openmeld 0.3.206 → 0.3.207

package/dist/daemon-service-runtime-DQW9gSLT.js

@@ -0,0 +1,3642 @@
+#!/usr/bin/env node
+
+import { $ as openMeldBinDir, N as OPENMELD_HOME_ENV_KEY, a as isOpenMeldOrphanedLockError, d as runWithHeldLock, dt as resolveOpenMeldEnvPreset, et as openMeldManagedBinaryPath, ft as resolveOpenMeldRootDir, i as isOpenMeldLockError, it as openMeldVersionsDir, mt as resolveOpenMeldServiceScope, nt as openMeldManagedVersionDir, rt as openMeldRootDir, t as acquireLock, tt as openMeldManagedVersionBinaryPath, v as resolveCliContextId } from "./lock-Dxp6o_t_.js";
+import { n as cliBinaryManifestSchema, r as cliBinaryServiceReleaseSchema, t as cliBinaryDeltaPatchSchema } from "./cli-binary-manifest-DiUulkp0.js";
+import { R as openMeldToolsUpdateOperationPhaseSchema, V as openMeldToolsUpdateRequestSourceSchema, a as openMeldDaemonControlPlaneResponseSchema } from "./control-plane-D9jDcbMZ.js";
+import { t as daemonServiceContractSchema } from "./service-contract-CRyDcIIf.js";
+import { n as resolveOpenMeldDistribution, t as isBinaryDistribution } from "./distribution-DY2fBeSW.js";
+import { r as readDaemonRuntimeLease } from "./daemon-runtime-lease-Dd4hdHNo.js";
+import { n as writeDaemonLocalStateFile, t as readDaemonLocalStateFile } from "./daemon-local-state-file-jOXuXrky.js";
+import { A as getDaemonStatus, C as daemonServiceStableBinaryExecutablePath, D as daemonStatePath, E as daemonServiceUpdateWorkerBinaryExecutablePath, N as readDaemonControlPlaneToken, P as readDaemonServiceLifecycleLockMeta, R as resolveDaemonControlPlaneEndpoint, T as daemonServiceStableLauncherPath, U as uninstallDaemon, _ as daemonRuntimeStateRootPath, a as DAEMON_SERVICE_RUNTIME_MODE_ENV, b as daemonServiceLegacyExecutableWrapperPath, f as daemonLifecycleJournalPath, g as daemonRuntimeServiceManagerPath, h as daemonRuntimeRootPath, i as DAEMON_SERVICE_RUNTIME_DETACHED_ENV, k as getDaemonRuntimeStatus, l as clearDaemonServiceRuntimeState, n as DAEMON_SERVICE_RUNTIME_AUTO_START_ENV, p as daemonRuntimeBundlesPath, r as DAEMON_SERVICE_RUNTIME_CONTROLLER_ENV, s as DAEMON_SERVICE_RUNTIME_SYSTEM_SERVICE_ENV, t as DAEMON_HEARTBEAT_STALE_MS, v as daemonServiceActiveBundleStatePath, w as daemonServiceStableExecutableWrapperPath, x as daemonServiceRecognizedExecutablePaths$1, y as daemonServiceExecutableWrapperPaths$1 } from "./daemon-state-C37ZtIZK.js";
+import { A as isTestProcess, D as assertNoPublishedProductionMutationDuringTests, E as resolveDaemonServiceIdentity, S as resolveDaemonServiceManager, k as isPublishedProductionOpenMeldRoot } from "./daemon-service-manager-GiMCiTmu.js";
+import { t as sleep } from "./dist-o3UL1EGQ.js";
+import { createRequire } from "node:module";
+import { createHash } from "node:crypto";
+import { homedir } from "node:os";
+import path, { basename, dirname, isAbsolute, join, relative, sep } from "node:path";
+import { access, appendFile, chmod, copyFile, cp, lstat, mkdir, readFile, readdir, readlink, realpath, rename, rm, stat, symlink, writeFile } from "node:fs/promises";
+import * as z$1 from "zod/v4";
+import { constants } from "node:fs";
+import process$1 from "node:process";
+import { execFile, spawn } from "node:child_process";
+import { setTimeout } from "node:timers/promises";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+import { createConnection } from "node:net";
+import { gunzipSync } from "node:zlib";
+//#region ../../packages/schemas/dist/schemas/daemon/service-update-job.js
+const OPENMELD_DAEMON_SERVICE_UPDATE_JOB_SCHEMA = "openmeld-daemon-service-update-job-v2";
+const daemonServiceUpdatePreparedBundleSchema = z$1.strictObject({
+	v: z$1.literal(2),
+	schema: z$1.literal("openmeld-daemon-active-bundle-v2"),
+	bundleId: z$1.string().min(1),
+	daemonVersion: z$1.string().min(1),
+	entryScriptRelativePath: z$1.string().min(1),
+	bundleFormat: z$1.enum([
+		"legacy_linked_v1",
+		"self_contained_v1",
+		"binary_v1"
+	]),
+	sourceEntryScriptPath: z$1.string().min(1),
+	sourcePackageRootPath: z$1.string().min(1),
+	sourceDistRootPath: z$1.string().min(1),
+	sourceDistFingerprint: z$1.string().min(1).nullable().optional(),
+	sourceKind: z$1.enum([
+		"workspace",
+		"package_install",
+		"npx_cache",
+		"unknown"
+	]),
+	createdAt: z$1.iso.datetime({ offset: true }),
+	updatedAt: z$1.iso.datetime({ offset: true })
+});
+const daemonServiceUpdateJobBodySchema = z$1.strictObject({
+	attempts: z$1.number().int().nonnegative(),
+	desiredState: z$1.enum(["background", "stopped"]),
+	errorMessage: z$1.string().min(1).nullable(),
+	jobId: z$1.string().min(1),
+	preparedBundle: daemonServiceUpdatePreparedBundleSchema,
+	requestedAt: z$1.iso.datetime({ offset: true }),
+	targetVersion: z$1.string().min(1),
+	updatedAt: z$1.iso.datetime({ offset: true }),
+	urgency: z$1.enum(["available", "required"])
+});
+const daemonServiceUpdateJobV1Schema = daemonServiceUpdateJobBodySchema.extend({
+	v: z$1.literal(1),
+	schema: z$1.literal("openmeld-daemon-service-update-job-v1"),
+	status: z$1.enum([
+		"scheduled",
+		"running",
+		"completed",
+		"failed"
+	])
+});
+const daemonServiceUpdateJobSchema = daemonServiceUpdateJobBodySchema.extend({
+	v: z$1.literal(2),
+	schema: z$1.literal(OPENMELD_DAEMON_SERVICE_UPDATE_JOB_SCHEMA),
+	phase: openMeldToolsUpdateOperationPhaseSchema,
+	requestSource: openMeldToolsUpdateRequestSourceSchema
+});
+const storedDaemonServiceUpdateJobSchema = z$1.discriminatedUnion("v", [daemonServiceUpdateJobV1Schema, daemonServiceUpdateJobSchema]);
+//#endregion
+//#region src/config/daemon-service-contract.ts
+const DAEMON_SERVICE_CONTRACT_FILENAME = "service-contract.json";
+function daemonServiceContractPath(pathInput = {}) {
+	return join(daemonRuntimeStateRootPath(pathInput), DAEMON_SERVICE_CONTRACT_FILENAME);
+}
+async function readDaemonServiceContract(pathInput = {}) {
+	return await readDaemonLocalStateFile({
+		path: daemonServiceContractPath(pathInput),
+		schema: daemonServiceContractSchema
+	});
+}
+async function upsertDaemonServiceContract(input, pathInput = {}) {
+	assertDaemonServiceContractMutationAllowed(pathInput);
+	const current = await readDaemonServiceContract(pathInput);
+	const candidate = buildContractCandidate(input, pathInput, current);
+	assertDaemonServiceContractIdentityAllowed(candidate, pathInput);
+	if (current && isSameContractState(current, candidate)) return current;
+	const next = {
+		...candidate,
+		generation: current ? current.generation + 1 : 1,
+		updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+	await writeDaemonLocalStateFile({
+		path: daemonServiceContractPath(pathInput),
+		schema: daemonServiceContractSchema,
+		value: next,
+		mode: 384
+	});
+	return next;
+}
+async function clearDaemonServiceContract(pathInput = {}) {
+	assertDaemonServiceContractMutationAllowed(pathInput);
+	await rm(daemonServiceContractPath(pathInput), { force: true });
+}
+function assertDaemonServiceContractMutationAllowed(pathInput) {
+	assertNoPublishedProductionMutationDuringTests(pathInput, "OpenMeld Service contract");
+}
+function assertDaemonServiceContractIdentityAllowed(candidate, pathInput) {
+	if (!isUnsafeProductionDaemonServiceContractIdentity(candidate)) return;
+	if (isTestProcess(pathInput) && !isPublishedProductionOpenMeldRoot(pathInput)) return;
+	throw new Error(["Refusing to write OpenMeld Service contract with a test fixture identity in the published production lane.", "Run `openmeld service repair --profile <profile-id>` from the signed-in production lane, or clear the polluted local service state before retrying."].join(" "));
+}
+function isDaemonServiceContractIdentityReusable(contract, pathInput = {}) {
+	if (!contract) return false;
+	if (contract.lane !== resolveOpenMeldEnvPreset(pathInput)) return false;
+	return !isUnsafeProductionDaemonServiceContractIdentity(contract);
+}
+function isUnsafeProductionDaemonServiceContractIdentity(contract) {
+	if (contract.lane !== "prod") return false;
+	return isUnsafeProductionDeviceId(contract.deviceId) || (contract.profileId ? isUnsafeProductionProfileId(contract.profileId) : false);
+}
+function isUnsafeProductionDeviceId(deviceId) {
+	return normalizeFixtureText(deviceId) === "device_123";
+}
+function isUnsafeProductionProfileId(profileId) {
+	return UNSAFE_PRODUCTION_PROFILE_IDS.has(normalizeFixtureText(profileId));
+}
+const UNSAFE_PRODUCTION_PROFILE_IDS = /* @__PURE__ */ new Set([
+	"agt_existing",
+	"11111111-1111-1111-1111-111111111111",
+	"agt_11111111-1111-1111-1111-111111111111",
+	"11111111-1111-4111-8111-111111111111",
+	"agt_11111111-1111-4111-8111-111111111111"
+]);
+function normalizeFixtureText(value) {
+	return value.trim().toLowerCase();
+}
+function buildContractCandidate(input, pathInput, current) {
+	const lane = input.lane ?? resolveOpenMeldEnvPreset(pathInput);
+	const connectedComputerId = input.connectedComputerId ?? (current && canReuseConnectedComputerEvidence(current, input, lane) ? current.connectedComputerId : void 0);
+	return {
+		schema: "openmeld-daemon-service-contract-v1",
+		v: 1,
+		lane,
+		daemonVersion: input.daemonVersion,
+		bundleId: input.bundleId,
+		desiredState: input.desiredState,
+		serviceController: input.serviceController,
+		autoStart: input.autoStart,
+		gatewayUrl: input.gatewayUrl,
+		...input.ownerUserId ? { ownerUserId: input.ownerUserId } : {},
+		...input.profileId ? { profileId: input.profileId } : {},
+		deviceId: input.deviceId,
+		...connectedComputerId ? { connectedComputerId } : {},
+		heartbeatMs: input.heartbeatMs
+	};
+}
+function canReuseConnectedComputerEvidence(current, input, lane) {
+	if (current.lane !== lane || current.gatewayUrl !== input.gatewayUrl || current.deviceId !== input.deviceId) return false;
+	if (current.ownerUserId && input.ownerUserId) return current.ownerUserId === input.ownerUserId;
+	if (current.profileId && input.profileId) return current.profileId === input.profileId;
+	return !(current.ownerUserId || input.ownerUserId);
+}
+function isSameContractState(current, candidate) {
+	return current.schema === candidate.schema && current.v === candidate.v && current.lane === candidate.lane && current.daemonVersion === candidate.daemonVersion && current.bundleId === candidate.bundleId && current.desiredState === candidate.desiredState && current.serviceController === candidate.serviceController && current.autoStart === candidate.autoStart && current.gatewayUrl === candidate.gatewayUrl && current.ownerUserId === candidate.ownerUserId && current.profileId === candidate.profileId && current.deviceId === candidate.deviceId && current.connectedComputerId === candidate.connectedComputerId && current.heartbeatMs === candidate.heartbeatMs;
+}
+//#endregion
+//#region src/local-service/control-plane/client.ts
+const DEFAULT_LOCAL_DAEMON_CONTROL_PLANE_TIMEOUT_MS = 5e3;
+var LocalDaemonControlPlaneClientError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.code = code;
+	}
+};
+async function sendLocalDaemonControlPlaneRequest(input) {
+	const endpoint = input.endpoint ?? resolveDaemonControlPlaneEndpoint();
+	const authToken = await readDaemonControlPlaneToken();
+	if (!authToken) throw new LocalDaemonControlPlaneClientError("daemon.control.auth_token_missing", "daemon control token is missing");
+	const rawResponse = await writeControlPlaneRequest({
+		endpoint,
+		request: {
+			...input.request,
+			authToken
+		},
+		timeoutMs: input.timeoutMs ?? DEFAULT_LOCAL_DAEMON_CONTROL_PLANE_TIMEOUT_MS
+	});
+	const parsed = openMeldDaemonControlPlaneResponseSchema.safeParse(rawResponse);
+	if (!parsed.success) throw new LocalDaemonControlPlaneClientError("daemon.control.invalid_response", "local daemon control returned an invalid response");
+	if (parsed.data.code === "service.error") throw new LocalDaemonControlPlaneClientError(parsed.data.payload.errorCode, parsed.data.payload.errorMessage);
+	return parsed.data;
+}
+async function requestLocalSyncRouteCatalog(input) {
+	let response;
+	try {
+		response = await sendLocalDaemonControlPlaneRequest({
+			endpoint: input.endpoint,
+			timeoutMs: input.timeoutMs,
+			request: {
+				v: 1,
+				command: "sync_route_catalog",
+				payload: input.payload
+			}
+		});
+	} catch (error) {
+		throw rewriteDaemonControlPlaneContractMismatch(error);
+	}
+	if (response.code !== "service.sync_route_catalog") throw new LocalDaemonControlPlaneClientError("daemon.control.invalid_response", "local daemon control returned an unexpected response for route catalog sync");
+	return response.payload;
+}
+async function requestLocalAgentActivitySync(input) {
+	let response;
+	try {
+		response = await sendLocalDaemonControlPlaneRequest({
+			endpoint: input.endpoint,
+			timeoutMs: input.timeoutMs,
+			request: {
+				v: 1,
+				command: "request_agent_activity_sync",
+				payload: input.payload
+			}
+		});
+	} catch (error) {
+		throw rewriteDaemonControlPlaneContractMismatch(error);
+	}
+	if (response.code !== "service.agent_activity_sync_requested") throw new LocalDaemonControlPlaneClientError("daemon.control.invalid_response", "local daemon control returned an unexpected response for Agent Activity sync");
+	return response.payload;
+}
+async function requestLocalDaemonShutdown(input) {
+	let response;
+	try {
+		response = await sendLocalDaemonControlPlaneRequest({
+			endpoint: input.endpoint,
+			timeoutMs: input.timeoutMs,
+			request: {
+				v: 1,
+				command: "shutdown",
+				payload: input.payload
+			}
+		});
+	} catch (error) {
+		throw rewriteDaemonControlPlaneContractMismatch(error);
+	}
+	if (response.code !== "service.shutdown") throw new LocalDaemonControlPlaneClientError("daemon.control.invalid_response", "local daemon control returned an unexpected response for shutdown");
+	return response.payload;
+}
+async function requestLocalDaemonServiceUpdateReadiness(input = {}) {
+	let response;
+	try {
+		response = await sendLocalDaemonControlPlaneRequest({
+			endpoint: input.endpoint,
+			timeoutMs: input.timeoutMs,
+			request: {
+				v: 1,
+				command: "service_update_readiness"
+			}
+		});
+	} catch (error) {
+		throw rewriteDaemonControlPlaneContractMismatch(error);
+	}
+	if (response.code !== "service.update_readiness") throw new LocalDaemonControlPlaneClientError("daemon.control.invalid_response", "local daemon control returned an unexpected response for service update readiness");
+	return response.payload;
+}
+function rewriteDaemonControlPlaneContractMismatch(error) {
+	if (error instanceof LocalDaemonControlPlaneClientError && error.code === "service.invalid_request") return new LocalDaemonControlPlaneClientError("daemon.control.contract_mismatch", "local OpenMeld Service must be restarted because the daemon control-plane contract changed on this device");
+	return error;
+}
+async function writeControlPlaneRequest(input) {
+	return await new Promise((resolve, reject) => {
+		const socket = createConnection(input.endpoint);
+		let responseBuffer = "";
+		let settled = false;
+		const cleanup = () => {
+			socket.setTimeout(0);
+			socket.off("connect", handleConnect);
+			socket.off("data", handleData);
+			socket.off("end", handleEnd);
+			socket.off("error", handleError);
+			socket.off("timeout", handleTimeout);
+		};
+		const settle = (action) => {
+			if (settled) return;
+			settled = true;
+			cleanup();
+			action();
+		};
+		const fail = (error) => {
+			settle(() => {
+				socket.destroy();
+				reject(error);
+			});
+		};
+		const handleConnect = () => {
+			socket.write(`${JSON.stringify(input.request)}\n`);
+		};
+		const handleData = (chunk) => {
+			responseBuffer += chunk;
+		};
+		const handleEnd = () => {
+			settle(() => {
+				const rawResponse = responseBuffer.trim();
+				if (!rawResponse) {
+					reject(new LocalDaemonControlPlaneClientError("daemon.control.empty_response", "local daemon control returned an empty response"));
+					return;
+				}
+				try {
+					resolve(JSON.parse(rawResponse));
+				} catch {
+					reject(new LocalDaemonControlPlaneClientError("daemon.control.invalid_json", "local daemon control returned malformed JSON"));
+				}
+			});
+		};
+		const handleError = (error) => {
+			const code = error && typeof error === "object" && "code" in error ? String(error.code) : "daemon.control.connection_failed";
+			fail(new LocalDaemonControlPlaneClientError(code === "ENOENT" || code === "ECONNREFUSED" ? "daemon.control.endpoint_missing" : code, error instanceof Error ? error.message : "failed to connect to local daemon control"));
+		};
+		const handleTimeout = () => {
+			fail(new LocalDaemonControlPlaneClientError("daemon.control.timeout", `local daemon control timed out after ${String(input.timeoutMs)}ms`));
+		};
+		socket.setEncoding("utf8");
+		socket.setTimeout(input.timeoutMs);
+		socket.once("connect", handleConnect);
+		socket.on("data", handleData);
+		socket.once("end", handleEnd);
+		socket.once("error", handleError);
+		socket.once("timeout", handleTimeout);
+	});
+}
+//#endregion
+//#region ../../runtime/local-service/src/cli-binary-delta.ts
+function reconstructCliBinaryDelta(input) {
+	verifyBytes({
+		bytes: input.baseBytes,
+		expectedSha256: input.delta.fromSha256,
+		expectedSizeBytes: input.delta.fromSizeBytes,
+		label: "delta base"
+	});
+	const patch = parseCliBinaryDeltaPatch(input.patchPayloadBytes);
+	assertPatchMatchesRelease({
+		delta: input.delta,
+		patch,
+		targetSha256: input.targetSha256,
+		targetSizeBytes: input.targetSizeBytes
+	});
+	const targetBytes = Buffer.alloc(input.targetSizeBytes);
+	input.baseBytes.copy(targetBytes, 0, 0, Math.min(input.baseBytes.byteLength, targetBytes.byteLength));
+	let previousEnd = 0;
+	for (const segment of patch.segments) {
+		const bytes = Buffer.from(segment.dataBase64, "base64");
+		const segmentEnd = segment.offset + bytes.byteLength;
+		if (segment.offset < previousEnd) throw new Error("delta patch segments must be sorted and non-overlapping");
+		if (segmentEnd > targetBytes.byteLength) throw new Error("delta patch segment exceeds the target binary size");
+		bytes.copy(targetBytes, segment.offset);
+		previousEnd = segmentEnd;
+	}
+	verifyBytes({
+		bytes: targetBytes,
+		expectedSha256: input.targetSha256,
+		expectedSizeBytes: input.targetSizeBytes,
+		label: "reconstructed binary"
+	});
+	return targetBytes;
+}
+function parseCliBinaryDeltaPatch(bytes) {
+	let value;
+	try {
+		value = JSON.parse(bytes.toString("utf8"));
+	} catch (error) {
+		throw new Error(`delta patch is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	const parsed = cliBinaryDeltaPatchSchema.safeParse(value);
+	if (!parsed.success) throw new Error(`delta patch is invalid: ${parsed.error.message}`);
+	return parsed.data;
+}
+function assertPatchMatchesRelease(input) {
+	const mismatches = [
+		[
+			"format",
+			input.patch.patchFormat,
+			input.delta.patchFormat
+		],
+		[
+			"base sha256",
