nodal-agents 0.8.9 → 0.8.10

package/cli.js

@@ -262,6 +262,214 @@ var init_config = __esm({
   }
 });
 
+// src/lib/pg-logging.ts
+import {
+  existsSync as existsSync3,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync2,
+  renameSync,
+  unlinkSync,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { join as join3, resolve } from "path";
+import { createHash } from "crypto";
+function postgresLogDirFor(dataDir) {
+  const normalised = normaliseDataDir(dataDir);
+  const digest = createHash("sha256").update(normalised).digest("hex").slice(0, 8);
+  const leaf = normalised.split("/").filter(Boolean).pop() ?? "pg-data";
+  return join3(PG_LOG_DIR, `${leaf.replace(/[^A-Za-z0-9._-]/g, "_")}-${digest}`);
+}
+function normaliseDataDir(dataDir) {
+  const resolved = toPosixPath(resolve(dataDir)).replace(/\/+$/, "");
+  return process.platform === "win32" ? resolved.toLowerCase() : resolved;
+}
+function toPosixPath(path) {
+  return path.split("\\").join("/");
+}
+function postgresLoggingSettings(logDirectory) {
+  return {
+    logging_collector: "on",
+    log_destination: "stderr",
+    log_directory: toPosixPath(logDirectory),
+    log_filename: "postgresql-%Y-%m-%d.log",
+    log_rotation_age: "1d",
+    log_rotation_size: `${PG_LOG_ROTATION_SIZE_KB}kB`,
+    log_truncate_on_rotation: "on",
+    // See the header: this KEEPS the crash lines, it does not drop them.
+    log_min_messages: "warning",
+    // %m = timestamp with milliseconds, %p = pid of the process writing the
+    // line. Both are load-bearing for #111: attributing a crash means matching
+    // a pid against what a process table said at a given instant.
+    log_line_prefix: "%m [%p] %q%u@%d ",
+    // A postmaster that reaps a crashed child names the signal only if it is
+    // still around to write the line. On by default; said out loud because the
+    // whole diagnosis depends on it.
+    restart_after_crash: "on"
+  };
+}
+function managedKeys() {
+  return new Set(Object.keys(postgresLoggingSettings("x")));
+}
+function quoteGuc(value) {
+  return `'${value.replace(/'/g, "''")}'`;
+}
+function mergeAutoConf(existing, settings) {
+  const managed = managedKeys();
+  const kept = [];
+  for (const line2 of existing.split(/\r?\n/)) {
+    const trimmed = line2.trim();
+    if (trimmed === "" || trimmed.startsWith("#")) continue;
+    const eq2 = trimmed.indexOf("=");
+    if (eq2 < 0) continue;
+    const key = trimmed.slice(0, eq2).trim();
+    if (managed.has(key)) continue;
+    kept.push(trimmed);
+  }
+  const ours = Object.entries(settings).map(([k, v]) => `${k} = ${quoteGuc(v)}`);
+  return "# Do not edit this file manually!\n# It will be overwritten by the ALTER SYSTEM command,\n# and by nodal-agents for the logging_* settings (see apps/cli/src/lib/pg-logging.ts).\n" + [...kept, ...ours].join("\n") + "\n";
+}
+function applyPostgresLoggingConfig(dataDir, logDirectory) {
+  mkdirSync2(logDirectory, { recursive: true });
+  const target = join3(dataDir, "postgresql.auto.conf");
+  let existing = "";
+  if (existsSync3(target)) {
+    try {
+      existing = readFileSync2(target, "utf-8");
+    } catch {
+      existing = "";
+    }
+  }
+  writeAtomically(target, mergeAutoConf(existing, postgresLoggingSettings(logDirectory)));
+  return logDirectory;
+}
+function tempConfPath(target) {
+  return `${target}.nodalai.tmp`;
+}
+function writeAtomically(target, contents) {
+  const tmp = tempConfPath(target);
+  writeFileSync2(tmp, contents, "utf-8");
+  try {
+    renameSync(tmp, target);
+  } catch (err) {
+    try {
+      unlinkSync(tmp);
+    } catch {
+    }
+    throw err;
+  }
+}
+var PG_LOG_DIR, PG_LOG_ROTATION_SIZE_KB;
+var init_pg_logging = __esm({
+  "src/lib/pg-logging.ts"() {
+    "use strict";
+    init_config();
+    PG_LOG_DIR = join3(LOG_DIR, "postgres");
+    PG_LOG_ROTATION_SIZE_KB = 20 * 1024;
+  }
+});
+
+// src/lib/orphans.ts
+function parseProcessRows(stdout) {
+  const rows = [];
+  for (const line2 of stdout.split(/\r?\n/)) {
+    const first = line2.indexOf("|");
+    if (first < 0) continue;
+    const second = line2.indexOf("|", first + 1);
+    if (second < 0) continue;
+    const third = line2.indexOf("|", second + 1);
+    if (third < 0) continue;
+    const pid = Number.parseInt(line2.slice(0, first), 10);
+    if (!Number.isInteger(pid) || pid <= 0) continue;
+    const ppid = Number.parseInt(line2.slice(first + 1, second), 10);
+    const startedAt = Number.parseInt(line2.slice(second + 1, third), 10);
+    rows.push({
+      pid,
+      ppid: Number.isInteger(ppid) ? ppid : 0,
+      commandLine: line2.slice(third + 1),
+      ...Number.isInteger(startedAt) && startedAt > 0 ? { startedAt } : {}
+    });
+  }
+  return rows;
+}
+function isPlausibleParent(parent, child) {
+  if (parent.startedAt === void 0 || child.startedAt === void 0) return false;
+  return parent.startedAt <= child.startedAt;
+}
+function ownedPostgresPids(input) {
+  const owned = [];
+  const skipped = [];
+  const claim = input.claim;
+  if (claim === null) {
+    for (const row of input.rows) {
+      skipped.push({ pid: row.pid, reason: "no postmaster.pid claims this data dir" });
+    }
+    return { owned, skipped };
+  }
+  const byPid = /* @__PURE__ */ new Map();
+  for (const row of input.rows) byPid.set(row.pid, row);
+  const postmaster = byPid.get(claim.pid);
+  if (!input.tableRead) {
+    for (const row of input.rows) {
+      skipped.push({ pid: row.pid, reason: "the process table could not be read" });
+    }
+    return { owned, skipped };
+  }
+  {
+    if (postmaster === void 0) {
+      for (const row of input.rows) {
+        skipped.push({ pid: row.pid, reason: `lockfile pid ${claim.pid} is not a live postgres` });
+      }
+      return { owned, skipped };
+    }
+    if (!startMatchesClaim(postmaster, claim)) {
+      for (const row of input.rows) {
+        skipped.push({
+          pid: row.pid,
+          reason: `pid ${claim.pid} started at ${String(postmaster.startedAt)}, lockfile says ${String(claim.startedAtSeconds)}`
+        });
+      }
+      return { owned, skipped };
+    }
+  }
+  owned.push(claim.pid);
+  for (const row of input.rows) {
+    if (row.pid === claim.pid) continue;
+    if (descendsFrom(row, claim.pid, byPid)) owned.push(row.pid);
+    else skipped.push({ pid: row.pid, reason: `ancestry=${row.ppid} does not reach ${claim.pid}` });
+  }
+  return { owned, skipped };
+}
+function startMatchesClaim(process3, claim) {
+  if (process3.startedAt === void 0 || claim.startedAtSeconds === null) return false;
+  return Math.abs(process3.startedAt - claim.startedAtSeconds * 1e3) <= START_TIME_TOLERANCE_MS;
+}
+function descendsFrom(row, ancestorPid, byPid) {
+  const seen = /* @__PURE__ */ new Set([row.pid]);
+  let child = row;
+  let cursor = byPid.get(row.ppid);
+  while (cursor && !seen.has(cursor.pid)) {
+    if (!isPlausibleParent(cursor, child)) return false;
+    if (cursor.pid === ancestorPid) return true;
+    seen.add(cursor.pid);
+    child = cursor;
+    cursor = byPid.get(cursor.ppid);
+  }
+  return false;
+}
+function measuredPort(pid, listeners) {
+  return listeners.find((l) => l.pid === pid)?.port ?? null;
+}
+function formatForeignSkip(entry) {
+  return `ORPHAN_PROBE_FOREIGN_POSTGRES_SKIPPED pid=${entry.pid} reason=${entry.reason}`;
+}
+var START_TIME_TOLERANCE_MS;
+var init_orphans = __esm({
+  "src/lib/orphans.ts"() {
+    "use strict";
+    START_TIME_TOLERANCE_MS = 2e3;
+  }
+});
+
 // ../../node_modules/.pnpm/postgres@3.4.9/node_modules/postgres/src/query.js
 function cachedError(xs) {
   if (originCache.has(xs))
@@ -282,9 +490,9 @@ var init_query = __esm({
     CLOSE = {};
     Query = class extends Promise {
       constructor(strings, args, handler, canceller, options = {}) {
-        let resolve3, reject;
+        let resolve4, reject;
         super((a, b2) => {
-          resolve3 = a;
+          resolve4 = a;
           reject = b2;
         });
         this.tagged = Array.isArray(strings.raw);
@@ -295,7 +503,7 @@ var init_query = __esm({
         this.options = options;
         this.state = null;
         this.statement = null;
-        this.resolve = (x) => (this.active = false, resolve3(x));
+        this.resolve = (x) => (this.active = false, resolve4(x));
         this.reject = (x) => (this.active = false, reject(x));
         this.active = false;
         this.cancelled = null;
@@ -343,12 +551,12 @@ var init_query = __esm({
               if (this.executed && !this.active)
                 return { done: true };
               prev && prev();
-              const promise = new Promise((resolve3, reject) => {
+              const promise = new Promise((resolve4, reject) => {
                 this.cursorFn = (value) => {
-                  resolve3({ value, done: false });
+                  resolve4({ value, done: false });
                   return new Promise((r) => prev = r);
                 };
-                this.resolve = () => (this.active = false, resolve3({ done: true }));
+                this.resolve = () => (this.active = false, resolve4({ done: true }));
                 this.reject = (x) => (this.active = false, reject(x));
               });
               this.execute();
@@ -946,12 +1154,12 @@ function Connection(options, queues = {}, { onopen = noop, onend = noop, onclose
     x.on("drain", drain);
     return x;
   }
-  async function cancel({ pid, secret }, resolve3, reject) {
+  async function cancel({ pid, secret }, resolve4, reject) {
     try {
       cancelMessage = bytes_default().i32(16).i32(80877102).i32(pid).i32(secret).end(16);
       await connect();
       socket.once("error", reject);
-      socket.once("close", resolve3);
+      socket.once("close", resolve4);
     } catch (error2) {
       reject(error2);
     }
@@ -1968,7 +2176,7 @@ var init_subscribe = __esm({
 // ../../node_modules/.pnpm/postgres@3.4.9/node_modules/postgres/src/large.js
 import Stream2 from "stream";
 function largeObject(sql2, oid, mode = 131072 | 262144) {
-  return new Promise(async (resolve3, reject) => {
+  return new Promise(async (resolve4, reject) => {
     await sql2.begin(async (sql3) => {
       let finish;
       !oid && ([{ oid }] = await sql3`select lo_creat(-1) as oid`);
@@ -1994,7 +2202,7 @@ function largeObject(sql2, oid, mode = 131072 | 262144) {
           ) seek
         `
       };
-      resolve3(lo);
+      resolve4(lo);
       return new Promise(async (r) => finish = r);
       async function readable({
         highWaterMark = 2048 * 8,
@@ -2155,8 +2363,8 @@ function Postgres(a, b2) {
   }
   async function reserve() {
     const queue = queue_default();
-    const c = open2.length ? open2.shift() : await new Promise((resolve3, reject) => {
-      const query = { reserve: resolve3, reject };
+    const c = open2.length ? open2.shift() : await new Promise((resolve4, reject) => {
+      const query = { reserve: resolve4, reject };
       queries.push(query);
       closed.length && connect(closed.shift(), query);
     });
@@ -2193,9 +2401,9 @@ function Postgres(a, b2) {
       let uncaughtError, result;
       name && await sql3`savepoint ${sql3(name)}`;
       try {
-        result = await new Promise((resolve3, reject) => {
+        result = await new Promise((resolve4, reject) => {
           const x = fn2(sql3);
-          Promise.resolve(Array.isArray(x) ? Promise.all(x) : x).then(resolve3, reject);
+          Promise.resolve(Array.isArray(x) ? Promise.all(x) : x).then(resolve4, reject);
         });
         if (uncaughtError)
           throw uncaughtError;
@@ -2252,8 +2460,8 @@ function Postgres(a, b2) {
     return c.execute(query) ? move(c, busy) : move(c, full);
   }
   function cancel(query) {
-    return new Promise((resolve3, reject) => {
-      query.state ? query.active ? connection_default(options).cancel(query.state, resolve3, reject) : query.cancelled = { resolve: resolve3, reject } : (queries.remove(query), query.cancelled = true, query.reject(Errors.generic("57014", "canceling statement due to user request")), resolve3());
+    return new Promise((resolve4, reject) => {
+      query.state ? query.active ? connection_default(options).cancel(query.state, resolve4, reject) : query.cancelled = { resolve: resolve4, reject } : (queries.remove(query), query.cancelled = true, query.reject(Errors.generic("57014", "canceling statement due to user request")), resolve4());
     });
   }
   async function end({ timeout = null } = {}) {
@@ -2272,11 +2480,11 @@ function Postgres(a, b2) {
   async function close() {
     await Promise.all(connections.map((c) => c.end()));
   }
-  async function destroy(resolve3) {
+  async function destroy(resolve4) {
     await Promise.all(connections.map((c) => c.terminate()));
     while (queries.length)
       queries.shift().reject(Errors.connection("CONNECTION_DESTROYED", options));
-    resolve3();
+    resolve4();
   }
   function connect(c, query) {
     move(c, connecting);
@@ -3714,7 +3922,7 @@ var init_sql = __esm({
         return new SQL([new StringChunk(str)]);
       }
       sql2.raw = raw;
-      function join12(chunks, separator) {
+      function join14(chunks, separator) {
         const result = [];
         for (const [i, chunk] of chunks.entries()) {
           if (i > 0 && separator !== void 0) {
@@ -3724,7 +3932,7 @@ var init_sql = __esm({
         }
         return new SQL(result);
       }
-      sql2.join = join12;
+      sql2.join = join14;
       function identifier(value) {
         return new Name(value);
       }
@@ -8047,7 +8255,7 @@ var init_select2 = __esm({
           const baseTableName = this.tableName;
           const tableName = getTableLikeName(table);
           for (const item of extractUsedTable(table)) this.usedTables.add(item);
-          if (typeof tableName === "string" && this.config.joins?.some((join12) => join12.alias === tableName)) {
+          if (typeof tableName === "string" && this.config.joins?.some((join14) => join14.alias === tableName)) {
             throw new Error(`Alias "${tableName}" is already used in this query`);
           }
           if (!this.isPartialSelect) {
@@ -9582,7 +9790,7 @@ var init_update = __esm({
       createJoin(joinType) {
         return (table, on) => {
           const tableName = getTableLikeName(table);
-          if (typeof tableName === "string" && this.config.joins.some((join12) => join12.alias === tableName)) {
+          if (typeof tableName === "string" && this.config.joins.some((join14) => join14.alias === tableName)) {
             throw new Error(`Alias "${tableName}" is already used in this query`);
           }
           if (typeof on === "function") {
@@ -9678,10 +9886,10 @@ var init_update = __esm({
               const fromFields = this.getTableLikeFields(this.config.from);
               fields[tableName] = fromFields;
             }
-            for (const join12 of this.config.joins) {
-              const tableName2 = getTableLikeName(join12.table);
-              if (typeof tableName2 === "string" && !is(join12.table, SQL)) {
-                const fromFields = this.getTableLikeFields(join12.table);
+            for (const join14 of this.config.joins) {
+              const tableName2 = getTableLikeName(join14.table);
+              if (typeof tableName2 === "string" && !is(join14.table, SQL)) {
+                const fromFields = this.getTableLikeFields(join14.table);
                 fields[tableName2] = fromFields;
               }
             }
@@ -10924,14 +11132,14 @@ __export(migrate_exports, {
   runMigrations: () => runMigrations
 });
 import { fileURLToPath as fileURLToPath2 } from "url";
-import { join as join3, dirname as dirname2 } from "path";
+import { join as join4, dirname as dirname2 } from "path";
 import {
-  existsSync as existsSync3,
+  existsSync as existsSync4,
   mkdtempSync,
   readdirSync,
-  readFileSync as readFileSync2,
-  writeFileSync as writeFileSync2,
-  mkdirSync as mkdirSync2
+  readFileSync as readFileSync3,
+  writeFileSync as writeFileSync3,
+  mkdirSync as mkdirSync3
 } from "fs";
 import { tmpdir } from "os";
 async function runMigrations(connectionString, opts = {}) {
@@ -10944,26 +11152,26 @@ async function runMigrations(connectionString, opts = {}) {
   });
   const db = drizzle(sql2);
   const here = dirname2(fileURLToPath2(import.meta.url));
-  const sibling = join3(here, "migrations");
-  const sourceFolder = existsSync3(sibling) ? sibling : join3(here, "../migrations");
+  const sibling = join4(here, "migrations");
+  const sourceFolder = existsSync4(sibling) ? sibling : join4(here, "../migrations");
   const migrationsFolder = opts.patchVectorAsText ? patchMigrationsForNoVector(sourceFolder) : sourceFolder;
   await migrate(db, { migrationsFolder });
   await sql2.end();
 }
 function patchMigrationsForNoVector(sourceFolder) {
-  const tmpFolder = mkdtempSync(join3(tmpdir(), "nodalai-migrations-"));
-  const metaDir = join3(tmpFolder, "meta");
-  mkdirSync2(metaDir, { recursive: true });
+  const tmpFolder = mkdtempSync(join4(tmpdir(), "nodalai-migrations-"));
+  const metaDir = join4(tmpFolder, "meta");
+  mkdirSync3(metaDir, { recursive: true });
   for (const entry of readdirSync(sourceFolder, { withFileTypes: true })) {
     if (entry.isDirectory() && entry.name === "meta") {
-      for (const metaFile of readdirSync(join3(sourceFolder, "meta"))) {
-        const content = readFileSync2(join3(sourceFolder, "meta", metaFile), "utf8");
-        writeFileSync2(join3(metaDir, metaFile), content);
+      for (const metaFile of readdirSync(join4(sourceFolder, "meta"))) {
+        const content = readFileSync3(join4(sourceFolder, "meta", metaFile), "utf8");
+        writeFileSync3(join4(metaDir, metaFile), content);
       }
     } else if (entry.isFile() && entry.name.endsWith(".sql")) {
-      const content = readFileSync2(join3(sourceFolder, entry.name), "utf8");
+      const content = readFileSync3(join4(sourceFolder, entry.name), "utf8");
       const patched = content.replace(/\bvector\(\d+\)/g, "text");
-      writeFileSync2(join3(tmpFolder, entry.name), patched);
+      writeFileSync3(join4(tmpFolder, entry.name), patched);
     }
   }
   return tmpFolder;
@@ -10978,69 +11186,185 @@ var init_migrate = __esm({
 });
 
