fullcourtdefense-cli 1.36.3 → 1.37.0

package/dist/commands/watchdog.js

@@ -84,27 +84,39 @@ async function watchdogCommand(args, config) {
     // with the alive-marker freshness + a verdict-pipe probe.
     let health = state.alive ? 'healthy' : 'dead';
     if (state.alive && state.pid) {
+        const probe = await (0, verdictIpcClient_1.probeVerdictServerDetail)(1_500);
         health = (0, daemonForensics_1.classifyDaemonHealth)({
             pidAlive: true,
             pid: state.pid,
             marker: (0, daemonForensics_1.readAliveMarker)(),
             staleAfterMs: (0, daemonForensics_1.daemonHungAfterMs)(),
-            pipeProbe: await (0, verdictIpcClient_1.probeVerdictServer)(1_500),
+            pipeProbe: probe.result,
+            pipeAuthorized: probe.authorized,
             machineSuspended,
         });
     }
+    // The daemon repairs a replaced token itself within a minute (verdictIpc
+    // checkToken). Still rejecting hooks one tick later (>= 5 min): recycle it
+    // like a hung daemon so the restart publishes a fresh token.
+    const notServingTicks = (0, daemonForensics_1.recordNotServing)(health === 'not_serving' ? state.pid : undefined);
+    if (health === 'not_serving' && notServingTicks === 1) {
+        (0, distress_1.reportDistress)('watchdog', distress_1.DISTRESS.IPC_NOT_SERVING, `daemon pid ${state.pid} rejects this profile's verdict token (token file replaced) — waiting one tick for its self-repair`);
+    }
+    const recycleNotServing = health === 'not_serving' && notServingTicks >= 2;
     // An updater run is replacing the install: the daemon is down ON PURPOSE.
     // Reviving the old build now puts a second daemon (and its update kick)
     // in the middle of msiexec. Stand back; stage 2 relaunches the daemon when
     // it finishes, and a lock older than its max age no longer counts, so the
     // next tick revives normally if the run never completes.
     const updaterRun = (0, selfUpdate_1.readActiveUpdaterRun)();
-    if (health === 'hung' && state.pid && !updaterRun && process.env.FCD_WATCHDOG_NO_RELAUNCH !== '1') {
+    if ((health === 'hung' || recycleNotServing) && state.pid && !updaterRun && process.env.FCD_WATCHDOG_NO_RELAUNCH !== '1') {
         // Positive evidence this pid IS our daemon (it still owns the verdict
         // endpoint) and it is wedged — recycle it so the relaunch below starts
         // clean. The distress ledger survives; the fresh daemon's first heartbeat
         // ships the story to the fleet.
-        (0, distress_1.reportDistress)('watchdog', distress_1.DISTRESS.DAEMON_HUNG, `daemon pid ${state.pid} unresponsive (alive-marker stale + verdict pipe silent) — recycled by watchdog`);
+        (0, distress_1.reportDistress)('watchdog', recycleNotServing ? distress_1.DISTRESS.IPC_NOT_SERVING : distress_1.DISTRESS.DAEMON_HUNG, recycleNotServing
+            ? `daemon pid ${state.pid} kept rejecting this profile's verdict token for ${notServingTicks} ticks — recycled by watchdog`
+            : `daemon pid ${state.pid} unresponsive (alive-marker stale + verdict pipe silent) — recycled by watchdog`);
         // Claim the kill first: otherwise the next daemon boots, finds a marker
         // with no clean-exit stamp, and reports EDR/AV killed it.
         (0, daemonForensics_1.recordWatchdogRecycle)(state.pid);
@@ -114,7 +126,7 @@ async function watchdogCommand(args, config) {
     // kill it. The daemon is simply gone; fall through to the dead path. The
     // relaunched daemon's own startup detects the recycled pid-file owner and
     // takes over the lock without touching that process.