+			input.patch.baseSha256,
+			input.delta.fromSha256
+		],
+		[
+			"base size",
+			input.patch.baseSizeBytes,
+			input.delta.fromSizeBytes
+		],
+		[
+			"target sha256",
+			input.patch.targetSha256,
+			input.targetSha256
+		],
+		[
+			"target size",
+			input.patch.targetSizeBytes,
+			input.targetSizeBytes
+		]
+	].filter(([, actual, expected]) => actual !== expected);
+	if (mismatches.length > 0) throw new Error(`delta patch metadata mismatch: ${mismatches.map(([label]) => label).join(", ")}`);
+}
+function verifyBytes(input) {
+	if (input.bytes.byteLength !== input.expectedSizeBytes) throw new Error(`${input.label} size mismatch: expected ${input.expectedSizeBytes} bytes, received ${input.bytes.byteLength} bytes`);
+	const actualSha256 = createHash("sha256").update(input.bytes).digest("hex");
+	if (actualSha256 !== input.expectedSha256.toLowerCase()) throw new Error(`${input.label} sha256 mismatch: expected ${input.expectedSha256.toLowerCase()}, received ${actualSha256}`);
+}
+//#endregion
+//#region ../../runtime/local-service/src/cli-binary-update-artifact.ts
+const HARDENED_RUNTIME_FLAG_RE = /flags=.*runtime/iu;
+const SIGNING_TIMESTAMP_RE = /^Timestamp=/mu;
+async function resolveCliBinaryUpdatePlan(input) {
+	const fullDownloadPlan = resolveFullCliBinaryUpdatePlan(input.release);
+	const versionDeltas = input.release.deltas?.filter((candidate) => candidate.fromVersion === input.currentVersion);
+	if (!versionDeltas?.length) return fullDownloadPlan;
+	let baseBytes;
+	try {
+		baseBytes = await readFile(input.baseBinaryPath);
+	} catch (error) {
+		input.onDeltaFallback(toError(error));
+		return fullDownloadPlan;
+	}
+	const baseSha256 = createHash("sha256").update(baseBytes).digest("hex");
+	const delta = versionDeltas.find((candidate) => candidate.fromSizeBytes === baseBytes.byteLength && candidate.fromSha256.toLowerCase() === baseSha256);
+	if (!delta) return fullDownloadPlan;
+	return {
+		baseBytes,
+		delta,
+		downloadSizeBytes: delta.patchSizeBytes,
+		transport: "delta"
+	};
+}
+async function downloadCliBinaryUpdateArtifact(input) {
+	if (input.plan.transport === "delta") {
+		try {
+			return await downloadCliBinaryDelta({
+				...input,
+				baseBytes: input.plan.baseBytes,
+				delta: input.plan.delta
+			});
+		} catch (error) {
+			input.onDeltaFallback(toError(error));
+		}
+		return downloadFullCliBinaryArtifact({
+			...input,
+			plan: resolveFullCliBinaryUpdatePlan(input.release)
+		});
+	}
+	return downloadFullCliBinaryArtifact({
+		...input,
+		plan: input.plan
+	});
+}
+async function verifyCliBinaryCodeSignature(input) {
+	const { codeIdentifier, teamIdentifier } = input.release;
+	if (!(codeIdentifier && teamIdentifier)) return;
+	if (process.platform !== "darwin") throw new Error("signed OpenMeld CLI verification requires macOS");
+	const verification = await input.runCommand("/usr/bin/codesign", [
+		"--verify",
+		"--strict",
+		"--verbose=2",
+		input.artifactPath
+	]);
+	if (verification.code !== 0) throw new Error(`binary code signature verification failed: ${commandFailureDetails(verification)}`);
+	const inspection = await input.runCommand("/usr/bin/codesign", [
+		"--display",
+		"--verbose=4",
+		input.artifactPath
+	]);
+	if (inspection.code !== 0) throw new Error(`binary code signature inspection failed: ${commandFailureDetails(inspection)}`);
+	const details = `${inspection.stdout}\n${inspection.stderr}`;
+	for (const expected of [
+		`Identifier=${codeIdentifier}`,
+		`TeamIdentifier=${teamIdentifier}`,
+		"Authority=Developer ID Application:"
+	]) if (!details.includes(expected)) throw new Error(`binary code signature is missing expected identity: ${expected}`);
+	if (!HARDENED_RUNTIME_FLAG_RE.test(details)) throw new Error("binary code signature is missing the hardened runtime");
+	if (!SIGNING_TIMESTAMP_RE.test(details)) throw new Error("binary code signature is missing a trusted timestamp");
+}
+async function downloadCliBinaryDelta(input) {
+	const response = await input.fetchImpl(input.delta.patchUrl, {
+		method: "GET",
+		signal: AbortSignal.timeout(input.downloadTimeoutMs)
+	});
+	if (!response.ok) {
+		const body = await response.text().catch(() => "");
+		throw new Error(`binary delta download failed: HTTP ${response.status}${body ? `: ${body}` : ""}`);
+	}
+	const patchBytes = Buffer.from(await response.arrayBuffer());
+	verifyBinaryBytes({
+		bytes: patchBytes,
+		expectedSha256: input.delta.patchSha256,
+		expectedSizeBytes: input.delta.patchSizeBytes,
+		label: "binary delta archive"
+	});
+	let patchPayloadBytes;
+	try {
+		patchPayloadBytes = gunzipSync(patchBytes, { maxOutputLength: input.delta.patchPayloadSizeBytes });
+	} catch (error) {
+		throw new Error(`binary delta could not be decompressed: ${toError(error).message}`);
+	}
+	if (patchPayloadBytes.byteLength !== input.delta.patchPayloadSizeBytes) throw new Error(`binary delta payload size mismatch: expected ${input.delta.patchPayloadSizeBytes} bytes, received ${patchPayloadBytes.byteLength} bytes`);
+	return reconstructCliBinaryDelta({
+		baseBytes: input.baseBytes,
+		delta: input.delta,
+		patchPayloadBytes,
+		targetSha256: input.release.sha256,
+		targetSizeBytes: input.release.sizeBytes
+	});
+}
+function resolveFullCliBinaryUpdatePlan(release) {
+	if (hasCompressedCliBinaryTransport(release)) return {
+		downloadSha256: release.archiveSha256,
+		downloadSizeBytes: release.archiveSizeBytes,
+		downloadUrl: release.archiveUrl,
+		transport: "archive"
+	};
+	return {
+		downloadSha256: release.sha256,
+		downloadSizeBytes: release.sizeBytes,
+		downloadUrl: release.url,
+		transport: "raw"
+	};
+}
+async function downloadFullCliBinaryArtifact(input) {
+	const response = await input.fetchImpl(input.plan.downloadUrl, {
+		method: "GET",
+		signal: AbortSignal.timeout(input.downloadTimeoutMs)
+	});
+	if (!response.ok) {
+		const body = await response.text().catch(() => "");
+		throw new Error(`binary download failed: HTTP ${response.status}${body ? `: ${body}` : ""}`);
+	}
+	const downloadBytes = Buffer.from(await response.arrayBuffer());
+	verifyBinaryBytes({
+		bytes: downloadBytes,
+		expectedSha256: input.plan.downloadSha256,
+		expectedSizeBytes: input.plan.downloadSizeBytes,
+		label: input.plan.transport === "archive" ? "binary archive" : "binary download"
+	});
+	let artifactBytes = downloadBytes;
+	if (input.plan.transport === "archive") try {
+		artifactBytes = gunzipSync(downloadBytes, { maxOutputLength: input.release.sizeBytes });
+	} catch (error) {
+		throw new Error(`binary archive could not be decompressed: ${toError(error).message}`);
+	}
+	verifyBinaryBytes({
+		bytes: artifactBytes,
+		expectedSha256: input.release.sha256,
+		expectedSizeBytes: input.release.sizeBytes,
+		label: "binary download"
+	});
+	return artifactBytes;
+}
+function hasCompressedCliBinaryTransport(release) {
+	return release.archiveFormat === "gzip" && typeof release.archiveUrl === "string" && typeof release.archiveSha256 === "string" && typeof release.archiveSizeBytes === "number";
+}
+function verifyBinaryBytes(input) {
+	if (input.bytes.byteLength !== input.expectedSizeBytes) throw new Error(`${input.label} size mismatch: expected ${input.expectedSizeBytes} bytes, received ${input.bytes.byteLength} bytes`);
+	const actualSha256 = createHash("sha256").update(input.bytes).digest("hex");
+	if (actualSha256 !== input.expectedSha256.toLowerCase()) throw new Error(`${input.label} sha256 mismatch: expected ${input.expectedSha256.toLowerCase()}, received ${actualSha256}`);
+}
+function commandFailureDetails(result) {
+	return result.stderr.trim() || result.stdout.trim() || `exit ${result.code}`;
+}
+function toError(error) {
+	return error instanceof Error ? error : new Error(String(error));
+}
+//#endregion
+//#region src/config/daemon-service-update-worker-registration.ts
+const MANAGED_VERSION_FROM_EXECUTABLE_PATTERN = /[\\/]versions[\\/](v?(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)[\\/]openmeld(?:\.exe)?/gu;
+const SELF_CONTAINED_BUNDLE_FROM_EXECUTABLE_PATTERN = /[\\/]runtime[\\/]daemon[\\/]bundles[\\/]([0-9A-Za-z._-]+)[\\/]/gu;
+const INDEPENDENT_MAINTENANCE_REGISTRATION = "openmeld-independent-maintenance-v1";
+function configureDaemonMaintenanceEnvironment(env) {
+	for (const key of [
+		DAEMON_SERVICE_RUNTIME_AUTO_START_ENV,
+		DAEMON_SERVICE_RUNTIME_CONTROLLER_ENV,
+		DAEMON_SERVICE_RUNTIME_DETACHED_ENV,
+		DAEMON_SERVICE_RUNTIME_MODE_ENV,
+		DAEMON_SERVICE_RUNTIME_SYSTEM_SERVICE_ENV
+	]) delete env[key];
+	env.OPENMELD_INTERNAL_MAINTENANCE_WORKER = "1";
+}
+const NPM_ENTRY_IMPORT_PATTERN = /^await import\((".*")\);$/mu;
+function daemonServiceUpdateWorkerNpmEntryPath(pathInput = {}) {
+	return join(daemonRuntimeRootPath(pathInput), "service-update-worker.mjs");
+}
+async function hasIndependentMaintenanceRegistration(pathInput = {}, platform = process$1.platform, expectedDefinition) {
+	if (platform === "win32") {
+		const { runWindowsUserTask, readWindowsTaskAction } = await import("./windows-user-task-DxPN7TzK.js");
+		const task = await runWindowsUserTask({
+			name: resolveDaemonServiceUpdateWorkerIdentity(pathInput).windowsServiceName,
+			legacyScript: resolveDaemonServiceUpdateWorkerWindowsScriptPath(pathInput),
+			operation: "status"
+		});
+		return Boolean(task.installed && !task.legacy && task.actionArguments && (expectedDefinition === void 0 || task.actionArguments === expectedDefinition) && resolveOpenMeldRootDir({ env: readWindowsTaskAction(task.actionArguments).env }) === resolveOpenMeldRootDir(pathInput));
+	}
+	const registration = await readDaemonServiceUpdateWorkerRegistration(pathInput, platform);
+	if (!registration?.includes("openmeld-independent-maintenance-v1")) return false;
+	if (expectedDefinition !== void 0 && registration !== expectedDefinition) return false;
+	const { parseDaemonServiceEnvironmentFromDefinition } = await import("./daemon-service-manager-Bh0LoLed.js");
+	return resolveOpenMeldRootDir({ env: parseDaemonServiceEnvironmentFromDefinition({
+		controller: platform === "darwin" ? "launchd" : "systemd",
+		definition: registration
+	}) }) === resolveOpenMeldRootDir(pathInput);
+}
+function resolveDaemonServiceUpdateWorkerIdentity(pathInput = {}) {
+	const preset = resolveOpenMeldEnvPreset(pathInput);
+	const scope = resolveOpenMeldServiceScope(pathInput);
+	const suffix = (preset === "prod" ? "" : `-${preset}`) + (scope ? `-${scope}` : "");
+	return {
+		launchdLabel: `com.openmeld.openmeld-service-update${(preset === "prod" ? "" : `.${preset}`) + (scope ? `.${scope}` : "")}`,
+		serviceName: `openmeld-service-update${suffix}`,
+		windowsDisplayName: `OpenMeld Service Update${preset === "prod" ? "" : ` (${preset})`}`,
+		windowsServiceName: `OpenMeld-Service-Update${suffix}`
+	};
+}
+function resolveDaemonServiceUpdateWorkerLaunchdPlistPath(pathInput = {}) {
+	return join(pathInput.homeDir ?? homedir(), "Library", "LaunchAgents", `${resolveDaemonServiceUpdateWorkerIdentity(pathInput).launchdLabel}.plist`);
+}
+function resolveDaemonServiceUpdateWorkerSystemdUnitPath(pathInput = {}) {
+	return join(pathInput.homeDir ?? homedir(), ".config", "systemd", "user", `${resolveDaemonServiceUpdateWorkerIdentity(pathInput).serviceName}.service`);
+}
+function resolveDaemonServiceUpdateWorkerSystemdPathUnitPath(pathInput = {}) {
+	return join(pathInput.homeDir ?? homedir(), ".config", "systemd", "user", `${resolveDaemonServiceUpdateWorkerIdentity(pathInput).serviceName}.path`);
+}
+function resolveDaemonServiceUpdateWorkerWindowsScriptPath(pathInput = {}) {
+	return join(daemonRuntimeRootPath(pathInput), "service-update-worker.bat");
+}
+function resolveDaemonServiceUpdateWorkerSystemdTimerUnitPath(pathInput = {}) {
+	return join(pathInput.homeDir ?? homedir(), ".config", "systemd", "user", `${resolveDaemonServiceUpdateWorkerIdentity(pathInput).serviceName}.timer`);
+}
+async function readDaemonServiceUpdateWorkerProtectedManagedVersions(pathInput = {}, platform = process$1.platform) {
+	const contents = await readDaemonServiceUpdateWorkerRegistration(pathInput, platform);
+	return contents === null ? /* @__PURE__ */ new Set() : readManagedVersionsFromUpdateWorkerRegistration(contents);
+}
+async function readDaemonServiceUpdateWorkerProtectedBundleIds(pathInput = {}, platform = process$1.platform) {
+	const contents = await readDaemonServiceUpdateWorkerRegistration(pathInput, platform);
+	const protectedIds = contents === null ? /* @__PURE__ */ new Set() : readBundleIdsFromUpdateWorkerRegistration(contents);
+	const launcher = await readFile(daemonServiceUpdateWorkerNpmEntryPath(pathInput), "utf8").catch((error) => {
+		if (getErrorCode$2(error) === "ENOENT") return null;
+		throw error;
+	});
+	if (launcher !== null) {
+		const importLine = launcher.trim().match(NPM_ENTRY_IMPORT_PATTERN);
+		if (!importLine?.[1]) throw new Error("OpenMeld maintenance launcher is invalid; bundle cleanup was stopped.");
+		const entryPath = fileURLToPath(JSON.parse(importLine[1]));
+		for (const id of readBundleIdsFromUpdateWorkerRegistration(entryPath)) protectedIds.add(id);
+	}
+	return protectedIds;
+}
+function readManagedVersionsFromUpdateWorkerRegistration(contents) {
+	const versions = /* @__PURE__ */ new Set();
+	for (const match of contents.matchAll(MANAGED_VERSION_FROM_EXECUTABLE_PATTERN)) {
+		const version = match[1];
+		if (version) versions.add(version);
+	}
+	return versions;
+}
+function readBundleIdsFromUpdateWorkerRegistration(contents) {
+	const bundleIds = /* @__PURE__ */ new Set();
+	for (const match of contents.matchAll(SELF_CONTAINED_BUNDLE_FROM_EXECUTABLE_PATTERN)) {
+		const bundleId = match[1];
+		if (bundleId) bundleIds.add(bundleId);
+	}
+	return bundleIds;
+}
+function resolveDaemonServiceUpdateWorkerRegistrationPath(pathInput, platform) {
+	if (platform === "darwin") return resolveDaemonServiceUpdateWorkerLaunchdPlistPath(pathInput);
+	if (platform === "linux") return resolveDaemonServiceUpdateWorkerSystemdUnitPath(pathInput);
+	if (platform === "win32") return resolveDaemonServiceUpdateWorkerWindowsScriptPath(pathInput);
+	return null;
+}
+async function readDaemonServiceUpdateWorkerRegistration(pathInput, platform) {
+	const registrationPath = resolveDaemonServiceUpdateWorkerRegistrationPath(pathInput, platform);
+	if (registrationPath === null) return null;
+	return await readFile(registrationPath, "utf8").catch((error) => {
+		if (getErrorCode$2(error) === "ENOENT") return null;
+		throw error;
+	});
+}
+function getErrorCode$2(error) {
+	return error && typeof error === "object" && "code" in error ? String(error.code) : null;
+}
+//#endregion
+//#region package.json
+var package_default = {
+	$schema: "https://www.schemastore.org/package.json",
+	name: "openmeld",
+	version: "0.3.207",
+	openMeldReleaseDate: "2026-09-15",
+	description: "OpenMeld CLI - https://openmeld.ai",
+	license: "MIT",
+	type: "module",
+	bin: { "openmeld": "dist/openmeld.js" },
+	"private": false,
+	publishConfig: { "access": "public" },
+	engines: { "node": "20.x || >=22 <26" },
+	files: [
+		"README.md",
+		"dist",
+		"!dist/binary/**",
+		"skills"
+	],
+	scripts: {
+		"build": "tsdown && node scripts/build-macos-keychain-addon.mjs --copy-npm",
+		"prepack": "pnpm -C ../.. run verify:release-ready -- --force && pnpm run verify:pack-readme",
+		"deploy": "pnpm -C ../.. run release:deploy:local -- --scope cli",
+		"publish:npm": "npm publish",
+		"prepublishOnly": "pnpm run verify:pack-readme",
+		"verify:pack-readme": "node scripts/verify-npm-pack-readme.mjs",
+		"typecheck": "tsc -p tsconfig.json --noEmit",
+		"check": "biome check --no-errors-on-unmatched ./ && tsc -p tsconfig.json --noEmit",
+		"test": "vitest run --config vitest.config.ts",
+		"test:integration": "node scripts/run-integration-tests.mjs",
+		"test:full": "pnpm run test && pnpm run test:integration",
+		"test:local-service": "vitest run --config vitest.integration.config.ts tests/local-service-state.integration.test.ts tests/local-service-command.integration.test.ts tests/local-service-menu.integration.test.ts tests/local-service-run.integration.test.ts tests/local-service-bootstrap-recommendation.test.ts",
+		"test:watch": "vitest"
+	},
+	dependencies: {
+		"@anthropic-ai/claude-agent-sdk": "^0.3.195",
+		"@anthropic-ai/sdk": "^0.93.0",
+		"@clack/prompts": "^1.0.1",
+		"@mariozechner/pi-tui": "0.57.1",
+		"@modelcontextprotocol/sdk": "^1.29.0",
+		"@opencode-ai/sdk": "^1.18.7",
+		"better-sqlite3": "^12.6.2",
+		"commander": "^14.0.0",
+		"picocolors": "^1.1.1",
+		"string-width": "^8.1.0",
+		"wrap-ansi": "10.0.0",
+		"ws": "^8.18.3",
+		"zod": "^4.3.6"
+	},
+	devDependencies: {
+		"@openmeld/adapter-claude-code": "workspace:*",
+		"@openmeld/adapter-codex": "workspace:*",
+		"@openmeld/adapter-core": "workspace:*",
+		"@openmeld/adapter-cursor": "workspace:*",
+		"@openmeld/adapter-grok-build": "workspace:*",
+		"@openmeld/adapter-openclaw": "workspace:*",
+		"@openmeld/adapter-opencode": "workspace:*",
+		"@openmeld/agent-runtime": "workspace:*",
+		"@openmeld/api-client": "workspace:*",
+		"@openmeld/gateway-contract": "workspace:*",
+		"@openmeld/local-execution": "workspace:*",
+		"@openmeld/local-service": "workspace:*",
+		"@openmeld/projects": "workspace:*",
+		"@openmeld/protocol": "workspace:*",
+		"@openmeld/routine-schedule": "workspace:*",
+		"@openmeld/schemas": "workspace:*",
+		"@openmeld/space": "workspace:*",
+		"@openmeld/space-mesh": "workspace:*",
+		"@openmeld/start": "workspace:*",
+		"@openmeld/utils": "workspace:*",
+		"@types/better-sqlite3": "^7.6.13",
+		"@types/node": "^24.3.0",
+		"@types/ws": "^8.18.1",
+		"node-gyp": "^12.4.0",
+		"oxc-resolver": "^11.0.0",
+		"tsdown": "^0.20.3",
+		"typescript": "^5.9.3",
+		"unplugin-lightningcss": "^0.4.0",
+		"vitest": "~3.2.0"
+	},
+	openmeld: {
+		"releaseLine": "openmeld-greenfield-2026-07",
+		"minRequiredCliVersion": "0.3.198"
+	}
+};
+//#endregion
+//#region src/config/service-release.ts
+function resolveBundledServiceRelease() {
+	if (!isBinaryDistribution()) return;
+	const metadata = package_default;
+	const selection = typeof __OPENMELD_SERVICE_RELEASE__ === "undefined" ? metadata.openmeld?.service : __OPENMELD_SERVICE_RELEASE__;
+	if (selection === void 0) return;
+	const parsed = cliBinaryServiceReleaseSchema.safeParse(selection);
+	if (!parsed.success) throw new Error("The installed CLI contains invalid Service release metadata.");
+	const platform = `${process.platform}-${process.arch}`;
+	const artifact = parsed.data.platforms[platform];
+	if (!artifact) throw new Error(`The installed CLI has no Service artifact for ${platform}.`);
+	return {
+		...artifact,
+		version: parsed.data.version,
+		platform,
+		minRequiredCliVersion: null
+	};
+}
+//#endregion
+//#region src/config/version-state.ts
+const VERSION_STATE_FILENAME = "version.json";
+const NPM_REGISTRY_LATEST_TIMEOUT_MS = 5e3;
