openmeld 0.3.201 → 0.3.202

package/dist/{openmeld-tools-update-coordinator-Bf8KyI6N.js → openmeld-tools-update-coordinator-DNMcMykJ.js}

@@ -27,6 +27,7 @@ import { execFile, spawn } from "node:child_process";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { promisify } from "node:util";
+import { gunzipSync } from "node:zlib";
 import { connect, createConnection, createServer } from "node:net";
 import { query } from "@anthropic-ai/claude-agent-sdk";
 import { createOpencodeClient } from "@opencode-ai/sdk/v2";
@@ -310,11 +311,28 @@ const cliBinaryReleaseSchema = cliBinaryArtifactSchema.extend({
 		deltaBases.add(baseKey);
 	}
 });
+const binaryPlatformsSchema = z$1.record(z$1.string().trim().min(1), cliBinaryReleaseSchema).refine((platforms) => Object.keys(platforms).length > 0, { message: "at least one platform is required" });
+const cliBinaryServiceReleaseSchema = z$1.object({
+	platforms: binaryPlatformsSchema,
+	version: z$1.string().trim().min(1)
+});
 const cliBinaryManifestSchema = z$1.object({
 	channels: z$1.object({ stable: z$1.object({
 		minRequiredCliVersion: z$1.string().trim().min(1).nullable().optional(),
-		platforms: z$1.record(z$1.string().trim().min(1), cliBinaryReleaseSchema).refine((platforms) => Object.keys(platforms).length > 0, { message: "at least one platform is required" }),
+		platforms: binaryPlatformsSchema,
+		service: cliBinaryServiceReleaseSchema.optional(),
 		version: z$1.string().trim().min(1)
+	}).superRefine((stable, context) => {
+		if (!stable.service) return;
+		for (const platform of Object.keys(stable.platforms)) if (!stable.service.platforms[platform]) context.addIssue({
+			code: "custom",
+			path: [
+				"service",
+				"platforms",
+				platform
+			],
+			message: "a Service artifact is required for every CLI platform"
+		});
 	}) }),
 	schemaVersion: z$1.literal(1)
 });
@@ -1310,11 +1328,17 @@ async function fetchLatestCliBinaryRelease(input) {
 	const platform = toNonEmptyString(input?.platform) ?? `${process$1.platform}-${process$1.arch}`;
 	const release = manifest.platforms[platform];
 	if (!release) throw new Error(`version check failed: invalid CLI manifest response: missing platform ${platform}`);
+	const serviceRelease = manifest.service?.platforms[platform];
 	return {
 		version: manifest.version,
 		minRequiredCliVersion: manifest.minRequiredCliVersion,
 		platform,
-		...release
+		...release,
+		...manifest.service && serviceRelease ? { service: {
+			...serviceRelease,
+			version: manifest.service.version,
+			platform
+		} } : {}
 	};
 }
 async function requestLatestPackageInfo(packageName) {
@@ -1342,7 +1366,8 @@ async function requestLatestPackageInfoFromCliManifest() {
 	const manifest = await requestCliBinaryManifest();
 	return {
 		version: manifest.version,
-		minRequiredCliVersion: manifest.minRequiredCliVersion
+		minRequiredCliVersion: manifest.minRequiredCliVersion,
+		...manifest.service ? { serviceVersion: manifest.service.version } : {}
 	};
 }
 async function requestCliBinaryManifest() {
@@ -1363,9 +1388,8 @@ function parseCliBinaryManifest(raw) {
 	if (!parsed.success) throw new Error(parsed.error.message);
 	const stable = parsed.data.channels.stable;
 	return {
-		version: stable.version,
-		minRequiredCliVersion: stable.minRequiredCliVersion ?? null,
-		platforms: stable.platforms
+		...stable,
+		minRequiredCliVersion: stable.minRequiredCliVersion ?? null
 	};
 }
 function readMinRequiredCliVersion(openmeld) {
@@ -1659,79 +1683,11 @@ function getErrorCode$2(error) {
 	return error && typeof error === "object" && "code" in error ? String(error.code) : null;
 }
 //#endregion
-//#region src/local-service/lifecycle/daemon-service-update-state.ts
-const DAEMON_SERVICE_UPDATE_JOB_SCHEMA = OPENMELD_DAEMON_SERVICE_UPDATE_JOB_SCHEMA;
-function daemonServicePendingUpdatePath(pathInput = {}) {
-	return join(daemonRuntimeStateRootPath(pathInput), "service-update.json");
-}
-function daemonServiceLastUpdatePath(pathInput = {}) {
-	return join(daemonRuntimeStateRootPath(pathInput), "service-update-last.json");
-}
-async function readPendingDaemonServiceUpdate(pathInput = {}) {
-	return await readDaemonServiceUpdateJob(daemonServicePendingUpdatePath(pathInput));
-}
-async function readLastDaemonServiceUpdate(pathInput = {}) {
-	return await readDaemonServiceUpdateJob(daemonServiceLastUpdatePath(pathInput));
-}
-async function persistPendingDaemonServiceUpdate(job, pathInput = {}) {
-	await writeUpdateJobAtomically({
-		job,
-		path: daemonServicePendingUpdatePath(pathInput)
-	});
-}
-async function completePendingDaemonServiceUpdate(job, pathInput = {}, retainPending = false) {
-	await writeUpdateJobAtomically({
-		job,
-		path: daemonServiceLastUpdatePath(pathInput)
-	});
-	if (retainPending) {
-		await persistPendingDaemonServiceUpdate(job, pathInput);
-		return;
-	}
-	await rm(daemonServicePendingUpdatePath(pathInput), { force: true });
-}
-async function readDaemonServiceUpdateJob(path) {
-	const raw = await readFile(path, "utf8").catch((error) => {
-		if (error.code === "ENOENT") return null;
-		throw error;
-	});
-	if (raw === null) return null;
-	const parsed = storedDaemonServiceUpdateJobSchema.safeParse(JSON.parse(raw));
-	if (!parsed.success) throw new Error("OpenMeld Service update state is invalid.");
-	if (parsed.data.v === 2) return parsed.data;
-	const { status, ...legacyJob } = parsed.data;
-	return daemonServiceUpdateJobSchema.parse({
-		...legacyJob,
-		v: 2,
-		schema: DAEMON_SERVICE_UPDATE_JOB_SCHEMA,
-		phase: migrateLegacyPhase(status),
-		requestSource: "cli"
-	});
-}
-function migrateLegacyPhase(status) {
-	switch (status) {
-		case "scheduled": return "waiting_for_work";
-		case "running": return "updating";
-		case "completed": return "updated";
-		case "failed": return "needs_help";
-		default: return status;
-	}
-}
-async function writeUpdateJobAtomically(input) {
-	const temporaryPath = `${input.path}.${String(process.pid)}.tmp`;
-	await mkdir(dirname(input.path), { recursive: true });
-	await writeFile(temporaryPath, `${JSON.stringify(input.job, null, 2)}\n`, {
-		encoding: "utf8",
-		mode: 384
-	});
-	await rename(temporaryPath, input.path);
-}
-//#endregion
 //#region package.json
 var package_default = {
 	$schema: "https://www.schemastore.org/package.json",
 	name: "openmeld",
-	version: "0.3.201",
+	version: "0.3.202",
 	openMeldReleaseDate: "2026-09-13",
 	description: "OpenMeld CLI - https://openmeld.ai",
 	license: "MIT",
@@ -1813,391 +1769,265 @@ var package_default = {
 	}
 };
 //#endregion
-//#region src/runtime/version.ts
-/**
-* The version of the running CLI and Service bundle.
-*
-* npm builds use package.json. Binary builds may inject an isolated staging
-* prerelease so the real update lifecycle can be exercised before a production
-* version exists.
-*/
-function resolveOpenMeldVersion() {
-	return (typeof __OPENMELD_VERSION__ === "string" ? __OPENMELD_VERSION__.trim() : "") || package_default.version;
+//#region src/config/service-release.ts
+function resolveBundledServiceRelease() {
+	if (!isBinaryDistribution()) return;
+	const metadata = package_default;
+	const selection = typeof __OPENMELD_SERVICE_RELEASE__ === "undefined" ? metadata.openmeld?.service : __OPENMELD_SERVICE_RELEASE__;
+	if (selection === void 0) return;
+	const parsed = cliBinaryServiceReleaseSchema.safeParse(selection);
+	if (!parsed.success) throw new Error("The installed CLI contains invalid Service release metadata.");
+	const platform = `${process.platform}-${process.arch}`;
+	const artifact = parsed.data.platforms[platform];
+	if (!artifact) throw new Error(`The installed CLI has no Service artifact for ${platform}.`);
+	return {
+		...artifact,
+		version: parsed.data.version,
+		platform,
+		minRequiredCliVersion: null
+	};
 }
-const OPENMELD_VERSION = resolveOpenMeldVersion();
 //#endregion
-//#region src/local-components/managed-version-pruning.ts
-const MANAGED_VERSION_DIRECTORY_PATTERN = /^v?(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*))*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
-async function pruneManagedVersions(input) {
-	const versionsDir = openMeldVersionsDir(input.pathInput);
-	const managedVersions = (await readdir(versionsDir, { withFileTypes: true })).filter((entry) => entry.isDirectory() && MANAGED_VERSION_DIRECTORY_PATTERN.test(entry.name)).map((entry) => entry.name);
-	const usableManagedVersions = new Set((await Promise.all(managedVersions.map(async (version) => ({
-		usable: await isUsableManagedVersion(version, versionsDir),
-		version
-	})))).filter((entry) => entry.usable).map((entry) => entry.version));
-	const retainedVersions = /* @__PURE__ */ new Set([input.currentVersion]);
-	let rollbackVersion = null;
-	if (input.preferredRollbackVersion && input.preferredRollbackVersion !== input.currentVersion && usableManagedVersions.has(input.preferredRollbackVersion)) rollbackVersion = input.preferredRollbackVersion;
-	rollbackVersion ??= [...usableManagedVersions].filter((version) => compareSemver(version, input.currentVersion) < 0).sort((left, right) => compareSemver(right, left))[0] ?? null;
-	if (rollbackVersion) retainedVersions.add(rollbackVersion);
-	for (const protectedVersion of input.protectedVersions ?? []) if (usableManagedVersions.has(protectedVersion)) retainedVersions.add(protectedVersion);
-	await Promise.all(managedVersions.filter((version) => !retainedVersions.has(version)).map((version) => rm(path.join(versionsDir, version), { recursive: true })));
+//#region src/runtime/cli-binary-delta.ts
+function reconstructCliBinaryDelta(input) {
+	verifyBytes({
+		bytes: input.baseBytes,
+		expectedSha256: input.delta.fromSha256,
+		expectedSizeBytes: input.delta.fromSizeBytes,
+		label: "delta base"
+	});
+	const patch = parseCliBinaryDeltaPatch(input.patchPayloadBytes);
+	assertPatchMatchesRelease({
+		delta: input.delta,
+		patch,
+		targetSha256: input.targetSha256,
+		targetSizeBytes: input.targetSizeBytes
+	});
+	const targetBytes = Buffer.alloc(input.targetSizeBytes);
+	input.baseBytes.copy(targetBytes, 0, 0, Math.min(input.baseBytes.byteLength, targetBytes.byteLength));
+	let previousEnd = 0;
+	for (const segment of patch.segments) {
+		const bytes = Buffer.from(segment.dataBase64, "base64");
+		const segmentEnd = segment.offset + bytes.byteLength;
+		if (segment.offset < previousEnd) throw new Error("delta patch segments must be sorted and non-overlapping");
+		if (segmentEnd > targetBytes.byteLength) throw new Error("delta patch segment exceeds the target binary size");
+		bytes.copy(targetBytes, segment.offset);
+		previousEnd = segmentEnd;
+	}
+	verifyBytes({
+		bytes: targetBytes,
+		expectedSha256: input.targetSha256,
+		expectedSizeBytes: input.targetSizeBytes,
+		label: "reconstructed binary"
+	});
+	return targetBytes;
+}
+function parseCliBinaryDeltaPatch(bytes) {
+	let value;
+	try {
+		value = JSON.parse(bytes.toString("utf8"));
+	} catch (error) {
+		throw new Error(`delta patch is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	const parsed = cliBinaryDeltaPatchSchema.safeParse(value);
+	if (!parsed.success) throw new Error(`delta patch is invalid: ${parsed.error.message}`);
+	return parsed.data;
 }
-async function isUsableManagedVersion(version, versionsDir) {
-	const target = path.join(versionsDir, version, "openmeld");
-	if (!(await stat(target).catch((error) => {
-		if (getErrorCode$1(error) === "ENOENT") return null;
-		throw error;
-	}))?.isFile()) return false;
-	return await access(target, constants.X_OK).then(() => true, (error) => {
-		if (getErrorCode$1(error) === "EACCES" || getErrorCode$1(error) === "ENOENT") return false;
-		throw error;
-	});
+function assertPatchMatchesRelease(input) {
+	const mismatches = [
+		[
+			"format",
+			input.patch.patchFormat,
+			input.delta.patchFormat
+		],
+		[
+			"base sha256",
+			input.patch.baseSha256,
+			input.delta.fromSha256
+		],
+		[
+			"base size",
+			input.patch.baseSizeBytes,
+			input.delta.fromSizeBytes
+		],
+		[
+			"target sha256",
+			input.patch.targetSha256,
+			input.targetSha256
+		],
+		[
+			"target size",
+			input.patch.targetSizeBytes,
+			input.targetSizeBytes
+		]
+	].filter(([, actual, expected]) => actual !== expected);
+	if (mismatches.length > 0) throw new Error(`delta patch metadata mismatch: ${mismatches.map(([label]) => label).join(", ")}`);
 }
-function getErrorCode$1(error) {
-	return error && typeof error === "object" && "code" in error ? String(error.code) : null;
+function verifyBytes(input) {
+	if (input.bytes.byteLength !== input.expectedSizeBytes) throw new Error(`${input.label} size mismatch: expected ${input.expectedSizeBytes} bytes, received ${input.bytes.byteLength} bytes`);
+	const actualSha256 = createHash("sha256").update(input.bytes).digest("hex");
+	if (actualSha256 !== input.expectedSha256.toLowerCase()) throw new Error(`${input.label} sha256 mismatch: expected ${input.expectedSha256.toLowerCase()}, received ${actualSha256}`);
 }
 //#endregion
-//#region src/local-components/managed-install.ts
-const MANAGED_INSTALL_LOCK_PROFILE = "managed-cli";
-const MANAGED_INSTALL_LOCK_KEY = "install";
-const MANAGED_INSTALL_LOCK_RETRY_DELAY_MS = 100;
-const MANAGED_INSTALL_LOCK_TIMEOUT_MS = 3e4;
-function resolveCliPlatformToken() {
-	return `${process$1.platform}-${process$1.arch}`;
-}
-function resolveCliSelfVersion() {
-	return OPENMELD_VERSION;
-}
-async function isUsableManagedBinary(target) {
-	if (!(await stat(target).catch((error) => {
-		if (isErrorWithCode(error, "ENOENT")) return null;
-		throw error;
-	}))?.isFile()) return false;
-	return await access(target, constants.X_OK).then(() => true, (error) => {
-		if (isErrorWithCode(error, "EACCES") || isErrorWithCode(error, "ENOENT")) return false;
-		throw error;
-	});
-}
-async function readCurrentPointerVersion(pathInput = {}) {
-	const pointerPath = openMeldManagedBinaryPath(pathInput);
-	const target = await readlink(pointerPath).catch((error) => {
-		if (isErrorWithCode(error, "ENOENT") || isErrorWithCode(error, "EINVAL")) return null;
-		throw error;
-	});
-	if (!target) return null;
-	const resolved = path.isAbsolute(target) ? target : path.resolve(path.dirname(pointerPath), target);
-	const version = path.basename(path.dirname(resolved));
-	return version.length > 0 ? version : null;
-}
-/**
-* Install the currently-running binary (process.execPath) into the managed
-* layout and point bin/openmeld at it. Idempotent with semver arbitration:
-* a same-or-newer pointer is left in place (install only goes up), unless
-* `force` is set. Both the versioned binary and the pointer are swapped in
-* atomically via a temp name + rename.
