rigscope 0.0.0-stage → 0.1.0

package/dist/system.cjs

@@ -0,0 +1,4333 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/cli/system.ts
+var system_exports = {};
+__export(system_exports, {
+  COMPONENTS: () => COMPONENTS,
+  DEFAULT_NODE_PATH: () => DEFAULT_NODE_PATH,
+  DEFAULT_SYSTEM_ACCOUNTS: () => DEFAULT_SYSTEM_ACCOUNTS,
+  POWER_STATE_FILE_NAME: () => POWER_STATE_FILE_NAME,
+  POWER_SYSUSERS_NAME: () => POWER_SYSUSERS_NAME,
+  RAPL_RULE_NAME: () => RAPL_RULE_NAME,
+  STATE_FILE_NAME: () => STATE_FILE_NAME,
+  SYSTEM_SCOPE: () => SYSTEM_SCOPE,
+  SYSTEM_STATE_FORMAT_VERSION: () => SYSTEM_STATE_FORMAT_VERSION,
+  SYSUSERS_NAME: () => SYSUSERS_NAME,
+  SystemError: () => SystemError,
+  UNIT_NAMES: () => UNIT_NAMES,
+  assertDirectoryStopped: () => assertDirectoryStopped,
+  assertManagedFileOwnership: () => assertManagedFileOwnership,
+  collectorEnvPath: () => collectorEnvPath,
+  collectorStatePath: () => collectorStatePath,
+  componentEnabled: () => componentEnabled,
+  componentSet: () => componentSet,
+  componentsForRole: () => componentsForRole,
+  connectDestinationUrl: () => connectDestinationUrl,
+  connectSystem: () => connectSystem,
+  createSystemHost: () => createSystemHost,
+  defaultSystemPaths: () => defaultSystemPaths,
+  detectPowerDriver: () => detectPowerDriver,
+  detectUserInstallations: () => detectUserInstallations,
+  disableSystem: () => disableSystem,
+  enableSystem: () => enableSystem,
+  enabledComponents: () => enabledComponents,
+  formatSystemReport: () => formatSystemReport,
+  grantPower: () => grantPower,
+  hubDatabasePath: () => hubDatabasePath,
+  hubEnrollmentPath: () => hubEnrollmentPath,
+  hubEnvPath: () => hubEnvPath,
+  hubSocketPath: () => hubSocketPath,
+  inspectPowerAccess: () => inspectPowerAccess,
+  installSystem: () => installSystem,
+  powerStatus: () => powerStatus,
+  powerSysusersPath: () => powerSysusersPath,
+  raplRulePath: () => raplRulePath,
+  readSystemState: () => readSystemState,
+  renderPowerSysusers: () => renderPowerSysusers,
+  renderRaplRule: () => renderRaplRule,
+  renderSystemCollectorUnit: () => renderSystemCollectorUnit,
+  renderSystemHubUnit: () => renderSystemHubUnit,
+  renderSysusers: () => renderSysusers,
+  restartSystem: () => restartSystem,
+  revokePower: () => revokePower,
+  rolesFor: () => rolesFor,
+  rollbackSystem: () => rollbackSystem,
+  runSystemCommand: () => runSystemCommand,
+  startSystem: () => startSystem,
+  stateFilePath: () => stateFilePath,
+  stopSystem: () => stopSystem,
+  systemStatus: () => systemStatus,
+  systemdQuote: () => systemdQuote,
+  sysusersPath: () => sysusersPath,
+  uninstallSystem: () => uninstallSystem,
+  unitFor: () => unitFor,
+  unitNamesFor: () => unitNamesFor,
+  unitNamesForComponents: () => unitNamesForComponents,
+  upgradeSystem: () => upgradeSystem,
+  validateAccounts: () => validateAccounts,
+  validateSystemPaths: () => validateSystemPaths,
+  verifySystemHealth: () => verifySystemHealth
+});
+module.exports = __toCommonJS(system_exports);
+var import_node_fs3 = require("node:fs");
+var import_node_child_process = require("node:child_process");
+var import_node_crypto5 = require("node:crypto");
+var import_node_path3 = require("node:path");
+var import_node_sqlite = require("node:sqlite");
+var import_node_util = require("node:util");
+
+// src/cli/health.ts
+var import_node_http = require("node:http");
+var MAX_HEALTH_BODY_BYTES = 64 * 1024;
+function probeHealth(target, timeoutMs = 3e3) {
+  return new Promise((resolve3) => {
+    let settled = false;
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      resolve3(result);
+    };
+    const options = target.kind === "unix" ? { socketPath: target.socketPath, path: target.path, method: "GET", headers: { Host: target.hostHeader } } : { host: target.host, port: target.port, path: target.path, method: "GET" };
+    let req;
+    try {
+      req = (0, import_node_http.request)(options, (res) => {
+        const chunks = [];
+        let bytes = 0;
+        res.on("data", (chunk) => {
+          bytes += chunk.length;
+          if (bytes > MAX_HEALTH_BODY_BYTES) {
+            req.destroy();
+            finish({ ok: false, statusCode: res.statusCode ?? null, body: null, error: "health response is oversized" });
+            return;
+          }
+          chunks.push(chunk);
+        });
+        res.on("end", () => {
+          const statusCode = res.statusCode ?? null;
+          const text = Buffer.concat(chunks).toString("utf8");
+          let body = null;
+          try {
+            const value = JSON.parse(text);
+            if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+              body = value;
+            }
+          } catch {
+          }
+          const ok = statusCode === 200 && body?.status === "ok";
+          finish({
+            ok,
+            statusCode,
+            body,
+            error: ok ? null : statusCode === 200 ? "health response is not ok" : `health returned HTTP ${statusCode ?? "unknown"}`
+          });
+        });
+      });
+    } catch (error) {
+      finish({ ok: false, statusCode: null, body: null, error: errorText(error) });
+      return;
+    }
+    const deadline = setTimeout(() => {
+      req.destroy();
+      finish({ ok: false, statusCode: null, body: null, error: `health probe timed out after ${timeoutMs}ms` });
+    }, timeoutMs);
+    req.once("close", () => {
+      clearTimeout(deadline);
+      finish({ ok: false, statusCode: null, body: null, error: "health connection closed before a complete response" });
+    });
+    req.on("error", (error) => {
+      finish({ ok: false, statusCode: null, body: null, error: errorText(error) });
+    });
+    req.end();
+  });
+}
+async function waitForHealth(target, options = {}) {
+  const deadlineMs = bounded(options.deadlineMs ?? 2e4, 100, 12e4);
+  const intervalMs = bounded(options.intervalMs ?? 250, 25, 5e3);
+  const probeTimeoutMs = bounded(options.probeTimeoutMs ?? 3e3, 100, 3e4);
+  const started = Date.now();
+  let attempts = 0;
+  let last = { ok: false, statusCode: null, body: null, error: "health was not probed" };
+  while (Date.now() - started < deadlineMs) {
+    attempts += 1;
+    const remaining = Math.max(100, deadlineMs - (Date.now() - started));
+    last = await probeHealth(target, Math.min(probeTimeoutMs, remaining));
+    const reported = typeof last.body?.version === "string" ? last.body.version : null;
+    const versionMatches = options.expectedVersion === void 0 || reported === options.expectedVersion;
+    if (last.ok && versionMatches) {
+      return { ok: true, attempts, elapsedMs: Date.now() - started, last, version: reported };
+    }
+    if (last.ok && !versionMatches) {
+      last = { ...last, ok: false, error: `running version ${reported} does not match expected ${options.expectedVersion}` };
+    }
+    const wait = Math.min(intervalMs, Math.max(0, deadlineMs - (Date.now() - started)));
+    if (wait > 0) await delay(wait);
+  }
+  return { ok: false, attempts, elapsedMs: Date.now() - started, last, version: null };
+}
+function bounded(value, min, max) {
+  return Math.min(max, Math.max(min, Number.isFinite(value) ? value : min));
+}
+function delay(ms) {
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
+}
+function errorText(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+// src/runtime/process-lease.ts
+var import_node_fs = require("node:fs");
+var import_node_path = require("node:path");
+var import_node_crypto = require("node:crypto");
+var MAX_LOCK_BYTES = 1024;
+var MAX_ACQUIRE_ATTEMPTS = 8;
+var ProcessLeaseError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "ProcessLeaseError";
+    this.code = code;
+  }
+};
+function acquireProcessLease(path) {
+  const absolute = (0, import_node_path.resolve)(path);
+  (0, import_node_fs.mkdirSync)((0, import_node_path.dirname)(absolute), { recursive: true, mode: 448 });
+  const parent = (0, import_node_fs.lstatSync)((0, import_node_path.dirname)(absolute));
+  if (!parent.isDirectory() || (parent.mode & 63) !== 0) {
+    throw new ProcessLeaseError("unsafe", "runtime state directory must be private");
+  }
+  for (let attempt = 0; attempt < MAX_ACQUIRE_ATTEMPTS; attempt++) {
+    let fd;
+    try {
+      fd = (0, import_node_fs.openSync)(absolute, "wx", 384);
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      const snapshot = inspectLock(absolute);
+      if (snapshot === null) {
+        continue;
+      }
+      if (snapshot.alive) {
+        throw new ProcessLeaseError(
+          "busy",
+          "another process owns this runtime state; stop it before starting another"
+        );
+      }
+      try {
+        const current = (0, import_node_fs.lstatSync)(absolute);
+        if (current.ino !== snapshot.stats.ino || current.dev !== snapshot.stats.dev) {
+          continue;
+        }
+        (0, import_node_fs.unlinkSync)(absolute);
+      } catch (error2) {
+        if (error2.code === "ENOENT") continue;
+        throw new ProcessLeaseError(
+          "unavailable",
+          "runtime lock could not be recovered; inspect it before recovery"
+        );
+      }
+      continue;
+    }
+    const inode = (0, import_node_fs.fstatSync)(fd);
+    try {
+      (0, import_node_fs.writeFileSync)(fd, JSON.stringify({ pid: process.pid, instance: (0, import_node_crypto.randomUUID)() }));
+      (0, import_node_fs.fsyncSync)(fd);
+    } catch (error) {
+      (0, import_node_fs.closeSync)(fd);
+      removeIfSameInode(absolute, inode);
+      throw error;
+    }
+    (0, import_node_fs.closeSync)(fd);
+    return createRelease(absolute, inode);
+  }
+  throw new ProcessLeaseError(
+    "recovering",
+    "runtime lease could not be acquired after repeated stale-lock recovery"
+  );
+}
+function inspectLock(path) {
+  let stats;
+  try {
+    stats = (0, import_node_fs.lstatSync)(path);
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw new ProcessLeaseError(
+      "unavailable",
+      "runtime lock could not be inspected; inspect it before recovery"
+    );
+  }
+  if (!stats.isFile() || stats.size > MAX_LOCK_BYTES || (stats.mode & 63) !== 0) {
+    throw new ProcessLeaseError("unsafe", "runtime lock is unsafe; inspect it before recovery");
+  }
+  let raw;
+  try {
+    raw = (0, import_node_fs.readFileSync)(path, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw new ProcessLeaseError(
+      "unavailable",
+      "runtime lock could not be read; inspect it before recovery"
+    );
+  }
+  let owner;
+  try {
+    owner = JSON.parse(raw);
+  } catch {
+    throw new ProcessLeaseError(
+      "incomplete",
+      "runtime lock is incomplete; inspect it before recovery"
+    );
+  }
+  if (owner === null || typeof owner !== "object" || Array.isArray(owner)) {
+    throw new ProcessLeaseError("invalid", "runtime lock has an invalid owner");
+  }
+  const pid = owner.pid;
+  if (!Number.isSafeInteger(pid) || pid < 1) {
+    throw new ProcessLeaseError("invalid", "runtime lock has an invalid owner");
+  }
+  try {
+    process.kill(pid, 0);
+    return { stats, alive: true };
+  } catch (error) {
+    const code = error.code;
+    if (code === "ESRCH") return { stats, alive: false };
+    if (code === "EPERM" || code === "EACCES") return { stats, alive: true };
+    throw new ProcessLeaseError(
+      "unavailable",
+      "runtime lock owner could not be verified; inspect it before recovery"
+    );
+  }
+}
+function createRelease(path, inode) {
+  let released = false;
+  const cleanup = () => {
+    removeIfSameInode(path, inode);
+  };
+  const onExit = () => {
+    if (released) return;
+    released = true;
+    cleanup();
+  };
+  process.once("exit", onExit);
+  return () => {
+    if (released) return;
+    released = true;
+    process.removeListener("exit", onExit);
+    cleanup();
+  };
+}
+function removeIfSameInode(path, inode) {
+  try {
+    const stat = (0, import_node_fs.lstatSync)(path);
+    if (stat.ino === inode.ino && stat.dev === inode.dev) (0, import_node_fs.unlinkSync)(path);
+  } catch {
+  }
+}
+
+// src/hub/auth/password.ts
+var import_node_crypto2 = require("node:crypto");
+var SCRYPT_N = 16384;
+var SCRYPT_R = 8;
+var SCRYPT_P = 1;
+var SALT_BYTES = 16;
+var KEY_BYTES = 64;
+var MAX_PASSWORD_CHARS = 1024;
+var HASH_PREFIX = `scrypt$${SCRYPT_N}$${SCRYPT_R}$${SCRYPT_P}$`;
+var HASH_PATTERN = new RegExp(
+  `^scrypt\\$${SCRYPT_N}\\$${SCRYPT_R}\\$${SCRYPT_P}\\$[0-9a-f]{${SALT_BYTES * 2}}\\$[0-9a-f]{${KEY_BYTES * 2}}$`
+);
+function hashPassword(password) {
+  if (typeof password !== "string" || password.length === 0 || password.length > MAX_PASSWORD_CHARS) {
+    throw new Error(`password must be a string of 1..${MAX_PASSWORD_CHARS} characters`);
+  }
+  const salt = (0, import_node_crypto2.randomBytes)(SALT_BYTES);
+  const key = (0, import_node_crypto2.scryptSync)(password.normalize("NFKC"), salt, KEY_BYTES, {
+    N: SCRYPT_N,
+    r: SCRYPT_R,
+    p: SCRYPT_P
+  });
+  return `${HASH_PREFIX}${salt.toString("hex")}$${key.toString("hex")}`;
+}
+
+// collector/destinations/policy.ts
+var SHARING_KEYS = [
+  "cpu",
+  "memory",
+  "swap",
+  "gpus",
+  "disks",
+  "network",
+  "networkAddresses",
+  "processes",
+  "processArguments"
+];
+
+// collector/config.ts
+var ConfigError = class extends Error {
+  issues;
+  constructor(issues) {
+    super(`invalid collector configuration:
+- ${issues.join("\n- ")}`);
+    this.name = "ConfigError";
+    this.issues = [...issues];
+  }
+};
+var DEFAULT_COLLECTOR_ID = "mock-collector";
+var MOCK_HOSTNAME = "mock-machine";
+var CONNECT_PATH = "/api/collector/connect";
+var PREVIOUS_CONNECT_PATH = "/api/collector/v1/connect";
+var MAX_DESTINATIONS = 8;
+var DEFAULT_INTERVAL_MS = 1e3;
+var MIN_INTERVAL_MS = 100;
+var MAX_INTERVAL_MS = 36e5;
+var MAX_ID_LENGTH = 128;
+var MAX_HOSTNAME_LENGTH = 253;
+var MAX_TOKEN_LENGTH = 256;
+var PRINTABLE_ASCII = /^[\x21-\x7e]+$/;
+var IPV4 = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/;
+var DIGITS = /^\d+$/;
+function requirePrintable(value, label, issues, maxLength) {
+  if (typeof value !== "string" || !PRINTABLE_ASCII.test(value)) {
+    issues.push(
+      `${label} must be a non-empty printable-ASCII string without spaces/control characters`
+    );
+    return;
+  }
+  if (value.length > maxLength) {
+    issues.push(`${label} must be at most ${maxLength} characters`);
+  }
+}
+function isLoopbackHostname(hostname) {
+  let lower = hostname.toLowerCase();
+  if (lower.startsWith("[") && lower.endsWith("]")) {
+    lower = lower.slice(1, -1);
+  }
+  if (lower === "::1") {
+    return true;
+  }
+  const match = IPV4.exec(lower);
+  if (match === null) {
+    return false;
+  }
+  if (Number(match[1]) !== 127) {
+    return false;
+  }
+  return [match[2], match[3], match[4]].every((part) => Number(part) <= 255);
+}
+function validateHubUrl(raw, label, issues) {
+  if (typeof raw !== "string" || raw.trim() === "") {
+    issues.push(`${label}: url must be a non-empty string`);
+    return null;
+  }
+  if (raw.length > 2048) {
+    issues.push(`${label}: url must be at most 2048 characters`);
+    return null;
+  }
+  let parsed;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    issues.push(`${label}: not a valid URL`);
+    return null;
+  }
+  if (parsed.protocol !== "ws:" && parsed.protocol !== "wss:") {
+    issues.push(`${label}: scheme must be ws:// or wss://`);
+    return null;
+  }
+  if (parsed.username !== "" || parsed.password !== "") {
+    issues.push(
+      `${label}: URL must not embed credentials (userinfo); send the token in the Authorization header`
+    );
+    return null;
+  }
+  if (parsed.search !== "") {
+    issues.push(`${label}: URL must not include a query string`);
+    return null;
+  }
+  if (parsed.hash !== "") {
+    issues.push(`${label}: URL must not include a fragment`);
+    return null;
+  }
+  if (parsed.hostname === "") {
+    issues.push(`${label}: URL must include a host`);
+    return null;
+  }
+  if (parsed.pathname === PREVIOUS_CONNECT_PATH) parsed.pathname = CONNECT_PATH;
+  if (parsed.pathname !== CONNECT_PATH) {
+    issues.push(`${label}: path must be exactly ${CONNECT_PATH}`);
+    return null;
+  }
+  if (parsed.protocol === "ws:" && !isLoopbackHostname(parsed.hostname)) {
+    issues.push(
+      `${label}: plaintext ws:// is restricted to literal loopback addresses; use wss:// otherwise`
+    );
+    return null;
+  }
+  return parsed;
+}
+var SHARING_KEY_SET = new Set(SHARING_KEYS);
+function parseSharing(raw, label, issues) {
+  if (raw === void 0) return void 0;
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+    issues.push(`${label}.sharing must be an object`);
+    return void 0;
+  }
+  const record = raw;
+  let valid = true;
+  for (const key of Object.keys(record)) {
+    if (!SHARING_KEY_SET.has(key)) {
+      issues.push(`${label}.sharing has unknown field "${key}"`);
+      valid = false;
+      continue;
+    }
+    if (typeof record[key] !== "boolean") {
+      issues.push(`${label}.sharing.${key} must be a boolean`);
+      valid = false;
+    }
+  }
+  if (typeof record["cpu"] !== "boolean" || typeof record["memory"] !== "boolean") {
+    issues.push(`${label}.sharing must contain boolean cpu and memory fields`);
+    valid = false;
+  }
+  if (!valid) return void 0;
+  const out = {};
+  for (const key of SHARING_KEYS) {
+    const value = record[key];
+    if (typeof value === "boolean") out[key] = value;
+  }
+  return out;
+}
+function parseDestinations(env, issues, destinations) {
+  const raw = env["COLLECTOR_HUBS"]?.trim();
+  if (raw === void 0 || raw === "") {
+    issues.push(
+      "COLLECTOR_HUBS is required: JSON array of {url, token} objects (1..8 destinations)"
+    );
+    return;
+  }
+  let value;
+  try {
+    value = JSON.parse(raw);
+  } catch {
+    issues.push("COLLECTOR_HUBS is not valid JSON");
+    return;
+  }
+  if (!Array.isArray(value)) {
+    issues.push("COLLECTOR_HUBS must be a JSON array");
+    return;
+  }
+  if (value.length === 0) {
+    issues.push("COLLECTOR_HUBS must contain at least one destination");
+    return;
+  }
+  if (value.length > MAX_DESTINATIONS) {
+    issues.push(
+      `COLLECTOR_HUBS allows at most ${MAX_DESTINATIONS} destinations (got ${value.length})`
+    );
+  }
+  const seenUrls = /* @__PURE__ */ new Set();
+  const limit = Math.min(value.length, MAX_DESTINATIONS);
+  for (let index = 0; index < limit; index += 1) {
+    const label = `COLLECTOR_HUBS[${index}]`;
+    const entry = value[index];
+    if (entry === null || typeof entry !== "object" || Array.isArray(entry)) {
+      issues.push(`${label} must be an object`);
+      continue;
+    }
+    const keys = Object.keys(entry).sort();
+    if (!keys.includes("url") || !keys.includes("token") || keys.some((k) => !["url", "token", "sharing", "intervalMs"].includes(k))) {
+      issues.push(`${label} must have exactly the fields {url, token}, plus optional sharing and intervalMs`);
+      continue;
+    }
+    const candidate = entry;
+    const sharing = parseSharing(candidate.sharing, label, issues);
+    if (candidate.intervalMs !== void 0 && (!Number.isSafeInteger(candidate.intervalMs) || Number(candidate.intervalMs) < MIN_INTERVAL_MS || Number(candidate.intervalMs) > MAX_INTERVAL_MS)) {
+      issues.push(`${label}.intervalMs is outside cadence bounds`);
+    }
+    const token = candidate.token;
+    if (typeof token !== "string" || token === "") {
+      issues.push(`${label}.token must be a non-empty string`);
+    } else {
+      requirePrintable(token, `${label}.token`, issues, MAX_TOKEN_LENGTH);
+    }
+    const url = validateHubUrl(candidate.url, `${label}.url`, issues);
+    if (url === null) {
+      continue;
+    }
+    if (seenUrls.has(url.href)) {
+      issues.push(`${label}: duplicate destination URL`);
+      continue;
+    }
+    seenUrls.add(url.href);
+    if (typeof token === "string" && token !== "") {
+      destinations.push({
+        url: url.href,
+        token,
+        ...sharing === void 0 ? {} : { sharing },
+        ...candidate.intervalMs === void 0 ? {} : { intervalMs: Number(candidate.intervalMs) }
+      });
+    }
+  }
+}
+function parseIntervalMs(env, issues) {
+  const raw = env["COLLECTOR_INTERVAL_MS"]?.trim();
+  if (raw === void 0 || raw === "") {
+    return DEFAULT_INTERVAL_MS;
+  }
+  const parsed = DIGITS.test(raw) ? Number(raw) : Number.NaN;
+  if (!Number.isSafeInteger(parsed) || parsed < MIN_INTERVAL_MS || parsed > MAX_INTERVAL_MS) {
+    issues.push(
+      `COLLECTOR_INTERVAL_MS must be an integer between ${MIN_INTERVAL_MS} and ${MAX_INTERVAL_MS}`
+    );
+    return DEFAULT_INTERVAL_MS;
+  }
+  return parsed;
+}
+function parseCollectorConfig(env) {
+  const issues = [];
+  const rawCollectorId = env["COLLECTOR_ID"]?.trim() ?? "";
+  let collectorId = DEFAULT_COLLECTOR_ID;
+  if (rawCollectorId !== "") {
+    requirePrintable(rawCollectorId, "COLLECTOR_ID", issues, MAX_ID_LENGTH);
+    collectorId = rawCollectorId;
+  }
+  const rawHostname = env["COLLECTOR_HOSTNAME"]?.trim() ?? "";
+  let hostname = MOCK_HOSTNAME;
+  if (rawHostname !== "") {
+    requirePrintable(rawHostname, "COLLECTOR_HOSTNAME", issues, MAX_HOSTNAME_LENGTH);
+    hostname = rawHostname;
+  }
+  const destinations = [];
+  const intervalMs = parseIntervalMs(env, issues);
+  parseDestinations(env, issues, destinations);
+  if (issues.length > 0) {
+    throw new ConfigError(issues);
+  }
+  return {
+    collectorId,
+    hostname,
+    hostnameIsMockDefault: rawHostname === "",
+    intervalMs,
+    destinations
+  };
+}
+
+// collector/local-state.ts
+var import_node_crypto3 = require("node:crypto");
+var import_node_fs2 = require("node:fs");
+var import_node_path2 = require("node:path");
+function readState(path) {
+  const stat = (0, import_node_fs2.lstatSync)(path);
+  if (!stat.isFile() || stat.size > 64 * 1024 || (stat.mode & 63) !== 0) throw new Error("collector state must be a private regular file");
+  const raw = JSON.parse((0, import_node_fs2.readFileSync)(path, "utf8"));
+  if (raw.version !== 1 || typeof raw.collectorId !== "string" || !/^[\x21-\x7e]{1,128}$/.test(raw.collectorId) || !Array.isArray(raw.destinations)) throw new Error("invalid collector state");