+const VERSION_CHECK_CACHE_TTL_MS = 1440 * 60 * 1e3;
+const LEADING_V_PREFIX_REGEX = /^v/;
+const SEMVER_CORE_REGEX = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+.*)?$/;
+const NUMERIC_SEMVER_IDENTIFIER_REGEX = /^\d+$/;
+const versionCache = /* @__PURE__ */ new Map();
+const inFlightVersionRequests = /* @__PURE__ */ new Map();
+function versionStatePath() {
+	return join(openMeldRootDir(), VERSION_STATE_FILENAME);
+}
+async function readVersionState() {
+	const raw = await readFile(versionStatePath(), "utf8").catch(() => null);
+	if (!raw) return null;
+	try {
+		const parsed = JSON.parse(raw);
+		if (parsed.v !== 1 || typeof parsed.updated_at !== "string") return null;
+		const lastVersion = toNonEmptyString(parsed.last_version);
+		const latestVersion = toNonEmptyString(parsed.latest_version);
+		const lastCheckedAt = toNonEmptyString(parsed.last_checked_at);
+		const dismissedVersion = parsed.dismissed_version === null ? null : toNonEmptyString(parsed.dismissed_version);
+		const requiredFloor = parseStoredRequiredFloor(parsed.required_floor);
+		return {
+			v: 1,
+			...lastVersion ? { last_version: lastVersion } : {},
+			...latestVersion ? { latest_version: latestVersion } : {},
+			...lastCheckedAt ? { last_checked_at: lastCheckedAt } : {},
+			...dismissedVersion === void 0 ? {} : { dismissed_version: dismissedVersion },
+			...requiredFloor === void 0 ? {} : { required_floor: requiredFloor },
+			updated_at: parsed.updated_at
+		};
+	} catch {
+		return null;
+	}
+}
+async function writeVersionState(state) {
+	await mkdir(openMeldRootDir(), { recursive: true });
+	await writeFile(versionStatePath(), `${JSON.stringify(state, null, 2)}\n`);
+}
+function createInitialVersionState(input) {
+	const checkedAt = input.checkedAt ?? (/* @__PURE__ */ new Date()).toISOString();
+	return {
+		v: 1,
+		last_version: input.currentVersion,
+		latest_version: input.currentVersion,
+		last_checked_at: checkedAt,
+		dismissed_version: null,
+		updated_at: checkedAt
+	};
+}
+function hasValidLastVersion(state) {
+	return Boolean(toNonEmptyString(state?.last_version));
+}
+async function ensureVersionStateReady(input) {
+	const previousVersionState = await readVersionState();
+	if (!previousVersionState) {
+		const nextState = createInitialVersionState({ currentVersion: input.currentVersion });
+		await writeVersionState(nextState);
+		return nextState;
+	}
+	if (hasValidLastVersion(previousVersionState)) return previousVersionState;
+	const nextState = {
+		...previousVersionState,
+		last_version: input.currentVersion,
+		latest_version: previousVersionState.latest_version ?? input.currentVersion
+	};
+	await writeVersionState(nextState);
+	return nextState;
+}
+function buildNextVersionState(input) {
+	const checkedAt = input.checkedAt ?? (/* @__PURE__ */ new Date()).toISOString();
+	const latestVersion = toNonEmptyString(input.latestVersion) ?? toNonEmptyString(input.previous?.latest_version) ?? input.currentVersion;
+	const requiredFloor = input.requiredFloor === void 0 ? input.previous?.required_floor ?? null : input.requiredFloor;
+	return {
+		v: 1,
+		last_version: input.currentVersion,
+		latest_version: latestVersion,
+		last_checked_at: checkedAt,
+		dismissed_version: input.dismissedVersion ?? input.previous?.dismissed_version ?? null,
+		...requiredFloor ? { required_floor: requiredFloor } : {},
+		updated_at: checkedAt
+	};
+}
+function parseStoredRequiredFloor(value) {
+	if (value === void 0) return;
+	if (value === null) return null;
+	return toNonEmptyString(value);
+}
+async function fetchLatestPackageInfo(packageName, input = {}) {
+	const now = Date.now();
+	const cached = input.forceRefresh ? void 0 : versionCache.get(packageName);
+	if (cached && now - cached.fetchedAt < VERSION_CHECK_CACHE_TTL_MS) return cached.info;
+	const requestKey = input.forceRefresh ? `${packageName}:force_refresh` : packageName;
+	const inFlight = inFlightVersionRequests.get(requestKey);
+	if (inFlight) return inFlight;
+	const request = requestLatestPackageInfo(packageName);
+	inFlightVersionRequests.set(requestKey, request);
+	try {
+		const info = await request;
+		versionCache.set(packageName, {
+			info,
+			fetchedAt: Date.now()
+		});
+		return info;
+	} finally {
+		inFlightVersionRequests.delete(requestKey);
+	}
+}
+async function fetchLatestCliBinaryRelease(input) {
+	const manifest = await requestCliBinaryManifest();
+	const platform = toNonEmptyString(input?.platform) ?? `${process$1.platform}-${process$1.arch}`;
+	const release = manifest.platforms[platform];
+	if (!release) throw new Error(`version check failed: invalid CLI manifest response: missing platform ${platform}`);
+	const serviceRelease = manifest.service?.platforms[platform];
+	return {
+		version: manifest.version,
+		minRequiredCliVersion: manifest.minRequiredCliVersion,
+		platform,
+		...release,
+		...manifest.service && serviceRelease ? { service: {
+			...serviceRelease,
+			version: manifest.service.version,
+			platform
+		} } : {}
+	};
+}
+async function requestLatestPackageInfo(packageName) {
+	if (isBinaryDistribution()) return await requestLatestPackageInfoFromCliManifest();
+	const response = await fetch(`https://registry.npmjs.org/${encodeURIComponent(packageName)}/latest`, {
+		method: "GET",
+		signal: AbortSignal.timeout(NPM_REGISTRY_LATEST_TIMEOUT_MS)
+	});
+	const raw = await response.text();
+	if (!response.ok) throw new Error(`version check failed: HTTP ${response.status}: ${raw}`);
+	try {
+		const parsed = JSON.parse(raw);
+		const version = typeof parsed.version === "string" ? parsed.version.trim() : "";
+		if (!version) throw new Error("missing version");
+		return {
+			version,
+			minRequiredCliVersion: readMinRequiredCliVersion(parsed.openmeld)
+		};
+	} catch (error) {
+		throw new Error(`version check failed: invalid registry response: ${toErrorMessage(error)}`);
+	}
+}
+const CLI_BINARY_MANIFEST_URL = toNonEmptyString(process$1.env.OPENMELD_CLI_BINARY_MANIFEST_URL) ?? "https://openmeld.ai/cli/manifest.json";
+async function requestLatestPackageInfoFromCliManifest() {
+	const manifest = await requestCliBinaryManifest();
+	return {
+		version: manifest.version,
+		minRequiredCliVersion: manifest.minRequiredCliVersion,
+		...manifest.service ? { serviceVersion: manifest.service.version } : {}
+	};
+}
+async function requestCliBinaryManifest() {
+	const response = await fetch(CLI_BINARY_MANIFEST_URL, {
+		method: "GET",
+		signal: AbortSignal.timeout(NPM_REGISTRY_LATEST_TIMEOUT_MS)
+	});
+	const raw = await response.text();
+	if (!response.ok) throw new Error(`version check failed: HTTP ${response.status}: ${raw}`);
+	try {
+		return parseCliBinaryManifest(raw);
+	} catch (error) {
+		throw new Error(`version check failed: invalid CLI manifest response: ${toErrorMessage(error)}`);
+	}
+}
+function parseCliBinaryManifest(raw) {
+	const parsed = cliBinaryManifestSchema.safeParse(JSON.parse(raw));
+	if (!parsed.success) throw new Error(parsed.error.message);
+	const stable = parsed.data.channels.stable;
+	return {
+		...stable,
+		minRequiredCliVersion: stable.minRequiredCliVersion ?? null
+	};
+}
+function readMinRequiredCliVersion(openmeld) {
+	if (!openmeld || typeof openmeld !== "object") return null;
+	const value = openmeld.minRequiredCliVersion;
+	if (typeof value !== "string") return null;
+	const trimmed = value.trim();
+	return trimmed.length > 0 && isPlainReleaseVersion(trimmed) ? trimmed : null;
+}
+const PLAIN_RELEASE_VERSION_RE = /^\d+\.\d+\.\d+$/;
+function isPlainReleaseVersion(value) {
+	return PLAIN_RELEASE_VERSION_RE.test(value.trim());
+}
+function compareSemver(a, b) {
+	const left = parseSemver(a);
+	const right = parseSemver(b);
+	if (!(left && right)) return a.localeCompare(b);
+	if (left.major !== right.major) return left.major > right.major ? 1 : -1;
+	if (left.minor !== right.minor) return left.minor > right.minor ? 1 : -1;
+	if (left.patch !== right.patch) return left.patch > right.patch ? 1 : -1;
+	return comparePrereleaseIdentifiers(left.prerelease, right.prerelease);
+}
+function parseSemver(value) {
+	const match = value.trim().replace(LEADING_V_PREFIX_REGEX, "").match(SEMVER_CORE_REGEX);
+	if (!match) return null;
+	return {
+		major: Number(match[1]),
+		minor: Number(match[2]),
+		patch: Number(match[3]),
+		prerelease: match[4] ? match[4].split(".") : null
+	};
+}
+function comparePrereleaseIdentifiers(left, right) {
+	if (!(left || right)) return 0;
+	if (!left) return 1;
+	if (!right) return -1;
+	const maxLength = Math.max(left.length, right.length);
+	for (let index = 0; index < maxLength; index += 1) {
+		const leftIdentifier = left[index];
+		const rightIdentifier = right[index];
+		const lengthComparison = comparePrereleaseLengthAtIndex(leftIdentifier, rightIdentifier);
+		if (lengthComparison !== 0) return lengthComparison;
+		if (!(leftIdentifier && rightIdentifier)) continue;
+		const compared = compareSinglePrereleaseIdentifier(leftIdentifier, rightIdentifier);
+		if (compared !== 0) return compared;
+	}
+	return 0;
+}
+function comparePrereleaseLengthAtIndex(leftIdentifier, rightIdentifier) {
+	if (leftIdentifier === void 0 && rightIdentifier === void 0) return 0;
+	if (leftIdentifier === void 0) return -1;
+	if (rightIdentifier === void 0) return 1;
+	return 0;
+}
+function compareSinglePrereleaseIdentifier(leftIdentifier, rightIdentifier) {
+	if (leftIdentifier === rightIdentifier) return 0;
+	const leftNumber = toNumericPrereleaseIdentifier(leftIdentifier);
+	const rightNumber = toNumericPrereleaseIdentifier(rightIdentifier);
+	if (leftNumber !== null && rightNumber !== null) {
+		if (leftNumber === rightNumber) return 0;
+		return leftNumber > rightNumber ? 1 : -1;
+	}
+	if (leftNumber !== null) return -1;
+	if (rightNumber !== null) return 1;
+	return leftIdentifier > rightIdentifier ? 1 : -1;
+}
+function toNumericPrereleaseIdentifier(identifier) {
+	if (!NUMERIC_SEMVER_IDENTIFIER_REGEX.test(identifier)) return null;
+	return Number(identifier);
+}
+function toNonEmptyString(value) {
+	if (typeof value !== "string") return null;
+	const normalized = value.trim();
+	return normalized.length > 0 ? normalized : null;
+}
+function toErrorMessage(error) {
+	if (error instanceof Error) return error.message;
+	return String(error);
+}
+//#endregion
+//#region src/local-service/lifecycle/daemon-service-update-state.ts
+const DAEMON_SERVICE_UPDATE_JOB_SCHEMA = OPENMELD_DAEMON_SERVICE_UPDATE_JOB_SCHEMA;
+function daemonServicePendingUpdatePath(pathInput = {}) {
+	return join(daemonRuntimeStateRootPath(pathInput), "service-update.json");
+}
+function daemonServiceLastUpdatePath(pathInput = {}) {
+	return join(daemonRuntimeStateRootPath(pathInput), "service-update-last.json");
+}
+async function readPendingDaemonServiceUpdate(pathInput = {}) {
+	return await readDaemonServiceUpdateJob(daemonServicePendingUpdatePath(pathInput));
+}
+async function readLastDaemonServiceUpdate(pathInput = {}) {
+	return await readDaemonServiceUpdateJob(daemonServiceLastUpdatePath(pathInput));
+}
+async function persistPendingDaemonServiceUpdate(job, pathInput = {}) {
+	await writeUpdateJobAtomically({
+		job,
+		path: daemonServicePendingUpdatePath(pathInput)
+	});
+}
+async function completePendingDaemonServiceUpdate(job, pathInput = {}, retainPending = false) {
+	await writeUpdateJobAtomically({
+		job,
+		path: daemonServiceLastUpdatePath(pathInput)
+	});
+	if (retainPending) {
+		await persistPendingDaemonServiceUpdate(job, pathInput);
+		return;
+	}
+	await rm(daemonServicePendingUpdatePath(pathInput), { force: true });
+}
+async function readDaemonServiceUpdateJob(path) {
+	const raw = await readFile(path, "utf8").catch((error) => {
+		if (error.code === "ENOENT") return null;
+		throw error;
+	});
+	if (raw === null) return null;
+	const parsed = storedDaemonServiceUpdateJobSchema.safeParse(JSON.parse(raw));
+	if (!parsed.success) throw new Error("OpenMeld Service update state is invalid.");
+	if (parsed.data.v === 2) return parsed.data;
+	const { status, ...legacyJob } = parsed.data;
+	return daemonServiceUpdateJobSchema.parse({
+		...legacyJob,
+		v: 2,
+		schema: DAEMON_SERVICE_UPDATE_JOB_SCHEMA,
+		phase: migrateLegacyPhase(status),
+		requestSource: "cli"
+	});
+}
+function migrateLegacyPhase(status) {
+	switch (status) {
+		case "scheduled": return "waiting_for_work";
+		case "running": return "updating";
+		case "completed": return "updated";
+		case "failed": return "needs_help";
+		default: return status;
+	}
+}
+async function writeUpdateJobAtomically(input) {
+	const temporaryPath = `${input.path}.${String(process.pid)}.tmp`;
+	await mkdir(dirname(input.path), { recursive: true });
+	await writeFile(temporaryPath, `${JSON.stringify(input.job, null, 2)}\n`, {
+		encoding: "utf8",
+		mode: 384
+	});
+	await rename(temporaryPath, input.path);
+}
+//#endregion
+//#region src/runtime/version.ts
+/**
+* The version of the running CLI and Service bundle.
+*
+* npm builds use package.json. Binary builds may inject an isolated staging
+* prerelease so the real update lifecycle can be exercised before a production
+* version exists.
+*/
+function resolveOpenMeldVersion() {
+	return (typeof __OPENMELD_VERSION__ === "string" ? __OPENMELD_VERSION__.trim() : "") || package_default.version;
+}
+const OPENMELD_VERSION = resolveOpenMeldVersion();
+//#endregion
+//#region src/local-components/managed-version-pruning.ts
+const MANAGED_VERSION_DIRECTORY_PATTERN = /^v?(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*))*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
+async function pruneManagedVersions(input) {
+	const versionsDir = openMeldVersionsDir(input.pathInput);
+	const managedVersions = (await readdir(versionsDir, { withFileTypes: true })).filter((entry) => entry.isDirectory() && MANAGED_VERSION_DIRECTORY_PATTERN.test(entry.name)).map((entry) => entry.name);
+	const usableManagedVersions = new Set((await Promise.all(managedVersions.map(async (version) => ({
+		usable: await isUsableManagedVersion(version, versionsDir),
+		version
+	})))).filter((entry) => entry.usable).map((entry) => entry.version));
+	const retainedVersions = /* @__PURE__ */ new Set([input.currentVersion]);
+	let rollbackVersion = null;
+	if (input.preferredRollbackVersion && input.preferredRollbackVersion !== input.currentVersion && usableManagedVersions.has(input.preferredRollbackVersion)) rollbackVersion = input.preferredRollbackVersion;
+	rollbackVersion ??= [...usableManagedVersions].filter((version) => compareSemver(version, input.currentVersion) < 0).sort((left, right) => compareSemver(right, left))[0] ?? null;
+	if (rollbackVersion) retainedVersions.add(rollbackVersion);
+	for (const protectedVersion of input.protectedVersions ?? []) if (usableManagedVersions.has(protectedVersion)) retainedVersions.add(protectedVersion);
+	await Promise.all(managedVersions.filter((version) => !retainedVersions.has(version)).map((version) => rm(path.join(versionsDir, version), { recursive: true })));
+}
+async function isUsableManagedVersion(version, versionsDir) {
+	const target = path.join(versionsDir, version, "openmeld");
+	if (!(await stat(target).catch((error) => {
+		if (getErrorCode$1(error) === "ENOENT") return null;
+		throw error;
+	}))?.isFile()) return false;
+	return await access(target, constants.X_OK).then(() => true, (error) => {
+		if (getErrorCode$1(error) === "EACCES" || getErrorCode$1(error) === "ENOENT") return false;
+		throw error;
+	});
+}
+function getErrorCode$1(error) {
+	return error && typeof error === "object" && "code" in error ? String(error.code) : null;
+}
+//#endregion
+//#region src/local-components/managed-install.ts
+const MANAGED_INSTALL_LOCK_PROFILE = "managed-cli";
+const MANAGED_INSTALL_LOCK_KEY = "install";
+const MANAGED_INSTALL_LOCK_RETRY_DELAY_MS = 100;
+const MANAGED_INSTALL_LOCK_TIMEOUT_MS = 3e4;
+function resolveCliPlatformToken() {
+	return `${process$1.platform}-${process$1.arch}`;
+}
+function resolveCliSelfVersion() {
+	return OPENMELD_VERSION;
+}
+async function isUsableManagedBinary(target) {
+	if (!(await stat(target).catch((error) => {
+		if (isErrorWithCode(error, "ENOENT")) return null;
+		throw error;
+	}))?.isFile()) return false;
+	return await access(target, constants.X_OK).then(() => true, (error) => {
+		if (isErrorWithCode(error, "EACCES") || isErrorWithCode(error, "ENOENT")) return false;
+		throw error;
+	});
+}
+async function readCurrentPointerVersion(pathInput = {}) {
+	const pointerPath = openMeldManagedBinaryPath(pathInput);
+	const target = await readlink(pointerPath).catch((error) => {
+		if (isErrorWithCode(error, "ENOENT") || isErrorWithCode(error, "EINVAL")) return null;
+		throw error;
+	});
+	if (!target) return null;
+	const resolved = path.isAbsolute(target) ? target : path.resolve(path.dirname(pointerPath), target);
+	const version = path.basename(path.dirname(resolved));
+	return version.length > 0 && path.resolve(resolved) === openMeldManagedVersionBinaryPath(version, pathInput) ? version : null;
+}
+async function readManagedCliInstallation() {
+	const version = await readCurrentPointerVersion();
+	if (!version) return null;
+	const binaryPath = openMeldManagedVersionBinaryPath(version);
+	if (!await isUsableManagedBinary(binaryPath)) return null;
+	return {
+		version,
+		binaryPath
+	};
+}
+/**
+* Install the currently-running binary (process.execPath) into the managed
+* layout and point bin/openmeld at it. Idempotent with semver arbitration:
+* a same-or-newer pointer is left in place (install only goes up), unless
+* `force` is set. Both the versioned binary and the pointer are swapped in
+* atomically via a temp name + rename.
+*/
+async function performManagedInstall(input) {
+	return await withManagedInstallTransaction(async () => performManagedInstallLocked(input));
+}
+async function withManagedInstallTransaction(run, pathInput = {}) {
+	const startedAtMs = Date.now();
+	for (;;) try {
+		return await runWithHeldLock({
+			lock: await acquireLock({
+				openMeldProfileId: MANAGED_INSTALL_LOCK_PROFILE,
+				key: MANAGED_INSTALL_LOCK_KEY,
+				meta: { component: "managed_cli.install" },
+				pathResolution: pathInput
+			}),
+			run,
+			releaseContext: {
+				component: "managed_cli.install",
+				lockKey: MANAGED_INSTALL_LOCK_KEY,
+				openMeldProfileId: MANAGED_INSTALL_LOCK_PROFILE
+			}
+		});
+	} catch (error) {
+		if (!isOpenMeldLockError(error) || isOpenMeldOrphanedLockError(error) || Date.now() - startedAtMs >= MANAGED_INSTALL_LOCK_TIMEOUT_MS) throw error;
+		await setTimeout(MANAGED_INSTALL_LOCK_RETRY_DELAY_MS);
+	}
+}
+/**
+* Prune managed CLI versions only while holding the install transaction lock.
+* The current pointer and every durable Service update target are re-read in
+* the lock, so cleanup cannot race an install or use a stale pending snapshot.
