@tryaura/aura-cli 0.4.0 → 0.5.0

package/dist/{run.boundary-fZhCH0bP.js → run.boundary-DSNajl5n.js}

@@ -2,17 +2,17 @@ import { A as displayPath, C as isRecord$4, D as SHARED_INSTRUCTIONS_TEMPLATE, E
 import { COMMAND_NOT_FOUND_EXIT_CODE, DEFAULT_EXEC_TIMEOUT_MS, DEFAULT_HTTP_TIMEOUT_MS, MAX_EXEC_OUTPUT_CHARACTERS, MAX_EXEC_TIMEOUT_MS, MAX_HTTP_RESPONSE_BYTES, MAX_HTTP_TIMEOUT_MS, McpWriteError, NOT_EXECUTABLE_EXIT_CODE, OUTPUT_LIMIT_EXIT_CODE, SHARED_INSTRUCTIONS_TEMPLATE_TOKEN, TIMEOUT_EXIT_CODE, defineOwnProperty, detectExecutable, hasMcpRedaction, jsonPropertyPath, mcpEnvironmentVariableNames, mcpServerNameProblem, normalizeMcpServerDefinition, parseMcpServerDefinition, parseMcpServerManifest, parseMcpServerManifestValue, parseSkillFrontmatter, parseSkillReferences, resolveMcpSecretNameCollisions, resolveSkillDirectory, splitSourceLines } from "@tryaura/aura-sdk";
 import { basename, delimiter, dirname, isAbsolute, join, posix, relative, resolve, sep, win32 } from "node:path";
 import { Buffer as Buffer$1, isUtf8 } from "node:buffer";
-import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
+import { createHash, createPublicKey, randomUUID, timingSafeEqual, verify } from "node:crypto";
 import { constants, homedir } from "node:os";
-import { spawn } from "node:child_process";
-import { constants as constants$1 } from "node:fs";
-import { access, chmod, link, lstat, mkdir, open, opendir, readFile, readdir, readlink, realpath, rename, rm, rmdir, stat, symlink, unlink, utimes, writeFile } from "node:fs/promises";
+import { execFile, spawn } from "node:child_process";
+import { constants as constants$1, createReadStream } from "node:fs";
+import { access, chmod, copyFile, link, lstat, mkdir, open, opendir, readFile, readdir, readlink, realpath, rename, rm, rmdir, stat, symlink, unlink, utimes, writeFile } from "node:fs/promises";
 import { applyPatch, createTwoFilesPatch, structuredPatch } from "diff";
-import { coerce, parse, satisfies, valid, validRange } from "semver";
+import { coerce, gt, parse, satisfies, valid, validRange } from "semver";
 import { isDeepStrictEqual } from "node:util";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { EnvHttpProxyAgent, fetch as fetch$1 } from "undici";
-import { gunzipSync } from "node:zlib";
+import { createGunzip, gunzipSync } from "node:zlib";
 import process$1 from "node:process";
 import { Builtins, Cli, Command, Option } from "clipanion/lib/advanced/index.js";
 import { HelpCommand } from "clipanion/lib/advanced/HelpCommand.js";
@@ -1474,13 +1474,13 @@ async function applyPreparedOperation(prepared, plan, registerUndo, filesystem =
 }
 //#endregion
 //#region ../core/src/fix-plan/journal-lock-record.ts
-const LOCK_STALE_MS = 3e5;
+const LOCK_STALE_MS$1 = 3e5;
 const UNREADABLE_LOCK_GRACE_MS = 5e3;
 async function inspectLock(path, now) {
 	try {
 		const owner = parseOwner(await readFile(path, "utf8"));
 		if (owner === void 0) return await unreadableLockIsStale(path, now) ? { kind: "stale" } : { kind: "active" };
-		if (now().getTime() - owner.acquiredAtMs <= LOCK_STALE_MS || processIsAlive(owner.pid)) return {
+		if (now().getTime() - owner.acquiredAtMs <= LOCK_STALE_MS$1 || processIsAlive(owner.pid)) return {
 			kind: "active",
 			owner
 		};
@@ -5786,7 +5786,7 @@ const MAX_CAUSE_DEPTH = 8;
 const MAX_DETAIL_CHARACTERS = 300;
 const MAX_REDIRECTS = 3;
 const URL_PROBE_TIMEOUT_MS = 3e3;
-const REDIRECT_STATUSES = /* @__PURE__ */ new Set([
+const REDIRECT_STATUSES$1 = /* @__PURE__ */ new Set([
 	301,
 	302,
 	303,
@@ -5833,13 +5833,13 @@ async function probeMcpUrl(url, request) {
 }
 async function runProbe(url, signal, request) {
 	const redirects = { count: 0 };
-	const head = await follow(url, "HEAD", signal, redirects, request);
+	const head = await follow$1(url, "HEAD", signal, redirects, request);
 	if (head.kind !== "response") return outcomeProblem(head);
 	if (head.response.status !== 405) return responseProblem(head.response.status);
-	const get = await follow(head.url, "GET", signal, redirects, request);
+	const get = await follow$1(head.url, "GET", signal, redirects, request);
 	return get.kind === "response" ? responseProblem(get.response.status) : outcomeProblem(get);
 }
-async function follow(initialUrl, method, signal, redirects, request) {
+async function follow$1(initialUrl, method, signal, redirects, request) {
 	let url = initialUrl;
 	while (true) {
 		const response = await request({
@@ -5847,7 +5847,7 @@ async function follow(initialUrl, method, signal, redirects, request) {
 			signal,
 			url
 		});
-		if (!REDIRECT_STATUSES.has(response.status)) return {
+		if (!REDIRECT_STATUSES$1.has(response.status)) return {
 			kind: "response",
 			response,
 			url
@@ -6708,6 +6708,72 @@ function environmentValue(variables, name) {
 	return variables[name] ?? variables[name.toUpperCase()];
 }
 //#endregion
+//#region ../core/src/workspace/disk-cache.ts
+/**
+* Shared primitives for the on-disk caches below `~/agents/.cache`.
+*
+* A cache here is an optimization and nothing more: every reader treats a malformed, oversized,
+* or unreadable entry as a miss, and a failed write leaves the world exactly as it was. Entries
+* are private to the user (`0700` directories, `0600` files) and land atomically via a temporary
+* file and rename, so a concurrent run never observes half an entry.
+*/
+/**
+* The caches' own reader, built once rather than per lookup.
+*
+* Deliberately not a caller-injected reader: entries are written here with `node:fs` and are
+* machine state rather than workspace content, so reading them through a substituted reader would
+* let a run see a cache it cannot write and write one it cannot see.
+*/
+const CACHE_READER = createFileReader();
+/**
+* Resolves one entry's location below `~/agents/.cache/<namespace>/<sha256(key)>`.
+*
+* Takes the home directory rather than a whole {@link Environment} so a caller that runs before
+* one exists — the startup updater, which decides whether to check for a release at all — reaches
+* the same directory layout as every other cache instead of inventing a second one.
+*/
+function cacheLocation(environment, namespace, key) {
+	const directory = join(environment.homeDir, "agents", ".cache", namespace);
+	const hash = createHash("sha256").update(key, "utf8").digest("hex");
+	return {
+		directory,
+		path: join(directory, hash)
+	};
+}
+/** Reads one entry's JSON envelope, or `undefined` for any reason it cannot be used. */
+async function readCacheEnvelope(location, maxBytes) {
+	try {
+		const contents = await CACHE_READER.read(location.path, { maxBytes });
+		if (!contents.exists || contents.problem !== void 0 || contents.content === void 0) return;
+		const value = JSON.parse(contents.content);
+		return isPlainRecord$2(value) ? value : void 0;
+	} catch {
+		return;
+	}
+}
+/** Stores one entry's envelope, treating any write failure as nothing having happened. */
+async function writeCacheEnvelope(location, envelope) {
+	const temporary = join(location.directory, `.${randomUUID()}.tmp`);
+	try {
+		await mkdir(location.directory, {
+			mode: 448,
+			recursive: true
+		});
+		await writeFile(temporary, `${JSON.stringify(envelope)}\n`, {
+			encoding: "utf8",
+			mode: 384
+		});
+		await rename(temporary, location.path);
+	} catch {
+		try {
+			await unlink(temporary);
+		} catch {}
+	}
+}
+function isPlainRecord$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
 //#region ../core/src/skills/agenticskills-http.ts
 /**
 * Performs one bounded GET, retrying once on a transient failure unless the caller opts out.
@@ -6833,66 +6899,6 @@ function daysInMonth(year, month) {
 	return month >= 1 && month <= 12 ? 31 : void 0;
 }
 //#endregion
-//#region ../core/src/workspace/disk-cache.ts
-/**
-* Shared primitives for the on-disk caches below `~/agents/.cache`.
-*
-* A cache here is an optimization and nothing more: every reader treats a malformed, oversized,
-* or unreadable entry as a miss, and a failed write leaves the world exactly as it was. Entries
-* are private to the user (`0700` directories, `0600` files) and land atomically via a temporary
-* file and rename, so a concurrent run never observes half an entry.
-*/
-/**
-* The caches' own reader, built once rather than per lookup.
-*
-* Deliberately not a caller-injected reader: entries are written here with `node:fs` and are
-* machine state rather than workspace content, so reading them through a substituted reader would
-* let a run see a cache it cannot write and write one it cannot see.
-*/
-const CACHE_READER = createFileReader();
-/** Resolves one entry's location below `~/agents/.cache/<namespace>/<sha256(key)>`. */
-function cacheLocation(environment, namespace, key) {
-	const directory = join(environment.homeDir, "agents", ".cache", namespace);
-	const hash = createHash("sha256").update(key, "utf8").digest("hex");
-	return {
-		directory,
-		path: join(directory, hash)
-	};
-}
-/** Reads one entry's JSON envelope, or `undefined` for any reason it cannot be used. */
-async function readCacheEnvelope(location, maxBytes) {
-	try {
-		const contents = await CACHE_READER.read(location.path, { maxBytes });
-		if (!contents.exists || contents.problem !== void 0 || contents.content === void 0) return;
-		const value = JSON.parse(contents.content);
-		return isPlainRecord$1(value) ? value : void 0;
-	} catch {
-		return;
-	}
-}
-/** Stores one entry's envelope, treating any write failure as nothing having happened. */
-async function writeCacheEnvelope(location, envelope) {
-	const temporary = join(location.directory, `.${randomUUID()}.tmp`);
-	try {
-		await mkdir(location.directory, {
-			mode: 448,
-			recursive: true
-		});
-		await writeFile(temporary, `${JSON.stringify(envelope)}\n`, {
-			encoding: "utf8",
-			mode: 384
-		});
-		await rename(temporary, location.path);
-	} catch {
-		try {
-			await unlink(temporary);
-		} catch {}
-	}
-}
-function isPlainRecord$1(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-//#endregion
 //#region ../core/src/skills/catalog-cache.ts
 /** How long a cached catalog serves with no network request at all. */
 const CATALOG_CACHE_FRESH_MS = 36e5;
@@ -6904,8 +6910,8 @@ const CATALOG_CACHE_FRESH_MS = 36e5;
 */
 const CATALOG_CACHE_MAX_AGE_MS = 6048e5;
 /** Doubled: the body is JSON stored inside JSON, so every quote costs one escape byte. */
-const MAX_CACHE_BYTES$1 = 8004096;
-const NAMESPACE$1 = "skill-catalogs";
+const MAX_CACHE_BYTES$2 = 8004096;
+const NAMESPACE$2 = "skill-catalogs";
 /**
 * Returns the cached document for one endpoint, or `undefined` for any reason it cannot be used.