-    const effectivelyDead = !state.alive || health === 'hung' || health === 'pid_reused';
+    const effectivelyDead = !state.alive || health === 'hung' || health === 'pid_reused' || recycleNotServing;
     // No post-mortem during an updater run either: a daemon the updater
     // stopped was not killed by EDR/AV.
     if (effectivelyDead && !updaterRun) {
@@ -151,7 +163,7 @@ async function watchdogCommand(args, config) {
         daemonVersion: state.version,
         daemonStartedAt: state.startedAt,
         relaunched: relaunched || undefined,
-        daemonHealth: health === 'hung' || health === 'pid_reused' ? health : undefined,
+        daemonHealth: health === 'hung' || health === 'pid_reused' || health === 'not_serving' ? health : undefined,
         lastCrash: crashSummary(postmortem),
     };
     const headers = { 'Content-Type': 'application/json' };
@@ -171,4 +183,17 @@ async function watchdogCommand(args, config) {
             (0, daemonForensics_1.markPostmortemReported)();
     }
     catch { /* offline / endpoint not deployed yet — next tick retries */ }
+    // Policy freshness while the daemon is down. Hooks and gateways never fetch
+    // policy, so without the daemon's poll a suspension or a mode change would
+    // not reach this machine; this tick delivers it within one interval.
+    // Loaded lazily: a healthy tick never pays for the policy modules. Not
+    // during an updater run: the install is being replaced (the daemon is down
+    // on purpose), and hooks keep serving the last good cache meanwhile.
+    if (effectivelyDead && !updaterRun) {
+        try {
+            const { refreshPolicyCachesInBackground } = await Promise.resolve().then(() => __importStar(require('./refreshPolicyCache')));
+            await refreshPolicyCachesInBackground(creds, { scheduled: true });
+        }
+        catch { /* quiet: the next tick retries */ }
+    }
 }

package/dist/config.d.ts

@@ -113,6 +113,12 @@ export declare function getCredentialResolutionTrace(): CredentialResolutionTrac
 export declare function resolveCliCredentials(config: BotGuardConfig, overrides?: Partial<ResolvedCliCredentials>, options?: {
     skipDpapi?: boolean;
 }): ResolvedCliCredentials;
+/**
+ * Shield, endpoint and override key only — no key store is read. For verdict
+ * paths that decide from the offline cache and resolve the key
+ * (resolveCliCredentials) only when a network call needs it.
+ */
+export declare function resolveCliCredentialsWithoutKey(config: BotGuardConfig, overrides?: Partial<ResolvedCliCredentials>): ResolvedCliCredentials;
 /**
  * Credential resolution that is guaranteed to spawn NO child process — for
  * frequent low-privilege callers (watchdog beacon every 5 min). Skips the
@@ -121,6 +127,36 @@ export declare function resolveCliCredentials(config: BotGuardConfig, overrides?
  * (unauthenticated) beacon instead.
  */
 export declare function resolveCliCredentialsShellFree(config: BotGuardConfig, overrides?: Partial<ResolvedCliCredentials>): ResolvedCliCredentials;
+/**
+ * The key this machine holds for one particular shield — what a hook of that
+ * shield resolves on its shell-free path (env handoff, Credential Manager,
+ * machine key file, saved config, env), but each source only for the shield it
+ * belongs to: never another shield's key. Read-only and spawn-free (no DPAPI
+ * decrypt, no migration or mirror write). `shieldId` must come from this
+ * process's configuration (machineEnrollment), never from a file another
+ * process could write.
+ */
+export declare function storedShieldKeyFor(config: BotGuardConfig, shieldId: string, env?: NodeJS.ProcessEnv): string | undefined;
+/**
+ * This machine's own enrollment as a hook started without flags resolves it:
+ * shield and API URL from ~/.fullcourtdefense.yml and the environment, and the
+ * key stored for THAT shield (storedShieldKeyFor). Read-only and spawn-free.
+ * The key belongs with this API URL only: a caller sends it nowhere else.
+ */
+export declare function machineEnrollment(env?: NodeJS.ProcessEnv): {
+    shieldId?: string;
+    apiUrl: string;
+    shieldKey?: string;
+};
+/**
+ * machineEnrollment without the key: the shield this machine is enrolled
+ * with and the API URL configured with it — the only destination its key may
+ * go to. Reads ~/.fullcourtdefense.yml and the environment, no key store.