+*/
+async function pruneManagedInstallVersions(input) {
+	const pathInput = input.pathInput;
+	assertNoPublishedProductionMutationDuringTests(pathInput, "managed CLI versions");
+	await withManagedInstallTransaction(async () => {
+		const currentVersion = await readCurrentPointerVersion(pathInput);
+		if (currentVersion === null) return;
+		const protectedVersions = await readManagedInstallProtectedVersions(pathInput);
+		await pruneManagedVersions({
+			currentVersion,
+			pathInput,
+			preferredRollbackVersion: input.preferredRollbackVersion,
+			protectedVersions
+		});
+	}, pathInput);
+}
+async function performManagedInstallLocked(input) {
+	const force = input?.force ?? false;
+	const version = resolveCliSelfVersion();
+	const platform = resolveCliPlatformToken();
+	const currentPointerPath = openMeldManagedBinaryPath();
+	const managedBinaryPath = openMeldManagedVersionBinaryPath(version);
+	const previousVersion = await readCurrentPointerVersion();
+	const protectedVersions = await readManagedInstallProtectedVersions();
+	const baseOutcome = {
+		version,
+		platform,
+		managedBinaryPath,
+		currentPointerPath,
+		previousVersion,
+		forced: force
+	};
+	if (previousVersion !== null) {
+		const comparison = compareSemver(version, previousVersion);
+		if (!force && comparison === 0 && await isUsableManagedBinary(managedBinaryPath)) {
+			await pruneManagedVersions({
+				currentVersion: previousVersion,
+				protectedVersions
+			});
+			return {
+				...baseOutcome,
+				result: "noop_same_version"
+			};
+		}
+		if (comparison < 0 && !force) {
+			if (!await isUsableManagedBinary(managedBinaryPath)) await placeVersionedBinary(input?.sourceBinaryPath ?? process$1.execPath, version, managedBinaryPath);
+			await pruneManagedVersions({
+				currentVersion: previousVersion,
+				preferredRollbackVersion: version,
+				protectedVersions
+			});
+			return {
+				...baseOutcome,
+				result: "noop_newer_present"
+			};
+		}
+	}
+	await placeVersionedBinary(input?.sourceBinaryPath ?? process$1.execPath, version, managedBinaryPath);
+	await pruneManagedVersions({
+		currentVersion: version,
+		preferredRollbackVersion: previousVersion,
+		protectedVersions
+	});
+	await swapCurrentPointer(currentPointerPath, managedBinaryPath);
+	return {
+		...baseOutcome,
+		result: "installed"
+	};
+}
+async function readManagedInstallProtectedVersions(pathInput = {}) {
+	const [protectedVersions, pendingServiceUpdate, activeBundle] = await Promise.all([
+		readDaemonServiceUpdateWorkerProtectedManagedVersions(pathInput),
+		readPendingDaemonServiceUpdate(pathInput),
+		readDaemonActiveBundleState(pathInput)
+	]);
+	if (activeBundle?.bundleFormat === "binary_v1") protectedVersions.add(activeBundle.daemonVersion);
+	if (pendingServiceUpdate?.preparedBundle.bundleFormat === "binary_v1") protectedVersions.add(pendingServiceUpdate.preparedBundle.daemonVersion);
+	return protectedVersions;
+}
+async function placeVersionedBinary(sourceBinary, version, managedBinaryPath) {
+	await mkdir(openMeldManagedVersionDir(version), { recursive: true });
+	const tmpPath = `${managedBinaryPath}.tmp-${process$1.pid}-${Date.now()}`;
+	await rm(tmpPath, { force: true }).catch(() => void 0);
+	await copyFile(sourceBinary, tmpPath);
+	await chmod(tmpPath, 493);
+	if ((await lstat(managedBinaryPath).catch((error) => {
+		if (isErrorWithCode(error, "ENOENT")) return null;
+		throw error;
+	}))?.isDirectory()) await rm(managedBinaryPath, { recursive: true });
+	await rename(tmpPath, managedBinaryPath);
+}
+async function swapCurrentPointer(currentPointerPath, managedBinaryPath) {
+	await mkdir(openMeldBinDir(), { recursive: true });
+	const relativeTarget = path.relative(path.dirname(currentPointerPath), managedBinaryPath);
+	const tmpPath = `${currentPointerPath}.tmp-${process$1.pid}-${Date.now()}`;
+	await rm(tmpPath, { force: true }).catch(() => void 0);
+	await symlink(relativeTarget, tmpPath);
+	await rename(tmpPath, currentPointerPath);
+}
+function buildInstallSelfJsonPayload(outcome) {
+	return {
+		schemaVersion: 1,
+		type: "cli.install_self",
+		result: outcome.result,
+		version: outcome.version,
+		platform: outcome.platform,
+		managedBinaryPath: outcome.managedBinaryPath,
+		currentPointerPath: outcome.currentPointerPath,
+		previousVersion: outcome.previousVersion,
+		forced: outcome.forced
+	};
+}
+function isErrorWithCode(error, code) {
+	return error instanceof Error && "code" in error && error.code === code;
+}
+//#endregion
+//#region src/system/local-operation-diagnostics.ts
+const ERROR_CODES = /* @__PURE__ */ new Set([
+	"EPERM",
+	"EACCES",
+	"ENOENT",
+	"ENOTDIR",
+	"EISDIR",
+	"EROFS",
+	"ENOSPC",
+	"EBUSY",
+	"ETXTBSY",
+	"EEXIST",
+	"EIO",
+	"EMFILE",
+	"ENFILE",
+	"EINVAL",
+	"ENAMETOOLONG"
+]);
+const SYSCALLS = /* @__PURE__ */ new Set([
+	"access",
+	"open",
+	"read",
+	"write",
+	"chmod",
+	"chown",
+	"copyfile",
+	"rename",
+	"unlink",
+	"rmdir",
+	"mkdir",
+	"stat",
+	"lstat",
+	"realpath",
+	"spawn"
+]);
+const APP_BUNDLE_PATH_PATTERN = /(?:^|[/\\])[^/\\]+\.app(?:[/\\]|$)/iu;
+function classifyDiagnosticPath(value) {
+	if (typeof value !== "string" || !value) return "unknown";
+	if (APP_BUNDLE_PATH_PATTERN.test(value)) return "app_bundle";
+	return isAbsolute(value) ? "absolute_other" : "relative";
+}
+function collectLocalOperationFailure(error) {
+	let current = error;
+	for (let depth = 0; depth < 4 && current instanceof Error; depth += 1) {
+		const native = current;
+		if (native.code && ERROR_CODES.has(native.code)) return {
+			code: native.code,
+			...Number.isSafeInteger(native.errno) ? { errno: native.errno } : {},
+			...native.syscall && SYSCALLS.has(native.syscall) ? { syscall: native.syscall } : {},
+			pathCategory: classifyDiagnosticPath(native.path),
+			...native.dest === void 0 ? {} : { destinationCategory: classifyDiagnosticPath(native.dest) }
+		};
+		current = current.cause;
+	}
+}
+//#endregion
+//#region src/local-service/lifecycle/daemon-lifecycle-journal.ts
+const DAEMON_LIFECYCLE_EVENT_TYPES = [
+	"connection.state",
+	"daemon.crash",
+	"lifecycle.command.begin",
+	"lifecycle.command.end",
+	"owner.snapshot",
+	"route_catalog.initial_load",
+	"runtime_state.takeover",
+	"stop.controlled_drain",
+	"stop.strategy.selected",
+	"service_manager.action",
+	"service_manager.registration_reconcile",
+	"process_stop.action",
+	"service_contract.write",
+	"stop.signal.observed"
+];
+const DAEMON_STOP_CAUSES = [
+	"user_stop",
+	"controlled_service_update",
+	"service_crash",
+	"network_disconnect",
+	"unknown"
+];
+function toJournalErrorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+function normalizeSessionId(value) {
+	const normalized = typeof value === "string" ? value.trim() : "";
+	return normalized.length > 0 ? normalized : null;
+}
+function resolveDaemonStopCause(input) {
+	if (input.explicitCause) return input.explicitCause;
+	if (input.type === "daemon.crash") return "service_crash";
+	if (input.type === "connection.state") return "unknown";
+	if (input.intent === "stop") return "user_stop";
+	if (input.intent === "upgrade_reconcile" || input.intent === "reinstall" || input.intent === "startup_check" || input.intent === "status_cleanup") return "controlled_service_update";
+	return "unknown";
+}
+function isDaemonLifecycleEvent(event) {
+	if (typeof event !== "object" || event === null) return false;
+	const candidate = event;
+	return candidate.schema === "openmeld-daemon-lifecycle-event-v1" && candidate.v === 1 && DAEMON_LIFECYCLE_EVENT_TYPES.includes(candidate.type) && typeof candidate.timestamp === "string" && candidate.timestamp.length > 0 && typeof candidate.lane === "string" && candidate.lane.length > 0 && typeof candidate.intent === "string" && candidate.intent.length > 0 && typeof candidate.command === "string" && candidate.command.length > 0 && typeof candidate.pid === "number" && Number.isInteger(candidate.pid) && candidate.pid > 0 && (candidate.sessionId === null || typeof candidate.sessionId === "string" && candidate.sessionId.length > 0) && (candidate.stopCause === void 0 || DAEMON_STOP_CAUSES.includes(candidate.stopCause)) && typeof candidate.result === "string" && candidate.result.length > 0;
+}
+async function resolveDaemonLifecycleAttribution(input) {
+	const lockMeta = await readDaemonServiceLifecycleLockMeta().catch(() => null);
+	return {
+		command: input.command?.trim() || (typeof lockMeta?.command === "string" ? lockMeta.command.trim() : "") || "unknown",
+		intent: input.intent ?? (typeof lockMeta?.intent === "string" ? lockMeta.intent : "unknown"),
+		lane: resolveOpenMeldEnvPreset(input.pathInput),
+		pid: typeof lockMeta?.pid === "number" && lockMeta.pid > 0 ? lockMeta.pid : process$1.pid,
+		sessionId: normalizeSessionId(lockMeta?.sessionId) ?? resolveCliContextId()
+	};
+}
+async function emitDaemonLifecycleEvent(input) {
+	assertNoPublishedProductionMutationDuringTests(input.pathInput ?? {}, "OpenMeld Service lifecycle journal");
+	const journalPath = daemonLifecycleJournalPath(input.pathInput);
+	const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+	const attribution = input.type === "connection.state" ? {
+		command: "openmeld service run",
+		intent: "unknown",
+		lane: resolveOpenMeldEnvPreset(input.pathInput),
+		pid: process$1.pid,
+		sessionId: resolveCliContextId()
+	} : await resolveDaemonLifecycleAttribution(input);
+	const event = {
+		schema: "openmeld-daemon-lifecycle-event-v1",
+		v: 1,
+		type: input.type,
+		timestamp,
+		lane: attribution.lane,
+		intent: attribution.intent,
+		command: attribution.command,
+		pid: attribution.pid,
+		sessionId: attribution.sessionId,
+		stopCause: resolveDaemonStopCause({
+			explicitCause: input.stopCause,
+			intent: attribution.intent,
+			result: input.result,
+			type: input.type
+		}),
+		result: input.result,
+		...input.metadata ? { metadata: input.metadata } : {}
+	};
+	if (!isDaemonLifecycleEvent(event)) {
+		console.warn(`[openmeld:lifecycle-journal] rejected invalid event ${input.type}`);
+		return;
+	}
+	try {
+		await mkdir(dirname(journalPath), { recursive: true });
+		await appendFile(journalPath, `${JSON.stringify(event)}\n`, "utf8");
+	} catch (error) {
+		console.warn(`[openmeld:lifecycle-journal] failed to append event ${input.type}: ${toJournalErrorMessage(error)}`);
+	}
+}
+async function runWithDaemonLifecycleCommandJournal(input) {
+	await emitDaemonLifecycleEvent({
+		type: "lifecycle.command.begin",
+		result: "started",
+		metadata: input.includeProcessUptime ? {
+			...input.metadata,
+			processUptimeMs: Math.round(process$1.uptime() * 1e3)
+		} : input.metadata,
+		pathInput: input.pathInput,
+		command: input.command,
+		intent: input.intent
+	});
+	try {
+		const result = await input.run();
+		const resolvedResult = input.resolveResult?.(result) ?? { result: "completed" };
+		await emitDaemonLifecycleEvent({
+			type: "lifecycle.command.end",
+			result: resolvedResult.result,
+			metadata: resolvedResult.metadata,
+			pathInput: input.pathInput,
+			command: input.command,
+			intent: input.intent
+		});
+		return result;
+	} catch (error) {
+		await emitDaemonLifecycleEvent({
+			type: "lifecycle.command.end",
+			result: "failed",
+			metadata: { errorMessage: toJournalErrorMessage(error) },
+			pathInput: input.pathInput,
+			command: input.command,
+			intent: input.intent
+		});
+		throw error;
+	}
+}
+async function runDaemonServiceManagerAction(input) {
+	const startedAtMs = Date.now();
+	try {
+		const result = await input.run();
+		await emitDaemonLifecycleEvent({
+			type: "service_manager.action",
+			result: "completed",
+			metadata: {
+				action: input.action,
+				controller: input.controller,
+				durationMs: Date.now() - startedAtMs,
+				...input.metadata ?? {}
+			},
+			pathInput: input.pathInput,
+			command: input.command,
+			intent: input.intent
+		});
+		return result;
+	} catch (error) {
+		let errorMetadata = null;
+		try {
+			errorMetadata = input.resolveErrorMetadata?.(error) ?? null;
+		} catch {
+			errorMetadata = null;
+		}
+		await emitDaemonLifecycleEvent({
+			type: "service_manager.action",
+			result: "failed",
+			metadata: {
+				action: input.action,
+				controller: input.controller,
+				durationMs: Date.now() - startedAtMs,
+				errorMessage: toJournalErrorMessage(error),
+				...errorMetadata ?? {},
+				...input.metadata ?? {}
+			},
+			pathInput: input.pathInput,
+			command: input.command,
+			intent: input.intent
+		});
+		throw error;
+	}
+}
+const DAEMON_LIFECYCLE_ORIGIN_EVENT_TYPES = /* @__PURE__ */ new Set([
+	"daemon.crash",
+	"lifecycle.command.end",
+	"process_stop.action",
+	"runtime_state.takeover",
+	"service_contract.write",
+	"service_manager.action"
+]);
+async function readLatestDaemonLifecycleOriginEvent(input = {}) {
+	return await readLatestDaemonLifecycleEvent({
+		pathInput: input.pathInput,
+		typeFilter: DAEMON_LIFECYCLE_ORIGIN_EVENT_TYPES
+	});
+}
+async function readLatestDaemonLifecycleConnectionStateEvent(input = {}) {
+	return await readLatestDaemonLifecycleEvent({
+		pathInput: input.pathInput,
+		typeFilter: /* @__PURE__ */ new Set(["connection.state"])
+	});
+}
+async function readLatestDaemonLifecycleEvent(input) {
+	const journalPath = daemonLifecycleJournalPath(input.pathInput);
+	let content;
+	try {
+		content = await readFile(journalPath, "utf8");
+	} catch (error) {
+		if (error.code === "ENOENT") return null;
+		throw error;
+	}
+	const lines = content.split("\n").map((line) => line.trim()).filter((line) => line.length > 0);
+	for (let index = lines.length - 1; index >= 0; index -= 1) {
+		const line = lines[index];
+		if (!line) continue;
+		try {
+			const parsed = JSON.parse(line);
+			if (isDaemonLifecycleEvent(parsed) && input.typeFilter.has(parsed.type)) return parsed;
+		} catch {}
+	}
+	return null;
+}
+async function readRecentDaemonLifecycleEvents(input) {
+	if (input.maxEntries <= 0) return [];
+	const journalPath = daemonLifecycleJournalPath(input.pathInput);
+	let content;
+	try {
+		content = await readFile(journalPath, "utf8");
+	} catch (error) {
+		if (error.code === "ENOENT") return [];
+		throw error;
+	}
+	const lines = content.split("\n").map((line) => line.trim()).filter((line) => line.length > 0);
+	const recent = [];
+	for (let index = lines.length - 1; index >= 0; index -= 1) {
+		const line = lines[index];
+		if (!line) continue;
+		try {
+			const parsed = JSON.parse(line);
+			if (isDaemonLifecycleEvent(parsed)) {
+				recent.push(parsed);
+				if (recent.length >= input.maxEntries) break;
+			}
+		} catch {}
+	}
+	return recent.reverse();
+}
+async function resolveRecentDaemonSignalStopCause(input = {}) {
+	const nowMs = Date.now();
+	const maxAgeMs = input.maxAgeMs ?? 3e4;
+	const events = await readRecentDaemonLifecycleEvents({
+		maxEntries: 32,
+		pathInput: input.pathInput
+	});
+	for (const event of events.toReversed()) {
+		const eventAtMs = Date.parse(event.timestamp);
+		if (!Number.isFinite(eventAtMs) || nowMs - eventAtMs < 0 || nowMs - eventAtMs > maxAgeMs) continue;
+		if (event.stopCause === "user_stop" || event.stopCause === "controlled_service_update") return event.stopCause;
+	}
+	return "unknown";
+}
+function formatDaemonLifecycleOriginSummary(event) {
+	const intent = formatDaemonLifecycleIntent(event.intent);
+	return `${event.result} ${intent} from ${event.command} at ${event.timestamp} (pid ${event.pid})`;
+}
+function formatDaemonLifecycleIntent(intent) {
+	if (intent === "unknown") return "OpenMeld Service task";
+	return intent.replaceAll("_", " ");
+}
+//#endregion
+//#region src/local-service/lifecycle/daemon-service-artifact.ts
+function resolveDaemonServiceArtifact(input) {
+	const installVersion = input.installStatus.installed ? input.installStatus.state.daemonVersion : null;
+	const expectedBundleId = input.serviceContract?.bundleId ?? null;
+	const expectedDaemonVersion = input.expectedVersion;
+	const activeBundleVersion = input.activeBundle?.daemonVersion ?? null;
+	const driftReasonCodes = input.activeBundle ? collectActiveBundleDriftReasonCodes({
+		activeBundle: input.activeBundle,
+		activeBundleEntryPath: input.activeBundleEntryPath,
+		activeBundleSourceAvailable: input.activeBundleSourceAvailable,
+		installedBundleFingerprint: input.installedBundleFingerprint,
+		expectedBundleId,
+		expectedDaemonVersion,
+		pathInput: input.pathInput
+	}) : ["bundle_missing"];
+	const isAligned = driftReasonCodes.length === 0;
+	return {
+		expectedVersion: input.expectedVersion,
+		installVersion,
+		activeBundleVersion,
+		resolvedEntryPath: isAligned ? input.activeBundleEntryPath : null,
+		driftReasonCodes,
+		isAligned
+	};
+}
+function collectActiveBundleDriftReasonCodes(input) {
+	const driftReasonCodes = [];
+	if (hasBundleVersionDrift(input)) driftReasonCodes.push("bundle_version_drift");
+	if (hasBundleIdDrift(input)) driftReasonCodes.push("bundle_id_drift");
+	if (!isDaemonBundleSourceAllowedForLane({
+		sourceKind: input.activeBundle.sourceKind,
+		pathInput: input.pathInput
+	})) driftReasonCodes.push("bundle_lane_drift");
+	if (input.activeBundle.bundleFormat === "legacy_linked_v1") {
+		driftReasonCodes.push("bundle_strategy_legacy");
+		if (input.activeBundleSourceAvailable === false) driftReasonCodes.push("bundle_provenance_drift");
+	} else if (hasBundleContentDrift(input)) driftReasonCodes.push("bundle_content_drift");
+	if (!input.activeBundleEntryPath) driftReasonCodes.push("bundle_path_invalid");
+	return driftReasonCodes;
+}
+function hasBundleVersionDrift(input) {
+	return input.activeBundle.daemonVersion !== input.expectedDaemonVersion;
+}
+function hasBundleIdDrift(input) {
+	return input.expectedBundleId !== null && input.activeBundle.bundleId !== input.expectedBundleId;
+}
+function hasBundleContentDrift(input) {
+	return input.installedBundleFingerprint === null || input.activeBundle.sourceDistFingerprint !== input.installedBundleFingerprint;
+}
+//#endregion
+//#region src/local-service/lifecycle/daemon-service-bundle.ts
+const DAEMON_ACTIVE_BUNDLE_SCHEMA = "openmeld-daemon-active-bundle-v2";
+const DAEMON_ACTIVE_BUNDLE_LEGACY_SCHEMA = "openmeld-daemon-active-bundle-v1";
+const DAEMON_CLI_ENTRY_NAMES = ["openmeld-dev.js", "openmeld.js"];
+const DAEMON_BUNDLE_SOURCE_KIND_WORKSPACE = "workspace";
+const DAEMON_BUNDLE_SOURCE_KIND_PACKAGE_INSTALL = "package_install";
+const DAEMON_BUNDLE_SOURCE_KIND_NPX_CACHE = "npx_cache";
+const DAEMON_BUNDLE_SOURCE_KIND_UNKNOWN = "unknown";
+const DAEMON_SOURCE_DIST_IGNORED_TOP_LEVEL_DIRS = /* @__PURE__ */ new Set(["binary", "native"]);
+function daemonServiceActiveBundlePath(pathInput = {}) {
+	return daemonServiceActiveBundleStatePath(pathInput);
+}
+function daemonServiceLauncherPath(pathInput = {}) {
+	return daemonServiceStableLauncherPath(pathInput);
+}
+function daemonServiceExecutableWrapperPath(pathInput = {}) {
+	return daemonServiceStableExecutableWrapperPath(pathInput);
+}
+function daemonServiceBinaryExecutablePath(pathInput = {}) {
+	return daemonServiceStableBinaryExecutablePath(pathInput);
+}
+function daemonServiceUpdateWorkerBinaryPath(pathInput = {}) {
+	return daemonServiceUpdateWorkerBinaryExecutablePath(pathInput);
+}
+function daemonServiceExecutableWrapperPaths(pathInput = {}) {
+	return daemonServiceExecutableWrapperPaths$1(pathInput);
+}
+function daemonServiceRecognizedExecutablePaths(pathInput = {}) {
+	return daemonServiceRecognizedExecutablePaths$1(pathInput);
+}
+function daemonServiceLegacyWrapperPath(pathInput = {}) {
+	return daemonServiceLegacyExecutableWrapperPath(pathInput);
+}
+function resolveDaemonBundleRootPath(bundleId, pathInput = {}) {
+	return join(daemonRuntimeBundlesPath(pathInput), bundleId);
+}
+function isDaemonBundleSourceAllowedForLane(input) {
+	if (input.sourceKind !== DAEMON_BUNDLE_SOURCE_KIND_WORKSPACE) return true;
+	return resolveOpenMeldEnvPreset(input.pathInput) === "dev-local";
+}
+async function readDaemonActiveBundleState(pathInput = {}) {
+	const raw = await readFile(daemonServiceActiveBundlePath(pathInput), "utf8").catch((error) => {
+		if (getErrorCode(error) === "ENOENT") return null;
+		throw error;
+	});
+	if (raw === null) return null;
+	try {
+		const parsed = JSON.parse(raw);
+		if (parsed.v === 2 && parsed.schema === DAEMON_ACTIVE_BUNDLE_SCHEMA) {
+			if (typeof parsed.bundleId !== "string" || parsed.bundleId.length === 0 || typeof parsed.daemonVersion !== "string" || parsed.daemonVersion.length === 0 || typeof parsed.entryScriptRelativePath !== "string" || parsed.entryScriptRelativePath.length === 0 || !isDaemonBundleFormat(parsed.bundleFormat) || typeof parsed.sourceEntryScriptPath !== "string" || parsed.sourceEntryScriptPath.length === 0 || typeof parsed.sourcePackageRootPath !== "string" || parsed.sourcePackageRootPath.length === 0 || typeof parsed.sourceDistRootPath !== "string" || parsed.sourceDistRootPath.length === 0 || !isDaemonBundleSourceKind(parsed.sourceKind) || typeof parsed.createdAt !== "string" || parsed.createdAt.length === 0 || typeof parsed.updatedAt !== "string" || parsed.updatedAt.length === 0) return null;
+			return {
+				v: 2,
+				schema: DAEMON_ACTIVE_BUNDLE_SCHEMA,
+				bundleId: parsed.bundleId,
+				daemonVersion: parsed.daemonVersion,
+				entryScriptRelativePath: parsed.entryScriptRelativePath,
+				bundleFormat: parsed.bundleFormat,
+				sourceEntryScriptPath: parsed.sourceEntryScriptPath,
+				sourcePackageRootPath: parsed.sourcePackageRootPath,
+				sourceDistRootPath: parsed.sourceDistRootPath,