 *
@@ -6913,7 +6919,7 @@ const NAMESPACE$1 = "skill-catalogs";
 * expired entry must never be the reason a run cannot list a catalog it could otherwise fetch.
 */
 async function readCatalogCache(environment, endpoint) {
-	const value = await readCacheEnvelope(cacheLocation(environment, NAMESPACE$1, endpoint), MAX_CACHE_BYTES$1);
+	const value = await readCacheEnvelope(cacheLocation(environment, NAMESPACE$2, endpoint), MAX_CACHE_BYTES$2);
 	if (value === void 0) return;
 	const body = value["body"];
 	const cachedAt = value["cachedAt"];
@@ -6929,7 +6935,7 @@ async function readCatalogCache(environment, endpoint) {
 }
 /** Stores one catalog body, treating any write failure as nothing having happened. */
 async function writeCatalogCache(environment, endpoint, body, etag) {
-	await writeCacheEnvelope(cacheLocation(environment, NAMESPACE$1, endpoint), {
+	await writeCacheEnvelope(cacheLocation(environment, NAMESPACE$2, endpoint), {
 		body,
 		cachedAt: environment.now().getTime(),
 		endpoint,
@@ -8584,8 +8590,8 @@ function isJsonArray(value) {
 //#endregion
 //#region ../core/src/preset/cache.ts
 const CACHE_TTL_MS = 864e5;
-const MAX_CACHE_BYTES = 260096;
-const NAMESPACE = "presets";
+const MAX_CACHE_BYTES$1 = 260096;
+const NAMESPACE$1 = "presets";
 /**
 * Returns the cached document for one reference, or `undefined` for any reason it cannot be used.
 *
@@ -8595,7 +8601,7 @@ const NAMESPACE = "presets";
 * so validating here would only duplicate that walk.
 */
 async function readPresetCache(environment, reference) {
-	const value = await readCacheEnvelope(cacheLocation(environment, NAMESPACE, reference), MAX_CACHE_BYTES);
+	const value = await readCacheEnvelope(cacheLocation(environment, NAMESPACE$1, reference), MAX_CACHE_BYTES$1);
 	if (value === void 0) return;
 	const cachedAt = value["cachedAt"];
 	const preset = value["preset"];
@@ -8605,7 +8611,7 @@ async function readPresetCache(environment, reference) {
 }
 /** Stores one validated document, treating any write failure as nothing having happened. */
 async function writePresetCache(environment, reference, preset) {
-	await writeCacheEnvelope(cacheLocation(environment, NAMESPACE, reference), {
+	await writeCacheEnvelope(cacheLocation(environment, NAMESPACE$1, reference), {
 		cachedAt: environment.now().getTime(),
 		preset,
 		reference
@@ -8671,7 +8677,7 @@ function extractPresetJson(compressed) {
 	const paths = /* @__PURE__ */ new Set();
 	while (offset + BLOCK <= archive.byteLength) {
 		const header = archive.subarray(offset, offset + BLOCK);
-		if (isZeroBlock(header)) break;
+		if (isZeroBlock$1(header)) break;
 		if (!validTarChecksum(header)) return invalid$1("npm preset tarball has an invalid header checksum.");
 		const name = tarName(header);
 		if (unsafeTarPath(name)) return invalid$1("npm preset tarball contains an unsafe entry path.");
@@ -8724,7 +8730,7 @@ function validTarChecksum(header) {
 	for (const [index, byte] of header.entries()) sum += index >= 148 && index < 156 ? 32 : byte;
 	return sum === Number.parseInt(raw, 8);
 }
-function isZeroBlock(block) {
+function isZeroBlock$1(block) {
 	return block.every((byte) => byte === 0);
 }
 function invalid$1(problem) {
@@ -8817,8 +8823,8 @@ function npmDistribution(text) {
 	} catch {
 		return;
 	}
-	const dist = isPlainRecord(value) ? value["dist"] : void 0;
-	if (!isPlainRecord(dist)) return;
+	const dist = isPlainRecord$1(value) ? value["dist"] : void 0;
+	if (!isPlainRecord$1(dist)) return;
 	const tarball = registryTarball(dist["tarball"]);
 	if (tarball === void 0) return;
 	return {
@@ -8836,7 +8842,7 @@ function registryTarball(value) {
 		return;
 	}
 }
-function isPlainRecord(value) {
+function isPlainRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 //#endregion
@@ -10530,7 +10536,7 @@ function positiveInteger(value) {
 /** What the frame says while adapters probe the machine. Same sentence the setup wizard uses. */
 const SCAN_PROMPT$1 = "Scanning this machine…";
 /** What a run with nothing to animate, or nowhere to animate it, gets instead. */
-const IDLE = {
+const IDLE$1 = {
 	close: () => {},
 	report: () => {}
 };
@@ -10547,7 +10553,7 @@ const IDLE = {
 * existed. The frame is erased on close, so nothing it painted survives into the report.
 */
 function startScanProgress(options) {
-	if (options.rows.length === 0 || !isTerminal(options.stdout)) return IDLE;
+	if (options.rows.length === 0 || !isTerminal(options.stdout)) return IDLE$1;
 	const style = createStyle(options.colorDepth);
 	const statuses = new Map(options.rows.map((row) => [row.id, "pending"]));
 	let painted = 0;
@@ -15731,7 +15737,7 @@ function compareEntries(left, right) {
 	if (leftRepo !== (right.repo === true)) return leftRepo ? -1 : 1;
 	const leftConfigured = left.existing !== void 0;
 	if (leftConfigured !== (right.existing !== void 0)) return leftConfigured ? -1 : 1;
-	return entryName(left).localeCompare(entryName(right));
+	return entryName$1(left).localeCompare(entryName$1(right));
 }
 /** The `repo/` namespace is reserved against plugins, so the prefix alone is provenance. */
 function isRepoCatalogId(id) {
@@ -15739,9 +15745,9 @@ function isRepoCatalogId(id) {
 }
 /** User-facing name used by the picker and deterministic sorting. */
 function mcpCatalogEntryName(entry) {
-	return entryName(entry);
+	return entryName$1(entry);
 }
-function entryName(entry) {
+function entryName$1(entry) {
 	return entry.catalog?.manifest.name ?? entry.existing?.name ?? entry.key;
 }
 //#endregion
@@ -15790,14 +15796,14 @@ async function resolveSourceBatch(context, sourceId, ids) {
 	if (driver === void 0) {
 		if (directory === void 0) return;
 		const result = await resolveDirectorySkills(context.environment, directory, eligibleIds);
-		record(context, sourceId, eligibleIds, result.skills, (id) => resolutionFailure(result.diagnostics, id));
+		record$1(context, sourceId, eligibleIds, result.skills, (id) => resolutionFailure(result.diagnostics, id));
 		return;
 	}
 	const result = await resolveDriverSkills(context.environment, driver, eligibleIds);
-	record(context, sourceId, eligibleIds, result.skills, (id) => result.problems.get(id) ?? "could not be fetched from its driver");
+	record$1(context, sourceId, eligibleIds, result.skills, (id) => result.problems.get(id) ?? "could not be fetched from its driver");
 }
 /** Memoizes one batch's packs, then explains every requested id the batch did not return. */
-function record(context, sourceId, requestedIds, skills, failure) {
+function record$1(context, sourceId, requestedIds, skills, failure) {
 	for (const skill of skills) context.packs.set(skillIdentity(sourceId, skill.id), skill);
 	for (const id of requestedIds) {
 		const identity = skillIdentity(sourceId, id);
@@ -18625,14 +18631,1722 @@ var UndoCommand = class extends Command {
 	}
 };
 //#endregion
-//#region src/run.boundary.ts
-/** Runs one build-time-composed Aura distribution. */
-async function runCli(distro, runtime) {
-	const resolved = resolveRuntime(runtime, distro.branding);
-	const telemetry = createTelemetryRecorder({
-		distroVersion: distro.branding.version,
-		now: resolved.now,
-		sink: telemetryEnabled(resolved.environmentVariables) ? distro.telemetry : void 0
+//#region src/update/limits.ts
+/**
+* Every bound the updater enforces, in one place.
+*
+* A limit that lives next to its single use gets relaxed by whoever is debugging that use. These
+* are the numbers a reviewer needs to see together to know an update cannot exhaust the disk, the
+* heap, the network, or the user's patience.
+*/
+/** Bytes accepted for one release archive, streamed and counted rather than buffered. */
+const MAX_ARCHIVE_BYTES = 268435456;
+/**
+* Bytes accepted from an archive's extracted entries, so a compression bomb cannot fill a disk.
+*
+* Larger than the archive bound because the archive is compressed, and small enough that the worst
+* case is a temporary file the transaction removes rather than a full disk.
+*/
+const MAX_EXTRACTED_BYTES = 536870912;
+/** Bytes accepted for one release-metadata document. */
+const MAX_METADATA_BYTES = 524288;
+/** Bytes accepted for one cached metadata entry. */
+const MAX_CACHE_BYTES = 65536;
+/**
+* How far ahead of now a signed manifest's `expiresAt` may sit.
+*
+* A signature proves who wrote a manifest, never that it is the newest one they wrote. Without a
+* bound, anything that can serve a stale-but-valid copy — a compromised edge, a caching proxy, a
+* mirror left behind — pins a fleet to a release forever, and the updater reports nothing because
+* "no newer release" is the quiet path. The window is what turns that freeze into an expiry.
+*
+* Capped rather than merely required, because a publisher who dates a manifest a decade out has
+* satisfied the field and rebuilt the same problem.
+*/
+const MAX_MANIFEST_FRESHNESS_MS = 2592e6;
+/**
+* Milliseconds the whole startup update may spend before the user's command starts.