+ */
+export declare function machineEnrollmentTarget(env?: NodeJS.ProcessEnv): {
+    shieldId?: string;
+    apiUrl: string;
+};
 export declare function isCliSetupComplete(config: BotGuardConfig): boolean;
 /** Fail fast with a clear message when setup was not run. */
 export declare function requireCliSetup(config: BotGuardConfig, overrides?: Partial<ResolvedCliCredentials>, options?: {

package/dist/config.js

@@ -45,7 +45,11 @@ exports.saveShieldConfig = saveShieldConfig;
 exports.daemonHandoffShieldKey = daemonHandoffShieldKey;
 exports.getCredentialResolutionTrace = getCredentialResolutionTrace;
 exports.resolveCliCredentials = resolveCliCredentials;
+exports.resolveCliCredentialsWithoutKey = resolveCliCredentialsWithoutKey;
 exports.resolveCliCredentialsShellFree = resolveCliCredentialsShellFree;
+exports.storedShieldKeyFor = storedShieldKeyFor;
+exports.machineEnrollment = machineEnrollment;
+exports.machineEnrollmentTarget = machineEnrollmentTarget;
 exports.isCliSetupComplete = isCliSetupComplete;
 exports.requireCliSetup = requireCliSetup;
 exports.saveSetupConfig = saveSetupConfig;
@@ -55,8 +59,12 @@ const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const child_process_1 = require("child_process");
 const distress_1 = require("./distress");
-const credentialStore_1 = require("./credentialStore");
-const machineKeyFile_1 = require("./machineKeyFile");
+// The credential stores load only when a shield key is actually resolved or
+// saved: a hook deciding from the offline cache never touches them.
+// eslint-disable-next-line @typescript-eslint/no-var-requires
+const credentialStore = () => require('./credentialStore');
+// eslint-disable-next-line @typescript-eslint/no-var-requires
+const machineKeyFile = () => require('./machineKeyFile');
 const CONFIG_FILENAMES = [
     '.fullcourtdefense.yml',
     '.fullcourtdefense.yaml',
@@ -354,13 +362,13 @@ function getCredentialResolutionTrace() {
 // long-lived (must not hammer the Credential Manager every 30s poll).
 let nativeMigrationAttempted = false;
 function maybeMigrateShieldKeyToNativeStore(shieldId, shieldKey) {
-    if (nativeMigrationAttempted || !(0, credentialStore_1.nativeCredentialStoreAvailable)())
+    if (nativeMigrationAttempted || !credentialStore().nativeCredentialStoreAvailable())
         return;
     nativeMigrationAttempted = true;
     try {
-        if ((0, credentialStore_1.readShieldKeyNative)(shieldId))
+        if (credentialStore().readShieldKeyNative(shieldId))
             return; // already migrated
-        (0, credentialStore_1.saveShieldKeyNative)(shieldId, shieldKey); // read-back verified inside
+        credentialStore().saveShieldKeyNative(shieldId, shieldKey); // read-back verified inside
     }
     catch { /* migration is opportunistic — legacy sources keep working */ }
 }
@@ -378,9 +386,9 @@ function maybeMirrorShieldKeyToMachineFile(shieldId, shieldKey) {
         return;
     machineFileMirrorAttempted = true;
     try {
-        if ((0, machineKeyFile_1.readShieldKeyFromMachineFile)(shieldId) === shieldKey)
+        if (machineKeyFile().readShieldKeyFromMachineFile(shieldId) === shieldKey)
             return; // mirror current
-        (0, machineKeyFile_1.saveShieldKeyToMachineFile)(shieldId, shieldKey); // read-back verified inside
+        machineKeyFile().saveShieldKeyToMachineFile(shieldId, shieldKey); // read-back verified inside
     }
     catch { /* mirroring is opportunistic — primary stores keep working */ }
 }
@@ -410,7 +418,7 @@ function resolveCliCredentials(config, overrides = {}, options = {}) {
         // in-process win32 API read that EDRs don't flag and CLM can't constrain.
         // Silently absent on machines that never migrated (see the migration
         // below) — the DPAPI chain still stands behind it.
-        shieldKey = (0, credentialStore_1.readShieldKeyNative)(resolvedShieldId);
+        shieldKey = credentialStore().readShieldKeyNative(resolvedShieldId);
         if (shieldKey)
             shieldKeySource = 'native_store';
     }
@@ -420,7 +428,7 @@ function resolveCliCredentials(config, overrides = {}, options = {}) {
         // S4U logon sessions do not have — the read above returns nothing there.