 // src/lib/postgres.ts
-import { existsSync as existsSync4, readFileSync as readFileSync3, unlinkSync } from "fs";
-import { join as join4 } from "path";
+var postgres_exports = {};
+__export(postgres_exports, {
+  LEGACY_PG_PASSWORD: () => LEGACY_PG_PASSWORD,
+  PG_DATABASE: () => PG_DATABASE,
+  PG_USER: () => PG_USER,
+  buildPgUrl: () => buildPgUrl,
+  isPostgresAuthFailure: () => isPostgresAuthFailure,
+  livePostmasterPid: () => livePostmasterPid,
+  postgresProcessesForDataDir: () => postgresProcessesForDataDir,
+  processStartedAtMs: () => processStartedAtMs,
+  readPostmasterClaim: () => readPostmasterClaim,
+  readPostmasterPid: () => readPostmasterPid,
+  resolvePgCtl: () => resolvePgCtl,
+  runMigrations: () => runMigrations2,
+  startAndWaitUntilReady: () => startAndWaitUntilReady,
+  startEmbeddedPostgres: () => startEmbeddedPostgres,
+  stopOrphanPostgres: () => stopOrphanPostgres,
+  unconfirmedReading: () => unconfirmedReading
+});
+import { existsSync as existsSync5, readdirSync as readdirSync2, readFileSync as readFileSync4, realpathSync, statSync, unlinkSync as unlinkSync2 } from "fs";
+import { join as join5 } from "path";
 function readPostmasterPid(dataDir = PG_DATA_DIR) {
-  const pidFile = join4(dataDir, "postmaster.pid");
-  if (!existsSync4(pidFile)) return null;
+  return readPostmasterClaim(dataDir)?.pid ?? null;
+}
+function readPostmasterClaim(dataDir = PG_DATA_DIR) {
+  const pidFile = join5(dataDir, "postmaster.pid");
+  if (!existsSync5(pidFile)) return null;
   try {
-    const firstLine = readFileSync3(pidFile, "utf-8").split("\n")[0]?.trim() ?? "";
-    const pid = Number.parseInt(firstLine, 10);
-    return Number.isInteger(pid) && pid > 0 ? pid : null;
+    const lines = readFileSync4(pidFile, "utf-8").split("\n");
+    const pid = Number.parseInt(lines[0]?.trim() ?? "", 10);
+    if (!Number.isInteger(pid) || pid <= 0) return null;
+    const recorded = lines[1]?.trim();
+    if (recorded !== void 0 && recorded !== "" && !sameDirectory(recorded, dataDir)) {
+      process.stderr.write(
+        `POSTMASTER_PID_FOREIGN_DATA_DIR pid=${pid} recorded=${recorded} expected=${dataDir}
+`
+      );
+      return null;
+    }
+    const seconds = Number.parseInt(lines[2]?.trim() ?? "", 10);
+    return { pid, startedAtSeconds: Number.isInteger(seconds) && seconds > 0 ? seconds : null };
   } catch {
     return null;
   }
 }
+function sameDirectory(a, b2) {
+  const clean = (v) => process.platform === "win32" ? v.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase() : (
+    // A backslash is a legal character in a POSIX filename, so turning it
+    // into a separator made `/srv/pg\data` and `/srv/pg/data` — two real,
+    // different directories — compare equal (pass-9 finding R2). Only the
+    // trailing separator is dropped.
+    v.replace(/\/+$/, "")
+  );
+  return clean(a) === clean(b2);
+}
 function livePostmasterPid(dataDir = PG_DATA_DIR) {
   const pid = readPostmasterPid(dataDir);
-  if (pid === null) return null;
+  return pid !== null && isPidRunning(pid) ? pid : null;
+}
+function isPidRunning(pid) {
   try {
     process.kill(pid, 0);
-    return pid;
+    return true;
   } catch (err) {
-    return err.code === "ESRCH" ? null : pid;
+    return err.code !== "ESRCH";
   }
 }
-async function postgresPidsForDataDir(dataDir = PG_DATA_DIR) {
-  if (process.platform !== "win32") return [];
+async function postgresProcessesForDataDir(dataDir = PG_DATA_DIR) {
+  if (process.platform !== "win32") return unconfirmedReading(dataDir);
   const { execa: execa4 } = await import("execa");
   try {
-    const { stdout } = await execa4(
+    const { stdout, stderr, exitCode } = await execa4(
       "powershell",
       [
         "-NoProfile",
         "-NonInteractive",
         "-Command",
-        // CommandLine is where the -D <dataDir> argument lives. Matching on it
-        // is what ties a bare `postgres.exe` to OUR cluster rather than to some
-        // other Postgres the user runs.
-        `Get-CimInstance Win32_Process -Filter "Name='postgres.exe'" | Select-Object -ExpandProperty ProcessId,CommandLine | Out-Null; Get-CimInstance Win32_Process -Filter "Name='postgres.exe'" | ForEach-Object { "$($_.ProcessId)\`t$($_.CommandLine)" }`
+        // `CreationDate` is the load-bearing field: it tells one generation of
+        // a pid from the next, which is the only thing that catches a pid the
+        // OS recycled onto a stranger. It goes BEFORE the command line, the one
+        // field that may itself carry a `|`. The command line is kept for the
+        // log line that says what was left alone — never to decide ownership.
+        `Get-CimInstance Win32_Process -Filter "Name='postgres.exe'" | ForEach-Object { $ms = if ($_.CreationDate) { [int64]($_.CreationDate.ToUniversalTime() - (Get-Date '1970-01-01T00:00:00Z').ToUniversalTime()).TotalMilliseconds } else { 0 }; "$($_.ProcessId)|$($_.ParentProcessId)|$ms|$($_.CommandLine)" }`
       ],
       { reject: false, timeout: 1e4 }
     );
-    const dataNeedle = dataDir.toLowerCase().replace(/\\/g, "/");
-    const binNeedle = "@embedded-postgres";
-    const pids = [];
-    for (const line2 of stdout.split(/\r?\n/)) {
-      const tab = line2.indexOf("	");
-      if (tab < 0) continue;
-      const pid = Number.parseInt(line2.slice(0, tab), 10);
-      if (!Number.isInteger(pid) || pid <= 0) continue;
-      const cmd = line2.slice(tab + 1).toLowerCase().replace(/\\/g, "/");
-      if (cmd.includes(dataNeedle) || cmd.includes(binNeedle)) pids.push(pid);
-    }
-    return pids;
+    if (exitCode !== 0) {
+      process.stderr.write(
+        `ORPHAN_PROBE_UNREADABLE exit=${String(exitCode)} stderr=${stderr.trim().slice(0, 200)}
+`
+      );
+      return unconfirmedReading(dataDir);
+    }
+    const { owned, skipped } = ownedPostgresPids({
+      rows: parseProcessRows(stdout),
+      tableRead: true,
+      // The data directory answers; this table only confirms.
+      claim: readPostmasterClaim(dataDir)
+    });
+    for (const entry of skipped) process.stderr.write(`${formatForeignSkip(entry)}
+`);
+    return { read: true, owned };
+  } catch (err) {
+    process.stderr.write(
+      `ORPHAN_PROBE_UNREADABLE error=${err instanceof Error ? err.message : String(err)}
+`
+    );
+    return unconfirmedReading(dataDir);
+  }
+}
+function unconfirmedReading(dataDir) {
+  const claim = readPostmasterClaim(dataDir);
+  if (claim === null) {
+    process.stderr.write(`ORPHAN_PROBE_NO_CLAIM dataDir=${dataDir}
+`);
+    return { read: false, owned: [] };
+  }
+  if (!isPidRunning(claim.pid)) {
+    process.stderr.write(`ORPHAN_PROBE_CLAIMED_PID_NOT_ALIVE pid=${claim.pid}
+`);
+    return { read: false, owned: [] };
+  }
+  const holdsDataDir = postmasterHoldsDataDir(claim.pid, dataDir);
+  if (holdsDataDir !== true) {
+    process.stderr.write(
+      `ORPHAN_PROBE_NOT_IN_DATA_DIR pid=${claim.pid} holds=${String(holdsDataDir)}
+`
+    );
+    return { read: false, owned: [] };
+  }
+  const startedAt = processStartedAtMs(claim.pid);
+  if (startedAt === null) {
+    process.stderr.write(
+      `ORPHAN_PROBE_NO_START_TIME pid=${claim.pid} platform=${process.platform}
+`
+    );
+    return { read: false, owned: [] };
+  }
+  const { owned, skipped } = ownedPostgresPids({
+    rows: [{ pid: claim.pid, ppid: 0, commandLine: "", startedAt }],
+    tableRead: true,
+    claim
+  });
+  for (const entry of skipped) process.stderr.write(`${formatForeignSkip(entry)}
+`);
+  return { read: false, owned };
+}
+function postmasterHoldsDataDir(pid, dataDir) {
+  if (process.platform !== "linux") return null;
+  try {
+    return sameDirectory(realpathSync(`/proc/${pid}/cwd`), realpathSync(dataDir));
   } catch {
-    return [];
+    return null;
+  }
+}
+function processStartedAtMs(pid) {
+  if (process.platform !== "linux") return null;
+  try {
+    const stat = readFileSync4(`/proc/${pid}/stat`, "utf-8");
+    const after = stat.slice(stat.lastIndexOf(")") + 2).split(" ");
+    const ticksSinceBoot = Number.parseInt(after[19] ?? "", 10);
+    if (!Number.isFinite(ticksSinceBoot)) return null;
+    const uptimeSeconds = Number.parseFloat(
+      readFileSync4("/proc/uptime", "utf-8").split(" ")[0] ?? ""
+    );
+    if (!Number.isFinite(uptimeSeconds)) return null;
+    const elapsedSeconds = uptimeSeconds - ticksSinceBoot / 100;
+    return Date.now() - elapsedSeconds * 1e3;
+  } catch {
+    return null;
   }
 }
 function clearStalePostmasterPid(dataDir) {
-  const pidFile = join4(dataDir, "postmaster.pid");
-  if (!existsSync4(pidFile)) return;
+  const pidFile = join5(dataDir, "postmaster.pid");
+  if (!existsSync5(pidFile)) return;
   if (readPostmasterPid(dataDir) === null) return;
   if (livePostmasterPid(dataDir) !== null) return;
   try {
-    unlinkSync(pidFile);
+    unlinkSync2(pidFile);
   } catch {
   }
 }
@@ -11050,32 +11374,128 @@ function buildPgUrl(port, password) {
 function quotePgLiteral(value) {
   return `'${value.replace(/'/g, "''")}'`;
 }
-async function stopOrphanPostgres(dataDir = PG_DATA_DIR) {
-  const pidFile = join4(dataDir, "postmaster.pid");
-  if (!existsSync4(pidFile)) return false;
+async function stopOrphanPostgres(decidedPid, dataDir = PG_DATA_DIR) {
+  const claim = readPostmasterClaim(dataDir);
+  if (claim === null || claim.pid !== decidedPid) {
+    process.stderr.write(
+      `PG_CTL_SKIPPED_LOCKFILE_MISMATCH decided=${decidedPid} lockfile=${String(claim?.pid ?? null)}
+`
+    );
+    return false;
+  }
+  const asRoot = process.platform !== "win32" && typeof process.getuid === "function" && process.getuid() === 0;
+  if (asRoot) {
+    process.stderr.write("PG_CTL_SKIPPED_ROOT \u2014 pg_ctl refuses to run as root\n");
+    return false;
+  }
   try {
-    const EmbeddedPostgres = (await import("embedded-postgres")).default;
-    const pg = new EmbeddedPostgres({
-      databaseDir: dataDir,
-      user: PG_USER,
-      // stop() only reads postmaster.pid and signals pg_ctl — it never
-      // authenticates, so the value here is irrelevant.
-      password: LEGACY_PG_PASSWORD,
-      port: 25432,
-      // unused for stop()
-      persistent: true,
-      onError: () => {
-      },
-      onLog: () => {
-      }
-    });
-    await pg.stop();
+    const binary = await resolvePgCtl();
+    if (binary === null) {
+      process.stderr.write(`PG_CTL_NOT_FOUND dataDir=${dataDir}
+`);
+      return false;
+    }
+    const { execa: execa4 } = await import("execa");
+    const { exitCode, stderr } = await execa4(
+      binary,
+      ["stop", "-D", dataDir, "-m", "fast", "-w", "-t", "30"],
+      { reject: false, timeout: 4e4 }
+    );
+    if (exitCode !== 0) {
+      process.stderr.write(
+        `PG_CTL_STOP_FAILED exit=${String(exitCode)} stderr=${stderr.trim().slice(0, 200)}
+`
+      );
+      return false;
+    }
     return true;
-  } catch {
+  } catch (err) {
+    process.stderr.write(
+      `PG_CTL_STOP_FAILED error=${err instanceof Error ? err.message : String(err)}
+`
+    );
     return false;
   }
 }
-async function startEmbeddedPostgres(dataDir = PG_DATA_DIR, port = 25432, password = LEGACY_PG_PASSWORD) {
+async function resolvePgCtl() {
+  try {
+    const { createRequire: createRequire2 } = await import("module");
+    const { pathToFileURL } = await import("url");
+    const { dirname: dirname5 } = await import("path");
+    const require2 = createRequire2(import.meta.url);
+    const entry = require2.resolve("embedded-postgres");
+    const module = await import(pathToFileURL(join5(dirname5(entry), "binary.js")).href);
+    const binaries = await module.default?.();
+    const pgCtl = binaries?.pg_ctl;
+    return pgCtl !== void 0 && existsSync5(pgCtl) ? pgCtl : null;
+  } catch {
+    return null;
+  }
+}
+function isPostgresAuthFailure(err) {
+  const code = err?.code;
+  return typeof code === "string" && code.length === 5 && code.startsWith("28");
+}
+async function stopQuietly(pg) {
+  try {
+    await pg.stop?.();
+  } catch {
+  }
+}
+async function startAndWaitUntilReady(pg) {
+  let exitedEarly = null;
+  let resolvedItself = false;
+  const started = pg.start().then(
+    () => {
+      resolvedItself = true;
+    },
+    (err) => {
+      exitedEarly = err ?? new Error("the postmaster exited during startup");
+    }
+  );
+  const deadline = Date.now() + READY_TIMEOUT_MS;
+  for (; ; ) {
+    if (exitedEarly !== null) throw exitedEarly;
+    const probe = pg.getPgClient("postgres");
+    try {
+      await probe.connect();
+      await probe.end();
+      return;
+    } catch (err) {
+      await probe.end().catch(() => {
+      });
+      if (isPostgresAuthFailure(err)) {
+        await stopQuietly(pg);
+        const code = err.code;
+        throw new Error(
+          `Postgres refused the connection: authentication failed (SQLSTATE ${code}). The cluster started and was stopped again. The password the CLI holds does not match the one this data directory was initialised with.`
+        );
+      }
+    }
+    if (resolvedItself) {
+      await started;
+      return;
+    }
+    if (Date.now() > deadline) {
+      await stopQuietly(pg);
+      throw new Error(
+        `Postgres did not accept a connection within ${READY_TIMEOUT_MS / 1e3}s of starting`
+      );
+    }
+    await new Promise((r) => setTimeout(r, 500));
+  }
+}
+function tailLogDirectory(logDirectory, lines = 40) {
+  try {
+    const files = readdirSync2(logDirectory).map((name) => join5(logDirectory, name)).map((path) => ({ path, mtime: statSync(path).mtimeMs })).sort((a, b2) => b2.mtime - a.mtime);
+    const newest = files[0];
+    if (!newest) return [];
+    return readFileSync4(newest.path, "utf-8").split(/\r?\n/).filter((l) => l.trim() !== "").slice(-lines);
+  } catch {
+    return [];
+  }
+}
+async function startEmbeddedPostgres(dataDir = PG_DATA_DIR, port = 25432, password = LEGACY_PG_PASSWORD, logDirectory = postgresLogDirFor(dataDir)) {
   const EmbeddedPostgres = (await import("embedded-postgres")).default;
   const capturedLogs = [];
   const capturedErrors = [];
@@ -11104,23 +11524,26 @@ async function startEmbeddedPostgres(dataDir = PG_DATA_DIR, port = 25432, passwo
       if (verboseLog) process.stdout.write("[pg] " + m + "\n");
     }
   });
-  const alreadyInitialised = existsSync4(join4(dataDir, "PG_VERSION"));
+  const alreadyInitialised = existsSync5(join5(dataDir, "PG_VERSION"));
   if (alreadyInitialised) clearStalePostmasterPid(dataDir);
   try {
     if (!alreadyInitialised) {
       await pg.initialise();
     }
-    await pg.start();
+    applyPostgresLoggingConfig(dataDir, logDirectory);
+    await startAndWaitUntilReady(pg);
   } catch (err) {
     const errMsg = err instanceof Error && err.message ? err.message : String(err);
-    const fatalLines = capturedLogs.filter((l) => /\b(FATAL|PANIC|ERROR)\b/.test(l));
+    const fatalLines = [...capturedLogs, ...tailLogDirectory(logDirectory)].filter(
+      (l) => /\b(FATAL|PANIC|ERROR)\b/.test(l)
+    );
     const detail = [
       capturedErrors.length ? `Captured Postgres errors:
     ${capturedErrors.join("\n    ")}` : null,
       fatalLines.length ? `Postgres log:
     ${fatalLines.join("\n    ")}` : null
     ].filter(Boolean).join("\n  ");
-    const sharedMemHint = capturedLogs.some((l) => /pre-existing shared memory block/.test(l)) ? "\n  \u2192 A previous Postgres crashed without releasing its Windows shared-memory block. Reboot the machine to clear the orphan kernel object, then retry. No data is lost; pg-data is preserved." : "";
+    const sharedMemHint = fatalLines.some((l) => /pre-existing shared memory block/.test(l)) ? "\n  \u2192 A previous Postgres crashed without releasing its Windows shared-memory block. Reboot the machine to clear the orphan kernel object, then retry. No data is lost; pg-data is preserved." : "";
     throw new Error(
       `Postgres ${alreadyInitialised ? "start" : "init+start"} failed: ${errMsg}` + (detail ? `
   ${detail}` : "") + sharedMemHint
@@ -11185,14 +11608,17 @@ async function runMigrations2(databaseUrl, opts = {}) {
   const { runMigrations: migrate2 } = await Promise.resolve().then(() => (init_migrate(), migrate_exports));
   await migrate2(databaseUrl, opts);
 }
-var LEGACY_PG_PASSWORD, PG_USER, PG_DATABASE;
+var LEGACY_PG_PASSWORD, PG_USER, PG_DATABASE, READY_TIMEOUT_MS;
 var init_postgres = __esm({
   "src/lib/postgres.ts"() {
     "use strict";
     init_config();
+    init_pg_logging();
+    init_orphans();
     LEGACY_PG_PASSWORD = "nodalai";
     PG_USER = "nodalai";
     PG_DATABASE = "nodalai";
+    READY_TIMEOUT_MS = 18e4;
   }
 });
 