-*/
-async function performManagedInstall(input) {
-	return await withManagedInstallTransaction(async () => performManagedInstallLocked(input));
-}
-async function withManagedInstallTransaction(run, pathInput = {}) {
-	const startedAtMs = Date.now();
-	for (;;) try {
-		return await runWithHeldLock({
-			lock: await acquireLock({
-				openMeldProfileId: MANAGED_INSTALL_LOCK_PROFILE,
-				key: MANAGED_INSTALL_LOCK_KEY,
-				meta: { component: "managed_cli.install" },
-				pathResolution: pathInput
-			}),
-			run,
-			releaseContext: {
-				component: "managed_cli.install",
-				lockKey: MANAGED_INSTALL_LOCK_KEY,
-				openMeldProfileId: MANAGED_INSTALL_LOCK_PROFILE
-			}
-		});
+//#region src/runtime/cli-binary-update-artifact.ts
+const HARDENED_RUNTIME_FLAG_RE = /flags=.*runtime/iu;
+const SIGNING_TIMESTAMP_RE = /^Timestamp=/mu;
+async function resolveCliBinaryUpdatePlan(input) {
+	const fullDownloadPlan = resolveFullCliBinaryUpdatePlan(input.release);
+	const versionDeltas = input.release.deltas?.filter((candidate) => candidate.fromVersion === input.currentVersion);
+	if (!versionDeltas?.length) return fullDownloadPlan;
+	let baseBytes;
+	try {
+		baseBytes = await readFile(input.baseBinaryPath);
 	} catch (error) {
-		if (!isOpenMeldLockError(error) || isOpenMeldOrphanedLockError(error) || Date.now() - startedAtMs >= MANAGED_INSTALL_LOCK_TIMEOUT_MS) throw error;
-		await setTimeout$1(MANAGED_INSTALL_LOCK_RETRY_DELAY_MS);
+		input.onDeltaFallback(toError(error));
+		return fullDownloadPlan;
 	}
-}
-/**
-* Prune managed CLI versions only while holding the install transaction lock.
-* The current pointer and every durable Service update target are re-read in
-* the lock, so cleanup cannot race an install or use a stale pending snapshot.
-*/
-async function pruneManagedInstallVersions(input) {
-	const pathInput = input.pathInput;
-	assertNoPublishedProductionMutationDuringTests(pathInput, "managed CLI versions");
-	await withManagedInstallTransaction(async () => {
-		const currentVersion = await readCurrentPointerVersion(pathInput);
-		if (currentVersion === null) return;
-		const protectedVersions = await readManagedInstallProtectedVersions(pathInput);
-		await pruneManagedVersions({
-			currentVersion,
-			pathInput,
-			preferredRollbackVersion: input.preferredRollbackVersion,
-			protectedVersions
-		});
-	}, pathInput);
-}
-async function performManagedInstallLocked(input) {
-	const force = input?.force ?? false;
-	const version = resolveCliSelfVersion();
-	const platform = resolveCliPlatformToken();
-	const currentPointerPath = openMeldManagedBinaryPath();
-	const managedBinaryPath = openMeldManagedVersionBinaryPath(version);
-	const previousVersion = await readCurrentPointerVersion();
-	const protectedVersions = await readManagedInstallProtectedVersions();
-	const baseOutcome = {
-		version,
-		platform,
-		managedBinaryPath,
-		currentPointerPath,
-		previousVersion,
-		forced: force
+	const baseSha256 = createHash("sha256").update(baseBytes).digest("hex");
+	const delta = versionDeltas.find((candidate) => candidate.fromSizeBytes === baseBytes.byteLength && candidate.fromSha256.toLowerCase() === baseSha256);
+	if (!delta) return fullDownloadPlan;
+	return {
+		baseBytes,
+		delta,
+		downloadSizeBytes: delta.patchSizeBytes,
+		transport: "delta"
 	};
-	if (previousVersion !== null) {
-		const comparison = compareSemver(version, previousVersion);
-		if (!force && comparison === 0 && await isUsableManagedBinary(managedBinaryPath)) {
-			await pruneManagedVersions({
-				currentVersion: previousVersion,
-				protectedVersions
-			});
-			return {
-				...baseOutcome,
-				result: "noop_same_version"
-			};
-		}
-		if (comparison < 0 && !force) {
-			if (!await isUsableManagedBinary(managedBinaryPath)) await placeVersionedBinary(input?.sourceBinaryPath ?? process$1.execPath, version, managedBinaryPath);
-			await pruneManagedVersions({
-				currentVersion: previousVersion,
-				preferredRollbackVersion: version,
-				protectedVersions
+}
+async function downloadCliBinaryUpdateArtifact(input) {
+	if (input.plan.transport === "delta") {
+		try {
+			return await downloadCliBinaryDelta({
+				...input,
+				baseBytes: input.plan.baseBytes,
+				delta: input.plan.delta
 			});
-			return {
-				...baseOutcome,
-				result: "noop_newer_present"
-			};
+		} catch (error) {
+			input.onDeltaFallback(toError(error));
 		}
+		return downloadFullCliBinaryArtifact({
+			...input,
+			plan: resolveFullCliBinaryUpdatePlan(input.release)
+		});
 	}
-	await placeVersionedBinary(input?.sourceBinaryPath ?? process$1.execPath, version, managedBinaryPath);
-	await pruneManagedVersions({
-		currentVersion: version,
-		preferredRollbackVersion: previousVersion,
-		protectedVersions
+	return downloadFullCliBinaryArtifact({
+		...input,
+		plan: input.plan
+	});
+}
+async function verifyCliBinaryCodeSignature(input) {
+	const { codeIdentifier, teamIdentifier } = input.release;
+	if (!(codeIdentifier && teamIdentifier)) return;
+	if (process.platform !== "darwin") throw new Error("signed OpenMeld CLI verification requires macOS");
+	const verification = await input.runCommand("/usr/bin/codesign", [
+		"--verify",
+		"--strict",
+		"--verbose=2",
+		input.artifactPath
+	]);
+	if (verification.code !== 0) throw new Error(`binary code signature verification failed: ${commandFailureDetails(verification)}`);
+	const inspection = await input.runCommand("/usr/bin/codesign", [
+		"--display",
+		"--verbose=4",
+		input.artifactPath
+	]);
+	if (inspection.code !== 0) throw new Error(`binary code signature inspection failed: ${commandFailureDetails(inspection)}`);
+	const details = `${inspection.stdout}\n${inspection.stderr}`;
+	for (const expected of [
+		`Identifier=${codeIdentifier}`,
+		`TeamIdentifier=${teamIdentifier}`,
+		"Authority=Developer ID Application:"
+	]) if (!details.includes(expected)) throw new Error(`binary code signature is missing expected identity: ${expected}`);
+	if (!HARDENED_RUNTIME_FLAG_RE.test(details)) throw new Error("binary code signature is missing the hardened runtime");
+	if (!SIGNING_TIMESTAMP_RE.test(details)) throw new Error("binary code signature is missing a trusted timestamp");
+}
+async function downloadCliBinaryDelta(input) {
+	const response = await input.fetchImpl(input.delta.patchUrl, {
+		method: "GET",
+		signal: AbortSignal.timeout(input.downloadTimeoutMs)
 	});
-	await swapCurrentPointer(currentPointerPath, managedBinaryPath);
-	return {
-		...baseOutcome,
-		result: "installed"
-	};
-}
-async function readManagedInstallProtectedVersions(pathInput = {}) {
-	const [protectedVersions, pendingServiceUpdate] = await Promise.all([readDaemonServiceUpdateWorkerProtectedManagedVersions(pathInput), readPendingDaemonServiceUpdate(pathInput)]);
-	if (pendingServiceUpdate?.preparedBundle.bundleFormat === "binary_v1") protectedVersions.add(pendingServiceUpdate.preparedBundle.daemonVersion);
-	return protectedVersions;
-}
-async function placeVersionedBinary(sourceBinary, version, managedBinaryPath) {
-	await mkdir(openMeldManagedVersionDir(version), { recursive: true });
-	const tmpPath = `${managedBinaryPath}.tmp-${process$1.pid}-${Date.now()}`;
-	await rm(tmpPath, { force: true }).catch(() => void 0);
-	await copyFile(sourceBinary, tmpPath);
-	await chmod(tmpPath, 493);
-	if ((await lstat(managedBinaryPath).catch((error) => {
-		if (isErrorWithCode(error, "ENOENT")) return null;
-		throw error;
-	}))?.isDirectory()) await rm(managedBinaryPath, { recursive: true });
-	await rename(tmpPath, managedBinaryPath);
-}
-async function swapCurrentPointer(currentPointerPath, managedBinaryPath) {
-	await mkdir(openMeldBinDir(), { recursive: true });
-	const relativeTarget = path.relative(path.dirname(currentPointerPath), managedBinaryPath);
-	const tmpPath = `${currentPointerPath}.tmp-${process$1.pid}-${Date.now()}`;
-	await rm(tmpPath, { force: true }).catch(() => void 0);
-	await symlink(relativeTarget, tmpPath);
-	await rename(tmpPath, currentPointerPath);
-}
-function buildInstallSelfJsonPayload(outcome) {
-	return {
-		schemaVersion: 1,
-		type: "cli.install_self",
-		result: outcome.result,
-		version: outcome.version,
-		platform: outcome.platform,
-		managedBinaryPath: outcome.managedBinaryPath,
-		currentPointerPath: outcome.currentPointerPath,
-		previousVersion: outcome.previousVersion,
-		forced: outcome.forced
-	};
-}
-function isErrorWithCode(error, code) {
-	return error instanceof Error && "code" in error && error.code === code;
-}
-//#endregion
-//#region src/local-service/control-plane/client.ts
-const DEFAULT_LOCAL_DAEMON_CONTROL_PLANE_TIMEOUT_MS = 5e3;
-var LocalDaemonControlPlaneClientError = class extends Error {
-	code;
-	constructor(code, message) {
-		super(message);
-		this.code = code;
+	if (!response.ok) {
+		const body = await response.text().catch(() => "");
+		throw new Error(`binary delta download failed: HTTP ${response.status}${body ? `: ${body}` : ""}`);
 	}
-};
-async function sendLocalDaemonControlPlaneRequest(input) {
-	const endpoint = input.endpoint ?? resolveDaemonControlPlaneEndpoint();
-	const authToken = await readDaemonControlPlaneToken();
-	if (!authToken) throw new LocalDaemonControlPlaneClientError("daemon.control.auth_token_missing", "daemon control token is missing");
-	const rawResponse = await writeControlPlaneRequest({
-		endpoint,
-		request: {
-			...input.request,
-			authToken
-		},
-		timeoutMs: input.timeoutMs ?? DEFAULT_LOCAL_DAEMON_CONTROL_PLANE_TIMEOUT_MS
+	const patchBytes = Buffer.from(await response.arrayBuffer());
+	verifyBinaryBytes({
+		bytes: patchBytes,
+		expectedSha256: input.delta.patchSha256,
+		expectedSizeBytes: input.delta.patchSizeBytes,
+		label: "binary delta archive"
 	});
-	const parsed = openMeldDaemonControlPlaneResponseSchema.safeParse(rawResponse);
-	if (!parsed.success) throw new LocalDaemonControlPlaneClientError("daemon.control.invalid_response", "local daemon control returned an invalid response");
-	if (parsed.data.code === "service.error") throw new LocalDaemonControlPlaneClientError(parsed.data.payload.errorCode, parsed.data.payload.errorMessage);
-	return parsed.data;
-}
-async function requestLocalSyncRouteCatalog(input) {
-	let response;
+	let patchPayloadBytes;
 	try {
-		response = await sendLocalDaemonControlPlaneRequest({
-			endpoint: input.endpoint,
-			timeoutMs: input.timeoutMs,
-			request: {
-				v: 1,
-				command: "sync_route_catalog",
-				payload: input.payload
-			}
-		});
+		patchPayloadBytes = gunzipSync(patchBytes, { maxOutputLength: input.delta.patchPayloadSizeBytes });
 	} catch (error) {
-		throw rewriteDaemonControlPlaneContractMismatch(error);
+		throw new Error(`binary delta could not be decompressed: ${toError(error).message}`);
 	}
-	if (response.code !== "service.sync_route_catalog") throw new LocalDaemonControlPlaneClientError("daemon.control.invalid_response", "local daemon control returned an unexpected response for route catalog sync");
-	return response.payload;
+	if (patchPayloadBytes.byteLength !== input.delta.patchPayloadSizeBytes) throw new Error(`binary delta payload size mismatch: expected ${input.delta.patchPayloadSizeBytes} bytes, received ${patchPayloadBytes.byteLength} bytes`);
+	return reconstructCliBinaryDelta({
+		baseBytes: input.baseBytes,
+		delta: input.delta,
+		patchPayloadBytes,
+		targetSha256: input.release.sha256,
+		targetSizeBytes: input.release.sizeBytes
+	});
 }
-async function requestLocalAgentActivitySync(input) {
-	let response;
-	try {
-		response = await sendLocalDaemonControlPlaneRequest({
-			endpoint: input.endpoint,
-			timeoutMs: input.timeoutMs,
-			request: {
-				v: 1,
-				command: "request_agent_activity_sync",
-				payload: input.payload
-			}
-		});
-	} catch (error) {
-		throw rewriteDaemonControlPlaneContractMismatch(error);
-	}
-	if (response.code !== "service.agent_activity_sync_requested") throw new LocalDaemonControlPlaneClientError("daemon.control.invalid_response", "local daemon control returned an unexpected response for Agent Activity sync");
-	return response.payload;
+function resolveFullCliBinaryUpdatePlan(release) {
+	if (hasCompressedCliBinaryTransport(release)) return {
+		downloadSha256: release.archiveSha256,
+		downloadSizeBytes: release.archiveSizeBytes,
+		downloadUrl: release.archiveUrl,
+		transport: "archive"
+	};
+	return {
+		downloadSha256: release.sha256,
+		downloadSizeBytes: release.sizeBytes,
+		downloadUrl: release.url,
+		transport: "raw"
+	};
 }
-async function requestLocalDaemonShutdown(input) {
-	let response;
-	try {
-		response = await sendLocalDaemonControlPlaneRequest({
-			endpoint: input.endpoint,
-			timeoutMs: input.timeoutMs,
-			request: {
-				v: 1,
-				command: "shutdown",
-				payload: input.payload
-			}
-		});
+async function downloadFullCliBinaryArtifact(input) {
+	const response = await input.fetchImpl(input.plan.downloadUrl, {
+		method: "GET",
+		signal: AbortSignal.timeout(input.downloadTimeoutMs)
+	});
+	if (!response.ok) {
+		const body = await response.text().catch(() => "");
+		throw new Error(`binary download failed: HTTP ${response.status}${body ? `: ${body}` : ""}`);
+	}
+	const downloadBytes = Buffer.from(await response.arrayBuffer());
+	verifyBinaryBytes({
+		bytes: downloadBytes,
+		expectedSha256: input.plan.downloadSha256,
