openmeld 0.3.211 → 0.3.213

package/dist/{daemon-service-runtime-D8KrOfSV.js → daemon-service-runtime-CY6wdBe1.js}

@@ -2,7 +2,8 @@
 
 import { $ as openMeldBinDir, N as OPENMELD_HOME_ENV_KEY, a as isOpenMeldOrphanedLockError, d as runWithHeldLock, dt as resolveOpenMeldEnvPreset, et as openMeldManagedBinaryPath, ft as resolveOpenMeldRootDir, i as isOpenMeldLockError, it as openMeldVersionsDir, mt as resolveOpenMeldServiceScope, nt as openMeldManagedVersionDir, rt as openMeldRootDir, t as acquireLock, tt as openMeldManagedVersionBinaryPath, v as resolveCliContextId } from "./lock-Dxp6o_t_.js";
 import { n as cliBinaryManifestSchema, r as cliBinaryServiceReleaseSchema, t as cliBinaryDeltaPatchSchema } from "./cli-binary-manifest-DiUulkp0.js";
-import { R as openMeldToolsUpdateOperationPhaseSchema, V as openMeldToolsUpdateRequestSourceSchema, a as openMeldDaemonControlPlaneResponseSchema } from "./control-plane-D9jDcbMZ.js";
+import { a as openMeldDaemonControlPlaneResponseSchema } from "./control-plane-Bpu7g9Av.js";
+import { b as openMeldToolsUpdateOperationPhaseSchema, w as openMeldToolsUpdateRequestSourceSchema } from "./local-components-B6SCXZf9.js";
 import { t as daemonServiceContractSchema } from "./service-contract-CRyDcIIf.js";
 import { n as resolveOpenMeldDistribution, t as isBinaryDistribution } from "./distribution-DY2fBeSW.js";
 import { r as readDaemonRuntimeLease } from "./daemon-runtime-lease-Dd4hdHNo.js";
@@ -19,7 +20,7 @@ import * as z$1 from "zod/v4";
 import { constants } from "node:fs";
 import process$1 from "node:process";
 import { execFile, spawn } from "node:child_process";
-import { setTimeout } from "node:timers/promises";
+import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
 import { createConnection } from "node:net";
@@ -57,6 +58,8 @@ const daemonServiceUpdateJobBodySchema = z$1.strictObject({
 	jobId: z$1.string().min(1),
 	preparedBundle: daemonServiceUpdatePreparedBundleSchema,
 	requestedAt: z$1.iso.datetime({ offset: true }),
+	targetCliVersion: z$1.string().min(1).optional(),
+	targetServiceVersion: z$1.string().min(1).optional(),
 	targetVersion: z$1.string().min(1),
 	updatedAt: z$1.iso.datetime({ offset: true }),
 	urgency: z$1.enum(["available", "required"])
@@ -306,6 +309,7 @@ async function writeControlPlaneRequest(input) {
 			socket.write(`${JSON.stringify(input.request)}\n`);
 		};
 		const handleData = (chunk) => {
+			if (!responseBuffer && chunk.trim().length === 0) return;
 			responseBuffer += chunk;
 		};
 		const handleEnd = () => {
@@ -422,7 +426,30 @@ function verifyBytes(input) {
 //#endregion
 //#region ../../runtime/local-service/src/cli-binary-update-artifact.ts
 const HARDENED_RUNTIME_FLAG_RE = /flags=.*runtime/iu;
+const RETRY_AFTER_SECONDS_RE = /^\d+$/u;
 const SIGNING_TIMESTAMP_RE = /^Timestamp=/mu;
+const DEFAULT_CLI_BINARY_DOWNLOAD_POLICY = {
+	maxAttempts: 3,
+	retryDelaysMs: [500, 1500],
+	stallTimeoutMs: 6e4,
+	totalBudgetMs: 5 * 6e4
+};
+var CliBinaryUpdateError = class extends Error {
+	allowFullFallback;
+	code;
+	kind;
+	retryAfterMs;
+	retryable;
+	constructor(input) {
+		super(input.message, input.cause === void 0 ? void 0 : { cause: input.cause });
+		this.name = "CliBinaryUpdateError";
+		this.allowFullFallback = input.allowFullFallback;
+		this.code = `openmeld.tools.update.${input.kind}`;
+		this.kind = input.kind;
+		this.retryAfterMs = input.retryAfterMs;
+		this.retryable = input.retryable;
+	}
+};
 async function resolveCliBinaryUpdatePlan(input) {
 	const fullDownloadPlan = resolveFullCliBinaryUpdatePlan(input.release);
 	const versionDeltas = input.release.deltas?.filter((candidate) => candidate.fromVersion === input.currentVersion);
@@ -445,62 +472,80 @@ async function resolveCliBinaryUpdatePlan(input) {
 	};
 }
 async function downloadCliBinaryUpdateArtifact(input) {
+	const recovery = createDownloadRecoveryContext(input.downloadPolicy);
+	if (input.plan.transport === "delta" && input.downloadPolicy.maxAttempts < 2) return downloadFullCliBinaryArtifact({
+		...input,
+		plan: resolveFullCliBinaryUpdatePlan(input.release),
+		recovery
+	});
 	if (input.plan.transport === "delta") {
 		try {
 			return await downloadCliBinaryDelta({
 				...input,
+				attemptCeiling: Math.max(1, input.downloadPolicy.maxAttempts - 1),
 				baseBytes: input.plan.baseBytes,
-				delta: input.plan.delta
+				delta: input.plan.delta,
+				recovery
 			});
 		} catch (error) {
-			input.onDeltaFallback(toError(error));
+			const resolvedError = toError(error);