+  const destinations = raw.destinations.length === 0 ? [] : [...parseCollectorConfig({ COLLECTOR_HUBS: JSON.stringify(raw.destinations) }).destinations];
+  if (raw.pendingEnrollments !== void 0 && (!Array.isArray(raw.pendingEnrollments) || raw.pendingEnrollments.length > 8 || raw.pendingEnrollments.some((p) => !p || typeof p.url !== "string" || typeof p.requestId !== "string" || !/^[\x21-\x7e]{1,128}$/.test(p.requestId) || typeof p.recoverySecret !== "string" || !/^[A-Za-z0-9_-]{32,128}$/.test(p.recoverySecret)))) throw new Error("invalid pending enrollment recovery state");
+  const pendingEnrollments = raw.pendingEnrollments?.map((pending) => {
+    const issues = [];
+    const url = validateHubUrl(pending.url, "pending enrollment", issues);
+    if (!url || issues.length) throw new ConfigError(issues);
+    return { ...pending, url: url.href };
+  });
+  return {
+    version: 1,
+    collectorId: raw.collectorId,
+    destinations,
+    ...pendingEnrollments === void 0 ? {} : { pendingEnrollments }
+  };
+}
+function updateInstallation(path, change = (s) => s) {
+  (0, import_node_fs2.mkdirSync)((0, import_node_path2.dirname)(path), { recursive: true, mode: 448 });
+  const directoryStat = (0, import_node_fs2.lstatSync)((0, import_node_path2.dirname)(path));
+  if (!directoryStat.isDirectory() || (directoryStat.mode & 63) !== 0) {
+    throw new ConfigError(["collector state requires a private directory (0700)"]);
+  }
+  const lock = `${path}.lock`;
+  let releaseLock;
+  try {
+    releaseLock = acquireProcessLease(lock);
+  } catch (error) {
+    if (error instanceof ProcessLeaseError) {
+      if (error.code === "busy") {
+        throw new ConfigError(["collector state is locked by another process; stop it before retrying"]);
+      }
+      throw new ConfigError(["collector state is locked by an unsafe or incomplete lock file; inspect it before recovery"]);
+    }
+    throw new ConfigError(["collector state lock could not be acquired; check the state directory permissions"]);
+  }
+  let temporary;
+  try {
+    let state;
+    try {
+      (0, import_node_fs2.lstatSync)(path);
+      state = readState(path);
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+      state = { version: 1, collectorId: (0, import_node_crypto3.randomUUID)(), destinations: [] };
+    }
+    const next = change(state);
+    temporary = `${path}.${(0, import_node_crypto3.randomUUID)()}.tmp`;
+    const out = (0, import_node_fs2.openSync)(temporary, "wx", 384);
+    try {
+      (0, import_node_fs2.writeFileSync)(out, JSON.stringify(next) + "\n");
+      (0, import_node_fs2.fsyncSync)(out);
+    } finally {
+      (0, import_node_fs2.closeSync)(out);
+    }
+    (0, import_node_fs2.renameSync)(temporary, path);
+    temporary = void 0;
+    const directory = (0, import_node_fs2.openSync)((0, import_node_path2.dirname)(path), "r");
+    try {
+      (0, import_node_fs2.fsyncSync)(directory);
+    } finally {
+      (0, import_node_fs2.closeSync)(directory);
+    }
+    return next;
+  } finally {
+    try {
+      if (temporary) (0, import_node_fs2.unlinkSync)(temporary);
+    } finally {
+      releaseLock();
+    }
+  }
+}
+
+// collector/enroll.ts
+var import_node_crypto4 = require("node:crypto");
+async function enrollCollector(path, connectUrl, enrollmentToken, sharing, replace = false) {
+  const issues = [];
+  const url = validateHubUrl(connectUrl, "enrollment destination", issues);
+  if (!url || issues.length) throw new Error("invalid enrollment destination");
+  if (!/^[\x21-\x7e]{1,256}$/.test(enrollmentToken)) throw new Error("invalid enrollment token");
+  const state = updateInstallation(path);
+  if (!replace && state.destinations.some((d) => d.url === url.href) || !state.destinations.some((d) => d.url === url.href) && state.destinations.length >= 8) throw new Error("destination already enrolled or destination budget exhausted");
+  const prepared = updateInstallation(path, (current) => {
+    if (current.pendingEnrollments?.some((p) => p.url === url.href)) return current;
+    return { ...current, pendingEnrollments: [
+      ...current.pendingEnrollments ?? [],
+      { url: url.href, requestId: (0, import_node_crypto4.randomUUID)(), recoverySecret: (0, import_node_crypto4.randomBytes)(32).toString("base64url") }
+    ] };
+  });
+  const proof = prepared.pendingEnrollments.find((p) => p.url === url.href);
+  const endpoint = new URL(url.href);
+  endpoint.protocol = url.protocol === "wss:" ? "https:" : "http:";
+  endpoint.pathname = "/api/collector/enroll";
+  let response;
+  try {
+    response = await fetch(endpoint, {
+      method: "POST",
+      redirect: "error",
+      signal: AbortSignal.timeout(5e3),
+      headers: { "Authorization": `Bearer ${enrollmentToken}`, "Content-Type": "application/json" },
+      body: JSON.stringify({ collectorId: state.collectorId, requestId: proof.requestId, recoverySecret: proof.recoverySecret })
+    });
+  } catch {
+    throw new ConfigError(["enrollment request failed; check destination and TLS trust"]);
+  }
+  if (response.status !== 201) {
+    await response.body?.cancel();
+    throw new ConfigError([`enrollment rejected (${response.status}); check the grant and hub enrollment state`]);
+  }
+  const reader = response.body?.getReader();
+  if (!reader) throw new Error("missing enrollment response");
+  let text = "";
+  let bytes = 0;
+  try {
+    for (; ; ) {
+      const { value, done } = await reader.read();
+      if (done) break;
+      bytes += value.byteLength;
+      if (bytes > 4096) throw new Error("oversized enrollment response");
+      text += new TextDecoder().decode(value, { stream: true });
+    }
+  } finally {
+    await reader.cancel();
+  }
+  const result = JSON.parse(text);
+  if (result.collectorId !== state.collectorId || typeof result.machineId !== "string" || !result.machineId || typeof result.token !== "string") throw new Error("invalid enrollment response");
+  const destination = parseCollectorConfig({ COLLECTOR_HUBS: JSON.stringify([{ url: url.href, token: result.token, sharing }]) }).destinations[0];
+  try {
+    updateInstallation(path, (current) => {
+      if (current.collectorId !== state.collectorId || !replace && current.destinations.some((d) => d.url === url.href) || !current.destinations.some((d) => d.url === url.href) && current.destinations.length >= 8) throw new Error("collector state changed during enrollment");
+      return {
+        ...current,
+        destinations: [...current.destinations.filter((d) => d.url !== url.href), destination],
+        pendingEnrollments: (current.pendingEnrollments ?? []).filter((p) => p.url !== url.href)
+      };
+    });
+  } catch {
+    throw new ConfigError(["hub enrollment succeeded but local credential save failed; operator recovery is required"]);
+  }
+}
+
+// src/cli/system.ts
+var SYSTEM_STATE_FORMAT_VERSION = 2;
+var SYSTEM_SCOPE = "system";
+var DEFAULT_SYSTEM_ACCOUNTS = {
+  hub: "rigscope-hub",
+  collector: "rigscope-collector",
+  powerGroup: "rigscope-rapl"
+};
+var DEFAULT_NODE_PATH = "/opt/rigscope/node/node";
+var UNIT_NAMES = {
+  hub: "rigscope-hub.service",
+  collector: "rigscope-collector.service"
+};
+var RAPL_RULE_NAME = "90-rigscope-rapl.rules";
+var SYSUSERS_NAME = "rigscope.conf";
+var POWER_SYSUSERS_NAME = "rigscope-rapl.conf";
+var STATE_FILE_NAME = "system-install.json";
+var POWER_STATE_FILE_NAME = "power-access.json";
+var COMPONENTS = ["hub", "collector"];
+function componentsForRole(role) {
+  return { hub: role !== "collector", collector: role !== "hub" };
+}
+function componentSet(value) {
+  if (value === void 0) return { hub: false, collector: false };
+  if (typeof value === "string") return { hub: value === "hub", collector: value === "collector" };
+  if (Array.isArray(value)) return { hub: value.includes("hub"), collector: value.includes("collector") };
+  return { hub: value.hub === true, collector: value.collector === true };
+}
+function unitFor(component) {
+  return component === "hub" ? UNIT_NAMES.hub : UNIT_NAMES.collector;
+}
+function componentEnabled(state, component) {
+  return state.components[component].enabled;
+}
+function enabledComponents(state) {
+  return COMPONENTS.filter((component) => componentEnabled(state, component));
+}
+var SYSTEM_DEFAULT_SHARING = {
+  cpu: true,
+  memory: true,
+  swap: true,
+  gpus: true,
+  disks: true,
+  network: true,
+  networkAddresses: false,
+  processes: true,
+  processArguments: false
+};
+var SystemError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "SystemError";
+    this.code = code;
+  }
+};
+var ACCOUNT_PATTERN = /^[a-z_][a-z0-9_-]{0,31}$/;
+var VERSION_PATTERN = /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/;
+var PACKAGE_TOP_LEVEL = /* @__PURE__ */ new Set([
+  "bin",
+  "dist",
+  ".next",
+  "public",
+  "packaging",
+  "docs",
+  "manifest.json",
+  "package.json",
+  "package-lock.json",
+  "next.config.js",
+  "next-env.d.ts",
+  "tsconfig.json",
+  "README.md",
+  "LICENSE",
+  "LICENSE.md",
+  "SECURITY.md",
+  "THIRD_PARTY_NOTICES.md"
+]);
+var REQUIRED_ARTIFACTS = [
+  "dist/hub.cjs",
+  "dist/collector.cjs",
+  "dist/ops.cjs",
+  "dist/cli.cjs",
+  ".next/BUILD_ID",
+  "package.json"
+];
+function createSystemHost(overrides = {}) {
+  return {
+    uid: () => process.getuid?.() ?? -1,
+    now: () => Date.now(),
+    run: (command, args, options = {}) => {
+      const result = (0, import_node_child_process.spawnSync)(command, args, {
+        cwd: options.cwd,
+        env: options.env,
+        encoding: "utf8",
+        timeout: options.timeoutMs ?? 12e4,
+        maxBuffer: 16 * 1024 * 1024
+      });
+      return {
+        status: result.status,
+        stdout: result.stdout ?? "",
+        stderr: result.stderr ?? "",
+        error: result.error?.message
+      };
+    },
+    ...overrides
+  };
+}
+function defaultSystemPaths(overrides = {}) {
+  return {
+    prefix: (0, import_node_path3.resolve)(overrides.prefix ?? "/opt/rigscope"),
+    configDir: (0, import_node_path3.resolve)(overrides.configDir ?? "/etc/rigscope"),
+    stateDir: (0, import_node_path3.resolve)(overrides.stateDir ?? "/var/lib/rigscope"),
+    unitsDir: (0, import_node_path3.resolve)(overrides.unitsDir ?? "/etc/systemd/system"),
+    sysusersDir: (0, import_node_path3.resolve)(overrides.sysusersDir ?? "/etc/sysusers.d"),
+    udevRulesDir: (0, import_node_path3.resolve)(overrides.udevRulesDir ?? "/etc/udev/rules.d"),
+    powercapRoot: (0, import_node_path3.resolve)(overrides.powercapRoot ?? "/sys/class/powercap")
+  };
+}
+function unitNamesFor(role) {
+  if (role === "hub") return [UNIT_NAMES.hub];
+  if (role === "collector") return [UNIT_NAMES.collector];
+  return [UNIT_NAMES.hub, UNIT_NAMES.collector];
+}
+function unitNamesForComponents(components) {
+  return COMPONENTS.filter((component) => componentSet(components)[component]).map(unitFor);
+}
+function rolesFor(role) {
+  return { hub: role !== "collector", collector: role !== "hub" };
+}
+function isWithin(parent, candidate) {
+  const rel = (0, import_node_path3.relative)((0, import_node_path3.resolve)(parent), (0, import_node_path3.resolve)(candidate));
+  return rel === "" || rel !== ".." && !rel.startsWith(`..${import_node_path3.sep}`) && !(0, import_node_path3.isAbsolute)(rel);
+}
+function ensureAbsolute(path, label) {
+  const absolute = (0, import_node_path3.resolve)(path);
+  if (/[\0\r\n]/.test(absolute)) throw new SystemError("unsafe-path", `${label} contains control characters`);
+  if (absolute === "/") throw new SystemError("unsafe-path", `${label} must not be the filesystem root`);
+  for (const forbidden of ["/home", "/root", "/proc", "/sys", "/dev", "/boot"]) {
+    if (absolute === forbidden || absolute.startsWith(`${forbidden}/`)) {
+      throw new SystemError("unsafe-path", `${label} must not live under ${forbidden}: ${absolute}`);
+    }
+  }
+  return absolute;
+}
+function validateSystemPaths(input = {}) {
+  const paths = defaultSystemPaths(input);
+  for (const [label, value] of Object.entries(paths)) {
+    if (label === "powercapRoot") {
+      if (!(0, import_node_path3.isAbsolute)(value) || /[\0\r\n]/.test(value) || (0, import_node_path3.resolve)(value) === "/") {
+        throw new SystemError("unsafe-path", `powercap root is unsafe: ${value}`);
+      }
+    } else {
+      ensureAbsolute(value, label);
+    }
+  }
+  const fixed = [
+    ["prefix", paths.prefix],
+    ["configDir", paths.configDir],
+    ["stateDir", paths.stateDir],
+    ["unitsDir", paths.unitsDir],
+    ["sysusersDir", paths.sysusersDir],
+    ["udevRulesDir", paths.udevRulesDir]
+  ];
+  for (let i = 0; i < fixed.length; i += 1) {
+    for (let j = i + 1; j < fixed.length; j += 1) {
+      const [leftName, left] = fixed[i];
+      const [rightName, right] = fixed[j];
+      if (left === right || isWithin(left, right) || isWithin(right, left)) {
+        throw new SystemError("unsafe-path", `${leftName} and ${rightName} must be separate paths`);
+      }
+    }
+  }
+  return paths;
+}
+function validateAccounts(input = {}) {
+  const accounts = { ...DEFAULT_SYSTEM_ACCOUNTS, ...input };
+  for (const [label, value] of Object.entries(accounts)) {
+    if (!ACCOUNT_PATTERN.test(value)) throw new SystemError("invalid-account", `${label} account name is invalid: ${value}`);
+  }
+  if (new Set(Object.values(accounts)).size !== Object.values(accounts).length) {
+    throw new SystemError("invalid-account", "hub, collector and power group names must differ");
+  }
+  if (Object.values(accounts).includes("root")) {
+    throw new SystemError("invalid-account", "system services must not run as root");
+  }
+  return accounts;
+}
+function assertApply(host) {
+  if (host.uid() !== 0) {
+    throw new SystemError("root-required", "This mutation requires root. Re-run the same command with sudo; no change was made.");
+  }
+}
+function runRequired(host, command, args, label, options) {
+  const result = host.run(command, args, options);
+  if (result.status !== 0) {
+    const detail = (result.stderr || result.stdout || result.error || "").trim().split("\n").slice(-3).join(" ");
+    throw new SystemError("command-failed", `${label} failed${detail ? `: ${detail}` : ""}`);
+  }
+  return result;
+}
+function runMaybe(host, command, args, options) {
+  return host.run(command, args, options);
+}
+function sha256File(path) {
+  return (0, import_node_crypto5.createHash)("sha256").update((0, import_node_fs3.readFileSync)(path)).digest("hex");
+}
+function atomicWrite(path, content, mode) {
+  (0, import_node_fs3.mkdirSync)((0, import_node_path3.dirname)(path), { recursive: true, mode: 493 });
+  const temporary = (0, import_node_path3.join)((0, import_node_path3.dirname)(path), `.${(0, import_node_path3.basename)(path)}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+  try {
+    (0, import_node_fs3.writeFileSync)(temporary, content, { mode });
+    (0, import_node_fs3.chmodSync)(temporary, mode);
+    (0, import_node_fs3.renameSync)(temporary, path);
+  } catch (error) {
+    try {
+      (0, import_node_fs3.unlinkSync)(temporary);
+    } catch {
+    }
+    throw error;
+  }
+}
+function ensureDirectory(path, mode, privateDirectory = false) {
+  let stat;
+  try {
+    stat = (0, import_node_fs3.lstatSync)(path);
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+    (0, import_node_fs3.mkdirSync)(path, { recursive: true, mode });
+    (0, import_node_fs3.chmodSync)(path, mode);
+    stat = (0, import_node_fs3.lstatSync)(path);
+  }
+  if (!stat.isDirectory() || stat.isSymbolicLink()) {
+    throw new SystemError("unsafe-path", `${path} must be a real directory`);
+  }
+  const actual = stat.mode & 511;
+  if (privateDirectory && (actual & 63) !== 0) {
+    throw new SystemError("insecure-permissions", `${path} must be private (0700 or stricter); found 0${actual.toString(8)}`);
+  }
+}
+function isDefaultSystemLayout(paths) {
+  return paths.prefix === "/opt/rigscope" && paths.configDir === "/etc/rigscope" && paths.stateDir === "/var/lib/rigscope";
+}
+function assertManagedPathSafety(paths, enforceRoot) {
+  for (const path of [paths.prefix, paths.configDir, paths.stateDir, paths.unitsDir, paths.sysusersDir, paths.udevRulesDir]) {
+    if (!(0, import_node_fs3.existsSync)(path)) continue;
+    const stat = (0, import_node_fs3.lstatSync)(path);
+    if (!stat.isDirectory() || stat.isSymbolicLink()) {
+      throw new SystemError("unsafe-path", `${path} must be a real directory`);
+    }
+    if ((stat.mode & 18) !== 0) {
+      throw new SystemError("insecure-permissions", `${path} must not be group/world-writable; found 0${(stat.mode & 511).toString(8)}`);
+    }
+    if (enforceRoot && stat.uid !== 0) {
+      throw new SystemError("insecure-ownership", `${path} must be root-owned for a default system installation`);
+    }
+  }
+}
+function writeManagedFile(path, content, mode, replace) {
+  if ((0, import_node_fs3.existsSync)(path)) {
+    const stat = (0, import_node_fs3.lstatSync)(path);
+    if (!stat.isFile() || stat.isSymbolicLink()) {
+      throw new SystemError("unsafe-path", `${path} must be a regular file, not a symlink`);
+    }
+    if (!replace) {
+      if ((stat.mode & 63) !== 0) {
+        throw new SystemError("insecure-permissions", `${path} must be private (0600); found 0${(stat.mode & 511).toString(8)}`);
+      }
+      return { created: false };
+    }
+  }
+  atomicWrite(path, content, mode);
+  return { created: true };
+}
+function systemdQuote(value) {
+  if (/[\r\n\0]/.test(value)) throw new SystemError("unsafe-value", "systemd values must not contain control characters");
+  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/%/g, "%%").replace(/\$/g, "$$")}"`;
+}
+function envLine(key, value) {
+  if (!/^[A-Z][A-Z0-9_]*$/.test(key)) throw new SystemError("invalid-env", `invalid environment key: ${key}`);
+  if (/[\r\n\0]/.test(value)) throw new SystemError("invalid-env", `environment value for ${key} contains control characters`);
+  return `${key}=${JSON.stringify(value)}`;
+}
+function parseEnvValue(value) {
+  if (value.startsWith('"')) {
+    try {
+      return JSON.parse(value);
+    } catch {
+      return value.slice(1, -1);
+    }
+  }
+  if (value.startsWith("'") && value.endsWith("'")) {
+    return value.slice(1, -1).replace(/\\'/g, "'").replace(/\\\\/g, "\\");
+  }
+  return value;
+}
+function readEnvDocument(path) {
+  let raw;
+  try {
+    raw = (0, import_node_fs3.readFileSync)(path, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+  const lines = raw.split("\n");
+  const values = {};
+  for (const line of lines) {
+    const match = /^([A-Z][A-Z0-9_]*)=(.*)$/.exec(line);
+    if (match) values[match[1]] = parseEnvValue(match[2]);
+  }
+  return { lines, values };
+}
+function writeEnvValue(path, key, value) {
+  const document = readEnvDocument(path);
+  const lines = (document?.lines ?? ["# Rigscope private environment. Mode 0600; never printed."]).filter(
+    (line) => !line.startsWith(`${key}=`)
+  );
+  while (lines.length > 0 && lines[lines.length - 1] === "") lines.pop();
+  const comment = lines.findIndex((line) => line.startsWith(`# ${key}=`) || line.startsWith(`#${key}=`));
+  if (comment >= 0) lines.splice(comment + 1, 0, envLine(key, value));
+  else lines.push(envLine(key, value));
+  atomicWrite(path, `${lines.join("\n")}
+`, 384);
+}
+function connectDestinationUrl(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new SystemError("invalid-url", "Use a hub URL such as https://hub.example.com.");
+  }
+  if (url.protocol === "https:") url.protocol = "wss:";
+  else if (url.protocol === "http:") url.protocol = "ws:";
+  else if (url.protocol !== "ws:" && url.protocol !== "wss:") {
+    throw new SystemError("invalid-url", "Use an http(s) or ws(s) hub URL.");
+  }
+  if (url.username !== "" || url.password !== "") {
+    throw new SystemError("invalid-url", "Hub URLs must not contain credentials; use --token-file.");
+  }
+  if (url.search !== "" || url.hash !== "") throw new SystemError("invalid-url", "Hub URLs must not contain a query or fragment.");
+  if (url.hostname === "localhost") url.hostname = "127.0.0.1";
+  if (url.pathname === "/") url.pathname = "/api/collector/connect";
+  return url.href;
+}
+function hubDatabasePath(paths) {
+  return (0, import_node_path3.join)(paths.stateDir, "hub", "telemetry.sqlite");
+}
+function hubEnrollmentPath(paths) {
+  return (0, import_node_path3.join)(paths.stateDir, "hub", "enrollment.json");
+}
+function hubSocketPath(paths) {
+  return (0, import_node_path3.join)(paths.stateDir, "hub", "run", "hub.sock");
+}
+function collectorStatePath(paths) {
+  return (0, import_node_path3.join)(paths.stateDir, "collector", "state.json");
+}
+function hubEnvPath(paths) {
+  return (0, import_node_path3.join)(paths.configDir, "hub.env");
+}
+function collectorEnvPath(paths) {
+  return (0, import_node_path3.join)(paths.configDir, "collector.env");
+}
+function sysusersPath(paths) {
+  return (0, import_node_path3.join)(paths.sysusersDir, SYSUSERS_NAME);
+}
+function powerSysusersPath(paths) {
+  return (0, import_node_path3.join)(paths.sysusersDir, POWER_SYSUSERS_NAME);
+}
+function raplRulePath(paths) {
+  return (0, import_node_path3.join)(paths.udevRulesDir, RAPL_RULE_NAME);
+}
+function stateFilePath(paths) {
+  return (0, import_node_path3.join)(paths.stateDir, STATE_FILE_NAME);
+}
+function readCollectorIdentity(path) {
+  if (!(0, import_node_fs3.existsSync)(path)) return null;
+  const stat = (0, import_node_fs3.lstatSync)(path);
+  if (!stat.isFile() || stat.isSymbolicLink()) throw new SystemError("unsafe-path", `${path} must be a regular file`);
+  if ((stat.mode & 63) !== 0) throw new SystemError("insecure-permissions", `${path} must be private (0600)`);
+  let raw;
+  try {
+    raw = JSON.parse((0, import_node_fs3.readFileSync)(path, "utf8"));
+  } catch {
+    throw new SystemError("invalid-file", `${path} is not valid JSON`);
+  }
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new SystemError("invalid-file", `${path} is invalid`);
+  const record = raw;