+		expectedSizeBytes: input.plan.downloadSizeBytes,
+		label: input.plan.transport === "archive" ? "binary archive" : "binary download"
+	});
+	let artifactBytes = downloadBytes;
+	if (input.plan.transport === "archive") try {
+		artifactBytes = gunzipSync(downloadBytes, { maxOutputLength: input.release.sizeBytes });
 	} catch (error) {
-		throw rewriteDaemonControlPlaneContractMismatch(error);
+		throw new Error(`binary archive could not be decompressed: ${toError(error).message}`);
 	}
-	if (response.code !== "service.shutdown") throw new LocalDaemonControlPlaneClientError("daemon.control.invalid_response", "local daemon control returned an unexpected response for shutdown");
-	return response.payload;
+	verifyBinaryBytes({
+		bytes: artifactBytes,
+		expectedSha256: input.release.sha256,
+		expectedSizeBytes: input.release.sizeBytes,
+		label: "binary download"
+	});
+	return artifactBytes;
 }
-async function requestLocalDaemonServiceUpdateReadiness(input = {}) {
-	let response;
-	try {
-		response = await sendLocalDaemonControlPlaneRequest({
-			endpoint: input.endpoint,
-			timeoutMs: input.timeoutMs,
-			request: {
-				v: 1,
-				command: "service_update_readiness"
-			}
-		});
-	} catch (error) {
-		throw rewriteDaemonControlPlaneContractMismatch(error);
-	}
-	if (response.code !== "service.update_readiness") throw new LocalDaemonControlPlaneClientError("daemon.control.invalid_response", "local daemon control returned an unexpected response for service update readiness");
-	return response.payload;
+function hasCompressedCliBinaryTransport(release) {
+	return release.archiveFormat === "gzip" && typeof release.archiveUrl === "string" && typeof release.archiveSha256 === "string" && typeof release.archiveSizeBytes === "number";
 }
-function rewriteDaemonControlPlaneContractMismatch(error) {
-	if (error instanceof LocalDaemonControlPlaneClientError && error.code === "service.invalid_request") return new LocalDaemonControlPlaneClientError("daemon.control.contract_mismatch", "local OpenMeld Service must be restarted because the daemon control-plane contract changed on this device");
-	return error;
+function verifyBinaryBytes(input) {
+	if (input.bytes.byteLength !== input.expectedSizeBytes) throw new Error(`${input.label} size mismatch: expected ${input.expectedSizeBytes} bytes, received ${input.bytes.byteLength} bytes`);
+	const actualSha256 = createHash("sha256").update(input.bytes).digest("hex");
+	if (actualSha256 !== input.expectedSha256.toLowerCase()) throw new Error(`${input.label} sha256 mismatch: expected ${input.expectedSha256.toLowerCase()}, received ${actualSha256}`);
 }
-async function writeControlPlaneRequest(input) {
-	return await new Promise((resolve, reject) => {
-		const socket = createConnection(input.endpoint);
-		let responseBuffer = "";
-		let settled = false;
-		const cleanup = () => {
-			socket.setTimeout(0);
-			socket.off("connect", handleConnect);
-			socket.off("data", handleData);
-			socket.off("end", handleEnd);
-			socket.off("error", handleError);
-			socket.off("timeout", handleTimeout);
-		};
-		const settle = (action) => {
-			if (settled) return;
-			settled = true;
-			cleanup();
-			action();
-		};
-		const fail = (error) => {
-			settle(() => {
-				socket.destroy();
-				reject(error);
-			});
-		};
-		const handleConnect = () => {
-			socket.write(`${JSON.stringify(input.request)}\n`);
-		};
-		const handleData = (chunk) => {
-			responseBuffer += chunk;
-		};
-		const handleEnd = () => {
-			settle(() => {
-				const rawResponse = responseBuffer.trim();
-				if (!rawResponse) {
-					reject(new LocalDaemonControlPlaneClientError("daemon.control.empty_response", "local daemon control returned an empty response"));
-					return;
-				}
-				try {
-					resolve(JSON.parse(rawResponse));
-				} catch {
-					reject(new LocalDaemonControlPlaneClientError("daemon.control.invalid_json", "local daemon control returned malformed JSON"));
-				}
-			});
-		};
-		const handleError = (error) => {
-			const code = error && typeof error === "object" && "code" in error ? String(error.code) : "daemon.control.connection_failed";
-			fail(new LocalDaemonControlPlaneClientError(code === "ENOENT" || code === "ECONNREFUSED" ? "daemon.control.endpoint_missing" : code, error instanceof Error ? error.message : "failed to connect to local daemon control"));
-		};
-		const handleTimeout = () => {
-			fail(new LocalDaemonControlPlaneClientError("daemon.control.timeout", `local daemon control timed out after ${String(input.timeoutMs)}ms`));
-		};
-		socket.setEncoding("utf8");
-		socket.setTimeout(input.timeoutMs);
-		socket.once("connect", handleConnect);
-		socket.on("data", handleData);
-		socket.once("end", handleEnd);
-		socket.once("error", handleError);
-		socket.once("timeout", handleTimeout);
-	});
+function commandFailureDetails(result) {
+	return result.stderr.trim() || result.stdout.trim() || `exit ${result.code}`;
+}
+function toError(error) {
+	return error instanceof Error ? error : new Error(String(error));
 }
 //#endregion
 //#region src/system/local-operation-diagnostics.ts
@@ -2528,7 +2358,7 @@ function resolveDaemonServiceArtifact(input) {
 		activeBundle: input.activeBundle,
 		activeBundleEntryPath: input.activeBundleEntryPath,
 		activeBundleSourceAvailable: input.activeBundleSourceAvailable,
-		currentSourceDistFingerprint: input.currentSourceDistFingerprint,
+		installedBundleFingerprint: input.installedBundleFingerprint,
 		expectedBundleId,
 		expectedDaemonVersion,
 		pathInput: input.pathInput
@@ -2565,7 +2395,75 @@ function hasBundleIdDrift(input) {
 	return input.expectedBundleId !== null && input.activeBundle.bundleId !== input.expectedBundleId;
 }
 function hasBundleContentDrift(input) {
-	return input.currentSourceDistFingerprint !== null && input.activeBundle.sourceDistFingerprint !== input.currentSourceDistFingerprint;
+	return input.installedBundleFingerprint === null || input.activeBundle.sourceDistFingerprint !== input.installedBundleFingerprint;
+}
+//#endregion
+//#region src/local-service/lifecycle/daemon-service-update-state.ts
+const DAEMON_SERVICE_UPDATE_JOB_SCHEMA = OPENMELD_DAEMON_SERVICE_UPDATE_JOB_SCHEMA;
+function daemonServicePendingUpdatePath(pathInput = {}) {
+	return join(daemonRuntimeStateRootPath(pathInput), "service-update.json");
+}
+function daemonServiceLastUpdatePath(pathInput = {}) {
+	return join(daemonRuntimeStateRootPath(pathInput), "service-update-last.json");
+}
+async function readPendingDaemonServiceUpdate(pathInput = {}) {
+	return await readDaemonServiceUpdateJob(daemonServicePendingUpdatePath(pathInput));
+}
+async function readLastDaemonServiceUpdate(pathInput = {}) {
+	return await readDaemonServiceUpdateJob(daemonServiceLastUpdatePath(pathInput));
+}
+async function persistPendingDaemonServiceUpdate(job, pathInput = {}) {
+	await writeUpdateJobAtomically({
+		job,
+		path: daemonServicePendingUpdatePath(pathInput)
+	});
+}
+async function completePendingDaemonServiceUpdate(job, pathInput = {}, retainPending = false) {
+	await writeUpdateJobAtomically({
+		job,
+		path: daemonServiceLastUpdatePath(pathInput)
+	});
+	if (retainPending) {
+		await persistPendingDaemonServiceUpdate(job, pathInput);
+		return;
+	}
+	await rm(daemonServicePendingUpdatePath(pathInput), { force: true });
+}
+async function readDaemonServiceUpdateJob(path) {
+	const raw = await readFile(path, "utf8").catch((error) => {
+		if (error.code === "ENOENT") return null;
+		throw error;
+	});
+	if (raw === null) return null;
+	const parsed = storedDaemonServiceUpdateJobSchema.safeParse(JSON.parse(raw));
+	if (!parsed.success) throw new Error("OpenMeld Service update state is invalid.");
+	if (parsed.data.v === 2) return parsed.data;
+	const { status, ...legacyJob } = parsed.data;
+	return daemonServiceUpdateJobSchema.parse({
+		...legacyJob,
+		v: 2,
+		schema: DAEMON_SERVICE_UPDATE_JOB_SCHEMA,
+		phase: migrateLegacyPhase(status),
+		requestSource: "cli"
+	});
+}
+function migrateLegacyPhase(status) {
+	switch (status) {
+		case "scheduled": return "waiting_for_work";
+		case "running": return "updating";
+		case "completed": return "updated";
+		case "failed": return "needs_help";
+		default: return status;
+	}
+}
+async function writeUpdateJobAtomically(input) {
+	const temporaryPath = `${input.path}.${String(process.pid)}.tmp`;
+	await mkdir(dirname(input.path), { recursive: true });
+	await writeFile(temporaryPath, `${JSON.stringify(input.job, null, 2)}\n`, {
+		encoding: "utf8",
+		mode: 384
+	});
+	await rename(temporaryPath, input.path);
 }
 //#endregion
 //#region src/local-service/lifecycle/daemon-service-bundle.ts
@@ -2610,7 +2508,7 @@ function isDaemonBundleSourceAllowedForLane(input) {
 }
 async function readDaemonActiveBundleState(pathInput = {}) {
 	const raw = await readFile(daemonServiceActiveBundlePath(pathInput), "utf8").catch((error) => {
-		if (getErrorCode(error) === "ENOENT") return null;
+		if (getErrorCode$1(error) === "ENOENT") return null;
 		throw error;
 	});
 	if (raw === null) return null;
@@ -2665,8 +2563,8 @@ async function resolveAlignedDaemonActiveBundleEntryPath(input = {}) {
 	]);
 	const expectedVersion = input.expectedVersion ?? serviceContract?.daemonVersion ?? (installStatus.installed ? installStatus.state.daemonVersion : state?.daemonVersion ?? "unknown");
 	const matchingServiceContract = input.expectedVersion && serviceContract?.daemonVersion !== input.expectedVersion ? null : serviceContract;
-	const currentSourceDistFingerprint = await resolveCurrentDaemonFingerprintForState(state).catch(() => null);
 	const activeBundleEntryPath = await resolveDaemonBundleEntryPathFromState(state);
+	const installedBundleFingerprint = activeBundleEntryPath ? await resolveInstalledDaemonBundleFingerprint(state) : null;
 	return resolveDaemonServiceArtifact({
 		expectedVersion,
 		installStatus,
@@ -2674,15 +2572,22 @@ async function resolveAlignedDaemonActiveBundleEntryPath(input = {}) {
 		activeBundle: state,
 		activeBundleSourceAvailable: state && state.bundleFormat === "legacy_linked_v1" ? await pathExists$4(state.sourcePackageRootPath).catch(() => null) : null,
 		activeBundleEntryPath,
-		currentSourceDistFingerprint
+		installedBundleFingerprint
 	}).resolvedEntryPath;
 }
-async function resolveCurrentDaemonFingerprintForState(state) {
+async function resolveInstalledDaemonBundleFingerprint(state, pathInput = {}) {
 	if (state?.bundleFormat === "binary_v1") {
-		const entryPath = await resolveDaemonBundleEntryPathFromState(state);
+		const entryPath = await resolveDaemonBundleEntryPathFromState(state, pathInput);
 		return entryPath ? await hashDaemonBinaryFile(entryPath) : null;
 	}
-	return await resolveCurrentDaemonSourceDistFingerprint();
+	if (state?.bundleFormat === "self_contained_v1") {
+		const bundleRootPath = resolveDaemonBundleRootPath(state.bundleId, pathInput);
+		const distRootPath = join(bundleRootPath, dirname(state.entryScriptRelativePath));
+		const relativeDistRootPath = relative(bundleRootPath, distRootPath);
+		if (relativeDistRootPath === ".." || relativeDistRootPath.startsWith(`..${sep}`) || isAbsolute(relativeDistRootPath)) return null;
+		return await computeDaemonSourceDistFingerprint(distRootPath);
+	}
+	return null;
 }
 async function resolveDaemonBundleEntryPathFromState(state, pathInput = {}) {
 	if (!state) return null;
@@ -2695,7 +2600,7 @@ async function resolveDaemonBundleEntryPathFromState(state, pathInput = {}) {
 	return await pathExists$4(entryPath) ? entryPath : null;
 }
 async function prepareDaemonServiceBundle(input) {
-	const preparedBundle = isBinaryDistribution() ? await prepareBinaryDaemonServiceBundle() : await prepareNodeDaemonServiceBundle(input);
+	const preparedBundle = isBinaryDistribution() ? await prepareBinaryDaemonServiceBundle(input) : await prepareNodeDaemonServiceBundle(input);
 	if (input.activate !== false) await activateDaemonServiceBundle(preparedBundle);
 	return preparedBundle;
 }
@@ -2757,7 +2662,19 @@ async function prepareNodeDaemonServiceBundle(input) {
 		updatedAt: now
 	};
 }
-async function prepareBinaryDaemonServiceBundle() {
+async function prepareBinaryDaemonServiceBundle(input) {
+	const { daemonVersion } = input;
+	const bundledRelease = resolveBundledServiceRelease();
+	const binaryRelease = input.binaryRelease ?? (bundledRelease?.version === daemonVersion ? bundledRelease : void 0);
+	if (daemonVersion !== resolveCliSelfVersion()) {
+		const active = await readDaemonActiveBundleState();
+		if (active?.bundleFormat === "binary_v1" && active.daemonVersion === daemonVersion && active.sourceDistFingerprint && (!binaryRelease || binaryRelease.sha256 === active.sourceDistFingerprint) && await pathExists$4(active.sourceEntryScriptPath) && await hashDaemonBinaryFile(active.sourceEntryScriptPath) === active.sourceDistFingerprint) return active;
+	}
+	if (binaryRelease) return await prepareSelectedBinaryDaemonServiceBundle({
+		daemonVersion,
+		release: binaryRelease
+	});
+	if (daemonVersion !== resolveCliSelfVersion()) throw new Error(`Cannot prepare OpenMeld Service ${daemonVersion} from CLI ${resolveCliSelfVersion()}. Acquire the selected Service release before preparing the update.`);
 	const outcome = await performManagedInstall();
 	const managedBinaryPath = outcome.managedBinaryPath;