+			if (resolvedError instanceof CliBinaryUpdateError && !resolvedError.allowFullFallback) throw resolvedError;
+			if (recovery.attemptsStarted >= input.downloadPolicy.maxAttempts) throw resolvedError;
+			input.onDeltaFallback(resolvedError);
+			await waitForRetryDelay({
+				cause: resolvedError,
+				deadlineAtMs: recovery.deadlineAtMs,
+				delayMs: resolvedError instanceof CliBinaryUpdateError ? resolvedError.retryAfterMs ?? 0 : 0
+			});
 		}
 		return downloadFullCliBinaryArtifact({
 			...input,
-			plan: resolveFullCliBinaryUpdatePlan(input.release)
+			plan: resolveFullCliBinaryUpdatePlan(input.release),
+			recovery
 		});
 	}
 	return downloadFullCliBinaryArtifact({
 		...input,
-		plan: input.plan
+		plan: input.plan,
+		recovery
 	});
 }
 async function verifyCliBinaryCodeSignature(input) {
 	const { codeIdentifier, teamIdentifier } = input.release;
 	if (!(codeIdentifier && teamIdentifier)) return;
-	if (process.platform !== "darwin") throw new Error("signed OpenMeld CLI verification requires macOS");
+	if (process.platform !== "darwin") throw integrityError("signed OpenMeld CLI verification requires macOS");
 	const verification = await input.runCommand("/usr/bin/codesign", [
 		"--verify",
 		"--strict",
 		"--verbose=2",
 		input.artifactPath
 	]);
-	if (verification.code !== 0) throw new Error(`binary code signature verification failed: ${commandFailureDetails(verification)}`);
+	if (verification.code !== 0) throw integrityError(`binary code signature verification failed: ${commandFailureDetails(verification)}`);
 	const inspection = await input.runCommand("/usr/bin/codesign", [
 		"--display",
 		"--verbose=4",
 		input.artifactPath
 	]);
-	if (inspection.code !== 0) throw new Error(`binary code signature inspection failed: ${commandFailureDetails(inspection)}`);
+	if (inspection.code !== 0) throw integrityError(`binary code signature inspection failed: ${commandFailureDetails(inspection)}`);
 	const details = `${inspection.stdout}\n${inspection.stderr}`;
 	for (const expected of [
 		`Identifier=${codeIdentifier}`,
 		`TeamIdentifier=${teamIdentifier}`,
 		"Authority=Developer ID Application:"
-	]) if (!details.includes(expected)) throw new Error(`binary code signature is missing expected identity: ${expected}`);
-	if (!HARDENED_RUNTIME_FLAG_RE.test(details)) throw new Error("binary code signature is missing the hardened runtime");
-	if (!SIGNING_TIMESTAMP_RE.test(details)) throw new Error("binary code signature is missing a trusted timestamp");
+	]) if (!details.includes(expected)) throw integrityError(`binary code signature is missing expected identity: ${expected}`);
+	if (!HARDENED_RUNTIME_FLAG_RE.test(details)) throw integrityError("binary code signature is missing the hardened runtime");
+	if (!SIGNING_TIMESTAMP_RE.test(details)) throw integrityError("binary code signature is missing a trusted timestamp");
 }
 async function downloadCliBinaryDelta(input) {
-	const response = await input.fetchImpl(input.delta.patchUrl, {
-		method: "GET",
-		signal: AbortSignal.timeout(input.downloadTimeoutMs)
+	const patchBytes = await downloadBinaryBytesWithRecovery({
+		attemptCeiling: input.attemptCeiling,
+		expectedSizeBytes: input.delta.patchSizeBytes,
+		fetchImpl: input.fetchImpl,
+		label: "binary delta archive",
+		onProgress: input.onProgress,
+		recovery: input.recovery,
+		url: input.delta.patchUrl
 	});
-	if (!response.ok) {
-		const body = await response.text().catch(() => "");
-		throw new Error(`binary delta download failed: HTTP ${response.status}${body ? `: ${body}` : ""}`);
-	}
-	const patchBytes = Buffer.from(await response.arrayBuffer());
 	verifyBinaryBytes({
 		bytes: patchBytes,
 		expectedSha256: input.delta.patchSha256,
@@ -511,16 +556,20 @@ async function downloadCliBinaryDelta(input) {
 	try {
 		patchPayloadBytes = gunzipSync(patchBytes, { maxOutputLength: input.delta.patchPayloadSizeBytes });
 	} catch (error) {
-		throw new Error(`binary delta could not be decompressed: ${toError(error).message}`);
+		throw integrityError(`binary delta could not be decompressed: ${toError(error).message}`, error);
+	}
+	if (patchPayloadBytes.byteLength !== input.delta.patchPayloadSizeBytes) throw integrityError(`binary delta payload size mismatch: expected ${input.delta.patchPayloadSizeBytes} bytes, received ${patchPayloadBytes.byteLength} bytes`);
+	try {
+		return reconstructCliBinaryDelta({
+			baseBytes: input.baseBytes,
+			delta: input.delta,
+			patchPayloadBytes,