@@ -14335,6 +14761,22 @@ var init_agents = __esm({
         // (Memory Sprint 2). Pure char budget — token estimation done at call site
         // (length/4). 1500 chars ≈ ~375 tokens, similar to Hermes' 2200+1375 split.
         memoryTokenBudget: integer("memory_token_budget").default(1500).notNull(),
+        /**
+         * La réflexion (boucle d'apprentissage de skills) pour CET agent.
+         *
+         * `null` = suivre le réglage du propriétaire (`entities.reflection_enabled`),
+         * qui est le comportement historique et reste le défaut. `false` = jamais,
+         * même quand le propriétaire l'a activée. `true` n'est pas un
+         * contournement : la porte de l'entité s'applique toujours au-dessus.
+         *
+         * Existe parce que la réflexion était TOUT ou RIEN par propriétaire. Sur le
+         * run 20b73ed1 (09/09), un relecteur qui avait rendu « approve » sans le
+         * moindre constat a déclenché trois appels de réflexion à 0,041 $ — 12 % de
+         * la facture du run, pour apprendre d'un travail qui n'avait rien à
+         * apprendre. Un agent dont le métier est de juger n'accumule pas de savoir-
+         * faire réutilisable ; c'est celui qui PRODUIT qui en accumule.
+         */
+        reflectionEnabled: boolean("reflection_enabled"),
         // Daily budget for coding-CLI runs (code_task, étape B of the
         // subscription-runtimes plan), in NOTIONAL USD — the cost the claude CLI
         // reports even under subscription (codex reports none; its runs count 0
@@ -14588,6 +15030,19 @@ var init_jobs = __esm({
         requestId: text("request_id"),
         parentJobId: uuid("parent_job_id"),
         parentRequestId: text("parent_request_id"),
+        /**
+         * Temps où le job a réellement TOURNÉ, cumulé sur tous ses segments —
+         * suspensions exclues. Un job qui délègue ou attend une approbation sort de
+         * `executeJob` et y rentre plus tard : chaque rentrée ajoute son segment,
+         * elle ne remplace pas le total (apps/runner/src/job/execute.ts,
+         * `dureeCumuleeMs`).
+         *
+         * Ce n'est PAS le temps écoulé de bout en bout. Celui-là se lit
+         * `completed_at − created_at` et ne mérite pas une colonne. La distinction
+         * compte : sur le run 20b73ed1 (09/09/2026), l'orchestrateur a tourné une
+         * trentaine de secondes pour 34 minutes écoulées — le reste était de
+         * l'attente, et les deux chiffres disent des choses différentes.
+         */
         totalDurationMs: integer("total_duration_ms").default(0),
         inputTokens: integer("input_tokens").default(0),
         outputTokens: integer("output_tokens").default(0),
@@ -16530,10 +16985,10 @@ var init_transaction = __esm({
 
 // ../../packages/secrets/src/index.ts
 import { createCipheriv, createDecipheriv, randomBytes as randomBytes2 } from "crypto";
-import { chmodSync as chmodSync2, existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
+import { chmodSync as chmodSync2, existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
 import { execFileSync as execFileSync2 } from "child_process";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname3, join as join5 } from "path";
+import { dirname as dirname3, join as join6 } from "path";
 function restrictFileToOwner2(path) {
   try {
     chmodSync2(path, 384);
@@ -16548,15 +17003,15 @@ function restrictFileToOwner2(path) {
   }
 }
 function masterKeyPath() {
-  return join5(homedir2(), ".nodalai", "secrets.key");
+  return join6(homedir2(), ".nodalai", "secrets.key");
 }
 function masterKeyFileMissing(path = masterKeyPath()) {
-  return !existsSync5(path);
+  return !existsSync6(path);
 }
 function loadOrCreateMasterKey(path = masterKeyPath()) {
   if (cachedMasterKey) return cachedMasterKey;
-  if (existsSync5(path)) {
-    const raw = readFileSync4(path, "utf-8").trim();
+  if (existsSync6(path)) {
+    const raw = readFileSync5(path, "utf-8").trim();
     const buf2 = Buffer.from(raw, "base64");
     if (buf2.length !== KEY_BYTES) {
       throw new Error(
@@ -16567,9 +17022,9 @@ function loadOrCreateMasterKey(path = masterKeyPath()) {
     return buf2;
   }
   const dir = dirname3(path);
-  if (!existsSync5(dir)) mkdirSync3(dir, { recursive: true });
+  if (!existsSync6(dir)) mkdirSync4(dir, { recursive: true });
   const buf = randomBytes2(KEY_BYTES);
-  writeFileSync3(path, buf.toString("base64"), { mode: 384 });
+  writeFileSync4(path, buf.toString("base64"), { mode: 384 });
   restrictFileToOwner2(path);
   cachedMasterKey = buf;
   return buf;
@@ -16833,7 +17288,7 @@ var init_master_key_guard = __esm({
 });
 
 // ../../packages/db/src/queries/channel-identity.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 async function resolveOwnerConversation(db, agentId, channel) {
   if (channel === "telegram") {
     const [row2] = await db.select({ chatId: telegramAllowedChats.chatId }).from(telegramAllowedChats).where(
@@ -16909,7 +17364,7 @@ function credentialsFingerprint(creds) {
   const canonical = JSON.stringify(
     Object.keys(creds).sort().map((k) => [k, creds[k]])
   );
-  return createHash("sha256").update(canonical).digest("hex");
+  return createHash2("sha256").update(canonical).digest("hex");
 }
 async function getBindingCredentials(db, agentId, channel) {
   if (channel === "telegram") {
@@ -17014,6 +17469,39 @@ var init_telegram_allowed = __esm({
   }
 });
 
+// ../../packages/db/src/queries/skill-approval-rules.ts
+async function dropApprovalRulesForDetachedSkill(db, params) {
+  const [skillRetiree] = await db.select({ requiredBuiltins: agentSkills.requiredBuiltins }).from(agentSkills).where(and(eq(agentSkills.id, params.skillId), eq(agentSkills.entityId, params.entityId))).limit(1);
+  const debloquesParLaSkill = skillRetiree?.requiredBuiltins ?? [];
+  if (debloquesParLaSkill.length === 0) return [];
+  const encoreDebloques = new Set(
+    (await db.select({ requiredBuiltins: agentSkills.requiredBuiltins }).from(agentSkillAssignments).innerJoin(agentSkills, eq(agentSkills.id, agentSkillAssignments.skillId)).where(
+      and(
+        eq(agentSkillAssignments.agentId, params.agentId),
+        eq(agentSkillAssignments.entityId, params.entityId)
+      )
+    )).flatMap((r) => r.requiredBuiltins ?? [])
+  );
+  const candidats = debloquesParLaSkill.filter((t) => !encoreDebloques.has(t));
+  if (candidats.length === 0) return [];
+  const retirees = await db.delete(approvalRules).where(
+    and(
+      eq(approvalRules.entityId, params.entityId),
+      eq(approvalRules.agentId, params.agentId),
+      eq(approvalRules.action, "auto_approve"),
+      inArray(approvalRules.toolName, candidats)
+    )
+  ).returning({ toolName: approvalRules.toolName });
+  return retirees.map((r) => r.toolName);
+}
+var init_skill_approval_rules = __esm({
+  "../../packages/db/src/queries/skill-approval-rules.ts"() {
+    "use strict";
+    init_drizzle_orm();
+    init_schema2();
+  }
+});
+
 // ../../packages/db/src/queries/mcp-approval-context.ts
 function slugToPrefix(slug) {
   return slug.replace(/[^a-z0-9]+/gi, "_").toLowerCase();
@@ -17547,6 +18035,7 @@ __export(src_exports, {
   decryptChannelSecret: () => decryptChannelSecret,
   decryptCredentialForDisplay: () => decryptCredentialForDisplay,
   desc: () => desc,
+  dropApprovalRulesForDetachedSkill: () => dropApprovalRulesForDetachedSkill,
   encryptChannelCredentials: () => encryptChannelCredentials,
   encryptChannelSecret: () => encryptChannelSecret,
   entities: () => entities,
@@ -17628,6 +18117,7 @@ var init_src4 = __esm({
     init_master_key_guard();
     init_telegram_owner();
     init_telegram_allowed();
+    init_skill_approval_rules();
     init_mcp_approval_context();
     init_channel_identity();
     init_agents2();
@@ -17692,7 +18182,7 @@ var init_local_auth = __esm({
 });
 
 // ../../packages/auth/src/lib/constant-time.ts
-import { createHash as createHash2, timingSafeEqual } from "crypto";
+import { createHash as createHash3, timingSafeEqual } from "crypto";
 var init_constant_time = __esm({
   "../../packages/auth/src/lib/constant-time.ts"() {
     "use strict";
@@ -17865,22 +18355,44 @@ var init_env = __esm({
 });
 
 // src/lib/ports.ts
+var ports_exports = {};
+__export(ports_exports, {
+  DEFAULT_PORTS: () => DEFAULT_PORTS,
+  findFreePort: () => findFreePort,
+  formatPortRotation: () => formatPortRotation,
+  isPortBindable: () => isPortBindable,
+  pidListeningOnPort: () => pidListeningOnPort
+});
 import { createServer } from "net";
+async function pidListeningOnPort(port) {
+  const { execa: execa4 } = await import("execa");
+  try {
+    const { stdout } = await execa4("netstat", ["-ano"], { reject: false });
+    for (const line2 of stdout.split(/\r?\n/)) {
+      const m = line2.match(/\s+TCP\s+\S+:(\d+)\s+\S+\s+LISTENING\s+(\d+)/);
+      if (m && m[1] && m[2] && Number.parseInt(m[1], 10) === port) {
+        return Number.parseInt(m[2], 10);
+      }
+    }
+  } catch {
+  }
+  return null;
+}
 function isPortBindable(port) {
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     const server = createServer();
-    server.once("error", () => resolve3(false));
+    server.once("error", () => resolve4(false));
     try {
       server.listen(port, "127.0.0.1", () => {
-        server.close(() => resolve3(true));
+        server.close(() => resolve4(true));
       });
     } catch {
-      resolve3(false);
+      resolve4(false);
     }
   });
 }
 function findFreePort(preferred, maxAttempts = 20) {
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     let attempt = 0;
     const tryPort = (port) => {
       if (attempt >= maxAttempts) {
@@ -17896,7 +18408,7 @@ function findFreePort(preferred, maxAttempts = 20) {
       server.listen(port, "127.0.0.1", () => {
         const addr = server.address();
         const actualPort = typeof addr === "object" && addr ? addr.port : port;
-        server.close(() => resolve3(actualPort));
+        server.close(() => resolve4(actualPort));
       });
       server.on("error", () => {
         tryPort(port + 1);
@@ -17905,59 +18417,309 @@ function findFreePort(preferred, maxAttempts = 20) {
     tryPort(preferred);
   });
 }
+function formatPortRotation(changes) {
+  const lines = [];
+  for (const c of changes) {
+    lines.push(`  - ${c.name}: ${c.from} \u2192 ${c.to}`);
+    if (c.heldBy === null) continue;
+    lines.push(
+      `    :${c.from} is STILL HELD by pid ${c.heldBy}, which was not stopped: nothing here could confirm what it is.`,
+      `    It is left running and the port is abandoned, not freed. Check that pid and stop it yourself if it is ours.`
+    );
+  }
+  return lines;
+}
+var DEFAULT_PORTS;
 var init_ports = __esm({
   "src/lib/ports.ts"() {
     "use strict";
+    DEFAULT_PORTS = {
+      web: 3e3,
+      runner: 3001,
+      postgres: 25432
+    };
   }
 });
 