         // The machine key file is protected by NTFS ACL (SID-based, which S4U
         // does carry) and is mirrored by interactive-session processes below.
-        shieldKey = (0, machineKeyFile_1.readShieldKeyFromMachineFile)(resolvedShieldId);
+        shieldKey = machineKeyFile().readShieldKeyFromMachineFile(resolvedShieldId);
         if (shieldKey)
             shieldKeySource = 'machine_file';
     }
@@ -461,6 +469,10 @@ function resolveCliCredentials(config, overrides = {}, options = {}) {
         && (shieldKeySource === 'native_store' || shieldKeySource === 'dpapi' || shieldKeySource === 'plaintext_config')) {
         maybeMirrorShieldKeyToMachineFile(resolvedShieldId, shieldKey);
     }
+    return { ...credentialFields(config, overrides), shieldKey };
+}
+/** Everything but the shield key: config, env and overrides only. */
+function credentialFields(config, overrides) {
     return {
         apiKey: overrides.apiKey
             || config.apiKey
@@ -477,9 +489,16 @@ function resolveCliCredentials(config, overrides = {}, options = {}) {
             || process.env.FCD_SHIELD_ID
             || process.env.FULLCOURTDEFENSE_SHIELD_ID
             || process.env.AGENTGUARD_SHIELD_ID,
-        shieldKey,
     };
 }
+/**
+ * Shield, endpoint and override key only — no key store is read. For verdict
+ * paths that decide from the offline cache and resolve the key
+ * (resolveCliCredentials) only when a network call needs it.
+ */
+function resolveCliCredentialsWithoutKey(config, overrides = {}) {
+    return { ...credentialFields(config, overrides), shieldKey: overrides.shieldKey };
+}
 /**
  * Credential resolution that is guaranteed to spawn NO child process — for
  * frequent low-privilege callers (watchdog beacon every 5 min). Skips the
@@ -490,6 +509,53 @@ function resolveCliCredentials(config, overrides = {}, options = {}) {
 function resolveCliCredentialsShellFree(config, overrides = {}) {
     return resolveCliCredentials(config, overrides, { skipDpapi: true });
 }
+/**
+ * The key this machine holds for one particular shield — what a hook of that
+ * shield resolves on its shell-free path (env handoff, Credential Manager,
+ * machine key file, saved config, env), but each source only for the shield it
+ * belongs to: never another shield's key. Read-only and spawn-free (no DPAPI
+ * decrypt, no migration or mirror write). `shieldId` must come from this
+ * process's configuration (machineEnrollment), never from a file another
+ * process could write.
+ */
+function storedShieldKeyFor(config, shieldId, env = process.env) {
+    if (!shieldId)
+        return undefined;
+    if (env.FCD_SHIELD_ID === shieldId && env.FCD_SHIELD_KEY)
+        return env.FCD_SHIELD_KEY;
+    const stored = credentialStore().readShieldKeyNative(shieldId) || machineKeyFile().readShieldKeyFromMachineFile(shieldId);
+    if (stored)
+        return stored;
+    const envShieldId = env.FCD_SHIELD_ID || env.FULLCOURTDEFENSE_SHIELD_ID || env.AGENTGUARD_SHIELD_ID;
+    if (config.shieldKey && (config.shieldId || envShieldId) === shieldId)
+        return config.shieldKey;
+    const envKey = env.FCD_SHIELD_KEY || env.FULLCOURTDEFENSE_SHIELD_KEY || env.AGENTGUARD_SHIELD_KEY;
+    return envKey && (envShieldId || config.shieldId) === shieldId ? envKey : undefined;
+}
+/**
+ * This machine's own enrollment as a hook started without flags resolves it:
+ * shield and API URL from ~/.fullcourtdefense.yml and the environment, and the
+ * key stored for THAT shield (storedShieldKeyFor). Read-only and spawn-free.
+ * The key belongs with this API URL only: a caller sends it nowhere else.