+			targetSha256: input.release.sha256,
+			targetSizeBytes: input.release.sizeBytes
+		});
+	} catch (error) {
+		throw integrityError(`binary delta reconstruction failed: ${toError(error).message}`, error);
 	}
-	if (patchPayloadBytes.byteLength !== input.delta.patchPayloadSizeBytes) throw new Error(`binary delta payload size mismatch: expected ${input.delta.patchPayloadSizeBytes} bytes, received ${patchPayloadBytes.byteLength} bytes`);
-	return reconstructCliBinaryDelta({
-		baseBytes: input.baseBytes,
-		delta: input.delta,
-		patchPayloadBytes,
-		targetSha256: input.release.sha256,
-		targetSizeBytes: input.release.sizeBytes
-	});
 }
 function resolveFullCliBinaryUpdatePlan(release) {
 	if (hasCompressedCliBinaryTransport(release)) return {
@@ -537,15 +586,14 @@ function resolveFullCliBinaryUpdatePlan(release) {
 	};
 }
 async function downloadFullCliBinaryArtifact(input) {
-	const response = await input.fetchImpl(input.plan.downloadUrl, {
-		method: "GET",
-		signal: AbortSignal.timeout(input.downloadTimeoutMs)
+	const downloadBytes = await downloadBinaryBytesWithRecovery({
+		expectedSizeBytes: input.plan.downloadSizeBytes,
+		fetchImpl: input.fetchImpl,
+		label: input.plan.transport === "archive" ? "binary archive" : "binary download",
+		onProgress: input.onProgress,
+		recovery: input.recovery,
+		url: input.plan.downloadUrl
 	});
-	if (!response.ok) {
-		const body = await response.text().catch(() => "");
-		throw new Error(`binary download failed: HTTP ${response.status}${body ? `: ${body}` : ""}`);
-	}
-	const downloadBytes = Buffer.from(await response.arrayBuffer());
 	verifyBinaryBytes({
 		bytes: downloadBytes,
 		expectedSha256: input.plan.downloadSha256,
@@ -556,7 +604,7 @@ async function downloadFullCliBinaryArtifact(input) {
 	if (input.plan.transport === "archive") try {
 		artifactBytes = gunzipSync(downloadBytes, { maxOutputLength: input.release.sizeBytes });
 	} catch (error) {
-		throw new Error(`binary archive could not be decompressed: ${toError(error).message}`);
+		throw integrityError(`binary archive could not be decompressed: ${toError(error).message}`, error);
 	}
 	verifyBinaryBytes({
 		bytes: artifactBytes,
@@ -570,9 +618,222 @@ function hasCompressedCliBinaryTransport(release) {
 	return release.archiveFormat === "gzip" && typeof release.archiveUrl === "string" && typeof release.archiveSha256 === "string" && typeof release.archiveSizeBytes === "number";
 }
 function verifyBinaryBytes(input) {
-	if (input.bytes.byteLength !== input.expectedSizeBytes) throw new Error(`${input.label} size mismatch: expected ${input.expectedSizeBytes} bytes, received ${input.bytes.byteLength} bytes`);
+	if (input.bytes.byteLength !== input.expectedSizeBytes) throw integrityError(`${input.label} size mismatch: expected ${input.expectedSizeBytes} bytes, received ${input.bytes.byteLength} bytes`);
 	const actualSha256 = createHash("sha256").update(input.bytes).digest("hex");
-	if (actualSha256 !== input.expectedSha256.toLowerCase()) throw new Error(`${input.label} sha256 mismatch: expected ${input.expectedSha256.toLowerCase()}, received ${actualSha256}`);
+	if (actualSha256 !== input.expectedSha256.toLowerCase()) throw integrityError(`${input.label} sha256 mismatch: expected ${input.expectedSha256.toLowerCase()}, received ${actualSha256}`);
+}
+function createDownloadRecoveryContext(policy) {
+	if (!Number.isInteger(policy.maxAttempts) || policy.maxAttempts < 1 || !Number.isFinite(policy.stallTimeoutMs) || policy.stallTimeoutMs <= 0 || !Number.isFinite(policy.totalBudgetMs) || policy.totalBudgetMs <= 0 || policy.retryDelaysMs.some((delayMs) => !Number.isFinite(delayMs) || delayMs < 0)) throw new Error("CLI binary download policy is invalid.");
+	return {
+		attemptsStarted: 0,
+		deadlineAtMs: performance.now() + policy.totalBudgetMs,
+		policy
+	};
+}
+async function downloadBinaryBytesWithRecovery(input) {
+	let lastError = null;
+	const attemptCeiling = Math.min(input.attemptCeiling ?? input.recovery.policy.maxAttempts, input.recovery.policy.maxAttempts);
+	while (input.recovery.attemptsStarted < attemptCeiling) {
+		if (performance.now() >= input.recovery.deadlineAtMs) throw totalBudgetError(lastError ?? void 0);
+		const attemptIndex = input.recovery.attemptsStarted;
+		input.recovery.attemptsStarted += 1;
+		try {
+			return await downloadBinaryBytesAttempt(input);
+		} catch (error) {
+			const resolved = normalizeDownloadError(error, input.label);
+			lastError = resolved;