+  if (record.version !== void 0 && record.version !== 1 || typeof record.collectorId !== "string" || !/^[\x21-\x7e]{1,128}$/.test(record.collectorId) || !Array.isArray(record.destinations)) {
+    throw new SystemError("invalid-file", `${path} is not a collector installation state`);
+  }
+  const destinations = [];
+  for (const entry of record.destinations) {
+    if (entry === null || typeof entry !== "object" || Array.isArray(entry)) {
+      throw new SystemError("invalid-file", `${path} contains an invalid destination`);
+    }
+    const destination = entry;
+    if (typeof destination.url !== "string" || typeof destination.token !== "string" || destination.token === "") {
+      throw new SystemError("invalid-file", `${path} contains an invalid destination`);
+    }
+    destinations.push({
+      url: destination.url,
+      token: destination.token,
+      ...destination.sharing !== null && typeof destination.sharing === "object" && !Array.isArray(destination.sharing) ? { sharing: destination.sharing } : {}
+    });
+  }
+  return { version: 1, collectorId: record.collectorId, destinations };
+}
+function writeCollectorIdentity(path, identity) {
+  ensureDirectory((0, import_node_path3.dirname)(path), 448, true);
+  atomicWrite(path, `${JSON.stringify(identity)}
+`, 384);
+}
+function hubOwnerState(paths) {
+  const document = readEnvDocument(hubEnvPath(paths));
+  if (document === null) return { configured: false };
+  const value = document.values.HUB_BROWSER_USERS;
+  if (value === void 0 || value === "") return { configured: false };
+  try {
+    const parsed = JSON.parse(value);
+    if (!Array.isArray(parsed)) return { configured: false, problem: "HUB_BROWSER_USERS must be a JSON array" };
+    return { configured: parsed.length > 0 };
+  } catch {
+    return { configured: false, problem: "HUB_BROWSER_USERS is not valid JSON" };
+  }
+}
+function collectorConfigured(paths) {
+  try {
+    const identity = readCollectorIdentity(collectorStatePath(paths));
+    if (identity === null) return { configured: false, destinations: 0 };
+    return { configured: identity.destinations.length > 0, destinations: identity.destinations.length };
+  } catch (error) {
+    return { configured: false, destinations: 0, problem: error instanceof Error ? error.message : String(error) };
+  }
+}
+function ensureHubOwner(paths) {
+  const document = readEnvDocument(hubEnvPath(paths));
+  if (document === null) throw new SystemError("missing-config", `hub configuration is missing: ${hubEnvPath(paths)}; run install or enable hub`);
+  const existing = document.values.HUB_BROWSER_USERS;
+  if (existing !== void 0 && existing !== "") {
+    let parsed;
+    try {
+      parsed = JSON.parse(existing);
+    } catch {
+      throw new SystemError("invalid-config", "HUB_BROWSER_USERS is not valid JSON; repair the private hub environment");
+    }
+    if (!Array.isArray(parsed)) throw new SystemError("invalid-config", "HUB_BROWSER_USERS must be a JSON array");
+    if (parsed.length > 0) return void 0;
+  }
+  const password = (0, import_node_crypto5.randomBytes)(18).toString("base64url");
+  const users = [{ username: "owner", passwordHash: hashPassword(password), machineIds: "*", admin: true }];
+  writeEnvValue(hubEnvPath(paths), "HUB_BROWSER_USERS", JSON.stringify(users));
+  return password;
+}
+function hubDestinationUrl(paths) {
+  const document = readEnvDocument(hubEnvPath(paths));
+  if (document === null) return null;
+  const origin = document.values.HUB_PUBLIC_ORIGIN;
+  if (origin !== void 0 && origin !== "") {
+    let parsed;
+    try {
+      parsed = new URL(origin);
+    } catch {
+      return null;
+    }
+    if (parsed.protocol !== "https:") return null;
+    parsed.protocol = "wss:";
+    parsed.pathname = "/api/collector/connect";
+    return { url: parsed.href, remote: true };
+  }
+  const host = document.values.HUB_HOST ?? "127.0.0.1";
+  if (host !== "127.0.0.1" && host !== "::1") return null;
+  const port = Number(document.values.HUB_PORT ?? "8081");
+  if (!Number.isInteger(port) || port < 1 || port > 65535) return null;
+  return { url: `ws://127.0.0.1:${port}/api/collector/connect`, remote: false };
+}
+function updateHubCollectorRegistry(paths, identity) {
+  const document = readEnvDocument(hubEnvPath(paths));
+  if (document === null) return { added: false };
+  let collectors = [];
+  const raw = document.values.HUB_COLLECTORS;
+  if (raw !== void 0 && raw !== "") {
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      throw new SystemError("invalid-config", "HUB_COLLECTORS is not valid JSON; repair the private hub environment");
+    }
+    if (!Array.isArray(parsed)) throw new SystemError("invalid-config", "HUB_COLLECTORS must be a JSON array");
+    collectors = parsed;
+  }
+  if (collectors.some((entry) => entry !== null && typeof entry === "object" && !Array.isArray(entry) && entry.collectorId === identity.collectorId)) {
+    return { added: false };
+  }
+  collectors = [...collectors, { collectorId: identity.collectorId, machineId: identity.machineId, token: identity.token }];
+  writeEnvValue(hubEnvPath(paths), "HUB_COLLECTORS", JSON.stringify(collectors));
+  return { added: true };
+}
+function registerCollectorInHubDatabase(paths, identity, host) {
+  const database = hubDatabasePath(paths);
+  if (!(0, import_node_fs3.existsSync)(database)) return { inserted: false };
+  const db = new import_node_sqlite.DatabaseSync(database, { timeout: 5e3 });
+  try {
+    const table = db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='collector_registry'").get();
+    if (!table) return { inserted: false };
+    const existing = db.prepare("SELECT collector_id,machine_id,token FROM collector_registry WHERE collector_id=?").get(identity.collectorId);
+    if (existing) return { inserted: false, existing: { machineId: existing.machine_id, token: existing.token } };
+    db.prepare("INSERT INTO collector_registry(collector_id,machine_id,token,revoked,created_at_ms,updated_at_ms) VALUES(?,?,?,0,?,?)").run(identity.collectorId, identity.machineId, identity.token, host.now(), host.now());
+    return { inserted: true };
+  } finally {
+    db.close();
+  }
+}
+function findCollectorInHubDatabase(paths, collectorId) {
+  const database = hubDatabasePath(paths);
+  if (!(0, import_node_fs3.existsSync)(database)) return null;
+  const db = new import_node_sqlite.DatabaseSync(database, { readOnly: true, timeout: 5e3 });
+  try {
+    const table = db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='collector_registry'").get();
+    if (!table) return null;
+    const row = db.prepare("SELECT machine_id,token FROM collector_registry WHERE collector_id=? AND revoked=0").get(collectorId);
+    return row ? { machineId: row.machine_id, token: row.token } : null;
+  } finally {
+    db.close();
+  }
+}
+function createLocalEnrollmentGrant(paths, host) {
+  const database = hubDatabasePath(paths);
+  if (!(0, import_node_fs3.existsSync)(database)) throw new SystemError("hub-unavailable", "the hub database does not exist yet");
+  const token = (0, import_node_crypto5.randomBytes)(32).toString("base64url");
+  const tokenHash = (0, import_node_crypto5.createHash)("sha256").update(token).digest("hex");
+  const expiresAt = host.now() + 10 * 60 * 1e3;
+  const db = new import_node_sqlite.DatabaseSync(database, { timeout: 5e3 });
+  try {
+    const table = db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='collector_grants'").get();
+    if (!table) throw new SystemError("hub-unavailable", "the hub registry is not initialized");
+    db.exec("BEGIN IMMEDIATE");
+    try {
+      db.prepare("INSERT OR IGNORE INTO collector_registry_meta VALUES('bootstrapped','1')").run();
+      db.prepare("DELETE FROM collector_grants WHERE expires_at_ms < ? AND (recovery_until_ms IS NULL OR recovery_until_ms < ?)").run(host.now(), host.now());
+      const count = db.prepare("SELECT COUNT(*) AS n FROM collector_grants").get();
+      if (count.n >= 256) throw new SystemError("grant-budget", "the hub enrollment grant budget is exhausted");
+      db.prepare(
+        "INSERT INTO collector_grants(token_hash,expires_at_ms,replace_machine_id,consumed_by,request_id,recovery_hash,recovery_until_ms,actor) VALUES(?,?,NULL,NULL,NULL,NULL,NULL,?)"
+      ).run(tokenHash, expiresAt, "system-installer");
+      db.exec("COMMIT");
+    } catch (error) {
+      try {
+        db.exec("ROLLBACK");
+      } catch {
+      }
+      throw error;
+    }
+  } finally {
+    db.close();
+  }
+  return token;
+}
+async function pairCollectorWithHub(options) {
+  const { paths, accounts, host } = options;
+  const existing = readCollectorIdentity(collectorStatePath(paths));
+  if (existing !== null && existing.destinations.length > 0) {
+    return { paired: false, awaiting: false, hubWasActive: false, note: "configured collector keeps its destinations" };
+  }
+  const owner = hubOwnerState(paths);
+  if (!owner.configured) {
+    return {
+      paired: false,
+      awaiting: true,
+      hubWasActive: false,
+      note: owner.problem ?? "the local hub has no owner yet"
+    };
+  }
+  const destination = hubDestinationUrl(paths);
+  if (destination === null) {
+    return {
+      paired: false,
+      awaiting: true,
+      hubWasActive: false,
+      note: "the local hub has no reachable loopback or HTTPS destination"
+    };
+  }
+  if (!(0, import_node_fs3.existsSync)((0, import_node_path3.join)(paths.unitsDir, UNIT_NAMES.hub))) {
+    return { paired: false, awaiting: true, hubWasActive: false, note: "the local hub unit is not installed" };
+  }
+  const hubWasActive = systemdActive(host, UNIT_NAMES.hub);
+  if (hubWasActive) {
+    if (existing !== null) {
+      writeCollectorIdentity(collectorStatePath(paths), existing);
+      const registered = findCollectorInHubDatabase(paths, existing.collectorId);
+      if (registered !== null) {
+        const adopted = {
+          version: 1,
+          collectorId: existing.collectorId,
+          destinations: [{ url: destination.url, token: registered.token, sharing: { ...SYSTEM_DEFAULT_SHARING } }]
+        };
+        writeCollectorIdentity(collectorStatePath(paths), adopted);
+        chownAccount([(0, import_node_path3.join)(paths.stateDir, "collector")], accounts.collector, accounts.collector, host);
+        return { paired: true, awaiting: false, hubWasActive, destination: destination.url };
+      }
+    }
+    let grant;
+    try {
+      grant = createLocalEnrollmentGrant(paths, host);
+    } catch (error) {
+      chownAccount([(0, import_node_path3.join)(paths.stateDir, "collector")], accounts.collector, accounts.collector, host);
+      return {
+        paired: false,
+        awaiting: true,
+        hubWasActive,
+        note: `the live hub registry is unavailable: ${error instanceof Error ? error.message : String(error)}`
+      };
+    }
+    try {
+      await enrollCollector(collectorStatePath(paths), destination.url, grant, { ...SYSTEM_DEFAULT_SHARING }, false);
+    } catch (error) {
+      return {
+        paired: false,
+        awaiting: true,
+        hubWasActive,
+        note: `enrollment through the live hub failed: ${error instanceof Error ? error.message : String(error)}`
+      };
+    } finally {
+      chownAccount([(0, import_node_path3.join)(paths.stateDir, "collector")], accounts.collector, accounts.collector, host);
+    }
+    if (!collectorConfigured(paths).configured) {
+      return { paired: false, awaiting: true, hubWasActive, note: "the hub accepted enrollment but no destination was saved" };
+    }
+    chownAccount([(0, import_node_path3.join)(paths.stateDir, "collector")], accounts.collector, accounts.collector, host);
+    return { paired: true, awaiting: false, hubWasActive, destination: destination.url };
+  }
+  const identity = {
+    collectorId: existing?.collectorId ?? (0, import_node_crypto5.randomUUID)(),
+    machineId: (0, import_node_crypto5.randomUUID)(),
+    token: (0, import_node_crypto5.randomBytes)(32).toString("base64url")
+  };
+  const registry = registerCollectorInHubDatabase(paths, identity, host);
+  let token = identity.token;
+  if (registry.existing) {
+    token = registry.existing.token;
+  } else if (!registry.inserted) {
+    const added = updateHubCollectorRegistry(paths, identity);
+    if (!added.added) {
+      const document = readEnvDocument(hubEnvPath(paths));
+      const raw = document?.values.HUB_COLLECTORS;
+      if (raw !== void 0) {
+        const parsed = JSON.parse(raw);
+        const match = parsed.find((entry) => entry.collectorId === identity.collectorId);
+        if (match && typeof match.machineId === "string" && typeof match.token === "string") token = match.token;
+      }
+    }
+  }
+  const next = existing ?? { version: 1, collectorId: identity.collectorId, destinations: [] };
+  next.destinations = [
+    {
+      url: destination.url,
+      token,
+      sharing: { ...SYSTEM_DEFAULT_SHARING }
+    }
+  ];
+  writeCollectorIdentity(collectorStatePath(paths), next);
+  chownAccount([(0, import_node_path3.join)(paths.stateDir, "collector")], accounts.collector, accounts.collector, host);
+  return { paired: true, awaiting: false, hubWasActive, destination: destination.url };
+}
+function unitCommon(name, description, paths, account, envPath, execStart, extraService = []) {
+  return [
+    "[Unit]",
+    `Description=${description}`,
+    `Documentation=file:${paths.prefix}/current/README.md`,
+    "After=network-online.target",
+    "Wants=network-online.target",
+    "StartLimitIntervalSec=60",
+    "StartLimitBurst=5",
+    "",
+    "[Service]",
+    "Type=simple",
+    `User=${account}`,
+    `Group=${account}`,
+    `WorkingDirectory=${(0, import_node_path3.join)(paths.prefix, "current").replace(/%/g, "%%")}`,
+    `EnvironmentFile=${envPath.replace(/%/g, "%%")}`,
+    "Environment=NODE_ENV=production",
+    "Restart=on-failure",
+    "RestartSec=2s",
+    "KillSignal=SIGTERM",
+    "UMask=0077",
+    "NoNewPrivileges=yes",
+    "PrivateTmp=yes",
+    "ProtectSystem=strict",
+    "ProtectHome=yes",
+    "ProtectKernelTunables=yes",
+    "ProtectKernelModules=yes",
+    "ProtectKernelLogs=yes",
+    "ProtectControlGroups=yes",
+    "RestrictRealtime=yes",
+    "RestrictSUIDSGID=yes",
+    "RestrictNamespaces=yes",
+    "LockPersonality=yes",
+    "RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6",
+    "CapabilityBoundingSet=",
+    "AmbientCapabilities=",
+    `ExecStart=${execStart}`,
+    ...extraService,
+    "StandardOutput=journal",
+    "StandardError=journal",
+    `SyslogIdentifier=${name}`,
+    "",
+    "[Install]",
+    "WantedBy=multi-user.target",
+    ""
+  ];
+}
+function renderSystemHubUnit(options) {
+  const { paths, accounts } = options;
+  const hubScript = (0, import_node_path3.join)(paths.prefix, "current", "dist", "hub.cjs");
+  const extra = [
+    `Environment=${systemdQuote(`HUB_DATABASE_PATH=${options.database}`)}`,
+    `Environment=${systemdQuote(`HUB_STATE_FILE=${options.enrollment}`)}`,
+    ...options.remote ? [`Environment=${systemdQuote(`HUB_SOCKET_PATH=${options.socket}`)}`] : [],
+    `ReadWritePaths=${systemdQuote((0, import_node_path3.join)(paths.stateDir, "hub"))}`,
+    `ReadOnlyPaths=${systemdQuote((0, import_node_path3.join)(paths.prefix, "current"))}`,
+    "PrivateDevices=yes",
+    "TimeoutStopSec=15s"
+  ];
+  return [
+    "# Managed by `rigscope system`. Enable explicitly; do not edit in place.",
+    ...unitCommon(
+      "rigscope-hub",
+      "Rigscope hub (system scope)",
+      paths,
+      accounts.hub,
+      hubEnvPath(paths),
+      `${systemdQuote(options.nodePath)} ${systemdQuote(hubScript)}`,
+      extra
+    )
+  ].join("\n");
+}
+function renderSystemCollectorUnit(options) {
+  const { paths, accounts } = options;
+  const collectorScript = (0, import_node_path3.join)(paths.prefix, "current", "dist", "collector.cjs");
+  const extra = [
+    ...options.powerAccess ? [`SupplementaryGroups=${accounts.powerGroup}`] : [],
+    `Environment=${systemdQuote(`COLLECTOR_MODE=real`)}`,
+    `Environment=${systemdQuote(`COLLECTOR_STATE_FILE=${options.collectorState}`)}`,
+    `Environment=${systemdQuote(`COLLECTOR_HEALTH_FILE=${(0, import_node_path3.join)(paths.stateDir, "collector", "health.json")}`)}`,
+    `ReadWritePaths=${systemdQuote((0, import_node_path3.join)(paths.stateDir, "collector"))}`,
+    `ReadOnlyPaths=${systemdQuote((0, import_node_path3.join)(paths.prefix, "current"))}`,
+    "TimeoutStopSec=10s"
+  ];
+  return [
+    "# Managed by `rigscope system`. Enable explicitly after enrollment.",
+    "# The collector is nologin and has no capability grants.",
+    "# Package power reads use the private group rule installed separately.",
+    "# Node receives no capabilities, no root, and no device-control access.",
+    ...unitCommon(
+      "rigscope-collector",
+      "Rigscope collector (system scope)",
+      paths,
+      accounts.collector,
+      collectorEnvPath(paths),
+      `${systemdQuote(options.nodePath)} ${systemdQuote(collectorScript)} --await-connection`,
+      extra
+    )
+  ].join("\n");
+}
+function renderSysusers(paths, accounts, _role = "local") {
+  void paths;
+  return [
+    `# Managed by Rigscope system installation.`,
+    "# Accounts are unprivileged and cannot log in.",
+    `g ${accounts.hub} - -`,
+    `u ${accounts.hub} - "Rigscope hub" /nonexistent /usr/sbin/nologin`,
+    `g ${accounts.collector} - -`,
+    `u ${accounts.collector} - "Rigscope collector" /nonexistent /usr/sbin/nologin`,
+    ""
+  ].join("\n");
+}
+function renderPowerSysusers(_paths, accounts) {
+  return [
+    "# Managed by Rigscope. Grants only the collector account membership in the power group.",
+    `g ${accounts.powerGroup} - -`,
+    `m ${accounts.collector} ${accounts.powerGroup}`,
+    ""
+  ].join("\n");
+}
+function renderRaplRule(accounts) {
+  return [
+    "# Managed by Rigscope: read-only package energy/range counters for the collector group.",
+    "# Top-level package devices only; subdomains and constraint files are not touched.",
+    'SUBSYSTEM=="powercap", ACTION=="add|change", KERNEL=="intel-rapl:[0-9]*", KERNEL!="intel-rapl:*:*", ATTR{name}=="package*", \\',
+    `  RUN+="/usr/bin/chgrp ${accounts.powerGroup} /sys%p/energy_uj", \\`,
+    '  RUN+="/usr/bin/chmod 0440 /sys%p/energy_uj", \\',
+    `  RUN+="/usr/bin/chgrp ${accounts.powerGroup} /sys%p/max_energy_range_uj", \\`,
+    '  RUN+="/usr/bin/chmod 0440 /sys%p/max_energy_range_uj"',
+    ""
+  ].join("\n");
+}
+function hubEnvTemplate(paths, origin, port = 8081) {
+  const lines = [
+    "# Rigscope hub environment. Root-owned private file, mode 0600.",
+    "# Credentials remain commented out until an operator adds them: with no",
+    "# browser users the hub fails closed and exposes no protected data.",
+    "# Generate password hashes locally with scripts/hash-browser-password.cjs.",
+    envLine("HUB_DATABASE_PATH", hubDatabasePath(paths)),
+    envLine("HUB_STATE_FILE", hubEnrollmentPath(paths)),
+    ...origin ? [envLine("HUB_PUBLIC_ORIGIN", origin), envLine("HUB_SOCKET_PATH", hubSocketPath(paths))] : [envLine("HUB_HOST", "127.0.0.1"), envLine("HUB_PORT", String(port))],
+    '# HUB_BROWSER_USERS=[{"username":"operator","passwordHash":"<private hash>","machineIds":"*"}]',
+    '# HUB_COLLECTORS=[{"collectorId":"...","machineId":"...","token":"..."}]',
+    ""
+  ];
+  return lines.join("\n");
+}
+function collectorEnvTemplate() {
+  return [
+    "# Rigscope collector environment. Root-owned private file, mode 0600.",
+    "# Enrollment writes the durable destination/token state under /var/lib/rigscope.",
+    "# COLLECTOR_ENROLL_URL=ws://127.0.0.1:8081/api/collector/connect",
+    "# COLLECTOR_ENROLL_TOKEN=<one-use grant>",
+    "# COLLECTOR_MODE=real",
+    ""
+  ].join("\n");
+}
+function assertPrivateSourceFile(path, label) {
+  const stat = (0, import_node_fs3.lstatSync)(path);
+  if (!stat.isFile() || stat.isSymbolicLink()) {
+    throw new SystemError("unsafe-adoption", `${label} must be a regular file: ${path}`);
+  }
+  if ((stat.mode & 63) !== 0) {
+    throw new SystemError("insecure-permissions", `${label} must be private (0600) before adoption: ${path}`);
+  }
+}
+function readJsonObject(path) {
+  let raw;
+  try {
+    raw = (0, import_node_fs3.readFileSync)(path, "utf8");
+  } catch (error) {
+    throw new SystemError("missing-file", `cannot read ${path}: ${error.message}`);
+  }
+  let value;
+  try {
+    value = JSON.parse(raw);
+  } catch {
+    throw new SystemError("invalid-file", `${path} is not valid JSON`);
+  }
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new SystemError("invalid-file", `${path} must contain a JSON object`);
+  }
+  return value;
+}
+function readSystemState(paths) {
+  const path = stateFilePath(paths);
+  if (!(0, import_node_fs3.existsSync)(path)) return null;
+  const stat = (0, import_node_fs3.lstatSync)(path);
+  if (!stat.isFile() || stat.isSymbolicLink()) throw new SystemError("unsafe-path", `${path} must be a regular file`);
+  if ((stat.mode & 63) !== 0) throw new SystemError("insecure-permissions", `${path} must be 0600`);
+  const raw = readJsonObject(path);
+  if (raw.formatVersion !== 1 && raw.formatVersion !== SYSTEM_STATE_FORMAT_VERSION || raw.scope !== SYSTEM_SCOPE) {
+    throw new SystemError("invalid-state", `${path} is not a Rigscope system installation state`);
+  }
+  const savedPaths = raw.paths;
+  if (!savedPaths || savedPaths.prefix !== paths.prefix || savedPaths.stateDir !== paths.stateDir) {
+    throw new SystemError("invalid-state", "system installation state belongs to different paths");
+  }
+  const savedAccounts = raw.accounts;
+  const accounts = validateAccounts(savedAccounts ?? {});
+  if (raw.role !== "local" && raw.role !== "hub" && raw.role !== "collector") {
+    throw new SystemError("invalid-state", "system installation state has an invalid role");
+  }
+  let components;
+  if (raw.formatVersion === 1) {
+    const mapped = componentsForRole(raw.role);
+    components = { hub: { enabled: mapped.hub }, collector: { enabled: mapped.collector } };
+  } else {