-// src/lib/log-rotation.ts
-import { existsSync as existsSync6, renameSync, rmSync, statSync } from "fs";
-function rotateLogIfNeeded(logFile, maxBytes = LOG_ROTATE_MAX_BYTES) {
+// src/lib/watchdog.ts
+var watchdog_exports = {};
+__export(watchdog_exports, {
+  probeRunnerHealth: () => probeRunnerHealth,
+  startHealthWatchdog: () => startHealthWatchdog
+});
+async function probeRunnerHealth(runnerUrl) {
   try {
-    if (!existsSync6(logFile)) return false;
-    if (statSync(logFile).size < maxBytes) return false;
-    const archived = `${logFile}.1`;
-    rmSync(archived, { force: true });
-    renameSync(logFile, archived);
-    return true;
+    const controller = new AbortController();
+    const t = setTimeout(() => controller.abort(), 3e3);
+    const res = await fetch(`${runnerUrl}/api/health`, { signal: controller.signal });
+    clearTimeout(t);
+    if (res.status === 200) return { state: "healthy", detail: "" };
+    const body = await res.json().catch(() => null);
+    const detail = body?.db === "error" ? "database unreachable (runner reports db: error)" : `runner is unhealthy (HTTP ${res.status})`;
+    return { state: "degraded", detail };
   } catch (err) {
-    console.warn(
-      `[nodalai] log rotation skipped for ${logFile}: ${err instanceof Error ? err.message : String(err)}`
-    );
-    return false;
-  }
-}
-var LOG_ROTATE_MAX_BYTES;
-var init_log_rotation = __esm({
-  "src/lib/log-rotation.ts"() {
-    "use strict";
-    LOG_ROTATE_MAX_BYTES = 20 * 1024 * 1024;
+    const aborted = err instanceof Error && err.name === "AbortError";
+    return {
+      state: "unreachable",
+      detail: aborted ? "runner did not answer /api/health within 3s (busy or stalled)" : "runner is not answering /api/health"
+    };
   }
-});
-
-// src/lib/processes.ts
-import { execa as execa2 } from "execa";
-import { createWriteStream, openSync, writeFileSync as writeFileSync4, readFileSync as readFileSync5, existsSync as existsSync7 } from "fs";
-import { join as join6, dirname as dirname4, resolve } from "path";
-import { fileURLToPath as fileURLToPath3 } from "url";
-async function killProcessTree(child) {
-  const pid = child.pid;
-  if (!pid) return;
-  await killPidTree(pid);
-}
-async function descendantPidsWin(root, timeoutMs) {
-  const snapshot2 = await processSnapshotWin(timeoutMs);
-  return walkDescendants(snapshot2, root).map((p) => p.pid);
 }
-async function processSnapshotWin(timeoutMs = SNAPSHOT_BUDGET_MS) {
-  if (process.platform !== "win32") return /* @__PURE__ */ new Map();
-  if (!inFlightSnapshot) {
-    inFlightSnapshot = readProcessTableWin(timeoutMs).finally(() => {
-      inFlightSnapshot = null;
-    });
-  }
-  return inFlightSnapshot;
+function startHealthWatchdog(opts) {
+  const intervalMs = opts.intervalMs ?? 3e4;
+  const failureThreshold = opts.failureThreshold ?? 2;
+  let announced = "healthy";
+  let consecutiveFailures = 0;
+  let stopped = false;
+  let inFlight = false;
+  const tick = async () => {
+    if (stopped || inFlight) return;
+    inFlight = true;
+    try {
+      const result = await opts.probe();
+      if (stopped) return;
+      if (result.state === "healthy") {
+        consecutiveFailures = 0;
+        if (announced !== "healthy") {
+          announced = "healthy";
+          opts.onTransition("healthy", "services are answering again");
+        }
+        return;
+      }
+      consecutiveFailures += 1;
+      if (consecutiveFailures < failureThreshold) return;
+      if (announced !== result.state) {
+        announced = result.state;
+        opts.onTransition(result.state, result.detail);
+      }
+    } finally {
+      inFlight = false;
+    }
+  };
+  const timer2 = setInterval(() => void tick(), intervalMs);
+  timer2.unref?.();
+  return {
+    stop: () => {
+      stopped = true;
+      clearInterval(timer2);
+    }
+  };
+}
+var init_watchdog = __esm({
+  "src/lib/watchdog.ts"() {
+    "use strict";
+  }
+});
+
+// src/lib/already-running.ts
+function decideStart(evidence) {
+  if (!evidence.runnerHealthy || evidence.postmasterPid === null) return { proceed: true };
+  return {
+    proceed: false,
+    reason: "ALREADY_RUNNING",
+    message: formatAlreadyRunning(evidence)
+  };
+}
+function formatAlreadyRunning(evidence) {
+  const parts = [
+    evidence.runnerPid === null ? null : `runner pid ${evidence.runnerPid}`,
+    evidence.webPid === null ? null : `web pid ${evidence.webPid}`,
+    `postgres pid ${String(evidence.postmasterPid)}`
+  ].filter((p) => p !== null);
+  const runnerRef = evidence.runnerPid === null ? "that port" : `pid ${evidence.runnerPid}`;
+  return `Nodal-Agents looks already running (${parts.join(", ")}) \u2014 use \`nodal-agents down\` first.
+  Nothing was stopped, and nothing was signalled.
+  What was observed, and only that: something answered /api/health with 200 on the
+  configured runner port, and postmaster.pid in our data directory names a live
+  postmaster. That is usually this install, up and serving.
+  If it is NOT yours: check ${runnerRef} to see whose server is on that port, free the
+  port or change it in ~/.nodalai/config.json, then run \`up\` again.`;
+}
+async function decideStartFromProbes(opts) {
+  const { livePostmasterPid: livePostmasterPid2 } = await Promise.resolve().then(() => (init_postgres(), postgres_exports));
+  const postmasterPid = livePostmasterPid2(opts.dataDir);
+  if (postmasterPid === null) return { proceed: true };
+  const { probeRunnerHealth: probeRunnerHealth2 } = await Promise.resolve().then(() => (init_watchdog(), watchdog_exports));
+  const health = await probeRunnerHealth2(`http://127.0.0.1:${opts.runnerPort}`);
+  if (health.state !== "healthy") return { proceed: true };
+  const { pidListeningOnPort: pidListeningOnPort2 } = await Promise.resolve().then(() => (init_ports(), ports_exports));
+  return decideStart({
+    runnerHealthy: true,
+    postmasterPid,
+    runnerPid: await pidListeningOnPort2(opts.runnerPort),
+    webPid: await pidListeningOnPort2(opts.webPort)
+  });
+}
+var AlreadyRunningError;
+var init_already_running = __esm({
+  "src/lib/already-running.ts"() {
+    "use strict";
+    AlreadyRunningError = class extends Error {
+      reason = "ALREADY_RUNNING";
+      constructor(message) {
+        super(message);
+        this.name = "AlreadyRunningError";
+      }
+    };
+  }
+});
+
+// src/lib/pid-confirm.ts
+function confirmRecordedPid(input) {
+  const { recorded, live, tableRead, ownedPostgresPids: ownedPostgresPids2 } = input;
+  if (!tableRead) {
+    return {
+      killable: false,
+      code: "TABLE_UNREADABLE",
+      detail: `pid ${recorded.pid} could not be confirmed: the process table did not answer`
+    };
+  }
+  if (live === void 0) {
+    return {
+      killable: false,
+      code: "PID_GONE",
+      detail: `pid ${recorded.pid} is no longer running`
+    };
+  }
+  if (isPostgresExe(live.name) && !ownedPostgresPids2.has(live.pid)) {
+    return {
+      killable: false,
+      code: "FOREIGN_POSTGRES",
+      detail: `pid ${recorded.pid} is a ${live.name} that our data dir does not claim`
+    };
+  }
+  if (recorded.name !== void 0 && !sameExe(recorded.name, live.name)) {
+    return {
+      killable: false,
+      code: "BINARY_CHANGED",
+      detail: `pid ${recorded.pid} was recorded as ${recorded.name} and now runs ${live.name}`
+    };
+  }
+  if (recorded.startedAt !== void 0 && recorded.startedAt !== live.startedAt) {
+    return {
+      killable: false,
+      code: "PID_RECYCLED",
+      detail: `pid ${recorded.pid} started at ${live.startedAt}, recorded at ${recorded.startedAt}`
+    };
+  }
+  if (recorded.startedAt === void 0 && recorded.name === void 0) {
+    return {
+      killable: false,
+      code: "IDENTITY_NOT_RECORDED",
+      detail: `pid ${recorded.pid} was recorded as a bare number: nothing identifies it now`
+    };
+  }
+  return OK;
+}
+function sameExe(a, b2) {
+  return a.toLowerCase() === b2.toLowerCase();
+}
+function isPostgresExe(name) {
+  return sameExe(name, POSTGRES_EXE);
+}
+function confirmTree(root, members, ownedPostgresPids2) {
+  const verdict = confirmRecordedPid(root);
+  const foreign = [];
+  const killable = [];
+  for (const member of members) {
+    if (isPostgresExe(member.name) && !ownedPostgresPids2.has(member.pid)) foreign.push(member);
+    else killable.push(member);
+  }
+  return {
+    root: verdict,
+    treeKillAllowed: verdict.killable && foreign.length === 0,
+    foreign,
+    killable
+  };
+}
+function formatRefusal(refusal) {
+  return `KILL_REFUSED code=${refusal.code} ${refusal.detail}`;
+}
+function unconfirmedIdentityNotice(label, pid) {
+  return `${label} (pid ${pid}) \u2014 no process table on this platform to confirm it with`;
+}
+var OK, POSTGRES_EXE;
+var init_pid_confirm = __esm({
+  "src/lib/pid-confirm.ts"() {
+    "use strict";
+    OK = { killable: true };
+    POSTGRES_EXE = "postgres.exe";
+  }
+});
+
+// src/lib/log-rotation.ts
+import { existsSync as existsSync7, renameSync as renameSync2, rmSync, statSync as statSync2 } from "fs";
+function rotateLogIfNeeded(logFile, maxBytes = LOG_ROTATE_MAX_BYTES) {
+  try {
+    if (!existsSync7(logFile)) return false;
+    if (statSync2(logFile).size < maxBytes) return false;
+    const archived = `${logFile}.1`;
+    rmSync(archived, { force: true });
+    renameSync2(logFile, archived);
+    return true;
+  } catch (err) {
+    console.warn(
+      `[nodalai] log rotation skipped for ${logFile}: ${err instanceof Error ? err.message : String(err)}`
+    );
+    return false;
+  }
+}
+var LOG_ROTATE_MAX_BYTES;
+var init_log_rotation = __esm({
+  "src/lib/log-rotation.ts"() {
+    "use strict";
+    LOG_ROTATE_MAX_BYTES = 20 * 1024 * 1024;
+  }
+});
+
+// src/lib/launcher-log.ts
+import { appendFileSync } from "fs";
+import { join as join7 } from "path";
+function formatLauncherLine(at, event, detail) {
+  return `${at.toISOString()} ${event} ${detail.replace(/\s*\r?\n\s*/g, " ").trim()}
+`;
+}
+function logLauncherEvent(event, detail) {
+  try {
+    rotateLogIfNeeded(LAUNCHER_LOG);
+    appendFileSync(LAUNCHER_LOG, formatLauncherLine(/* @__PURE__ */ new Date(), event, detail), "utf-8");
+  } catch {
+  }
+}
+var LAUNCHER_LOG;
+var init_launcher_log = __esm({
+  "src/lib/launcher-log.ts"() {
+    "use strict";
+    init_config();
+    init_log_rotation();
+    LAUNCHER_LOG = join7(LOG_DIR, "launcher.log");
+  }
+});
+
+// src/lib/processes.ts
+import { execa as execa2 } from "execa";
+import { createWriteStream, openSync, writeFileSync as writeFileSync5, readFileSync as readFileSync6, existsSync as existsSync8 } from "fs";
+import { join as join8, dirname as dirname4, resolve as resolve2 } from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
+function asLiveRecord(rec) {
+  return { pid: rec.pid, startedAt: rec.startedAt, name: rec.name ?? "" };
+}
+function asLive(rec) {
+  return rec === void 0 ? void 0 : asLiveRecord(rec);
+}
+async function killProcessTree(child) {
+  const pid = child.pid;
+  if (!pid) return;
+  await killPidTree(pid);
+}
+async function processSnapshotWin(timeoutMs = SNAPSHOT_BUDGET_MS) {
+  if (process.platform !== "win32") return /* @__PURE__ */ new Map();
+  if (!inFlightSnapshot) {
+    inFlightSnapshot = readProcessTableWin(timeoutMs).finally(() => {
+      inFlightSnapshot = null;
+    });
+  }
+  return inFlightSnapshot;
 }
 async function readProcessTableWin(timeoutMs) {
   const out = /* @__PURE__ */ new Map();
@@ -17997,12 +18759,13 @@ async function readProcessTableWin(timeoutMs) {
     }
     for (const line2 of rows.split(/\r?\n/)) {
       const parts = line2.trim().split("|");
-      if (parts.length !== 3) continue;
+      if (parts.length !== 4) continue;
       const pid = Number.parseInt(parts[0] ?? "", 10);
       const ppid = Number.parseInt(parts[1] ?? "", 10);
       const startedAt = (parts[2] ?? "").trim();
+      const name = (parts[3] ?? "").trim();
       if (!Number.isInteger(pid) || !Number.isInteger(ppid) || startedAt === "") continue;
-      out.set(pid, { pid, ppid, startedAt });
+      out.set(pid, { pid, ppid, startedAt, name });
     }
     if (out.size > 0) {
       lastSnapshotFailure = null;
@@ -18036,17 +18799,105 @@ function walkDescendants(snapshot2, root) {
   }
   return out;
 }
-async function killPidTree(pid) {
+async function ownedPostgres() {
+  const { postgresProcessesForDataDir: postgresProcessesForDataDir2 } = await Promise.resolve().then(() => (init_postgres(), postgres_exports));
+  return new Set((await postgresProcessesForDataDir2()).owned);
+}
+async function ownedPostgresIfAnyInvolved(candidates) {
+  const EMPTY = /* @__PURE__ */ new Set();
+  const anyPostgres = candidates.some((c) => (c.name ?? "").toLowerCase() === "postgres.exe");
+  return anyPostgres ? await ownedPostgres() : EMPTY;
+}
+function vetoesRoot(code, fromRecord) {
+  if (ROOT_KILL_VETO.has(code)) return true;
+  return fromRecord && code === "IDENTITY_NOT_RECORDED";
+}
+async function reconfirmMembers(members, rootPid, ownedPostgresPids2) {
+  const fresh = await processSnapshotWin(SHUTDOWN_SNAPSHOT_BUDGET_MS);
+  if (fresh.size === 0) {
+    process.stderr.write(
+      `KILL_UNCONFIRMED code=TABLE_UNREADABLE pid=${rootPid} the tree members are swept on the earlier reading: the table would not answer a second time
+`
+    );
+    return [...members];
+  }
+  const out = [];
+  for (const member of members) {
+    const verdict = confirmRecordedPid({
+      // An empty name is a row WMI gave us without one; offering it as a
+      // recorded name would read as "it changed" the moment the second reading
+      // has one. One less proof, never a false refusal.
+      recorded: {
+        pid: member.pid,
+        startedAt: member.startedAt,
+        ...member.name === "" ? {} : { name: member.name }
+      },
+      live: asLive(fresh.get(member.pid)),
+      tableRead: true,
+      ownedPostgresPids: ownedPostgresPids2
+    });
+    if (verdict.killable) {
+      out.push(member);
+      continue;
+    }
+    if (verdict.code !== "PID_GONE") process.stderr.write(`${formatRefusal(verdict)}
+`);
+  }
+  return out;
+}
+async function killPidTree(pid, ownedPostgresPids2, recorded) {
   if (process.platform === "win32") {
-    const descendants = await descendantPidsWin(pid, SHUTDOWN_SNAPSHOT_BUDGET_MS);
-    try {
-      await execa2("taskkill", ["/T", "/F", "/PID", String(pid)], { reject: false });
-    } catch {
+    const snapshot2 = await processSnapshotWin(SHUTDOWN_SNAPSHOT_BUDGET_MS);
+    const descendants = walkDescendants(snapshot2, pid);
+    const owned = ownedPostgresPids2 ?? await ownedPostgresIfAnyInvolved([...descendants, snapshot2.get(pid) ?? {}]);
+    const fromRecord = recorded !== void 0;
+    const { treeKillAllowed, root, foreign, killable } = confirmTree(
+      {
+        recorded: recorded ?? { pid },
+        live: asLive(snapshot2.get(pid)),
+        tableRead: snapshot2.size > 0,
+        ownedPostgresPids: owned
+      },
+      descendants.map(asLiveRecord),
+      owned
+    );
+    if (!root.killable && root.code === "TABLE_UNREADABLE") {
+      if (fromRecord) {
+        process.stderr.write(`${formatRefusal(root)}
+`);
+        return;
+      }
+      process.stderr.write(
+        `KILL_UNCONFIRMED code=TABLE_UNREADABLE pid=${pid} is a live handle, not a record: the tree kill proceeds with the identity unconfirmed
+`
+      );
     }
-    for (const child of descendants) {
-      if (!isPidAlive(child)) continue;
+    const rootVetoed = !root.killable && vetoesRoot(root.code, fromRecord);
+    if (rootVetoed) process.stderr.write(`${formatRefusal(root)}
+`);
+    const rootGone = !root.killable && root.code === "PID_GONE";
+    for (const stranger of foreign) {
+      process.stderr.write(
+        `KILL_REFUSED code=FOREIGN_POSTGRES pid=${stranger.pid} is a ${stranger.name} in the tree of pid ${pid} that our data dir does not claim; the tree kill was done pid by pid around it
+`
+      );
+    }
+    if (treeKillAllowed) {
+      try {
+        await execa2("taskkill", ["/T", "/F", "/PID", String(pid)], { reject: false });
+      } catch {
+      }
+    } else if (!rootVetoed && !rootGone) {
+      try {
+        await execa2("taskkill", ["/F", "/PID", String(pid)], { reject: false });
+      } catch {
+      }
+    }
+    const vouched = killable.length > 0 ? await reconfirmMembers(killable, pid, owned) : [];
+    for (const child of vouched) {
+      if (!isPidAlive(child.pid)) continue;
       try {
-        await execa2("taskkill", ["/F", "/PID", String(child)], { reject: false });
+        await execa2("taskkill", ["/F", "/PID", String(child.pid)], { reject: false });
       } catch {
       }
     }
@@ -18087,14 +18938,14 @@ function resolveAppDir(appName) {
   const fileDir = dirname4(here);
   let cursor = fileDir;
   for (let i = 0; i < 8; i++) {
-    if (existsSync7(join6(cursor, "pnpm-workspace.yaml"))) {
-      return join6(cursor, appName);
+    if (existsSync8(join8(cursor, "pnpm-workspace.yaml"))) {
+      return join8(cursor, appName);
     }
     const parent = dirname4(cursor);
     if (parent === cursor) break;
     cursor = parent;
   }
-  return resolve(fileDir, "..", "..", "..", "..", appName);
+  return resolve2(fileDir, "..", "..", "..", "..", appName);
 }
 function spawnWiring(logFile, detach) {
   if (!detach) return { stdin: "ignore", stdout: "pipe", stderr: "pipe", detached: false };
@@ -18105,7 +18956,7 @@ function spawnWiring(logFile, detach) {
   };
 }
 function spawnRunner(env, opts = {}) {
-  const logFile = join6(LOG_DIR, "runner.log");
+  const logFile = join8(LOG_DIR, "runner.log");
   rotateLogIfNeeded(logFile);
   const outStream = createWriteStream(logFile, { flags: "a" });
   let bin;
@@ -18113,7 +18964,7 @@ function spawnRunner(env, opts = {}) {
   let cwd;
   if (BUNDLED_ROOT) {
     bin = process.execPath;
-    args = [join6(BUNDLED_ROOT, "runner.js")];
+    args = [join8(BUNDLED_ROOT, "runner.js")];
     cwd = BUNDLED_ROOT;
   } else {
     const runnerDir = resolveAppDir("apps/runner");
@@ -18151,7 +19002,7 @@ env keys: ${Object.keys(env).join(",")}
   return child;
 }
 function spawnWeb(env, opts = {}) {
-  const logFile = join6(LOG_DIR, "web.log");
+  const logFile = join8(LOG_DIR, "web.log");
   rotateLogIfNeeded(logFile);
   const outStream = createWriteStream(logFile, { flags: "a" });
   let bin;
@@ -18160,8 +19011,8 @@ function spawnWeb(env, opts = {}) {
   let modeLabel;
   if (BUNDLED_ROOT) {
     bin = process.execPath;
-    args = [join6(BUNDLED_ROOT, "web", "server.js")];
-    cwd = join6(BUNDLED_ROOT, "web");
+    args = [join8(BUNDLED_ROOT, "web", "server.js")];
+    cwd = join8(BUNDLED_ROOT, "web");
     modeLabel = "bundled-standalone";
   } else {
     const webDir = resolveAppDir("apps/web");
@@ -18200,33 +19051,52 @@ env keys: ${Object.keys(env).join(",")}
 }
 function resolveLocalBin(packageDir, binName) {
   const ext = process.platform === "win32" ? ".CMD" : "";
-  return join6(packageDir, "node_modules", ".bin", `${binName}${ext}`);
+  return join8(packageDir, "node_modules", ".bin", `${binName}${ext}`);
 }
 async function recordServiceTree(pids) {
   if (process.platform !== "win32") return;
   const snapshot2 = await processSnapshotWin();
   if (snapshot2.size === 0) return;
   const children = [];
+  const roots = [];
   const seen = /* @__PURE__ */ new Set();
   for (const root of [pids.runner, pids.web]) {
     if (!root) continue;
-    for (const rec of walkDescendants(snapshot2, root)) {
-      if (seen.has(rec.pid)) continue;
-      seen.add(rec.pid);
-      children.push(rec);
+    const rec = snapshot2.get(root);
+    if (rec) roots.push(rec);
+    for (const rec2 of walkDescendants(snapshot2, root)) {
+      if (seen.has(rec2.pid)) continue;
+      seen.add(rec2.pid);
+      children.push(rec2);
     }
   }
-  writePids({ ...pids, children });
+  writePids({ ...pids, children, roots });
+}
+function recordedRoot(pids, pid) {
+  const found = pids?.roots?.find((r) => r.pid === pid);
+  if (!found) return { pid };
+  return { pid, startedAt: found.startedAt, ...found.name ? { name: found.name } : {} };
 }
-async function sweepRecordedChildren(children) {
+async function sweepRecordedChildren(children, ownedPostgresPids2) {
   if (process.platform !== "win32" || children.length === 0) return [];
   const alive = children.filter((c) => isPidAlive(c.pid));
   if (alive.length === 0) return [];
   const snapshot2 = await processSnapshotWin();
+  const tableRead = snapshot2.size > 0;
+  const owned = ownedPostgresPids2 ?? await ownedPostgresIfAnyInvolved(alive.flatMap((rec) => [rec, snapshot2.get(rec.pid) ?? {}]));
   const killed = [];
   for (const rec of alive) {
-    const now = snapshot2.get(rec.pid);
-    if (!now || now.startedAt !== rec.startedAt) continue;
+    const verdict = confirmRecordedPid({
+      recorded: rec,
+      live: asLive(snapshot2.get(rec.pid)),
+      tableRead,
+      ownedPostgresPids: owned
+    });
+    if (!verdict.killable) {
+      if (verdict.code !== "PID_GONE") process.stderr.write(`${formatRefusal(verdict)}
+`);
+      continue;
+    }
     try {
       await execa2("taskkill", ["/F", "/PID", String(rec.pid)], { reject: false });
       killed.push(rec.pid);
@@ -18236,21 +19106,21 @@ async function sweepRecordedChildren(children) {
   return killed;
 }
 function writePids(pids) {
-  writeFileSync4(join6(PID_DIR, "processes.json"), JSON.stringify(pids, null, 2), "utf-8");
+  writeFileSync5(join8(PID_DIR, "processes.json"), JSON.stringify(pids, null, 2), "utf-8");
 }
 function readPids() {
-  const pidFile = join6(PID_DIR, "processes.json");
-  if (!existsSync7(pidFile)) return null;
+  const pidFile = join8(PID_DIR, "processes.json");
+  if (!existsSync8(pidFile)) return null;
   try {
-    return JSON.parse(readFileSync5(pidFile, "utf-8"));
+    return JSON.parse(readFileSync6(pidFile, "utf-8"));
   } catch {
     return null;
   }
 }
 function clearPids() {
-  const pidFile = join6(PID_DIR, "processes.json");
-  if (existsSync7(pidFile)) {
-    writeFileSync4(pidFile, JSON.stringify({}), "utf-8");
+  const pidFile = join8(PID_DIR, "processes.json");
+  if (existsSync8(pidFile)) {
+    writeFileSync5(pidFile, JSON.stringify({}), "utf-8");
   }
 }
 async function waitForHealth(url, timeoutMs = 3e4) {
@@ -18290,12 +19160,13 @@ async function assertWebRenders(url, timeoutMs = 3e5) {
 function sleep(ms) {
   return new Promise((r) => setTimeout(r, ms));
 }
-var SNAPSHOT_BUDGET_MS, SHUTDOWN_SNAPSHOT_BUDGET_MS, inFlightSnapshot, PROCESS_TABLE_QUERIES, lastSnapshotFailure, BUNDLED_ROOT;
+var SNAPSHOT_BUDGET_MS, SHUTDOWN_SNAPSHOT_BUDGET_MS, inFlightSnapshot, PROCESS_TABLE_QUERIES, lastSnapshotFailure, ROOT_KILL_VETO, BUNDLED_ROOT;
 var init_processes = __esm({
   "src/lib/processes.ts"() {
     "use strict";
     init_config();
     init_log_rotation();
+    init_pid_confirm();
     SNAPSHOT_BUDGET_MS = 2e4;
     SHUTDOWN_SNAPSHOT_BUDGET_MS = 6e3;
     inFlightSnapshot = null;
@@ -18303,7 +19174,7 @@ var init_processes = __esm({
       {
         name: "Get-CimInstance",
         // -Property keeps WMI from materialising every column of every process.
-        command: 'Get-CimInstance Win32_Process -Property ProcessId,ParentProcessId,CreationDate | ForEach-Object { "$($_.ProcessId)|$($_.ParentProcessId)|$($_.CreationDate.Ticks)" }'
+        command: 'Get-CimInstance Win32_Process -Property ProcessId,ParentProcessId,CreationDate,Name | ForEach-Object { "$($_.ProcessId)|$($_.ParentProcessId)|$($_.CreationDate.Ticks)|$($_.Name)" }'
       },
       {
         name: "Get-WmiObject",
@@ -18321,82 +19192,22 @@ var init_processes = __esm({
         // (The obvious alternative, Get-Process | $_.Parent, was tried first and
         // does not exist before PowerShell 6. It returned empty parents for every
         // row, which the parser correctly discarded.)
-        command: 'Get-WmiObject Win32_Process | ForEach-Object { "$($_.ProcessId)|$($_.ParentProcessId)|$($_.ConvertToDateTime($_.CreationDate).Ticks)" }'
+        command: 'Get-WmiObject Win32_Process | ForEach-Object { "$($_.ProcessId)|$($_.ParentProcessId)|$($_.ConvertToDateTime($_.CreationDate).Ticks)|$($_.Name)" }'
       }
     ];
     lastSnapshotFailure = null;
+    ROOT_KILL_VETO = /* @__PURE__ */ new Set([
+      "FOREIGN_POSTGRES",
+      "BINARY_CHANGED",
+      "PID_RECYCLED"
+    ]);
     BUNDLED_ROOT = (() => {
       const here = dirname4(fileURLToPath3(import.meta.url));
-      return existsSync7(join6(here, "runner.js")) ? here : null;
+      return existsSync8(join8(here, "runner.js")) ? here : null;
     })();
   }
 });
 