+			if (!resolved.retryable) throw resolved;
+			if (input.recovery.attemptsStarted >= attemptCeiling) throw resolved;
+			const delayMs = input.recovery.policy.retryDelaysMs[attemptIndex] ?? input.recovery.policy.retryDelaysMs.at(-1) ?? 0;
+			await waitForRetryDelay({
+				cause: resolved,
+				deadlineAtMs: input.recovery.deadlineAtMs,
+				delayMs: Math.max(delayMs, resolved.retryAfterMs ?? 0)
+			});
+		}
+	}
+	throw lastError ?? totalBudgetError();
+}
+async function downloadBinaryBytesAttempt(input) {
+	const controller = new AbortController();
+	let reader = null;
+	let lastProgressAtMs = performance.now();
+	try {
+		const response = await waitForDownloadProgress(input.fetchImpl(input.url, {
+			method: "GET",
+			signal: controller.signal
+		}), {
+			controller,
+			lastProgressAtMs,
+			recovery: input.recovery
+		});
+		if (!response.ok) {
+			cancelReadableStream(response.body);
+			throw httpDownloadError({
+				label: input.label,
+				retryAfter: response.headers.get("retry-after"),
+				status: response.status,
+				statusText: response.statusText
+			});
+		}
+		if (!response.body) return Buffer.alloc(0);
+		reader = response.body.getReader();
+		const chunks = [];
+		let receivedBytes = 0;
+		input.onProgress?.({
+			receivedBytes,
+			totalBytes: input.expectedSizeBytes,
+			transferAttempt: input.recovery.attemptsStarted
+		});
+		while (true) {
+			const next = await waitForDownloadProgress(reader.read(), {
+				controller,
+				lastProgressAtMs,
+				recovery: input.recovery
+			});
+			if (next.done) return Buffer.concat(chunks, receivedBytes);
+			if (!next.value || next.value.byteLength === 0) continue;
+			lastProgressAtMs = performance.now();
+			receivedBytes += next.value.byteLength;
+			if (receivedBytes > input.expectedSizeBytes) throw integrityError(`${input.label} size exceeded the declared ${input.expectedSizeBytes} bytes while downloading`);
+			input.onProgress?.({
+				receivedBytes,
+				totalBytes: input.expectedSizeBytes,
+				transferAttempt: input.recovery.attemptsStarted
+			});
+			chunks.push(Buffer.from(next.value));
+		}
+	} catch (error) {
+		controller.abort(error);
+		if (reader) cancelReadableStreamReader(reader);
+		throw error;
+	} finally {
+		reader?.releaseLock();
+	}
+}
+async function waitForDownloadProgress(pending, input) {
+	const stallDeadlineAtMs = input.lastProgressAtMs + input.recovery.policy.stallTimeoutMs;
+	const totalDeadlineWins = input.recovery.deadlineAtMs <= stallDeadlineAtMs;
+	const deadlineAtMs = Math.min(stallDeadlineAtMs, input.recovery.deadlineAtMs);
+	const timeoutMs = Math.max(0, deadlineAtMs - performance.now());
+	let timer = null;
+	const timeout = new Promise((_resolve, reject) => {
+		timer = setTimeout(() => {
+			const error = totalDeadlineWins ? totalBudgetError() : stalledError();
+			reject(error);
+			input.controller.abort(error);
+		}, timeoutMs);
+	});
+	try {
+		return await Promise.race([pending, timeout]);
+	} finally {
+		if (timer) clearTimeout(timer);
+	}
+}
+async function waitForRetryDelay(input) {
+	if (input.delayMs === 0) return;
+	if (input.deadlineAtMs - performance.now() <= input.delayMs) throw totalBudgetError(input.cause);
+	await new Promise((resolve) => setTimeout(resolve, input.delayMs));
+}
+function normalizeDownloadError(error, label) {
+	if (error instanceof CliBinaryUpdateError) return error;
+	const resolved = toError(error);
+	const terminalTlsFailure = findErrorCode(error, isTerminalTlsErrorCode);
+	if (terminalTlsFailure || isTerminalTlsErrorMessage(resolved.message)) return new CliBinaryUpdateError({
+		allowFullFallback: false,
+		cause: error,
+		kind: "download_failed",
+		message: `${label} download failed TLS certificate verification${terminalTlsFailure ? ` (${terminalTlsFailure})` : ""}`,
+		retryable: false
+	});
+	const retryable = Boolean(findErrorCode(error, isRetryableNetworkErrorCode));
+	return new CliBinaryUpdateError({
+		allowFullFallback: true,
+		cause: error,
+		kind: "download_failed",
+		message: `${label} download failed: ${resolved.message}`,
+		retryable
+	});
+}
+function httpDownloadError(input) {
+	const retryable = input.status === 408 || input.status === 429 || input.status === 500 || input.status === 502 || input.status === 503 || input.status === 504;
+	const missingDelta = input.status === 404 || input.status === 410;
+	const retryAfterMs = input.retryAfter ? parseRetryAfterMs(input.retryAfter) : void 0;
+	return new CliBinaryUpdateError({
+		allowFullFallback: retryable || missingDelta,