+    const saved = raw.components;
+    if (saved === null || typeof saved !== "object" || saved.hub === null || saved.collector === null || typeof saved.hub !== "object" || typeof saved.collector !== "object" || typeof saved.hub.enabled !== "boolean" || typeof saved.collector.enabled !== "boolean") {
+      throw new SystemError("invalid-state", "system installation state has invalid component enabled state");
+    }
+    components = { hub: { enabled: saved.hub.enabled }, collector: { enabled: saved.collector.enabled } };
+  }
+  return {
+    ...raw,
+    formatVersion: SYSTEM_STATE_FORMAT_VERSION,
+    accounts,
+    components
+  };
+}
+function writeSystemState(paths, state) {
+  ensureDirectory(paths.stateDir, 493, false);
+  atomicWrite(stateFilePath(paths), `${JSON.stringify({ ...state, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }, null, 2)}
+`, 384);
+}
+function emptyState(options) {
+  const timestamp = new Date(options.now()).toISOString();
+  const components = options.components ?? componentsForRole(options.role);
+  return {
+    formatVersion: SYSTEM_STATE_FORMAT_VERSION,
+    scope: SYSTEM_SCOPE,
+    role: options.role,
+    active: true,
+    components: { hub: { enabled: components.hub }, collector: { enabled: components.collector } },
+    paths: options.paths,
+    accounts: options.accounts,
+    nodePath: options.nodePath,
+    currentVersion: null,
+    previousVersion: null,
+    releases: {},
+    backups: {},
+    adoption: null,
+    power: null,
+    installedAt: timestamp,
+    updatedAt: timestamp
+  };
+}
+function validateVersion(value) {
+  if (typeof value !== "string" || !VERSION_PATTERN.test(value)) {
+    throw new SystemError("invalid-version", `invalid release version: ${String(value)}`);
+  }
+  return value;
+}
+function releaseVersion(root) {
+  return validateVersion(readJsonObject((0, import_node_path3.join)(root, "package.json")).version);
+}
+function releaseSchemaVersion(root) {
+  const manifestPath = (0, import_node_path3.join)(root, "manifest.json");
+  if (!(0, import_node_fs3.existsSync)(manifestPath)) return null;
+  const manifest = readJsonObject(manifestPath);
+  return Number.isSafeInteger(manifest.schemaVersion) ? Number(manifest.schemaVersion) : null;
+}
+function assertReleaseArtifacts(root) {
+  for (const artifact of REQUIRED_ARTIFACTS) {
+    const path = (0, import_node_path3.join)(root, artifact);
+    let stat;
+    try {
+      stat = (0, import_node_fs3.lstatSync)(path);
+    } catch {
+      throw new SystemError("missing-artifact", `release is missing ${artifact}`);
+    }
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.size === 0) {
+      throw new SystemError("invalid-artifact", `release artifact is not a non-empty regular file: ${artifact}`);
+    }
+  }
+  const buildId = (0, import_node_fs3.readFileSync)((0, import_node_path3.join)(root, ".next", "BUILD_ID"), "utf8").trim();
+  if (buildId === "" || /\s/.test(buildId)) throw new SystemError("invalid-artifact", ".next/BUILD_ID is invalid");
+  for (const directory of [".next/server", ".next/static"]) {
+    let stat;
+    try {
+      stat = (0, import_node_fs3.lstatSync)((0, import_node_path3.join)(root, directory));
+    } catch {
+      throw new SystemError("missing-artifact", `release is missing ${directory}/`);
+    }
+    if (!stat.isDirectory()) throw new SystemError("invalid-artifact", `${directory} is not a directory`);
+  }
+}
+function verifyReleaseManifest(root) {
+  const manifestPath = (0, import_node_path3.join)(root, "manifest.json");
+  if (!(0, import_node_fs3.existsSync)(manifestPath)) return;
+  const manifest = readJsonObject(manifestPath);
+  const packageJson = readJsonObject((0, import_node_path3.join)(root, "package.json"));
+  if (manifest.name !== void 0 && manifest.name !== packageJson.name) {
+    throw new SystemError("manifest-mismatch", "release manifest name does not match package.json");
+  }
+  if (manifest.version !== void 0 && manifest.version !== packageJson.version) {
+    throw new SystemError("manifest-mismatch", "release manifest version does not match package.json");
+  }
+  const artifacts = manifest.artifacts;
+  if (!Array.isArray(artifacts) || artifacts.length === 0) return;
+  const listed = /* @__PURE__ */ new Set();
+  for (const raw of artifacts) {
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+      throw new SystemError("invalid-manifest", "release manifest contains an invalid artifact entry");
+    }
+    const entry = raw;
+    const relativePath = entry.path;
+    if (typeof relativePath !== "string" || relativePath === "" || relativePath.startsWith("/") || relativePath.includes("\\") || relativePath.split("/").includes("..")) {
+      throw new SystemError("invalid-manifest", `release manifest contains an unsafe path: ${String(relativePath)}`);
+    }
+    const absolute = (0, import_node_path3.join)(root, relativePath);
+    const stat = (0, import_node_fs3.lstatSync)(absolute);
+    if (!stat.isFile() || stat.isSymbolicLink()) throw new SystemError("invalid-manifest", `release artifact is not a regular file: ${relativePath}`);
+    if (entry.bytes !== stat.size) throw new SystemError("artifact-mismatch", `release artifact size changed: ${relativePath}`);
+    if (entry.sha256 !== sha256File(absolute)) throw new SystemError("artifact-mismatch", `release artifact hash changed: ${relativePath}`);
+    listed.add(relativePath);
+  }
+  const visit = (current) => {
+    for (const entry of (0, import_node_fs3.readdirSync)(current, { withFileTypes: true })) {
+      const absolute = (0, import_node_path3.join)(current, entry.name);
+      const rel = (0, import_node_path3.relative)(root, absolute).split(import_node_path3.sep).join("/");
+      if (rel === "node_modules" || rel.startsWith("node_modules/") || rel === ".next/cache" || rel.startsWith(".next/cache/")) continue;
+      if (entry.isSymbolicLink()) throw new SystemError("unsafe-release", `release contains a symlink: ${rel}`);
+      if (entry.isDirectory()) {
+        visit(absolute);
+        continue;
+      }
+      if (rel === "manifest.json") continue;
+      if (!listed.has(rel)) throw new SystemError("artifact-mismatch", `release contains an unlisted file: ${rel}`);
+    }
+  };
+  visit(root);
+}
+function assertNoSymlinks(root) {
+  const visit = (path) => {
+    const stat = (0, import_node_fs3.lstatSync)(path);
+    if (stat.isSymbolicLink()) throw new SystemError("unsafe-release", `release contains a symlink: ${(0, import_node_path3.relative)(root, path)}`);
+    if (!stat.isDirectory()) return;
+    for (const entry of (0, import_node_fs3.readdirSync)(path)) visit((0, import_node_path3.join)(path, entry));
+  };
+  visit(root);
+}
+function copyReleaseTree(source, destination) {
+  const visit = (current, target) => {
+    const stat = (0, import_node_fs3.lstatSync)(current);
+    if (stat.isSymbolicLink()) throw new SystemError("unsafe-release", `source contains a symlink: ${(0, import_node_path3.relative)(source, current)}`);
+    if (stat.isDirectory()) {
+      (0, import_node_fs3.mkdirSync)(target, { recursive: true, mode: 493 });
+      for (const entry of (0, import_node_fs3.readdirSync)(current)) {
+        const child = (0, import_node_path3.join)(current, entry);
+        const rel = (0, import_node_path3.relative)(source, child);
+        if (rel === ".git" || rel === ".next-dev" || rel === ".next/cache" || rel === "node_modules" || rel.startsWith("node_modules/")) {
+          continue;
+        }
+        visit(child, (0, import_node_path3.join)(target, entry));
+      }
+      return;
+    }
+    if (!stat.isFile()) throw new SystemError("unsafe-release", `source contains a non-regular file: ${(0, import_node_path3.relative)(source, current)}`);
+    (0, import_node_fs3.mkdirSync)((0, import_node_path3.dirname)(target), { recursive: true, mode: 493 });
+    (0, import_node_fs3.copyFileSync)(current, target);
+    (0, import_node_fs3.chmodSync)(target, 420);
+  };
+  visit(source, destination);
+}
+function copyReleaseAllowlisted(source, destination) {
+  for (const entry of (0, import_node_fs3.readdirSync)(source)) {
+    if (!PACKAGE_TOP_LEVEL.has(entry)) continue;
+    if (entry === "node_modules") continue;
+    const child = (0, import_node_path3.join)(source, entry);
+    const target = (0, import_node_path3.join)(destination, entry);
+    const stat = (0, import_node_fs3.lstatSync)(child);
+    if (stat.isSymbolicLink()) throw new SystemError("unsafe-release", `source contains a symlink: ${entry}`);
+    if (stat.isDirectory()) {
+      copyReleaseTree(child, target);
+    } else if (stat.isFile()) {
+      (0, import_node_fs3.copyFileSync)(child, target);
+      (0, import_node_fs3.chmodSync)(target, 420);
+    }
+  }
+}
+function extractArchive(archive, stage, host) {
+  const listing = runRequired(host, "tar", ["-tvzf", archive], "archive inspection");
+  const lines = listing.stdout.split("\n").filter((line) => line.trim() !== "");
+  if (lines.length === 0) throw new SystemError("invalid-archive", "release archive is empty");
+  let strip = 0;
+  const names = [];
+  for (const line of lines) {
+    if (/^[lhcbps]/.test(line.trim())) {
+      throw new SystemError("unsafe-release", "release archive contains a link or special file");
+    }
+    const match = / -> /.test(line);
+    if (match) throw new SystemError("unsafe-release", "release archive contains a symlink");
+    const parts = line.trim().split(/\s+/);
+    const name = parts[parts.length - 1] ?? "";
+    names.push(name);
+  }
+  if (names.every((name) => name === "package" || name.startsWith("package/"))) strip = 1;
+  for (const name of names) {
+    const normalized = name.replace(/^package\//, "").replace(/^\.\//, "");
+    if (normalized === "" || normalized === ".") continue;
+    if (normalized.startsWith("/") || normalized.split("/").includes("..") || normalized.includes("\\")) {
+      throw new SystemError("unsafe-release", `release archive contains an unsafe path: ${name}`);
+    }
+  }
+  const args = ["-xzf", archive, "-C", stage, "--no-same-owner", "--no-same-permissions"];
+  if (strip === 1) args.push("--strip-components=1");
+  runRequired(host, "tar", args, "archive extraction");
+  assertNoSymlinks(stage);
+}
+function stageRelease(options) {
+  const source = (0, import_node_path3.resolve)(options.source);
+  const stat = (0, import_node_fs3.lstatSync)(source);
+  const releasesDir = (0, import_node_path3.join)(options.paths.prefix, "releases");
+  ensureDirectory(releasesDir, 493);
+  const stage = (0, import_node_path3.join)(releasesDir, `.stage-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+  (0, import_node_fs3.mkdirSync)(stage, { recursive: true, mode: 448 });
+  try {
+    if (stat.isDirectory() && !stat.isSymbolicLink()) {
+      copyReleaseAllowlisted(source, stage);
+    } else if (stat.isFile() && !stat.isSymbolicLink()) {
+      extractArchive(source, stage, options.host);
+    } else {
+      throw new SystemError("invalid-source", "release source must be a directory or .tar.gz archive");
+    }
+    assertReleaseArtifacts(stage);
+    verifyReleaseManifest(stage);
+    const version = releaseVersion(stage);
+    const releaseDir = (0, import_node_path3.join)(releasesDir, version);
+    if ((0, import_node_fs3.existsSync)(releaseDir)) {
+      const current = currentReleaseDir(options.paths);
+      const previous = previousReleaseDir(options.paths);
+      if (!options.replaceRelease || current === releaseDir || previous === releaseDir) {
+        throw new SystemError(
+          "release-exists",
+          `release ${version} is already installed${current === releaseDir || previous === releaseDir ? " or retained" : ""}; choose a new version`
+        );
+      }
+      (0, import_node_fs3.rmSync)(releaseDir, { recursive: true, force: true });
+    }
+    (0, import_node_fs3.renameSync)(stage, releaseDir);
+    ensureDirectory((0, import_node_path3.join)(releaseDir, ".next", "cache"), 493);
+    return { version, releaseDir, schemaVersion: releaseSchemaVersion(releaseDir), artifacts: [...REQUIRED_ARTIFACTS] };
+  } catch (error) {
+    (0, import_node_fs3.rmSync)(stage, { recursive: true, force: true });
+    throw error;
+  }
+}
+function dependencyNames(root) {
+  const pkg = readJsonObject((0, import_node_path3.join)(root, "package.json"));
+  const dependencies = pkg.dependencies;
+  if (dependencies === null || typeof dependencies !== "object" || Array.isArray(dependencies)) return [];
+  return Object.keys(dependencies).filter((name) => /^[A-Za-z0-9@/._-]+$/.test(name));
+}
+function missingDependencies(root) {
+  return dependencyNames(root).filter((name) => !(0, import_node_fs3.existsSync)((0, import_node_path3.join)(root, "node_modules", name, "package.json")));
+}
+function installDependencies(root, host, command = "npm") {
+  const hasLock = (0, import_node_fs3.existsSync)((0, import_node_path3.join)(root, "package-lock.json"));
+  const args = hasLock ? ["ci", "--omit=dev", "--ignore-scripts", "--no-audit", "--no-fund"] : ["install", "--omit=dev", "--ignore-scripts", "--no-audit", "--no-fund"];
+  const siblingNpm = (0, import_node_path3.join)((0, import_node_path3.dirname)(process.execPath), "npm");
+  const executable = command === "npm" && (0, import_node_fs3.existsSync)(siblingNpm) ? siblingNpm : command;
+  const nodeBin = (0, import_node_path3.dirname)(process.execPath);
+  const path = [nodeBin, process.env.PATH ?? ""].filter(Boolean).join(":");
+  runRequired(host, executable, args, "production dependency installation", {
+    cwd: root,
+    env: { ...process.env, NODE_ENV: "production", PATH: path },
+    timeoutMs: 6e5
+  });
+}
+function currentReleaseDir(paths) {
+  const link = (0, import_node_path3.join)(paths.prefix, "current");
+  try {
+    const target = (0, import_node_fs3.readlinkSync)(link);
+    const absolute = (0, import_node_path3.isAbsolute)(target) ? target : (0, import_node_path3.resolve)(paths.prefix, target);
+    return isWithin((0, import_node_path3.join)(paths.prefix, "releases"), absolute) ? absolute : null;
+  } catch {
+    return null;
+  }
+}
+function previousReleaseDir(paths) {
+  const link = (0, import_node_path3.join)(paths.prefix, "previous");
+  try {
+    const target = (0, import_node_fs3.readlinkSync)(link);
+    const absolute = (0, import_node_path3.isAbsolute)(target) ? target : (0, import_node_path3.resolve)(paths.prefix, target);
+    return isWithin((0, import_node_path3.join)(paths.prefix, "releases"), absolute) ? absolute : null;
+  } catch {
+    return null;
+  }
+}
+function replaceSymlink(link, target, host) {
+  const temporary = `${link}.tmp-${process.pid}-${Date.now()}`;
+  try {
+    (0, import_node_fs3.symlinkSync)(target, temporary);
+    (0, import_node_fs3.renameSync)(temporary, link);
+  } catch (error) {
+    try {
+      (0, import_node_fs3.unlinkSync)(temporary);
+    } catch {
+    }
+    throw error;
+  }
+  void host;
+}
+function removeSymlink(link) {
+  try {
+    const stat = (0, import_node_fs3.lstatSync)(link);
+    if (stat.isSymbolicLink()) (0, import_node_fs3.unlinkSync)(link);
+  } catch {
+  }
+}
+function nodeVersion(host, nodePath) {
+  const result = host.run(nodePath, ["--version"], { timeoutMs: 5e3 });
+  const output = result.stdout.trim();
+  if (result.status !== 0 || !/^v26\.\d+\.\d+$/.test(output)) {
+    throw new SystemError("unsupported-node", `selected executable must run Node 26; got ${output || "no version"}`);
+  }
+  return output;
+}
+function ensureRootOwnedNode(options) {
+  const selected = (0, import_node_path3.resolve)(options.nodePath ?? process.execPath);
+  const real = (0, import_node_fs3.realpathSync)(selected);
+  nodeVersion(options.host, real);
+  const stat = (0, import_node_fs3.statSync)(real);
+  const unsafe = stat.uid !== 0 || (stat.mode & 18) !== 0 || options.copyNode === true;
+  if (!unsafe || options.trustedNode === true) return real;
+  const target = (0, import_node_path3.join)(options.paths.prefix, "node", "node");
+  if (!options.apply) return target;
+  ensureDirectory((0, import_node_path3.join)(options.paths.prefix, "node"), 493);
+  (0, import_node_fs3.copyFileSync)(real, target);
+  (0, import_node_fs3.chmodSync)(target, 493);
+  runRequired(options.host, "chown", ["root:root", target], "node ownership");
+  nodeVersion(options.host, target);
+  return target;
+}
+function normalizedJsonArray(value, label) {
+  if (value === void 0 || value === null || value === "") return void 0;
+  const candidate = typeof value === "string" ? value : JSON.stringify(value);
+  if (typeof candidate !== "string") throw new SystemError("invalid-adoption", `${label} must be JSON`);
+  let parsed;
+  try {
+    parsed = JSON.parse(candidate);
+  } catch {
+    throw new SystemError("invalid-adoption", `${label} is not valid JSON`);
+  }
+  if (!Array.isArray(parsed)) throw new SystemError("invalid-adoption", `${label} must be a JSON array`);
+  return JSON.stringify(parsed);
+}
+function validatedOrigin(value) {
+  if (value === void 0 || value === null || value === "") return void 0;
+  if (typeof value !== "string") throw new SystemError("invalid-adoption", "adopted hub origin is not a URL");
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    throw new SystemError("invalid-adoption", "adopted hub origin is not a URL");
+  }
+  if (parsed.protocol !== "https:") throw new SystemError("invalid-adoption", "adopted hub origin must be https");
+  return value;
+}
+function hasCollectorIdentity(source) {
+  return (0, import_node_fs3.existsSync)((0, import_node_path3.join)(source, "collector", "state.json")) || (0, import_node_fs3.existsSync)((0, import_node_path3.join)(source, "collector", "collector.json"));
+}
+function readAdoptionSetup(source) {
+  const modernPath = (0, import_node_path3.join)(source, "config.json");
+  const legacyPath = (0, import_node_path3.join)(source, "hub-config.json");
+  if ((0, import_node_fs3.existsSync)(modernPath)) {
+    assertPrivateSourceFile(modernPath, "adopted setup");
+    const setup = readJsonObject(modernPath);
+    const role = setup.role;
+    if (setup.version !== 1 || typeof role !== "string" || !["local", "hub", "collector"].includes(role)) {
+      throw new SystemError("invalid-adoption", "adopted setup version or role is incompatible");
+    }
+    const port = Number(setup.port ?? 8081);
+    if (!Number.isInteger(port) || port < 1 || port > 65535) throw new SystemError("invalid-adoption", "adopted hub port is invalid");
+    return {
+      role,
+      port,
+      origin: validatedOrigin(setup.origin),
+      usersJson: normalizedJsonArray(setup.users, "HUB_BROWSER_USERS"),
+      collectorsJson: normalizedJsonArray(setup.collectors, "HUB_COLLECTORS"),
+      maxConnections: Number.isSafeInteger(setup.maxCollectorConnections) ? Number(setup.maxCollectorConnections) : void 0,
+      legacy: false
+    };
+  }
+  if ((0, import_node_fs3.existsSync)(legacyPath)) {
+    assertPrivateSourceFile(legacyPath, "adopted hub configuration");
+    const legacy = readJsonObject(legacyPath);
+    const hasHub = ["HUB_PUBLIC_ORIGIN", "HUB_BROWSER_USERS", "HUB_DATABASE_PATH", "HUB_HOST", "HUB_PORT"].some((key) => key in legacy);
+    const hasCollector = hasCollectorIdentity(source);
+    if (!hasHub && !hasCollector) throw new SystemError("invalid-adoption", "adopted configuration is neither a hub nor a collector setup");
+    return {
+      role: hasHub && hasCollector ? "local" : hasHub ? "hub" : "collector",
+      port: Number(legacy.HUB_PORT ?? 8081),
+      origin: validatedOrigin(legacy.HUB_PUBLIC_ORIGIN),
+      usersJson: normalizedJsonArray(legacy.HUB_BROWSER_USERS, "HUB_BROWSER_USERS"),
+      collectorsJson: normalizedJsonArray(legacy.HUB_COLLECTORS, "HUB_COLLECTORS"),
+      maxConnections: Number.isSafeInteger(Number(legacy.HUB_MAX_COLLECTOR_CONNECTIONS)) ? Number(legacy.HUB_MAX_COLLECTOR_CONNECTIONS) : void 0,
+      legacy: true
+    };
+  }
+  if (hasCollectorIdentity(source) && (0, import_node_fs3.existsSync)((0, import_node_path3.join)(source, "collector"))) {
+    return { role: "collector", port: 8081, legacy: true };
+  }
+  throw new SystemError("invalid-adoption", "adopted installation has no config.json or hub-config.json");
+}
+function resolveRole(options) {
+  const role = options.role ?? "local";
+  if (!["local", "hub", "collector"].includes(role)) {
+    throw new SystemError("invalid-role", "--role must be local, hub or collector");
+  }
+  if (options.adoptFrom) {
+    const setup = readAdoptionSetup(options.adoptFrom);
+    if (options.role !== void 0 && options.role !== setup.role && setup.role !== "local") {
+      throw new SystemError("role-mismatch", `the adopted setup is ${setup.role}; do not change its role during adoption`);
+    }
+    return options.role ?? setup.role;
+  }
+  return role;
+}
+function detectUserInstallations(options = {}) {
+  const roots = options.homeRoots ?? ["/home", "/root"];
+  const found = [];
+  for (const homeRoot of roots) {
+    if (!(0, import_node_fs3.existsSync)(homeRoot)) continue;
+    const homes = homeRoot === "/root" ? ["/root"] : (0, import_node_fs3.readdirSync)(homeRoot).map((entry) => (0, import_node_path3.join)(homeRoot, entry));
+    for (const home of homes) {
+      let stat;
+      try {
+        stat = (0, import_node_fs3.lstatSync)(home);
+      } catch {
+        continue;
+      }
+      if (!stat.isDirectory()) continue;
+      const unitDir = (0, import_node_path3.join)(home, ".config", "systemd", "user");
+      let units = [];
+      try {
+        units = (0, import_node_fs3.readdirSync)(unitDir);
+      } catch {
+        units = [];
+      }
+      for (const unitName of units) {
+        if (!/^rigscope(?:-[0-9a-f]{12})?(?:-(?:hub|collector))?\.service$/.test(unitName)) continue;
+        const unitPath = (0, import_node_path3.join)(unitDir, unitName);
+        let execStart = null;
+        try {
+          const line = (0, import_node_fs3.readFileSync)(unitPath, "utf8").split("\n").find((item) => item.startsWith("ExecStart="));
+          execStart = line ? line.slice("ExecStart=".length) : null;