+ */
+function machineEnrollment(env = process.env) {
+    const config = loadMachineConfig();
+    const { shieldId, apiUrl } = enrollmentTargetOf(config, env);
+    return { shieldId, apiUrl, shieldKey: shieldId ? storedShieldKeyFor(config, shieldId, env) : undefined };
+}
+/**
+ * machineEnrollment without the key: the shield this machine is enrolled
+ * with and the API URL configured with it — the only destination its key may
+ * go to. Reads ~/.fullcourtdefense.yml and the environment, no key store.
+ */
+function machineEnrollmentTarget(env = process.env) {
+    return enrollmentTargetOf(loadMachineConfig(), env);
+}
+function enrollmentTargetOf(config, env) {
+    const shieldId = config.shieldId || env.FCD_SHIELD_ID || env.FULLCOURTDEFENSE_SHIELD_ID || env.AGENTGUARD_SHIELD_ID;
+    const apiUrl = (config.apiUrl || env.FULLCOURTDEFENSE_API_URL || env.FCD_API_URL || DEFAULT_API_URL).replace(/\/$/, '');
+    return { shieldId, apiUrl };
+}
 function isCliSetupComplete(config) {
     const creds = resolveCliCredentials(config);
     return Boolean(creds.shieldId && creds.apiKey && creds.organizationId);
@@ -542,11 +608,11 @@ function writeSetupConfig(target, input) {
     // verifies: rolling back to a ≤1.21.33 CLI keeps working, and machines
     // where the native binding is blocked keep their PowerShell path.
     if (input.shieldKey && input.shieldId) {
-        (0, credentialStore_1.saveShieldKeyNative)(input.shieldId, input.shieldKey);
+        credentialStore().saveShieldKeyNative(input.shieldId, input.shieldKey);
         // S4U mirror: the daemon/watchdog tasks cannot read Credential Manager or
         // user-scope DPAPI (S4U logon has no password-derived master key) — give
         // them the ACL-protected file at enrollment so they are never key-less.
-        (0, machineKeyFile_1.saveShieldKeyToMachineFile)(input.shieldId, input.shieldKey);
+        machineKeyFile().saveShieldKeyToMachineFile(input.shieldId, input.shieldKey);
     }
     const protectedShieldKey = input.shieldKey && process.platform === 'win32'
         ? protectShieldKeyForCurrentWindowsUser(input.shieldKey)

package/dist/daemonDetectorBoot.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/daemonDetectorBoot.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Side-effect module, imported FIRST by index.ts: in the resident daemon the
+ * signed detector is compiled on the verdict thread (detectorInThread.ts), and
+ * that choice must be made before the hook module graph imported next loads
+ * the detector. Every other command (hooks included) loads nothing here.
+ */
+if (process.argv[2] === 'daemon') {
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    require('./detectorInThread').useInThreadDetector();
+}

package/dist/daemonForensics.d.ts

@@ -116,7 +116,12 @@ export declare function recordCleanExit(reason: string): void;
  *   marker stale + no pipe endpoint     → pid recycled (daemon is gone; do NOT
  *                                         kill the unrelated process)
  */
-export type DaemonHealthClass = 'dead' | 'healthy' | 'hung' | 'pid_reused' | 'indeterminate';
+/**
+ * 'not_serving': the daemon is alive and its pipe answers, but it rejects this
+ * profile's token ('unauthorized') — the token file is not the serving
+ * daemon's, so every hook evaluates locally while heartbeats look healthy.
+ */
+export type DaemonHealthClass = 'dead' | 'healthy' | 'hung' | 'pid_reused' | 'not_serving' | 'indeterminate';
 /** Marker older than this is stale — 4 missed 5-minute heartbeats. */
 export declare function daemonHungAfterMs(): number;
 export declare function classifyDaemonHealth(input: {
@@ -125,6 +130,8 @@ export declare function classifyDaemonHealth(input: {
     marker: DaemonAliveMarker | undefined;
     staleAfterMs: number;
     pipeProbe: 'responsive' | 'unresponsive' | 'no-endpoint' | 'not-probed';
+    /** With a 'responsive' probe: false when the endpoint rejected this profile's token. */
+    pipeAuthorized?: boolean;
     /**
      * True when the machine itself stopped running since the previous check
      * (sleep/hibernate). Marker staleness is then not evidence of anything —
@@ -165,6 +172,12 @@ export interface WatchdogTick {
 export declare function watchdogTickFile(): string;
 export declare function readWatchdogTick(): WatchdogTick | undefined;
 export declare function recordWatchdogTick(now?: Date): void;
+/**
+ * Consecutive watchdog ticks on which daemon `pid` was alive but rejected this
+ * profile's token (DaemonHealthClass 'not_serving'). `undefined` (any other
+ * class) resets the count. Returns the count including this tick.