+		kind: "download_failed",
+		message: `${input.label} download failed: HTTP ${input.status}${input.statusText ? ` ${input.statusText}` : ""}`,
+		...retryAfterMs === void 0 ? {} : { retryAfterMs },
+		retryable
+	});
+}
+function parseRetryAfterMs(value) {
+	const trimmed = value.trim();
+	if (RETRY_AFTER_SECONDS_RE.test(trimmed)) {
+		const milliseconds = Number(trimmed) * 1e3;
+		return Number.isSafeInteger(milliseconds) ? milliseconds : void 0;
+	}
+	const retryAtMs = Date.parse(trimmed);
+	if (!Number.isFinite(retryAtMs)) return;
+	return Math.max(0, retryAtMs - Date.now());
+}
+function stalledError() {
+	return new CliBinaryUpdateError({
+		allowFullFallback: true,
+		kind: "download_stalled",
+		message: "binary download stopped making progress",
+		retryable: true
+	});
+}
+function totalBudgetError(cause) {
+	return new CliBinaryUpdateError({
+		allowFullFallback: false,
+		...cause === void 0 ? {} : { cause },
+		kind: "download_timed_out",
+		message: "binary download exceeded the total recovery time budget",
+		retryable: false
+	});
+}
+function integrityError(message, cause) {
+	return new CliBinaryUpdateError({
+		allowFullFallback: true,
+		...cause === void 0 ? {} : { cause },
+		kind: "integrity_check_failed",
+		message,
+		retryable: false
+	});
+}
+function findErrorCode(error, predicate) {
+	const seen = /* @__PURE__ */ new Set();
+	let current = error;
+	while (current && typeof current === "object" && !seen.has(current)) {
+		seen.add(current);
+		const code = current.code;
+		if (typeof code === "string" && predicate(code.toUpperCase())) return code;
+		current = current.cause;
+	}
+	return null;
+}
+function cancelReadableStream(stream) {
+	if (!stream) return;
+	try {
+		stream.cancel().catch(() => void 0);
+	} catch {}
+}
+function cancelReadableStreamReader(reader) {
+	try {
+		reader.cancel().catch(() => void 0);
+	} catch {}
+}
+function isTerminalTlsErrorCode(code) {
+	return code.startsWith("CERT_") || code.includes("_CERT_") || code.startsWith("ERR_OSSL_") || code.startsWith("ERR_SSL_") || code.startsWith("ERR_TLS_") || code === "DEPTH_ZERO_SELF_SIGNED_CERT" || code === "SELF_SIGNED_CERT_IN_CHAIN" || code.startsWith("UNABLE_TO_GET_ISSUER_CERT") || code === "UNABLE_TO_VERIFY_LEAF_SIGNATURE";
+}
+function isTerminalTlsErrorMessage(message) {
+	const normalized = message.toLowerCase();
+	return normalized.includes("certificate") || normalized.includes("self signed") || normalized.includes("tls handshake") || normalized.includes("unable to verify");
+}
+function isRetryableNetworkErrorCode(code) {
+	return code === "EAI_AGAIN" || code === "ECONNABORTED" || code === "ECONNREFUSED" || code === "ECONNRESET" || code === "EHOSTUNREACH" || code === "ENETDOWN" || code === "ENETUNREACH" || code === "ENOTFOUND" || code === "EPIPE" || code === "ETIMEDOUT" || code === "UND_ERR_BODY_TIMEOUT" || code === "UND_ERR_CONNECT_TIMEOUT" || code === "UND_ERR_HEADERS_TIMEOUT" || code === "UND_ERR_RES_CONTENT_LENGTH_MISMATCH" || code === "UND_ERR_SOCKET";
 }
 function commandFailureDetails(result) {
 	return result.stderr.trim() || result.stdout.trim() || `exit ${result.code}`;
@@ -701,8 +962,8 @@ function getErrorCode$2(error) {
 var package_default = {
 	$schema: "https://www.schemastore.org/package.json",
 	name: "openmeld",
-	version: "0.3.211",
-	openMeldReleaseDate: "2026-09-16",
+	version: "0.3.213",
+	openMeldReleaseDate: "2026-09-18",
 	description: "OpenMeld CLI - https://openmeld.ai",
 	license: "MIT",
 	type: "module",
@@ -1059,6 +1320,7 @@ function toErrorMessage(error) {
 }
 //#endregion
 //#region src/local-service/lifecycle/daemon-service-update-state.ts
+const UPDATE_TARGETS_FILE = "service-update-targets.json";
 const DAEMON_SERVICE_UPDATE_JOB_SCHEMA = OPENMELD_DAEMON_SERVICE_UPDATE_JOB_SCHEMA;
 function daemonServicePendingUpdatePath(pathInput = {}) {
 	return join(daemonRuntimeStateRootPath(pathInput), "service-update.json");
@@ -1097,14 +1359,23 @@ async function readDaemonServiceUpdateJob(path) {
 	if (raw === null) return null;
 	const parsed = storedDaemonServiceUpdateJobSchema.safeParse(JSON.parse(raw));
 	if (!parsed.success) throw new Error("OpenMeld Service update state is invalid.");
-	if (parsed.data.v === 2) return parsed.data;
-	const { status, ...legacyJob } = parsed.data;
+	let job;
+	if (parsed.data.v === 2) job = parsed.data;
+	else {
+		const { status, ...legacyJob } = parsed.data;
+		job = daemonServiceUpdateJobSchema.parse({
+			...legacyJob,