+        } catch {
+        }
+        const stateCandidates = [(0, import_node_path3.join)(home, ".local", "state", "rigscope")];
+        const stateDir = stateCandidates.find((candidate) => (0, import_node_fs3.existsSync)(candidate)) ?? null;
+        found.push({ user: (0, import_node_path3.basename)(home), home, unitPath, unitName, execStart, stateDir });
+      }
+    }
+  }
+  return found;
+}
+function lockIsLive(path) {
+  try {
+    const stat = (0, import_node_fs3.lstatSync)(path);
+    if (!stat.isFile() || stat.size > 4096) return { exists: true, live: false, pid: null, ambiguous: true };
+    const owner = JSON.parse((0, import_node_fs3.readFileSync)(path, "utf8"));
+    const pid = owner.pid;
+    if (!Number.isSafeInteger(pid) || pid < 1) return { exists: true, live: false, pid: null, ambiguous: true };
+    try {
+      process.kill(pid, 0);
+      return { exists: true, live: true, pid, ambiguous: false };
+    } catch (error) {
+      const code = error.code;
+      if (code === "ESRCH") return { exists: true, live: false, pid, ambiguous: false };
+      return { exists: true, live: true, pid, ambiguous: true };
+    }
+  } catch (error) {
+    if (error.code === "ENOENT") return { exists: false, live: false, pid: null, ambiguous: false };
+    return { exists: true, live: false, pid: null, ambiguous: true };
+  }
+}
+function directoryLocks(directory) {
+  return [
+    (0, import_node_path3.join)(directory, "hub", "telemetry.sqlite.hub.lock"),
+    (0, import_node_path3.join)(directory, "run", "rigscope.lock"),
+    (0, import_node_path3.join)(directory, "collector", "collector-runtime.lock")
+  ];
+}
+function assertDirectoryStopped(directory, scope = "local") {
+  const components = typeof scope === "string" && (scope === "local" || scope === "hub" || scope === "collector") ? componentsForRole(scope) : componentSet(scope);
+  const locks = directoryLocks(directory).filter((path) => (!path.includes("/collector/") || components.collector) && (path.includes("/collector/") || components.hub));
+  for (const lock of locks) {
+    const state = lockIsLive(lock);
+    if (state.live || state.ambiguous) {
+      throw new SystemError(
+        "service-active",
+        `stop the existing installation before adoption; a live or ambiguous runtime lock exists: ${lock}`
+      );
+    }
+  }
+}
+function systemLockState(paths) {
+  const path = `${hubDatabasePath(paths)}.hub.lock`;
+  const state = lockIsLive(path);
+  return { live: state.live || state.ambiguous, path, pid: state.pid, ambiguous: state.ambiguous };
+}
+function assertSystemStartAllowed(paths, components) {
+  if (componentSet(components).hub) {
+    const lock = systemLockState(paths);
+    if (lock.live) {
+      throw new SystemError("duplicate-runtime", `a hub runtime already owns ${lock.path}; stop it before starting another`);
+    }
+  }
+}
+function detectPowerDriver(moduleRoot = "/sys/module") {
+  const candidates = ["intel_rapl_msr", "intel_rapl_common", "intel_rapl_tpmi", "intel_rapl", "amd_energy"];
+  return candidates.filter((name) => (0, import_node_fs3.existsSync)((0, import_node_path3.join)(moduleRoot, name)));
+}
+function readPasswd(path = "/etc/passwd") {
+  const users = /* @__PURE__ */ new Map();
+  let lines;
+  try {
+    lines = (0, import_node_fs3.readFileSync)(path, "utf8").split("\n");
+  } catch {
+    return users;
+  }
+  for (const line of lines) {
+    const parts = line.split(":");
+    if (parts.length < 4) continue;
+    const uid = Number(parts[2]);
+    const gid = Number(parts[3]);
+    if (parts[0] && Number.isSafeInteger(uid) && Number.isSafeInteger(gid)) users.set(parts[0], { uid, gid });
+  }
+  return users;
+}
+function readGroups(path = "/etc/group") {
+  const groups = /* @__PURE__ */ new Map();
+  let lines;
+  try {
+    lines = (0, import_node_fs3.readFileSync)(path, "utf8").split("\n");
+  } catch {
+    return groups;
+  }
+  for (const line of lines) {
+    const parts = line.split(":");
+    if (parts.length < 4) continue;
+    const gid = Number(parts[2]);
+    if (!parts[0] || !Number.isSafeInteger(gid)) continue;
+    groups.set(parts[0], { gid, members: parts[3] ? parts[3].split(",").filter(Boolean) : [] });
+  }
+  return groups;
+}
+function modeString(mode) {
+  return `0${(mode & 511).toString(8).padStart(3, "0")}`;
+}
+function inspectPowerAccess(options = {}) {
+  const paths = validateSystemPaths(options.paths ?? {});
+  const accounts = validateAccounts(options.accounts ?? {});
+  const users = readPasswd(options.passwdFile ?? "/etc/passwd");
+  const groups = readGroups(options.groupFile ?? "/etc/group");
+  const collector = users.get(accounts.collector) ?? null;
+  const group = groups.get(accounts.powerGroup) ?? null;
+  const collectorGids = collector ? [collector.gid, ...group?.members.includes(accounts.collector) ? [group.gid] : []] : [];
+  const rulePath = options.rulePath ?? raplRulePath(paths);
+  const sysusers = options.sysusersPath ?? powerSysusersPath(paths);
+  let ruleText = null;
+  try {
+    ruleText = (0, import_node_fs3.readFileSync)(rulePath, "utf8");
+  } catch {
+    ruleText = null;
+  }
+  const requiredFragments = [
+    'SUBSYSTEM=="powercap"',
+    'KERNEL=="intel-rapl:[0-9]*"',
+    'ATTR{name}=="package*"',
+    `/sys%p/energy_uj`,
+    `/sys%p/max_energy_range_uj`,
+    `chgrp ${accounts.powerGroup}`,
+    "chmod 0440"
+  ];
+  const compliant = ruleText !== null && requiredFragments.every((fragment) => ruleText.includes(fragment));
+  const domains = [];
+  let entries = [];
+  try {
+    entries = (0, import_node_fs3.readdirSync)(paths.powercapRoot);
+  } catch {
+    entries = [];
+  }
+  for (const entry of entries.filter((name) => /^intel-rapl:\d+$/.test(name)).sort()) {
+    const domainPath = (0, import_node_path3.join)(paths.powercapRoot, entry);
+    let name = entry;
+    try {
+      name = (0, import_node_fs3.readFileSync)((0, import_node_path3.join)(domainPath, "name"), "utf8").trim() || entry;
+    } catch {
+    }
+    if (!/^package/.test(name)) continue;
+    const energyPath = (0, import_node_path3.join)(domainPath, "energy_uj");
+    const maxRangePath = (0, import_node_path3.join)(domainPath, "max_energy_range_uj");
+    const readStat = (path) => {
+      if (options.statOverride) {
+        const override = options.statOverride(path);
+        return override === null ? null : { mode: modeString(override.mode), uid: override.uid, gid: override.gid };
+      }
+      try {
+        const stat = (0, import_node_fs3.statSync)(path);
+        return { mode: modeString(stat.mode), uid: stat.uid, gid: stat.gid };
+      } catch {
+        return null;
+      }
+    };
+    const energyStat = readStat(energyPath);
+    const maxStat = readStat(maxRangePath);
+    const energyMode = energyStat === null ? 0 : Number.parseInt(energyStat.mode, 8);
+    const readable = energyStat !== null && (collector !== null && (energyStat.uid === collector.uid && (energyMode & 256) !== 0 || collectorGids.includes(energyStat.gid) && (energyMode & 32) !== 0 || (energyMode & 4) !== 0));
+    domains.push({
+      path: domainPath,
+      name,
+      energyPath,
+      energyExists: energyStat !== null,
+      energy: energyStat === null ? null : {
+        ...energyStat,
+        readable,
+        worldReadable: (energyMode & 4) !== 0,
+        writable: (energyMode & 146) !== 0
+      },
+      maxRangePath,
+      maxRangeExists: maxStat !== null,
+      maxRange: maxStat
+    });
+  }
+  const problems = [];
+  if (domains.length === 0) problems.push("no top-level package powercap counters were found");
+  if (!collector) problems.push(`collector account ${accounts.collector} does not exist`);
+  if (!group) problems.push(`power group ${accounts.powerGroup} does not exist`);
+  if (collector && group && !group.members.includes(accounts.collector)) {
+    problems.push(`collector account ${accounts.collector} is not a member of ${accounts.powerGroup}`);
+  }
+  if (!compliant) problems.push(`persistent udev rule is missing or not compliant: ${rulePath}`);
+  if (!(0, import_node_fs3.existsSync)(sysusers)) problems.push(`power sysusers definition is missing: ${sysusers}`);
+  for (const domain of domains) {
+    if (!domain.energyExists) problems.push(`${domain.name}: energy_uj is unavailable`);
+    else if (domain.energy?.worldReadable) problems.push(`${domain.name}: energy_uj is world-readable`);
+    else if (domain.energy?.writable) problems.push(`${domain.name}: energy_uj is writable`);
+    else if (!domain.energy?.readable) problems.push(`${domain.name}: collector cannot read energy_uj`);
+  }
+  const worldReadable = domains.some((domain) => domain.energy?.worldReadable === true);
+  const writableByCollector = domains.some((domain) => domain.energy?.writable === true);
+  const collectorCanRead = domains.length > 0 && domains.every((domain) => domain.energy?.readable === true);
+  return {
+    available: domains.length > 0,
+    driver: detectPowerDriver(options.moduleRoot ?? "/sys/module"),
+    domains,
+    collectorUser: accounts.collector,
+    collectorUid: collector?.uid ?? null,
+    collectorGids,
+    group: { name: accounts.powerGroup, exists: group !== null, gid: group?.gid ?? null, members: group?.members ?? [] },
+    rule: { path: rulePath, present: ruleText !== null, compliant },
+    sysusers: { path: sysusers, present: (0, import_node_fs3.existsSync)(sysusers) },
+    collectorCanRead,
+    persistent: compliant && group !== null && collector !== null && group.members.includes(accounts.collector),
+    worldReadable,
+    writableByCollector,
+    problems
+  };
+}
+async function backupDatabase(source, output, host) {
+  ensureDirectory((0, import_node_path3.dirname)(output), 448, true);
+  const db = new import_node_sqlite.DatabaseSync(source, { readOnly: true, timeout: 5e3 });
+  try {
+    await (0, import_node_sqlite.backup)(db, output);
+  } finally {
+    db.close();
+  }
+  (0, import_node_fs3.chmodSync)(output, 384);
+  const check = new import_node_sqlite.DatabaseSync(output, { readOnly: true });
+  try {
+    const result = check.prepare("PRAGMA integrity_check").get();
+    if (!result || Object.values(result)[0] !== "ok") throw new SystemError("invalid-backup", `backup integrity check failed: ${output}`);
+  } finally {
+    check.close();
+  }
+  void host;
+}
+function databaseSchema(path) {
+  if (!(0, import_node_fs3.existsSync)(path)) return null;
+  const db = new import_node_sqlite.DatabaseSync(path, { readOnly: true, timeout: 5e3 });
+  try {
+    const table = db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='schema_migrations'").get();
+    if (!table) return null;
+    const row = db.prepare("SELECT MAX(version) AS version FROM schema_migrations").get();
+    return row && Number.isSafeInteger(Number(row.version)) ? Number(row.version) : null;
+  } finally {
+    db.close();
+  }
+}
+function replaceDatabaseFromBackup(backupPath, target, safetyBackup, host) {
+  assertPrivateSourceFile(backupPath, "database backup");
+  const backup = new import_node_sqlite.DatabaseSync(backupPath, { readOnly: true });
+  try {
+    if (Object.values(backup.prepare("PRAGMA integrity_check").get())[0] !== "ok") throw new SystemError("invalid-backup", "rollback backup integrity failed");
+  } finally {
+    backup.close();
+  }
+  ensureDirectory((0, import_node_path3.dirname)(target), 448, true);
+  if (safetyBackup !== null && (0, import_node_fs3.existsSync)(target)) {
+    void host;
+  }
+  const temporary = (0, import_node_path3.join)((0, import_node_path3.dirname)(target), `.restore-${process.pid}-${Date.now()}.sqlite`);
+  (0, import_node_fs3.copyFileSync)(backupPath, temporary);
+  (0, import_node_fs3.chmodSync)(temporary, 384);
+  for (const sidecar of [`${target}-wal`, `${target}-shm`]) {
+    try {
+      (0, import_node_fs3.unlinkSync)(sidecar);
+    } catch {
+    }
+  }
+  (0, import_node_fs3.renameSync)(temporary, target);
+  (0, import_node_fs3.chmodSync)(target, 384);
+}
+function newestTimestamp() {
+  return (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+}
+function adoptUserState(options) {
+  const source = (0, import_node_path3.resolve)(options.source);
+  if (!(0, import_node_fs3.existsSync)(source)) throw new SystemError("invalid-adoption", `user installation does not exist: ${source}`);
+  if (isWithin(options.paths.prefix, source) || isWithin(options.paths.stateDir, source) || isWithin(source, options.paths.stateDir)) {
+    throw new SystemError("invalid-adoption", "adoption source and system paths must not overlap");
+  }
+  assertDirectoryStopped(source, options.role);
+  const setup = readAdoptionSetup(source);
+  if (setup.role !== options.role && setup.role !== "local") throw new SystemError("invalid-adoption", "adopted setup role is incompatible");
+  const { port, origin } = setup;
+  if (!Number.isInteger(port) || port < 1 || port > 65535) throw new SystemError("invalid-adoption", "adopted hub port is invalid");
+  const copied = [];
+  const warnings = [];
+  const targetDatabase = hubDatabasePath(options.paths);
+  const targetCollector = collectorStatePath(options.paths);
+  if (options.apply && (0, import_node_fs3.existsSync)(targetDatabase)) {
+    throw new SystemError("destination-exists", `refusing to overwrite ${targetDatabase}`);
+  }
+  const hubEnv = options.role === "collector" ? null : [
+    "# Adopted by `rigscope system install --adopt-user-state`.",
+    "# Credentials were copied into this root-owned 0600 file; the original user setup is untouched.",
+    envLine("HUB_DATABASE_PATH", targetDatabase),
+    envLine("HUB_STATE_FILE", hubEnrollmentPath(options.paths)),
+    ...origin ? [envLine("HUB_PUBLIC_ORIGIN", origin), envLine("HUB_SOCKET_PATH", hubSocketPath(options.paths))] : [envLine("HUB_HOST", "127.0.0.1"), envLine("HUB_PORT", String(port))],
+    ...setup.usersJson !== void 0 ? [envLine("HUB_BROWSER_USERS", setup.usersJson)] : [],
+    ...setup.collectorsJson !== void 0 ? [envLine("HUB_COLLECTORS", setup.collectorsJson)] : [],
+    ...setup.maxConnections !== void 0 ? [envLine("HUB_MAX_COLLECTOR_CONNECTIONS", String(setup.maxConnections))] : [],
+    ""
+  ].join("\n");
+  const collectorEnv = options.role === "hub" ? null : [
+    "# Adopted by `rigscope system install --adopt-user-state`.",
+    envLine("COLLECTOR_MODE", "real"),
+    envLine("COLLECTOR_STATE_FILE", targetCollector),
+    ""
+  ].join("\n");
+  void options.accounts;
+  return {
+    hubEnv,
+    collectorEnv,
+    record: {
+      source,
+      copiedAt: new Date(options.now()).toISOString(),
+      files: copied,
+      reversible: true
+    },
+    warnings,
+    remote: origin !== void 0,
+    port
+  };
+}
+function copyAdoptedTree(source, target, copied, skipLocks = true) {
+  const visit = (current, destination) => {
+    const stat = (0, import_node_fs3.lstatSync)(current);
+    if (stat.isSymbolicLink()) return;
+    if (stat.isDirectory()) {
+      (0, import_node_fs3.mkdirSync)(destination, { recursive: true, mode: 448 });
+      for (const entry of (0, import_node_fs3.readdirSync)(current)) visit((0, import_node_path3.join)(current, entry), (0, import_node_path3.join)(destination, entry));
+      return;
+    }
+    if (!stat.isFile()) return;
+    if (skipLocks && /\.(lock|sock)$/.test(current)) return;
+    (0, import_node_fs3.mkdirSync)((0, import_node_path3.dirname)(destination), { recursive: true, mode: 448 });
+    (0, import_node_fs3.copyFileSync)(current, destination);
+    (0, import_node_fs3.chmodSync)(destination, 384);
+    copied.push({ source: current, target: destination, sha256: sha256File(destination), bytes: stat.size });
+  };
+  visit(source, target);
+}
+async function performAdoptionCopyAsync(options) {
+  const { source, paths, role, host, copy } = options;
+  assertDirectoryStopped(source, role);
+  const targetDatabase = hubDatabasePath(paths);
+  const sourceDatabase = (0, import_node_path3.join)(source, "hub", "telemetry.sqlite");
+  if (role !== "collector" && (0, import_node_fs3.existsSync)(sourceDatabase) && !(0, import_node_fs3.existsSync)(targetDatabase)) {
+    assertPrivateSourceFile(sourceDatabase, "adopted database");
+    ensureDirectory((0, import_node_path3.join)(paths.stateDir, "hub"), 448, true);
+    await backupDatabase(sourceDatabase, targetDatabase, host);
+    copy.record.files.push({
+      source: sourceDatabase,
+      target: targetDatabase,
+      sha256: sha256File(targetDatabase),
+      bytes: (0, import_node_fs3.statSync)(targetDatabase).size
+    });
+  }
+  const sourceCollectorState = [
+    (0, import_node_path3.join)(source, "collector", "state.json"),
+    (0, import_node_path3.join)(source, "collector", "collector.json")
+  ].find((candidate) => (0, import_node_fs3.existsSync)(candidate));
+  if (role !== "hub" && sourceCollectorState) {
+    assertPrivateSourceFile(sourceCollectorState, "adopted collector state");
+    ensureDirectory((0, import_node_path3.join)(paths.stateDir, "collector"), 448, true);
+    const targetCollector = collectorStatePath(paths);
+    (0, import_node_fs3.copyFileSync)(sourceCollectorState, targetCollector);
+    (0, import_node_fs3.chmodSync)(targetCollector, 384);
+    copy.record.files.push({
+      source: sourceCollectorState,
+      target: targetCollector,
+      sha256: sha256File(targetCollector),
+      bytes: (0, import_node_fs3.statSync)(targetCollector).size
+    });
+    const outbox = (0, import_node_path3.join)(source, "collector", "outbox");
+    if ((0, import_node_fs3.existsSync)(outbox)) copyAdoptedTree(outbox, (0, import_node_path3.join)(paths.stateDir, "collector", "outbox"), copy.record.files);
+  }
+  const enrollment = (0, import_node_path3.join)(source, "hub", "enrollment.json");
+  if (role !== "collector" && (0, import_node_fs3.existsSync)(enrollment)) {
+    const target = hubEnrollmentPath(paths);
+    (0, import_node_fs3.copyFileSync)(enrollment, target);
+    (0, import_node_fs3.chmodSync)(target, 384);
+    copy.record.files.push({ source: enrollment, target, sha256: sha256File(target), bytes: (0, import_node_fs3.statSync)(target).size });
+  }
+}
+function writeSysusersFiles(paths, accounts, role, power, host) {
+  ensureDirectory(paths.sysusersDir, 493);
+  writeManagedFile(sysusersPath(paths), renderSysusers(paths, accounts, role), 420, true);
+  if (power) {
+    writeManagedFile(powerSysusersPath(paths), renderPowerSysusers(paths, accounts), 420, true);
+  }
+  runRequired(host, "systemd-sysusers", [], "system account creation");
+  assertSystemAccounts(host, accounts, power, [...COMPONENTS]);
+}
+function assertSystemAccounts(host, accounts, power, required = COMPONENTS) {
+  const checked = required.map((component) => component === "hub" ? accounts.hub : accounts.collector);
+  for (const account of checked) {
+    const fields = runRequired(host, "getent", ["passwd", account], "service account inspection").stdout.trim().split(":");
+    if (fields[0] !== account || !(Number(fields[2]) > 0) || !(Number(fields[3]) > 0) || !/\/(nologin|false)$/.test(fields[6] ?? "")) {
+      throw new SystemError("unsafe-account", `service account ${account} must be non-root with a nologin shell`);
+    }
+  }
+  if (power) {
+    const fields = runRequired(host, "getent", ["group", accounts.powerGroup], "power group inspection").stdout.trim().split(":");
+    const members = (fields[3] ?? "").split(",").filter(Boolean);
+    if (!(Number(fields[2]) > 0) || members.length !== 1 || members[0] !== accounts.collector) {
+      throw new SystemError("unsafe-group", "RAPL group must contain only the dedicated collector");
+    }
+    const passwd = runRequired(host, "getent", ["passwd"], "power group primary membership inspection").stdout;
+    if (passwd.split("\n").some((line) => {
+      const p = line.split(":");
+      return p[3] === fields[2] && p[0] !== accounts.collector;
+    })) {
+      throw new SystemError("unsafe-group", "another account uses the RAPL group as its primary group");
+    }
+  }
+}
+function writePowerRule(paths, accounts) {
+  ensureDirectory(paths.udevRulesDir, 493);
+  writeManagedFile(raplRulePath(paths), renderRaplRule(accounts), 420, true);
+}
+function powerOriginalPath(paths) {
+  return (0, import_node_path3.join)(paths.stateDir, POWER_STATE_FILE_NAME);
+}
+function capturePowerOriginals(paths) {
+  const files = {};
+  for (const domain of packageDomainPaths(paths.powercapRoot)) {
+    for (const name of ["energy_uj", "max_energy_range_uj"]) {
+      const path = (0, import_node_path3.join)(domain, name);
+      try {
+        const stat = (0, import_node_fs3.statSync)(path);
+        files[path] = { mode: stat.mode & 511, uid: stat.uid, gid: stat.gid };
+      } catch {
+      }
+    }
+  }
+  atomicWrite(powerOriginalPath(paths), `${JSON.stringify({ files }, null, 2)}
+`, 384);
+}
+function applyPowerAccess(paths, accounts, host) {
+  for (const domain of packageDomainPaths(paths.powercapRoot)) {
+    for (const name of ["energy_uj", "max_energy_range_uj"]) {
+      const path = (0, import_node_path3.join)(domain, name);
+      if (!(0, import_node_fs3.existsSync)(path)) continue;
+      runRequired(host, "chgrp", [accounts.powerGroup, path], `power counter group ${path}`);
+      runRequired(host, "chmod", ["0440", path], `power counter mode ${path}`);
+    }
+  }
+}
+function resumePowerRule(paths, host) {
+  runRequired(host, "udevadm", ["control", "--reload-rules"], "udev rule reload");
+  runRequired(host, "udevadm", ["trigger", "--subsystem-match=powercap", "--action=change"], "powercap rule application");
+  runRequired(host, "udevadm", ["settle", "--timeout=10"], "powercap event completion");
+}
+function packageDomainPaths(root) {
+  try {
+    return (0, import_node_fs3.readdirSync)(root).filter((entry) => /^intel-rapl:\d+$/.test(entry)).map((entry) => (0, import_node_path3.join)(root, entry)).filter((path) => {
+      try {
+        return /^package/.test((0, import_node_fs3.readFileSync)((0, import_node_path3.join)(path, "name"), "utf8").trim());
+      } catch {
+        return false;
+      }
+    }).sort();
+  } catch {
+    return [];
+  }
+}