+ */
+export declare function recordNotServing(pid: number | undefined, now?: Date): number;
 /**
  * Pure: did the machine stop running between the previous watchdog tick and
  * this one?

package/dist/daemonForensics.js

@@ -52,6 +52,7 @@ exports.classifyDaemonHealth = classifyDaemonHealth;
 exports.watchdogTickFile = watchdogTickFile;
 exports.readWatchdogTick = readWatchdogTick;
 exports.recordWatchdogTick = recordWatchdogTick;
+exports.recordNotServing = recordNotServing;
 exports.detectMachineSuspension = detectMachineSuspension;
 exports.recordWatchdogRecycle = recordWatchdogRecycle;
 exports.markPostmortemReported = markPostmortemReported;
@@ -246,6 +247,10 @@ function classifyDaemonHealth(input) {
     // freshness cannot be judged — stay conservative, never kill on a guess.
     if (!marker || marker.pid !== input.pid)
         return 'indeterminate';
+    // Alive and answering, but not for this profile's hooks: a fresh marker
+    // does not make that healthy (2026-10-02: 11 h of 'unauthorized').
+    if (input.pipeProbe === 'responsive' && input.pipeAuthorized === false)
+        return 'not_serving';
     const last = Date.parse(marker.lastAliveAt || marker.startedAt || '');
     const age = (input.nowMs ?? Date.now()) - last;
     if (!Number.isFinite(age) || age <= input.staleAfterMs)
@@ -306,6 +311,33 @@ function readWatchdogTick() {
 function recordWatchdogTick(now = new Date()) {
     writeJson(watchdogTickFile(), { lastTickAt: now.toISOString() });
 }
+function notServingFile() {
+    return path.join(stateDir(), 'watchdog.not-serving.json');
+}
+/**
+ * Consecutive watchdog ticks on which daemon `pid` was alive but rejected this
+ * profile's token (DaemonHealthClass 'not_serving'). `undefined` (any other
+ * class) resets the count. Returns the count including this tick.
+ */
+function recordNotServing(pid, now = new Date()) {
+    if (pid === undefined) {
+        try {
+            fs.unlinkSync(notServingFile());
+        }
+        catch { /* none */ }
+        return 0;
+    }
+    let ticks = 0;
+    try {
+        const prev = JSON.parse(fs.readFileSync(notServingFile(), 'utf8'));
+        if (prev && prev.pid === pid && typeof prev.ticks === 'number')
+            ticks = prev.ticks;
+    }
+    catch { /* first tick */ }
+    ticks += 1;
+    writeJson(notServingFile(), { pid, ticks, lastAt: now.toISOString() });
+    return ticks;
+}
 /**
  * Pure: did the machine stop running between the previous watchdog tick and
  * this one?

package/dist/detectorInProcess.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Make the signed detector available to this evaluation without loading it:
+ * the signed vocabulary is read (cheap), and a placeholder is installed that
+ * verifies and compiles the artifact on the engine's first inference. No-op
+ * where the Worker loader already owns the detector.
+ */
+export declare function ensureEvaluationDetector(): void;
+/**
+ * Detector stamp for spooled events (revision / sha256 / active), without
+ * loading anything: the Worker loader's status where it owns the detector,
+ * otherwise the in-process detector once a decision has used it. Undefined
+ * when this process never consulted the detector.