 	if (!await pathExists$4(managedBinaryPath)) throw new Error(`OpenMeld managed binary is missing at ${managedBinaryPath}; cannot prepare binary OpenMeld Service.`);
@@ -2778,7 +2695,67 @@ async function prepareBinaryDaemonServiceBundle() {
 		sourceEntryScriptPath: managedBinaryPath,
 		sourcePackageRootPath: managedVersionDir,
 		sourceDistRootPath: managedVersionDir,
-		sourceDistFingerprint: await hashDaemonBinaryFile(managedBinaryPath).catch(() => null),
+		sourceDistFingerprint: await hashDaemonBinaryFile(managedBinaryPath),
+		sourceKind: DAEMON_BUNDLE_SOURCE_KIND_PACKAGE_INSTALL,
+		createdAt: now,
+		updatedAt: now
+	};
+}
+async function prepareSelectedBinaryDaemonServiceBundle(input) {
+	if (input.release.version !== input.daemonVersion) throw new Error("The selected Service artifact does not match the update target.");
+	const bundleId = createBundleId(input.daemonVersion);
+	const bundleRootPath = resolveDaemonBundleRootPath(bundleId);
+	const executablePath = join(bundleRootPath, "openmeld");
+	const onDeltaFallback = (error) => {
+		console.warn("[openmeld.service.artifact_delta_fallback]", error.message);
+	};
+	const plan = await resolveCliBinaryUpdatePlan({
+		baseBinaryPath: process$1.execPath,
+		currentVersion: resolveCliSelfVersion(),
+		onDeltaFallback,
+		release: input.release
+	});
+	const bytes = await downloadCliBinaryUpdateArtifact({
+		downloadTimeoutMs: 6e4,
+		fetchImpl: fetch,
+		onDeltaFallback,
+		plan,
+		release: input.release
+	});
+	await mkdir(bundleRootPath, { recursive: true });
+	try {
+		await writeFile(executablePath, bytes, { mode: 493 });
+		await verifyCliBinaryCodeSignature({
+			artifactPath: executablePath,
+			release: input.release,
+			runCommand: async (command, args) => {
+				const result = await promisify(execFile)(command, args, { encoding: "utf8" });
+				return {
+					code: 0,
+					stdout: result.stdout,
+					stderr: result.stderr
+				};
+			}
+		});
+	} catch (error) {
+		await rm(bundleRootPath, {
+			recursive: true,
+			force: true
+		});
+		throw error;
+	}
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	return {
+		v: 2,
+		schema: DAEMON_ACTIVE_BUNDLE_SCHEMA,
+		bundleId,
+		daemonVersion: input.daemonVersion,
+		entryScriptRelativePath: "openmeld",
+		bundleFormat: "binary_v1",
+		sourceEntryScriptPath: executablePath,
+		sourcePackageRootPath: bundleRootPath,
+		sourceDistRootPath: bundleRootPath,
+		sourceDistFingerprint: input.release.sha256.toLowerCase(),
 		sourceKind: DAEMON_BUNDLE_SOURCE_KIND_PACKAGE_INSTALL,
 		createdAt: now,
 		updatedAt: now
@@ -2793,7 +2770,7 @@ async function activateDaemonServiceBundle(preparedBundle) {
 	if (preparedBundle.bundleFormat !== "binary_v1") await ensureDaemonServiceManagerExecutables();
 }
 async function discardPreparedDaemonServiceBundle(preparedBundle) {
-	if (preparedBundle.bundleFormat !== "self_contained_v1") return;
+	if (preparedBundle.bundleFormat === "legacy_linked_v1") return;
 	if ((await readDaemonActiveBundleState())?.bundleId === preparedBundle.bundleId) return;
 	await rm(resolveDaemonBundleRootPath(preparedBundle.bundleId), {
 		recursive: true,
@@ -2938,17 +2915,8 @@ async function ensureVerifiedBinaryCarrier(input) {
 async function verifyDaemonActiveBundleIntegrity(activeBundle) {
 	const expectedFingerprint = activeBundle.sourceDistFingerprint?.trim();
 	if (!expectedFingerprint || activeBundle.bundleFormat === "legacy_linked_v1") return false;
-	if (activeBundle.bundleFormat === "binary_v1") {
-		const entryPath = await resolveDaemonBundleEntryPathFromState(activeBundle);
-		if (!entryPath) return false;
-		return await hashDaemonBinaryFile(entryPath) === expectedFingerprint;
-	}
-	const bundleRootPath = resolveDaemonBundleRootPath(activeBundle.bundleId);
-	const activeDistRootPath = join(bundleRootPath, dirname(activeBundle.entryScriptRelativePath));
-	const relativeDistRootPath = relative(bundleRootPath, activeDistRootPath);
-	if (relativeDistRootPath === ".." || relativeDistRootPath.startsWith(`..${sep}`) || isAbsolute(relativeDistRootPath)) return false;
 	if (!await resolveDaemonBundleEntryPathFromState(activeBundle)) return false;
-	return await computeDaemonSourceDistFingerprint(activeDistRootPath) === expectedFingerprint;
+	return await resolveInstalledDaemonBundleFingerprint(activeBundle) === expectedFingerprint;
 }
 async function writeDaemonBundlePackageManifest(input) {
 	await writeFile(join(input.bundleRootPath, "package.json"), `${JSON.stringify({
@@ -3068,11 +3036,6 @@ async function resolveDaemonBundleSourceProvenance(explicitPath) {
 		sourceKind: inferDaemonBundleSourceKind(sourcePackageRootPath)
 	};
 }
-async function resolveCurrentDaemonSourceDistFingerprint(input = {}) {
-	const sourceProvenance = await resolveDaemonBundleSourceProvenance(input.cliScriptPath).catch(() => null);
-	if (!sourceProvenance) return null;
-	return await computeDaemonSourceDistFingerprint(sourceProvenance.sourceDistRootPath).catch(() => null);
-}
 async function resolveCliScriptPath(explicitPath) {
 	const rawPath = explicitPath ?? process$1.argv[1];
 	if (!rawPath) throw new Error("Cannot determine CLI script path for OpenMeld background service bundle.");
@@ -3129,7 +3092,7 @@ function isDaemonSourceDistPathIncluded(sourceDistRootPath, candidatePath) {
 async function collectDaemonBundleRuntimeDependencyClosure(input) {
 	const packageManifestPath = join(input.sourcePackageRootPath, "package.json");
 	const packageManifestRaw = await readFile(packageManifestPath, "utf8").catch((error) => {
-		if (getErrorCode(error) === "ENOENT") throw new Error(`OpenMeld could not find the CLI package manifest for background service bundling at ${packageManifestPath}.`);
+		if (getErrorCode$1(error) === "ENOENT") throw new Error(`OpenMeld could not find the CLI package manifest for background service bundling at ${packageManifestPath}.`);
 		throw error;
 	});
 	const packageManifest = JSON.parse(packageManifestRaw);
@@ -3191,7 +3154,7 @@ async function readDaemonBundleDependencyManifest(input) {
 	if (!dependencyPackageRootPath) return null;
 	const dependencyManifestPath = join(dependencyPackageRootPath, "package.json");
 	const dependencyManifestRaw = await readFile(dependencyManifestPath, "utf8").catch((error) => {
-		if (getErrorCode(error) === "ENOENT") {
+		if (getErrorCode$1(error) === "ENOENT") {
 			if (!input.required) return null;
 			throw new Error(`OpenMeld could not find runtime dependency ${input.dependencyName} for background service bundling at ${dependencyManifestPath}. Run \`pnpm install\` and retry.`);
 		}
@@ -3240,7 +3203,7 @@ async function findDaemonDependencyPackageRootFromManifestPath(input) {
 	let currentPath = dirname(input.dependencyManifestPath);
 	while (true) {
 		const packageManifestRaw = await readFile(join(currentPath, "package.json"), "utf8").catch((error) => {
-			if (getErrorCode(error) === "ENOENT") return null;
+			if (getErrorCode$1(error) === "ENOENT") return null;
 			throw error;
 		});
 		if (packageManifestRaw !== null) {
@@ -3577,7 +3540,7 @@ function quoteShellSingle(value) {
 }
 async function readDirectoryNames(path) {
 	return (await readdir(path, { withFileTypes: true }).catch((error) => {
-		if (getErrorCode(error) === "ENOENT") return [];
+		if (getErrorCode$1(error) === "ENOENT") return [];
 		throw error;
 	})).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
 }
@@ -3595,7 +3558,7 @@ function isDaemonBundleSourceKind(value) {
 	return value === DAEMON_BUNDLE_SOURCE_KIND_WORKSPACE || value === DAEMON_BUNDLE_SOURCE_KIND_PACKAGE_INSTALL || value === DAEMON_BUNDLE_SOURCE_KIND_NPX_CACHE || value === DAEMON_BUNDLE_SOURCE_KIND_UNKNOWN;
 }
 function isPackageEntryResolutionError(error) {
-	const code = getErrorCode(error);
+	const code = getErrorCode$1(error);
 	return code === "MODULE_NOT_FOUND" || code === "ERR_PACKAGE_PATH_NOT_EXPORTED";
 }
 function normalizeOptionalText$54(value) {
@@ -3607,7 +3570,7 @@ async function pathExists$4(path) {
 		await stat(path);
 		return true;
 	} catch (error) {
-		if (getErrorCode(error) === "ENOENT") return false;
+		if (getErrorCode$1(error) === "ENOENT") return false;
 		throw error;
 	}
 }
@@ -3635,12 +3598,414 @@ function buildPreferredCliScriptNames(rawPath) {
 function isSupportedDaemonCliEntryName(value) {
 	return DAEMON_CLI_ENTRY_NAMES.includes(value);
 }
-function getErrorCode(error) {
+function getErrorCode$1(error) {
 	if (!error || typeof error !== "object") return;
 	const code = error.code;
 	return typeof code === "string" ? code : void 0;
 }
 //#endregion
+//#region src/runtime/version.ts
+/**
+* The version of the running CLI and Service bundle.
+*
+* npm builds use package.json. Binary builds may inject an isolated staging
+* prerelease so the real update lifecycle can be exercised before a production
+* version exists.
+*/
+function resolveOpenMeldVersion() {
+	return (typeof __OPENMELD_VERSION__ === "string" ? __OPENMELD_VERSION__.trim() : "") || package_default.version;
+}
+const OPENMELD_VERSION = resolveOpenMeldVersion();
+//#endregion
+//#region src/local-components/managed-version-pruning.ts
+const MANAGED_VERSION_DIRECTORY_PATTERN = /^v?(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*))*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
+async function pruneManagedVersions(input) {
+	const versionsDir = openMeldVersionsDir(input.pathInput);
+	const managedVersions = (await readdir(versionsDir, { withFileTypes: true })).filter((entry) => entry.isDirectory() && MANAGED_VERSION_DIRECTORY_PATTERN.test(entry.name)).map((entry) => entry.name);
+	const usableManagedVersions = new Set((await Promise.all(managedVersions.map(async (version) => ({
+		usable: await isUsableManagedVersion(version, versionsDir),
+		version
+	})))).filter((entry) => entry.usable).map((entry) => entry.version));
+	const retainedVersions = /* @__PURE__ */ new Set([input.currentVersion]);
+	let rollbackVersion = null;
+	if (input.preferredRollbackVersion && input.preferredRollbackVersion !== input.currentVersion && usableManagedVersions.has(input.preferredRollbackVersion)) rollbackVersion = input.preferredRollbackVersion;
+	rollbackVersion ??= [...usableManagedVersions].filter((version) => compareSemver(version, input.currentVersion) < 0).sort((left, right) => compareSemver(right, left))[0] ?? null;
+	if (rollbackVersion) retainedVersions.add(rollbackVersion);
+	for (const protectedVersion of input.protectedVersions ?? []) if (usableManagedVersions.has(protectedVersion)) retainedVersions.add(protectedVersion);
+	await Promise.all(managedVersions.filter((version) => !retainedVersions.has(version)).map((version) => rm(path.join(versionsDir, version), { recursive: true })));
+}
+async function isUsableManagedVersion(version, versionsDir) {
+	const target = path.join(versionsDir, version, "openmeld");
+	if (!(await stat(target).catch((error) => {
+		if (getErrorCode(error) === "ENOENT") return null;
+		throw error;
+	}))?.isFile()) return false;
+	return await access(target, constants.X_OK).then(() => true, (error) => {
+		if (getErrorCode(error) === "EACCES" || getErrorCode(error) === "ENOENT") return false;
+		throw error;
+	});
+}
+function getErrorCode(error) {
+	return error && typeof error === "object" && "code" in error ? String(error.code) : null;
+}
+//#endregion
+//#region src/local-components/managed-install.ts
+const MANAGED_INSTALL_LOCK_PROFILE = "managed-cli";
+const MANAGED_INSTALL_LOCK_KEY = "install";
+const MANAGED_INSTALL_LOCK_RETRY_DELAY_MS = 100;
+const MANAGED_INSTALL_LOCK_TIMEOUT_MS = 3e4;
+function resolveCliPlatformToken() {
+	return `${process$1.platform}-${process$1.arch}`;
+}
+function resolveCliSelfVersion() {
+	return OPENMELD_VERSION;
+}
+async function isUsableManagedBinary(target) {
+	if (!(await stat(target).catch((error) => {
+		if (isErrorWithCode(error, "ENOENT")) return null;
+		throw error;
+	}))?.isFile()) return false;
+	return await access(target, constants.X_OK).then(() => true, (error) => {
+		if (isErrorWithCode(error, "EACCES") || isErrorWithCode(error, "ENOENT")) return false;
+		throw error;
+	});
+}
+async function readCurrentPointerVersion(pathInput = {}) {
+	const pointerPath = openMeldManagedBinaryPath(pathInput);
+	const target = await readlink(pointerPath).catch((error) => {
+		if (isErrorWithCode(error, "ENOENT") || isErrorWithCode(error, "EINVAL")) return null;
+		throw error;
+	});
+	if (!target) return null;
+	const resolved = path.isAbsolute(target) ? target : path.resolve(path.dirname(pointerPath), target);
+	const version = path.basename(path.dirname(resolved));
+	return version.length > 0 && path.resolve(resolved) === openMeldManagedVersionBinaryPath(version, pathInput) ? version : null;
+}
+async function readManagedCliInstallation() {
+	const version = await readCurrentPointerVersion();
+	if (!version) return null;
+	const binaryPath = openMeldManagedVersionBinaryPath(version);
+	if (!await isUsableManagedBinary(binaryPath)) return null;
+	return {
+		version,
+		binaryPath
+	};
+}
+/**
+* Install the currently-running binary (process.execPath) into the managed
+* layout and point bin/openmeld at it. Idempotent with semver arbitration:
+* a same-or-newer pointer is left in place (install only goes up), unless
+* `force` is set. Both the versioned binary and the pointer are swapped in
+* atomically via a temp name + rename.