+			v: 2,
+			schema: DAEMON_SERVICE_UPDATE_JOB_SCHEMA,
+			phase: migrateLegacyPhase(status),
+			requestSource: "cli"
+		});
+	}
+	const targets = await readDaemonServiceUpdateTargets(dirname(path));
+	if (targets?.jobId !== job.jobId) return job;
 	return daemonServiceUpdateJobSchema.parse({
-		...legacyJob,
-		v: 2,
-		schema: DAEMON_SERVICE_UPDATE_JOB_SCHEMA,
-		phase: migrateLegacyPhase(status),
-		requestSource: "cli"
+		...job,
+		...targets
 	});
 }
 function migrateLegacyPhase(status) {
@@ -1117,14 +1388,50 @@ function migrateLegacyPhase(status) {
 	}
 }
 async function writeUpdateJobAtomically(input) {
+	const { targetCliVersion, targetServiceVersion, ...compatibleJob } = input.job;
+	await writeDaemonServiceUpdateTargets(dirname(input.path), {
+		jobId: input.job.jobId,
+		...targetCliVersion ? { targetCliVersion } : {},
+		...targetServiceVersion ? { targetServiceVersion } : {}
+	});
 	const temporaryPath = `${input.path}.${String(process.pid)}.tmp`;
 	await mkdir(dirname(input.path), { recursive: true });
-	await writeFile(temporaryPath, `${JSON.stringify(input.job, null, 2)}\n`, {
+	await writeFile(temporaryPath, `${JSON.stringify(compatibleJob, null, 2)}\n`, {
 		encoding: "utf8",
 		mode: 384
 	});
 	await rename(temporaryPath, input.path);
 }
+async function readDaemonServiceUpdateTargets(stateRoot) {
+	const raw = await readFile(join(stateRoot, UPDATE_TARGETS_FILE), "utf8").catch((error) => {
+		if (error.code === "ENOENT") return null;
+		throw error;
+	});
+	if (raw === null) return null;
+	const value = JSON.parse(raw);
+	const jobId = normalizeTarget(value.jobId);
+	const targetCliVersion = normalizeTarget(value.targetCliVersion);
+	const targetServiceVersion = normalizeTarget(value.targetServiceVersion);
+	if (!jobId) return null;
+	return {
+		jobId,
+		...targetCliVersion ? { targetCliVersion } : {},
+		...targetServiceVersion ? { targetServiceVersion } : {}
+	};
+}
+async function writeDaemonServiceUpdateTargets(stateRoot, targets) {
+	const path = join(stateRoot, UPDATE_TARGETS_FILE);
+	const temporaryPath = `${path}.${String(process.pid)}.tmp`;
+	await mkdir(stateRoot, { recursive: true });
+	await writeFile(temporaryPath, `${JSON.stringify(targets, null, 2)}\n`, {
+		encoding: "utf8",
+		mode: 384
+	});
+	await rename(temporaryPath, path);
+}
+function normalizeTarget(value) {
+	return typeof value === "string" && value.trim() ? value.trim() : null;
+}
 //#endregion
 //#region src/runtime/version.ts
 /**
@@ -1242,7 +1549,7 @@ async function withManagedInstallTransaction(run, pathInput = {}) {
 		});
 	} catch (error) {
 		if (!isOpenMeldLockError(error) || isOpenMeldOrphanedLockError(error) || Date.now() - startedAtMs >= MANAGED_INSTALL_LOCK_TIMEOUT_MS) throw error;
-		await setTimeout(MANAGED_INSTALL_LOCK_RETRY_DELAY_MS);
+		await setTimeout$1(MANAGED_INSTALL_LOCK_RETRY_DELAY_MS);
 	}
 }
 /**
@@ -1875,6 +2182,10 @@ async function prepareNodeDaemonServiceBundle(input) {
 	const sourceProvenance = await resolveDaemonBundleSourceProvenance(input.cliScriptPath);
 	if (!isDaemonBundleSourceAllowedForLane({ sourceKind: sourceProvenance.sourceKind })) throw new Error("OpenMeld Service cannot use repo-local workspace service files in this lane. Repo-local service files are only allowed through `openmeld-dev`.");
 	const { sourceEntryScriptPath, sourceDistRootPath, sourcePackageRootPath } = sourceProvenance;
+	if (sourceProvenance.sourceKind !== DAEMON_BUNDLE_SOURCE_KIND_WORKSPACE) {
+		const sourcePackageVersion = await readDaemonSourcePackageVersion(sourcePackageRootPath);
+		if (sourcePackageVersion !== input.daemonVersion) throw new Error(`Cannot prepare OpenMeld Service ${input.daemonVersion} from CLI source ${sourcePackageVersion} at ${sourcePackageRootPath}. Install openmeld@${input.daemonVersion} and rerun \`openmeld setup\`, or use a verified Service artifact for that version.`);
+	}
 	const sourceDistFingerprint = await computeDaemonSourceDistFingerprint(sourceDistRootPath);
 	const entryScriptRelativePath = basename(sourceEntryScriptPath);
 	const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -1983,7 +2294,7 @@ async function prepareSelectedBinaryDaemonServiceBundle(input) {
 		release: input.release
 	});
 	const bytes = await downloadCliBinaryUpdateArtifact({
-		downloadTimeoutMs: 6e4,
+		downloadPolicy: DEFAULT_CLI_BINARY_DOWNLOAD_POLICY,
 		fetchImpl: fetch,
 		onDeltaFallback,
 		plan,
@@ -2303,6 +2614,22 @@ async function resolveDaemonBundleSourceProvenance(explicitPath) {