+*
+* The one number that bounds the wait, because it is the only one the user experiences. Every step
+* below has its own ceiling, but a per-step bound is not an aggregate: metadata, a probe of the
+* installed binary, the transfer, and a probe of the staged one each finishing just inside their
+* own limit is a command that has not started yet. The download is given whatever is left of this,
+* so a slow transfer is abandoned rather than allowed to consume the sum of the other steps too.
+*/
+const STARTUP_UPDATE_BUDGET_MS = 24e4;
+/** Milliseconds one metadata request may take. */
+const METADATA_TIMEOUT_MS = 1e4;
+/** Milliseconds a version probe of an executable may take. */
+const VERSION_PROBE_TIMEOUT_MS = 3e4;
+/** How long a successful "already current" check stays fresh. */
+const CHECK_FRESH_MS = 864e5;
+/** How long a failed check waits before the next one, silently. */
+const CHECK_RETRY_MS = 36e5;
+/** First backoff step after an installation failure, doubled per attempt. */
+const INSTALL_BACKOFF_BASE_MS = 9e5;
+/** Ceiling the installation backoff doubles up to. */
+const INSTALL_BACKOFF_MAX_MS = 864e5;
+//#endregion
+//#region src/update/download.boundary.ts
+const REDIRECT_STATUSES = /* @__PURE__ */ new Set([
+	301,
+	302,
+	303,
+	307,
+	308
+]);
+/** Progress reports emitted across one download, spread evenly over its declared length. */
+const PROGRESS_STEPS = 100;
+/**
+* Creates the archive downloader: a bounded, TLS-only stream straight to disk.
+*
+* This is the one place in the updater that reaches the network directly. `Environment.httpGet`
+* cannot do this job — it buffers into memory and refuses redirects outright — and a release
+* archive is both too large to hold in the heap and, for a private repository, served through a
+* redirect to a temporary signed URL. The rules `httpGet` enforces are reimplemented rather than
+* relaxed: HTTPS only, a hop limit, and `Authorization` stripped the moment the origin changes.
+*/
+function createUpdateDownload() {
+	return async (request) => {
+		try {
+			return await stream(request);
+		} catch {
+			return {
+				kind: "failure",
+				reason: "network"
+			};
+		}
+	};
+}
+async function stream(request) {
+	const response = await follow(request, AbortSignal.timeout(request.timeoutMs));
+	if (typeof response === "string") return {
+		kind: "failure",
+		reason: response
+	};
+	if (response.status !== 200 || response.body === null) return {
+		kind: "failure",
+		reason: "network"
+	};
+	const declared = response.headers.get("content-length");
+	if (announcesReleaseLength(response) && declared !== String(request.expectedBytes)) return {
+		kind: "failure",
+		reason: "unexpected-length"
+	};
+	return await writeBody(response.body, request);
+}
+/**
+* Whether `content-length` describes the bytes this download will actually see.
+*
+* A proxy that applies its own `Content-Encoding` leaves the header describing the compressed form
+* while `fetch` hands over the decoded one, so comparing the two rejects a download that is
+* perfectly good. The count and the digest are both re-checked once the body has been read, so
+* skipping the header here costs nothing.
+*/
+function announcesReleaseLength(response) {
+	const encoding = response.headers.get("content-encoding")?.trim().toLowerCase();
+	return response.headers.get("content-length") !== null && (encoding === void 0 || encoding === "" || encoding === "identity");
+}
+/** Streams the body to a fresh file, counting and hashing as it goes. */
+async function writeBody(body, request) {
+	const hash = createHash("sha256");
+	let received = 0;
+	const step = Math.ceil(request.expectedBytes / PROGRESS_STEPS);
+	let reported = 0;
+	const handle = await open(request.destinationPath, "wx", 384);
+	try {
+		for await (const chunk of body) {
+			received += chunk.byteLength;
+			if (received > request.expectedBytes) return {
+				kind: "failure",
+				reason: "too-large"
+			};
+			hash.update(chunk);
+			await handle.write(chunk);
+			if (received - reported >= step) {
+				reported = received;
+				request.onProgress?.(received, request.expectedBytes);
+			}
+		}
+		if (received !== request.expectedBytes) return {
+			kind: "failure",
+			reason: "unexpected-length"
+		};
+		await handle.sync();
+		return {
+			kind: "downloaded",
+			sha256: hash.digest("hex")
+		};
+	} finally {
+		await handle.close();
+	}
+}
+/**
+* Follows redirects by hand so each hop is vetted before it is taken.
+*
+* `Authorization` survives only a same-origin hop. GitHub answers an authenticated asset request
+* with a redirect to a signed storage URL that needs no credential of its own, so forwarding one
+* there would hand a repository token to a host the caller never named.
+*/
+async function follow(request, signal) {
+	let url = vetHttpUrl(request.url);
+	let headers = { ...request.headers };
+	for (let hop = 0; hop <= 5; hop += 1) {
+		if (!(url instanceof URL)) return url === "insecure-url" ? "insecure-url" : "network";
+		const response = await fetch(url, {
+			headers,
+			method: "GET",
+			redirect: "manual",
+			signal
+		});
+		const location = response.headers.get("location");
+		if (!REDIRECT_STATUSES.has(response.status) || location === null) return response;
+		const origin = url.origin;
+		url = vetHttpUrl(new URL(location, url).href);
+		if (url instanceof URL && url.origin !== origin) headers = withoutAuthorization(headers);
+	}
+	return "network";
+}
+function withoutAuthorization(headers) {
+	return Object.fromEntries(Object.entries(headers).filter(([name]) => name.toLowerCase() !== "authorization"));
+}
+//#endregion
+//#region src/update/host.boundary.ts
+/** A version line and nothing else: one canonical-shaped version on one line. */
+const VERSION_LINE = /^[0-9][0-9A-Za-z.+-]*$/u;
+/**
+* The process seam the updater runs against.
+*
+* Named as a boundary because it is one: the process id, the ability to signal another process,
+* and forking a child are ambient state everywhere else in the CLI is forbidden from reading.
+* Everything below this file takes {@link UpdateHost} as a parameter, so the exception is one
+* module wide.
+*/
+const UPDATE_HOST = {
+	download: createUpdateDownload(),
+	isProcessAlive,
+	pid: process$1.pid,
+	probeVersion
+};
+/**
+* Whether a process id is still running, from the perspective of this user.
+*
+* Signal `0` performs the permission and existence checks without delivering anything. `EPERM`
+* means the process exists and belongs to someone else, which still counts as alive: the lock it
+* holds is not this run's to break.
+*/
+function isProcessAlive(pid) {
+	if (!Number.isInteger(pid) || pid <= 0) return false;
+	try {
+		process$1.kill(pid, 0);
+		return true;
+	} catch (error) {
+		return error instanceof Error && "code" in error && error.code === "EPERM";
+	}
+}
+/**
+* Asks an executable what version it is.
+*
+* The child's environment is exactly what the caller passed, which is how a staged binary is
+* verified without giving it the chance to start an update of its own. Any outcome that is not one
+* well-formed version line reads as unknown, and an unknown version never satisfies the equality
+* the installer requires before it replaces anything.
+*/
+function probeVersion(executablePath, environmentVariables) {
+	return new Promise((resolve) => {
+		execFile(executablePath, ["--version"], {
+			encoding: "utf8",
+			env: { ...environmentVariables },
+			timeout: VERSION_PROBE_TIMEOUT_MS
+		}, (error, stdout) => {
+			const version = stdout.trim();
+			resolve(error === null && VERSION_LINE.test(version) ? version : void 0);
+		});
+	});
+}
+//#endregion
+//#region src/update/narrow.ts
+/**
+* Narrowing helpers for provider responses.
+*
+* Every release document is unknown input from a server, so nothing reads a field without proving
+* its shape first. These return `undefined` rather than throwing: a provider turns absence into a
+* refusal, and a refusal is never fatal to the command the user actually asked for.
+*/
+/** 64 lowercase hexadecimal characters, the only digest form the updater accepts. */
+const SHA256_PATTERN = /^[0-9a-f]{64}$/u;
+const GITHUB_DIGEST_PREFIX = "sha256:";
+function asRecord(value) {
+	return isPlainRecord(value) ? value : void 0;
+}
+function asArray(value) {
+	return Array.isArray(value) ? value : void 0;
+}
+/** A non-empty string, since an empty name or URL is never a value the updater can act on. */
+function asText(value) {
+	return typeof value === "string" && value !== "" ? value : void 0;
+}
+/** A boolean, and only a boolean: a missing `immutable` field must not read as `false`. */
+function asFlag(value) {
+	return typeof value === "boolean" ? value : void 0;
+}
+/** A positive safe integer within `ceiling`, which is what a byte size has to be to be usable. */
+function asSize(value, ceiling) {
+	if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) return;
+	return value <= ceiling ? value : void 0;
+}
+/** A bare lowercase SHA-256 digest. */
+function asDigest(value) {
+	const text = asText(value);
+	return text !== void 0 && SHA256_PATTERN.test(text) ? text : void 0;
+}
+/** GitHub's `sha256:<hex>` asset digest, reduced to the bare hexadecimal form. */
+function asGitHubDigest(value) {
+	const text = asText(value);
+	if (text === void 0 || !text.startsWith(GITHUB_DIGEST_PREFIX)) return;
+	return asDigest(text.slice(7));
+}
+/** Parses a document, treating any malformed body as an absent one. */
+function parseJson(text) {
+	try {
+		return JSON.parse(text);
+	} catch {
+		return;
+	}
+}
+function isPlainRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
+//#region src/update/cache.ts
+/**
+* Where update metadata lives, beside every other cache Aura keeps.
+*
+* The entry is machine state, not workspace content: `0700` directories, `0600` files, and
+* temporary-file renames, all inherited from the shared cache primitives.
+*/
+const NAMESPACE = "distribution-updates";
+const OUTCOMES = {
+	"check-failed": "check-failed",
+	current: "current",
+	"install-failed": "install-failed"
+};
+/**
+* Reads the entry for one source, or `undefined` for every reason it cannot be used.
+*
+* Corruption, truncation, and a timestamp from the future are all misses rather than errors. A
+* changed source identity resolves to a different hashed path. A cache is only an optimization.
+*/
+async function readUpdateCache(homeDir, identity, now) {
+	const value = await readCacheEnvelope(cacheLocation({ homeDir }, NAMESPACE, identity), MAX_CACHE_BYTES);
+	if (value === void 0) return;
+	const checkedAt = value["checkedAt"];
+	const outcome = value["outcome"];
+	if (typeof checkedAt !== "number" || checkedAt > now || typeof outcome !== "string") return;
+	return narrowEntry(value, checkedAt, outcome);
+}
+/** Stores one entry, treating any write failure as nothing having happened. */
+async function writeUpdateCache(homeDir, identity, entry) {
+	await writeCacheEnvelope(cacheLocation({ homeDir }, NAMESPACE, identity), { ...entry });
+}
+/**
+* Whether this run should ask the source for release metadata.