+function restorePowerOriginals(paths, host) {
+  const restored = [];
+  let originals = null;
+  try {
+    originals = readJsonObject(powerOriginalPath(paths));
+  } catch {
+    originals = null;
+  }
+  const files = { ...originals?.files ?? {} };
+  for (const domain of packageDomainPaths(paths.powercapRoot)) {
+    for (const name of ["energy_uj", "max_energy_range_uj"]) {
+      const path = (0, import_node_path3.join)(domain, name);
+      if (!(0, import_node_fs3.existsSync)(path)) continue;
+      const original = files[path];
+      if (original) {
+        runRequired(host, "chown", [`${original.uid}:${original.gid}`, path], "restore counter ownership");
+        runRequired(host, "chmod", [modeString(original.mode).slice(1), path], "restore counter mode");
+      } else if (name === "energy_uj") {
+        runRequired(host, "chown", ["root:root", path], "restore counter ownership");
+        runRequired(host, "chmod", ["0400", path], "restore counter mode");
+      } else {
+        runRequired(host, "chown", ["root:root", path], "restore counter ownership");
+        runRequired(host, "chmod", ["0444", path], "restore counter mode");
+      }
+      restored.push(path);
+    }
+  }
+  try {
+    (0, import_node_fs3.unlinkSync)(powerOriginalPath(paths));
+  } catch {
+  }
+  return restored;
+}
+function systemdActive(host, unit) {
+  return host.run("systemctl", ["is-active", "--quiet", unit], { timeoutMs: 1e3 }).status === 0;
+}
+function systemdEnabled(host, unit) {
+  return host.run("systemctl", ["is-enabled", "--quiet", unit]).status === 0;
+}
+function stopUnits(host, units) {
+  for (const unit of units) {
+    const stopped = host.run("systemctl", ["stop", unit]);
+    if (stopped.status !== 0) {
+      const load = host.run("systemctl", ["show", unit, "--property=LoadState", "--value"]).stdout.trim();
+      if (!["not-found", "bad-setting", "error"].includes(load) || systemdActive(host, unit)) {
+        throw new SystemError("stop-failed", `could not stop ${unit}; no runtime files may be restored`);
+      }
+    }
+  }
+  if (units.some((unit) => systemdActive(host, unit))) throw new SystemError("service-active", "system services did not stop; no files were restored");
+}
+function startUnits(host, units) {
+  runRequired(host, "systemctl", ["daemon-reload"], "systemd daemon-reload");
+  for (const unit of units) runRequired(host, "systemctl", ["start", unit], `starting ${unit}`);
+}
+function enableUnits(host, units) {
+  runRequired(host, "systemctl", ["daemon-reload"], "systemd daemon-reload");
+  for (const unit of units) runRequired(host, "systemctl", ["enable", unit], `enabling ${unit}`);
+}
+async function waitForUnits(host, units, timeoutMs) {
+  if (timeoutMs <= 0) return units.every((unit) => systemdActive(host, unit));
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (units.every((unit) => systemdActive(host, unit))) return true;
+    await new Promise((resolveDelay) => setTimeout(resolveDelay, 250));
+  }
+  return units.every((unit) => systemdActive(host, unit));
+}
+function readHubEnvironment(paths) {
+  return readEnvDocument(hubEnvPath(paths))?.values ?? {};
+}
+async function verifySystemHealth(paths, state, host, timeoutMs, components = enabledComponents(state)) {
+  if (host.verifyHealth) return host.verifyHealth(paths, state, timeoutMs);
+  const selected = componentSet(components);
+  const selectedUnits = COMPONENTS.filter((component) => selected[component]).map(unitFor);
+  if (selectedUnits.length === 0) return;
+  const deadline = Date.now() + timeoutMs;
+  if (!await waitForUnits(host, selectedUnits, timeoutMs)) throw new SystemError("startup-failed", "system units did not become active");
+  if (selected.hub) {
+    const env = readHubEnvironment(paths);
+    const target = env.HUB_PUBLIC_ORIGIN ? { kind: "unix", socketPath: hubSocketPath(paths), hostHeader: new URL(env.HUB_PUBLIC_ORIGIN).host, path: "/api/health" } : { kind: "loopback", host: "127.0.0.1", port: Number(env.HUB_PORT ?? 8081), path: "/api/health" };
+    const health = await waitForHealth(target, { expectedVersion: state.currentVersion, deadlineMs: Math.max(100, deadline - Date.now()) });
+    if (!health.ok) throw new SystemError("startup-failed", `system hub readiness failed: ${health.last.error}`);
+    const report = runRequired(
+      host,
+      state.nodePath,
+      [(0, import_node_path3.join)(paths.prefix, "current/dist/ops.cjs"), "inspect", "--database", hubDatabasePath(paths), "--json"],
+      "activated database verification",
+      { timeoutMs: Math.max(100, deadline - Date.now()) }
+    );
+    const info = JSON.parse(report.stdout);
+    if (!info.integrityOk || info.newerSchema || info.ledgerProblem || info.schemaVersion !== info.supportedSchemaVersion) {
+      throw new SystemError("database-unready", "activated hub database schema/integrity is not ready");
+    }
+    if (!info.tables?.some((table) => table.name === "users" && Number(table.rows) > 0)) {
+      throw new SystemError("users-unconfigured", "hub has no managed browser users; configure its private bootstrap users before first start");
+    }
+  }
+  if (selected.collector) {
+    let problem = "no sampling marker";
+    while (Date.now() < deadline) {
+      try {
+        const marker = readJsonObject((0, import_node_path3.join)(paths.stateDir, "collector/health.json"));
+        const lease = readJsonObject((0, import_node_path3.join)(paths.stateDir, "collector/collector-runtime.lock"));
+        if (marker.pid !== lease.pid || !Number.isSafeInteger(marker.pid)) throw new Error("sampling marker belongs to another process");
+        process.kill(Number(marker.pid), 0);
+        if (marker.version !== state.currentVersion || !Number.isFinite(marker.sampledAt) || Date.now() - Number(marker.sampledAt) > 15e3) throw new Error("collector version or sampling freshness is wrong");
+        return;
+      } catch (error) {
+        problem = error instanceof Error ? error.message : String(error);
+      }
+      await new Promise((resolve3) => setTimeout(resolve3, 100));
+    }
+    throw new SystemError("collector-unready", `system collector did not sample: ${problem}`);
+  }
+}
+function chownAccount(paths, owner, group, host) {
+  for (const path of paths) {
+    if (!(0, import_node_fs3.existsSync)(path)) continue;
+    runRequired(host, "chown", ["-R", `${owner}:${group}`, path], `ownership ${path}`);
+  }
+}
+function chmodTree(path, host) {
+  if (!(0, import_node_fs3.existsSync)(path)) return;
+  runRequired(host, "chmod", ["-R", "u=rwX,go=rX", path], `release permissions ${path}`);
+}
+function pickRollbackBackup(state, previousSchema) {
+  const backups = Object.values(state.backups).sort((a, b) => a.createdAt.localeCompare(b.createdAt));
+  if (previousSchema === null) return null;
+  return [...backups].reverse().find((backup) => backup.fromVersion === state.previousVersion && backup.toVersion === state.currentVersion && backup.schemaVersion !== null && backup.schemaVersion <= previousSchema) ?? null;
+}
+async function recoverFailedUpgrade(options) {
+  stopUnits(options.host, options.units);
+  assertDirectoryStopped(options.paths.stateDir);
+  replaceSymlink((0, import_node_path3.join)(options.paths.prefix, "current"), options.oldCurrent, options.host);
+  if (options.oldPrevious === null) removeSymlink((0, import_node_path3.join)(options.paths.prefix, "previous"));
+  else replaceSymlink((0, import_node_path3.join)(options.paths.prefix, "previous"), options.oldPrevious, options.host);
+  const database = hubDatabasePath(options.paths);
+  let afterSchema = null;
+  try {
+    afterSchema = databaseSchema(database);
+  } catch {
+    afterSchema = null;
+  }
+  if (options.backupPath !== null && (0, import_node_fs3.existsSync)(options.backupPath) && (afterSchema === null || options.beforeSchema === null || afterSchema > options.beforeSchema)) {
+    await backupDatabase(database, (0, import_node_path3.join)(options.paths.stateDir, "backups", `failed-upgrade-${newestTimestamp()}.sqlite`), options.host);
+    replaceDatabaseFromBackup(options.backupPath, database, null, options.host);
+    runRequired(options.host, "chown", [`${options.state.accounts.hub}:${options.state.accounts.hub}`, database], "restored database ownership");
+  }
+  options.state.previousVersion = options.oldPrevious === null ? null : (0, import_node_path3.basename)(options.oldPrevious);
+  options.state.currentVersion = (0, import_node_path3.basename)(options.oldCurrent);
+  writeSystemState(options.paths, options.state);
+  if (options.activeComponents.length > 0) {
+    startUnits(options.host, options.units);
+    await verifySystemHealth(options.paths, options.state, options.host, 2e4, options.activeComponents);
+  }
+}
+function assertManagedFileOwnership(paths, path) {
+  if (!isDefaultSystemLayout(paths)) return;
+  if (!(0, import_node_fs3.existsSync)(path)) return;
+  const stat = (0, import_node_fs3.lstatSync)(path);
+  if (stat.isSymbolicLink() || !stat.isFile()) throw new SystemError("unsafe-path", `${path} must be a regular managed file`);
+  if (stat.uid !== 0) throw new SystemError("insecure-ownership", `${path} must be root-owned before replacement`);
+  if ((stat.mode & 18) !== 0) throw new SystemError("insecure-permissions", `${path} must not be group/world-writable`);
+}
+function writeUnitFile(paths, unit, content, replace) {
+  const path = (0, import_node_path3.join)(paths.unitsDir, unit);
+  assertManagedFileOwnership(paths, path);
+  writeManagedFile(path, content, 420, replace);
+}
+function currentReleaseOrThrow(paths) {
+  const current = currentReleaseDir(paths);
+  if (current === null) throw new SystemError("invalid-state", "the active release is missing; reinstall or upgrade first");
+  return current;
+}
+function ensureComponentSetup(options) {
+  const { paths, accounts, nodePath, component, power, host } = options;
+  ensureDirectory(paths.prefix, 493);
+  ensureDirectory(paths.configDir, 493);
+  ensureDirectory(paths.stateDir, 493);
+  ensureDirectory(paths.unitsDir, 493);
+  ensureDirectory((0, import_node_path3.join)(paths.stateDir, "hub"), 448, true);
+  ensureDirectory((0, import_node_path3.join)(paths.stateDir, "hub", "run"), 448, true);
+  ensureDirectory((0, import_node_path3.join)(paths.stateDir, "collector"), 448, true);
+  ensureDirectory((0, import_node_path3.join)(paths.stateDir, "backups"), 448, true);
+  const release = currentReleaseOrThrow(paths);
+  void release;
+  writeSysusersFiles(paths, accounts, "local", power, host);
+  if (component === "hub") {
+    if (!(0, import_node_fs3.existsSync)(hubEnvPath(paths))) {
+      const env = hubEnvTemplate(paths);
+      writeManagedFile(hubEnvPath(paths), env, 384, false);
+    }
+    if (!(0, import_node_fs3.existsSync)((0, import_node_path3.join)(paths.unitsDir, UNIT_NAMES.hub))) {
+      const env = readHubEnvironment(paths);
+      const remote = env.HUB_PUBLIC_ORIGIN !== void 0 && env.HUB_PUBLIC_ORIGIN !== "";
+      const unit = renderSystemHubUnit({
+        paths,
+        accounts,
+        nodePath,
+        database: hubDatabasePath(paths),
+        enrollment: hubEnrollmentPath(paths),
+        socket: hubSocketPath(paths),
+        remote,
+        powerAccess: false
+      });
+      writeUnitFile(paths, UNIT_NAMES.hub, `${unit}
+`, false);
+    }
+  } else {
+    if (!(0, import_node_fs3.existsSync)(collectorEnvPath(paths))) {
+      writeManagedFile(collectorEnvPath(paths), collectorEnvTemplate(), 384, false);
+    }
+    const unit = renderSystemCollectorUnit({
+      paths,
+      accounts,
+      nodePath,
+      collectorState: collectorStatePath(paths),
+      powerAccess: power
+    });
+    writeUnitFile(paths, UNIT_NAMES.collector, `${unit}
+`, true);
+  }
+  const validation = runRequired(
+    host,
+    "systemd-analyze",
+    ["verify", "--man=no", (0, import_node_path3.join)(paths.unitsDir, unitFor(component))],
+    "native systemd unit validation"
+  );
+  if (/path is not absolute|bad unit file|fatal error|unknown (?:key|lvalue)|ignoring/i.test(validation.stderr)) {
+    throw new SystemError("invalid-unit", "native systemd validation rejected a generated directive");
+  }
+  if (component === "hub") chownAccount([(0, import_node_path3.join)(paths.stateDir, "hub")], accounts.hub, accounts.hub, host);
+  if (component === "collector") chownAccount([(0, import_node_path3.join)(paths.stateDir, "collector")], accounts.collector, accounts.collector, host);
+}
+function ensurePowerAccess(paths, accounts, host) {
+  if (!(0, import_node_fs3.existsSync)(powerOriginalPath(paths))) capturePowerOriginals(paths);
+  writePowerRule(paths, accounts);
+  resumePowerRule(paths, host);
+  applyPowerAccess(paths, accounts, host);
+}
+function planSystemInstall(options) {
+  const paths = validateSystemPaths(options.paths);
+  const accounts = validateAccounts(options.accounts);
+  const role = resolveRole(options);
+  const preset = componentSet(componentsForRole(role));
+  const power = options.power !== false && preset.collector;
+  const initial = options.enable === true ? preset : { hub: false, collector: false };
+  const files = [
+    { path: (0, import_node_path3.join)(paths.prefix, "current"), mode: "symlink", purpose: "active root-owned release" },
+    { path: hubEnvPath(paths), mode: "0600", purpose: "root-owned hub configuration" },
+    { path: collectorEnvPath(paths), mode: "0600", purpose: "root-owned collector configuration" },
+    { path: sysusersPath(paths), mode: "0644", purpose: "dedicated nologin accounts" },
+    ...COMPONENTS.map((component) => ({ path: (0, import_node_path3.join)(paths.unitsDir, unitFor(component)), mode: "0644", purpose: `${component} boot unit` }))
+  ];
+  if (power) {
+    files.push({ path: raplRulePath(paths), mode: "0644", purpose: "package RAPL read rule" });
+    files.push({ path: powerSysusersPath(paths), mode: "0644", purpose: "collector-only power group membership" });
+  }
+  const commands = [
+    "systemd-sysusers",
+    "systemctl daemon-reload",
+    ...power ? ["udevadm control --reload-rules", "udevadm trigger --subsystem-match=powercap --action=change"] : [],
+    ...options.enable ? unitNamesForComponents(initial).map((unit) => `systemctl enable ${unit}`) : [],
+    ...options.start ? unitNamesForComponents(initial).map((unit) => `systemctl start ${unit}`) : []
+  ];
+  const notes = [
+    "Nothing is changed without --apply and root.",
+    options.adoptFrom ? `Adopts ${(0, import_node_path3.resolve)(options.adoptFrom)} by copy only; the original user setup is preserved.` : "Existing user services are not modified.",
+    "One complete package: both runtimes, units and accounts are installed; --role only sets the initial enabled preset.",
+    "Hub and collector use separate unprivileged accounts; Node gets no capabilities.",
+    ...options.enable && preset.hub ? ["Enabling the hub creates its owner account once and prints the password once."] : [],
+    ...options.enable && preset.collector ? ["A collector with no destination pairs with a configured colocated hub, otherwise it waits for `system connect`."] : []
+  ];
+  return { operation: "install", apply: options.apply === true, role, components: initial, paths, accounts, commands, files, notes };
+}
+async function installSystem(options) {
+  const host = options.host ?? createSystemHost();
+  const now = options.now ?? Date.now;
+  const paths = validateSystemPaths(options.paths);
+  const accounts = validateAccounts(options.accounts);
+  const role = resolveRole(options);
+  const plan = planSystemInstall({ ...options, paths, accounts, role });
+  if (options.apply !== true) return { operation: "install", ok: true, apply: false, message: "plan only", plan };
+  assertApply(host);
+  const existing = readSystemState(paths);
+  if (existing?.active === true) {
+    throw new SystemError("already-installed", "a system installation already exists; use `rigscope system upgrade` or uninstall first");
+  }
+  const conflicts = detectUserInstallations({ homeRoots: options.homeRoots });
+  if (conflicts.length > 0 && options.adoptFrom === void 0 && options.allowUserConflicts !== true) {
+    const detail = conflicts.map((item) => `${item.user}:${item.unitName}`).join(", ");
+    throw new SystemError(
+      "user-installation-present",
+      `existing user service(s) detected (${detail}); stop them and use --adopt-user-state for explicit copy-based adoption`
+    );
+  }
+  assertSystemStartAllowed(paths, options.start === true ? componentsForRole(role) : { hub: false, collector: false });
+  const source = (0, import_node_path3.resolve)(options.source);
+  if (!(0, import_node_fs3.existsSync)(source)) throw new SystemError("missing-source", `release source does not exist: ${source}`);
+  ensureDirectory(paths.prefix, 493);
+  ensureDirectory((0, import_node_path3.join)(paths.prefix, "releases"), 493);
+  ensureDirectory(paths.stateDir, 493);
+  ensureDirectory(paths.configDir, 493);
+  ensureDirectory(paths.unitsDir, 493);
+  ensureDirectory((0, import_node_path3.join)(paths.stateDir, "hub"), 448, true);
+  ensureDirectory((0, import_node_path3.join)(paths.stateDir, "collector"), 448, true);
+  ensureDirectory((0, import_node_path3.join)(paths.stateDir, "backups"), 448, true);
+  ensureDirectory((0, import_node_path3.join)(paths.stateDir, "hub", "run"), 448, true);
+  assertManagedPathSafety(paths, isDefaultSystemLayout(paths));
+  const nodePath = ensureRootOwnedNode({ paths, host, nodePath: options.nodePath, copyNode: options.copyNode, trustedNode: options.trustedNode, apply: true });
+  const stage = stageRelease({ source, paths, host, replaceRelease: options.replaceRelease, now });
+  if (options.installDeps === true) {
+    installDependencies(stage.releaseDir, host, options.installDepsCommand ?? "npm");
+  }
+  const missing = missingDependencies(stage.releaseDir);
+  if (missing.length > 0) {
+    throw new SystemError(
+      "missing-dependencies",
+      `production dependencies are missing (${missing.join(", ")}); stage with --install-deps or use a built release directory`
+    );
+  }
+  chmodTree(stage.releaseDir, host);
+  runRequired(host, "chown", ["-R", "root:root", stage.releaseDir], "release ownership");
+  let adoption = null;
+  if (options.adoptFrom) {
+    adoption = adoptUserState({ source: options.adoptFrom, paths, role, accounts, apply: true, host, now });
+    await performAdoptionCopyAsync({ source: options.adoptFrom, paths, role, host, copy: adoption });
+  }
+  const port = options.port ?? 8081;
+  if (!Number.isInteger(port) || port < 1 || port > 65535) throw new SystemError("invalid-argument", "--port must be 1-65535");
+  const preset = componentSet(componentsForRole(role));
+  const power = options.power !== false && preset.collector;
+  const hubEnv = adoption?.hubEnv ?? hubEnvTemplate(paths, options.origin, port);
+  const collectorEnv = adoption?.collectorEnv ?? collectorEnvTemplate();
+  writeManagedFile(hubEnvPath(paths), hubEnv, 384, false);
+  writeManagedFile(collectorEnvPath(paths), collectorEnv, 384, false);
+  writeSysusersFiles(paths, accounts, "local", power, host);
+  const hubUnit = renderSystemHubUnit({
+    paths,
+    accounts,
+    nodePath,
+    database: hubDatabasePath(paths),
+    enrollment: hubEnrollmentPath(paths),
+    socket: hubSocketPath(paths),
+    remote: adoption?.remote === true || typeof options.origin === "string",
+    powerAccess: false
+  });
+  const collectorUnit = renderSystemCollectorUnit({
+    paths,
+    accounts,
+    nodePath,
+    collectorState: collectorStatePath(paths),
+    powerAccess: power
+  });
+  writeUnitFile(paths, UNIT_NAMES.hub, `${hubUnit}
+`, true);
+  writeUnitFile(paths, UNIT_NAMES.collector, `${collectorUnit}
+`, true);
+  const validation = runRequired(host, "systemd-analyze", ["verify", "--man=no", ...COMPONENTS.map((component) => (0, import_node_path3.join)(paths.unitsDir, unitFor(component)))], "native systemd unit validation");
+  if (/path is not absolute|bad unit file|fatal error|unknown (?:key|lvalue)|ignoring/i.test(validation.stderr)) {
+    throw new SystemError("invalid-unit", "native systemd validation rejected a generated directive");
+  }
+  if (power) ensurePowerAccess(paths, accounts, host);
+  chownAccount([(0, import_node_path3.join)(paths.stateDir, "hub")], accounts.hub, accounts.hub, host);
+  chownAccount([(0, import_node_path3.join)(paths.stateDir, "collector")], accounts.collector, accounts.collector, host);
+  const state = emptyState({ paths, accounts, role, components: { hub: false, collector: false }, nodePath, now });
+  state.currentVersion = stage.version;
+  state.releases[stage.version] = {
+    releaseDir: stage.releaseDir,
+    schemaVersion: stage.schemaVersion,
+    installedAt: new Date(now()).toISOString()
+  };
+  state.adoption = adoption?.record ?? null;
+  state.power = power ? { enabled: true, rulePath: raplRulePath(paths), group: accounts.powerGroup } : null;
+  replaceSymlink((0, import_node_path3.join)(paths.prefix, "current"), stage.releaseDir, host);
+  writeSystemState(paths, state);
+  const wantsHub = preset.hub && (options.enable === true || options.start === true);
+  const wantsCollector = preset.collector && (options.enable === true || options.start === true);
+  let password;
+  const awaiting = [];
+  if (wantsHub) password = ensureHubOwner(paths);
+  if (wantsCollector && !collectorConfigured(paths).configured) {
+    const pairing = await pairCollectorWithHub({ paths, accounts, host });
+    if (pairing.awaiting) awaiting.push("collector");
+  }
+  if (options.enable === true) {
+    enableUnits(host, unitNamesForComponents(preset));
+    state.components = { hub: { enabled: preset.hub }, collector: { enabled: preset.collector } };
+    writeSystemState(paths, state);
+  }
+  const started = [];
+  if (options.start === true) {
+    assertSystemStartAllowed(paths, componentSet(preset));
+    if (preset.hub) started.push("hub");
+    if (preset.collector && !awaiting.includes("collector")) started.push("collector");
+    if (started.length > 0) {
+      startUnits(host, started.map(unitFor));