-// src/lib/watchdog.ts
-async function probeRunnerHealth(runnerUrl) {
-  try {
-    const controller = new AbortController();
-    const t = setTimeout(() => controller.abort(), 3e3);
-    const res = await fetch(`${runnerUrl}/api/health`, { signal: controller.signal });
-    clearTimeout(t);
-    if (res.status === 200) return { state: "healthy", detail: "" };
-    const body = await res.json().catch(() => null);
-    const detail = body?.db === "error" ? "database unreachable (runner reports db: error)" : `runner is unhealthy (HTTP ${res.status})`;
-    return { state: "degraded", detail };
-  } catch (err) {
-    const aborted = err instanceof Error && err.name === "AbortError";
-    return {
-      state: "unreachable",
-      detail: aborted ? "runner did not answer /api/health within 3s (busy or stalled)" : "runner is not answering /api/health"
-    };
-  }
-}
-function startHealthWatchdog(opts) {
-  const intervalMs = opts.intervalMs ?? 3e4;
-  const failureThreshold = opts.failureThreshold ?? 2;
-  let announced = "healthy";
-  let consecutiveFailures = 0;
-  let stopped = false;
-  let inFlight = false;
-  const tick = async () => {
-    if (stopped || inFlight) return;
-    inFlight = true;
-    try {
-      const result = await opts.probe();
-      if (stopped) return;
-      if (result.state === "healthy") {
-        consecutiveFailures = 0;
-        if (announced !== "healthy") {
-          announced = "healthy";
-          opts.onTransition("healthy", "services are answering again");
-        }
-        return;
-      }
-      consecutiveFailures += 1;
-      if (consecutiveFailures < failureThreshold) return;
-      if (announced !== result.state) {
-        announced = result.state;
-        opts.onTransition(result.state, result.detail);
-      }
-    } finally {
-      inFlight = false;
-    }
-  };
-  const timer2 = setInterval(() => void tick(), intervalMs);
-  timer2.unref?.();
-  return {
-    stop: () => {
-      stopped = true;
-      clearInterval(timer2);
-    }
-  };
-}
-var init_watchdog = __esm({
-  "src/lib/watchdog.ts"() {
-    "use strict";
-  }
-});
-
 // src/commands/up.ts
 var up_exports = {};
 __export(up_exports, {
@@ -18406,20 +19217,20 @@ import chalk from "chalk";
 import ora from "ora";
 import open from "open";
 import { randomBytes as randomBytes4 } from "crypto";
-import { existsSync as existsSync8, readFileSync as readFileSync6 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync7 } from "fs";
+import { join as join9 } from "path";
 async function killSilent(child) {
   await killProcessTree(child);
 }
 function printLogTail(service, lines) {
-  const logFile = join7(LOG_DIR, `${service}.log`);
+  const logFile = join9(LOG_DIR, `${service}.log`);
   try {
-    if (!existsSync8(logFile)) {
+    if (!existsSync9(logFile)) {
       console.error(chalk.gray(`
   ${service}: no log at ${logFile}`));
       return;
     }
-    const tail = readFileSync6(logFile, "utf-8").split(/\r?\n/).filter((l) => l.trim() !== "").slice(-lines);
+    const tail = readFileSync7(logFile, "utf-8").split(/\r?\n/).filter((l) => l.trim() !== "").slice(-lines);
     if (tail.length === 0) {
       console.error(chalk.gray(`
   ${service}: log is empty (${logFile})`));
@@ -18434,20 +19245,6 @@ function printLogTail(service, lines) {
   ${service}: could not read ${logFile}`));
   }
 }
-async function pidListeningOnPort(port) {
-  const { execa: execa4 } = await import("execa");
-  try {
-    const { stdout } = await execa4("netstat", ["-ano"], { reject: false });
-    for (const line2 of stdout.split(/\r?\n/)) {
-      const m = line2.match(/\s+TCP\s+\S+:(\d+)\s+\S+\s+LISTENING\s+(\d+)/);
-      if (m && m[1] && m[2] && Number.parseInt(m[1], 10) === port) {
-        return Number.parseInt(m[2], 10);
-      }
-    }
-  } catch {
-  }
-  return null;
-}
 async function runUp(opts = {}) {
   let config = readConfig();
   if (!config) {
@@ -18469,8 +19266,19 @@ async function runUp(opts = {}) {
     config = defaultConfig;
   }
   resolveAuthMode(config);
+  const startVerdict = await decideStartFromProbes({
+    runnerPort: config.ports.runner,
+    webPort: config.ports.web,
+    dataDir: PG_DATA_DIR
+  });
+  if (!startVerdict.proceed) {
+    logLauncherEvent("refused-kill", `already-running runner=${config.ports.runner}`);
+    throw new AlreadyRunningError(startVerdict.message);
+  }
   const known = readPids();
-  const leftovers = await sweepRecordedChildren(known?.children ?? []);
+  const pgTable2 = await postgresProcessesForDataDir();
+  const ownedPgPids = new Set(pgTable2.owned);
+  const leftovers = await sweepRecordedChildren(known?.children ?? [], ownedPgPids);
   if (leftovers.length > 0) {
     console.log(
       chalk.gray(`  Cleaned up ${leftovers.length} process(es) left by the previous session`)
@@ -18484,16 +19292,21 @@ async function runUp(opts = {}) {
   for (const root of [...ourPids]) {
     for (const rec of walkDescendants(snapshot2, root)) ourPids.add(rec.pid);
   }
-  const orphans = [];
-  const strangers = [];
+  const listeners = [];
   for (const [name, port] of [
     ["web", config.ports.web],
     ["runner", config.ports.runner],
     ["postgres", config.ports.postgres]
   ]) {
     const pid = await pidListeningOnPort(port);
-    if (pid === null) continue;
-    if (ourPids.has(pid) || name === "postgres") orphans.push({ name, port, pid });
+    if (pid !== null) listeners.push({ name, port, pid });
+  }
+  const isOurPostmasterPid = (pid) => ownedPgPids.has(pid);
+  const orphans = [];
+  const strangers = [];
+  for (const { name, port, pid } of listeners) {
+    const ours = name === "postgres" ? isOurPostmasterPid(pid) : ourPids.has(pid);
+    if (ours) orphans.push({ name, port, pid });
     else strangers.push({ name, port, pid });
   }
   if (strangers.length > 0) {
@@ -18508,14 +19321,25 @@ ${lines}
   }
   if (!orphans.some((o) => o.name === "postgres")) {
     const pgPid = livePostmasterPid();
-    if (pgPid !== null) {
-      orphans.push({ name: "postgres", port: config.ports.postgres, pid: pgPid });
+    if (pgPid !== null && isOurPostmasterPid(pgPid)) {
+      orphans.push({ name: "postgres", port: measuredPort(pgPid, listeners), pid: pgPid });
+    } else if (pgPid !== null) {
+      console.log(
+        chalk.yellow(
+          `  - postmaster.pid in ${PG_DATA_DIR} names pid ${pgPid}, which has not been seen
+    to exit. Its identity could NOT be confirmed: its start time differs from
+    the one recorded, or it does not run out of that directory, or at least
+    one of those two could not be read. Nothing was stopped. If Postgres then
+    fails to start, check that pid yourself (its executable, its start time,
+    which cluster it serves) and stop it through its owner rather than killing
+    the number.`
+        )
+      );
     }
   }
-  if (!orphans.some((o) => o.name === "postgres")) {
-    for (const pid of await postgresPidsForDataDir()) {
-      orphans.push({ name: "postgres", port: config.ports.postgres, pid });
-    }
+  for (const pid of ownedPgPids) {
+    if (orphans.some((o) => o.pid === pid)) continue;
+    orphans.push({ name: "postgres", port: measuredPort(pid, listeners), pid });
   }
   if (orphans.length > 0) {
     console.log(
@@ -18524,13 +19348,33 @@ ${lines}
       )
     );
     for (const o of orphans) {
-      console.log(chalk.gray(`  - ${o.name} on :${o.port} (pid ${o.pid})`));
+      console.log(
+        chalk.gray(
+          o.port === null ? `  - ${o.name} for our data dir (pid ${o.pid}, listening on none of our ports)` : `  - ${o.name} on :${o.port} (pid ${o.pid})`
+        )
+      );
     }
     console.log(chalk.yellow("Cleaning up before starting\u2026"));
-    const { execa: execa4 } = await import("execa");
-    const pgOrphan = orphans.find((o) => o.name === "postgres");
-    if (pgOrphan) {
-      await stopOrphanPostgres();
+    const pgOrphans = orphans.filter((o) => o.name === "postgres");
+    const postmasterPid = pgOrphans[0]?.pid;
+    if (postmasterPid !== void 0) {
+      const confirmedNow = new Set((await postgresProcessesForDataDir()).owned);
+      if (confirmedNow.has(postmasterPid)) await stopOrphanPostgres(postmasterPid);
+    }
+    const leftAlone = [];
+    const unconfirmed = [];
+    for (const pgOrphan of pgOrphans) {
+      const stillOurs = new Set((await postgresProcessesForDataDir()).owned);
+      if (!stillOurs.has(pgOrphan.pid)) {
+        if (!isPidAlive(pgOrphan.pid)) continue;
+        leftAlone.push(pgOrphan.pid);
+        console.log(
+          chalk.yellow(
+            `  - postgres pid ${pgOrphan.pid} is alive but can no longer be confirmed as ours; it was NOT stopped`
+          )
+        );
+        continue;
+      }
       if (isPidAlive(pgOrphan.pid)) {
         try {
           process.kill(pgOrphan.pid, "SIGKILL");
@@ -18546,12 +19390,31 @@ ${lines}
         );
       }
     }
+    const tableAvailable = process.platform === "win32";
+    const table = tableAvailable ? await processSnapshotWin() : /* @__PURE__ */ new Map();
     for (const o of orphans) {
       if (o.name === "postgres") continue;
+      const live = table.get(o.pid);
+      const verdict = !tableAvailable ? { killable: true } : confirmRecordedPid({
+        recorded: recordedRoot(known, o.pid),
+        live: live === void 0 ? void 0 : { pid: live.pid, startedAt: live.startedAt, name: live.name ?? "" },
+        tableRead: table.size > 0,
+        ownedPostgresPids: ownedPgPids
+      });
+      if (!verdict.killable) {
+        if (verdict.code !== "PID_GONE") {
+          unconfirmed.push(o.pid);
+          console.log(chalk.yellow(`  - ${o.name} pid ${o.pid} was NOT killed: ${verdict.detail}`));
+          process.stderr.write(`${formatRefusal(verdict)}
+`);
+        }
+        continue;
+      }
       try {
         if (process.platform === "win32") {
-          await execa4("taskkill", ["/T", "/F", "/PID", String(o.pid)], { reject: false });
+          await killPidTree(o.pid, ownedPgPids, recordedRoot(known, o.pid));
         } else {
+          console.log(chalk.gray(`  - ${unconfirmedIdentityNotice(o.name, o.pid)}`));
           process.kill(o.pid, "SIGKILL");
         }
       } catch {
@@ -18562,6 +19425,7 @@ ${lines}
     while (Date.now() < deadline) {
       stillHeld = [];
       for (const o of orphans) {
+        if (o.port === null) continue;
         const pid = await pidListeningOnPort(o.port);
         if (pid !== null) stillHeld.push({ ...o, pid });
       }
@@ -18571,7 +19435,30 @@ ${lines}
     if (stillHeld.length > 0) {
       const list = stillHeld.map((o) => `${o.name}:${o.port}=${o.pid}`).join(", ");
       console.log(chalk.yellow(`Some ports still held (likely Windows ghost sockets): ${list}.`));
+      const alsoLeft = [...leftAlone, ...unconfirmed];
+      if (alsoLeft.length > 0) {
+        console.log(
+          chalk.yellow(`Also left running, unconfirmed as ours: ${alsoLeft.join(", ")}.`)
+        );
+      }
       console.log(chalk.gray("Will rotate to free neighbours below.\n"));
+    } else if (leftAlone.length > 0 || unconfirmed.length > 0) {
+      if (leftAlone.length > 0) {
+        console.log(
+          chalk.yellow(
+            `Ports are free, but ${leftAlone.length} postgres process(es) were left running (${leftAlone.join(", ")}): they could not be confirmed as ours.
+`
+          )
+        );
+      }
+      if (unconfirmed.length > 0) {
+        console.log(
+          chalk.yellow(
+            `${unconfirmed.length} recorded process(es) were left running (${unconfirmed.join(", ")}): the pid no longer identifies what we started.
+`
+          )
+        );
+      }
     } else {
       console.log(chalk.green("Orphans cleaned up.\n"));
     }
@@ -18581,13 +19468,18 @@ ${lines}
     const configured = config.ports[name];
     if (await isPortBindable(configured)) continue;
     const next = await findFreePort(configured + 1);
-    portChanges.push({ name, from: configured, to: next });
+    portChanges.push({
+      name,
+      from: configured,
+      to: next,
+      heldBy: await pidListeningOnPort(configured)
+    });
     config.ports[name] = next;
   }
   if (portChanges.length > 0) {
     console.log(chalk.yellow("Configured ports unavailable \u2014 rotating:"));
-    for (const c of portChanges) {
-      console.log(chalk.gray(`  - ${c.name}: ${c.from} \u2192 ${c.to}`));
+    for (const line2 of formatPortRotation(portChanges)) {
+      console.log(line2.trimStart().startsWith("-") ? chalk.gray(line2) : chalk.yellow(line2));
     }
     writeConfig(config);
     console.log(chalk.gray("  Updated ~/.nodalai/config.json.\n"));
@@ -18610,9 +19502,10 @@ ${lines}
     runner: null,
     web: null
   };
-  const shutdown = async () => {
+  const shutdown = async (cause = "signal") => {
     if (shuttingDown) return;
     shuttingDown = true;
+    logLauncherEvent("shutdown", `cause=${cause}`);
     console.log("\n" + chalk.yellow("  Stopping Nodal-Agents\u2026"));
     const recorded = readPids()?.children ?? [];
     await Promise.allSettled(
@@ -18627,8 +19520,8 @@ ${lines}
     console.log(chalk.green("  Stopped. Goodbye!"));
     process.exit(0);
   };
-  process.on("SIGINT", () => void shutdown());
-  process.on("SIGTERM", () => void shutdown());
+  process.on("SIGINT", () => void shutdown("SIGINT"));
+  process.on("SIGTERM", () => void shutdown("SIGTERM"));
   let effectivePgPassword = pgPassword;
   if (pendingRotation) {
     writeConfig({ ...config, postgresPassword: pendingRotation });
@@ -18748,7 +19641,7 @@ ${lines}
       const installed = getInstalledVersion2();
       const latest = await Promise.race([
         getLatestVersion2(),
-        new Promise((resolve3) => setTimeout(() => resolve3(null), 3e3))
+        new Promise((resolve4) => setTimeout(() => resolve4(null), 3e3))
       ]);
       if (latest !== null && isNewerVersion2(latest, installed)) {
         console.log(chalk.cyan(`  \u2139 v${latest} available \u2014 run \`nodal-agents update\``));
@@ -18763,14 +19656,20 @@ ${lines}
     }
   }
   console.log("");
+  logLauncherEvent(
+    "started",
+    `web=${webUrl} runner=${runnerUrl} mode=${opts.detach ? "detached" : "foreground"}`
+  );
   console.log(chalk.bold.green(`  Nodal-Agents ready at ${webUrl}`));
   if (config.bind === "lan") {
     console.log(chalk.cyan(`  LAN mode \u2014 sign up at ${webUrl}/login`));
   }
   if (opts.detach) {
+    logLauncherEvent("detached", `web=${webUrl} runner=${runnerUrl}`);
     console.log(chalk.gray("  Detached \u2014 the terminal is yours again."));
     console.log(chalk.gray("  nodal-agents logs runner   follow a service"));
     console.log(chalk.gray("  nodal-agents down          stop everything"));
+    console.log(chalk.gray(`  ${LAUNCHER_LOG}   what the launcher saw`));
     console.log("");
     process.exit(0);
   }
@@ -18780,6 +19679,7 @@ ${lines}
     probe: () => probeRunnerHealth(runnerUrl),
     onTransition: (state, detail) => {
       const at = (/* @__PURE__ */ new Date()).toLocaleTimeString();
+      logLauncherEvent(state === "healthy" ? "recovered" : "degraded", `state=${state} ${detail}`);
       if (state === "healthy") {
         console.log(chalk.green(`
   [${at}] Recovered \u2014 ${detail}.`));
@@ -18800,9 +19700,13 @@ ${lines}
       );
     }
   });
-  await Promise.race([runnerProcess, webProcess]);
+  const exited = await Promise.race([
+    runnerProcess.then(() => "runner").catch(() => "runner"),
+    webProcess.then(() => "web").catch(() => "web")
+  ]);
+  logLauncherEvent("child-exited", `service=${exited}`);
   watchdog.stop();
-  await shutdown();
+  await shutdown(`${exited} exited`);
 }
 var init_up = __esm({
   "src/commands/up.ts"() {
@@ -18812,6 +19716,10 @@ var init_up = __esm({
     init_seed();
     init_env();
     init_ports();
+    init_orphans();
+    init_already_running();
+    init_pid_confirm();
+    init_launcher_log();
     init_processes();
     init_src4();
     init_watchdog();
@@ -19099,17 +20007,49 @@ var init_init = __esm({
 // src/commands/down.ts
 var down_exports = {};
 __export(down_exports, {
-  runDown: () => runDown
+  runDown: () => runDown,
+  stopWithinBudget: () => stopWithinBudget
 });
 import chalk3 from "chalk";
-import { existsSync as existsSync9 } from "fs";
-import { join as join8 } from "path";
-async function killPid(pid, label) {
+import { existsSync as existsSync10 } from "fs";
+import { join as join10 } from "path";
+function liveOf(snapshot2, pid) {
+  const rec = snapshot2.get(pid);
+  return rec === void 0 ? void 0 : { pid: rec.pid, startedAt: rec.startedAt, name: rec.name ?? "" };
+}
+async function killPid(pid, label, ctx) {
   if (!isPidAlive(pid)) {
     console.log(chalk3.gray(`  ${label} (pid ${pid}) was already stopped`));
     return false;
   }
-  await killPidTree(pid);
+  if (!ctx.tableAvailable) {
+    console.log(chalk3.gray(`  ${unconfirmedIdentityNotice(label, pid)}`));
+    await killPidTree(pid, ctx.ownedPostgresPids);
+    if (isPidAlive(pid)) {
+      console.log(chalk3.red(`  ${label} (pid ${pid}) is STILL RUNNING after SIGTERM then SIGKILL`));
+      return false;
+    }
+    console.log(chalk3.green(`  Stopped ${label} (pid ${pid})`));
+    return true;
+  }
+  const verdict = confirmRecordedPid({
+    recorded: recordedRoot(ctx.pids, pid),
+    live: liveOf(ctx.snapshot, pid),
+    tableRead: ctx.snapshot.size > 0,
+    ownedPostgresPids: ctx.ownedPostgresPids
+  });
+  if (!verdict.killable) {
+    console.log(
+      chalk3.yellow(
+        `  ${label} (pid ${pid}) was NOT stopped \u2014 ${verdict.detail}.
+    Nodal-Agents does not kill a pid it cannot identify. Nothing was signalled.`
+      )
+    );
+    process.stderr.write(`${formatRefusal(verdict)}
+`);
+    return false;
+  }
+  await killPidTree(pid, ctx.ownedPostgresPids, recordedRoot(ctx.pids, pid));
   if (isPidAlive(pid)) {
     console.log(chalk3.red(`  ${label} (pid ${pid}) is STILL RUNNING after SIGTERM then SIGKILL`));
     return false;
@@ -19117,10 +20057,30 @@ async function killPid(pid, label) {
   console.log(chalk3.green(`  Stopped ${label} (pid ${pid})`));
   return true;
 }
-async function stopPostgresGracefully() {
-  const pidFile = join8(PG_DATA_DIR, "postmaster.pid");
-  if (!existsSync9(pidFile)) return false;
+async function stopWithinBudget(pg, budgetMs) {
+  return await Promise.race([
+    pg.stop().then(() => true).catch(() => true),
+    new Promise((resolve4) => setTimeout(() => resolve4(false), budgetMs))
+  ]);
+}
+async function stopPostgresGracefully(ctx) {
+  const pidFile = join10(PG_DATA_DIR, "postmaster.pid");
+  if (!existsSync10(pidFile)) return false;
   const pgPid = readPostmasterPid(PG_DATA_DIR);
+  const confirmed = pgPid !== null && ctx.ownedPostgresPids.has(pgPid);
+  const refused = pgPid !== null && !confirmed && ctx.postgresReadingWorked;
+  if (refused) {
+    console.log(
+      chalk3.yellow(
+        `  postgres (pid ${pgPid}) was NOT stopped \u2014 postmaster.pid names it, but a fresh
+    reading could not confirm it belongs to ${PG_DATA_DIR}.
+    Nothing was signalled. Check that pid yourself before touching it.`
+      )
+    );
+    process.stderr.write(`KILL_REFUSED code=FOREIGN_POSTGRES pid=${pgPid} lockfile=${pidFile}
+`);
+    return false;
+  }
   try {
     const EmbeddedPostgres = (await import("embedded-postgres")).default;
     const pg = new EmbeddedPostgres({
@@ -19136,7 +20096,15 @@ async function stopPostgresGracefully() {
       onLog: () => {
       }
     });
-    await pg.stop();
+    if (!await stopWithinBudget(pg, GRACEFUL_STOP_BUDGET_MS)) {
+      console.log(
+        chalk3.yellow(
+          `  postgres (pid ${pgPid ?? "unknown"}) did not finish a graceful stop within ${GRACEFUL_STOP_BUDGET_MS / 1e3}s.
+    A postmaster that is recovering from a crashed backend can take longer than
+    that. Nothing else was signalled; what it is doing now is reported below.`
+        )
+      );
+    }
     const pgGone = pgPid === null || await waitForPidDead(pgPid, 15e3);
     if (!pgGone) {
       const killCmd = process.platform === "win32" ? `powershell Stop-Process -Id ${pgPid} -Force` : `kill -9 ${pgPid}`;
@@ -19144,7 +20112,9 @@ async function stopPostgresGracefully() {
         chalk3.red(
           `  postgres (pid ${pgPid}) is STILL RUNNING after a graceful stop
     It holds the shared-memory block for the data dir, so the next \`up\` will fail.
-    Fix: ${killCmd}`
+` + (confirmed ? `    Fix: ${killCmd}` : `    Its identity could NOT be confirmed, so no kill command is suggested:
+    check that pid yourself (its executable, its start time, which cluster
+    it serves) and stop it through its owner.`)
         )
       );
       return false;
@@ -19158,15 +20128,23 @@ async function stopPostgresGracefully() {
 }
 async function runDown() {
   const pids = readPids();
+  const pgReading = await postgresProcessesForDataDir();
+  const ctx = {
+    pids,
+    tableAvailable: process.platform === "win32",
+    snapshot: await processSnapshotWin(),
+    ownedPostgresPids: new Set(pgReading.owned),
+    postgresReadingWorked: pgReading.read
+  };
   let stopped = 0;
-  if (pids?.runner) stopped += await killPid(pids.runner, "runner") ? 1 : 0;
-  if (pids?.web) stopped += await killPid(pids.web, "web") ? 1 : 0;
-  const swept = await sweepRecordedChildren(pids?.children ?? []);
+  if (pids?.runner) stopped += await killPid(pids.runner, "runner", ctx) ? 1 : 0;
+  if (pids?.web) stopped += await killPid(pids.web, "web", ctx) ? 1 : 0;
+  const swept = await sweepRecordedChildren(pids?.children ?? [], ctx.ownedPostgresPids);
   if (swept.length > 0) {
     console.log(chalk3.green(`  Stopped ${swept.length} background worker(s) left behind`));
     stopped += swept.length;
   }
-  if (await stopPostgresGracefully()) stopped++;
+  if (await stopPostgresGracefully(ctx)) stopped++;
   clearPids();
   if (stopped === 0) {
     console.log(chalk3.yellow("No running Nodal-Agents processes found."));
@@ -19174,12 +20152,15 @@ async function runDown() {
   }
   console.log(chalk3.green("\n  Nodal-Agents stopped."));
 }
+var GRACEFUL_STOP_BUDGET_MS;
 var init_down = __esm({
   "src/commands/down.ts"() {
     "use strict";
     init_processes();
     init_config();
     init_postgres();
+    init_pid_confirm();
+    GRACEFUL_STOP_BUDGET_MS = 6e4;
   }
 });
 