+*
+* The cadence is what keeps startup cheap and quiet: one successful check a day, one silent retry
+* an hour after a failure, and an exponential backoff per candidate version after an installation
+* that did not complete — so a machine that cannot write to its own install directory asks once,
+* then twice a day, rather than on every command.
+*/
+function shouldCheck(entry, now) {
+	if (entry === void 0) return true;
+	if (entry.outcome === "current") return now - entry.checkedAt >= CHECK_FRESH_MS;
+	if (entry.outcome === "check-failed") return now - entry.checkedAt >= CHECK_RETRY_MS;
+	return now >= nextInstallAttempt(entry);
+}
+/**
+* Attempts already spent on one candidate version.
+*
+* A different version starts at zero: backoff exists to stop retrying a release that will not
+* install, not to punish the next one for it.
+*/
+function attemptsFor(entry, version) {
+	return entry?.failedVersion === version ? entry.failedAttempts ?? 0 : 0;
+}
+function nextInstallAttempt(entry) {
+	const attempts = entry.failedAttempts ?? 0;
+	if (attempts === 0) return entry.checkedAt;
+	const delay = Math.min(INSTALL_BACKOFF_BASE_MS * 2 ** (attempts - 1), INSTALL_BACKOFF_MAX_MS);
+	return entry.checkedAt + delay;
+}
+function narrowEntry(value, checkedAt, rawOutcome) {
+	const outcome = OUTCOMES[rawOutcome];
+	const failedVersion = asText(value["failedVersion"]);
+	if (outcome === void 0 || outcome === "install-failed" && failedVersion === void 0) return;
+	return {
+		checkedAt,
+		...narrowEtag(value),
+		...narrowFailure(value),
+		outcome
+	};
+}
+function narrowEtag(value) {
+	const etag = asText(value["etag"]);
+	return etag === void 0 ? {} : { etag };
+}
+function narrowFailure(value) {
+	const failedAttempts = asSize(value["failedAttempts"], Number.MAX_SAFE_INTEGER);
+	const failedVersion = asText(value["failedVersion"]);
+	return {
+		...failedAttempts === void 0 ? {} : { failedAttempts },
+		...failedVersion === void 0 ? {} : { failedVersion }
+	};
+}
+//#endregion
+//#region src/update/diagnostics.ts
+/**
+* The updater's two diagnostic surfaces: a trace for whoever wired the distribution up, and a
+* progress line for whoever is waiting on the download.
+*
+* Neither belongs to the message contract in `docs/cli-ux.md`. The trace stays off unless a
+* variable asks for it, and the progress line is painted only on a terminal that can erase it
+* again — so redirected output, piped output, and `--json` stay byte-identical either way.
+*/
+/** Suffix on a distribution's disable variable, which is what names its debug variable. */
+const DEBUG_SUFFIX = "_DEBUG";
+const ENABLED_VALUES = /* @__PURE__ */ new Set([
+	"1",
+	"on",
+	"true",
+	"yes"
+]);
+/** What the progress frame says while the archive streams. */
+const DOWNLOAD_PROMPT = "Downloading…";
+/** The distribution-specific variable that disables startup updates. */
+function updateEnvironmentVariable(command) {
+	return `${command.replace(/[^A-Za-z0-9]+/gu, "_").replace(/^_+|_+$/gu, "").toUpperCase()}_UPDATE`;
+}
+/**
+* The debug writer for one distribution.
+*
+* Derived from the command name rather than configured: `acme-dev` gets `ACME_DEV_UPDATE` and its
+* trace gets `ACME_DEV_UPDATE_DEBUG`, leaving neither as a field a distribution can mistype.
+*
+* It exists because every refusal in this subsystem is deliberately silent. That is right for the
+* user, whose command is the thing they asked about — and useless for the author of a distribution
+* whose updates are simply not happening, with nine gates and no way to tell which one fired.
+*/
+function createUpdateDebug(disableEnvironmentVariable, environmentVariables, stderr) {
+	const value = environmentVariables[`${disableEnvironmentVariable}${DEBUG_SUFFIX}`];
+	if (value === void 0 || !ENABLED_VALUES.has(value.trim().toLowerCase())) return () => void 0;
+	return (message) => {
+		stderr.write(`update: ${message}\n`);
+	};
+}
+/** What a run with nowhere to paint gets instead. */
+const IDLE = {
+	close: () => {},
+	report: void 0
+};
+/**
+* Paints how much of the release archive has arrived.
+*
+* The download is the one part of an update the user waits on, and the archive is tens of
+* megabytes: on a thin connection a single unchanging line is indistinguishable from a hung
+* command. Erased on close, so nothing it painted survives into the outcome line.
+*/
+function startUpdateProgress(stderr) {
+	if (!isTerminal(stderr)) return IDLE;
+	let painted = 0;
+	let closed = false;
+	return {
+		close: () => {
+			if (closed) return;
+			closed = true;
+			stderr.write(eraseFrame(painted));
+			painted = 0;
+		},
+		report: (received, total) => {
+			if (closed) return;
+			const frame = `  ${DOWNLOAD_PROMPT} ${String(percentage(received, total))}%\n`;
+			stderr.write(`${eraseFrame(painted)}${frame}`);
+			painted = countFrameRows(frame, terminalDimension(stderr, "columns") ?? 80);
+		}
+	};
+}
+/** Whole percent, never reaching 100 before the transfer has actually finished. */
+function percentage(received, total) {
+	if (total <= 0) return 99;
+	return Math.min(99, Math.floor(received / total * 100));
+}
+//#endregion
+//#region src/update/target.ts
+/**
+* The version a source build reports.
+*
+* Only release CI stamps a real version into the distribution manifest, so a developer running a
+* checkout is structurally indistinguishable from the newest release. Refusing this value keeps a
+* source build from replacing itself with a published binary.
+*/
+const UNSTAMPED_VERSION = "0.0.0";
+const TARGETS = {
+	"darwin-arm64": "darwin-arm64",
+	"darwin-x64": "darwin-x64",
+	"linux-arm64": "linux-arm64",
+	"linux-x64": "linux-x64"
+};
+/** The release target for one installation, or `undefined` when no release names this machine. */
+function releaseTarget(current) {
+	return TARGETS[`${current.platform}-${current.arch}`];
+}
+/**
+* Whether a version is canonical semver a release can be selected by.
+*
+* Canonical rather than merely parseable: `1.4` and `v1.4.0` both describe a release, but only one
+* spelling can be compared against a tag, a probed `--version`, and a cached candidate and agree
+* with itself every time.
+*/
+function isInstallableVersion(value) {
+	return valid(value) === value && value !== UNSTAMPED_VERSION;
+}
+/** Whether `candidate` is a strictly newer release than `current`. Prereleases order as semver. */
+function isNewerVersion(candidate, current) {
+	return valid(candidate) === candidate && valid(current) === current && gt(candidate, current);
+}
+//#endregion
+//#region src/update/eligibility.ts
+/** Values that turn startup updates off, matching how `AURA_TELEMETRY=off` reads today. */
+const DISABLED_VALUES = /* @__PURE__ */ new Set([
+	"0",
+	"false",
+	"no",
+	"off"
+]);
+/**
+* Whether this run may install over its own executable.
+*
+* Every clause is a refusal, and the whole gate resolves before a single byte is requested: a run
+* that is not eligible makes no network request and touches no file. The interactive and `CI`
+* clauses are what keep a pipeline pinned to the binary it selected — a script that pinned
+* `v0.5.0` must still be running `0.5.0` an hour later.
+*/
+async function eligibleInstallation(request) {
+	const { current, version } = request;
+	if (version === void 0 || !isInstallableVersion(version)) return {
+		kind: "refused",
+		reason: "unstamped-version"
+	};
+	const target = releaseTarget(current);
+	if (target === void 0) return {
+		kind: "refused",
+		reason: "unsupported-target"
+	};
+	const blocked = blockedBy(request);
+	if (blocked !== void 0) return {
+		kind: "refused",
+		reason: blocked
+	};
+	if (!await isReplaceableFile(current.execPath)) return {
+		kind: "refused",
+		reason: "not-a-regular-file"
+	};
+	return {
+		installation: {
+			executablePath: current.execPath,
+			target,
+			version
+		},
+		kind: "eligible"
+	};
+}
+/** The environment and terminal half of the gate, separated so its clauses stay readable. */
+function blockedBy(request) {
+	if (isInformationalRun(request.argv)) return "informational-run";
+	if (turnedOff(request)) return "disabled";
+	if (inContinuousIntegration(request)) return "continuous-integration";
+	return ownsTerminal(request) ? void 0 : "not-a-terminal";
+}
+/** Help and version output must remain immediate, including the argument-free root help screen. */
+function isInformationalRun(argv) {
+	return argv.length === 0 || argv.some((value) => value === "--help" || value === "-h" || value === "--version");
+}
+function turnedOff(request) {
+	const value = request.environmentVariables[request.disableEnvironmentVariable];
+	return value !== void 0 && DISABLED_VALUES.has(value.trim().toLowerCase());
+}
+/**
+* Whether this looks like an automated runner.
+*
+* Any `CI` value counts. Providers disagree on whether it is `true`, `1`, or their own name, and an
+* update nobody asked for is the wrong way to discover which one this runner uses.
+*/
+function inContinuousIntegration(request) {
+	const value = request.environmentVariables["CI"];
+	return value !== void 0 && value !== "" && value !== "0";
+}
+/** All three streams, so neither a redirected report nor a piped-in script gets an update. */
+function ownsTerminal(request) {
+	return isTerminal(request.stdin) && isTerminal(request.stdout) && isTerminal(request.stderr);
+}
+/**
+* Whether the path is a regular file the installer can rename over.
+*
+* `lstat` rather than `stat`: a symlink means some other installation — a package manager's shim,
+* a version manager's current-release pointer — owns this name, and replacing the link would
+* either detach it from its manager or write through it into a directory Aura does not own.
+*/
+async function isReplaceableFile(path) {
+	try {
+		return (await lstat(path)).isFile();
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region src/update/lock.ts
+/**
+* Takes the per-executable update lock, or gives up.
+*
+* Exclusive creation is the whole mechanism: two updaters racing on the same executable both call
+* `open(…, "wx")` and exactly one succeeds. Losing is not an error — the other process is already
+* installing the same release, and the command the user asked for runs either way.