+				sourceDistFingerprint: normalizeOptionalText(parsed.sourceDistFingerprint),
+				sourceKind: parsed.sourceKind,
+				createdAt: parsed.createdAt,
+				updatedAt: parsed.updatedAt
+			};
+		}
+		const legacyParsed = parsed;
+		if (legacyParsed.v !== 1 || legacyParsed.schema !== DAEMON_ACTIVE_BUNDLE_LEGACY_SCHEMA || typeof legacyParsed.bundleId !== "string" || legacyParsed.bundleId.length === 0 || typeof legacyParsed.daemonVersion !== "string" || legacyParsed.daemonVersion.length === 0 || typeof legacyParsed.entryScriptRelativePath !== "string" || legacyParsed.entryScriptRelativePath.length === 0 || typeof legacyParsed.sourceDistRootPath !== "string" || legacyParsed.sourceDistRootPath.length === 0 || typeof legacyParsed.createdAt !== "string" || legacyParsed.createdAt.length === 0 || typeof legacyParsed.updatedAt !== "string" || legacyParsed.updatedAt.length === 0) return null;
+		const sourceEntryScriptPath = join(legacyParsed.sourceDistRootPath, basename(legacyParsed.entryScriptRelativePath));
+		const sourcePackageRootPath = dirname(legacyParsed.sourceDistRootPath);
+		return {
+			v: 2,
+			schema: DAEMON_ACTIVE_BUNDLE_SCHEMA,
+			bundleId: legacyParsed.bundleId,
+			daemonVersion: legacyParsed.daemonVersion,
+			entryScriptRelativePath: legacyParsed.entryScriptRelativePath,
+			bundleFormat: "legacy_linked_v1",
+			sourceEntryScriptPath,
+			sourcePackageRootPath,
+			sourceDistRootPath: legacyParsed.sourceDistRootPath,
+			sourceDistFingerprint: null,
+			sourceKind: inferDaemonBundleSourceKind(sourcePackageRootPath),
+			createdAt: legacyParsed.createdAt,
+			updatedAt: legacyParsed.updatedAt
+		};
+	} catch {
+		return null;
+	}
+}
+async function resolveAlignedDaemonActiveBundleEntryPath(input = {}) {
+	const [installStatus, serviceContract, state] = await Promise.all([
+		getDaemonStatus(),
+		readDaemonServiceContract().catch(() => null),
+		readDaemonActiveBundleState()
+	]);
+	const expectedVersion = input.expectedVersion ?? serviceContract?.daemonVersion ?? (installStatus.installed ? installStatus.state.daemonVersion : state?.daemonVersion ?? "unknown");
+	const matchingServiceContract = input.expectedVersion && serviceContract?.daemonVersion !== input.expectedVersion ? null : serviceContract;
+	const activeBundleEntryPath = await resolveDaemonBundleEntryPathFromState(state);
+	const installedBundleFingerprint = activeBundleEntryPath ? await resolveInstalledDaemonBundleFingerprint(state) : null;
+	return resolveDaemonServiceArtifact({
+		expectedVersion,
+		installStatus,
+		serviceContract: matchingServiceContract,
+		activeBundle: state,
+		activeBundleSourceAvailable: state && state.bundleFormat === "legacy_linked_v1" ? await pathExists(state.sourcePackageRootPath).catch(() => null) : null,
+		activeBundleEntryPath,
+		installedBundleFingerprint
+	}).resolvedEntryPath;
+}
+async function resolveInstalledDaemonBundleFingerprint(state, pathInput = {}) {
+	if (state?.bundleFormat === "binary_v1") {
+		const entryPath = await resolveDaemonBundleEntryPathFromState(state, pathInput);
+		return entryPath ? await hashDaemonBinaryFile(entryPath) : null;
+	}
+	if (state?.bundleFormat === "self_contained_v1") {
+		const bundleRootPath = resolveDaemonBundleRootPath(state.bundleId, pathInput);
+		const distRootPath = join(bundleRootPath, dirname(state.entryScriptRelativePath));
+		const relativeDistRootPath = relative(bundleRootPath, distRootPath);
+		if (relativeDistRootPath === ".." || relativeDistRootPath.startsWith(`..${sep}`) || isAbsolute(relativeDistRootPath)) return null;
+		return await computeDaemonSourceDistFingerprint(distRootPath);
+	}
+	return null;
+}
+async function resolveDaemonBundleEntryPathFromState(state, pathInput = {}) {
+	if (!state) return null;
+	if (state.bundleFormat === "binary_v1") {
+		const stableExecutablePath = daemonServiceBinaryExecutablePath(pathInput);
+		if (await pathExists(stableExecutablePath)) return stableExecutablePath;
+		return await pathExists(state.sourceEntryScriptPath) ? state.sourceEntryScriptPath : null;
+	}
+	const entryPath = join(resolveDaemonBundleRootPath(state.bundleId, pathInput), state.entryScriptRelativePath);
+	return await pathExists(entryPath) ? entryPath : null;
+}
+async function prepareDaemonServiceBundle(input) {
+	const preparedBundle = isBinaryDistribution() ? await prepareBinaryDaemonServiceBundle(input) : await prepareNodeDaemonServiceBundle(input);
+	if (input.activate !== false) await activateDaemonServiceBundle(preparedBundle);
+	return preparedBundle;
+}
+async function prepareNodeDaemonServiceBundle(input) {
+	const sourceProvenance = await resolveDaemonBundleSourceProvenance(input.cliScriptPath);
+	if (!isDaemonBundleSourceAllowedForLane({ sourceKind: sourceProvenance.sourceKind })) throw new Error("OpenMeld Service cannot use repo-local workspace service files in this lane. Repo-local service files are only allowed through `openmeld-dev`.");
+	const { sourceEntryScriptPath, sourceDistRootPath, sourcePackageRootPath } = sourceProvenance;
+	const sourceDistFingerprint = await computeDaemonSourceDistFingerprint(sourceDistRootPath);
+	const entryScriptRelativePath = basename(sourceEntryScriptPath);
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	const bundleId = createBundleId(input.daemonVersion);
+	const bundleRootPath = resolveDaemonBundleRootPath(bundleId);
+	const targetDistRootPath = join(bundleRootPath, "dist");
+	await Promise.all([
+		mkdir(daemonRuntimeRootPath(), { recursive: true }),
+		mkdir(daemonRuntimeBundlesPath(), { recursive: true }),
+		mkdir(daemonRuntimeStateRootPath(), { recursive: true }),
+		mkdir(daemonRuntimeServiceManagerPath(), { recursive: true })
+	]);
+	try {
+		await rm(bundleRootPath, {
+			recursive: true,
+			force: true
+		});
+		await mkdir(bundleRootPath, { recursive: true });
+		await cp(sourceDistRootPath, targetDistRootPath, {
+			recursive: true,
+			force: true,
+			filter: (sourcePath) => isDaemonSourceDistPathIncluded(sourceDistRootPath, sourcePath)
+		});
+		await writeDaemonBundlePackageManifest({
+			bundleRootPath,
+			daemonVersion: input.daemonVersion
+		});
+		await copyDaemonBundleRuntimeDependencies({
+			bundleRootPath,
+			sourcePackageRootPath
+		});
+	} catch (error) {
+		await rm(bundleRootPath, {
+			recursive: true,
+			force: true
+		}).catch(() => void 0);
+		throw error;
+	}
+	return {
+		v: 2,
+		schema: DAEMON_ACTIVE_BUNDLE_SCHEMA,
+		bundleId,
+		daemonVersion: input.daemonVersion,
+		entryScriptRelativePath: join("dist", entryScriptRelativePath),
+		bundleFormat: "self_contained_v1",
+		sourceEntryScriptPath,
+		sourcePackageRootPath,
+		sourceDistRootPath,
+		sourceDistFingerprint,
+		sourceKind: sourceProvenance.sourceKind,
+		createdAt: now,
+		updatedAt: now
+	};
+}
+async function prepareBinaryDaemonServiceBundle(input) {
+	const { daemonVersion } = input;
+	const bundledRelease = resolveBundledServiceRelease();
+	const binaryRelease = input.binaryRelease ?? (bundledRelease?.version === daemonVersion ? bundledRelease : void 0);
+	if (daemonVersion !== resolveCliSelfVersion()) {
+		const active = await readDaemonActiveBundleState();
+		if (active?.bundleFormat === "binary_v1" && active.daemonVersion === daemonVersion && active.sourceDistFingerprint && (!binaryRelease || binaryRelease.sha256 === active.sourceDistFingerprint) && await pathExists(active.sourceEntryScriptPath) && await hashDaemonBinaryFile(active.sourceEntryScriptPath) === active.sourceDistFingerprint) return active;
+	}
+	if (binaryRelease) return await prepareSelectedBinaryDaemonServiceBundle({
+		daemonVersion,
+		release: binaryRelease
+	});
+	if (daemonVersion !== resolveCliSelfVersion()) throw new Error(`Cannot prepare OpenMeld Service ${daemonVersion} from CLI ${resolveCliSelfVersion()}. Acquire the selected Service release before preparing the update.`);
+	const outcome = await performManagedInstall();
+	const managedBinaryPath = outcome.managedBinaryPath;
+	if (!await pathExists(managedBinaryPath)) throw new Error(`OpenMeld managed binary is missing at ${managedBinaryPath}; cannot prepare binary OpenMeld Service.`);
+	const managedVersionDir = dirname(managedBinaryPath);
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	await Promise.all([
+		mkdir(daemonRuntimeRootPath(), { recursive: true }),
+		mkdir(daemonRuntimeStateRootPath(), { recursive: true }),
+		mkdir(daemonRuntimeServiceManagerPath(), { recursive: true })
+	]);
+	return {
+		v: 2,
+		schema: DAEMON_ACTIVE_BUNDLE_SCHEMA,
+		bundleId: createBundleId(outcome.version),
+		daemonVersion: outcome.version,
+		entryScriptRelativePath: "openmeld",
+		bundleFormat: "binary_v1",
+		sourceEntryScriptPath: managedBinaryPath,
+		sourcePackageRootPath: managedVersionDir,
+		sourceDistRootPath: managedVersionDir,
+		sourceDistFingerprint: await hashDaemonBinaryFile(managedBinaryPath),
+		sourceKind: DAEMON_BUNDLE_SOURCE_KIND_PACKAGE_INSTALL,
+		createdAt: now,
+		updatedAt: now
+	};
+}
+async function prepareSelectedBinaryDaemonServiceBundle(input) {
+	if (input.release.version !== input.daemonVersion) throw new Error("The selected Service artifact does not match the update target.");
+	const bundleId = createBundleId(input.daemonVersion);
+	const bundleRootPath = resolveDaemonBundleRootPath(bundleId);
+	const executablePath = join(bundleRootPath, "openmeld");
+	const onDeltaFallback = (error) => {
+		console.warn("[openmeld.service.artifact_delta_fallback]", error.message);
+	};
+	const plan = await resolveCliBinaryUpdatePlan({
+		baseBinaryPath: process$1.execPath,
+		currentVersion: resolveCliSelfVersion(),
+		onDeltaFallback,
+		release: input.release
+	});
+	const bytes = await downloadCliBinaryUpdateArtifact({
+		downloadTimeoutMs: 6e4,
+		fetchImpl: fetch,
+		onDeltaFallback,
+		plan,
+		release: input.release
+	});
+	await mkdir(bundleRootPath, { recursive: true });
+	try {
+		await writeFile(executablePath, bytes, { mode: 493 });
+		await verifyCliBinaryCodeSignature({
+			artifactPath: executablePath,
+			release: input.release,
+			runCommand: async (command, args) => {
+				const result = await promisify(execFile)(command, args, { encoding: "utf8" });
+				return {
+					code: 0,
+					stdout: result.stdout,
+					stderr: result.stderr
+				};
+			}
+		});
+	} catch (error) {
+		await rm(bundleRootPath, {
+			recursive: true,
+			force: true
+		});
+		throw error;
+	}
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	return {
+		v: 2,
+		schema: DAEMON_ACTIVE_BUNDLE_SCHEMA,
+		bundleId,
+		daemonVersion: input.daemonVersion,
+		entryScriptRelativePath: "openmeld",
+		bundleFormat: "binary_v1",
+		sourceEntryScriptPath: executablePath,
+		sourcePackageRootPath: bundleRootPath,
+		sourceDistRootPath: bundleRootPath,
+		sourceDistFingerprint: input.release.sha256.toLowerCase(),
+		sourceKind: DAEMON_BUNDLE_SOURCE_KIND_PACKAGE_INSTALL,
+		createdAt: now,
+		updatedAt: now
+	};
+}
+async function activateDaemonServiceBundle(preparedBundle) {
+	await mkdir(daemonRuntimeStateRootPath(), { recursive: true });
+	await writeFile(daemonServiceActiveBundlePath(), `${JSON.stringify(preparedBundle, null, 2)}\n`, {
+		encoding: "utf8",
+		mode: 384
+	});
+	if (preparedBundle.bundleFormat !== "binary_v1") await ensureDaemonServiceManagerExecutables();
+}
+async function discardPreparedDaemonServiceBundle(preparedBundle) {
+	if (preparedBundle.bundleFormat === "legacy_linked_v1") return;
+	if ((await readDaemonActiveBundleState())?.bundleId === preparedBundle.bundleId) return;
+	await rm(resolveDaemonBundleRootPath(preparedBundle.bundleId), {
+		recursive: true,
+		force: true
+	});
+}
+async function hashDaemonBinaryFile(filePath) {
+	const hash = createHash("sha256");
+	hash.update(await readFile(filePath));
+	return hash.digest("hex");
+}
+async function runAuditedServiceManagerCarrierMutation(input) {
+	const pathInput = input.pathInput ?? {};
+	const metadata = {
+		distribution: input.distribution ?? resolveOpenMeldDistribution(),
+		executable: process$1.execPath,
+		operation: input.operation,
+		preset: resolveOpenMeldEnvPreset(pathInput),
+		targetPath: input.targetPath,
+		targetCategory: classifyDiagnosticPath(input.targetPath),
+		actorPid: process$1.pid,
+		parentPid: process$1.ppid
+	};
+	await emitDaemonLifecycleEvent({
+		command: "openmeld service carrier mutation",
+		intent: "status_cleanup",
+		metadata,
+		pathInput,
+		result: "attempted",
+		type: "service_manager.registration_reconcile"
+	});
+	try {
+		const result = await input.run();
+		await emitDaemonLifecycleEvent({
+			command: "openmeld service carrier mutation",
+			intent: "status_cleanup",
+			metadata,
+			pathInput,
+			result: "completed",
+			type: "service_manager.registration_reconcile"
+		});
+		return result;
+	} catch (error) {
+		await emitDaemonLifecycleEvent({
+			command: "openmeld service carrier mutation",
+			intent: "status_cleanup",
+			metadata: {
+				...metadata,
+				errorMessage: error instanceof Error ? error.message : String(error),
+				operationFailure: collectLocalOperationFailure(error)
+			},
+			pathInput,
+			result: "failed",
+			type: "service_manager.registration_reconcile"
+		});
+		throw error;
+	}
+}
+async function ensureDaemonServiceStableBinaryExecutable(pathInput = {}) {
+	const activeBundle = await readDaemonActiveBundleState();
+	if (activeBundle?.bundleFormat !== "binary_v1") throw new Error("OpenMeld cannot prepare the stable macOS Service executable without an active binary bundle.");
+	return await ensureVerifiedBinaryCarrier({
+		bundle: activeBundle,
+		operationName: "stable_binary",
+		pathInput,
+		targetPath: daemonServiceBinaryExecutablePath(pathInput)
+	});
+}
+async function ensureDaemonServiceUpdateWorkerBinaryExecutable(preparedBundle, pathInput = {}) {
+	if (preparedBundle.bundleFormat !== "binary_v1") throw new Error("OpenMeld cannot prepare the update worker binary without a binary Service bundle.");
+	return await ensureVerifiedBinaryCarrier({
+		bundle: preparedBundle,
+		operationName: "update_worker_binary",
+		pathInput,
+		targetPath: daemonServiceUpdateWorkerBinaryPath(pathInput)
+	});
+}
+async function clearDaemonServiceUpdateWorkerBinaryExecutable(pathInput = {}) {
+	const targetPath = daemonServiceUpdateWorkerBinaryPath(pathInput);
+	await runAuditedServiceManagerCarrierMutation({
+		distribution: "binary",
+		operation: "remove_update_worker_binary",
+		pathInput,
+		targetPath,
+		run: async () => await rm(targetPath, { force: true })
+	});
+}
+async function ensureVerifiedBinaryCarrier(input) {
+	const sourcePath = input.bundle.sourceEntryScriptPath;
+	const expectedFingerprint = input.bundle.sourceDistFingerprint ?? await hashDaemonBinaryFile(sourcePath);
+	const stableExecutablePath = input.targetPath;
+	const stableExecutableStat = await lstat(stableExecutablePath).catch(() => null);
+	if (stableExecutableStat?.isFile() === true && !stableExecutableStat.isSymbolicLink() && await hashDaemonBinaryFile(stableExecutablePath).catch(() => null) === expectedFingerprint) {
+		await runAuditedServiceManagerCarrierMutation({
+			distribution: "binary",
+			operation: `refresh_${input.operationName}_permissions`,
+			pathInput: input.pathInput,
+			targetPath: stableExecutablePath,
+			run: async () => await chmod(stableExecutablePath, 448)
+		});
+		return stableExecutablePath;
+	}
+	await mkdir(dirname(stableExecutablePath), { recursive: true });
+	const preparedPath = `${stableExecutablePath}.next-${String(process$1.pid)}`;
+	await runAuditedServiceManagerCarrierMutation({
+		distribution: "binary",
+		operation: `clear_prepared_${input.operationName}`,
+		pathInput: input.pathInput,
+		targetPath: preparedPath,
+		run: async () => await rm(preparedPath, { force: true })
+	});
+	try {
+		await runAuditedServiceManagerCarrierMutation({
+			distribution: "binary",
+			operation: `prepare_${input.operationName}`,
+			pathInput: input.pathInput,
+			targetPath: preparedPath,
+			run: async () => {
+				await copyFile(sourcePath, preparedPath);
+				await chmod(preparedPath, 448);
+			}
+		});
+		if (await hashDaemonBinaryFile(preparedPath) !== expectedFingerprint) throw new Error("OpenMeld could not verify the prepared Service carrier executable.");
+		await runAuditedServiceManagerCarrierMutation({
+			distribution: "binary",
+			operation: `replace_${input.operationName}`,
+			pathInput: input.pathInput,
+			targetPath: stableExecutablePath,
+			run: async () => await rename(preparedPath, stableExecutablePath)
+		});
+		return stableExecutablePath;
+	} finally {
+		await runAuditedServiceManagerCarrierMutation({
+			distribution: "binary",
+			operation: `clear_prepared_${input.operationName}`,
+			pathInput: input.pathInput,
+			targetPath: preparedPath,
+			run: async () => await rm(preparedPath, { force: true })
+		}).catch(() => void 0);
+	}
+}
+async function verifyDaemonActiveBundleIntegrity(activeBundle) {
+	const expectedFingerprint = activeBundle.sourceDistFingerprint?.trim();
+	if (!expectedFingerprint || activeBundle.bundleFormat === "legacy_linked_v1") return false;
+	if (!await resolveDaemonBundleEntryPathFromState(activeBundle)) return false;
+	return await resolveInstalledDaemonBundleFingerprint(activeBundle) === expectedFingerprint;
+}
+async function writeDaemonBundlePackageManifest(input) {
+	await writeFile(join(input.bundleRootPath, "package.json"), `${JSON.stringify({
+		name: "openmeld-daemon-service-bundle",
+		private: true,
+		type: "module",
+		version: input.daemonVersion
+	}, null, 2)}\n`, {
+		encoding: "utf8",
+		mode: 384
+	});
+}
+async function copyDaemonBundleRuntimeDependencies(input) {
+	const runtimeDependencies = await collectDaemonBundleRuntimeDependencyClosure({ sourcePackageRootPath: input.sourcePackageRootPath });
+	const targetNodeModulesPath = join(input.bundleRootPath, "node_modules");
+	await rm(targetNodeModulesPath, {
+		recursive: true,
+		force: true
+	});
+	await mkdir(targetNodeModulesPath, { recursive: true });
+	for (const runtimeDependency of runtimeDependencies) await copyDaemonBundleDependencyDirectory({
+		dependencyName: runtimeDependency.dependencyName,
+		sourceDependencyPath: runtimeDependency.packageRootPath,
+		targetNodeModulesPath
+	});
+}
+async function copyDaemonBundleDependencyDirectory(input) {
+	if (!await pathExists(input.sourceDependencyPath)) throw new Error(`OpenMeld could not copy runtime dependency ${input.dependencyName} for background service bundling from ${input.sourceDependencyPath}. Run \`pnpm install\` and retry.`);
+	const targetDependencyPath = join(input.targetNodeModulesPath, ...input.dependencyName.split("/"));
+	await mkdir(dirname(targetDependencyPath), { recursive: true });
+	await cp(input.sourceDependencyPath, targetDependencyPath, {
+		recursive: true,
+		force: true,
+		dereference: true,
+		preserveTimestamps: true
+	});
+}
+async function writeDaemonServiceLauncher(pathInput = {}) {
+	await mkdir(daemonRuntimeServiceManagerPath(pathInput), { recursive: true });
+	const targetPath = daemonServiceLauncherPath(pathInput);
+	await runAuditedServiceManagerCarrierMutation({
+		distribution: "npm",
+		operation: "write_launcher",
+		pathInput,
+		targetPath,
+		run: async () => await writeFile(targetPath, `${buildDaemonServiceLauncherSource(pathInput)}\n`, {
+			encoding: "utf8",
+			mode: 448
+		})
+	});
+}
+async function writeDaemonServiceExecutableWrapper(pathInput = {}) {
+	await mkdir(daemonRuntimeServiceManagerPath(pathInput), { recursive: true });
+	await Promise.all(daemonServiceExecutableWrapperPaths(pathInput).map(async (wrapperPath) => {
+		await runAuditedServiceManagerCarrierMutation({
+			distribution: "npm",
+			operation: "write_executable_wrapper",
+			pathInput,
+			targetPath: wrapperPath,
+			run: async () => {
+				await writeFile(wrapperPath, `${buildDaemonServiceExecutableWrapperSource(pathInput)}\n`, {
+					encoding: "utf8",
+					mode: 448
+				});
+				await chmod(wrapperPath, 448);
+			}
+		});
+	}));
+}
+async function ensureDaemonServiceManagerExecutables(pathInput = {}) {
+	await writeDaemonServiceLauncher(pathInput);
+	await writeDaemonServiceExecutableWrapper(pathInput);
+}
+async function restoreDaemonActiveBundleStateSnapshot(snapshot, pathInput = {}) {
+	if (!snapshot) {
+		await rm(daemonServiceActiveBundlePath(pathInput), { force: true });
+		return;
+	}
+	await mkdir(daemonRuntimeStateRootPath(pathInput), { recursive: true });
+	await writeFile(daemonServiceActiveBundlePath(pathInput), `${JSON.stringify(snapshot, null, 2)}\n`, {
+		encoding: "utf8",
+		mode: 384
+	});
+}
+async function cleanupInactiveDaemonServiceBundles(input = {}) {
+	const [active, serviceContract, runtimeLease, registeredWorkerBundleIds, pendingUpdate] = await Promise.all([
+		readDaemonActiveBundleState(),
+		readDaemonServiceContract().catch(() => null),
+		readDaemonRuntimeLease().catch(() => null),
+		readDaemonServiceUpdateWorkerProtectedBundleIds(),
+		readPendingDaemonServiceUpdate()
+	]);
+	const retain = /* @__PURE__ */ new Set([
+		...active ? [active.bundleId] : [],
+		...serviceContract?.bundleId ? [serviceContract.bundleId] : [],
+		...runtimeLease?.bundleId ? [runtimeLease.bundleId] : [],
+		...registeredWorkerBundleIds,
+		...pendingUpdate?.preparedBundle.bundleFormat === "self_contained_v1" ? [pendingUpdate.preparedBundle.bundleId] : [],
+		...input.retainBundleIds ?? []
+	]);
+	const bundleEntries = await readDirectoryNames(daemonRuntimeBundlesPath());