+*/
+async function performManagedInstall(input) {
+	return await withManagedInstallTransaction(async () => performManagedInstallLocked(input));
+}
+async function withManagedInstallTransaction(run, pathInput = {}) {
+	const startedAtMs = Date.now();
+	for (;;) try {
+		return await runWithHeldLock({
+			lock: await acquireLock({
+				openMeldProfileId: MANAGED_INSTALL_LOCK_PROFILE,
+				key: MANAGED_INSTALL_LOCK_KEY,
+				meta: { component: "managed_cli.install" },
+				pathResolution: pathInput
+			}),
+			run,
+			releaseContext: {
+				component: "managed_cli.install",
+				lockKey: MANAGED_INSTALL_LOCK_KEY,
+				openMeldProfileId: MANAGED_INSTALL_LOCK_PROFILE
+			}
+		});
+	} catch (error) {
+		if (!isOpenMeldLockError(error) || isOpenMeldOrphanedLockError(error) || Date.now() - startedAtMs >= MANAGED_INSTALL_LOCK_TIMEOUT_MS) throw error;
+		await setTimeout$1(MANAGED_INSTALL_LOCK_RETRY_DELAY_MS);
+	}
+}
+/**
+* Prune managed CLI versions only while holding the install transaction lock.
+* The current pointer and every durable Service update target are re-read in
+* the lock, so cleanup cannot race an install or use a stale pending snapshot.
+*/
+async function pruneManagedInstallVersions(input) {
+	const pathInput = input.pathInput;
+	assertNoPublishedProductionMutationDuringTests(pathInput, "managed CLI versions");
+	await withManagedInstallTransaction(async () => {
+		const currentVersion = await readCurrentPointerVersion(pathInput);
+		if (currentVersion === null) return;
+		const protectedVersions = await readManagedInstallProtectedVersions(pathInput);
+		await pruneManagedVersions({
+			currentVersion,
+			pathInput,
+			preferredRollbackVersion: input.preferredRollbackVersion,
+			protectedVersions
+		});
+	}, pathInput);
+}
+async function performManagedInstallLocked(input) {
+	const force = input?.force ?? false;
+	const version = resolveCliSelfVersion();
+	const platform = resolveCliPlatformToken();
+	const currentPointerPath = openMeldManagedBinaryPath();
+	const managedBinaryPath = openMeldManagedVersionBinaryPath(version);
+	const previousVersion = await readCurrentPointerVersion();
+	const protectedVersions = await readManagedInstallProtectedVersions();
+	const baseOutcome = {
+		version,
+		platform,
+		managedBinaryPath,
+		currentPointerPath,
+		previousVersion,
+		forced: force
+	};
+	if (previousVersion !== null) {
+		const comparison = compareSemver(version, previousVersion);
+		if (!force && comparison === 0 && await isUsableManagedBinary(managedBinaryPath)) {
+			await pruneManagedVersions({
+				currentVersion: previousVersion,
+				protectedVersions
+			});
+			return {
+				...baseOutcome,
+				result: "noop_same_version"
+			};
+		}
+		if (comparison < 0 && !force) {
+			if (!await isUsableManagedBinary(managedBinaryPath)) await placeVersionedBinary(input?.sourceBinaryPath ?? process$1.execPath, version, managedBinaryPath);
+			await pruneManagedVersions({
+				currentVersion: previousVersion,
+				preferredRollbackVersion: version,
+				protectedVersions
+			});
+			return {
+				...baseOutcome,
+				result: "noop_newer_present"
+			};
+		}
+	}
+	await placeVersionedBinary(input?.sourceBinaryPath ?? process$1.execPath, version, managedBinaryPath);
+	await pruneManagedVersions({
+		currentVersion: version,
+		preferredRollbackVersion: previousVersion,
+		protectedVersions
+	});
+	await swapCurrentPointer(currentPointerPath, managedBinaryPath);
+	return {
+		...baseOutcome,
+		result: "installed"
+	};
+}
+async function readManagedInstallProtectedVersions(pathInput = {}) {
+	const [protectedVersions, pendingServiceUpdate, activeBundle] = await Promise.all([
+		readDaemonServiceUpdateWorkerProtectedManagedVersions(pathInput),
+		readPendingDaemonServiceUpdate(pathInput),
+		readDaemonActiveBundleState(pathInput)
+	]);
+	if (activeBundle?.bundleFormat === "binary_v1") protectedVersions.add(activeBundle.daemonVersion);
+	if (pendingServiceUpdate?.preparedBundle.bundleFormat === "binary_v1") protectedVersions.add(pendingServiceUpdate.preparedBundle.daemonVersion);
+	return protectedVersions;
+}
+async function placeVersionedBinary(sourceBinary, version, managedBinaryPath) {
+	await mkdir(openMeldManagedVersionDir(version), { recursive: true });
+	const tmpPath = `${managedBinaryPath}.tmp-${process$1.pid}-${Date.now()}`;
+	await rm(tmpPath, { force: true }).catch(() => void 0);
+	await copyFile(sourceBinary, tmpPath);
+	await chmod(tmpPath, 493);
+	if ((await lstat(managedBinaryPath).catch((error) => {
+		if (isErrorWithCode(error, "ENOENT")) return null;
+		throw error;
+	}))?.isDirectory()) await rm(managedBinaryPath, { recursive: true });
+	await rename(tmpPath, managedBinaryPath);
+}
+async function swapCurrentPointer(currentPointerPath, managedBinaryPath) {
+	await mkdir(openMeldBinDir(), { recursive: true });
+	const relativeTarget = path.relative(path.dirname(currentPointerPath), managedBinaryPath);
+	const tmpPath = `${currentPointerPath}.tmp-${process$1.pid}-${Date.now()}`;
+	await rm(tmpPath, { force: true }).catch(() => void 0);
+	await symlink(relativeTarget, tmpPath);
+	await rename(tmpPath, currentPointerPath);
+}
+function buildInstallSelfJsonPayload(outcome) {
+	return {
+		schemaVersion: 1,
+		type: "cli.install_self",
+		result: outcome.result,
+		version: outcome.version,
+		platform: outcome.platform,
+		managedBinaryPath: outcome.managedBinaryPath,
+		currentPointerPath: outcome.currentPointerPath,
+		previousVersion: outcome.previousVersion,
+		forced: outcome.forced
+	};
+}
+function isErrorWithCode(error, code) {
+	return error instanceof Error && "code" in error && error.code === code;
+}
+//#endregion
+//#region src/local-service/control-plane/client.ts
+const DEFAULT_LOCAL_DAEMON_CONTROL_PLANE_TIMEOUT_MS = 5e3;
+var LocalDaemonControlPlaneClientError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.code = code;
+	}
+};
+async function sendLocalDaemonControlPlaneRequest(input) {
+	const endpoint = input.endpoint ?? resolveDaemonControlPlaneEndpoint();
+	const authToken = await readDaemonControlPlaneToken();
+	if (!authToken) throw new LocalDaemonControlPlaneClientError("daemon.control.auth_token_missing", "daemon control token is missing");
+	const rawResponse = await writeControlPlaneRequest({
+		endpoint,
+		request: {
+			...input.request,
+			authToken
+		},
+		timeoutMs: input.timeoutMs ?? DEFAULT_LOCAL_DAEMON_CONTROL_PLANE_TIMEOUT_MS
+	});
+	const parsed = openMeldDaemonControlPlaneResponseSchema.safeParse(rawResponse);
+	if (!parsed.success) throw new LocalDaemonControlPlaneClientError("daemon.control.invalid_response", "local daemon control returned an invalid response");
+	if (parsed.data.code === "service.error") throw new LocalDaemonControlPlaneClientError(parsed.data.payload.errorCode, parsed.data.payload.errorMessage);
+	return parsed.data;
+}
+async function requestLocalSyncRouteCatalog(input) {
+	let response;
+	try {
+		response = await sendLocalDaemonControlPlaneRequest({
+			endpoint: input.endpoint,
+			timeoutMs: input.timeoutMs,
+			request: {
+				v: 1,
+				command: "sync_route_catalog",
+				payload: input.payload
+			}
+		});
+	} catch (error) {
+		throw rewriteDaemonControlPlaneContractMismatch(error);
+	}
+	if (response.code !== "service.sync_route_catalog") throw new LocalDaemonControlPlaneClientError("daemon.control.invalid_response", "local daemon control returned an unexpected response for route catalog sync");
+	return response.payload;
+}
+async function requestLocalAgentActivitySync(input) {
+	let response;
+	try {
+		response = await sendLocalDaemonControlPlaneRequest({
+			endpoint: input.endpoint,
+			timeoutMs: input.timeoutMs,
+			request: {
+				v: 1,
+				command: "request_agent_activity_sync",
+				payload: input.payload
+			}
+		});
+	} catch (error) {
+		throw rewriteDaemonControlPlaneContractMismatch(error);
+	}
+	if (response.code !== "service.agent_activity_sync_requested") throw new LocalDaemonControlPlaneClientError("daemon.control.invalid_response", "local daemon control returned an unexpected response for Agent Activity sync");
+	return response.payload;
+}
+async function requestLocalDaemonShutdown(input) {
+	let response;
+	try {
+		response = await sendLocalDaemonControlPlaneRequest({
+			endpoint: input.endpoint,
+			timeoutMs: input.timeoutMs,
+			request: {
+				v: 1,
+				command: "shutdown",
+				payload: input.payload
+			}
+		});
+	} catch (error) {
+		throw rewriteDaemonControlPlaneContractMismatch(error);
+	}
+	if (response.code !== "service.shutdown") throw new LocalDaemonControlPlaneClientError("daemon.control.invalid_response", "local daemon control returned an unexpected response for shutdown");
+	return response.payload;
+}
+async function requestLocalDaemonServiceUpdateReadiness(input = {}) {
+	let response;
+	try {
+		response = await sendLocalDaemonControlPlaneRequest({
+			endpoint: input.endpoint,
+			timeoutMs: input.timeoutMs,
+			request: {
+				v: 1,
+				command: "service_update_readiness"
+			}
+		});
+	} catch (error) {
+		throw rewriteDaemonControlPlaneContractMismatch(error);
+	}
+	if (response.code !== "service.update_readiness") throw new LocalDaemonControlPlaneClientError("daemon.control.invalid_response", "local daemon control returned an unexpected response for service update readiness");
+	return response.payload;
+}
+function rewriteDaemonControlPlaneContractMismatch(error) {
+	if (error instanceof LocalDaemonControlPlaneClientError && error.code === "service.invalid_request") return new LocalDaemonControlPlaneClientError("daemon.control.contract_mismatch", "local OpenMeld Service must be restarted because the daemon control-plane contract changed on this device");
+	return error;
+}
+async function writeControlPlaneRequest(input) {
+	return await new Promise((resolve, reject) => {
+		const socket = createConnection(input.endpoint);
+		let responseBuffer = "";
+		let settled = false;
+		const cleanup = () => {
+			socket.setTimeout(0);
+			socket.off("connect", handleConnect);
+			socket.off("data", handleData);
+			socket.off("end", handleEnd);
+			socket.off("error", handleError);
+			socket.off("timeout", handleTimeout);
+		};
+		const settle = (action) => {
+			if (settled) return;
+			settled = true;
+			cleanup();
+			action();
+		};
+		const fail = (error) => {
+			settle(() => {
+				socket.destroy();
+				reject(error);
+			});
+		};
+		const handleConnect = () => {
+			socket.write(`${JSON.stringify(input.request)}\n`);
+		};
+		const handleData = (chunk) => {
+			responseBuffer += chunk;
+		};
+		const handleEnd = () => {
+			settle(() => {
+				const rawResponse = responseBuffer.trim();
+				if (!rawResponse) {
+					reject(new LocalDaemonControlPlaneClientError("daemon.control.empty_response", "local daemon control returned an empty response"));
+					return;
+				}
+				try {
+					resolve(JSON.parse(rawResponse));
+				} catch {
+					reject(new LocalDaemonControlPlaneClientError("daemon.control.invalid_json", "local daemon control returned malformed JSON"));
+				}
+			});
+		};
+		const handleError = (error) => {
+			const code = error && typeof error === "object" && "code" in error ? String(error.code) : "daemon.control.connection_failed";
+			fail(new LocalDaemonControlPlaneClientError(code === "ENOENT" || code === "ECONNREFUSED" ? "daemon.control.endpoint_missing" : code, error instanceof Error ? error.message : "failed to connect to local daemon control"));
+		};
+		const handleTimeout = () => {
+			fail(new LocalDaemonControlPlaneClientError("daemon.control.timeout", `local daemon control timed out after ${String(input.timeoutMs)}ms`));
+		};
+		socket.setEncoding("utf8");
+		socket.setTimeout(input.timeoutMs);
+		socket.once("connect", handleConnect);
+		socket.on("data", handleData);
+		socket.once("end", handleEnd);
+		socket.once("error", handleError);
+		socket.once("timeout", handleTimeout);
+	});
+}
+//#endregion
 //#region src/config/auth-url.ts
 const DEFAULT_AUTH_BASE_URL = "https://auth.openmeld.ai";
 const DEV_LOCAL_AUTH_BASE_URL = "http://localhost:8788";
@@ -5331,8 +5696,9 @@ function parseJson$1(raw) {
 }
 //#endregion
 //#region src/local-service/lifecycle/current-daemon-version.ts
-function resolveCurrentDaemonExpectedVersion() {
-	return OPENMELD_VERSION;
+async function resolveCurrentDaemonExpectedVersion(selectedVersion = resolveBundledServiceRelease()?.version ?? OPENMELD_VERSION) {
+	const contract = await readDaemonServiceContract();
+	return contract && compareSemver(contract.daemonVersion, selectedVersion) > 0 ? contract.daemonVersion : selectedVersion;
 }
 //#endregion
 //#region src/local-service/core/types.ts
@@ -6402,7 +6768,7 @@ async function inspectDaemonServiceInventory(input) {
 		runtimeStatus
 	});
 	const runtimeCommandPathExists = runtimeCommandEntryPath ? await pathExists$3(runtimeCommandEntryPath).catch(() => null) : null;
-	const currentSourceDistFingerprint = activeBundle?.bundleFormat === "self_contained_v1" ? await resolveCurrentDaemonSourceDistFingerprint({ cliScriptPath: input.cliScriptPath }).catch(() => null) : null;
+	const installedBundleFingerprint = activeBundleEntryPath ? await resolveInstalledDaemonBundleFingerprint(activeBundle) : null;
 	const resolvedArtifact = resolveDaemonServiceArtifact({
 		expectedVersion: input.expectedVersion,
 		installStatus,
@@ -6410,7 +6776,7 @@ async function inspectDaemonServiceInventory(input) {
 		activeBundle,
 		activeBundleSourceAvailable,
 		activeBundleEntryPath,
-		currentSourceDistFingerprint
+		installedBundleFingerprint
 	});
 	const mergedOwnedProcesses = mergeOwnedProcesses(ownedProcesses, legacySharedService?.present ? legacySharedService.ownedProcesses : []);
 	const observedServiceManager = installStatus.installed || runtimeStatus.managedBySystemService || runtimeStatus.serviceController !== "unknown" || isKnownServiceController(serviceContract?.serviceController) ? await resolveServiceManager(resolvePreferredServiceManagerController({
@@ -6662,7 +7028,7 @@ function buildBundleAnomaly(input) {
 		}
 		case "bundle_content_drift": return {
 			code: "bundle_content_drift",
-			message: "OpenMeld Service is using older local service files than this lane expects, so OpenMeld needs to update the service."
+			message: "OpenMeld could not verify the installed Service files. The Service needs repair."