+*/
+async function acquireUpdateLock(request) {
+	const attempt = await claim(request);
+	if (attempt.kind !== "held") return attempt;
+	return await reclaimStale(request) ? claim(request) : attempt;
+}
+async function claim(request) {
+	const token = randomUUID();
+	try {
+		const handle = await open(request.lockPath, "wx", 384);
+		try {
+			await handle.write(JSON.stringify({
+				pid: request.host.pid,
+				startedAt: request.now,
+				token
+			}));
+		} finally {
+			await handle.close();
+		}
+		return {
+			kind: "acquired",
+			lock: { release: () => removeOwned(request.lockPath, token) }
+		};
+	} catch (error) {
+		return { kind: error instanceof Error && "code" in error && error.code === "EEXIST" ? "held" : "unavailable" };
+	}
+}
+/**
+* Removes a lock whose owner is gone.
+*
+* Both conditions are required. Age alone would break a slow but healthy download on a thin
+* connection; a missing process alone would race a holder that has not written its record yet.
+* An unreadable or malformed lock counts as expired once it is old enough — nothing that can be
+* asked about it will ever answer.
+*/
+async function reclaimStale(request) {
+	const contents = await read(request.lockPath);
+	const record = asRecord(parseJson(contents));
+	const startedAt = asSize(record?.["startedAt"], Number.MAX_SAFE_INTEGER) ?? await modifiedAt(request.lockPath);
+	if (startedAt === void 0 || request.now - startedAt < 6e5) return false;
+	const pid = asSize(record?.["pid"], Number.MAX_SAFE_INTEGER);
+	if (pid !== void 0 && request.host.isProcessAlive(pid)) return false;
+	return await removeUnchanged(request.lockPath, contents);
+}
+/**
+* When the lock file was last written, used when its contents cannot say.
+*
+* An updater killed between creating the lock and writing its record leaves a file that names no
+* process. Without this fallback that file would block every future update on the machine.
+*/
+async function modifiedAt(path) {
+	try {
+		return (await stat(path)).mtimeMs;
+	} catch {
+		return;
+	}
+}
+async function read(path) {
+	try {
+		return await readFile(path, "utf8");
+	} catch {
+		return "";
+	}
+}
+async function remove(path) {
+	try {
+		await unlink(path);
+	} catch {}
+}
+/** Removes a stale lock only while it is still the exact record that was inspected. */
+async function removeUnchanged(path, expected) {
+	const reclaimPath = `${path}.reclaim-${createHash("sha256").update(expected, "utf8").digest("hex").slice(0, 16)}`;
+	try {
+		await link(path, reclaimPath);
+	} catch {
+		return false;
+	}
+	try {
+		if (await read(reclaimPath) !== expected || await read(path) !== expected) return false;
+		await unlink(path);
+		return true;
+	} catch {
+		return false;
+	} finally {
+		await remove(reclaimPath);
+	}
+}
+/** A holder must never unlink a successor that reused the same path. */
+async function removeOwned(path, token) {
+	if (asRecord(parseJson(await read(path)))?.["token"] === token) await remove(path);
+}
+//#endregion
+//#region src/update/tar-header.ts
+const NAME = {
+	length: 100,
+	offset: 0
+};
+const SIZE = {
+	length: 12,
+	offset: 124
+};
+const CHECKSUM = {
+	length: 8,
+	offset: 148
+};
+const TYPEFLAG_OFFSET = 156;
+const PREFIX = {
+	length: 155,
+	offset: 345
+};
+/** Type flags for a plain file. `0` is ustar; NUL is the historic spelling of the same thing. */
+const REGULAR_TYPES = /* @__PURE__ */ new Set(["0", "\0"]);
+/** Whether a block is all zeroes, which is how a tar announces its own end. */
+function isZeroBlock(block) {
+	return block.every((byte) => byte === 0);
+}
+/**
+* One header, or `undefined` for any block this extractor refuses to act on.
+*
+* Refusal is deliberately undifferentiated: the caller aborts the whole archive either way, and a
+* reason string would only invite someone to relax a specific case later.
+*/
+function parseTarHeader(block) {
+	if (!hasValidChecksum(block)) return;
+	if (!REGULAR_TYPES.has(String.fromCharCode(block[TYPEFLAG_OFFSET] ?? 0))) return;
+	const size = parseOctal(block, SIZE);
+	const name = entryName(block);
+	return size === void 0 || name === void 0 ? void 0 : {
+		name,
+		size
+	};
+}
+/**
+* The entry path, refused unless it is a plain relative name.
+*
+* Absolute paths, parent traversal, and Windows separators are all ways to make an extraction land
+* somewhere the caller did not choose, and none of them appear in an archive this project builds.
+*/
+function entryName(block) {
+	const prefix = readString(block, PREFIX);
+	const base = readString(block, NAME);
+	if (base === "") return;
+	const joined = prefix === "" ? base : `${prefix}/${base}`;
+	const normalized = joined.startsWith("./") ? joined.slice(2) : joined;
+	const segments = normalized.split("/");
+	if (normalized.startsWith("/") || normalized.includes("\\")) return;
+	return segments.some((segment) => segment === ".." || segment === "") ? void 0 : normalized;
+}
+/**
+* The header checksum, which every tar writer sets and every reader is expected to verify.
+*
+* Checked here because it is the cheapest way to notice that the stream has drifted out of block
+* alignment — a state in which arbitrary payload bytes would otherwise be read as a header.
+*/
+function hasValidChecksum(block) {
+	const declared = parseOctal(block, CHECKSUM);
+	if (declared === void 0) return false;
+	let sum = 0;
+	for (const [index, byte] of block.entries()) {
+		const inChecksum = index >= CHECKSUM.offset && index < CHECKSUM.offset + CHECKSUM.length;
+		sum += inChecksum ? 32 : byte;
+	}
+	return sum === declared;
+}
+/**
+* A NUL- or space-terminated octal field.
+*
+* Base-256 encoded fields — the GNU extension for sizes beyond 8 GiB — are refused rather than
+* decoded: nothing this extracts is that large, and the size field is what bounds the write.
+*/
+function parseOctal(block, field) {
+	if ((block.subarray(field.offset, field.offset + field.length)[0] ?? 0) & 128) return;
+	const text = readString(block, field).trim();
+	if (text === "") return 0;
+	if (!/^[0-7]+$/u.test(text)) return;
+	const value = Number.parseInt(text, 8);
+	return Number.isSafeInteger(value) && value >= 0 ? value : void 0;
+}
+function readString(block, field) {
+	const bytes = block.subarray(field.offset, field.offset + field.length);
+	const end = bytes.indexOf(0);
+	return new TextDecoder().decode(end === -1 ? bytes : bytes.subarray(0, end)).replace(/\0+$/u, "");
+}
+//#endregion
+//#region src/update/archive.ts
+/**
+* Extracts the expected files from a gzip tar, and refuses everything else.
+*
+* Allow-listed by name rather than filtered after the fact: the extractor never creates a path the
+* caller did not name, so no header field — however hostile — can decide where a byte lands.
+*/
+async function extractArchive(request) {
+	const extractor = new TarExtractor(request);
+	const source = createReadStream(request.archivePath);
+	try {
+		for await (const chunk of source.pipe(createGunzip())) {
+			if (!(chunk instanceof Uint8Array)) return "unreadable-archive";
+			extractor.push(chunk);
+			await extractor.drain();
+			if (extractor.failure !== void 0) return extractor.failure;
+			if (extractor.done) break;
+		}
+	} catch {
+		return "unreadable-archive";
+	} finally {
+		source.destroy();
+		await extractor.close();
+	}
+	return extractor.failure ?? (extractor.extracted(request.requiredEntry) ? void 0 : "missing-executable");
+}
+/** A tar reader that consumes a byte stream one 512-byte block at a time. */
+var TarExtractor = class {
+	failure;
+	#request;
+	#seen = /* @__PURE__ */ new Set();
+	#chunks = [];
+	#queued = 0;
+	#state = "header";
+	#remaining = 0;
+	#padding = 0;
+	#pending;
+	#sink;
+	#written = 0;
+	#zeroBlocks = 0;
+	#done = false;
+	constructor(request) {
+		this.#request = request;
+	}
+	push(chunk) {
+		this.#chunks.push(chunk);
+		this.#queued += chunk.byteLength;
+	}
+	extracted(name) {
+		return this.#seen.has(name);
+	}
+	get done() {
+		return this.#done;
+	}
+	/** Consumes as much of the queue as the current state allows, then waits for more bytes. */
+	async drain() {
+		while (this.failure === void 0 && !this.#done) if (!(this.#state === "header" ? await this.#readHeader() : this.#state === "body" ? await this.#readBody() : await this.#endEntry())) return;
+	}
+	async close() {
+		const sink = this.#sink;
+		this.#sink = void 0;
+		this.#pending = void 0;
+		this.#chunks = [];
+		this.#queued = 0;
+		try {
+			await sink?.close();
+		} catch {}
+	}
+	async #readHeader() {
+		const block = this.#take(512);
+		if (block === void 0) return false;
+		if (isZeroBlock(block)) {
+			this.#zeroBlocks += 1;
+			this.#done = this.#zeroBlocks === 2;
+			return true;
+		}
+		this.#zeroBlocks = 0;
+		const entry = parseTarHeader(block);
+		if (entry === void 0) {
+			this.failure = "unexpected-entry";
+			return false;
+		}
+		return await this.#openEntry(entry.name, entry.size);
+	}
+	async #openEntry(name, size) {
+		const destination = this.#request.entries[name];
+		if (destination === void 0 || this.#seen.has(name)) {
+			this.failure = "unexpected-entry";
+			return false;
+		}
+		this.#written += size;
+		if (this.#written > this.#request.maxBytes) {
+			this.failure = "too-large";
+			return false;
+		}
+		this.#pending = name;
+		this.#sink = await open(destination, "wx", 384);
+		this.#remaining = size;
+		this.#padding = (512 - size % 512) % 512;
+		this.#state = size > 0 ? "body" : "padding";
+		return true;
+	}
+	/**
+	* Writes body bytes straight out of the queue.
+	*
+	* Deliberately not routed through {@link TarExtractor.#take}: gathering a contiguous buffer first
+	* would copy the whole executable an extra time on its way to disk, and nothing here needs the
+	* bytes in hand. Only headers and padding, which are one block at a time, do.