+	await Promise.all(bundleEntries.filter((bundleId) => !retain.has(bundleId)).map(async (bundleId) => {
+		await rm(resolveDaemonBundleRootPath(bundleId), {
+			recursive: true,
+			force: true
+		});
+	}));
+}
+async function resolveDaemonBundleSourceProvenance(explicitPath) {
+	const sourceEntryScriptPath = await resolveCliScriptPath(explicitPath);
+	const sourceDistRootPath = dirname(sourceEntryScriptPath);
+	const sourcePackageRootPath = dirname(sourceDistRootPath);
+	return {
+		sourceEntryScriptPath,
+		sourceDistRootPath,
+		sourcePackageRootPath,
+		sourceKind: inferDaemonBundleSourceKind(sourcePackageRootPath)
+	};
+}
+async function resolveCliScriptPath(explicitPath) {
+	const rawPath = explicitPath ?? process$1.argv[1];
+	if (!rawPath) throw new Error("Cannot determine CLI script path for OpenMeld background service bundle.");
+	const resolvedPath = await realpath(rawPath).catch(async () => {
+		const fallbackPath = await resolvePreferredCliScriptPath(rawPath);
+		if (fallbackPath) return fallbackPath;
+		throw new Error(`OpenMeld could not resolve a CLI dist entry for service bundling from ${rawPath}.`);
+	});
+	const preferredPath = await resolvePreferredCliScriptPath(resolvedPath);
+	if (preferredPath) return preferredPath;
+	throw new Error(`OpenMeld could not find a supported CLI dist entry for service bundling from ${resolvedPath}.`);
+}
+function createBundleId(version) {
+	return `${version.replace(/[^a-zA-Z0-9._-]+/g, "_")}-${Date.now()}`;
+}
+async function computeDaemonSourceDistFingerprint(sourceDistRootPath) {
+	const filePaths = await listDaemonSourceDistFiles(sourceDistRootPath);
+	const hash = createHash("sha256");
+	for (const filePath of filePaths) {
+		const relativePath = relative(sourceDistRootPath, filePath).replaceAll("\\", "/");
+		hash.update(relativePath, "utf8");
+		hash.update("\0", "utf8");
+		hash.update(await readFile(filePath));
+		hash.update("\0", "utf8");
+	}
+	return hash.digest("hex");
+}
+async function listDaemonSourceDistFiles(path) {
+	return await listIncludedDaemonSourceDistFiles(path, path);
+}
+async function listIncludedDaemonSourceDistFiles(sourceDistRootPath, currentPath) {
+	const entries = await readdir(currentPath, { withFileTypes: true });
+	const filePaths = [];
+	for (const entry of entries) {
+		const entryPath = join(currentPath, entry.name);
+		if (!isDaemonSourceDistPathIncluded(sourceDistRootPath, entryPath)) continue;
+		if (entry.isDirectory()) {
+			filePaths.push(...await listIncludedDaemonSourceDistFiles(sourceDistRootPath, entryPath));
+			continue;
+		}
+		if (entry.isFile()) filePaths.push(entryPath);
+	}
+	return filePaths.sort((left, right) => {
+		if (left === right) return 0;
+		return left < right ? -1 : 1;
+	});
+}
+function isDaemonSourceDistPathIncluded(sourceDistRootPath, candidatePath) {
+	const relativePath = relative(sourceDistRootPath, candidatePath).replaceAll("\\", "/");
+	if (!relativePath || relativePath.startsWith("..")) return true;
+	const topLevelPathSegment = relativePath.split("/")[0] ?? "";
+	return !DAEMON_SOURCE_DIST_IGNORED_TOP_LEVEL_DIRS.has(topLevelPathSegment);
+}
+async function collectDaemonBundleRuntimeDependencyClosure(input) {
+	const packageManifestPath = join(input.sourcePackageRootPath, "package.json");
+	const packageManifestRaw = await readFile(packageManifestPath, "utf8").catch((error) => {
+		if (getErrorCode(error) === "ENOENT") throw new Error(`OpenMeld could not find the CLI package manifest for background service bundling at ${packageManifestPath}.`);
+		throw error;
+	});
+	const packageManifest = JSON.parse(packageManifestRaw);
+	const resolvedDependencies = /* @__PURE__ */ new Map();
+	const queue = [...Object.keys(packageManifest.dependencies ?? {}).map((dependencyName) => ({
+		dependencyName,
+		required: true,
+		resolverPackageRootPath: input.sourcePackageRootPath
+	})), ...Object.keys(packageManifest.optionalDependencies ?? {}).map((dependencyName) => ({
+		dependencyName,
+		required: false,
+		resolverPackageRootPath: input.sourcePackageRootPath
+	}))];
+	while (queue.length > 0) {
+		const nextDependency = queue.shift();
+		if (!nextDependency) continue;
+		if (isTypeOnlyDependencyName(nextDependency.dependencyName)) continue;
+		if (resolvedDependencies.has(nextDependency.dependencyName)) continue;
+		const dependencyManifest = await readDaemonBundleDependencyManifest({
+			dependencyName: nextDependency.dependencyName,
+			required: nextDependency.required,
+			resolverPackageRootPath: nextDependency.resolverPackageRootPath
+		});
+		if (!dependencyManifest) continue;
+		resolvedDependencies.set(nextDependency.dependencyName, dependencyManifest.packageRootPath);
+		const nestedRequiredDependencies = Object.keys(dependencyManifest.dependencies ?? {});
+		const nestedOptionalDependencies = Object.keys(dependencyManifest.optionalDependencies ?? {});
+		const nestedPeerDependencies = Object.keys(dependencyManifest.peerDependencies ?? {});
+		for (const dependencyName of nestedRequiredDependencies) queue.push({
+			dependencyName,
+			required: true,
+			resolverPackageRootPath: dependencyManifest.packageRootPath
+		});
+		for (const dependencyName of nestedOptionalDependencies) queue.push({
+			dependencyName,
+			required: false,
+			resolverPackageRootPath: dependencyManifest.packageRootPath
+		});
+		for (const dependencyName of nestedPeerDependencies) queue.push({
+			dependencyName,
+			required: false,
+			resolverPackageRootPath: dependencyManifest.packageRootPath
+		});
+	}
+	return [...resolvedDependencies.entries()].map(([dependencyName, packageRootPath]) => ({
+		dependencyName,
+		packageRootPath
+	})).sort((left, right) => left.dependencyName.localeCompare(right.dependencyName));
+}
+function isTypeOnlyDependencyName(dependencyName) {
+	return dependencyName.startsWith("@types/");
+}
+async function readDaemonBundleDependencyManifest(input) {
+	const dependencyPackageRootPath = await resolveDaemonDependencyPackageRoot({
+		dependencyName: input.dependencyName,
+		resolverPackageRootPath: input.resolverPackageRootPath,
+		required: input.required
+	});
+	if (!dependencyPackageRootPath) return null;
+	const dependencyManifestPath = join(dependencyPackageRootPath, "package.json");
+	const dependencyManifestRaw = await readFile(dependencyManifestPath, "utf8").catch((error) => {
+		if (getErrorCode(error) === "ENOENT") {
+			if (!input.required) return null;
+			throw new Error(`OpenMeld could not find runtime dependency ${input.dependencyName} for background service bundling at ${dependencyManifestPath}. Run \`pnpm install\` and retry.`);
+		}
+		throw error;
+	});
+	if (dependencyManifestRaw === null) return null;
+	return {
+		packageRootPath: dependencyPackageRootPath,
+		...JSON.parse(dependencyManifestRaw)
+	};
+}
+async function resolveDaemonDependencyPackageRoot(input) {
+	const resolver = createRequire(join(input.resolverPackageRootPath, "package.json"));
+	const dependencyPackageRootPath = await resolveDaemonDependencyPackageRootFromManifest({
+		dependencyName: input.dependencyName,
+		resolver
+	});
+	if (dependencyPackageRootPath) return dependencyPackageRootPath;
+	try {
+		return await findDaemonDependencyPackageRoot(await realpath(resolver.resolve(input.dependencyName)));
+	} catch (error) {
+		if (isPackageEntryResolutionError(error)) {
+			const dependencyPackageRootPath = await findDaemonDependencyPackageRootFromResolutionPaths({
+				dependencyName: input.dependencyName,
+				resolver
+			});
+			if (dependencyPackageRootPath) return dependencyPackageRootPath;
+			if (!input.required) return null;
+			throw new Error(`OpenMeld could not find runtime dependency ${input.dependencyName} for background service bundling from ${input.resolverPackageRootPath}. Run \`pnpm install\` and retry.`);
+		}
+		throw error;
+	}
+}
+async function resolveDaemonDependencyPackageRootFromManifest(input) {
+	try {
+		return await findDaemonDependencyPackageRootFromManifestPath({
+			dependencyManifestPath: await realpath(input.resolver.resolve(`${input.dependencyName}/package.json`)),
+			dependencyName: input.dependencyName
+		});
+	} catch (error) {
+		if (isPackageEntryResolutionError(error)) return null;
+		throw error;
+	}
+}
+async function findDaemonDependencyPackageRootFromManifestPath(input) {
+	let currentPath = dirname(input.dependencyManifestPath);
+	while (true) {
+		const packageManifestRaw = await readFile(join(currentPath, "package.json"), "utf8").catch((error) => {
+			if (getErrorCode(error) === "ENOENT") return null;
+			throw error;
+		});
+		if (packageManifestRaw !== null) {
+			if (JSON.parse(packageManifestRaw).name === input.dependencyName) return currentPath;
+		}
+		const parentPath = dirname(currentPath);
+		if (parentPath === currentPath) return null;
+		currentPath = parentPath;
+	}
+}
+async function findDaemonDependencyPackageRootFromResolutionPaths(input) {
+	const resolutionPaths = input.resolver.resolve.paths(input.dependencyName);
+	if (!resolutionPaths) return null;
+	for (const nodeModulesPath of resolutionPaths) {
+		const candidatePackageRootPath = join(nodeModulesPath, ...input.dependencyName.split("/"));
+		if (await pathExists(join(candidatePackageRootPath, "package.json"))) return await realpath(candidatePackageRootPath);
+	}
+	return null;
+}
+async function findDaemonDependencyPackageRoot(resolvedEntryPath) {
+	let currentPath = dirname(resolvedEntryPath);
+	while (true) {
+		if (await pathExists(join(currentPath, "package.json"))) return currentPath;
+		const parentPath = dirname(currentPath);
+		if (parentPath === currentPath) break;
+		currentPath = parentPath;
+	}
+	throw new Error(`OpenMeld could not determine the package root for background service dependency entry ${resolvedEntryPath}.`);
+}
+function buildDaemonServiceLauncherSource(pathInput = {}) {
+	return `import { access, readFile, readdir, stat, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import process from "node:process";
+import { spawn } from "node:child_process";
+
+const ACTIVE_BUNDLE_PATH = ${JSON.stringify(daemonServiceActiveBundlePath(pathInput))};
+const INSTALL_STATE_PATH = ${JSON.stringify(daemonStatePath(pathInput))};
+const BUNDLE_ROOT_PATH = ${JSON.stringify(daemonRuntimeBundlesPath(pathInput))};
+const ALLOW_WORKSPACE_BUNDLE_SOURCE = ${JSON.stringify(resolveOpenMeldEnvPreset(pathInput) === "dev-local")};
+
+const ACTIVE_BUNDLE_SCHEMA = "openmeld-daemon-active-bundle-v2";
+const ACTIVE_BUNDLE_LEGACY_SCHEMA = "openmeld-daemon-active-bundle-v1";
+const INSTALL_STATE_SCHEMA = "openmeld-daemon-install-v1";
+
+async function readJsonFile(path) {
+  try {
+    return JSON.parse(await readFile(path, "utf8"));
+  } catch (error) {
+    if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") {
+      return null;
+    }
+    throw error;
+  }
+}
+
+async function pathExists(path) {
+  try {
+    await access(path);
+    return true;
+  } catch (error) {
+    if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") {
+      return false;
+    }
+    throw error;
+  }
+}
+
+function normalizeInstallState(parsed) {
+  if (!parsed || parsed.schema !== INSTALL_STATE_SCHEMA || typeof parsed.daemonVersion !== "string" || parsed.daemonVersion.length === 0) {
+    return null;
+  }
+  return {
+    daemonVersion: parsed.daemonVersion,
+  };
+}
+
+function normalizeBundleState(parsed) {
+  if (
+    parsed &&
+    parsed.v === 2 &&
+    parsed.schema === ACTIVE_BUNDLE_SCHEMA &&
+    typeof parsed.bundleId === "string" &&
+    parsed.bundleId.length > 0 &&
+    typeof parsed.daemonVersion === "string" &&
+    parsed.daemonVersion.length > 0 &&
+    typeof parsed.entryScriptRelativePath === "string" &&
+    parsed.entryScriptRelativePath.length > 0 &&
+    (parsed.bundleFormat === "self_contained_v1" || parsed.bundleFormat === "legacy_linked_v1")
+  ) {
+    return parsed;
+  }
+  if (
+    parsed &&
+    parsed.v === 1 &&
+    parsed.schema === ACTIVE_BUNDLE_LEGACY_SCHEMA &&
+    typeof parsed.bundleId === "string" &&
+    parsed.bundleId.length > 0 &&
+    typeof parsed.daemonVersion === "string" &&
+    parsed.daemonVersion.length > 0 &&
+    typeof parsed.entryScriptRelativePath === "string" &&
+    parsed.entryScriptRelativePath.length > 0
+  ) {
+    return {
+      ...parsed,
+      bundleFormat: "legacy_linked_v1",
+    };
+  }
+  return null;
+}
+
+function normalizeBundlePackageManifest(parsed) {
+  if (!parsed || typeof parsed.version !== "string" || parsed.version.length === 0) {
+    return null;
+  }
+  return {
+    version: parsed.version,
+  };
+}
+
+function uniqueNonEmptyStrings(values) {
+  return [...new Set(values.filter((value) => typeof value === "string" && value.length > 0))];
+}
+
+async function findFallbackSelfContainedBundle(input) {
+  const directories = await readdir(BUNDLE_ROOT_PATH, { withFileTypes: true }).catch((error) => {
+    if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") {
+      return [];
+    }
+    throw error;
+  });
+  const entryScriptRelativePaths = uniqueNonEmptyStrings([
+    input.preferredEntryScriptRelativePath,
+    "dist/openmeld.js",
+    "dist/openmeld-dev.js",
+  ]);
+  const candidates = [];
+  for (const directory of directories) {
+    if (!directory.isDirectory()) {
+      continue;
+    }
+    const bundleId = directory.name;
+    const bundlePath = join(BUNDLE_ROOT_PATH, bundleId);
+    const manifest = normalizeBundlePackageManifest(
+      await readJsonFile(join(bundlePath, "package.json"))
+    );
+    if (manifest?.version !== input.installState.daemonVersion) {
+      continue;
+    }
+    for (const entryScriptRelativePath of entryScriptRelativePaths) {
+      const entryPath = join(bundlePath, entryScriptRelativePath);
+      if (!(await pathExists(entryPath))) {
+        continue;
+      }
+      const entryStat = await stat(entryPath).catch(() => null);
+      candidates.push({
+        bundleId,
+        entryPath,
+        entryScriptRelativePath,
+        mtimeMs: entryStat?.mtimeMs ?? 0,
+      });
+      break;
+    }
+  }
+  candidates.sort((a, b) => {
+    if (b.mtimeMs !== a.mtimeMs) {
+      return b.mtimeMs - a.mtimeMs;
+    }
+    return b.bundleId.localeCompare(a.bundleId);
+  });
+  return candidates[0] ?? null;
+}
+
+async function persistFallbackActiveBundleState(input) {
+  const now = new Date().toISOString();
+  const bundleRootPath = join(BUNDLE_ROOT_PATH, input.bundleId);
+  const nextState = {
+    v: 2,
+    schema: ACTIVE_BUNDLE_SCHEMA,
+    bundleId: input.bundleId,
+    daemonVersion: input.installState.daemonVersion,
+    entryScriptRelativePath: input.entryScriptRelativePath,
+    bundleFormat: "self_contained_v1",
+    sourceEntryScriptPath: input.entryPath,
+    sourcePackageRootPath: bundleRootPath,
+    sourceDistRootPath: join(bundleRootPath, "dist"),
+    sourceDistFingerprint: null,
+    sourceKind: "package_install",
+    createdAt: input.previousBundleState?.createdAt ?? now,
+    updatedAt: now,
+  };
+  await writeFile(ACTIVE_BUNDLE_PATH, \`\${JSON.stringify(nextState, null, 2)}\\n\`, {
+    encoding: "utf8",
+    mode: 0o600,
+  }).catch((error) => {
+    console.error(\`OpenMeld Service launcher recovered a matching bundle but could not update active bundle state: \${String(error)}\`);
+  });
+}
+
+async function resolveEntryPath() {
+  const installState = normalizeInstallState(await readJsonFile(INSTALL_STATE_PATH));
+  const bundleState = normalizeBundleState(await readJsonFile(ACTIVE_BUNDLE_PATH));
+  if (!installState) {
+    throw new Error("OpenMeld Service launcher could not read a valid install state.");
+  }
+  if (!bundleState) {
+    const fallback = await findFallbackSelfContainedBundle({
+      installState,
+      preferredEntryScriptRelativePath: null,
+    });
+    if (!fallback) {
+      throw new Error("OpenMeld Service launcher could not read a valid active bundle state.");
+    }
+    await persistFallbackActiveBundleState({
+      ...fallback,
+      installState,
+      previousBundleState: null,
+    });
+    console.error(\`OpenMeld Service launcher recovered bundle \${fallback.bundleId} because active bundle state was missing or invalid.\`);
+    return fallback.entryPath;
+  }
+  if (bundleState.bundleFormat !== "self_contained_v1") {
+    const fallback = await findFallbackSelfContainedBundle({
+      installState,
+      preferredEntryScriptRelativePath: bundleState.entryScriptRelativePath,
+    });
+    if (!fallback) {
+      throw new Error(\`OpenMeld Service launcher refused to start legacy bundle format \${String(bundleState.bundleFormat)}.\`);
+    }
+    await persistFallbackActiveBundleState({
+      ...fallback,
+      installState,
+      previousBundleState: bundleState,
+    });
+    console.error(\`OpenMeld Service launcher recovered bundle \${fallback.bundleId} because active bundle state used legacy bundle format \${String(bundleState.bundleFormat)}.\`);
+    return fallback.entryPath;
+  }
+  if (bundleState.sourceKind === "workspace" && !ALLOW_WORKSPACE_BUNDLE_SOURCE) {
+    const fallback = await findFallbackSelfContainedBundle({
+      installState,
+      preferredEntryScriptRelativePath: bundleState.entryScriptRelativePath,
+    });
+    if (!fallback) {
+      throw new Error("OpenMeld Service launcher refused to start repo-local workspace service files in this lane. Repo-local service files are only allowed through \`openmeld-dev\`.");
+    }
+    await persistFallbackActiveBundleState({
+      ...fallback,
+      installState,
+      previousBundleState: bundleState,
+    });
+    console.error(\`OpenMeld Service launcher recovered bundle \${fallback.bundleId} because active bundle state pointed at a repo-local workspace bundle in this lane.\`);
+    return fallback.entryPath;
+  }
+  if (bundleState.daemonVersion !== installState.daemonVersion) {
+    const fallback = await findFallbackSelfContainedBundle({
+      installState,
+      preferredEntryScriptRelativePath: bundleState.entryScriptRelativePath,
+    });
+    if (!fallback) {
+      throw new Error(\`OpenMeld Service launcher detected bundle version drift: bundle v\${String(bundleState.daemonVersion)} != install v\${String(installState.daemonVersion)}.\`);
+    }
+    await persistFallbackActiveBundleState({
+      ...fallback,
+      installState,
+      previousBundleState: bundleState,
+    });
+    console.error(\`OpenMeld Service launcher recovered bundle \${fallback.bundleId} because active bundle state had version drift.\`);
+    return fallback.entryPath;
+  }
+  const entryPath = join(BUNDLE_ROOT_PATH, bundleState.bundleId, bundleState.entryScriptRelativePath);
+  if (await pathExists(entryPath)) {
+    return entryPath;
+  }
+  const fallback = await findFallbackSelfContainedBundle({
+    installState,
+    preferredEntryScriptRelativePath: bundleState.entryScriptRelativePath,
+  });
+  if (!fallback) {
+    throw new Error(\`OpenMeld Service launcher could not find active bundle entry \${entryPath}.\`);
+  }
+  await persistFallbackActiveBundleState({
+    ...fallback,
+    installState,
+    previousBundleState: bundleState,
+  });
+  console.error(\`OpenMeld Service launcher recovered bundle \${fallback.bundleId} because active bundle entry was missing.\`);
+  return fallback.entryPath;
+}
+
+async function main() {
+  const entryPath = await resolveEntryPath();
+  const child = spawn(process.execPath, [entryPath, ...process.argv.slice(2)], {
+    stdio: "inherit",
+    env: process.env,
+    windowsHide: true,
+  });
+
+  const forwardSignal = (signal) => {
+    if (!child.killed) {
+      child.kill(signal);
+    }
+  };
+
+  for (const signal of ["SIGINT", "SIGTERM"]) {
+    process.on(signal, () => {
+      forwardSignal(signal);
+    });
+  }
+
+  child.once("error", (error) => {
+    console.error(String(error));
+    process.exitCode = 1;
+  });
+
+  child.once("close", (code, signal) => {
+    if (typeof code === "number") {
+      process.exitCode = code;
+      return;
+    }
+    if (signal) {
+      process.kill(process.pid, signal);
+      return;
+    }
+    process.exitCode = 1;
+  });
+}
+
+await main();`;
+}
+function buildDaemonServiceExecutableWrapperSource(pathInput = {}) {
+	return ["#!/bin/sh", `exec ${quoteShellSingle(process$1.execPath)} ${quoteShellSingle(daemonServiceLauncherPath(pathInput))} "$@"`].join("\n");
+}
+function quoteShellSingle(value) {
+	return `'${value.replaceAll("'", "'\"'\"'")}'`;
+}
+async function readDirectoryNames(path) {
+	return (await readdir(path, { withFileTypes: true }).catch((error) => {
+		if (getErrorCode(error) === "ENOENT") return [];
+		throw error;
+	})).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+}
+function inferDaemonBundleSourceKind(sourcePackageRootPath) {
+	const normalized = sourcePackageRootPath.replaceAll("\\", "/").toLowerCase();
+	if (normalized.includes("/.npm/") && normalized.includes("_npx")) return DAEMON_BUNDLE_SOURCE_KIND_NPX_CACHE;
+	if (normalized.includes("/node_modules/")) return DAEMON_BUNDLE_SOURCE_KIND_PACKAGE_INSTALL;
+	if (normalized.includes("/openmeld/")) return DAEMON_BUNDLE_SOURCE_KIND_WORKSPACE;
+	return DAEMON_BUNDLE_SOURCE_KIND_UNKNOWN;
+}
+function isDaemonBundleFormat(value) {
+	return value === "legacy_linked_v1" || value === "self_contained_v1" || value === "binary_v1";
+}
+function isDaemonBundleSourceKind(value) {
+	return value === DAEMON_BUNDLE_SOURCE_KIND_WORKSPACE || value === DAEMON_BUNDLE_SOURCE_KIND_PACKAGE_INSTALL || value === DAEMON_BUNDLE_SOURCE_KIND_NPX_CACHE || value === DAEMON_BUNDLE_SOURCE_KIND_UNKNOWN;