+ */
+export declare function detectorStampForEvent(): {
+    revision: number;
+    sha256?: string;
+    active: boolean;
+} | undefined;

package/dist/detectorInProcess.js

@@ -0,0 +1,234 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureEvaluationDetector = ensureEvaluationDetector;
+exports.detectorStampForEvent = detectorStampForEvent;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const vm_1 = require("vm");
+const detectionData_1 = require("./detectionData");
+const detectorArtifact_1 = require("./detectorArtifact");
+const detectorRuntime_1 = require("./detectorRuntime");
+const localDetectionData_1 = require("./localDetectionData");
+const machineIdentity_1 = require("./machineIdentity");
+const MAX_INPUT_BYTES = 256 * 1024;
+const MAX_OUTPUT_BYTES = 512 * 1024;
+let installed = false;
+let resolved = false;
+let chosen;
+/** The Worker loader owns the detector in this process (daemon, gateways). */
+function longRunningLoaderLoaded() {
+    try {
+        return Boolean(require.cache[require.resolve('./localDetectionUpdates')]);
+    }
+    catch {
+        return false;
+    }
+}
+/** Same VM setup as detectorModule's Worker, on this thread. Synchronous, no Atomics.wait. */
+function compileInProcess(artifact) {
+    const context = (0, vm_1.createContext)(Object.create(null), { codeGeneration: { strings: false, wasm: false } });
+    // Expose parsed scalar fields, not Node's host URL constructor or native
+    // exceptions. The wrapper and all values visible to code belong to the VM.
+    const makeUrl = new vm_1.Script('(parse => class URL { constructor(input, base) { const fields=JSON.parse(parse(String(input), base===undefined?undefined:String(base))); if(fields.error)throw new TypeError("Invalid URL"); Object.assign(this,fields); } toString(){return this.href;} })').runInContext(context, { timeout: 1000 });
+    context.URL = makeUrl((input, base) => {
+        try {
+            if (typeof input !== 'string' || input.length > 256 * 1024 || (base !== undefined && (typeof base !== 'string' || base.length > 256 * 1024)))
+                return '{"error":true}';
+            const value = new URL(input, base);
+            const fields = {};
+            for (const key of ['href', 'origin', 'protocol', 'username', 'password', 'host', 'hostname', 'port', 'pathname', 'search', 'hash'])
+                fields[key] = value[key];
+            return JSON.stringify(fields);
+        }
+        catch {
+            return '{"error":true}';
+        }
+    });
+    new vm_1.Script(artifact.code).runInContext(context, { timeout: 1000 });
+    new vm_1.Script('if(typeof FcdDetector?.inferToolContext!=="function")throw new Error("Missing export")').runInContext(context, { timeout: 1000 });
+    const evaluate = new vm_1.Script('JSON.stringify(FcdDetector.inferToolContext(...JSON.parse(inputJson)))');
+    let stopped = false;
+    const invoke = (tool, args) => {
+        if (stopped)
+            throw new detectorRuntime_1.DetectorWorkerUnavailable('Detector unavailable');
+        const input = JSON.stringify([tool, args, (0, detectionData_1.getDetectionData)()]);
+        if (Buffer.byteLength(input) > MAX_INPUT_BYTES)
+            throw new Error('Detector input exceeds bound');
+        let text;
+        try {
+            context.inputJson = input;
+            text = evaluate.runInContext(context, { timeout: 250 });
+            if (typeof text !== 'string')
+                throw new Error('Invalid output');
+            if (Buffer.byteLength(text) > MAX_OUTPUT_BYTES)
+                throw new Error('Output too large');
+        }
+        catch {
+            // The Worker retires itself on any inference fault; so does this copy.
+            stopped = true;
+            throw new detectorRuntime_1.DetectorWorkerUnavailable('Detector timed out or failed');
+        }
+        finally {
+            delete context.inputJson;
+        }
+        return JSON.parse(text);
+    };
+    return Object.assign(invoke, { dispose: () => { stopped = true; } });
+}
+/** Compile and smoke-test exactly as detectorUpdates.prepareDetector does. */
+function prepare(artifact) {
+    let infer;
+    try {
+        infer = compileInProcess(artifact);
+        (0, detectorRuntime_1.validateDetectorFacts)(infer('read_file', { path: 'sample.txt' }));
+        return infer;
+    }
+    catch {
+        infer?.dispose();
+        return undefined;
+    }
+}
+function bundledBaseline() {
+    try {
+        // eslint-disable-next-line @typescript-eslint/no-var-requires
+        const { BUNDLED_DETECTOR_ENVELOPE } = require('./detectorBaseline');
+        if (!BUNDLED_DETECTOR_ENVELOPE)
+            return undefined;
+        const issuedAt = JSON.parse(JSON.parse(BUNDLED_DETECTOR_ENVELOPE).payload).issuedAt;
+        const bundled = (0, detectorArtifact_1.verifyDetectorArtifact)(BUNDLED_DETECTOR_ENVELOPE, Math.min(Date.now(), issuedAt));
+        return bundled.machineIds === null ? bundled : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The daemon's accepted update cache, under the same verification and eligibility as DetectorUpdates.loadLocal. */
+function cachedUpdate() {
+    try {
+        const file = path.join(os.homedir(), '.fullcourtdefense', 'detector-update-v1.json');
+        if (fs.statSync(file).size > detectorArtifact_1.MAX_DETECTOR_BYTES)
+            return undefined;
+        const raw = fs.readFileSync(file, 'utf8');
+        // Expiration gates first acceptance, not continued offline use.