 		};
 		case "bundle_lane_drift": return {
 			code: "bundle_lane_drift",
@@ -36280,7 +36646,7 @@ async function resolveDeviceReadinessLocalDemand(input) {
 }
 async function resolveReplyReadinessInventory(_status) {
 	return await inspectDaemonServiceInventory({
-		expectedVersion: resolveCurrentDaemonExpectedVersion(),
+		expectedVersion: await resolveCurrentDaemonExpectedVersion(),
 		intent: "status_cleanup"
 	}).catch(() => null);
 }
@@ -36529,10 +36895,10 @@ function resolveRuntimeStatusForSnapshot(input) {
 	if (input.localServiceObservation) return Promise.resolve(input.localServiceObservation.runtimeStatus);
 	return resolveDaemonRuntimeState(input.daemonStatus).catch(() => null);
 }
-function resolveInventoryForSnapshot(localServiceObservation) {
+async function resolveInventoryForSnapshot(localServiceObservation) {
 	if (localServiceObservation) return Promise.resolve(localServiceObservation.inventory);
 	return inspectDaemonServiceInventory({
-		expectedVersion: resolveCurrentDaemonExpectedVersion(),
+		expectedVersion: await resolveCurrentDaemonExpectedVersion(),
 		intent: "status_cleanup"
 	}).catch(() => null);
 }
@@ -38812,8 +39178,7 @@ async function runDaemonServiceLifecycle(input) {
 		state.inventoryBefore = await inspectDaemonServiceInventory({
 			expectedVersion: input.expectedVersion,
 			intendedMode: resolveLifecycleIntendedMode(input),
-			intent: toLifecycleIntent(input.operation),
-			...input.cliScriptPath ? { cliScriptPath: input.cliScriptPath } : {}
+			intent: toLifecycleIntent(input.operation)
 		});
 		const inventoryBefore = state.inventoryBefore;
 		const desiredState = input.desiredState ?? resolveLifecycleDesiredState(inventoryBefore);
@@ -40006,6 +40371,7 @@ async function scheduleDaemonServiceUpdateLocked(input, deps) {
 	const preparedBundle = await deps.prepareBundle({
 		activate: false,
 		daemonVersion: input.targetVersion,
+		...input.binaryRelease ? { binaryRelease: input.binaryRelease } : {},
 		...input.cliScriptPath ? { cliScriptPath: input.cliScriptPath } : {}
 	});
 	const now = deps.now();
@@ -40051,6 +40417,7 @@ async function reschedulePendingDaemonServiceUpdate(input) {
 			preparedBundle: await input.dependencies.prepareBundle({
 				activate: false,
 				daemonVersion: input.request.targetVersion,
+				...input.request.binaryRelease ? { binaryRelease: input.request.binaryRelease } : {},
 				...input.request.cliScriptPath ? { cliScriptPath: input.request.cliScriptPath } : {}
 			}),
 			requestSource: input.request.requestSource ?? "cli",
@@ -40384,7 +40751,7 @@ function isCliUpdateCheckApplicable(environmentTarget, input = {}) {
 * caller fails open and never locks a user out over a flaky release channel.
 */
 async function assessCliUpdate(input) {
-	const currentVersion = OPENMELD_VERSION;
+	const currentVersion = input.currentVersion ?? OPENMELD_VERSION;
 	const unchecked = {
 		checked: false,
 		currentVersion,
@@ -40408,6 +40775,7 @@ async function assessCliUpdate(input) {
 		checked: true,
 		currentVersion,
 		latestVersion: info.version,
+		...info.serviceVersion ? { serviceVersion: info.serviceVersion } : {},
 		requiredFloor,
 		updateAvailable: compareSemver(currentVersion, info.version) < 0,
 		floorBreached
@@ -40626,11 +40994,20 @@ async function resolveOpenMeldToolsMaintenanceProjection() {
 }
 //#endregion
 //#region src/local-service/maintenance/openmeld-tools-upgrade-process.ts
+async function resolveMaintenanceCliInstallation() {
+	const installed = isBinaryDistribution() ? await readManagedCliInstallation() : null;
+	return installed && compareSemver(installed.version, OPENMELD_VERSION) >= 0 ? installed : {
+		version: OPENMELD_VERSION,
+		binaryPath: process.execPath
+	};
+}
 async function runOpenMeldToolsUpgradeProcess(context) {
+	const binaryDistribution = isBinaryDistribution();
+	const cli = await resolveMaintenanceCliInstallation();
 	const { command, argsPrefix } = resolveOpenMeldToolsUpgradeProgram({
-		binaryDistribution: isBinaryDistribution(),
+		binaryDistribution,
 		processEntryScriptPath: process.argv[1],
-		processExecutablePath: process.execPath
+		processExecutablePath: binaryDistribution ? cli.binaryPath : process.execPath
 	});
 	return await new Promise((resolve, reject) => {
 		const child = spawn(command, [...argsPrefix, "maintenance-upgrade"], {
@@ -40717,7 +41094,8 @@ function createOpenMeldToolsUpdateCoordinator(overrides = {}, options = {}) {
 		}
 		const assessment = await deps.assessUpdate({ forceRefresh: true });
 		if (!(assessment.checked && assessment.latestVersion)) return { status: "unavailable" };
-		if (!(assessment.updateAvailable || await deps.serviceNeedsAlignment(assessment.currentVersion))) return {
+		const serviceVersion = assessment.serviceVersion ?? assessment.currentVersion;
+		if (!(assessment.updateAvailable || await deps.serviceNeedsAlignment(serviceVersion))) return {
 			currentVersion: assessment.currentVersion,
 			status: "current"
 		};
@@ -40731,7 +41109,7 @@ function createOpenMeldToolsUpdateCoordinator(overrides = {}, options = {}) {
 				phase: "updating",
 				requestSource,
 				requestedAt: now,
-				targetVersion: assessment.updateAvailable ? assessment.latestVersion : assessment.currentVersion,
+				targetVersion: assessment.updateAvailable ? assessment.latestVersion : serviceVersion,
 				updatedAt: now,
 				urgency: assessment.floorBreached ? "required" : await deps.resolveUrgency()
 			}
@@ -40802,10 +41180,12 @@ function resolveDependencies(overrides) {
 		wakeWorker: overrides.wakeWorker ?? (() => startDaemonServiceUpdateWorker()),
 		assessUpdate: overrides.assessUpdate ?? (async () => await assessCliUpdate({
 			environmentTarget: await resolveOpenMeldEnvironmentTarget(),
-			forceRefresh: true
+			forceRefresh: true,
+			currentVersion: (await resolveMaintenanceCliInstallation()).version
 		})),
 		completeAttempt: overrides.completeAttempt ?? completeOpenMeldToolsUpdateAttempt,
-		serviceNeedsAlignment: overrides.serviceNeedsAlignment ?? (async (daemonVersion) => {
+		serviceNeedsAlignment: overrides.serviceNeedsAlignment ?? (async (selectedVersion) => {
+			const daemonVersion = await resolveCurrentDaemonExpectedVersion(selectedVersion);
 			const decision = resolveDaemonServiceAlignmentDecision({
 				inventory: await inspectDaemonServiceInventory({
 					expectedVersion: daemonVersion,
@@ -40842,6 +41222,6 @@ function projectServiceJob(job) {
 	};
 }
 //#endregion
-export { formatDeviceReplyReadinessLabel as $, RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS as $a, getSetupFlowCopy as $i, resolveRouteRegistrationReconcileDecision as $n, primeOpenMeldProfilesSessionCache as $o, resolveAgentControllerPermissionModeForController as $r, resolveProjectBindingForPath as $t, resolveDaemonStatusSnapshot as A, normalizeNonNegativeInteger as Aa, readCurrentDaemonOwnerSnapshot as Ai, resolveSkillsAgentRegistry as An, OPENMELD_VERSION as Ao, seedLegacyAgentContext as Ar, createModelCatalogReadSession as At, formatDaemonServiceRefreshReliabilityMessage as B, CONTROLLED_SHUTDOWN_SOCKET_CLOSE_TIMEOUT_MS as Ba, waitForDaemonSystemServiceToStop as Bi, repairBuiltinControllerInstall as Bn, upsertDaemonServiceContract as Bo, buildWorkingLanguagePromptPlan as Br, setOpenMeldManagedProfileWorkspace as Bt, isSystemServiceStartupTimeoutError as C, ensureDaemonRuntimePaths as Ca, buildCliLaunchInvocation as Ci, removeAgentCustomTarget as Cn, collectLocalOperationFailure as Co, buildRuntimeWorkspaceFingerprint as Cr, cliBinaryDeltaPatchSchema as Cs, summarizeSkippedDaemonProfiles as Ct, captureDaemonServiceEvidence as D, dirnamePath as Da, buildDaemonOwnerSnapshotFromObservedState as Di, updateAgentRegistrations as Dn, sendLocalDaemonControlPlaneRequest as Do, loadLedgerState as Dr, resolveLocalController as Dt, startDaemonSystemServiceWithAutoRepair as E, asRecord as Ea, inspectDaemonServiceInventory as Ei, updateAgentCustomTarget as En, requestLocalDaemonShutdown as Eo, commitResolvedAgentContext as Er, readLocalEnabledControllers as Et, buildDaemonServiceRefreshNextStep as F, warnDaemonEvent as Fa, getEffectiveDaemonRuntimeStatus as Fi, notifyDaemonRouteCatalogChanged as Fn, configureDaemonMaintenanceEnvironment as Fo, buildAgentContextLookupKey as Fr, readProfileWorkspaceConfig as Ft, buildDaemonServiceDependencyDetails as G, DEFAULT_RECONNECT_DELAY_MS as Ga, toStartBackgroundHelperExecutionCompatibility as Gi, isNpmGlobalCommandPath as Gn, fetchLatestPackageInfo as Go, getAgentControllerPermissionModeFieldLabel as Gr, bindProject as Gt, resolveDaemonServiceFreshnessWarning as H, DAEMON_STREAM_CONNECT_TIMEOUT_MS as Ha, listDaemonOwnedProcesses as Hi, resolveBuiltinAgentControllerDefinition as Hn, compareSemver as Ho, createAgentExecutionStatusDisplayRows as Hr, describeProfileWorkspacePathValidationFailure as Ht, buildDaemonServiceRefreshPromptMessage as I, CATALOG_SYNC_RETRY_INTERVAL_MS as Ia, readCurrentDaemonRuntimeContext as Ii, normalizeAgentId as In, hasIndependentMaintenanceRegistration as Io, DEFAULT_TASK_LIFECYCLE_HEARTBEAT_INTERVAL_MS as Ir, readProfileWorkspaceConfigForAccount as It, buildDaemonServiceDependencySummary as J, PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS as Ja, DaemonServiceRunError as Ji, normalizeDispatchThreadAction as Jn, createOpenMeldAgentProfile as Jo, parseAgentControllerRef as Jr, listProjectConnectionsWithStatus as Jt, buildDaemonServiceDependencyMeaning as K, HEARTBEAT_RESPONSE_TIMEOUT_MS as Ka, ensureDaemonRuntimeContractState as Ki, isPnpmGlobalCommandPath as Kn, readVersionState as Ko, isAgentExecutionReadyOrConnecting as Kr, isProjectBound as Kt, buildDaemonServiceRepairGuidance as L, CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS as La, readCurrentObservedDaemonRuntimeStatus as Li, normalizeAgentIds as Ln, clearDaemonServiceContract as Lo, areAgentControllerInterfaceAccountsSame as Lr, resolveConfiguredProfileWorkspacePath as Lt, resolveDaemonStatusAuthenticationAttention as M, normalizeText$11 as Ma, resolveStoppedContractWriteBlockedReason as Mi, resolveRegistryOriginLaunchCommand as Mn, completePendingDaemonServiceUpdate as Mo, upsertConversationExecutionState as Mr, resolveProfileWorkspaceRuntime as Mt, resolveServiceReadiness as N, nowIsoString as Na, summarizeDaemonOwnerSnapshot as Ni, resolveRegistryRuntimeAdapterCapabilitySnapshot as Nn, readLastDaemonServiceUpdate as No, withLedgerStateTransaction as Nr, ensureOpenMeldManagedProfileWorkspace as Nt, captureDaemonServiceEvidenceBestEffort as O, emitRunLine as Oa, formatDaemonOwnerSummaryLabel as Oi, canManageRegistryAgentSkillTargets as On, buildInstallSelfJsonPayload as Oo, removeConversationExecutionState as Or, resolveLocalRuntimeControllerSupport as Ot, resolveServiceReadinessFromServiceStatus as P, toErrorMessage$23 as Pa, clearDaemonRuntimeStateIfDefinitelyStopped as Pi, resolveRegistryRuntimeAdapterContractByAgentControllerRef as Pn, readPendingDaemonServiceUpdate as Po, buildAuthenticatedControlPlaneResponse as Pr, normalizeCustomProfileWorkspacePath as Pt, formatAgentReplyReadinessLabel as Q, RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS as Qa, buildOnboardingPlan as Qi, isDaemonReconcileInProgressError as Qn, listOpenMeldProfiles as Qo, renderWorkingLanguagePrompt as Qr, removeProjectConnection as Qt, buildDaemonServiceStatusReadOnlyDetail as R, CONTROLLED_SHUTDOWN_REQUEST_TIMEOUT_MS as Ra, resolveDaemonRuntimeState as Ri, parseAgentEnabledOption as Rn, isDaemonServiceContractIdentityReusable as Ro, buildAgentControllerRef as Rr, resolveConfiguredProfileWorkspacePathForAccount as Rt, isDaemonInventoryRunningAndStartReady as S, buildLedgerPaths as Sa, resolveDispatchSpaceActionMcpServer as Si, reconcileNewRunnableBuiltinAgentsForSetup as Sn, runWithDaemonLifecycleCommandJournal as So, runRuntimeTask as Sr, resolveUserFacingCliEntryCommand as Ss, loadDaemonRouteCatalog as St, waitForSystemServiceStartup as T, resolvePreferredDaemonDeviceId as Ta, createProviderOriginalError as Ti, setAgentRegistrationEnabled as Tn, requestLocalAgentActivitySync as To, appendLedgerHistoryEntry as Tr, resolveBuiltinAgentControllerBrand as Ts, buildRuntimeRouteTargets as Tt, clearDaemonStartFailureState as U, DAEMON_STREAM_KEEPALIVE_INTERVAL_MS as Ua, assertDaemonMaintenanceInstallationOwnership as Ui, isBunGlobalCommandPath as Un, ensureVersionStateReady as Uo, createAuthorityOpenMeldServiceRuntimeId as Ur, ProjectBindingOperationError as Ut, formatDaemonServiceUpdateRequiredMessage as V, DAEMON_RUNTIME_CONTRACT_EPOCH as Va, cleanupLegacySharedDaemonServiceState as Vi, EMPTY_AGENT_CONTROLLER_INTERFACE_CAPABILITIES as Vn, buildNextVersionState as Vo, createAgentControllerInterfaceDisplayRows