+}
+function isPackageEntryResolutionError(error) {
+	const code = getErrorCode(error);
+	return code === "MODULE_NOT_FOUND" || code === "ERR_PACKAGE_PATH_NOT_EXPORTED";
+}
+function normalizeOptionalText(value) {
+	const normalized = String(value ?? "").trim();
+	return normalized.length > 0 ? normalized : null;
+}
+async function pathExists(path) {
+	try {
+		await stat(path);
+		return true;
+	} catch (error) {
+		if (getErrorCode(error) === "ENOENT") return false;
+		throw error;
+	}
+}
+async function resolvePreferredCliScriptPath(rawPath) {
+	const preferredScriptNames = buildPreferredCliScriptNames(rawPath);
+	const candidateRoots = [
+		dirname(rawPath),
+		join(process$1.cwd(), "dist"),
+		join(process$1.cwd(), "clients", "openmeld-cli", "dist"),
+		dirname(fileURLToPath(import.meta.url)),
+		join(dirname(fileURLToPath(import.meta.url)), "..", "dist")
+	];
+	for (const scriptName of preferredScriptNames) for (const candidateRoot of candidateRoots) {
+		const candidatePath = join(candidateRoot, scriptName);
+		if (await pathExists(candidatePath)) return candidatePath;
+	}
+	return null;
+}
+function buildPreferredCliScriptNames(rawPath) {
+	const requestedScriptName = basename(rawPath).endsWith(".js") ? basename(rawPath) : `${basename(rawPath)}.js`;
+	if (isSupportedDaemonCliEntryName(requestedScriptName)) return [requestedScriptName];
+	if (String(process$1.env.OPENMELD_DEV_MODE ?? "").trim() === "1") return [...DAEMON_CLI_ENTRY_NAMES];
+	return [...DAEMON_CLI_ENTRY_NAMES].reverse();
+}
+function isSupportedDaemonCliEntryName(value) {
+	return DAEMON_CLI_ENTRY_NAMES.includes(value);
+}
+function getErrorCode(error) {
+	if (!error || typeof error !== "object") return;
+	const code = error.code;
+	return typeof code === "string" ? code : void 0;
+}
+//#endregion
+//#region src/local-service/lifecycle/daemon-managed-binary-path.ts
+const MANAGED_BINARY_NAME = "openmeld";
+const PATH_BOUNDARY_PATTERN = /[\s"'<>]/u;
+const TRAILING_SLASHES_PATTERN = /\/+$/u;
+const VERSION_SEGMENT_BOUNDARY_PATTERN = /[\s"'<>/]/u;
+function isOpenMeldManagedBinaryPath(value, pathInput = {}) {
+	const normalizedPath = normalizeManagedBinaryPathText(value);
+	if (normalizedPath === normalizeManagedBinaryPathText(openMeldManagedBinaryPath(pathInput))) return true;
+	return isManagedVersionBinaryPath(normalizedPath, pathInput);
+}
+function containsOpenMeldManagedBinaryPath(value, pathInput = {}) {
+	const normalizedValue = normalizeManagedBinaryPathText(value);
+	return containsExactManagedPath(normalizedValue, normalizeManagedBinaryPathText(openMeldManagedBinaryPath(pathInput))) || containsManagedVersionBinaryPath(normalizedValue, pathInput);
+}
+function resolveOpenMeldManagedVersionBinaryRootPath(value) {
+	const normalizedPath = normalizeManagedBinaryPathText(value);
+	const segments = normalizedPath.split("/");
+	const binaryName = segments.pop();
+	const versionSegment = segments.pop();
+	const versionsDirectory = segments.pop();
+	if (binaryName !== MANAGED_BINARY_NAME || versionsDirectory !== "versions" || !versionSegment || !isValidManagedVersionSegment(versionSegment)) return null;
+	const rootPath = segments.join("/");
+	if (rootPath.length > 0) return rootPath;
+	return normalizedPath.startsWith("/") ? "/" : null;
+}
+function isManagedVersionBinaryPath(normalizedPath, pathInput) {
+	const versionsRoot = normalizeVersionsRoot(pathInput);
+	if (!normalizedPath.startsWith(versionsRoot)) return false;
+	const segments = normalizedPath.slice(versionsRoot.length).split("/");
+	const versionSegment = segments[0] ?? "";
+	const binaryName = segments[1] ?? "";
+	return segments.length === 2 && versionSegment.length > 0 && binaryName === MANAGED_BINARY_NAME;
+}
+function containsManagedVersionBinaryPath(normalizedValue, pathInput) {
+	const versionsRoot = normalizeVersionsRoot(pathInput);
+	let index = normalizedValue.indexOf(versionsRoot);
+	while (index >= 0) {
+		const before = index > 0 ? normalizedValue[index - 1] ?? "" : "";
+		const afterRoot = normalizedValue.slice(index + versionsRoot.length);
+		const versionSeparatorIndex = afterRoot.indexOf("/");
+		if (isPathBoundary(before) && versionSeparatorIndex > 0 && isValidManagedVersionSegment(afterRoot.slice(0, versionSeparatorIndex))) {
+			const afterVersion = afterRoot.slice(versionSeparatorIndex + 1);
+			if (afterVersion.startsWith(MANAGED_BINARY_NAME)) {
+				if (isPathBoundary(afterVersion[8] ?? "")) return true;
+			}
+		}
+		index = normalizedValue.indexOf(versionsRoot, index + 1);
+	}
+	return false;
+}
+function containsExactManagedPath(normalizedValue, normalizedPath) {
+	let index = normalizedValue.indexOf(normalizedPath);
+	while (index >= 0) {
+		const before = index > 0 ? normalizedValue[index - 1] ?? "" : "";
+		const after = normalizedValue[index + normalizedPath.length] ?? "";
+		if (isPathBoundary(before) && isPathBoundary(after)) return true;
+		index = normalizedValue.indexOf(normalizedPath, index + 1);
+	}
+	return false;
+}
+function normalizeVersionsRoot(pathInput) {
+	return `${normalizeManagedBinaryPathText(openMeldVersionsDir(pathInput)).replace(TRAILING_SLASHES_PATTERN, "")}/`;
+}
+function normalizeManagedBinaryPathText(value) {
+	return value.trim().replaceAll("\\", "/").toLowerCase();
+}
+function isPathBoundary(value) {
+	return value === "" || PATH_BOUNDARY_PATTERN.test(value);
+}
+function isValidManagedVersionSegment(value) {
+	return value.length > 0 && !VERSION_SEGMENT_BOUNDARY_PATTERN.test(value);
+}
+//#endregion
+//#region src/local-service/lifecycle/daemon-service-manager-command-match.ts
+async function assertDaemonMaintenanceInstallationOwnership() {
+	const manager = await resolveDaemonServiceManager();
+	if (!manager) throw new Error("OpenMeld cannot verify the background service installation.");
+	const status = await manager.status();
+	if (!status.installed) return;
+	if (!await matchesExpectedDaemonServiceManagerDefinition({
+		controller: manager.controller,
+		definitionPath: status.definitionPath ?? null,
+		commandSpec: status.commandSpec
+	})) throw new Error("OpenMeld background service belongs to a different installation. Automatic maintenance was stopped without changing it.");
+}
+function matchesExpectedDaemonServiceManagerCommand(input) {
+	if (input.controller === "windows-service") {
+		if (input.commandSpec) return matchesWindowsTaskInstallation(input.commandSpec, input.pathInput);
+		return typeof input.definitionPath === "string" && input.definitionPath.length > 0 && input.commandSummary.includes(input.definitionPath);
+	}
+	if ((input.distribution ?? resolveOpenMeldDistribution()) === "binary") {
+		if (input.controller === "launchd") {
+			const stableExecutablePath = daemonServiceBinaryExecutablePath(input.pathInput);
+			return [
+				`${stableExecutablePath} service run`,
+				`"${stableExecutablePath}" service run`,
+				`'${stableExecutablePath}' service run`
+			].some((expectedPrefix) => input.commandSummary.includes(expectedPrefix));
+		}
+		return containsOpenMeldManagedBinaryPath(input.commandSummary, input.pathInput);
+	}
+	return resolveExpectedDaemonServiceManagerCommandPaths({
+		controller: input.controller,
+		includeLegacyExecutableWrappers: input.includeLegacyExecutableWrappers === true,
+		pathInput: input.pathInput
+	}).some((path) => input.commandSummary.includes(path));
+}
+async function matchesExpectedDaemonServiceManagerDefinition(input) {
+	if (input.controller === "windows-service" && input.commandSpec) return matchesWindowsTaskInstallation(input.commandSpec, input.pathInput);
+	if (typeof input.definitionPath !== "string" || input.definitionPath.trim().length === 0) return false;
+	const definition = await readFile(input.definitionPath, "utf8").catch(() => null);
+	if (definition === null) return false;
+	if ((input.distribution ?? resolveOpenMeldDistribution()) === "binary") {
+		if (input.controller === "launchd") {
+			const stableExecutablePath = daemonServiceBinaryExecutablePath(input.pathInput);
+			return definition.includes(`<string>${stableExecutablePath}</string>`);
+		}
+		return containsOpenMeldManagedBinaryPath(definition, input.pathInput);
+	}
+	return resolveExpectedDaemonServiceManagerCommandPaths({
+		controller: input.controller ?? null,
+		pathInput: input.pathInput
+	}).some((path) => definition.includes(path));
+}
+function matchesWindowsTaskInstallation(spec, pathInput = {}) {
+	return spec.args[0] === daemonServiceLauncherPath(pathInput) && spec.args[1] === "service" && spec.args[2] === "run" && resolveOpenMeldRootDir({ env: spec.env }) === resolveOpenMeldRootDir(pathInput);
+}
+function resolveExpectedDaemonServiceManagerCommandPaths(input) {
+	if (input.controller === "launchd") return [daemonServiceExecutableWrapperPath(input.pathInput), ...input.includeLegacyExecutableWrappers === true ? [daemonServiceLegacyWrapperPath(input.pathInput)] : []];
+	return [daemonServiceLauncherPath(input.pathInput)];
+}
+//#endregion
+//#region src/local-service/lifecycle/daemon-service-command-path.ts
+const COMMAND_TOKEN_PATTERN = /"([^"]*)"|'([^']*)'|(\S+)/g;
+const COMMAND_ARGUMENT_BOUNDARY_PATTERN = /\s/u;
+function tokenizeDaemonCommand(command) {
+	const tokens = [];
+	for (const match of command.matchAll(COMMAND_TOKEN_PATTERN)) {
+		const token = match[1] ?? match[2] ?? match[3];
+		if (token) tokens.push(token);
+	}
+	return tokens;
+}
+function normalizeDaemonCommandPath(path) {
+	return path.trim().replaceAll("\\", "/").toLowerCase();
+}
+function daemonCommandContainsExactPath(command, path) {
+	const normalizedCommand = normalizeDaemonCommandPath(command);
+	const normalizedPath = normalizeDaemonCommandPath(path);
+	let pathIndex = normalizedCommand.indexOf(normalizedPath);
+	while (pathIndex >= 0) {
+		const beforePath = normalizedCommand[pathIndex - 1];
+		const afterPath = normalizedCommand[pathIndex + normalizedPath.length];
+		if (isCommandArgumentBoundary(beforePath) && isCommandArgumentBoundary(afterPath)) return true;
+		pathIndex = normalizedCommand.indexOf(normalizedPath, pathIndex + normalizedPath.length);
+	}
+	return false;
+}
+function extractDaemonCommandEntryPath(command, pathInput = {}) {
+	const unquotedWrapperPath = extractUnquotedDaemonWrapperPath(command, pathInput);
+	if (unquotedWrapperPath) return unquotedWrapperPath;
+	const tokens = tokenizeDaemonCommand(command);
+	if (tokens.length === 0) return null;
+	const serviceRunIndex = findDaemonServiceCommandIndex(tokens);
+	const candidateTokens = serviceRunIndex > 0 ? tokens.slice(0, serviceRunIndex) : tokens;
+	for (let index = candidateTokens.length - 1; index >= 0; index -= 1) {
+		const token = candidateTokens[index];
+		if (!(token && looksLikeDaemonEntryPath(token, pathInput))) continue;
+		return token;
+	}
+	return null;
+}
+function isDaemonRuntimeProcessCommand(command) {
+	const serviceCommand = parseDaemonServiceProcessCommand(command);
+	return serviceCommand?.action === "run" || serviceCommand?.action === "start" && serviceCommand.mode === "foreground";
+}
+function parseDaemonServiceProcessCommand(command) {
+	const tokens = tokenizeDaemonCommand(command).map((token) => token.toLowerCase());
+	const serviceCommandIndex = findDaemonServiceCommandIndex(tokens);
+	if (serviceCommandIndex < 0) return null;
+	const action = tokens[serviceCommandIndex + 1];
+	if (action !== "run" && action !== "start") return null;
+	return {
+		action,
+		mode: resolveDaemonServiceProcessMode(tokens.slice(serviceCommandIndex + 2))
+	};
+}
+function resolveDaemonBundleIdFromEntryPath(entryPath, pathInput = {}) {
+	const normalizedEntryPath = normalizeDaemonCommandPath(entryPath);
+	const normalizedBundleRoot = `${normalizeDaemonCommandPath(daemonRuntimeBundlesPath(pathInput))}/`;
+	if (!normalizedEntryPath.startsWith(normalizedBundleRoot)) return null;
+	const bundleId = normalizedEntryPath.slice(normalizedBundleRoot.length).split("/")[0];
+	return bundleId && bundleId.length > 0 ? bundleId : null;
+}
+function looksLikeDaemonEntryPath(token, pathInput) {
+	return token.includes("/bundles/") || token.includes("openmeld/dist/openmeld.js") || token.endsWith("/openmeld.js") || token.endsWith("/openmeld-dev.js") || token.endsWith("/daemon-service-launcher.mjs") || isRecognizedDaemonServiceExecutableWrapperPath(token, pathInput) || isOpenMeldManagedBinaryPath(token, pathInput);
+}
+function findDaemonServiceCommandIndex(tokens) {
+	return tokens.findIndex((token, index) => token === "service" && (tokens[index + 1] === "run" || tokens[index + 1] === "start"));
+}
+function resolveDaemonServiceProcessMode(serviceArguments) {
+	let mode = null;
+	for (let index = 0; index < serviceArguments.length; index += 1) {
+		const argument = serviceArguments[index];
+		let modeValue;
+		if (argument === "--mode") modeValue = serviceArguments[index + 1];
+		else if (argument?.startsWith("--mode=")) modeValue = argument.slice(7);
+		if (modeValue === "foreground" || modeValue === "background") mode = modeValue;
+	}
+	return mode;
+}
+function isRecognizedDaemonServiceExecutableWrapperPath(token, pathInput) {
+	const normalizedToken = normalizeDaemonCommandPath(token);
+	return daemonServiceRecognizedExecutablePaths$1(pathInput).some((wrapperPath) => {
+		const normalizedWrapperPath = normalizeDaemonCommandPath(wrapperPath);
+		return normalizedToken === normalizedWrapperPath || normalizedToken.endsWith(`/${normalizeDaemonCommandPath(basename(wrapperPath))}`);
+	});
+}
+function extractUnquotedDaemonWrapperPath(command, pathInput) {
+	const normalizedCommand = normalizeDaemonCommandPath(command);
+	const serviceRunIndex = normalizedCommand.indexOf(" service run");
+	if (serviceRunIndex <= 0) return null;
+	const commandPrefix = command.slice(0, serviceRunIndex);
+	const normalizedPrefix = normalizedCommand.slice(0, serviceRunIndex);
+	for (const wrapperPath of daemonServiceRecognizedExecutablePaths$1(pathInput)) {
+		const normalizedWrapperPath = normalizeDaemonCommandPath(wrapperPath);
+		const wrapperPathIndex = normalizedPrefix.lastIndexOf(normalizedWrapperPath);
+		if (wrapperPathIndex >= 0 && daemonCommandContainsExactPath(commandPrefix, wrapperPath)) return commandPrefix.slice(wrapperPathIndex, wrapperPathIndex + normalizedWrapperPath.length);
+		const wrapperName = basename(wrapperPath);
+		if (!wrapperName.includes(" ")) continue;
+		const normalizedSuffix = `/${normalizeDaemonCommandPath(wrapperName)}`;
+		const wrapperNameIndex = normalizedPrefix.lastIndexOf(normalizedSuffix);
+		if (wrapperNameIndex < 0 || wrapperNameIndex + normalizedSuffix.length !== normalizedPrefix.length) continue;
+		return commandPrefix.slice(0, wrapperNameIndex + normalizedSuffix.length);
+	}
+	return null;
+}
+function isCommandArgumentBoundary(char) {
+	return char === void 0 || char === "'" || char === "\"" || COMMAND_ARGUMENT_BOUNDARY_PATTERN.test(char);
+}
+//#endregion
+//#region src/local-service/lifecycle/daemon-service-process-inventory.ts
+const POSIX_PROCESS_LINE_PATTERN = /^(\d+)\s+(\d+)\s+(.+)$/;
+const TRAILING_PATH_SEPARATOR_PATTERN = /\/+$/u;
+const OPENMELD_PACKAGE_INSTALL_ENTRY_SEGMENT = "/node_modules/openmeld/dist/openmeld.js";
+const OPENMELD_DEV_LOCAL_ENTRY_SEGMENT = "/openmeld-dev.js";
+const ALL_OPENMELD_ENV_PRESETS = [
+	"prod",
+	"dev-local",
+	"canary"
+];
+const DAEMON_BIN_COMMAND_PATTERN_BY_PRESET = {
+	prod: buildOpenMeldBinCommandPatternForPreset("prod"),
+	"dev-local": buildOpenMeldBinCommandPatternForPreset("dev-local"),
+	canary: buildOpenMeldBinCommandPatternForPreset("canary")
+};
+async function listDaemonOwnedProcesses(overrides = {}) {
+	const listProcesses = overrides.listProcesses ?? listProcessesForCurrentPlatform;
+	const ignoredProcessIds = new Set(Array.from(overrides.ignoreProcessIds ?? []).filter((pid) => Number.isInteger(pid) && pid > 0));
+	return collapseLauncherWrapperProcesses((await listProcesses()).map((processInfo) => classifyDaemonOwnedProcess(processInfo, ignoredProcessIds, overrides.pathInput)).filter((processInfo) => processInfo !== null));
+}
+function classifyDaemonOwnedProcess(processInfo, ignoredProcessIds, pathInput = {}) {
+	if (ignoredProcessIds.has(processInfo.pid)) return null;
+	const normalizedCommand = normalizeProcessCommand(processInfo.command);
+	const isRuntimeProcess = isDaemonRuntimeProcessCommand(normalizedCommand);
+	const isLegacyDetachedProcess = normalizedCommand.includes("legacy-detached");
+	if (!(isRuntimeProcess || isLegacyDetachedProcess)) return null;
+	const launcherPath = normalizeProcessCommand(daemonServiceLauncherPath(pathInput));
+	const wrapperPaths = daemonServiceRecognizedExecutablePaths(pathInput).map(normalizeProcessCommand);
+	if (wrapperPaths.some((wrapperPath) => normalizedCommand.includes(wrapperPath) && !daemonCommandContainsExactPath(normalizedCommand, wrapperPath))) return null;
+	if (!looksLikeCurrentLaneDaemonCandidate({
+		launcherPath,
+		normalizedCommand,
+		wrapperPaths
+	})) return null;
+	if (resolveDaemonCommandLaneScope({
+		launcherPath,
+		normalizedCommand,
+		pathInput
+	}) !== "current_lane") return null;
+	const ownership = resolveDaemonProcessOwnership(normalizedCommand, launcherPath, wrapperPaths, pathInput);
+	const mode = parseDaemonServiceProcessCommand(normalizedCommand)?.mode ?? null;
+	return {
+		pid: processInfo.pid,
+		parentPid: processInfo.parentPid,
+		command: processInfo.command,
+		mode,
+		ownership
+	};
+}
+async function listProcessesForCurrentPlatform() {
+	if (process$1.platform === "win32") return await listWindowsProcesses();
+	return await listPosixProcesses();
+}
+async function listPosixProcesses() {
+	const output = await runCommand("ps", ["-axo", "pid=,ppid=,command="]);
+	const processes = [];
+	for (const line of output.split("\n")) {
+		const trimmed = line.trim();
+		if (trimmed.length === 0) continue;
+		const match = trimmed.match(POSIX_PROCESS_LINE_PATTERN);
+		if (!(match?.[1] && match[2] && match[3])) continue;
+		processes.push({
+			pid: Number(match[1]),
+			parentPid: Number(match[2]),
+			command: match[3]
+		});
+	}
+	return processes;
+}
+function resolveDaemonProcessOwnership(normalizedCommand, launcherPath, wrapperPaths, pathInput) {
+	const isRuntimeProcess = isDaemonRuntimeProcessCommand(normalizedCommand);
+	if (normalizedCommand.includes(launcherPath) || wrapperPaths.some((wrapperPath) => daemonCommandContainsExactPath(normalizedCommand, wrapperPath)) || isRuntimeProcess && containsOpenMeldManagedBinaryPath(normalizedCommand, pathInput)) return "stable_launcher";
+	if (normalizedCommand.includes("legacy-detached")) return "legacy_detached";
+	if (isRuntimeProcess) return "cli_direct";
+	return "unknown";
+}
+function looksLikeCurrentLaneDaemonCandidate(input) {
+	return isDaemonRuntimeProcessCommand(input.normalizedCommand) || input.normalizedCommand.includes(input.launcherPath) || input.wrapperPaths.some((wrapperPath) => daemonCommandContainsExactPath(input.normalizedCommand, wrapperPath)) || input.normalizedCommand.includes("legacy-detached");
+}
+function resolveDaemonCommandLaneScope(input) {
+	const managedVersionRoot = resolveDaemonCommandManagedVersionRoot(input.normalizedCommand);
+	if (managedVersionRoot) return managedVersionRoot === normalizeRootPath(resolveOpenMeldRootDir(input.pathInput)) ? "current_lane" : "other_lane";
+	const currentLane = resolveOpenMeldEnvPreset(input.pathInput);
+	const managedLane = resolveManagedDaemonPathLane({
+		normalizedCommand: input.normalizedCommand,
+		pathInput: input.pathInput
+	});
+	if (managedLane) return managedLane === currentLane ? "current_lane" : "other_lane";
+	if (hasExplicitOpenMeldHome(input.pathInput)) return "not_openmeld";
+	const detectedLane = resolveDaemonCliCommandLane(input.normalizedCommand, input.pathInput);
+	if (!detectedLane) return "not_openmeld";
+	return detectedLane === currentLane ? "current_lane" : "other_lane";
+}
+function hasExplicitOpenMeldHome(pathInput) {
+	const value = (pathInput.env ?? process$1.env)[OPENMELD_HOME_ENV_KEY];
+	return typeof value === "string" && value.trim().length > 0;
+}
+function resolveDaemonCommandManagedVersionRoot(normalizedCommand) {
+	for (const token of tokenizeDaemonCommand(normalizedCommand)) {
+		const rootPath = resolveOpenMeldManagedVersionBinaryRootPath(token);
+		if (rootPath) return normalizeRootPath(rootPath);
+	}
+	return null;
+}
+function resolveManagedDaemonPathLane(input) {
+	const currentPreset = resolveOpenMeldEnvPreset(input.pathInput);
+	for (const preset of ALL_OPENMELD_ENV_PRESETS) {
+		const lanePathInput = resolveLanePathInput(input.pathInput, preset);
+		const laneLauncherPath = normalizeProcessCommand(daemonServiceLauncherPath(lanePathInput));
+		const laneWrapperPaths = daemonServiceRecognizedExecutablePaths(lanePathInput).map(normalizeProcessCommand);
+		const laneRuntimeRoot = normalizeProcessCommand(daemonRuntimeRootPath(lanePathInput));
+		const laneEntryPath = extractDaemonCommandEntryPath(input.normalizedCommand, lanePathInput);
+		const laneExecutableNames = laneWrapperPaths.map((candidatePath) => basename(candidatePath));
+		if (input.normalizedCommand.includes(laneLauncherPath) || laneWrapperPaths.some((wrapperPath) => daemonCommandContainsExactPath(input.normalizedCommand, wrapperPath)) || preset !== currentPreset && laneEntryPath !== null && laneExecutableNames.includes(normalizeProcessCommand(basename(laneEntryPath))) || input.normalizedCommand.includes(laneRuntimeRoot) || containsOpenMeldManagedBinaryPath(input.normalizedCommand, lanePathInput)) return preset;