+      await verifySystemHealth(paths, state, host, options.startupTimeoutMs ?? 2e4, started);
+    }
+  }
+  return {
+    operation: "install",
+    ok: true,
+    apply: true,
+    message: `installed ${stage.version} for ${role} preset`,
+    version: stage.version,
+    current: stage.releaseDir,
+    previous: null,
+    state,
+    password,
+    ...awaiting.length > 0 ? { awaitingConnection: awaiting } : {},
+    warnings: adoption?.warnings ?? []
+  };
+}
+function systemStatus(options = {}) {
+  const host = options.host ?? createSystemHost();
+  const paths = validateSystemPaths(options.paths);
+  const accounts = validateAccounts(options.accounts);
+  let state = null;
+  let stateError = null;
+  try {
+    state = readSystemState(paths);
+  } catch (error) {
+    stateError = error instanceof Error ? error.message : String(error);
+  }
+  const presentUnits = [UNIT_NAMES.hub, UNIT_NAMES.collector].filter((unit) => (0, import_node_fs3.existsSync)((0, import_node_path3.join)(paths.unitsDir, unit)));
+  const publicRole = presentUnits.length === 2 ? "local" : presentUnits[0] === UNIT_NAMES.hub ? "hub" : presentUnits[0] === UNIT_NAMES.collector ? "collector" : null;
+  const role = state?.role ?? publicRole ?? "local";
+  const current = currentReleaseDir(paths);
+  let publicVersion = null;
+  if (current) {
+    try {
+      const manifest = JSON.parse((0, import_node_fs3.readFileSync)((0, import_node_path3.join)(current, "package.json"), "utf8"));
+      if (typeof manifest.version === "string") publicVersion = manifest.version;
+    } catch {
+    }
+  }
+  const selected = options.component ? [options.component] : [...COMPONENTS];
+  const hubOwner = hubOwnerState(paths);
+  const collector = collectorConfigured(paths);
+  const componentReports = {};
+  for (const component of COMPONENTS) {
+    const unit = unitFor(component);
+    const present = (0, import_node_fs3.existsSync)((0, import_node_path3.join)(paths.unitsDir, unit));
+    const active = present && systemdActive(host, unit);
+    const unitEnabled = present && systemdEnabled(host, unit);
+    const enabled = state !== null ? state.components[component].enabled : unitEnabled;
+    const configured = component === "hub" ? hubOwner.configured : collector.configured;
+    const readiness = !present ? "missing" : component === "collector" && collector.problem ? "invalid-state" : component === "hub" && hubOwner.problem ? "invalid-config" : !configured ? component === "collector" ? "awaiting-connection" : "unconfigured" : active ? "ready" : "stopped";
+    componentReports[component] = {
+      component,
+      unit,
+      path: (0, import_node_path3.join)(paths.unitsDir, unit),
+      present,
+      enabled,
+      unitEnabled,
+      active,
+      configured,
+      readiness,
+      ...component === "collector" ? { destinations: collector.destinations } : {},
+      ...component === "hub" ? { ownerConfigured: hubOwner.configured } : {}
+    };
+  }
+  const units = selected.map((component) => componentReports[component]);
+  const lock = systemLockState(paths);
+  const database = hubDatabasePath(paths);
+  let schema = null;
+  try {
+    schema = databaseSchema(database);
+  } catch {
+    schema = null;
+  }
+  const power = inspectPowerAccess({ paths, accounts });
+  return {
+    scope: SYSTEM_SCOPE,
+    installed: state?.active ?? (current !== null && publicRole !== null),
+    stateError,
+    role: state?.role ?? publicRole,
+    currentVersion: state?.currentVersion ?? publicVersion,
+    previousVersion: state?.previousVersion ?? null,
+    current,
+    previous: previousReleaseDir(paths),
+    paths,
+    accounts,
+    nodePath: state?.nodePath ?? null,
+    ...options.component ? { selected: options.component } : {},
+    components: componentReports,
+    units: units.map((unit) => ({
+      unit: unit.unit,
+      path: unit.path,
+      present: unit.present,
+      active: unit.active,
+      enabled: unit.enabled
+    })),
+    database: {
+      path: database,
+      exists: (0, import_node_fs3.existsSync)(database),
+      schema,
+      mode: (0, import_node_fs3.existsSync)(database) ? modeString((0, import_node_fs3.statSync)(database).mode) : null,
+      lock
+    },
+    socket: { path: hubSocketPath(paths), exists: (0, import_node_fs3.existsSync)(hubSocketPath(paths)) },
+    config: {
+      dir: paths.configDir,
+      hubEnv: { path: hubEnvPath(paths), present: (0, import_node_fs3.existsSync)(hubEnvPath(paths)) },
+      collectorEnv: { path: collectorEnvPath(paths), present: (0, import_node_fs3.existsSync)(collectorEnvPath(paths)) }
+    },
+    adoption: state?.adoption ?? null,
+    power,
+    userInstallations: detectUserInstallations({ homeRoots: options.homeRoots })
+  };
+}
+function selectedComponents(state, component) {
+  if (component !== void 0) return [component];
+  const enabled = enabledComponents(state);
+  if (enabled.length === 0) {
+    throw new SystemError("no-enabled-components", "no system components are enabled; run `rigscope system enable hub|collector` first");
+  }
+  return enabled;
+}
+function assertComponentConfigured(paths, components) {
+  if (components.includes("hub")) {
+    const owner = hubOwnerState(paths);
+    if (!owner.configured) {
+      throw new SystemError("hub-unconfigured", "the hub has no owner; run `rigscope system enable hub --apply` to create it once");
+    }
+  }
+  if (components.includes("collector")) {
+    const collector = collectorConfigured(paths);
+    if (!collector.configured) {
+      throw new SystemError(
+        "collector-awaiting-connection",
+        "the collector has no destination; run `rigscope system connect https://<hub> --token-file /private/grant --apply`"
+      );
+    }
+  }
+}
+async function startSystem(options = {}) {
+  const host = options.host ?? createSystemHost();
+  const paths = validateSystemPaths(options.paths);
+  const state = readSystemState(paths);
+  if (state === null || !state.active) throw new SystemError("not-installed", "no active system installation; run install first");
+  const components = selectedComponents(state, options.component);
+  const units = components.map(unitFor);
+  const plan = {
+    operation: "start",
+    apply: options.apply === true,
+    role: state.role,
+    ...options.component ? { component: options.component } : {},
+    components: { hub: components.includes("hub"), collector: components.includes("collector") },
+    paths,
+    accounts: state.accounts,
+    commands: ["systemctl daemon-reload", ...options.enable ? units.map((unit) => `systemctl enable ${unit}`) : [], ...units.map((unit) => `systemctl start ${unit}`)],
+    files: [],
+    notes: ["Starting refuses to create a second hub runtime for the same database."]
+  };
+  if (options.apply !== true) return { operation: "start", ok: true, apply: false, message: "plan only", plan };
+  assertApply(host);
+  assertComponentConfigured(paths, components);
+  if (state.adoption) assertDirectoryStopped(state.adoption.source, componentSet(components));
+  assertSystemStartAllowed(paths, componentSet(components));
+  if (options.enable === true) {
+    enableUnits(host, units);
+    for (const component of components) state.components[component].enabled = true;
+  }
+  startUnits(host, units);
+  await verifySystemHealth(paths, state, host, options.startupTimeoutMs ?? 2e4, components);
+  writeSystemState(paths, state);
+  return {
+    operation: "start",
+    ok: true,
+    apply: true,
+    message: components.length === 1 ? `${components[0]} started` : "both components started",
+    ...options.component ? { component: options.component } : {},
+    components: { hub: components.includes("hub"), collector: components.includes("collector") },
+    state
+  };
+}
+function stopSystem(options = {}) {
+  const host = options.host ?? createSystemHost();
+  const paths = validateSystemPaths(options.paths);
+  const state = readSystemState(paths);
+  if (state === null) throw new SystemError("not-installed", "no system installation state");
+  const components = selectedComponents(state, options.component);
+  const units = components.map(unitFor);
+  const plan = {
+    operation: "stop",
+    apply: options.apply === true,
+    role: state.role,
+    ...options.component ? { component: options.component } : {},
+    components: { hub: components.includes("hub"), collector: components.includes("collector") },
+    paths,
+    accounts: state.accounts,
+    commands: units.map((unit) => `systemctl stop ${unit}`),
+    files: [],
+    notes: ["Stop is bounded by each unit's TimeoutStopSec."]
+  };
+  if (options.apply !== true) return { operation: "stop", ok: true, apply: false, message: "plan only", plan };
+  assertApply(host);
+  stopUnits(host, units);
+  assertDirectoryStopped(paths.stateDir, componentSet(components));
+  writeSystemState(paths, state);
+  return {
+    operation: "stop",
+    ok: true,
+    apply: true,
+    message: components.length === 1 ? `${components[0]} stopped` : "both components stopped",
+    ...options.component ? { component: options.component } : {},
+    components: { hub: components.includes("hub"), collector: components.includes("collector") },
+    state
+  };
+}
+async function restartSystem(options = {}) {
+  const host = options.host ?? createSystemHost();
+  const paths = validateSystemPaths(options.paths);
+  const state = readSystemState(paths);
+  if (state === null || !state.active) throw new SystemError("not-installed", "no active system installation");
+  const components = selectedComponents(state, options.component);
+  assertComponentConfigured(paths, components);
+  const units = components.map(unitFor);
+  const plan = {
+    operation: "restart",
+    apply: options.apply === true,
+    role: state.role,
+    ...options.component ? { component: options.component } : {},
+    components: { hub: components.includes("hub"), collector: components.includes("collector") },
+    paths,
+    accounts: state.accounts,
+    commands: units.map((unit) => `systemctl restart ${unit}`),
+    files: [],
+    notes: ["Restart refuses to create a duplicate hub runtime."]
+  };
+  if (options.apply !== true) return { operation: "restart", ok: true, apply: false, message: "plan only", plan };
+  assertApply(host);
+  stopUnits(host, units);
+  assertDirectoryStopped(paths.stateDir, componentSet(components));
+  assertSystemStartAllowed(paths, componentSet(components));
+  startUnits(host, units);
+  await verifySystemHealth(paths, state, host, options.startupTimeoutMs ?? 2e4, components);
+  writeSystemState(paths, state);
+  return {
+    operation: "restart",
+    ok: true,
+    apply: true,
+    message: components.length === 1 ? `${components[0]} restarted` : "both components restarted",
+    ...options.component ? { component: options.component } : {},
+    components: { hub: components.includes("hub"), collector: components.includes("collector") },
+    state
+  };
+}
+async function enableSystem(options) {
+  const host = options.host ?? createSystemHost();
+  const paths = validateSystemPaths(options.paths);
+  const state = readSystemState(paths);
+  if (state === null || !state.active) throw new SystemError("not-installed", "no active system installation; run install first");
+  const component = options.component;
+  const power = component === "collector" && options.power !== false;
+  const plan = {
+    operation: "enable",
+    apply: options.apply === true,
+    role: state.role,
+    component,
+    components: { hub: component === "hub" || state.components.hub.enabled, collector: component === "collector" || state.components.collector.enabled },
+    paths,
+    accounts: state.accounts,
+    commands: [
+      "systemd-sysusers",
+      "systemctl daemon-reload",
+      ...power ? ["udevadm control --reload-rules", "udevadm trigger --subsystem-match=powercap --action=change"] : [],
+      `systemctl enable ${unitFor(component)}`,
+      `systemctl start ${unitFor(component)}`
+    ],
+    files: [
+      { path: component === "hub" ? hubEnvPath(paths) : collectorEnvPath(paths), mode: "0600", purpose: `${component} configuration` },
+      { path: (0, import_node_path3.join)(paths.unitsDir, unitFor(component)), mode: "0644", purpose: `${component} boot unit` }
+    ],
+    notes: [
+      "Enables only the requested component; the other component keeps running.",
+      ...component === "hub" ? ["Creates the owner account once when the hub has no browser users; the password is printed once."] : [],
+      ...component === "collector" ? ["Pairs with a configured colocated hub when no destination exists; otherwise reports Awaiting connection."] : []
+    ]
+  };
+  if (options.apply !== true) return { operation: "enable", ok: true, apply: false, message: "plan only", plan };
+  assertApply(host);
+  ensureComponentSetup({ paths, accounts: state.accounts, nodePath: state.nodePath, component, power, host });
+  if (power) {
+    ensurePowerAccess(paths, state.accounts, host);
+    state.power = { enabled: true, rulePath: raplRulePath(paths), group: state.accounts.powerGroup };
+  }
+  let password;
+  const awaiting = [];
+  if (component === "hub") {
+    const hubWasActive = systemdActive(host, UNIT_NAMES.hub);
+    password = ensureHubOwner(paths);
+    if (password !== void 0 && hubWasActive) {
+      stopUnits(host, [UNIT_NAMES.hub]);
+      assertDirectoryStopped(paths.stateDir, "hub");
+    }
+  } else if (!collectorConfigured(paths).configured) {
+    if (systemdActive(host, UNIT_NAMES.collector)) {
+      stopUnits(host, [UNIT_NAMES.collector]);
+      assertDirectoryStopped(paths.stateDir, "collector");
+    }
+    const pairing = await pairCollectorWithHub({ paths, accounts: state.accounts, host });
+    if (pairing.awaiting) awaiting.push("collector");
+  }
+  enableUnits(host, [unitFor(component)]);
+  state.components[component].enabled = true;
+  writeSystemState(paths, state);
+  const canStart = component === "hub" || !awaiting.includes("collector");
+  if (canStart) {
+    startUnits(host, [unitFor(component)]);
+    await verifySystemHealth(paths, state, host, options.startupTimeoutMs ?? 2e4, [component]);
+  }
+  return {
+    operation: "enable",
+    ok: true,
+    apply: true,
+    message: component === "hub" ? "hub enabled" : awaiting.length > 0 ? "collector enabled; awaiting connection" : "collector enabled",
+    component,
+    components: { hub: state.components.hub.enabled, collector: state.components.collector.enabled },
+    ...awaiting.length > 0 ? { awaitingConnection: awaiting } : {},
+    password,
+    state
+  };
+}
+function disableSystem(options) {
+  const host = options.host ?? createSystemHost();
+  const paths = validateSystemPaths(options.paths);
+  const state = readSystemState(paths);
+  if (state === null) throw new SystemError("not-installed", "no system installation state");
+  const component = options.component;
+  const plan = {
+    operation: "disable",
+    apply: options.apply === true,
+    role: state.role,
+    component,
+    components: { hub: component === "hub" || state.components.hub.enabled, collector: component === "collector" || state.components.collector.enabled },
+    paths,
+    accounts: state.accounts,
+    commands: [`systemctl stop ${unitFor(component)}`, `systemctl disable ${unitFor(component)}`],
+    files: [],
+    notes: ["Settings, credentials, history and outboxes are retained while the component is disabled."]
+  };
+  if (options.apply !== true) return { operation: "disable", ok: true, apply: false, message: "plan only", plan };
+  assertApply(host);
+  stopUnits(host, [unitFor(component)]);
+  assertDirectoryStopped(paths.stateDir, component);
+  runMaybe(host, "systemctl", ["disable", unitFor(component)]);
+  state.components[component].enabled = false;
+  writeSystemState(paths, state);
+  return {
+    operation: "disable",
+    ok: true,
+    apply: true,
+    message: `${component} disabled; settings and data retained`,
+    component,
+    components: { hub: state.components.hub.enabled, collector: state.components.collector.enabled },
+    state
+  };
+}
+function readPrivateToken(path, read) {
+  let stat;
+  try {
+    stat = (0, import_node_fs3.lstatSync)(path);
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      throw new SystemError("missing-grant", `grant file does not exist: ${path}`);
+    }
+    throw error;
+  }
+  if (!stat.isFile() || stat.isSymbolicLink()) throw new SystemError("unsafe-token", `grant must be a regular file: ${path}`);
+  if ((stat.mode & 63) !== 0) throw new SystemError("insecure-permissions", `grant file must be private (0600): ${path}`);
+  if (stat.size < 1 || stat.size > 4096) throw new SystemError("invalid-token", `grant file must contain 1-4096 bytes: ${path}`);
+  if (!read) return void 0;
+  const token = (0, import_node_fs3.readFileSync)(path, "utf8").trim();
+  if (token === "" || /[\r\n\0]/.test(token) || !/^[\x21-\x7e]{1,256}$/.test(token)) {
+    throw new SystemError("invalid-token", "grant file contains an invalid token");
+  }
+  return token;
+}
+async function connectSystem(options) {
+  const host = options.host ?? createSystemHost();
+  const paths = validateSystemPaths(options.paths);
+  const state = readSystemState(paths);
+  if (state === null || !state.active) throw new SystemError("not-installed", "no active system installation; run install first");
+  const destination = connectDestinationUrl(options.url);
+  const tokenFile = (0, import_node_path3.resolve)(options.tokenFile);
+  const configured = collectorConfigured(paths);
+  if (configured.configured) {
+    throw new SystemError(
+      "already-connected",
+      "the collector already has a destination; this command never overwrites configured remote destinations"
+    );
+  }
+  const plan = {
+    operation: "connect",
+    apply: options.apply === true,
+    role: state.role,
+    component: "collector",
+    components: { hub: state.components.hub.enabled, collector: true },
+    paths,
+    accounts: state.accounts,
+    commands: ["systemd-sysusers", "systemctl daemon-reload", "stop collector if running", "enroll collector through the hub API", "start collector if enabled"],
+    files: [{ path: collectorStatePath(paths), mode: "0600", purpose: "collector identity and destination" }],
+    notes: [`Connects to ${destination} using the grant in ${tokenFile}; the grant is consumed once and never printed.`]
+  };
+  if (options.apply !== true) return { operation: "connect", ok: true, apply: false, message: "plan only", plan };
+  assertApply(host);
+  const token = readPrivateToken(tokenFile, true);
+  ensureComponentSetup({
+    paths,
+    accounts: state.accounts,
+    nodePath: state.nodePath,
+    component: "collector",
+    power: options.power !== false,
+    host
+  });
+  if (options.power !== false) {
+    ensurePowerAccess(paths, state.accounts, host);
+    state.power = { enabled: true, rulePath: raplRulePath(paths), group: state.accounts.powerGroup };
+  }
+  const existingIdentity = readCollectorIdentity(collectorStatePath(paths));
+  if (existingIdentity !== null) {
+    writeCollectorIdentity(collectorStatePath(paths), existingIdentity);
+  }
+  const wasActive = systemdActive(host, UNIT_NAMES.collector);
+  if (wasActive) {
+    stopUnits(host, [UNIT_NAMES.collector]);
+    assertDirectoryStopped(paths.stateDir, "collector");
+  }
+  try {
+    await enrollCollector(collectorStatePath(paths), destination, token, { ...SYSTEM_DEFAULT_SHARING }, false);
+  } catch (error) {
+    throw new SystemError(
+      "enrollment-failed",
+      `collector enrollment failed: ${error instanceof Error ? error.message : String(error)}`
+    );
+  } finally {
+    chownAccount([(0, import_node_path3.join)(paths.stateDir, "collector")], state.accounts.collector, state.accounts.collector, host);
+  }
+  if (!collectorConfigured(paths).configured) {
+    throw new SystemError("enrollment-failed", "the hub accepted enrollment but no destination was saved; check private state");
+  }
+  chownAccount([(0, import_node_path3.join)(paths.stateDir, "collector")], state.accounts.collector, state.accounts.collector, host);
+  writeSystemState(paths, state);
+  const enabled = state.components.collector.enabled;
+  if (enabled || wasActive) {
+    startUnits(host, [UNIT_NAMES.collector]);
+    await verifySystemHealth(paths, state, host, options.startupTimeoutMs ?? 2e4, ["collector"]);
+  }
+  return {
+    operation: "connect",
+    ok: true,
+    apply: true,
+    message: enabled ? "collector connected and started" : "collector connected; run `rigscope system start collector`",
+    component: "collector",
+    components: { hub: state.components.hub.enabled, collector: enabled },
+    state
+  };
+}
+async function upgradeSystemUnlocked(options) {
+  const host = options.host ?? createSystemHost();
+  const now = options.now ?? Date.now;
+  const paths = validateSystemPaths(options.paths);
+  const state = readSystemState(paths);
+  if (state === null || !state.active) throw new SystemError("not-installed", "no active system installation; run install first");
+  const activeComponents = COMPONENTS.filter((component) => systemdActive(host, unitFor(component)));
+  const activeUnits = activeComponents.map(unitFor);
+  const plan = {
+    operation: "upgrade",
+    apply: options.apply === true,
+    role: state.role,
+    components: { hub: state.components.hub.enabled, collector: state.components.collector.enabled },
+    paths,
+    accounts: state.accounts,
+    commands: ["stage new release", ...activeUnits.map((unit) => `systemctl stop ${unit}`), "backup database", "switch current", ...activeUnits.map((unit) => `systemctl start ${unit}`)],
+    files: [{ path: (0, import_node_path3.join)(paths.stateDir, "backups"), mode: "0700", purpose: "pre-upgrade database backup" }],
+    notes: [
+      "Staging happens before any service is stopped.",
+      "The exact active component set is restored; --start does not start a component that was stopped.",
+      "A failed post-upgrade start restores the previous release and matching database backup."