+	*/
+	async #readBody() {
+		const count = Math.min(this.#remaining, this.#queued);
+		if (count === 0) return false;
+		let written = 0;
+		while (written < count) {
+			const slice = this.#shift(count - written);
+			if (slice === void 0) return false;
+			written += slice.byteLength;
+			await this.#sink?.write(slice);
+		}
+		this.#remaining -= count;
+		if (this.#remaining === 0) this.#state = "padding";
+		return true;
+	}
+	async #endEntry() {
+		if (this.#padding > 0) {
+			if (this.#take(this.#padding) === void 0) return false;
+			this.#padding = 0;
+		}
+		const sink = this.#sink;
+		this.#sink = void 0;
+		await sink?.sync();
+		await sink?.close();
+		if (this.#pending !== void 0) {
+			this.#seen.add(this.#pending);
+			this.#pending = void 0;
+		}
+		this.#state = "header";
+		return true;
+	}
+	/** Up to `limit` bytes off the front of the queue, without copying them. */
+	#shift(limit) {
+		const chunk = this.#chunks[0];
+		if (chunk === void 0) return;
+		if (chunk.byteLength <= limit) {
+			this.#chunks.shift();
+			this.#queued -= chunk.byteLength;
+			return chunk;
+		}
+		this.#chunks[0] = chunk.subarray(limit);
+		this.#queued -= limit;
+		return chunk.subarray(0, limit);
+	}
+	/** Exactly `count` bytes off the front of the queue, or `undefined` until they have arrived. */
+	#take(count) {
+		if (this.#queued < count) return;
+		const out = new Uint8Array(count);
+		let offset = 0;
+		while (offset < count) {
+			const chunk = this.#chunks[0];
+			if (chunk === void 0) return;
+			const needed = count - offset;
+			if (chunk.byteLength <= needed) {
+				out.set(chunk, offset);
+				offset += chunk.byteLength;
+				this.#chunks.shift();
+			} else {
+				out.set(chunk.subarray(0, needed), offset);
+				offset += needed;
+				this.#chunks[0] = chunk.subarray(needed);
+			}
+		}
+		this.#queued -= count;
+		return out;
+	}
+};
+//#endregion
+//#region src/update/stage.ts
+/**
+* Turns a validated candidate into a verified executable sitting next to the installed one.
+*
+* Nothing here touches the installed binary. Every failure leaves temporary files for the caller
+* to remove and the running installation exactly as it was — which is the property that makes an
+* update safe to attempt on every startup.
+*/
+async function stageExecutable(request) {
+	const download = await request.host.download({
+		destinationPath: request.archivePath,
+		expectedBytes: request.candidate.size,
+		headers: request.downloadHeaders,
+		...request.onProgress === void 0 ? {} : { onProgress: request.onProgress },
+		timeoutMs: request.downloadTimeoutMs,
+		url: request.candidate.downloadUrl
+	});
+	if (download.kind !== "downloaded") return `download-${download.reason}`;
+	if (download.sha256 !== request.candidate.sha256) return "digest";
+	const archive = await extract(request);
+	if (archive !== void 0) return archive;
+	return await verifyStaged(request);
+}
+function extract(request) {
+	return extractArchive({
+		archivePath: request.archivePath,
+		entries: {
+			LICENSE: request.licensePath,
+			[request.entryName]: request.stagedPath
+		},
+		maxBytes: MAX_EXTRACTED_BYTES,
+		requiredEntry: request.entryName
+	});
+}
+/**
+* Proves the staged file is an executable that agrees about which version it is.
+*
+* This is the last gate before anything irreversible. A digest proves the bytes match a published
+* release; running the program proves the release is the one the metadata named, that it starts on
+* this machine at all, and that its architecture is the one this process is running.
+*/
+async function verifyStaged(request) {
+	try {
+		await chmod(request.stagedPath, request.executableMode);
+		if (!(await lstat(request.stagedPath)).isFile()) return "staged-version";
+	} catch {
+		return "staged-version";
+	}
+	return await request.host.probeVersion(request.stagedPath, request.probeEnvironment) === request.candidate.version ? void 0 : "staged-version";
+}
+//#endregion
+//#region src/update/install.ts
+/**
+* Replaces the running distribution's executable with a newer release, or changes nothing.
+*
+* The transaction is ordered so the installed executable is only ever touched by two renames, both
+* within one directory: a recovery copy moves into place, then the verified staged file moves over
+* the original. A crash at any earlier point leaves temporary files and nothing else; a crash
+* between the two renames leaves a working binary and a copy of it.
+*/
+async function installUpdate(request) {
+	const directory = dirname(request.executablePath);
+	const attempt = await acquireUpdateLock({
+		host: request.host,
+		lockPath: `${request.executablePath}.update-lock`,
+		now: request.now
+	});
+	if (attempt.kind !== "acquired") return attempt.kind === "held" ? { kind: "skipped" } : {
+		kind: "failed",
+		reason: "lock-unavailable"
+	};
+	try {
+		return await transact(request, directory);
+	} catch {
+		return {
+			kind: "failed",
+			reason: "replace-failed"
+		};
+	} finally {
+		await attempt.lock.release();
+	}
+}
+async function transact(request, directory) {
+	const installed = await request.host.probeVersion(request.executablePath, request.probeEnvironment);
+	if (installed !== void 0 && !isNewerVersion(request.candidate.version, installed)) return { kind: "skipped" };
+	const executableMode = await regularFileMode(request.executablePath);
+	if (executableMode === void 0) return {
+		kind: "failed",
+		reason: "not-a-regular-file"
+	};
+	const scratch = join(directory, `.${request.command}-${randomUUID()}`);
+	const paths = {
+		archive: `${scratch}.tar.gz`,
+		license: `${scratch}.LICENSE`,
+		previous: `${scratch}.previous`,
+		staged: `${scratch}.staged`
+	};
+	try {
+		const failure = await stageExecutable({
+			archivePath: paths.archive,
+			candidate: request.candidate,
+			downloadHeaders: request.downloadHeaders,
+			downloadTimeoutMs: request.downloadTimeoutMs,
+			entryName: request.command,
+			executableMode,
+			host: request.host,
+			licensePath: paths.license,
+			...request.onProgress === void 0 ? {} : { onProgress: request.onProgress },
+			probeEnvironment: request.probeEnvironment,
+			stagedPath: paths.staged
+		});
+		if (failure !== void 0) return failure === "digest" ? { kind: "refused" } : {
+			kind: "failed",
+			reason: failure
+		};
+		await swap(request, directory, paths);
+		return { kind: "installed" };
+	} finally {
+		await discard([
+			paths.archive,
+			paths.license,
+			paths.previous,
+			paths.staged
+		]);
+	}
+}
+/** The two renames, in the order that leaves something runnable at every point between them. */
+async function swap(request, directory, paths) {
+	await retainPrevious(request, paths.previous);
+	await rename(paths.staged, request.executablePath);
+	await replaceLicense(directory, paths.license);
+	await syncDirectory(directory);
+}
+/**
+* Keeps one recovery copy beside the installed binary.
+*
+* A hard link costs no space and no read of a hundred-megabyte file; a copy is the fallback for
+* filesystems that refuse links. The intermediate rename is what makes the copy appear whole: a
+* reader either sees the previous `.previous` or the new one, never a partially written file.
+*/
+async function retainPrevious(request, temporary) {
+	try {
+		await link(request.executablePath, temporary);
+	} catch {
+		await copyFile(request.executablePath, temporary);
+	}
+	await rename(temporary, `${request.executablePath}.previous`);
+}
+/**
+* Updates the license text only where the installation already keeps one.
+*
+* Replacing a file the original install wrote is maintenance; creating one it never wrote would
+* put an unexpected file into a directory Aura shares with whatever else lives on the user's path.
+*/
+async function replaceLicense(directory, staged) {
+	const installed = join(directory, "LICENSE");
+	const mode = await regularFileMode(installed);
+	if (mode === void 0 || !await isRegularFile(staged)) return;
+	await chmod(staged, mode);
+	await rename(staged, installed);
+}
+/**
+* Flushes the directory entry itself where the platform supports it.
+*
+* Without this the renames can still be in the filesystem's own buffers after the process exits;
+* a power loss then leaves a directory that lists neither the old name nor the new one.
+*/
+async function syncDirectory(directory) {
+	try {
+		const handle = await open(directory, "r");
+		try {
+			await handle.sync();
+		} finally {
+			await handle.close();
+		}
+	} catch {}
+}
+async function isRegularFile(path) {
+	return await regularFileMode(path) !== void 0;
+}
+async function regularFileMode(path) {
+	try {
+		const status = await lstat(path);
+		return status.isFile() ? status.mode & 511 : void 0;
+	} catch {
+		return;
+	}
+}
+async function discard(paths) {
+	for (const path of paths) try {
+		await rm(path, { force: true });
+	} catch {}
+}
+//#endregion
+//#region src/update/metadata.ts
+/**
+* Fetches one release-metadata document under the shared caps.
+*
+* Both providers ask the same questions of a response — did it arrive, is it a 304, is it a 200 —
+* and both must answer a credential-bearing request without letting the reason travel with the
+* result. Keeping that in one place is what stops the two from drifting apart.
+*/
+async function fetchMetadata(query, options) {
+	const response = await query.httpGet({
+		headers: {
+			accept: options.accept,
+			"user-agent": query.userAgent,
+			...options.headers,
+			...query.etag === void 0 ? {} : { "if-none-match": query.etag }
+		},
+		maxResponseBytes: MAX_METADATA_BYTES,
+		timeoutMs: METADATA_TIMEOUT_MS,
+		url: options.url
+	});
+	if (response.kind !== "response") return { kind: "failure" };
+	if (response.status === 304) return { kind: "unchanged" };
+	if (response.status !== 200) return { kind: "failure" };
+	return {
+		body: response.body,
+		...response.etag === void 0 ? {} : { etag: response.etag },
+		kind: "body"
+	};
+}
+/**
+* The `Authorization` header for a configured credential, or no header at all.
+*
+* Built at the call site and never stored: the value leaves scope with the request it authorizes.
+*/
+function bearer(token) {
+	return token === void 0 ? {} : { authorization: `Bearer ${token}` };
+}
+/** Headers the archive download carries. Rebuilt per lookup, so nothing cached holds a secret. */
+function downloadHeaders(token) {
+	return {
+		accept: "application/octet-stream",
+		...bearer(token)
+	};
+}
+function compareRelease(version, current) {
+	if (version === void 0 || !isInstallableVersion(version)) return { kind: "invalid" };
+	return isNewerVersion(version, current) ? {
+		kind: "newer",
+		version
+	} : { kind: "current" };
+}
+/** An entity tag as an optional field, so absence stays absent rather than `undefined`-valued. */
+function etagField(etag) {
+	return etag === void 0 ? {} : { etag };
+}
+/** Reads a source's configured credential, when it names one. */
+function sourceToken(query, tokenEnvironmentVariable) {
+	return tokenEnvironmentVariable === void 0 ? void 0 : query.readVariable(tokenEnvironmentVariable);
+}
+//#endregion
+//#region src/update/github-release.ts
+const PUBLIC_API_BASE_URL = "https://api.github.com";
+const PUBLIC_API_HOST = "api.github.com";
+const PUBLIC_WEB_ORIGIN = "https://github.com";
+/**
+* REST API version this provider is written against.