+	}
+	return null;
+}
+function resolveDaemonCliCommandLane(normalizedCommand, pathInput) {
+	if (!isDaemonRuntimeProcessCommand(normalizedCommand)) return null;
+	if (matchesDaemonCliLane(normalizedCommand, "dev-local", pathInput)) return "dev-local";
+	if (matchesDaemonCliLane(normalizedCommand, "canary", pathInput)) return "canary";
+	if (matchesDaemonCliLane(normalizedCommand, "prod", pathInput)) return "prod";
+	return null;
+}
+function matchesDaemonCliLane(normalizedCommand, preset, pathInput) {
+	if (DAEMON_BIN_COMMAND_PATTERN_BY_PRESET[preset].test(normalizedCommand)) return true;
+	if (preset === "dev-local") return normalizedCommand.includes(OPENMELD_DEV_LOCAL_ENTRY_SEGMENT);
+	const canaryPackageInstallRoot = resolveCanaryPackageInstallRoot(pathInput);
+	if (preset === "canary") return normalizedCommand.includes(canaryPackageInstallRoot) || normalizedCommand.includes("/.local/share/openmeld-canary/package-install/");
+	return normalizedCommand.includes(OPENMELD_PACKAGE_INSTALL_ENTRY_SEGMENT) && !normalizedCommand.includes(canaryPackageInstallRoot) && !normalizedCommand.includes("/.local/share/openmeld-canary/package-install/") && !normalizedCommand.includes(OPENMELD_DEV_LOCAL_ENTRY_SEGMENT);
+}
+function collapseLauncherWrapperProcesses(processes) {
+	const launcherPidSet = /* @__PURE__ */ new Set();
+	for (const processInfo of processes) if (processInfo.ownership === "stable_launcher") launcherPidSet.add(processInfo.pid);
+	if (launcherPidSet.size === 0) return processes;
+	const collapsedProcesses = [];
+	for (const processInfo of processes) {
+		if (processInfo.ownership === "stable_launcher") {
+			if (processes.some((candidate) => candidate.pid !== processInfo.pid && candidate.parentPid === processInfo.pid && candidate.ownership !== "stable_launcher")) continue;
+			collapsedProcesses.push(processInfo);
+			continue;
+		}
+		if (processInfo.parentPid !== null && launcherPidSet.has(processInfo.parentPid)) {
+			collapsedProcesses.push({
+				...processInfo,
+				ownership: processInfo.ownership === "unknown" ? processInfo.ownership : "stable_launcher"
+			});
+			continue;
+		}
+		collapsedProcesses.push(processInfo);
+	}
+	return collapsedProcesses;
+}
+async function listWindowsProcesses() {
+	const output = await runCommand("powershell", [
+		"-NoProfile",
+		"-Command",
+		"Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,CommandLine | ConvertTo-Json -Compress"
+	]);
+	const parsed = JSON.parse(output);
+	const rows = Array.isArray(parsed) ? parsed : [parsed];
+	const processes = [];
+	for (const row of rows) {
+		if (typeof row.ProcessId !== "number" || typeof row.ParentProcessId !== "number" || typeof row.CommandLine !== "string" || row.CommandLine.trim().length === 0) continue;
+		processes.push({
+			pid: row.ProcessId,
+			parentPid: row.ParentProcessId,
+			command: row.CommandLine
+		});
+	}
+	return processes;
+}
+async function runCommand(command, args) {
+	return await new Promise((resolve, reject) => {
+		const child = spawn(command, args, {
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			],
+			env: process$1.env,
+			windowsHide: true
+		});
+		let stdout = "";
+		let stderr = "";
+		child.stdout?.on("data", (chunk) => {
+			stdout += chunk.toString();
+		});
+		child.stderr?.on("data", (chunk) => {
+			stderr += chunk.toString();
+		});
+		child.once("error", reject);
+		child.once("close", (code) => {
+			if (code !== 0) {
+				reject(/* @__PURE__ */ new Error(`process inventory command failed: ${command} ${args.join(" ")} ${stderr.trim()}`));
+				return;
+			}
+			resolve(stdout);
+		});
+	});
+}
+function buildOpenMeldBinCommandPatternForPreset(preset) {
+	const aliases = resolveDaemonServiceIdentity({ env: { OPENMELD_ENV_PRESET: preset } }).cliEntryAliases.map(escapeRegex);
+	return new RegExp(`(^|[\\s\\/])(${aliases.join("|")})(?:\\.cmd|\\.exe|\\.js)?(?=\\s|$)`, "u");
+}
+function escapeRegex(value) {
+	return value.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function resolveCanaryPackageInstallRoot(pathInput = {}) {
+	return normalizeProcessCommand(join(pathInput.homeDir ?? homedir(), ".local", "share", "openmeld-canary", "package-install"));
+}
+function resolveLanePathInput(pathInput, preset) {
+	const currentPreset = resolveOpenMeldEnvPreset(pathInput);
+	const env = {
+		...pathInput.env ?? process$1.env,
+		OPENMELD_ENV_PRESET: preset
+	};
+	if (preset !== currentPreset && env["OPENMELD_HOME"]) delete env[OPENMELD_HOME_ENV_KEY];
+	return {
+		...pathInput,
+		env
+	};
+}
+function normalizeProcessCommand(command) {
+	return command.trim().toLowerCase().replaceAll("\\", "/");
+}
+function normalizeRootPath(path) {
+	const normalized = normalizeProcessCommand(path);
+	return normalized === "/" ? normalized : normalized.replace(TRAILING_PATH_SEPARATOR_PATTERN, "");
+}
+//#endregion
+//#region src/local-service/lifecycle/daemon-service-legacy-shared.ts
+const PROD_ENV_PRESET = "prod";
+function shouldInspectLegacySharedDaemonService(input = {}) {
+	const env = input.env ?? process.env;
+	if (String(env["OPENMELD_HOME"] ?? "").trim()) return false;
+	return resolveOpenMeldEnvPreset(input) === PROD_ENV_PRESET;
+}
+function resolveLegacySharedDaemonPathInput(input = {}) {
+	if (!shouldInspectLegacySharedDaemonService(input)) return null;
+	return {
+		...input,
+		env: {
+			...input.env ?? process.env,
+			OPENMELD_ENV_PRESET: PROD_ENV_PRESET
+		}
+	};
+}
+function requiresLegacySharedDaemonServiceMigration(input) {
+	if (hasLegacySharedServiceManagerResidual(input)) return true;
+	return hasLegacyDetachedResidual(input);
+}
+async function inspectLegacySharedDaemonService(input = {}) {
+	const pathInput = resolveLegacySharedDaemonPathInput(input);
+	if (!pathInput) return null;
+	const [installStatus, runtimeStatus, serviceManager, ownedProcesses] = await Promise.all([
+		getDaemonStatus(pathInput),
+		getDaemonRuntimeStatus(pathInput),
+		resolveDaemonServiceManager(void 0, pathInput).catch(() => null),
+		listDaemonOwnedProcesses({ pathInput }).catch(() => [])
+	]);
+	const serviceManagerStatus = serviceManager ? await serviceManager.status().catch(() => null) : null;
+	return {
+		present: requiresLegacySharedDaemonServiceMigration({
+			pathInput,
+			runtimeStatus,
+			serviceManager,
+			serviceManagerStatus,
+			ownedProcesses
+		}),
+		pathInput,
+		installStatus,
+		runtimeStatus,
+		serviceManager,
+		serviceManagerStatus,
+		ownedProcesses
+	};
+}
+function hasLegacySharedServiceManagerResidual(input) {
+	if (!input.serviceManagerStatus?.installed) return false;
+	if (!input.serviceManagerStatus.commandSummary) return true;
+	return !matchesExpectedDaemonServiceManagerCommand({
+		controller: input.serviceManager?.controller ?? null,
+		commandSummary: input.serviceManagerStatus.commandSummary,
+		commandSpec: input.serviceManagerStatus.commandSpec,
+		definitionPath: input.serviceManagerStatus.definitionPath ?? null,
+		includeLegacyExecutableWrappers: true,
+		pathInput: input.pathInput
+	});
+}
+function hasLegacyDetachedResidual(input) {
+	if (input.runtimeStatus.serviceController === "legacy-detached") return true;
+	return input.ownedProcesses.some((processInfo) => processInfo.ownership === "legacy_detached");
+}
+async function cleanupLegacySharedDaemonServiceState(input = {}) {
+	const pathInput = resolveLegacySharedDaemonPathInput(input);
+	if (!pathInput) return { removed: false };
+	const legacySharedService = await inspectLegacySharedDaemonService(input);
+	let removedServiceManager = false;
+	if (legacySharedService?.present && legacySharedService.serviceManager && legacySharedService.serviceManagerStatus?.installed) {
+		await legacySharedService.serviceManager.uninstall();
+		await legacySharedService.serviceManager.waitUntilAbsent();
+		removedServiceManager = true;
+	}
+	const uninstallResult = await uninstallDaemon(pathInput);
+	return { removed: removedServiceManager || uninstallResult.removed };
+}
+//#endregion
+//#region src/local-service/lifecycle/daemon-service-runtime-observer.ts
+function resolveObservedDaemonRuntimeStatus(input) {
+	const runtimeLeaseIssue = resolveRuntimeLeaseIssue(input.runtimeLease);
+	const observedProcess = selectObservedRuntimeProcess(input.ownedProcesses);
+	if (!runtimeLeaseIssue && input.runtimeLease) return {
+		status: "running",
+		mode: input.runtimeLease.mode,
+		pid: input.runtimeLease.pid,
+		startedAt: input.runtimeLease.startedAt,
+		updatedAt: input.runtimeLease.updatedAt,
+		managedBySystemService: input.runtimeLease.managedBySystemService,
+		serviceController: input.runtimeLease.serviceController,
+		autoStart: input.runtimeLease.managedBySystemService
+	};
+	if (observedProcess) return {
+		status: "stale",
+		mode: observedProcess.mode,
+		pid: observedProcess.pid,
+		startedAt: input.runtimeLease?.startedAt ?? null,
+		updatedAt: input.runtimeLease?.updatedAt ?? null,
+		managedBySystemService: observedProcess.ownership === "stable_launcher",
+		serviceController: observedProcess.ownership === "legacy_detached" ? "legacy-detached" : "unknown",
+		autoStart: observedProcess.ownership === "stable_launcher",
+		reason: runtimeLeaseIssue ?? "runtime_lease_missing"
+	};
+	if (!input.runtimeLease) return {
+		status: "not_running",
+		mode: null,
+		pid: null,
+		startedAt: null,
+		updatedAt: null,
+		managedBySystemService: false,
+		serviceController: "unknown",
+		autoStart: false
+	};
+	return {
+		status: "stale",
+		mode: input.runtimeLease.mode,
+		pid: input.runtimeLease.pid,
+		startedAt: input.runtimeLease.startedAt,
+		updatedAt: input.runtimeLease.updatedAt,
+		managedBySystemService: input.runtimeLease.managedBySystemService,
+		serviceController: input.runtimeLease.serviceController,
+		autoStart: input.runtimeLease.managedBySystemService,
+		reason: runtimeLeaseIssue ?? "runtime_lease_missing"
+	};
+}
+function resolveObservedRuntimeCommandEntryPath(input) {
+	const runtimePid = typeof input.runtimeStatus.pid === "number" ? input.runtimeStatus.pid : null;
+	if (!runtimePid) return null;
+	const runtimeProcess = input.ownedProcesses.find((processInfo) => processInfo.pid === runtimePid);
+	if (!runtimeProcess) return null;
+	return extractDaemonCommandEntryPath(runtimeProcess.command);
+}
+function resolveRuntimeLeaseIssue(runtimeLease) {
+	if (!runtimeLease) return "runtime_lease_missing";
+	if (!Number.isInteger(runtimeLease.pid) || runtimeLease.pid <= 0) return "invalid_pid";
+	if (!isPidAlive(runtimeLease.pid)) return "process_not_alive";
+	if (isRuntimeLeaseHeartbeatStale(runtimeLease)) return "heartbeat_stale";
+	return null;
+}
+function selectObservedRuntimeProcess(ownedProcesses) {
+	return [...ownedProcesses].sort((left, right) => {
+		const priorityDifference = resolveOwnershipPriority(left.ownership) - resolveOwnershipPriority(right.ownership);
+		if (priorityDifference !== 0) return priorityDifference;
+		const modeDifference = resolveModePriority(left.mode) - resolveModePriority(right.mode);
+		if (modeDifference !== 0) return modeDifference;
+		return left.pid - right.pid;
+	})[0] ?? null;
+}
+function resolveOwnershipPriority(ownership) {
+	switch (ownership) {
+		case "stable_launcher": return 0;
+		case "legacy_detached": return 1;
+		case "cli_direct": return 2;
+		default: return 3;
+	}
+}
+function resolveModePriority(mode) {
+	switch (mode) {
+		case "background": return 0;
+		case "foreground": return 1;
+		default: return 2;
+	}
+}
+function isPidAlive(pid) {
+	try {
+		process$1.kill(pid, 0);
+		return true;
+	} catch {
+		return false;
+	}
+}
+function isRuntimeLeaseHeartbeatStale(runtimeLease) {
+	const freshnessTimestamp = runtimeLease.heartbeatAt ?? runtimeLease.updatedAt;
+	const heartbeatMs = Date.parse(freshnessTimestamp);
+	if (Number.isNaN(heartbeatMs)) return true;
+	return Date.now() - heartbeatMs > DAEMON_HEARTBEAT_STALE_MS;
+}
+//#endregion
+//#region src/local-service/lifecycle/daemon-service-runtime.ts
+const DEFAULT_SYSTEM_SERVICE_STOP_WAIT_MS = 3e3;
+const DEFAULT_SYSTEM_SERVICE_STOP_POLL_MS = 200;
+async function readCurrentObservedDaemonRuntimeStatus() {
+	return await readObservedRuntimeState();
+}
+async function clearDaemonRuntimeStateIfDefinitelyStopped() {
+	const context = await readCurrentDaemonRuntimeContext();
+	if (!(context.effectiveRuntimeStatus === "not_running" || await isStoppedSystemServiceSnapshot(context))) return {
+		context,
+		cleared: false
+	};
+	await clearDaemonServiceRuntimeState();
+	return {
+		context,
+		cleared: true
+	};
+}
+async function isStoppedSystemServiceSnapshot(context) {
+	if (context.runtimeStatus.status !== "stale" || !context.runtimeStatus.managedBySystemService || context.serviceManagerStatus?.running !== false) return false;
+	return (await listDaemonOwnedProcesses({ ignoreProcessIds: [process$1.pid, process$1.ppid] })).length === 0;
+}
+async function readCurrentDaemonRuntimeContext(input = {}) {
+	const status = input.status ?? await getDaemonStatus();
+	const runtimeStatus = await readCurrentObservedDaemonRuntimeStatus();
+	const { serviceManager, serviceManagerStatus, legacySharedService } = await resolveDaemonServiceManagerForRuntimeState({
+		status,
+		runtimeState: runtimeStatus
+	});
+	return {
+		status,
+		runtimeStatus,
+		serviceManager,
+		serviceManagerStatus,
+		legacySharedService,
+		effectiveRuntimeStatus: getEffectiveDaemonRuntimeStatus({
+			runtimeState: runtimeStatus,
+			serviceManagerStatus
+		})
+	};
+}
+async function resolveDaemonRuntimeState(status) {
+	if (!status.installed) return null;
+	return await readCurrentObservedDaemonRuntimeStatus();
+}
+async function resolveDaemonServiceManagerFromRuntimeState(runtimeState) {
+	if (!runtimeState?.managedBySystemService) return null;
+	if (runtimeState.serviceController === "legacy-detached") return null;
+	return await resolveDaemonServiceManager(runtimeState.serviceController);
+}
+async function resolveDaemonServiceManagerForRuntimeState(input) {
+	const initialManager = await resolveDaemonServiceManagerFromRuntimeState(input.runtimeState);
+	const initialManagerStatus = initialManager ? await initialManager.status().catch(() => null) : null;
+	if (input.status.installed && input.runtimeState?.managedBySystemService !== true && !initialManagerStatus?.installed) {
+		const detectedManager = await resolveDaemonServiceManager().catch(() => null);
+		if (detectedManager) {
+			const detectedManagerStatus = await detectedManager.status().catch(() => null);
+			if (detectedManagerStatus?.installed) return {
+				serviceManager: detectedManager,
+				serviceManagerStatus: detectedManagerStatus,
+				legacySharedService: null
+			};
+		}
+	}
+	const legacySharedService = await inspectLegacySharedDaemonService().catch(() => null);
+	if (legacySharedService?.present && legacySharedService.serviceManagerStatus?.installed) {
+		const legacyManager = legacySharedService.serviceManager ?? await resolveDaemonServiceManager(legacySharedService.runtimeStatus.serviceController === "unknown" ? void 0 : legacySharedService.runtimeStatus.serviceController, legacySharedService.pathInput).catch(() => null);
+		if (legacyManager) return {
+			serviceManager: legacyManager,
+			serviceManagerStatus: legacySharedService.serviceManagerStatus,
+			legacySharedService
+		};
+	}
+	return {
+		serviceManager: initialManager,
+		serviceManagerStatus: initialManagerStatus,
+		legacySharedService
+	};
+}
+function getEffectiveDaemonRuntimeStatus(input) {
+	if (input.runtimeState.status === "running") return "running";
+	if (!(input.runtimeState.managedBySystemService && input.serviceManagerStatus)) return input.runtimeState.status;
+	if (input.runtimeState.status === "stale") {
+		if (input.runtimeState.reason === "heartbeat_stale") return "stale";
+		if (input.serviceManagerStatus.running) return "running";
+		if (!input.serviceManagerStatus.enabled) return "not_running";
+	}
+	if (!input.serviceManagerStatus.running) return "not_running";
+	return input.runtimeState.status;
+}
+async function waitForDaemonSystemServiceToStop(input) {
+	const waitMs = input.waitMs ?? DEFAULT_SYSTEM_SERVICE_STOP_WAIT_MS;
+	const pollMs = input.pollMs ?? DEFAULT_SYSTEM_SERVICE_STOP_POLL_MS;
+	const deadlineMs = Date.now() + waitMs;
+	while (Date.now() < deadlineMs) {
+		const currentRuntime = await readCurrentObservedDaemonRuntimeStatus().catch(() => null);
+		if ((await input.manager.status().catch(() => null))?.running === false && currentRuntime !== null && currentRuntime.status !== "running") return true;
+		if (currentRuntime?.status === "stale" && !currentRuntime.managedBySystemService) return true;
+		if (currentRuntime?.status === "not_running") return true;
+		await sleep(pollMs);
+	}
+	const finalRuntime = await readCurrentObservedDaemonRuntimeStatus().catch(() => null);
+	if (finalRuntime?.status === "not_running") return true;
+	if (finalRuntime?.status === "stale" && !finalRuntime.managedBySystemService) return true;
+	if (finalRuntime?.status === "running") return false;
+	if (finalRuntime === null) return false;
+	return (await input.manager.status().catch(() => null))?.running === false;
+}
+async function readObservedRuntimeState() {
+	const ignoredProcessIds = [process$1.pid, process$1.ppid].filter((pid) => Number.isInteger(pid) && pid > 0);
+	const [runtimeLease, ownedProcesses] = await Promise.all([readDaemonRuntimeLease().catch(() => null), listDaemonOwnedProcesses({ ignoreProcessIds: ignoredProcessIds })]);
+	return resolveObservedDaemonRuntimeStatus({
+		runtimeLease,
+		ownedProcesses
+	});
+}
+//#endregion
+export { readManagedCliInstallation as $, prepareDaemonServiceBundle as A, verifyCliBinaryCodeSignature as At, resolveDaemonServiceArtifact as B, readDaemonServiceContract as Bt, daemonServiceExecutableWrapperPath as C, resolveDaemonServiceUpdateWorkerLaunchdPlistPath as Ct, ensureDaemonServiceStableBinaryExecutable as D, resolveDaemonServiceUpdateWorkerWindowsScriptPath as Dt, discardPreparedDaemonServiceBundle as E, resolveDaemonServiceUpdateWorkerSystemdUnitPath as Et, restoreDaemonActiveBundleStateSnapshot as F, requestLocalSyncRouteCatalog as Ft, readRecentDaemonLifecycleEvents as G, formatDaemonLifecycleOriginSummary as H, runAuditedServiceManagerCarrierMutation as I, sendLocalDaemonControlPlaneRequest as It, runWithDaemonLifecycleCommandJournal as J, resolveRecentDaemonSignalStopCause as K, verifyDaemonActiveBundleIntegrity as L, clearDaemonServiceContract as Lt, resolveAlignedDaemonActiveBundleEntryPath as M, requestLocalAgentActivitySync as Mt, resolveDaemonBundleEntryPathFromState as N, requestLocalDaemonServiceUpdateReadiness as Nt, ensureDaemonServiceUpdateWorkerBinaryExecutable as O, downloadCliBinaryUpdateArtifact as Ot, resolveInstalledDaemonBundleFingerprint as P, requestLocalDaemonShutdown as Pt, pruneManagedInstallVersions as Q, writeDaemonServiceExecutableWrapper as R, isDaemonServiceContractIdentityReusable as Rt, daemonServiceBinaryExecutablePath as S, resolveDaemonServiceUpdateWorkerIdentity as St, daemonServiceUpdateWorkerBinaryPath as T, resolveDaemonServiceUpdateWorkerSystemdTimerUnitPath as Tt, readLatestDaemonLifecycleConnectionStateEvent as U, emitDaemonLifecycleEvent as V, upsertDaemonServiceContract as Vt, readLatestDaemonLifecycleOriginEvent as W, buildInstallSelfJsonPayload as X, collectLocalOperationFailure as Y, performManagedInstall as Z, matchesExpectedDaemonServiceManagerDefinition as _, package_default as _t, resolveDaemonRuntimeState as a, persistPendingDaemonServiceUpdate as at, cleanupInactiveDaemonServiceBundles as b, daemonServiceUpdateWorkerNpmEntryPath as bt, resolveObservedDaemonRuntimeStatus as c, buildNextVersionState as ct, inspectLegacySharedDaemonService as d, fetchLatestCliBinaryRelease as dt, resolveCliSelfVersion as et, listDaemonOwnedProcesses as f, fetchLatestPackageInfo as ft, assertDaemonMaintenanceInstallationOwnership as g, resolveBundledServiceRelease as gt, resolveDaemonBundleIdFromEntryPath as h, writeVersionState as ht, readCurrentObservedDaemonRuntimeStatus as i, completePendingDaemonServiceUpdate as it, readDaemonActiveBundleState as j, LocalDaemonControlPlaneClientError as jt, isDaemonBundleSourceAllowedForLane as k, resolveCliBinaryUpdatePlan as kt, resolveObservedRuntimeCommandEntryPath as l, compareSemver as lt, normalizeDaemonCommandPath as m, readVersionState as mt, getEffectiveDaemonRuntimeStatus as n, OPENMELD_VERSION as nt, resolveDaemonServiceManagerForRuntimeState as o, readLastDaemonServiceUpdate as ot, extractDaemonCommandEntryPath as p, isPlainReleaseVersion as pt, runDaemonServiceManagerAction as q, readCurrentDaemonRuntimeContext as r, DAEMON_SERVICE_UPDATE_JOB_SCHEMA as rt, waitForDaemonSystemServiceToStop as s, readPendingDaemonServiceUpdate as st, clearDaemonRuntimeStateIfDefinitelyStopped as t, withManagedInstallTransaction as tt, cleanupLegacySharedDaemonServiceState as u, ensureVersionStateReady as ut, isOpenMeldManagedBinaryPath as v, INDEPENDENT_MAINTENANCE_REGISTRATION as vt, daemonServiceLauncherPath as w, resolveDaemonServiceUpdateWorkerSystemdPathUnitPath as wt, clearDaemonServiceUpdateWorkerBinaryExecutable as x, hasIndependentMaintenanceRegistration as xt, activateDaemonServiceBundle as y, configureDaemonMaintenanceEnvironment as yt, writeDaemonServiceLauncher as z, isUnsafeProductionDeviceId as zt };
+
+//# sourceMappingURL=daemon-service-runtime-DQW9gSLT.js.map