 		sourceKind: inferDaemonBundleSourceKind(sourcePackageRootPath)
 	};
 }
+async function readDaemonSourcePackageVersion(sourcePackageRootPath) {
+	const packageManifestPath = join(sourcePackageRootPath, "package.json");
+	const packageManifestRaw = await readFile(packageManifestPath, "utf8").catch((error) => {
+		if (getErrorCode(error) === "ENOENT") throw new Error(`OpenMeld could not verify the CLI source version because ${packageManifestPath} is missing.`);
+		throw error;
+	});
+	let packageManifest;
+	try {
+		packageManifest = JSON.parse(packageManifestRaw);
+	} catch {
+		throw new Error(`OpenMeld could not verify the CLI source version because ${packageManifestPath} is not valid JSON.`);
+	}
+	const version = packageManifest.name === "openmeld" && typeof packageManifest.version === "string" ? packageManifest.version.trim() : "";
+	if (!version) throw new Error(`OpenMeld could not verify the CLI source version from ${packageManifestPath}.`);
+	return version;
+}
 async function resolveCliScriptPath(explicitPath) {
 	const rawPath = explicitPath ?? process$1.argv[1];
 	if (!rawPath) throw new Error("Cannot determine CLI script path for OpenMeld background service bundle.");
@@ -3637,6 +3964,6 @@ async function readObservedRuntimeState() {
 	});
 }
 //#endregion
-export { readManagedCliInstallation as $, prepareDaemonServiceBundle as A, verifyCliBinaryCodeSignature as At, resolveDaemonServiceArtifact as B, readDaemonServiceContract as Bt, daemonServiceExecutableWrapperPath as C, resolveDaemonServiceUpdateWorkerLaunchdPlistPath as Ct, ensureDaemonServiceStableBinaryExecutable as D, resolveDaemonServiceUpdateWorkerWindowsScriptPath as Dt, discardPreparedDaemonServiceBundle as E, resolveDaemonServiceUpdateWorkerSystemdUnitPath as Et, restoreDaemonActiveBundleStateSnapshot as F, requestLocalSyncRouteCatalog as Ft, readRecentDaemonLifecycleEvents as G, formatDaemonLifecycleOriginSummary as H, runAuditedServiceManagerCarrierMutation as I, sendLocalDaemonControlPlaneRequest as It, runWithDaemonLifecycleCommandJournal as J, resolveRecentDaemonSignalStopCause as K, verifyDaemonActiveBundleIntegrity as L, clearDaemonServiceContract as Lt, resolveAlignedDaemonActiveBundleEntryPath as M, requestLocalAgentActivitySync as Mt, resolveDaemonBundleEntryPathFromState as N, requestLocalDaemonServiceUpdateReadiness as Nt, ensureDaemonServiceUpdateWorkerBinaryExecutable as O, downloadCliBinaryUpdateArtifact as Ot, resolveInstalledDaemonBundleFingerprint as P, requestLocalDaemonShutdown as Pt, pruneManagedInstallVersions as Q, writeDaemonServiceExecutableWrapper as R, isDaemonServiceContractIdentityReusable as Rt, daemonServiceBinaryExecutablePath as S, resolveDaemonServiceUpdateWorkerIdentity as St, daemonServiceUpdateWorkerBinaryPath as T, resolveDaemonServiceUpdateWorkerSystemdTimerUnitPath as Tt, readLatestDaemonLifecycleConnectionStateEvent as U, emitDaemonLifecycleEvent as V, upsertDaemonServiceContract as Vt, readLatestDaemonLifecycleOriginEvent as W, buildInstallSelfJsonPayload as X, collectLocalOperationFailure as Y, performManagedInstall as Z, matchesExpectedDaemonServiceManagerDefinition as _, package_default as _t, resolveDaemonRuntimeState as a, persistPendingDaemonServiceUpdate as at, cleanupInactiveDaemonServiceBundles as b, daemonServiceUpdateWorkerNpmEntryPath as bt, resolveObservedDaemonRuntimeStatus as c, buildNextVersionState as ct, inspectLegacySharedDaemonService as d, fetchLatestCliBinaryRelease as dt, resolveCliSelfVersion as et, listDaemonOwnedProcesses as f, fetchLatestPackageInfo as ft, assertDaemonMaintenanceInstallationOwnership as g, resolveBundledServiceRelease as gt, resolveDaemonBundleIdFromEntryPath as h, writeVersionState as ht, readCurrentObservedDaemonRuntimeStatus as i, completePendingDaemonServiceUpdate as it, readDaemonActiveBundleState as j, LocalDaemonControlPlaneClientError as jt, isDaemonBundleSourceAllowedForLane as k, resolveCliBinaryUpdatePlan as kt, resolveObservedRuntimeCommandEntryPath as l, compareSemver as lt, normalizeDaemonCommandPath as m, readVersionState as mt, getEffectiveDaemonRuntimeStatus as n, OPENMELD_VERSION as nt, resolveDaemonServiceManagerForRuntimeState as o, readLastDaemonServiceUpdate as ot, extractDaemonCommandEntryPath as p, isPlainReleaseVersion as pt, runDaemonServiceManagerAction as q, readCurrentDaemonRuntimeContext as r, DAEMON_SERVICE_UPDATE_JOB_SCHEMA as rt, waitForDaemonSystemServiceToStop as s, readPendingDaemonServiceUpdate as st, clearDaemonRuntimeStateIfDefinitelyStopped as t, withManagedInstallTransaction as tt, cleanupLegacySharedDaemonServiceState as u, ensureVersionStateReady as ut, isOpenMeldManagedBinaryPath as v, INDEPENDENT_MAINTENANCE_REGISTRATION as vt, daemonServiceLauncherPath as w, resolveDaemonServiceUpdateWorkerSystemdPathUnitPath as wt, clearDaemonServiceUpdateWorkerBinaryExecutable as x, hasIndependentMaintenanceRegistration as xt, activateDaemonServiceBundle as y, configureDaemonMaintenanceEnvironment as yt, writeDaemonServiceLauncher as z, isUnsafeProductionDeviceId as zt };