+*
+* Pinned rather than omitted: the response fields the trust decision rests on — `immutable` and
+* the per-asset `digest` — are the ones a future default version could reshape.
+*/
+const GITHUB_API_VERSION = "2026-03-10";
+/**
+* Resolves the latest release of one GitHub or GitHub Enterprise Server repository.
+*
+* The trust boundary is the API's TLS connection plus immutable releases: one authenticated
+* document supplies the version, the asset, and the digest together, so there is no second
+* endpoint, moving URL, or long-lived signing key to defend.
+*/
+async function resolveGitHubRelease(source, query) {
+	const baseUrl = source.apiBaseUrl ?? PUBLIC_API_BASE_URL;
+	if (parseUrl(baseUrl) === void 0) return {
+		kind: "failure",
+		reason: "invalid-release"
+	};
+	const token = sourceToken(query, source.tokenEnvironmentVariable);
+	const response = await fetchMetadata(query, {
+		accept: "application/vnd.github+json",
+		headers: {
+			...bearer(token),
+			"x-github-api-version": GITHUB_API_VERSION
+		},
+		url: `${trimSlash(baseUrl)}/repos/${source.owner}/${source.repository}/releases/latest`
+	});
+	if (response.kind !== "body") return response.kind === "unchanged" ? {
+		etag: query.etag,
+		kind: "current"
+	} : {
+		kind: "failure",
+		reason: "network"
+	};
+	return narrowRelease(source, query, parseJson(response.body), response.etag, token);
+}
+/** Turns the response body into a candidate, refusing every release that is not exactly usable. */
+function narrowRelease(source, query, document, etag, token) {
+	const release = asRecord(document);
+	if (release === void 0 || !isPublished(release)) return {
+		kind: "failure",
+		reason: "invalid-release"
+	};
+	if (asFlag(release["immutable"]) !== true) return {
+		kind: "failure",
+		reason: "untrusted-release"
+	};
+	const tag = asText(release["tag_name"]) ?? "";
+	const verdict = compareRelease(releaseVersion(tag), query.version);
+	if (verdict.kind !== "newer") return verdict.kind === "current" ? {
+		kind: "current",
+		...etagField(etag)
+	} : {
+		kind: "failure",
+		reason: "invalid-release"
+	};
+	const asset = selectAsset(source, release["assets"], assetName(query), tag);
+	return asset === void 0 ? {
+		kind: "failure",
+		reason: "invalid-release"
+	} : candidate$1(asset, verdict.version, etag, token);
+}
+/**
+* Whether the release is a published, final one.
+*
+* Absent reads as unusable rather than as `false`: a server that stopped reporting draft state must
+* not have every draft silently promoted to installable.
+*/
+function isPublished(release) {
+	return asFlag(release["draft"]) === false && asFlag(release["prerelease"]) === false;
+}
+/** The version a `v`-prefixed tag names, or `undefined` for any other tag shape. */
+function releaseVersion(tag) {
+	return tag.startsWith("v") ? tag.slice(1) : void 0;
+}
+/** The archive name a release must publish for this target, and the only one accepted. */
+function assetName(query) {
+	return `${query.command}-${query.target}.tar.gz`;
+}
+/**
+* The candidate, downloading through the API when a token is configured.
+*
+* A private repository serves assets only from the API URL with an octet-stream `Accept`, which
+* answers with the bytes or with a redirect to a temporary signed URL. Public releases keep the
+* plain browser URL so an unauthenticated download stays unauthenticated.
+*/
+function candidate$1(asset, version, etag, token) {
+	return {
+		candidate: {
+			downloadUrl: token === void 0 ? asset.browserUrl : asset.apiUrl,
+			sha256: asset.sha256,
+			size: asset.size,
+			version
+		},
+		downloadHeaders: downloadHeaders(token),
+		kind: "candidate",
+		...etagField(etag)
+	};
+}
+/** Selects exactly one target asset and narrows every field the download depends on. */
+function selectAsset(source, assets, expectedName, tag) {
+	const entries = asArray(assets);
+	if (entries === void 0) return;
+	const matches = entries.map((entry) => asRecord(entry)).filter((entry) => entry !== void 0 && asText(entry["name"]) === expectedName);
+	if (matches.length !== 1) return;
+	return narrowAsset(source, matches[0], expectedName, tag);
+}
+function narrowAsset(source, asset, expectedName, tag) {
+	if (asset === void 0) return;
+	const size = asSize(asset["size"], MAX_ARCHIVE_BYTES);
+	const sha256 = asGitHubDigest(asset["digest"]);
+	const browserUrl = asText(asset["browser_download_url"]);
+	const apiUrl = asText(asset["url"]);
+	if (size === void 0 || sha256 === void 0 || browserUrl === void 0) return;
+	if (apiUrl === void 0 || !isExpectedApiUrl(source, apiUrl)) return;
+	if (browserUrl !== expectedBrowserUrl(source, tag, expectedName)) return;
+	return {
+		apiUrl,
+		browserUrl,
+		sha256,
+		size
+	};
+}
+function expectedBrowserUrl(source, tag, name) {
+	return `${webOrigin(source)}/${source.owner}/${source.repository}/releases/download/${tag}/${name}`;
+}
+function isExpectedApiUrl(source, apiUrl) {
+	const prefix = `${trimSlash(source.apiBaseUrl ?? PUBLIC_API_BASE_URL)}/repos/${source.owner}/${source.repository}/releases/assets/`;
+	return apiUrl.startsWith(prefix) && /^[0-9]+$/u.test(apiUrl.slice(prefix.length));
+}
+function webOrigin(source) {
+	const url = parseUrl(source.apiBaseUrl ?? PUBLIC_API_BASE_URL);
+	if (url === void 0) return PUBLIC_WEB_ORIGIN;
+	return url.hostname === PUBLIC_API_HOST ? PUBLIC_WEB_ORIGIN : url.origin;
+}
+function parseUrl(raw) {
+	try {
+		const url = new URL(raw);
+		return url.username === "" && url.password === "" ? url : void 0;
+	} catch {
+		return;
+	}
+}
+function trimSlash(value) {
+	return value.replace(/\/+$/u, "");
+}
+//#endregion
+//#region src/update/signed-manifest.ts
+const ED25519_SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
+const ED25519_KEY_BYTES = 32;
+const ED25519_SIGNATURE_BYTES = 64;
+const BASE64URL_PATTERN = /^[A-Za-z0-9_-]+={0,2}$/u;
+/**
+* Resolves a release from one signed HTTPS manifest.
+*
+* For deployments a GitHub-shaped provider cannot serve honestly — an internal artifact service, or
+* a GitHub Enterprise Server without immutable releases and per-asset digests. The trust boundary
+* moves from the transport to the signature, so the manifest URL itself may be a stable "latest"
+* reference while every asset URL inside it stays pinned to the version it names.
+*/
+async function resolveSignedManifest(source, query) {
+	const token = sourceToken(query, source.tokenEnvironmentVariable);
+	const response = await fetchMetadata(query, {
+		accept: "application/json",
+		headers: bearer(token),
+		url: source.manifestUrl
+	});
+	if (response.kind !== "body") return response.kind === "unchanged" ? {
+		etag: query.etag,
+		kind: "current"
+	} : {
+		kind: "failure",
+		reason: "network"
+	};
+	return narrowManifest(source, query, response.body, response.etag, token);
+}
+function narrowManifest(source, query, body, etag, token) {
+	const payload = verifyEnvelope(parseJson(body), source.trustedPublicKeys);
+	if (payload === void 0) return {
+		kind: "failure",
+		reason: "untrusted-release"
+	};
+	const document = asRecord(parseJson(payload));
+	if (!isFresh(document?.["expiresAt"], query.now)) return {
+		kind: "failure",
+		reason: "stale-manifest"
+	};
+	const verdict = compareRelease(asText(document?.["version"]), query.version);
+	if (verdict.kind !== "newer") return verdict.kind === "current" ? {
+		kind: "current",
+		...etagField(etag)
+	} : {
+		kind: "failure",
+		reason: "invalid-release"
+	};
+	return candidate(source, query, document?.["assets"], verdict.version, etag, token);
+}
+/** The resolved release, with the credential attached only where it is the caller's to send. */
+function candidate(source, query, assets, version, etag, token) {
+	const archive = manifestAsset(assets, query.target, version);
+	if (archive === void 0) return {
+		kind: "failure",
+		reason: "invalid-release"
+	};
+	return {
+		candidate: {
+			...archive,
+			version
+		},
+		downloadHeaders: downloadHeaders(sameOrigin(source.manifestUrl, archive.downloadUrl) ? token : void 0),
+		kind: "candidate",
+		...etagField(etag)
+	};
+}
+/**
+* Whether a signed manifest is still within the window it signed for.
+*
+* Required, not optional: a publisher who omits the field would otherwise get a document that is
+* valid forever, which is exactly the one an attacker wants to keep replaying. Epoch milliseconds
+* rather than a formatted timestamp, so reading it needs no clock, locale, or calendar.
+*/
+function isFresh(expiresAt, now) {
+	const expiry = asSize(expiresAt, Number.MAX_SAFE_INTEGER);
+	if (expiry === void 0 || expiry <= now) return false;
+	return expiry - now <= MAX_MANIFEST_FRESHNESS_MS;
+}
+function sameOrigin(left, right) {
+	try {
+		return new URL(left).origin === new URL(right).origin;
+	} catch {
+		return false;
+	}
+}
+/** Returns the payload only when one trusted key verifies its exact bytes. */
+function verifyEnvelope(envelope, trustedPublicKeys) {
+	const document = asRecord(envelope);
+	if (document === void 0 || document["schemaVersion"] !== 1) return;
+	const payload = decodeBase64Url(asText(document["payload"]));
+	const signature = decodeBase64Url(asText(document["signature"]));
+	if (payload === void 0 || signature?.byteLength !== ED25519_SIGNATURE_BYTES) return;
+	return trustedPublicKeys.map((key) => publicKey(key)).some((key) => key !== void 0 && verifySignature(key, payload, signature)) ? payload.toString("utf8") : void 0;
+}
+function manifestAsset(assets, target, version) {
+	const entry = asRecord(asRecord(assets)?.[target]);
+	const downloadUrl = asText(entry?.["downloadUrl"]);
+	const sha256 = asDigest(entry?.["sha256"]);
+	const size = asSize(entry?.["size"], MAX_ARCHIVE_BYTES);
+	if (downloadUrl === void 0 || sha256 === void 0 || size === void 0) return;
+	return isPinnedUrl(downloadUrl, version) ? {
+		downloadUrl,
+		sha256,
+		size
+	} : void 0;
+}
+function isPinnedUrl(raw, version) {
+	try {
+		const url = new URL(raw);
+		return isAllowedHttpUrl(url) && `${url.pathname}${url.search}`.includes(version);
+	} catch {
+		return false;
+	}
+}
+function verifySignature(key, payload, signature) {
+	try {
+		return verify(null, payload, key, signature);
+	} catch {
+		return false;
+	}
+}
+function publicKey(encoded) {
+	const raw = Buffer.from(encoded, "base64");
+	if (raw.byteLength !== ED25519_KEY_BYTES) return;
+	try {
+		return createPublicKey({
+			format: "der",
+			key: Buffer.concat([ED25519_SPKI_PREFIX, raw]),
+			type: "spki"
+		});
+	} catch {
+		return;
+	}
+}
+function decodeBase64Url(value) {
+	return value === void 0 || !BASE64URL_PATTERN.test(value) ? void 0 : Buffer.from(value, "base64url");
+}
+//#endregion
+//#region src/update/provider.ts
+/** Turns one distribution-specific source into a validated candidate. */
+function resolveUpdateSource(source, query) {
+	return source.kind === "github-release" ? resolveGitHubRelease(source, query) : resolveSignedManifest(source, query);
+}
+/**
+* The cache key one source's metadata is stored under.