@@ -19189,8 +20170,8 @@ __export(logs_exports, {
   runLogs: () => runLogs
 });
 import chalk4 from "chalk";
-import { existsSync as existsSync10, createReadStream, watch, statSync as statSync2 } from "fs";
-import { join as join9 } from "path";
+import { existsSync as existsSync11, createReadStream, watch, statSync as statSync3 } from "fs";
+import { join as join11 } from "path";
 function isServiceName(s) {
   return VALID_SERVICES.includes(s);
 }
@@ -19202,34 +20183,34 @@ async function runLogs(service) {
   }
   const services = target === "all" ? VALID_SERVICES : [target];
   for (const svc of services) {
-    const logFile = join9(LOG_DIR, `${svc}.log`);
-    if (!existsSync10(logFile)) {
+    const logFile = join11(LOG_DIR, `${svc}.log`);
+    if (!existsSync11(logFile)) {
       console.log(chalk4.gray(`  [${svc}] No log file yet at ${logFile}`));
       continue;
     }
     console.log(chalk4.bold(`
 --- ${svc} ---`));
-    await new Promise((resolve3, reject) => {
+    await new Promise((resolve4, reject) => {
       const stream = createReadStream(logFile, { encoding: "utf-8" });
       stream.on("data", (chunk) => process.stdout.write(chunk));
-      stream.on("end", resolve3);
+      stream.on("end", resolve4);
       stream.on("error", reject);
     });
   }
   if (target !== "all") {
-    const logFile = join9(LOG_DIR, `${target}.log`);
-    if (!existsSync10(logFile)) {
+    const logFile = join11(LOG_DIR, `${target}.log`);
+    if (!existsSync11(logFile)) {
       console.log(chalk4.yellow("Waiting for log file to be created\u2026"));
     }
     console.log(chalk4.gray("\nFollowing log (Ctrl+C to stop)...\n"));
     let fileSize = 0;
     try {
-      fileSize = statSync2(logFile).size;
+      fileSize = statSync3(logFile).size;
     } catch {
     }
     const watcher = watch(logFile, () => {
       try {
-        const newSize = statSync2(logFile).size;
+        const newSize = statSync3(logFile).size;
         if (newSize > fileSize) {
           const stream = createReadStream(logFile, { start: fileSize, encoding: "utf-8" });
           stream.on("data", (chunk) => process.stdout.write(chunk));
@@ -19254,10 +20235,10 @@ var init_logs = __esm({
 
 // ../../packages/checkpoints/src/checkpoints.ts
 import { execFile, spawn } from "child_process";
-import { createHash as createHash3, randomBytes as randomBytes6 } from "crypto";
+import { createHash as createHash4, randomBytes as randomBytes6 } from "crypto";
 import { mkdir, rm, writeFile } from "fs/promises";
-import { existsSync as existsSync11 } from "fs";
-import { join as join10 } from "path";
+import { existsSync as existsSync12 } from "fs";
+import { join as join12 } from "path";
 import { promisify } from "util";
 function workspaceKey(workspace) {
   let norm = workspace;
@@ -19265,18 +20246,18 @@ function workspaceKey(workspace) {
     norm = norm.toLowerCase().replace(/\//g, "\\");
   }
   norm = norm.replace(/[\\/]+$/, "");
-  return createHash3("sha256").update(norm).digest("hex").slice(0, 16);
+  return createHash4("sha256").update(norm).digest("hex").slice(0, 16);
 }
 function gitEnv(store, workspace, indexFile) {
   const key = workspaceKey(workspace);
   return {
     ...process.env,
-    GIT_DIR: join10(store, "store"),
+    GIT_DIR: join12(store, "store"),
     GIT_WORK_TREE: workspace,
     // A per-workspace index: two workspaces snapshotting at once must not
     // stomp on each other's staging area. A READ (diffFile) brings its own
     // temporary index instead — see diffFile — so it never touches this one.
-    GIT_INDEX_FILE: indexFile ?? join10(store, "indexes", key),
+    GIT_INDEX_FILE: indexFile ?? join12(store, "indexes", key),
     // A checkpoint is machinery, not authorship. Identity is fixed so it can
     // never depend on — or leak — the owner's git config.
     GIT_AUTHOR_NAME: "Nodal checkpoints",
@@ -19284,8 +20265,8 @@ function gitEnv(store, workspace, indexFile) {
     GIT_COMMITTER_NAME: "Nodal checkpoints",
     GIT_COMMITTER_EMAIL: "checkpoints@nodal.local",
     // The owner's global config must not change what we store or how.
-    GIT_CONFIG_GLOBAL: join10(store, "gitconfig"),
-    GIT_CONFIG_SYSTEM: join10(store, "gitconfig")
+    GIT_CONFIG_GLOBAL: join12(store, "gitconfig"),
+    GIT_CONFIG_SYSTEM: join12(store, "gitconfig")
   };
 }
 async function git(store, workspace, args, indexFile) {
@@ -19297,17 +20278,17 @@ async function git(store, workspace, args, indexFile) {
   return stdout.trim();
 }
 async function ensureStore(store) {
-  const gitDir = join10(store, "store");
-  await mkdir(join10(store, "indexes"), { recursive: true });
-  await writeFile(join10(store, "gitconfig"), "", { flag: "a" });
-  if (!existsSync11(join10(gitDir, "HEAD"))) {
+  const gitDir = join12(store, "store");
+  await mkdir(join12(store, "indexes"), { recursive: true });
+  await writeFile(join12(store, "gitconfig"), "", { flag: "a" });
+  if (!existsSync12(join12(gitDir, "HEAD"))) {
     await mkdir(gitDir, { recursive: true });
     await run("git", ["init", "--bare", "--quiet", gitDir], {
       timeout: GIT_TIMEOUT_MS,
       windowsHide: true
     });
-    await mkdir(join10(gitDir, "info"), { recursive: true });
-    await writeFile(join10(gitDir, "info", "exclude"), EXCLUDES.join("\n") + "\n", "utf-8");
+    await mkdir(join12(gitDir, "info"), { recursive: true });
+    await writeFile(join12(gitDir, "info", "exclude"), EXCLUDES.join("\n") + "\n", "utf-8");
   }
 }
 async function snapshot(store, workspace, label) {
@@ -19333,7 +20314,7 @@ async function snapshot(store, workspace, label) {
   return { sha, workspace, at, label };
 }
 async function listCheckpoints(store, workspace, limit = 20) {
-  if (!existsSync11(join10(store, "store", "HEAD"))) return [];
+  if (!existsSync12(join12(store, "store", "HEAD"))) return [];
   const ref = `refs/nodal/${workspaceKey(workspace)}`;
   const out = await git(store, workspace, [
     "log",
@@ -19376,9 +20357,9 @@ var init_checkpoints = __esm({
 