as Vr, validateCustomProfileWorkspacePath as Vt, writeDaemonStartFailureState as W, DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS as Wa, resolveDaemonRuntimeContractCompatibility as Wi, isHomebrewCommandPath as Wn, fetchLatestCliBinaryRelease as Wo, getAgentControllerPermissionModeDisplayMetadata as Wr, ProjectBindingStoreUpdateRequiredError as Wt, resolveDaemonServiceDependencyDiagnostics as X, REGISTER_RESPONSE_TIMEOUT_MS as Xa, PREPARE_SESSION_RECONNECT_GRACE_MS as Xi, SPACE_ACTION_CONTEXT_GUIDANCE_LINES as Xn, deleteOpenMeldProfile as Xo, projectPeopleComputersToLegacyLocalRuntimes as Xr, removeAgentActivityBindingsWhileDeliveryLocked as Xt, buildDaemonServiceDependencyTitle as Y, PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS as Ya, resolveCurrentDaemonExpectedVersion as Yi, syncRuntimeEventToInflightTaskControlRegistry as Yn, createOpenMeldHumanProfile as Yo, peopleComputerContainsDevice as Yr, migrateProjectBindingStore as Yt, resolveCurrentReplyReadinessSnapshot as Z, RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS as Za, buildDaemonRouteObservationPresentation as Zi, SPACE_ACTION_TARGET_GUIDANCE_LINES as Zn, getOpenMeldProfileCapabilities as Zo, renderInformationProtectionPrompt as Zr, removeMissingProjectConnections as Zt, DaemonServiceLifecycleDrainTimeoutError as _, DAEMON_SERVICE_FULL_ALIGNMENT_ANOMALIES as _a, forkCodexAppServerThread as _i, listAgentRegistrations as _n, readLatestDaemonLifecycleConnectionStateEvent as _o, resolveDispatchQueueLogMeta as _r, formatOpenMeldCliLine as _s, readDaemonRouteCatalogCache as _t, resolveServiceUpdateUrgency as a, resolveCurrentOpenMeldAccountContext as aa, resolveCatalogSyncSkippedProfilesLogState as ai, withAgentActivityDeliveryLock as an, clearSelectedOpenMeldProfileId as ao, createLocalTaskInterruptSender as ar, buildAuthenticationStatusLabel as as, resolveReplyReadinessAvailabilityReasonCopy as at, prepareDaemonServiceUpdateWorkerCarrier as b, classifyDaemonServiceRunStartability as ba, createUnavailableProviderUsageLimits as bi, readAgentRuntimeConfigHealth as bn, resolveRecentDaemonSignalStopCause as bo, resolveCompatibleConversationExecutionState as br, formatProfileAwareOpenMeldCliCommands as bs, createMutableRouteCatalogState as bt, buildLocalAgentCatalogFromReadiness as c, ensureDaemonSystemServiceCommandFiles as ca, parseOpenCodeGoUsageResponse as ci, syncDeviceRuntimeStateProjection as cn, resolveOpenMeldEnvironmentTarget as co, createInflightTaskControlRegistry as cr, createAuthenticationError as cs, classifyGatewayChainFailure as ct, isCliUpdateCheckApplicable as d, isOpenMeldManagedBinaryPath as da, GrokBuildAcpTransportError as di, emitReconcileStartedEvidence as dn, prepareDaemonServiceBundle as do, MIN_HEARTBEAT_INTERVAL_MS as dr, resolveAuthenticationGuidanceFromError as ds, resolveGatewayChainRetryGuidance as dt, parseCliViewMode as ea, resolveAgentExecutionStatus as ei, runIfAgentActivityBindingGenerationIsCurrent as en, isSelectedOpenMeldProfileRequiredError as eo, createSerialAgentInteractionCallback as er, resolveOpenMeldProfile as es, formatHumanReplyReadinessReason as et, readLastOpenMeldToolsUpdateAttempt as f, buildDaemonServiceTargetSpec as fa, probeGrokBuildAcpInterface as fi, createPrimaryBindingReadSession as fn, readDaemonActiveBundleState as fo, applyAcceptedLeases as fr, resolveAuthenticationGuidanceFromMessage as fs, resolveOpenClawLocalDiagnosticsValue as ft, scheduleDaemonServiceUpdate as g, DAEMON_SERVICE_AUTO_HEAL_ANOMALIES as ga, resolveInstalledCodexLaunchCandidates as gi, listAgentCustomTargets as gn, formatDaemonLifecycleOriginSummary as go, resolveCatalogSyncIntervalMs as gr, formatOpenMeldCliCommands as gs, slugifyOpenClawNamePart as gt, runPendingDaemonServiceUpdate as h, resolveVersionChangeDirection as ha, resolveCodexTimeoutMs as hi, createRegistrationFromCatalogTarget as hn, emitDaemonLifecycleEvent as ho, resolveAdaptiveHeartbeatIntervalMs as hr, formatOpenMeldCliCommand as hs, normalizeOpenClawSpaceIdPrefix as ht, writeOpenMeldToolsMaintenancePolicy as i, setProfileDefaultView as ia, resolveSelectableCandidates as ii, resolveLocalProjectConnectionForPath as in, clearAllSelectedOpenMeldProfileIds as io, mergeOpenClawGatewayVisibility as ir, buildAgentAuthenticationGuide as is, formatSpaceMemberCommandRecoveryCopy as it, resolveDaemonStatusAttention as j, normalizeOptionalText$52 as ja, resolveDaemonStopStrategy as ji, listBuiltinAgentsRegistryEntries as jn, package_default as jo, settleInflightTask as jr, resolveCurrentEffectiveProfileWorkingFolderRuntime as jt, formatDaemonFailureContextText as k, normalizeHeartbeatIntervalMs as ka, hasActiveDaemonOwners as ki, detectInstalledSkillsAgents as kn, performManagedInstall as ko, resolveConversationExecutionStateByLookupKey as kr, syncProfileWorkspaceState as kt, readCurrentLocalDeviceId as l, extractDaemonCommandEntryPath as la, forkOpenCodeServerSession as li, emitDriftDetectedEvidence as ln, resolveAuthBaseUrl as lo, ADAPTIVE_HEARTBEAT_JITTER_RATIO as lr, extractAuthenticationPromptAction as ls, resolveGatewayChainReadiness as lt, readOpenMeldToolsUpdateContextFromEnv as m, isVersionDowngrade as ma, projectCodexUsageLimits as mi, addAgentCustomTarget as mn, resolveDaemonBundleEntryPathFromState as mo, pruneStaleLeases as mr, formatInlineOpenMeldCliCommands as ms, buildOpenClawSpaceSessionKey as mt, readOpenMeldToolsMaintenancePolicy as n, resolveViewProfileKey as na, resolveEvidenceSyncHealth as ni, unbindProject as nn, resolveOpenMeldProfileOrNull as no, normalizeDispatchPostMessageAction as nr, assertAdditionalHumanProfileCreationEnabled as ns, mapAgentReplyReadinessToLegacyAutoReply as nt, assessServerRequiredVersion as o, writeDaemonServiceContract as oa, createLocalAdapterContainer as oi, withAgentActivityLocalStateLock as on, getSelectedOpenMeldProfileId as oo, buildLocalServiceDiagnosticsPayload as or, buildCommandAuthenticationPromptMessage as os, resolveReplyReadinessGuidanceSummaryCopy as ot, readPendingOpenMeldToolsUpdateAttempt as p, resolveDaemonServiceAlignmentDecision as pa, resolveInstalledGrokBuildLaunchCandidates as pi, resolveAgentProfilePrimaryAgentControllerReport as pn, resolveAlignedDaemonActiveBundleEntryPath as po, applyIntervalJitterMs as pr, resolveAuthenticationReasonFromState as ps, prepareProviderRuntime as pt, buildDaemonServiceDependencyNextStep as q, MAX_RECONNECT_DELAY_MS as qa, readDaemonRuntimeContractRepairReport as qi, resolveLocalRegistryAgentIdFromAgentControllerRef as qn, writeVersionState as qo, listAgentControllerPermissionModeOptions as qr, listProjectBindings as qt, resolveOpenMeldToolsMaintenanceProjection as r, getProfileDefaultView as ra, resolveNativeAgentControllerPermissionModeForController as ri, canonicalizeLocalProjectPath as rn, alignSelectedOpenMeldProfileStorage as ro, createPendingAgentInteractionRegistry as rr, readDaemonCatalogSyncSignal as rs, REPLY_READINESS_COPY as rt, describeServerRequiredVersionUnavailableReason as s, buildDaemonSystemServiceCommandSpec as sa, createLocalAdapterEntries as si, NO_LOCAL_AGENTS_NEED_OPENMELD_SERVICE_REASON as sn, setSelectedOpenMeldProfileId as so, createLocalExecutionSlots as sr, buildHumanAuthenticationCard as ss, resolveOpenClawDiagnosticsGuidance as st, createOpenMeldToolsUpdateCoordinator as t, resolveRuntimeContext as ta, resolveAgentProfileEditCapabilities as ti, setDefaultProjectConnection as tn, requireOpenMeldProfile as to, buildDispatchReplyContextSummary as tr, updateOpenMeldProfile as ts, formatReplyReadinessSummary as tt, assessCliUpdate as u, resolveDaemonBundleIdFromEntryPath as ua, resolveInstalledOpenCodeLaunchCandidates as ui, emitReconcileCompletedEvidence as un, cleanupInactiveDaemonServiceBundles as uo, MAX_HEARTBEAT_INTERVAL_MS as ur, resolveAuthenticationGuidance as us, resolveGatewayChainRepairGuidance as ut, runDaemonServiceLifecycle as v, DAEMON_SERVICE_REPAIR_ANOMALIES as va, verifyCodexAppServerThread as vi, listAgentTargetStates as vn, readLatestDaemonLifecycleOriginEvent as vo, resolveDispatchContinuityObservation as vr, formatOpenMeldCliTextBlock as vs, writeDaemonRouteCatalogCache as vt, resolveSystemServiceStartupWaitMs as w, resolveDaemonDeviceId as wa, materializeCliLaunchCommand as wi, resolveAgentTargetState as wn, LocalDaemonControlPlaneClientError as wo, buildTaskResultEnvelope as wr, compareAgentControllerRefsForDisplay as ws, syncDaemonRouteCatalogState as wt, uninstallDaemonServiceUpdateWorker as x, classifyDaemonServiceWakeability as xa, createUnsupportedProviderUsageLimits as xi, reconcileNewRunnableBuiltinAgentRegistrations as xn, runDaemonServiceManagerAction as xo, resolveLatestScopedConversationExecutionState as xr, resolveSetupFollowUpCliEntryCommand as xs, createRouteCatalogFromMutableState as xt, ensureDaemonServiceMaintenanceInstalled as y, DAEMON_SERVICE_WAKEABILITY_ADVISORY_ANOMALIES as ya, resolveInstalledClaudeCodeLaunchCandidates as yi, manageAgentRegistrationInstallation as yn, readRecentDaemonLifecycleEvents as yo, resolveCompatibleAgentContextMatch as yr, formatProfileAwareOpenMeldCliCommand as ys, resolveLocalServiceDemand as yt, buildDaemonServiceUpdateRequiredNextStep as z, CONTROLLED_SHUTDOWN_RESULT_ACK_TIMEOUT_MS as za, resolveDaemonServiceManagerForRuntimeState as zi, sortAgentRegistrations as zn, readDaemonServiceContract as zo, buildInformationProtectionPromptPlan as zr, setCustomProfileWorkspace as zt };
+export { formatDeviceReplyReadinessLabel as $, RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS as $a, getSetupFlowCopy as $i, resolveRouteRegistrationReconcileDecision as $n, createOpenMeldHumanProfile as $o, resolveAgentControllerPermissionModeForController as $r, resolveProjectBindingForPath as $t, resolveDaemonStatusSnapshot as A, normalizeNonNegativeInteger as Aa, readCurrentDaemonOwnerSnapshot as Ai, resolveSkillsAgentRegistry as An, readRecentDaemonLifecycleEvents as Ao, seedLegacyAgentContext as Ar, createModelCatalogReadSession as At, formatDaemonServiceRefreshReliabilityMessage as B, CONTROLLED_SHUTDOWN_SOCKET_CLOSE_TIMEOUT_MS as Ba, waitForDaemonSystemServiceToStop as Bi, repairBuiltinControllerInstall as Bn, hasIndependentMaintenanceRegistration as Bo, buildWorkingLanguagePromptPlan as Br, setOpenMeldManagedProfileWorkspace as Bt, isSystemServiceStartupTimeoutError as C, ensureDaemonRuntimePaths as Ca, buildCliLaunchInvocation as Ci, removeAgentCustomTarget as Cn, completePendingDaemonServiceUpdate as Co, buildRuntimeWorkspaceFingerprint as Cr, formatProfileAwareOpenMeldCliCommand as Cs, summarizeSkippedDaemonProfiles as Ct, captureDaemonServiceEvidence as D, dirnamePath as Da, buildDaemonOwnerSnapshotFromObservedState as Di, updateAgentRegistrations as Dn, formatDaemonLifecycleOriginSummary as Do, loadLedgerState as Dr, compareAgentControllerRefsForDisplay as Ds, resolveLocalController as Dt, startDaemonSystemServiceWithAutoRepair as E, asRecord as Ea, inspectDaemonServiceInventory as Ei, updateAgentCustomTarget as En, emitDaemonLifecycleEvent as Eo, commitResolvedAgentContext as Er, resolveUserFacingCliEntryCommand as Es, readLocalEnabledControllers as Et, buildDaemonServiceRefreshNextStep as F, warnDaemonEvent as Fa, getEffectiveDaemonRuntimeStatus as Fi, notifyDaemonRouteCatalogChanged as Fn, downloadCliBinaryUpdateArtifact as Fo, buildAgentContextLookupKey as Fr, readProfileWorkspaceConfig as Ft, buildDaemonServiceDependencyDetails as G, DEFAULT_RECONNECT_DELAY_MS as Ga, toStartBackgroundHelperExecutionCompatibility as Gi, isNpmGlobalCommandPath as Gn, buildNextVersionState as Go, getAgentControllerPermissionModeFieldLabel as Gr, bindProject as Gt, resolveDaemonServiceFreshnessWarning as H, DAEMON_STREAM_CONNECT_TIMEOUT_MS as Ha, listDaemonOwnedProcesses as Hi, resolveBuiltinAgentControllerDefinition as Hn, isDaemonServiceContractIdentityReusable as Ho, createAgentExecutionStatusDisplayRows as Hr, describeProfileWorkspacePathValidationFailure as Ht, buildDaemonServiceRefreshPromptMessage as I, CATALOG_SYNC_RETRY_INTERVAL_MS as Ia, readCurrentDaemonRuntimeContext as Ii, normalizeAgentId as In, resolveCliBinaryUpdatePlan as Io, DEFAULT_TASK_LIFECYCLE_HEARTBEAT_INTERVAL_MS as Ir, readProfileWorkspaceConfigForAccount as It, buildDaemonServiceDependencySummary as J, PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS as Ja, DaemonServiceRunError as Ji, normalizeDispatchThreadAction as Jn, fetchLatestCliBinaryRelease as Jo, parseAgentControllerRef as Jr, listProjectConnectionsWithStatus as Jt, buildDaemonServiceDependencyMeaning as K, HEARTBEAT_RESPONSE_TIMEOUT_MS as Ka, ensureDaemonRuntimeContractState as Ki, isPnpmGlobalCommandPath as Kn, compareSemver as