  PROVENANCE_SUFFIX,
+  activateVerifiedFirstPartyHarnessArtifact,
+  checkFirstPartyHarnessUpdate,
+  fetchVerifiedManifest,
+  firstPartyHarnessBinaryPath,
+  firstPartyHarnessFeedBase,
+  firstPartyHarnessFeedCandidates,
+  firstPartyHarnessInstallDir,
+  firstPartyHarnessManifestFile,
+  firstPartyHarnessPlatformKey,
+  getVerifiedInstalledFirstPartyHarness,
+  installFirstPartyHarness,
+  installedFirstPartyHarnessSize,
+  isManagedFirstPartyHarnessReleasePath,
+  readFirstPartyHarnessUpdateState,
+  rollbackFirstPartyHarness
+});