 // ../../packages/checkpoints/src/root.ts
 import { homedir as homedir3 } from "os";
-import { join as join11 } from "path";
+import { join as join13 } from "path";
 function checkpointsRoot() {
-  return process.env["NODALAI_CHECKPOINTS_ROOT"] ?? join11(homedir3(), ".nodalai", "checkpoints");
+  return process.env["NODALAI_CHECKPOINTS_ROOT"] ?? join13(homedir3(), ".nodalai", "checkpoints");
 }
 var init_root = __esm({
   "../../packages/checkpoints/src/root.ts"() {
@@ -19402,7 +20383,7 @@ __export(checkpoints_exports, {
   runCheckpointsRestore: () => runCheckpointsRestore
 });
 import chalk5 from "chalk";
-import { resolve as resolve2 } from "path";
+import { resolve as resolve3 } from "path";
 function ago(iso2) {
   const ms = Date.now() - new Date(iso2).getTime();
   const min2 = Math.round(ms / 6e4);
@@ -19413,7 +20394,7 @@ function ago(iso2) {
   return `${Math.round(h / 24)} d ago`;
 }
 async function runCheckpointsList(workspace) {
-  const ws = resolve2(workspace ?? process.cwd());
+  const ws = resolve3(workspace ?? process.cwd());
   const list = await listCheckpoints(checkpointsRoot(), ws);
   if (list.length === 0) {
     console.log(chalk5.yellow(`No checkpoints for ${ws}`));
@@ -19438,7 +20419,7 @@ Checkpoints for ${ws}
 `));
 }
 async function runCheckpointsRestore(sha, workspace) {
-  const ws = resolve2(workspace ?? process.cwd());
+  const ws = resolve3(workspace ?? process.cwd());
   const list = await listCheckpoints(checkpointsRoot(), ws, 200);
   const match = list.find((c) => c.sha.startsWith(sha));
   if (!match) {
@@ -23354,7 +24335,7 @@ var init_protocol = __esm({
               return;
             }
             const pollInterval = task2.pollInterval ?? this._options?.defaultTaskPollInterval ?? 1e3;
-            await new Promise((resolve3) => setTimeout(resolve3, pollInterval));
+            await new Promise((resolve4) => setTimeout(resolve4, pollInterval));
             options?.signal?.throwIfAborted();
           }
         } catch (error) {
@@ -23371,7 +24352,7 @@ var init_protocol = __esm({
        */
       request(request, resultSchema, options) {
         const { relatedRequestId, resumptionToken, onresumptiontoken, task, relatedTask } = options ?? {};
-        return new Promise((resolve3, reject) => {
+        return new Promise((resolve4, reject) => {
           const earlyReject = (error) => {
             reject(error);
           };
@@ -23449,7 +24430,7 @@ var init_protocol = __esm({
               if (!parseResult.success) {
                 reject(parseResult.error);
               } else {
-                resolve3(parseResult.data);
+                resolve4(parseResult.data);
               }
             } catch (error) {
               reject(error);
@@ -23710,12 +24691,12 @@ var init_protocol = __esm({
           }
         } catch {
         }
-        return new Promise((resolve3, reject) => {
+        return new Promise((resolve4, reject) => {
           if (signal.aborted) {
             reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
             return;
           }
-          const timeoutId = setTimeout(resolve3, interval2);
+          const timeoutId = setTimeout(resolve4, interval2);
           signal.addEventListener("abort", () => {
             clearTimeout(timeoutId);
             reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
@@ -26742,7 +27723,7 @@ var require_compile = __commonJS({
       const schOrFunc = root.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve3.call(this, root, ref);
+      let _sch = resolve4.call(this, root, ref);
       if (_sch === void 0) {
         const schema = (_a = root.localRefs) === null || _a === void 0 ? void 0 : _a[ref];
         const { schemaId } = this.opts;
@@ -26769,7 +27750,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s2) {
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
-    function resolve3(root, ref) {
+    function resolve4(root, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -26861,15 +27842,33 @@ var require_data = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/fast-uri@3.1.2/node_modules/fast-uri/lib/utils.js
+// ../../node_modules/.pnpm/fast-uri@3.1.6/node_modules/fast-uri/lib/utils.js
 var require_utils = __commonJS({
-  "../../node_modules/.pnpm/fast-uri@3.1.2/node_modules/fast-uri/lib/utils.js"(exports, module) {
+  "../../node_modules/.pnpm/fast-uri@3.1.6/node_modules/fast-uri/lib/utils.js"(exports, module) {
     "use strict";
     var isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu);
     var isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u);
     var isHexPair = RegExp.prototype.test.bind(/^[\da-f]{2}$/iu);
     var isUnreserved = RegExp.prototype.test.bind(/^[\da-z\-._~]$/iu);
-    var isPathCharacter = RegExp.prototype.test.bind(/^[\da-z\-._~!$&'()*+,;=:@/]$/iu);
+    var isPathCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:@/]$/u);
+    var isQueryFragmentCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:@/?]$/u);
+    var isUserinfoCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:]$/u);
+    var BYTE_HEX = new Array(256);
+    {
+      const HEX_DIGITS = "0123456789ABCDEF";
+      for (let i = 0; i < 256; i++) {
+        BYTE_HEX[i] = "%" + HEX_DIGITS[i >> 4] + HEX_DIGITS[i & 15];
+      }
+    }
+    function percentEncodeNonAscii(cp) {
+      if (cp < 2048) {
+        return BYTE_HEX[192 | cp >> 6] + BYTE_HEX[128 | cp & 63];
+      }
+      if (cp < 65536) {
+        return BYTE_HEX[224 | cp >> 12] + BYTE_HEX[128 | cp >> 6 & 63] + BYTE_HEX[128 | cp & 63];
+      }
+      return BYTE_HEX[240 | cp >> 18] + BYTE_HEX[128 | cp >> 12 & 63] + BYTE_HEX[128 | cp >> 6 & 63] + BYTE_HEX[128 | cp & 63];
+    }
     function stringArrayToHexStripped(input) {
       let acc = "";
       let code = 0;
@@ -26894,91 +27893,105 @@ var require_utils = __commonJS({
       }
       return acc;
     }
+    var isHextet = RegExp.prototype.test.bind(/^[\dA-Fa-f]{1,4}$/);
+    var isIPvFuture = RegExp.prototype.test.bind(/^[vV][\dA-Fa-f]+\.[A-Za-z\d\-._~!$&'()*+,;=:]+$/);
+    var isZoneCharacter = RegExp.prototype.test.bind(/^[A-Za-z\d\-._~]$/);
     var nonSimpleDomain = RegExp.prototype.test.bind(/[^!"$&'()*+,\-.;=_`a-z{}~]/u);
-    function consumeIsZone(buffer2) {
-      buffer2.length = 0;
-      return true;
-    }
-    function consumeHextets(buffer2, address, output) {
-      if (buffer2.length) {
-        const hex = stringArrayToHexStripped(buffer2);
-        if (hex !== "") {
-          address.push(hex);
-        } else {
-          output.error = true;
-          return false;
+    function isZoneIdentifier(zone) {
+      if (zone.length === 0) return false;
+      for (let i = 0; i < zone.length; i++) {
+        if (isZoneCharacter(zone[i])) continue;
+        if (zone[i] === "%" && i + 2 < zone.length && isHexPair(zone.slice(i + 1, i + 3))) {
+          i += 2;
+          continue;
         }
-        buffer2.length = 0;
+        return false;
       }
       return true;
     }
-    function getIPV6(input) {
-      let tokenCount = 0;
-      const output = { error: false, address: "", zone: "" };
-      const address = [];
-      const buffer2 = [];
-      let endipv6Encountered = false;
-      let endIpv6 = false;
-      let consume = consumeHextets;
-      for (let i = 0; i < input.length; i++) {
-        const cursor = input[i];
-        if (cursor === "[" || cursor === "]") {
-          continue;
-        }
-        if (cursor === ":") {
-          if (endipv6Encountered === true) {
-            endIpv6 = true;
-          }
-          if (!consume(buffer2, address, output)) {
-            break;
-          }
-          if (++tokenCount > 7) {
-            output.error = true;
-            break;
-          }
-          if (i > 0 && input[i - 1] === ":") {
-            endipv6Encountered = true;
+    function compressIPv6ZeroRun(hextets) {
+      let bestStart = -1;
+      let bestLength = 0;
+      let runStart = -1;
+      let runLength = 0;
+      for (let i = 0; i < hextets.length; i++) {
+        if (hextets[i] === "0") {
+          if (runStart === -1) runStart = i;
+          runLength++;
+          if (runLength > bestLength) {
+            bestLength = runLength;
+            bestStart = runStart;
           }
-          address.push(":");
-          continue;
-        } else if (cursor === "%") {
-          if (!consume(buffer2, address, output)) {
-            break;
-          }
-          consume = consumeIsZone;
         } else {
-          buffer2.push(cursor);
+          runStart = -1;
+          runLength = 0;
+        }
+      }
+      if (bestLength < 2) return hextets.join(":");
+      const head = hextets.slice(0, bestStart).join(":");
+      const tail = hextets.slice(bestStart + bestLength).join(":");
+      return head + "::" + tail;
+    }
+    function normalizeIPv6Address(input) {
+      const compression = input.indexOf("::");
+      if (compression !== -1 && input.indexOf("::", compression + 1) !== -1) return void 0;
+      const left = compression === -1 ? input.split(":") : input.slice(0, compression).split(":");
+      const right = compression === -1 ? [] : input.slice(compression + 2).split(":");
+      if (compression !== -1) {
+        if (left.length === 1 && left[0] === "") left.length = 0;
+        if (right.length === 1 && right[0] === "") right.length = 0;
+      }
+      const parts = left.concat(right);
+      let hextetCount = 0;
+      for (let i = 0; i < parts.length; i++) {
+        const part = parts[i];
+        if (part === "") return void 0;
+        if (part.indexOf(".") !== -1) {
+          if (i !== parts.length - 1 || compression !== -1 && right.length === 0 || !isIPv4(part)) return void 0;
+          hextetCount += 2;
           continue;
         }
+        if (!isHextet(part)) return void 0;
+        parts[i] = parseInt(part, 16).toString(16);
+        hextetCount++;
       }
-      if (buffer2.length) {
-        if (consume === consumeIsZone) {
-          output.zone = buffer2.join("");
-        } else if (endIpv6) {
-          address.push(buffer2.join(""));
-        } else {
-          address.push(stringArrayToHexStripped(buffer2));
-        }
+      if (compression === -1) {
+        if (hextetCount !== 8) return void 0;
+        return compressIPv6ZeroRun(parts);
       }
-      output.address = address.join("");
-      return output;
+      if (hextetCount >= 8) return void 0;
+      const expanded = parts.slice(0, left.length);
+      for (let i = hextetCount; i < 8; i++) expanded.push("0");
+      for (let i = left.length; i < parts.length; i++) expanded.push(parts[i]);
+      return compressIPv6ZeroRun(expanded);
     }
     function normalizeIPv6(host) {
-      if (findToken(host, ":") < 2) {
-        return { host, isIPV6: false };
-      }
-      const ipv6 = getIPV6(host);
-      if (!ipv6.error) {
-        let newHost = ipv6.address;
-        let escapedHost = ipv6.address;
-        if (ipv6.zone) {
-          newHost += "%" + ipv6.zone;
-          escapedHost += "%25" + ipv6.zone;
-        }
-        return { host: newHost, isIPV6: true, escapedHost };
-      } else {
-        return { host, isIPV6: false };
-      }
+      const bracketed = host[0] === "[" && host[host.length - 1] === "]";
+      const hasBracket = host[0] === "[" || host[host.length - 1] === "]";
+      if (hasBracket && !bracketed) return { host, isIPV6: false, error: true };
+      let input = bracketed ? host.slice(1, -1) : host;
+      if (bracketed && isIPvFuture(input)) {
+        input = input.toLowerCase();
+        return { host: `[${input}]`, escapedHost: input, isIPV6: false, isIPVFuture: true };
+      }
+      if (findToken(input, ":") < 2) {
+        return { host, isIPV6: false, error: bracketed };
+      }
+      let zoneIdentifier = "";
+      const zoneSeparator = input.indexOf("%");
+      if (zoneSeparator !== -1) {
+        const separatorLength = input.slice(zoneSeparator, zoneSeparator + 3).toLowerCase() === "%25" ? 3 : 1;
+        zoneIdentifier = input.slice(zoneSeparator + separatorLength);
+        if (!isZoneIdentifier(zoneIdentifier)) return { host, isIPV6: false, error: true };
+        input = input.slice(0, zoneSeparator);
+      }
+      const address = normalizeIPv6Address(input);
+      if (address === void 0) return { host, isIPV6: false, error: true };
+      return {
+        host: address + (zoneIdentifier ? "%" + zoneIdentifier : ""),
+        escapedHost: address + (zoneIdentifier ? "%25" + zoneIdentifier : ""),
+        isIPV6: true
+      };
     }
     function findToken(str, token) {
       let ind = 0;
@@ -27097,7 +28110,8 @@ var require_utils = __commonJS({
     function normalizePathEncoding(input) {
       let output = "";
       for (let i = 0; i < input.length; i++) {
-        if (input[i] === "%" && i + 2 < input.length) {
+        const ch = input[i];
+        if (ch === "%" && i + 2 < input.length) {
           const hex = input.slice(i + 1, i + 3);
           if (isHexPair(hex)) {
             const normalizedHex = hex.toUpperCase();
@@ -27111,10 +28125,152 @@ var require_utils = __commonJS({
             continue;
           }
         }
-        if (isPathCharacter(input[i])) {
-          output += input[i];
+        if (isPathCharacter(ch)) {
+          output += ch;
+        } else {
+          const code = input.charCodeAt(i);
+          if (code < 128) {
+            output += isEscapeSafe(code) ? ch : BYTE_HEX[code];
+          } else if (code < 55296 || code > 57343) {
+            output += percentEncodeNonAscii(code);
+          } else if (code <= 56319 && i + 1 < input.length) {
+            const low = input.charCodeAt(i + 1);
+            if (low >= 56320 && low <= 57343) {
+              output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+              i++;
+            } else {
+              output += percentEncodeNonAscii(65533);
+            }
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
+        }
+      }
+      return output;
+    }
+    function serializePathEncoding(input, pathNoScheme = false) {
+      let output = "";
+      let firstSegment = pathNoScheme && input[0] !== "/";
+      for (let i = 0; i < input.length; i++) {
+        const ch = input[i];
+        if (ch === "%" && i + 2 < input.length) {
+          const hex = input.slice(i + 1, i + 3);
+          if (isHexPair(hex)) {
+            output += "%" + hex.toUpperCase();
+            i += 2;
+            continue;
+          }
+        }
+        if (ch === "/") {
+          firstSegment = false;
+        }
+        if (isPathCharacter(ch) && (ch !== ":" || !firstSegment)) {
+          output += ch;
+        } else {
+          const code = input.charCodeAt(i);
+          if (code < 128) {
+            output += BYTE_HEX[code];
+          } else if (code < 55296 || code > 57343) {
+            output += percentEncodeNonAscii(code);
+          } else if (code <= 56319 && i + 1 < input.length) {
+            const low = input.charCodeAt(i + 1);
+            if (low >= 56320 && low <= 57343) {
+              output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+              i++;
+            } else {
+              output += percentEncodeNonAscii(65533);
+            }
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
+        }
+      }
+      return output;
+    }
+    function encodeComponent(input, isAllowed) {
+      let output = "";
+      for (let i = 0; i < input.length; i++) {
+        const ch = input[i];
+        if (ch === "%" && i + 2 < input.length) {
+          const hex = input.slice(i + 1, i + 3);
+          if (isHexPair(hex)) {
+            output += "%" + hex.toUpperCase();
+            i += 2;
+            continue;
+          }
+        }
+        if (isAllowed(ch)) {
+          output += ch;
+        } else {
+          const code = input.charCodeAt(i);
+          if (code < 128) {
+            output += BYTE_HEX[code];
+          } else if (code < 55296 || code > 57343) {
+            output += percentEncodeNonAscii(code);
+          } else if (code <= 56319 && i + 1 < input.length) {
+            const low = input.charCodeAt(i + 1);
+            if (low >= 56320 && low <= 57343) {
+              output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+              i++;
+            } else {
+              output += percentEncodeNonAscii(65533);
+            }
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
+        }
+      }
+      return output;
+    }
+    function encodeUserinfo(input) {
+      return encodeComponent(input, isUserinfoCharacter);
+    }
+    function encodeQuery(input) {
+      return encodeComponent(input, isQueryFragmentCharacter);
+    }
+    function encodeFragment(input) {
+      return encodeComponent(input, isQueryFragmentCharacter);
+    }
+    function isEscapeSafe(cp) {
+      return cp >= 48 && cp <= 57 || cp >= 65 && cp <= 90 || cp >= 97 && cp <= 122 || cp === 42 || cp === 43 || cp === 45 || cp === 46 || cp === 47 || cp === 64 || cp === 95;
+    }
+    function normalizeQueryFragmentEncoding(input) {
+      let output = "";
+      for (let i = 0; i < input.length; i++) {
+        const ch = input[i];
+        if (ch === "%" && i + 2 < input.length) {
+          const hex = input.slice(i + 1, i + 3);
+          if (isHexPair(hex)) {
+            const normalizedHex = hex.toUpperCase();
+            const decoded = String.fromCharCode(parseInt(normalizedHex, 16));
+            if (isUnreserved(decoded)) {
+              output += decoded;
+            } else {
+              output += "%" + normalizedHex;
+            }
+            i += 2;
+            continue;
+          }
+        }
+        if (isQueryFragmentCharacter(ch)) {
+          output += ch;
         } else {
-          output += escape(input[i]);
+          const code = input.charCodeAt(i);
+          if (code < 128) {
+            output += isEscapeSafe(code) ? ch : BYTE_HEX[code];
+          } else if (code < 55296 || code > 57343) {
+            output += percentEncodeNonAscii(code);
+          } else if (code <= 56319 && i + 1 < input.length) {
+            const low = input.charCodeAt(i + 1);
+            if (low >= 56320 && low <= 57343) {
+              output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+              i++;
+            } else {
+              output += percentEncodeNonAscii(65533);
+            }
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
         }
       }
       return output;
@@ -27137,14 +28293,18 @@ var require_utils = __commonJS({
     function recomposeAuthority(component) {
       const uriTokens = [];
       if (component.userinfo !== void 0) {
-        uriTokens.push(component.userinfo);
+        uriTokens.push(encodeUserinfo(component.userinfo));
         uriTokens.push("@");
       }
       if (component.host !== void 0) {
-        let host = unescape(component.host);
+        let host = component.host;
         if (!isIPv4(host)) {
-          const ipV6res = normalizeIPv6(host);
-          if (ipV6res.isIPV6 === true) {
+          let ipV6res = normalizeIPv6(host);
+          if (ipV6res.isIPV6 !== true && ipV6res.isIPVFuture !== true) {
+            host = normalizePercentEncoding(host, true);
+            ipV6res = normalizeIPv6(host);
+          }
+          if (ipV6res.isIPV6 === true || ipV6res.isIPVFuture === true) {
             host = `[${ipV6res.escapedHost}]`;
           } else {
             host = reescapeHostDelimiters(host, false);
@@ -27164,6 +28324,11 @@ var require_utils = __commonJS({
       reescapeHostDelimiters,
       normalizePercentEncoding,
       normalizePathEncoding,
+      serializePathEncoding,
+      normalizeQueryFragmentEncoding,
+      encodeUserinfo,
+      encodeQuery,
+      encodeFragment,
       escapePreservingEscapes,
       removeDotSegments,
       isIPv4,