Ko, isAgentExecutionReadyOrConnecting as Kr, isProjectBound as Kt, buildDaemonServiceRepairGuidance as L, CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS as La, readCurrentObservedDaemonRuntimeStatus as Li, normalizeAgentIds as Ln, verifyCliBinaryCodeSignature as Lo, areAgentControllerInterfaceAccountsSame as Lr, resolveConfiguredProfileWorkspacePath as Lt, resolveDaemonStatusAuthenticationAttention as M, normalizeText$11 as Ma, resolveStoppedContractWriteBlockedReason as Mi, resolveRegistryOriginLaunchCommand as Mn, runDaemonServiceManagerAction as Mo, upsertConversationExecutionState as Mr, resolveProfileWorkspaceRuntime as Mt, resolveServiceReadiness as N, nowIsoString as Na, summarizeDaemonOwnerSnapshot as Ni, resolveRegistryRuntimeAdapterCapabilitySnapshot as Nn, runWithDaemonLifecycleCommandJournal as No, withLedgerStateTransaction as Nr, ensureOpenMeldManagedProfileWorkspace as Nt, captureDaemonServiceEvidenceBestEffort as O, emitRunLine as Oa, formatDaemonOwnerSummaryLabel as Oi, canManageRegistryAgentSkillTargets as On, readLatestDaemonLifecycleConnectionStateEvent as Oo, removeConversationExecutionState as Or, resolveBuiltinAgentControllerBrand as Os, resolveLocalRuntimeControllerSupport as Ot, resolveServiceReadinessFromServiceStatus as P, toErrorMessage$23 as Pa, clearDaemonRuntimeStateIfDefinitelyStopped as Pi, resolveRegistryRuntimeAdapterContractByAgentControllerRef as Pn, collectLocalOperationFailure as Po, buildAuthenticatedControlPlaneResponse as Pr, normalizeCustomProfileWorkspacePath as Pt, formatAgentReplyReadinessLabel as Q, RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS as Qa, buildOnboardingPlan as Qi, isDaemonReconcileInProgressError as Qn, createOpenMeldAgentProfile as Qo, renderWorkingLanguagePrompt as Qr, removeProjectConnection as Qt, buildDaemonServiceStatusReadOnlyDetail as R, CONTROLLED_SHUTDOWN_REQUEST_TIMEOUT_MS as Ra, resolveDaemonRuntimeState as Ri, parseAgentEnabledOption as Rn, package_default as Ro, buildAgentControllerRef as Rr, resolveConfiguredProfileWorkspacePathForAccount as Rt, isDaemonInventoryRunningAndStartReady as S, buildLedgerPaths as Sa, resolveDispatchSpaceActionMcpServer as Si, reconcileNewRunnableBuiltinAgentsForSetup as Sn, resolveDaemonBundleEntryPathFromState as So, runRuntimeTask as Sr, formatOpenMeldCliTextBlock as Ss, loadDaemonRouteCatalog as St, waitForSystemServiceStartup as T, resolvePreferredDaemonDeviceId as Ta, createProviderOriginalError as Ti, setAgentRegistrationEnabled as Tn, readPendingDaemonServiceUpdate as To, appendLedgerHistoryEntry as Tr, resolveSetupFollowUpCliEntryCommand as Ts, buildRuntimeRouteTargets as Tt, clearDaemonStartFailureState as U, DAEMON_STREAM_KEEPALIVE_INTERVAL_MS as Ua, assertDaemonMaintenanceInstallationOwnership as Ui, isBunGlobalCommandPath as Un, readDaemonServiceContract as Uo, createAuthorityOpenMeldServiceRuntimeId as Ur, ProjectBindingOperationError as Ut, formatDaemonServiceUpdateRequiredMessage as V, DAEMON_RUNTIME_CONTRACT_EPOCH as Va, cleanupLegacySharedDaemonServiceState as Vi, EMPTY_AGENT_CONTROLLER_INTERFACE_CAPABILITIES as Vn, clearDaemonServiceContract as Vo, createAgentControllerInterfaceDisplayRows as Vr, validateCustomProfileWorkspacePath as Vt, writeDaemonStartFailureState as W, DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS as Wa, resolveDaemonRuntimeContractCompatibility as Wi, isHomebrewCommandPath as Wn, upsertDaemonServiceContract as Wo, getAgentControllerPermissionModeDisplayMetadata as Wr, ProjectBindingStoreUpdateRequiredError as Wt, resolveDaemonServiceDependencyDiagnostics as X, REGISTER_RESPONSE_TIMEOUT_MS as Xa, PREPARE_SESSION_RECONNECT_GRACE_MS as Xi, SPACE_ACTION_CONTEXT_GUIDANCE_LINES as Xn, readVersionState as Xo, projectPeopleComputersToLegacyLocalRuntimes as Xr, removeAgentActivityBindingsWhileDeliveryLocked as Xt, buildDaemonServiceDependencyTitle as Y, PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS as Ya, resolveCurrentDaemonExpectedVersion as Yi, syncRuntimeEventToInflightTaskControlRegistry as Yn, fetchLatestPackageInfo as Yo, peopleComputerContainsDevice as Yr, migrateProjectBindingStore as Yt, resolveCurrentReplyReadinessSnapshot as Z, RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS as Za, buildDaemonRouteObservationPresentation as Zi, SPACE_ACTION_TARGET_GUIDANCE_LINES as Zn, writeVersionState as Zo, renderInformationProtectionPrompt as Zr, removeMissingProjectConnections as Zt, DaemonServiceLifecycleDrainTimeoutError as _, DAEMON_SERVICE_FULL_ALIGNMENT_ANOMALIES as _a, forkCodexAppServerThread as _i, listAgentRegistrations as _n, OPENMELD_VERSION as _o, resolveDispatchQueueLogMeta as _r, resolveAuthenticationReasonFromState as _s, readDaemonRouteCatalogCache as _t, resolveServiceUpdateUrgency as a, resolveCurrentOpenMeldAccountContext as aa, resolveCatalogSyncSkippedProfilesLogState as ai, withAgentActivityDeliveryLock as an, clearSelectedOpenMeldProfileId as ao, createLocalTaskInterruptSender as ar, updateOpenMeldProfile as as, resolveReplyReadinessAvailabilityReasonCopy as at, prepareDaemonServiceUpdateWorkerCarrier as b, classifyDaemonServiceRunStartability as ba, createUnavailableProviderUsageLimits as bi, readAgentRuntimeConfigHealth as bn, readDaemonActiveBundleState as bo, resolveCompatibleConversationExecutionState as br, formatOpenMeldCliCommands as bs, createMutableRouteCatalogState as bt, buildLocalAgentCatalogFromReadiness as c, ensureDaemonSystemServiceCommandFiles as ca, parseOpenCodeGoUsageResponse as ci, syncDeviceRuntimeStateProjection as cn, resolveOpenMeldEnvironmentTarget as co, createInflightTaskControlRegistry as cr, buildAgentAuthenticationGuide as cs, classifyGatewayChainFailure as ct, isCliUpdateCheckApplicable as d, isOpenMeldManagedBinaryPath as da, GrokBuildAcpTransportError as di, emitReconcileStartedEvidence as dn, requestLocalAgentActivitySync as do, MIN_HEARTBEAT_INTERVAL_MS as dr, buildHumanAuthenticationCard as ds, resolveGatewayChainRetryGuidance as dt, parseCliViewMode as ea, resolveAgentExecutionStatus as ei, runIfAgentActivityBindingGenerationIsCurrent as en, isSelectedOpenMeldProfileRequiredError as eo, createSerialAgentInteractionCallback as er, deleteOpenMeldProfile as es, formatHumanReplyReadinessReason as et, readLastOpenMeldToolsUpdateAttempt as f, buildDaemonServiceTargetSpec as fa, probeGrokBuildAcpInterface as fi, createPrimaryBindingReadSession as fn, requestLocalDaemonShutdown as fo, applyAcceptedLeases as fr, createAuthenticationError as fs, resolveOpenClawLocalDiagnosticsValue as ft, scheduleDaemonServiceUpdate as g, DAEMON_SERVICE_AUTO_HEAL_ANOMALIES as ga, resolveInstalledCodexLaunchCandidates as gi, listAgentCustomTargets as gn, readManagedCliInstallation as go, resolveCatalogSyncIntervalMs as gr, resolveAuthenticationGuidanceFromMessage as gs, slugifyOpenClawNamePart as gt, runPendingDaemonServiceUpdate as h, resolveVersionChangeDirection as ha, resolveCodexTimeoutMs as hi, createRegistrationFromCatalogTarget as hn, performManagedInstall as ho, resolveAdaptiveHeartbeatIntervalMs as hr, resolveAuthenticationGuidanceFromError as hs, normalizeOpenClawSpaceIdPrefix as ht, writeOpenMeldToolsMaintenancePolicy as i, setProfileDefaultView as ia, resolveSelectableCandidates as ii, resolveLocalProjectConnectionForPath as in, clearAllSelectedOpenMeldProfileIds as io, mergeOpenClawGatewayVisibility as ir, resolveOpenMeldProfile as is, formatSpaceMemberCommandRecoveryCopy as it, resolveDaemonStatusAttention as j, normalizeOptionalText$52 as ja, resolveDaemonStopStrategy as ji, listBuiltinAgentsRegistryEntries as jn, resolveRecentDaemonSignalStopCause as jo, settleInflightTask as jr, resolveCurrentEffectiveProfileWorkingFolderRuntime as jt, formatDaemonFailureContextText as k, normalizeHeartbeatIntervalMs as ka, hasActiveDaemonOwners as ki, detectInstalledSkillsAgents as kn, readLatestDaemonLifecycleOriginEvent as ko, resolveConversationExecutionStateByLookupKey as kr, syncProfileWorkspaceState as kt, readCurrentLocalDeviceId as l, extractDaemonCommandEntryPath as la, forkOpenCodeServerSession as li, emitDriftDetectedEvidence as ln, resolveAuthBaseUrl as lo, ADAPTIVE_HEARTBEAT_JITTER_RATIO as lr, buildAuthenticationStatusLabel as ls, resolveGatewayChainReadiness as lt, readOpenMeldToolsUpdateContextFromEnv as m, isVersionDowngrade as ma, projectCodexUsageLimits as mi, addAgentCustomTarget as mn, buildInstallSelfJsonPayload as mo, pruneStaleLeases as mr, resolveAuthenticationGuidance as ms, buildOpenClawSpaceSessionKey as mt, readOpenMeldToolsMaintenancePolicy as n, resolveViewProfileKey as na, resolveEvidenceSyncHealth as ni, unbindProject as nn, resolveOpenMeldProfileOrNull as no, normalizeDispatchPostMessageAction as nr, listOpenMeldProfiles as ns, mapAgentReplyReadinessToLegacyAutoReply as nt, assessServerRequiredVersion as o, writeDaemonServiceContract as oa, createLocalAdapterContainer as oi, withAgentActivityLocalStateLock as on, getSelectedOpenMeldProfileId as oo, buildLocalServiceDiagnosticsPayload as or, assertAdditionalHumanProfileCreationEnabled as os, resolveReplyReadinessGuidanceSummaryCopy as ot, readPendingOpenMeldToolsUpdateAttempt as p, resolveDaemonServiceAlignmentDecision as pa, resolveInstalledGrokBuildLaunchCandidates as pi, resolveAgentProfilePrimaryAgentControllerReport as pn, sendLocalDaemonControlPlaneRequest as po, applyIntervalJitterMs as pr, extractAuthenticationPromptAction as ps, prepareProviderRuntime as pt, buildDaemonServiceDependencyNextStep as q, MAX_RECONNECT_DELAY_MS as qa, readDaemonRuntimeContractRepairReport as qi, resolveLocalRegistryAgentIdFromAgentControllerRef as qn, ensureVersionStateReady as qo, listAgentControllerPermissionModeOptions as qr, listProjectBindings as qt, resolveOpenMeldToolsMaintenanceProjection as r, getProfileDefaultView as ra, resolveNativeAgentControllerPermissionModeForController as ri, canonicalizeLocalProjectPath as rn, alignSelectedOpenMeldProfileStorage as ro, createPendingAgentInteractionRegistry as rr, primeOpenMeldProfilesSessionCache as rs, REPLY_READINESS_COPY as rt, describeServerRequiredVersionUnavailableReason as s, buildDaemonSystemServiceCommandSpec as sa, createLocalAdapterEntries as si, NO_LOCAL_AGENTS_NEED_OPENMELD_SERVICE_REASON as sn, setSelectedOpenMeldProfileId as so, createLocalExecutionSlots as sr, readDaemonCatalogSyncSignal as ss, resolveOpenClawDiagnosticsGuidance as st, createOpenMeldToolsUpdateCoordinator as t, resolveRuntimeContext as ta, resolveAgentProfileEditCapabilities as ti, setDefaultProjectConnection as tn, requireOpenMeldProfile as to, buildDispatchReplyContextSummary as tr, getOpenMeldProfileCapabilities as ts, formatReplyReadinessSummary as tt, assessCliUpdate as u, resolveDaemonBundleIdFromEntryPath as ua, resolveInstalledOpenCodeLaunchCandidates as ui, emitReconcileCompletedEvidence as un, LocalDaemonControlPlaneClientError as uo, MAX_HEARTBEAT_INTERVAL_MS as ur, buildCommandAuthenticationPromptMessage as us, resolveGatewayChainRepairGuidance as ut, runDaemonServiceLifecycle as v, DAEMON_SERVICE_REPAIR_ANOMALIES as va, verifyCodexAppServerThread as vi, listAgentTargetStates as vn, cleanupInactiveDaemonServiceBundles as vo, resolveDispatchContinuityObservation as vr, formatInlineOpenMeldCliCommands as vs, writeDaemonRouteCatalogCache as vt, resolveSystemServiceStartupWaitMs as w, resolveDaemonDeviceId as wa, materializeCliLaunchCommand as wi, resolveAgentTargetState as wn, readLastDaemonServiceUpdate as wo, buildTaskResultEnvelope as wr, formatProfileAwareOpenMeldCliCommands as ws, syncDaemonRouteCatalogState as wt, uninstallDaemonServiceUpdateWorker as x, classifyDaemonServiceWakeability as xa, createUnsupportedProviderUsageLimits as xi, reconcileNewRunnableBuiltinAgentRegistrations as xn, resolveAlignedDaemonActiveBundleEntryPath as xo, resolveLatestScopedConversationExecutionState as xr, formatOpenMeldCliLine as xs, createRouteCatalogFromMutableState as xt, ensureDaemonServiceMaintenanceInstalled as y, DAEMON_SERVICE_WAKEABILITY_ADVISORY_ANOMALIES as ya, resolveInstalledClaudeCodeLaunchCandidates as yi, manageAgentRegistrationInstallation as yn, prepareDaemonServiceBundle as yo, resolveCompatibleAgentContextMatch as yr, formatOpenMeldCliCommand as ys, resolveLocalServiceDemand as yt, buildDaemonServiceUpdateRequiredNextStep as z, CONTROLLED_SHUTDOWN_RESULT_ACK_TIMEOUT_MS as za, resolveDaemonServiceManagerForRuntimeState as zi, sortAgentRegistrations as zn, configureDaemonMaintenanceEnvironment as zo, buildInformationProtectionPromptPlan as zr, setCustomProfileWorkspace as zt };
 
-//# sourceMappingURL=openmeld-tools-update-coordinator-Bf8KyI6N.js.map
+//# sourceMappingURL=openmeld-tools-update-coordinator-DNMcMykJ.js.map