+export { readManagedCliInstallation as $, prepareDaemonServiceBundle as A, resolveCliBinaryUpdatePlan as At, resolveDaemonServiceArtifact as B, isUnsafeProductionDeviceId as Bt, daemonServiceExecutableWrapperPath as C, resolveDaemonServiceUpdateWorkerLaunchdPlistPath as Ct, ensureDaemonServiceStableBinaryExecutable as D, resolveDaemonServiceUpdateWorkerWindowsScriptPath as Dt, discardPreparedDaemonServiceBundle as E, resolveDaemonServiceUpdateWorkerSystemdUnitPath as Et, restoreDaemonActiveBundleStateSnapshot as F, requestLocalDaemonShutdown as Ft, readRecentDaemonLifecycleEvents as G, formatDaemonLifecycleOriginSummary as H, upsertDaemonServiceContract as Ht, runAuditedServiceManagerCarrierMutation as I, requestLocalSyncRouteCatalog as It, runWithDaemonLifecycleCommandJournal as J, resolveRecentDaemonSignalStopCause as K, verifyDaemonActiveBundleIntegrity as L, sendLocalDaemonControlPlaneRequest as Lt, resolveAlignedDaemonActiveBundleEntryPath as M, LocalDaemonControlPlaneClientError as Mt, resolveDaemonBundleEntryPathFromState as N, requestLocalAgentActivitySync as Nt, ensureDaemonServiceUpdateWorkerBinaryExecutable as O, DEFAULT_CLI_BINARY_DOWNLOAD_POLICY as Ot, resolveInstalledDaemonBundleFingerprint as P, requestLocalDaemonServiceUpdateReadiness as Pt, pruneManagedInstallVersions as Q, writeDaemonServiceExecutableWrapper as R, clearDaemonServiceContract as Rt, daemonServiceBinaryExecutablePath as S, resolveDaemonServiceUpdateWorkerIdentity as St, daemonServiceUpdateWorkerBinaryPath as T, resolveDaemonServiceUpdateWorkerSystemdTimerUnitPath as Tt, readLatestDaemonLifecycleConnectionStateEvent as U, emitDaemonLifecycleEvent as V, readDaemonServiceContract as Vt, readLatestDaemonLifecycleOriginEvent as W, buildInstallSelfJsonPayload as X, collectLocalOperationFailure as Y, performManagedInstall as Z, matchesExpectedDaemonServiceManagerDefinition as _, package_default as _t, resolveDaemonRuntimeState as a, persistPendingDaemonServiceUpdate as at, cleanupInactiveDaemonServiceBundles as b, daemonServiceUpdateWorkerNpmEntryPath as bt, resolveObservedDaemonRuntimeStatus as c, buildNextVersionState as ct, inspectLegacySharedDaemonService as d, fetchLatestCliBinaryRelease as dt, resolveCliSelfVersion as et, listDaemonOwnedProcesses as f, fetchLatestPackageInfo as ft, assertDaemonMaintenanceInstallationOwnership as g, resolveBundledServiceRelease as gt, resolveDaemonBundleIdFromEntryPath as h, writeVersionState as ht, readCurrentObservedDaemonRuntimeStatus as i, completePendingDaemonServiceUpdate as it, readDaemonActiveBundleState as j, verifyCliBinaryCodeSignature as jt, isDaemonBundleSourceAllowedForLane as k, downloadCliBinaryUpdateArtifact as kt, resolveObservedRuntimeCommandEntryPath as l, compareSemver as lt, normalizeDaemonCommandPath as m, readVersionState as mt, getEffectiveDaemonRuntimeStatus as n, OPENMELD_VERSION as nt, resolveDaemonServiceManagerForRuntimeState as o, readLastDaemonServiceUpdate as ot, extractDaemonCommandEntryPath as p, isPlainReleaseVersion as pt, runDaemonServiceManagerAction as q, readCurrentDaemonRuntimeContext as r, DAEMON_SERVICE_UPDATE_JOB_SCHEMA as rt, waitForDaemonSystemServiceToStop as s, readPendingDaemonServiceUpdate as st, clearDaemonRuntimeStateIfDefinitelyStopped as t, withManagedInstallTransaction as tt, cleanupLegacySharedDaemonServiceState as u, ensureVersionStateReady as ut, isOpenMeldManagedBinaryPath as v, INDEPENDENT_MAINTENANCE_REGISTRATION as vt, daemonServiceLauncherPath as w, resolveDaemonServiceUpdateWorkerSystemdPathUnitPath as wt, clearDaemonServiceUpdateWorkerBinaryExecutable as x, hasIndependentMaintenanceRegistration as xt, activateDaemonServiceBundle as y, configureDaemonMaintenanceEnvironment as yt, writeDaemonServiceLauncher as z, isDaemonServiceContractIdentityReusable as zt };
 
-//# sourceMappingURL=daemon-service-runtime-D8KrOfSV.js.map
+//# sourceMappingURL=daemon-service-runtime-CY6wdBe1.js.map