@@ -27174,12 +28339,12 @@ var require_utils = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/fast-uri@3.1.2/node_modules/fast-uri/lib/schemes.js
+// ../../node_modules/.pnpm/fast-uri@3.1.6/node_modules/fast-uri/lib/schemes.js
 var require_schemes = __commonJS({
-  "../../node_modules/.pnpm/fast-uri@3.1.2/node_modules/fast-uri/lib/schemes.js"(exports, module) {
+  "../../node_modules/.pnpm/fast-uri@3.1.6/node_modules/fast-uri/lib/schemes.js"(exports, module) {
     "use strict";
     var { isUUID } = require_utils();
-    var URN_REG = /([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-.:;=@]|%[\da-f]{2})+)/iu;
+    var URN_REG = /^([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-./:;=@]|%[\da-f]{2})+)$/iu;
     var supportedSchemeNames = (
       /** @type {const} */
       [
@@ -27240,9 +28405,10 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path, query] = wsComponent.resourceName.split("?");
+        const queryIndex = wsComponent.resourceName.indexOf("?");
+        const path = queryIndex === -1 ? wsComponent.resourceName : wsComponent.resourceName.slice(0, queryIndex);
         wsComponent.path = path && path !== "/" ? path : void 0;
-        wsComponent.query = query;
+        wsComponent.query = queryIndex === -1 ? void 0 : wsComponent.resourceName.slice(queryIndex + 1);
         wsComponent.resourceName = void 0;
       }
       wsComponent.fragment = void 0;
@@ -27254,7 +28420,7 @@ var require_schemes = __commonJS({
         return urnComponent;
       }
       const matches = urnComponent.path.match(URN_REG);
-      if (matches) {
+      if (matches && matches[0] === urnComponent.path) {
         const scheme = options.scheme || urnComponent.scheme || "urn";
         urnComponent.nid = matches[1].toLowerCase();
         urnComponent.nss = matches[2];
@@ -27384,12 +28550,21 @@ var require_schemes = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/fast-uri@3.1.2/node_modules/fast-uri/index.js
+// ../../node_modules/.pnpm/fast-uri@3.1.6/node_modules/fast-uri/index.js
 var require_fast_uri = __commonJS({
-  "../../node_modules/.pnpm/fast-uri@3.1.2/node_modules/fast-uri/index.js"(exports, module) {
+  "../../node_modules/.pnpm/fast-uri@3.1.6/node_modules/fast-uri/index.js"(exports, module) {
     "use strict";
-    var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, escapePreservingEscapes, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
+    var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
     var { SCHEMES, getSchemeHandler } = require_schemes();
+    var VALID_SCHEME = /^[A-Za-z][A-Za-z0-9+.-]*$/u;
+    var MALFORMED_SCHEME_ERROR = "URI scheme is malformed.";
+    function decodeValidScheme(scheme) {
+      const decodedScheme = unescape(String(scheme));
+      if (!VALID_SCHEME.test(decodedScheme)) {
+        throw new TypeError(MALFORMED_SCHEME_ERROR);
+      }
+      return decodedScheme;
+    }
     function normalize(uri, options) {
       if (typeof uri === "string") {
         uri = /** @type {T} */
@@ -27400,9 +28575,36 @@ var require_fast_uri = __commonJS({
       }
       return uri;
     }
-    function resolve3(baseURI, relativeURI, options) {
+    function resolve4(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
-      const resolved = resolveComponent(parse2(baseURI, schemelessOptions), parse2(relativeURI, schemelessOptions), schemelessOptions, true);
+      const {
+        parsed: baseParsed,
+        malformedAuthorityOrPort: baseMalformed,
+        malformedPercentEncoding: baseMalformedPercentEncoding,
+        malformedSchemeSpecific: baseMalformedSchemeSpecific,
+        malformedHost: baseMalformedHost,
+        malformedScheme: baseMalformedScheme
+      } = parseWithStatus(baseURI, schemelessOptions);
+      const {
+        parsed: relativeParsed,
+        malformedAuthorityOrPort: relativeMalformed,
+        malformedPercentEncoding: relativeMalformedPercentEncoding,
+        malformedSchemeSpecific: relativeMalformedSchemeSpecific,
+        malformedHost: relativeMalformedHost,
+        malformedScheme: relativeMalformedScheme
+      } = parseWithStatus(relativeURI, schemelessOptions);
+      if (baseMalformed || relativeMalformed || baseMalformedPercentEncoding || relativeMalformedPercentEncoding || baseMalformedSchemeSpecific || relativeMalformedSchemeSpecific || baseMalformedHost || relativeMalformedHost || baseMalformedScheme || relativeMalformedScheme) {
+        throw new Error(baseParsed.error || relativeParsed.error || "URI is malformed.");
+      }
+      const resolved = resolveComponent(baseParsed, relativeParsed, schemelessOptions, true);
+      const resolvedSchemeHandler = getSchemeHandler(options && options.scheme || resolved.scheme);
+      const resolvedHost = resolved.host;
+      const resolvedHostIsIP = resolvedHost !== void 0 && resolvedHost !== "" && (isIPv4(resolvedHost) || normalizeIPv6(resolvedHost).isIPV6);
+      canonicalizeHost(resolved, options || {}, resolvedSchemeHandler, resolvedHostIsIP);
+      const encodedASCIIHost = resolvedHost && resolvedHost.indexOf("%") !== -1 && !new RegExp("\\P{ASCII}", "u").test(resolvedHost);
+      if (resolved.error && !encodedASCIIHost) {
+        throw new Error(resolved.error);
+      }
       schemelessOptions.skipEscape = true;
       return serialize(resolved, schemelessOptions);
     }
@@ -27462,7 +28664,7 @@ var require_fast_uri = __commonJS({
     function equal(uriA, uriB, options) {
       const normalizedA = normalizeComparableURI(uriA, options);
       const normalizedB = normalizeComparableURI(uriB, options);
-      return normalizedA !== void 0 && normalizedB !== void 0 && normalizedA.toLowerCase() === normalizedB.toLowerCase();
+      return normalizedA !== void 0 && normalizedB !== void 0 && normalizedA === normalizedB;
     }
     function serialize(cmpts, opts) {
       const component = {
@@ -27483,19 +28685,22 @@ var require_fast_uri = __commonJS({
       };
       const options = Object.assign({}, opts);
       const uriTokens = [];
+      if (component.scheme) {
+        component.scheme = decodeValidScheme(component.scheme);
+      }
       const schemeHandler = getSchemeHandler(options.scheme || component.scheme);
       if (schemeHandler && schemeHandler.serialize) schemeHandler.serialize(component, options);
+      const hasAuthority = component.userinfo !== void 0 || component.host !== void 0 || component.port !== void 0;
+      const pathNoScheme = !options.skipEscape && component.scheme === void 0 && !hasAuthority;
       if (component.path !== void 0) {
         if (!options.skipEscape) {
-          component.path = escapePreservingEscapes(component.path);
-          if (component.scheme !== void 0) {
-            component.path = component.path.split("%3A").join(":");
-          }
+          component.path = serializePathEncoding(component.path, pathNoScheme);
         } else {
           component.path = normalizePercentEncoding(component.path);
         }
       }
       if (options.reference !== "suffix" && component.scheme) {
+        component.scheme = decodeValidScheme(component.scheme);
         uriTokens.push(component.scheme, ":");
       }
       const authority = recomposeAuthority(component);
@@ -27513,20 +28718,25 @@ var require_fast_uri = __commonJS({
         if (!options.absolutePath && (!schemeHandler || !schemeHandler.absolutePath)) {
           s = removeDotSegments(s);
         }
+        if (pathNoScheme) {
+          s = serializePathEncoding(s, true);
+        }
         if (authority === void 0 && s[0] === "/" && s[1] === "/") {
           s = "/%2F" + s.slice(2);
         }
         uriTokens.push(s);
       }
       if (component.query !== void 0) {
-        uriTokens.push("?", component.query);
+        uriTokens.push("?", encodeQuery(component.query));
       }
       if (component.fragment !== void 0) {
-        uriTokens.push("#", component.fragment);
+        uriTokens.push("#", encodeFragment(component.fragment));
       }
       return uriTokens.join("");
     }
     var URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u;
+    var AUTHORITY_PREFIX = /^(?:[^#/:?]+:)?\/\/([^/?#]*)/;
+    var AUTHORITY_INTRODUCER_REGION = /^(?:[^#/:?]+:)?([/\\\t\n\r]*)/;
     function getParseError(parsed, matches) {
       if (matches[2] !== void 0 && parsed.path && parsed.path[0] !== "/") {
         return 'URI path must start with "/" when authority is present.';
@@ -27536,6 +28746,32 @@ var require_fast_uri = __commonJS({
       }
       return void 0;
     }
+    function hasMalformedPercentEncoding(component) {
+      if (component === void 0) return false;
+      let percent = component.indexOf("%");
+      while (percent !== -1) {
+        if (percent + 2 >= component.length || !/^[\da-f]{2}$/iu.test(component.slice(percent + 1, percent + 3))) {
+          return true;
+        }
+        percent = component.indexOf("%", percent + 3);
+      }
+      return false;
+    }
+    function hasMalformedComponentPercentEncoding(matches) {
+      const host = matches[4];
+      return hasMalformedPercentEncoding(matches[3]) || host !== void 0 && !(host[0] === "[" && host[host.length - 1] === "]") && hasMalformedPercentEncoding(host) || hasMalformedPercentEncoding(matches[6]) || hasMalformedPercentEncoding(matches[7]) || hasMalformedPercentEncoding(matches[8]);
+    }
+    function canonicalizeHost(parsed, options, schemeHandler, isIP) {
+      if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport) && parsed.host && parsed.host[0] !== "[" && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
+        try {
+          parsed.host = new URL("http://" + parsed.host).hostname;
+        } catch (e) {
+          parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
+          return true;
+        }
+      }
+      return false;
+    }
     function parseWithStatus(uri, opts) {
       const options = Object.assign({}, opts);
       const parsed = {
@@ -27548,6 +28784,11 @@ var require_fast_uri = __commonJS({
         fragment: void 0
       };
       let malformedAuthorityOrPort = false;
+      let malformedPercentEncoding = false;
+      let malformedSchemeSpecific = false;
+      let malformedHost = false;
+      let malformedIPLiteral = false;
+      let malformedScheme = false;
       let isIP = false;
       if (options.reference === "suffix") {
         if (options.scheme) {
@@ -27556,6 +28797,25 @@ var require_fast_uri = __commonJS({
           uri = "//" + uri;
         }
       }
+      const authorityMatch = uri.match(AUTHORITY_PREFIX);
+      if (authorityMatch !== null && authorityMatch[1].indexOf("\\") !== -1) {
+        parsed.error = "URI authority must not contain a literal backslash.";
+        malformedAuthorityOrPort = true;
+      }
+      const introducerMatch = uri.match(AUTHORITY_INTRODUCER_REGION);
+      if (introducerMatch !== null) {
+        const region = introducerMatch[1];
+        const normalizedRegion = region.replace(/[\t\n\r]/g, "");
+        if (normalizedRegion.length >= 2) {
+          if (normalizedRegion.slice(0, 2) !== "//") {
+            parsed.error = parsed.error || "URI authority must not contain a literal backslash.";
+            malformedAuthorityOrPort = true;
+          } else if (region.length !== normalizedRegion.length) {
+            parsed.error = parsed.error || "URI authority introducer must not contain whitespace.";
+            malformedAuthorityOrPort = true;
+          }
+        }
+      }
       const matches = uri.match(URI_PARSE);
       if (matches) {
         parsed.scheme = matches[1];
@@ -27565,6 +28825,19 @@ var require_fast_uri = __commonJS({
         parsed.path = matches[6] || "";
         parsed.query = matches[7];
         parsed.fragment = matches[8];
+        if (parsed.scheme !== void 0) {
+          const decodedScheme = unescape(parsed.scheme);
+          if (VALID_SCHEME.test(decodedScheme)) {
+            parsed.scheme = decodedScheme.toLowerCase();
+          } else {
+            parsed.error = parsed.error || MALFORMED_SCHEME_ERROR;
+            malformedScheme = true;
+          }
+        }
+        malformedPercentEncoding = hasMalformedComponentPercentEncoding(matches);
+        if (malformedPercentEncoding) {
+          parsed.error = parsed.error || "URI contains malformed percent-encoding.";
+        }
         if (isNaN(parsed.port)) {
           parsed.port = matches[5];
         }
@@ -27576,9 +28849,15 @@ var require_fast_uri = __commonJS({
         if (parsed.host) {
           const ipv4result = isIPv4(parsed.host);
           if (ipv4result === false) {
+            const bracketedIPLiteral = parsed.host[0] === "[" && parsed.host[parsed.host.length - 1] === "]";
             const ipv6result = normalizeIPv6(parsed.host);
-            parsed.host = ipv6result.host.toLowerCase();
-            isIP = ipv6result.isIPV6;
+            isIP = ipv6result.isIPV6 || ipv6result.isIPVFuture === true;
+            malformedIPLiteral = bracketedIPLiteral && ipv6result.error === true;
+            parsed.host = isIP ? ipv6result.host : ipv6result.host.toLowerCase();
+            if (malformedIPLiteral) {
+              parsed.error = parsed.error || "URI host is malformed.";
+              malformedAuthorityOrPort = true;
+            }
           } else {
             isIP = true;
           }
@@ -27596,42 +28875,34 @@ var require_fast_uri = __commonJS({
           parsed.error = parsed.error || "URI is not a " + options.reference + " reference.";
         }
         const schemeHandler = getSchemeHandler(options.scheme || parsed.scheme);
-        if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) {
-          if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
-            try {
-              parsed.host = URL.domainToASCII(parsed.host.toLowerCase());
-            } catch (e) {
-              parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
-            }
-          }
-        }
+        malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP);
         if (!schemeHandler || schemeHandler && !schemeHandler.skipNormalize) {
           if (uri.indexOf("%") !== -1) {
-            if (parsed.scheme !== void 0) {
-              parsed.scheme = unescape(parsed.scheme);
-            }
-            if (parsed.host !== void 0) {
-              parsed.host = reescapeHostDelimiters(unescape(parsed.host), isIP);
+            if (parsed.host !== void 0 && !malformedIPLiteral) {
+              const host = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true);
+              parsed.host = reescapeHostDelimiters(host, isIP);
             }
           }
           if (parsed.path) {
             parsed.path = normalizePathEncoding(parsed.path);
           }
+          if (parsed.query) {
+            parsed.query = normalizeQueryFragmentEncoding(parsed.query);
+          }
           if (parsed.fragment) {
-            try {
-              parsed.fragment = encodeURI(decodeURIComponent(parsed.fragment));
-            } catch {
-              parsed.error = parsed.error || "URI malformed";
-            }
+            parsed.fragment = normalizeQueryFragmentEncoding(parsed.fragment);
           }
         }
         if (schemeHandler && schemeHandler.parse) {
           schemeHandler.parse(parsed, options);
+          if (schemeHandler === SCHEMES.urn && parsed.nid === void 0) {
+            malformedSchemeSpecific = true;
+          }
         }
       } else {
         parsed.error = parsed.error || "URI can not be parsed.";
       }
-      return { parsed, malformedAuthorityOrPort };
+      return { parsed, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme };
     }
     function parse2(uri, opts) {
       return parseWithStatus(uri, opts).parsed;
@@ -27640,25 +28911,33 @@ var require_fast_uri = __commonJS({
       return normalizeStringWithStatus(uri, opts).normalized;
     }
     function normalizeStringWithStatus(uri, opts) {
-      const { parsed, malformedAuthorityOrPort } = parseWithStatus(uri, opts);
+      const { parsed, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = parseWithStatus(uri, opts);
       return {
-        normalized: malformedAuthorityOrPort ? uri : serialize(parsed, opts),
-        malformedAuthorityOrPort
+        normalized: malformedAuthorityOrPort || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? uri : serialize(parsed, opts),
+        malformedAuthorityOrPort,
+        malformedPercentEncoding,
+        malformedSchemeSpecific,
+        malformedHost,
+        malformedScheme
       };
     }
     function normalizeComparableURI(uri, opts) {
-      if (typeof uri === "string") {
-        const { normalized, malformedAuthorityOrPort } = normalizeStringWithStatus(uri, opts);
-        return malformedAuthorityOrPort ? void 0 : normalized;
+      if (typeof uri !== "string" && typeof uri !== "object") {
+        return void 0;
       }
-      if (typeof uri === "object") {
-        return serialize(uri, opts);
+      let value;
+      try {
+        value = typeof uri === "string" ? uri : serialize(uri, opts);
+      } catch {
+        return void 0;
       }
+      const { normalized, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = normalizeStringWithStatus(value, opts);
+      return malformedAuthorityOrPort || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? void 0 : normalized;
     }
     var fastUri = {
       SCHEMES,
       normalize,
-      resolve: resolve3,
+      resolve: resolve4,
       resolveComponent,
       equal,
       serialize,
@@ -31786,7 +33065,7 @@ var init_mcp2 = __esm({
         let task = createTaskResult.task;
         const pollInterval = task.pollInterval ?? 5e3;
         while (task.status !== "completed" && task.status !== "failed" && task.status !== "cancelled") {
-          await new Promise((resolve3) => setTimeout(resolve3, pollInterval));
+          await new Promise((resolve4) => setTimeout(resolve4, pollInterval));
           const updatedTask = await extra.taskStore.getTask(taskId);
           if (!updatedTask) {
             throw new McpError(ErrorCode.InternalError, `Task ${taskId} not found during polling`);
@@ -32382,12 +33661,12 @@ var init_stdio2 = __esm({
         this.onclose?.();
       }
       send(message) {
-        return new Promise((resolve3) => {
+        return new Promise((resolve4) => {
           const json2 = serializeMessage(message);
           if (this._stdout.write(json2)) {
-            resolve3();
+            resolve4();
           } else {
-            this._stdout.once("drain", resolve3);
+            this._stdout.once("drain", resolve4);
           }
         });
       }
@@ -32619,10 +33898,10 @@ async function buildNodalMcpServer(opts) {
 }
 async function startNodalMcpServer(opts) {
   const server = await buildNodalMcpServer(opts);
-  const closed = new Promise((resolve3) => {
-    server.server.onclose = resolve3;
-    process.stdin.once("end", resolve3);
-    process.stdin.once("close", resolve3);
+  const closed = new Promise((resolve4) => {
+    server.server.onclose = resolve4;
+    process.stdin.once("end", resolve4);
+    process.stdin.once("close", resolve4);
   });
   await server.connect(new StdioServerTransport());
   await closed;
@@ -32723,7 +34002,7 @@ __export(reset_exports, {
 });
 import chalk6 from "chalk";
 import prompts2 from "prompts";
-import { rmSync as rmSync2, existsSync as existsSync12 } from "fs";
+import { rmSync as rmSync2, existsSync as existsSync13 } from "fs";
 async function runReset(options = {}) {
   if (!options.yes) {
     const { confirm } = await prompts2({
@@ -32741,7 +34020,7 @@ async function runReset(options = {}) {
   }
   console.log(chalk6.yellow("Stopping any running processes\u2026"));
   await runDown();
-  if (existsSync12(CONFIG_DIR)) {
+  if (existsSync13(CONFIG_DIR)) {
     rmSync2(CONFIG_DIR, { recursive: true, force: true });
     console.log(chalk6.green(`  Removed ${CONFIG_DIR}`));
   } else {