+*
+* Includes every build-time field that changes lookup or trust and never includes a credential
+* value. The complete manifest URL and trusted keys ensure either change selects a new cache entry.
+*/
+function sourceIdentity(source, command) {
+	if (source.kind === "github-release") return JSON.stringify([
+		"github-release",
+		source.apiBaseUrl ?? "https://api.github.com",
+		source.owner,
+		source.repository,
+		source.tokenEnvironmentVariable ?? "",
+		command
+	]);
+	return JSON.stringify([
+		"signed-manifest",
+		source.manifestUrl,
+		source.tokenEnvironmentVariable ?? "",
+		source.trustedPublicKeys,
+		command
+	]);
+}
+//#endregion
+//#region src/update/run.ts
+/**
+* Installs a newer release before the requested command runs, or does nothing at all.
+*
+* Nothing here can change what the command does or what it exits with. Every failure path is
+* swallowed: the user asked Aura to check a repository, and an update that could not happen is not
+* a reason to refuse. The successfully updated executable is used by the next invocation — this
+* process keeps running the image it started with.
+*
+* Swallowed for the user, not for the developer: each refusal names itself through {@link debug},
+* which writes only when this distribution's debug variable asks it to.
+*/
+async function runStartupUpdate(request) {
+	const disableEnvironmentVariable = updateEnvironmentVariable(request.branding.command);
+	const debug = createUpdateDebug(disableEnvironmentVariable, request.environmentVariables, request.stderr);
+	try {
+		const verdict = await eligibleInstallation({
+			...request,
+			disableEnvironmentVariable,
+			version: request.branding.version
+		});
+		if (verdict.kind !== "eligible") {
+			debug(`skipped: ${verdict.reason}`);
+			return;
+		}
+		await check(request, verdict.installation, debug);
+	} catch {
+		debug("skipped: unexpected-error");
+	}
+}
+async function check(request, eligible, debug) {
+	const now = request.now().getTime();
+	const identity = sourceIdentity(request.updates, request.branding.command);
+	const entry = await readUpdateCache(request.homeDir, identity, now);
+	if (!shouldCheck(entry, now)) {
+		debug(`skipped: cached-${entry?.outcome ?? "check"}`);
+		return;
+	}
+	const resolution = await resolveUpdateSource(request.updates, {
+		command: request.branding.command,
+		...entry?.outcome === "current" && entry.etag !== void 0 ? { etag: entry.etag } : {},
+		httpGet: request.httpGet,
+		now,
+		readVariable: (name) => readVariable(request.environmentVariables, name),
+		target: eligible.target,
+		userAgent: `${request.branding.command}/${eligible.version}`,
+		version: eligible.version
+	});
+	debug(resolution.kind === "failure" ? `resolved: ${resolution.reason}` : `resolved: ${resolution.kind}`);
+	await apply(request, eligible, {
+		deadline: now + STARTUP_UPDATE_BUDGET_MS,
+		debug,
+		entry,
+		identity,
+		now,
+		resolution
+	});
+}
+async function apply(request, eligible, context) {
+	const { entry, identity, now, resolution } = context;
+	if (resolution.kind === "failure") {
+		await writeUpdateCache(request.homeDir, identity, {
+			checkedAt: now,
+			outcome: "check-failed"
+		});
+		return;
+	}
+	if (resolution.kind !== "candidate") {
+		const etag = resolution.kind === "current" ? resolution.etag ?? entry?.etag : entry?.etag;
+		await writeUpdateCache(request.homeDir, identity, {
+			checkedAt: now,
+			...etag === void 0 ? {} : { etag },
+			outcome: "current"
+		});
+		return;
+	}
+	const outcome = await install(request, eligible, resolution, context);
+	context.debug(`installed: ${trace(outcome)}`);
+	report(request, eligible, resolution.candidate.version, outcome);
+	await record(request, identity, now, resolution, outcome, attemptsFor(entry, resolution.candidate.version));
+}
+/** The transaction, with the progress frame painted around it and always taken back down. */
+async function install(request, eligible, resolution, context) {
+	const { candidate } = resolution;
+	request.stderr.write(updatingLine(request.branding, eligible.version, candidate.version));
+	const progress = startUpdateProgress(request.stderr);
+	try {
+		return await installUpdate({
+			candidate,
+			command: request.branding.command,
+			downloadHeaders: resolution.downloadHeaders,
+			downloadTimeoutMs: Math.max(0, context.deadline - request.now().getTime()),
+			executablePath: eligible.executablePath,
+			host: request.host,
+			now: context.now,
+			...progress.report === void 0 ? {} : { onProgress: progress.report },
+			probeEnvironment: probeEnvironment(request)
+		});
+	} finally {
+		progress.close();
+	}
+}
+/** The debug trace for one outcome, which is the only place a failure names its reason. */
+function trace(outcome) {
+	return outcome.kind === "failed" ? `failed: ${outcome.reason}` : outcome.kind;
+}
+/** One line, or none: the outcome table's message column. */
+function report(request, eligible, version, outcome) {
+	if (outcome.kind === "installed") {
+		request.stderr.write(updatedLine(request.branding, version));
+		return;
+	}
+	if (outcome.kind === "refused") {
+		request.stderr.write(digestRefusedLine(request.branding, version));
+		return;
+	}
+	if (outcome.kind === "failed") {
+		const manual = request.updates.manualUpdateUrl ?? request.branding.docsUrl;
+		request.stderr.write(installFailedLine(request.branding, version, manual));
+	}
+}
+/** Stores what happened, so a release that will not install is not retried on every command. */
+function record(request, identity, now, resolution, outcome, attempts) {
+	if (outcome.kind === "installed" || outcome.kind === "skipped") return writeUpdateCache(request.homeDir, identity, {
+		checkedAt: now,
+		outcome: "current"
+	});
+	return writeUpdateCache(request.homeDir, identity, {
+		checkedAt: now,
+		...resolution.etag === void 0 ? {} : { etag: resolution.etag },
+		failedAttempts: attempts + 1,
+		failedVersion: resolution.candidate.version,
+		outcome: "install-failed"
+	});
+}
+/**
+* The environment a version probe runs in.
+*
+* Deliberately tiny, and deliberately carrying this distribution's own disable variable: the
+* installer verifies a staged binary by running it, and a child that started an update of its own
+* would recurse into the directory its parent is mid-transaction on.
+*/
+function probeEnvironment(request) {
+	const home = request.environmentVariables["HOME"];
+	const path = request.environmentVariables["PATH"];
+	return {
+		...home === void 0 ? {} : { HOME: home },
+		...path === void 0 ? {} : { PATH: path },
+		NO_COLOR: "1",
+		[updateEnvironmentVariable(request.branding.command)]: "off"
+	};
+}
+/** Reads one variable at the moment of use, treating an empty value as unset. */
+function readVariable(environmentVariables, name) {
+	const value = environmentVariables[name];
+	return value === void 0 || value === "" ? void 0 : value;
+}
+function updatingLine(branding, from, to) {
+	return `Updating ${branding.displayName} ${from} -> ${to}...\n`;
+}
+function updatedLine(branding, to) {
+	return `Updated ${branding.displayName} to ${to}. The new version will be used on your next run.\n`;
+}
+function installFailedLine(branding, version, manualUpdateUrl) {
+	const suffix = manualUpdateUrl === void 0 ? "" : ` Update manually: ${manualUpdateUrl}`;
+	return `${branding.displayName} could not install the ${version} update.${suffix}\n`;
+}
+function digestRefusedLine(branding, version) {
+	return `${branding.displayName} refused the ${version} update: the download did not match the release's published SHA-256 digest. Nothing was installed.\n`;
+}
+//#endregion
+//#region src/run.boundary.ts
+/** Runs one build-time-composed Aura distribution. */
+function runCli(distro, runtime) {
+	return run(distro, runtime);
+}
+/** Runs a compiled standalone distribution that explicitly owns its executable. */
+function runStandaloneCli(distro, updates, current, runtime) {
+	return run(distro, runtime, {
+		current,
+		updates
+	});
+}
+async function run(distro, runtime, startupUpdate) {
+	const resolved = resolveRuntime(runtime, distro.branding);
+	const telemetry = createTelemetryRecorder({
+		distroVersion: distro.branding.version,
+		now: resolved.now,
+		sink: telemetryEnabled(resolved.environmentVariables) ? distro.telemetry : void 0
+	});
+	if (startupUpdate !== void 0) await runStartupUpdate({
+		argv: resolved.argv,
+		branding: distro.branding,
+		current: startupUpdate.current,
+		environmentVariables: resolved.environmentVariables,
+		homeDir: resolved.homeDir,
+		host: UPDATE_HOST,
+		httpGet: resolved.httpGet ?? createHttpGet(),
+		now: resolved.now,
+		stderr: resolved.stderr,
+		stdin: resolved.stdin,
+		stdout: resolved.stdout,
+		updates: startupUpdate.updates
 	});
 	const verdict = await runResolved(distro, resolved, telemetry);
 	await telemetry.flush();
@@ -18760,4 +20474,4 @@ function applyExitCode(exitCode, runtime) {
 	runtime.setExitCode(exitCode);
 }
 //#endregion
-export { vetHttpUrl as i, clampHttpTimeout as n, failureReason as r, runCli as t };
+export { vetHttpUrl as a, failureReason as i, runStandaloneCli as n, clampHttpTimeout as r, runCli as t };