+        const data = (0, detectorArtifact_1.verifyDetectorArtifact)(raw, Math.min(Date.now(), JSON.parse(JSON.parse(raw).payload).issuedAt));
+        if (data.machineIds !== null && !data.machineIds.includes((0, machineIdentity_1.getMachineIdentity)().machineId))
+            return undefined;
+        return data;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * The artifact the Worker loader would have active: it activates the baseline
+ * first, then a cached update only when strictly newer than what is active
+ * (any revision when the baseline did not activate). Each candidate must
+ * compile and pass the smoke inference.
+ */
+function selectDetector() {
+    const baseline = bundledBaseline();
+    const update = cachedUpdate();
+    const updateFirst = Boolean(update && (!baseline || update.revision > baseline.revision));
+    if (update && updateFirst) {
+        const infer = prepare(update);
+        if (infer)
+            return { artifact: update, infer };
+    }
+    if (baseline) {
+        const infer = prepare(baseline);
+        if (infer)
+            return { artifact: baseline, infer };
+    }
+    if (update && !updateFirst) {
+        const infer = prepare(update);
+        if (infer)
+            return { artifact: update, infer };
+    }
+    return undefined;
+}
+/**
+ * Make the signed detector available to this evaluation without loading it:
+ * the signed vocabulary is read (cheap), and a placeholder is installed that
+ * verifies and compiles the artifact on the engine's first inference. No-op
+ * where the Worker loader already owns the detector.
+ */
+function ensureEvaluationDetector() {
+    try {
+        localDetectionData_1.localDetectionUpdates.loadLocal();
+    }
+    catch { /* bundled vocabulary decides */ }
+    if (installed || longRunningLoaderLoaded() || (0, detectorRuntime_1.detectorRuntimeStatus)().revision > 0)
+        return;
+    installed = true;
+    let infer;
+    const lazy = Object.assign((tool, args) => {
+        if (!resolved) {
+            resolved = true;
+            const selected = selectDetector();
+            chosen = selected?.artifact;
+            infer = selected?.infer;
+        }
+        // No usable artifact: retire the placeholder; the bundled inference decides.
+        if (!infer)
+            throw new detectorRuntime_1.DetectorWorkerUnavailable('No signed detector available');
+        return infer(tool, args);
+    }, { dispose: () => { infer?.dispose(); } });
+    // Revision 1 orders below every published artifact, so a Worker loader that
+    // starts later in this process still replaces the placeholder.
+    try {
+        (0, detectorRuntime_1.installDetector)(lazy, 1);
+    }
+    catch {
+        installed = false;
+    }
+}
+/**
+ * Detector stamp for spooled events (revision / sha256 / active), without
+ * loading anything: the Worker loader's status where it owns the detector,
+ * otherwise the in-process detector once a decision has used it. Undefined
+ * when this process never consulted the detector.
+ */
+function detectorStampForEvent() {
+    if (longRunningLoaderLoaded()) {
+        // eslint-disable-next-line @typescript-eslint/no-var-requires
+        const status = require('./localDetectionUpdates').localDetectorUpdates.getDetectorStatus();
+        return { revision: status.revision, sha256: status.sha256, active: status.active };
+    }
+    if (!installed || !resolved)
+        return undefined;
+    return { revision: chosen?.revision ?? 0, sha256: chosen?.sha256, active: (0, detectorRuntime_1.detectorRuntimeStatus)().active };
+}