+    ]
+  };
+  if (options.apply !== true) return { operation: "upgrade", ok: true, apply: false, message: "plan only", plan };
+  assertApply(host);
+  assertManagedPathSafety(paths, isDefaultSystemLayout(paths));
+  const source = (0, import_node_path3.resolve)(options.source);
+  if (!(0, import_node_fs3.existsSync)(source)) throw new SystemError("missing-source", `release source does not exist: ${source}`);
+  const stage = stageRelease({ source, paths, host, replaceRelease: options.replaceRelease, now });
+  if (state.currentVersion === stage.version) {
+    throw new SystemError("same-version", `release ${stage.version} is already current; use a different version`);
+  }
+  if (options.installDeps === true) installDependencies(stage.releaseDir, host, options.installDepsCommand ?? "npm");
+  const missing = missingDependencies(stage.releaseDir);
+  if (missing.length > 0) throw new SystemError("missing-dependencies", `production dependencies are missing: ${missing.join(", ")}`);
+  chmodTree(stage.releaseDir, host);
+  runRequired(host, "chown", ["-R", "root:root", stage.releaseDir], "release ownership");
+  const oldCurrent = currentReleaseDir(paths);
+  if (oldCurrent === null) throw new SystemError("invalid-state", "current release symlink is missing");
+  const oldPrevious = previousReleaseDir(paths);
+  let backupPath = null;
+  let beforeSchema = null;
+  try {
+    stopUnits(host, activeUnits);
+    assertDirectoryStopped(paths.stateDir);
+    const lock = systemLockState(paths);
+    if (lock.live) throw new SystemError("duplicate-runtime", `hub did not stop cleanly; lock remains at ${lock.path}`);
+    const database = hubDatabasePath(paths);
+    if ((0, import_node_fs3.existsSync)(database)) {
+      ensureDirectory((0, import_node_path3.join)(paths.stateDir, "backups"), 448, true);
+      beforeSchema = databaseSchema(database);
+      backupPath = (0, import_node_path3.join)(paths.stateDir, "backups", `pre-upgrade-${stage.version}-${newestTimestamp()}.sqlite`);
+      await backupDatabase(database, backupPath, host);
+    }
+    replaceSymlink((0, import_node_path3.join)(paths.prefix, "previous"), oldCurrent, host);
+    replaceSymlink((0, import_node_path3.join)(paths.prefix, "current"), stage.releaseDir, host);
+    state.previousVersion = state.currentVersion;
+    state.currentVersion = stage.version;
+    state.releases[stage.version] = {
+      releaseDir: stage.releaseDir,
+      schemaVersion: stage.schemaVersion,
+      installedAt: new Date(now()).toISOString()
+    };
+    if (backupPath !== null) {
+      state.backups[(0, import_node_path3.basename)(backupPath)] = {
+        path: backupPath,
+        schemaVersion: beforeSchema,
+        fromSchema: beforeSchema,
+        toSchema: stage.schemaVersion,
+        createdAt: new Date(now()).toISOString(),
+        fromVersion: state.previousVersion ?? void 0,
+        toVersion: stage.version
+      };
+    }
+    writeSystemState(paths, state);
+    if (activeComponents.length > 0) {
+      startUnits(host, activeUnits);
+      await verifySystemHealth(paths, state, host, options.startupTimeoutMs ?? 2e4, activeComponents);
+    }
+  } catch (error) {
+    await recoverFailedUpgrade({
+      paths,
+      state,
+      oldCurrent,
+      oldPrevious,
+      beforeSchema,
+      backupPath,
+      host,
+      activeComponents,
+      units: activeUnits
+    });
+    throw error;
+  }
+  return {
+    operation: "upgrade",
+    ok: true,
+    apply: true,
+    message: `upgraded ${state.previousVersion ?? "previous"} -> ${stage.version}`,
+    version: stage.version,
+    current: stage.releaseDir,
+    previous: oldCurrent,
+    backupPath,
+    state
+  };
+}
+async function withSystemOperation(options, operation) {
+  if (!options.apply) return operation();
+  const host = options.host ?? createSystemHost();
+  assertApply(host);
+  const paths = validateSystemPaths(options.paths);
+  const release = acquireProcessLease((0, import_node_path3.join)(paths.stateDir, "backups/operation.lock"));
+  try {
+    return await operation();
+  } finally {
+    release();
+  }
+}
+function upgradeSystem(options) {
+  return withSystemOperation(options, () => upgradeSystemUnlocked(options));
+}
+function rollbackSystem(options = {}) {
+  return withSystemOperation(options, () => rollbackSystemUnlocked(options));
+}
+async function rollbackSystemUnlocked(options = {}) {
+  const host = options.host ?? createSystemHost();
+  const now = options.now ?? Date.now;
+  const paths = validateSystemPaths(options.paths);
+  const state = readSystemState(paths);
+  if (state === null || !state.active) throw new SystemError("not-installed", "no active system installation");
+  const previous = previousReleaseDir(paths);
+  if (previous === null || state.previousVersion === null) {
+    throw new SystemError("no-previous", "no previous release is retained for rollback");
+  }
+  const previousVersion = releaseVersion(previous);
+  const previousSchema = releaseSchemaVersion(previous);
+  const activeComponents = COMPONENTS.filter((component) => systemdActive(host, unitFor(component)));
+  const units = activeComponents.map(unitFor);
+  const plan = {
+    operation: "rollback",
+    apply: options.apply === true,
+    role: state.role,
+    components: { hub: state.components.hub.enabled, collector: state.components.collector.enabled },
+    paths,
+    accounts: state.accounts,
+    commands: [...units.map((unit) => `systemctl stop ${unit}`), "restore matching database backup if needed", `switch current to ${previousVersion}`, ...units.map((unit) => `systemctl start ${unit}`)],
+    files: [],
+    notes: [
+      "An old release is never run against a newer schema without restoring a matching verified backup.",
+      "The exact active component set is restored; a stopped component stays stopped."
+    ]
+  };
+  if (options.apply !== true) return { operation: "rollback", ok: true, apply: false, message: "plan only", plan };
+  assertApply(host);
+  const oldCurrent = currentReleaseDir(paths);
+  if (oldCurrent === null) throw new SystemError("invalid-state", "current release symlink is missing");
+  const originalState = JSON.parse(JSON.stringify(state));
+  let safetyBackup = null;
+  let restoredDatabase = false;
+  try {
+    stopUnits(host, units);
+    assertDirectoryStopped(paths.stateDir);
+    if (systemLockState(paths).live || lockIsLive((0, import_node_path3.join)(paths.stateDir, "collector/collector-runtime.lock")).live) {
+      throw new SystemError("runtime-active", "runtime lease remains after stop; rollback refused");
+    }
+    const database = hubDatabasePath(paths);
+    const currentSchema = (0, import_node_fs3.existsSync)(database) ? databaseSchema(database) : null;
+    let backupToRestore = null;
+    if (currentSchema !== null && (previousSchema === null || currentSchema > previousSchema)) {
+      backupToRestore = pickRollbackBackup(state, previousSchema);
+      if (backupToRestore === null || !(0, import_node_fs3.existsSync)(backupToRestore.path)) {
+        throw new SystemError(
+          "incompatible-schema",
+          `current database schema ${currentSchema} is newer than release ${previousVersion}; no matching pre-upgrade backup is recorded`
+        );
+      }
+    }
+    if ((0, import_node_fs3.existsSync)(database)) {
+      ensureDirectory((0, import_node_path3.join)(paths.stateDir, "backups"), 448, true);
+      safetyBackup = (0, import_node_path3.join)(paths.stateDir, "backups", `pre-rollback-${newestTimestamp()}.sqlite`);
+      await backupDatabase(database, safetyBackup, host);
+    }
+    if (backupToRestore !== null) {
+      replaceDatabaseFromBackup(backupToRestore.path, database, safetyBackup, host);
+      restoredDatabase = true;
+      runRequired(host, "chown", [`${state.accounts.hub}:${state.accounts.hub}`, database], "restored database ownership");
+    }
+    replaceSymlink((0, import_node_path3.join)(paths.prefix, "previous"), oldCurrent, host);
+    replaceSymlink((0, import_node_path3.join)(paths.prefix, "current"), previous, host);
+    state.previousVersion = state.currentVersion;
+    state.currentVersion = previousVersion;
+    state.updatedAt = new Date(now()).toISOString();
+    writeSystemState(paths, state);
+    if (activeComponents.length > 0) {
+      startUnits(host, units);
+      await verifySystemHealth(paths, state, host, options.startupTimeoutMs ?? 2e4, activeComponents);
+    }
+    return {
+      operation: "rollback",
+      ok: true,
+      apply: true,
+      message: `rolled back to ${previousVersion}`,
+      version: previousVersion,
+      current: previous,
+      previous: oldCurrent,
+      backupPath: backupToRestore?.path ?? safetyBackup,
+      state
+    };
+  } catch (error) {
+    stopUnits(host, units);
+    replaceSymlink((0, import_node_path3.join)(paths.prefix, "current"), oldCurrent, host);
+    replaceSymlink((0, import_node_path3.join)(paths.prefix, "previous"), previous, host);
+    if (restoredDatabase && safetyBackup) {
+      const failed = (0, import_node_path3.join)(paths.stateDir, "backups", `failed-rollback-${newestTimestamp()}.sqlite`);
+      await backupDatabase(hubDatabasePath(paths), failed, host);
+      replaceDatabaseFromBackup(safetyBackup, hubDatabasePath(paths), null, host);
+      runRequired(host, "chown", [`${state.accounts.hub}:${state.accounts.hub}`, hubDatabasePath(paths)], "restored database ownership");
+    }
+    writeSystemState(paths, originalState);
+    if (activeComponents.length > 0) {
+      startUnits(host, units);
+      await verifySystemHealth(paths, originalState, host, options.startupTimeoutMs ?? 2e4, activeComponents);
+    }
+    throw error;
+  }
+}
+function uninstallSystem(options = {}) {
+  const host = options.host ?? createSystemHost();
+  const now = options.now ?? Date.now;
+  const paths = validateSystemPaths(options.paths);
+  const state = readSystemState(paths);
+  const units = [UNIT_NAMES.hub, UNIT_NAMES.collector];
+  const plan = {
+    operation: "uninstall",
+    apply: options.apply === true,
+    role: state?.role,
+    components: { hub: false, collector: false },
+    paths,
+    accounts: state?.accounts ?? validateAccounts(options.accounts),
+    commands: [
+      ...units.map((unit) => `systemctl stop ${unit}`),
+      ...units.map((unit) => `systemctl disable ${unit}`),
+      "systemctl daemon-reload",
+      "remove both Rigscope units",
+      "remove releases, copied Node and active links",
+      "remove RAPL rule and restore counter permissions",
+      ...options.purgeData ? ["remove /var/lib/rigscope and /etc/rigscope (history)"] : [],
+      ...options.removeUsers ? ["delete service accounts and power group"] : []
+    ],
+    files: [],
+    notes: [
+      "The default uninstall removes both units and the application while preserving the database, history, configuration and accounts.",
+      "History is removed only with --purge-data --confirm-purge-history.",
+      "Adopted user data remains untouched at the recorded source path."
+    ]
+  };
+  if (options.apply !== true) return { operation: "uninstall", ok: true, apply: false, message: "plan only", plan };
+  assertApply(host);
+  if (options.purgeData === true && options.confirmPurgeHistory !== true) {
+    throw new SystemError("confirmation-required", "--purge-data requires --confirm-purge-history");
+  }
+  if (options.removeUsers === true && options.purgeData !== true) {
+    throw new SystemError("order-required", "refusing to delete accounts while their data remains; combine --remove-users with --purge-data");
+  }
+  const accounts = state?.accounts ?? validateAccounts(options.accounts);
+  stopUnits(host, units);
+  assertDirectoryStopped(paths.stateDir);
+  for (const unit of units) runMaybe(host, "systemctl", ["disable", unit]);
+  for (const unit of units) {
+    const path = (0, import_node_path3.join)(paths.unitsDir, unit);
+    assertManagedFileOwnership(paths, path);
+    try {
+      (0, import_node_fs3.unlinkSync)(path);
+    } catch {
+    }
+  }
+  runMaybe(host, "systemctl", ["daemon-reload"]);
+  const hadPowerAccess = state?.power?.enabled === true || (0, import_node_fs3.existsSync)(raplRulePath(paths)) || (0, import_node_fs3.existsSync)(powerOriginalPath(paths));
+  if (hadPowerAccess) {
+    try {
+      (0, import_node_fs3.unlinkSync)(raplRulePath(paths));
+    } catch {
+    }
+    try {
+      (0, import_node_fs3.unlinkSync)(powerSysusersPath(paths));
+    } catch {
+    }
+    restorePowerOriginals(paths, host);
+    resumePowerRule(paths, host);
+  }
+  removeSymlink((0, import_node_path3.join)(paths.prefix, "current"));
+  removeSymlink((0, import_node_path3.join)(paths.prefix, "previous"));
+  (0, import_node_fs3.rmSync)((0, import_node_path3.join)(paths.prefix, "releases"), { recursive: true, force: true });
+  (0, import_node_fs3.rmSync)((0, import_node_path3.join)(paths.prefix, "node"), { recursive: true, force: true });
+  if (state !== null) {
+    state.active = false;
+    state.power = null;
+    state.components = { hub: { enabled: false }, collector: { enabled: false } };
+    state.updatedAt = new Date(now()).toISOString();
+    writeSystemState(paths, state);
+  }
+  if (options.removeUsers === true) {
+    for (const account of [accounts.hub, accounts.collector]) runMaybe(host, "userdel", [account]);
+    for (const group of [accounts.powerGroup, accounts.hub, accounts.collector]) runMaybe(host, "groupdel", [group]);
+  }
+  if (options.purgeData === true) {
+    (0, import_node_fs3.rmSync)(paths.stateDir, { recursive: true, force: true });
+    (0, import_node_fs3.rmSync)(paths.configDir, { recursive: true, force: true });
+  }
+  return {
+    operation: "uninstall",
+    ok: true,
+    apply: true,
+    message: options.purgeData === true ? "uninstalled; system data and history removed" : "uninstalled; application removed, data and history preserved",
+    ...options.removeUsers === true ? { components: { hub: false, collector: false } } : {},
+    state
+  };
+}
+function powerStatus(options = {}) {
+  return inspectPowerAccess({
+    paths: options.paths,
+    accounts: options.accounts,
+    passwdFile: options.passwdFile,
+    groupFile: options.groupFile,
+    moduleRoot: options.moduleRoot
+  });
+}
+function grantPower(options = {}) {
+  const host = options.host ?? createSystemHost();
+  const paths = validateSystemPaths(options.paths);
+  const accounts = validateAccounts(options.accounts);
+  const plan = {
+    operation: "power-grant",
+    apply: options.apply === true,
+    paths,
+    accounts,
+    commands: [
+      "systemd-sysusers",
+      "udevadm control --reload-rules",
+      "udevadm trigger --subsystem-match=powercap --action=change",
+      `chgrp ${accounts.powerGroup} <package>/energy_uj`,
+      "chmod 0440 <package>/energy_uj"
+    ],
+    files: [
+      { path: raplRulePath(paths), mode: "0644", purpose: "package-only RAPL rule" },
+      { path: powerSysusersPath(paths), mode: "0644", purpose: "collector-only power group" }
+    ],
+    notes: ["Only top-level package energy/range counters are granted; no capabilities are added to Node."]
+  };
+  if (options.apply !== true) return { operation: "power-grant", ok: true, apply: false, message: "plan only", plan };
+  assertApply(host);
+  ensureDirectory(paths.sysusersDir, 493);
+  ensureDirectory(paths.udevRulesDir, 493);
+  ensureDirectory(paths.stateDir, 493);
+  writeManagedFile(powerSysusersPath(paths), renderPowerSysusers(paths, accounts), 420, true);
+  runRequired(host, "systemd-sysusers", [], "power group creation");
+  assertSystemAccounts(host, accounts, true, ["collector"]);
+  if (!(0, import_node_fs3.existsSync)(powerOriginalPath(paths))) capturePowerOriginals(paths);
+  writePowerRule(paths, accounts);
+  resumePowerRule(paths, host);
+  applyPowerAccess(paths, accounts, host);
+  const access = inspectPowerAccess({ paths, accounts, passwdFile: options.passwdFile, groupFile: options.groupFile, moduleRoot: options.moduleRoot });
+  return { operation: "power-grant", ok: true, apply: true, message: "power access granted", plan, access };
+}
+function revokePower(options = {}) {
+  const host = options.host ?? createSystemHost();
+  const paths = validateSystemPaths(options.paths);
+  const accounts = validateAccounts(options.accounts);
+  const plan = {
+    operation: "power-revoke",
+    apply: options.apply === true,
+    paths,
+    accounts,
+    commands: [
+      "remove RAPL rule",
+      "udevadm control --reload-rules",
+      "udevadm trigger --subsystem-match=powercap --action=change",
+      `gpasswd -d ${accounts.collector} ${accounts.powerGroup}`,
+      "restore recorded counter modes"
+    ],
+    files: [],
+    notes: ["Restores the exact modes/ownership recorded at grant time; never leaves energy_uj group-readable."]
+  };
+  if (options.apply !== true) return { operation: "power-revoke", ok: true, apply: false, message: "plan only", plan };
+  assertApply(host);
+  try {
+    (0, import_node_fs3.unlinkSync)(raplRulePath(paths));
+  } catch {
+  }
+  try {
+    (0, import_node_fs3.unlinkSync)(powerSysusersPath(paths));
+  } catch {
+  }
+  restorePowerOriginals(paths, host);
+  resumePowerRule(paths, host);
+  runMaybe(host, "gpasswd", ["-d", accounts.collector, accounts.powerGroup]);
+  if (options.removeGroup === true) runMaybe(host, "groupdel", [accounts.powerGroup]);
+  const access = inspectPowerAccess({ paths, accounts, passwdFile: options.passwdFile, groupFile: options.groupFile, moduleRoot: options.moduleRoot });
+  return { operation: "power-revoke", ok: true, apply: true, message: "power access revoked", plan, access };
+}
+var HELP = `Rigscope system installation (optional, root/sudo)
+
+Usage:
+  rigscope system plan   --source ARCHIVE_OR_DIR [options]
+  rigscope system install --source ARCHIVE_OR_DIR --apply [options]
+  rigscope system status [hub|collector] [--json]
+  rigscope system logs [hub|collector] [--follow]
+  rigscope system enable  hub|collector --apply
+  rigscope system disable hub|collector --apply
+  rigscope system start|stop|restart [hub|collector] --apply
+  rigscope system connect URL --token-file FILE --apply
+  rigscope system upgrade --source ARCHIVE_OR_DIR --apply
+  rigscope system rollback --apply
+  rigscope system uninstall --apply [--purge-data --confirm-purge-history] [--remove-users]
+  rigscope system power status|grant|revoke [--apply]
+
+Options:
+  --role local|hub|collector   Initial enabled preset; not a permanent restriction
+  --adopt-user-state DIR       Explicit, copy-only adoption of a stopped user installation
+  --allow-user-conflicts       Install beside existing user units (they must be stopped; no adoption)
+  --node PATH                  Node 26 executable; a non-root-owned binary is copied to /opt/rigscope/node
+  --copy-node                  Always copy the selected Node executable into the root-owned prefix
+  --install-deps               Run npm ci --omit=dev --ignore-scripts as root while staging
+  --without-power              Do not install collector group access to package counters
+  --token-file PATH            Read a one-time connection grant from a private (0600) file
+  --start / --enable           Start and/or enable the initial preset units explicitly
+  --json                       Machine-readable output
+  --apply                      Actually mutate; without it only the exact plan is printed
+
+Path overrides (testing/custom hosts):
+  --prefix DIR --config-dir DIR --state-dir DIR --units-dir DIR
+  --sysusers-dir DIR --udev-rules-dir DIR --powercap-root DIR
+
+One package contains both runtimes. --role only sets the initial enabled
+preset; enable or disable hub and collector independently at any time.
+Safety: mutations require root, never run systemctl --user, preserve user state,
+and refuse duplicate hub runtimes or world-readable RAPL access.`;
+function parseSystemArgs(argv) {
+  if (argv.length === 0 || argv[0] === "help" || argv[0] === "--help" || argv[0] === "-h") {
+    return { command: "help", values: {}, positionals: [] };
+  }
+  const command = argv[0];
+  const rest = argv.slice(1);
+  let subcommand;
+  if (command === "power" && rest[0] !== void 0 && !rest[0].startsWith("-")) {
+    subcommand = rest[0];
+    rest.shift();
+  }
+  const parsed = (0, import_node_util.parseArgs)({
+    args: rest,
+    allowPositionals: true,
+    options: {
+      apply: { type: "boolean" },
+      source: { type: "string" },
+      role: { type: "string" },
+      node: { type: "string" },
+      "copy-node": { type: "boolean" },
+      "install-deps": { type: "boolean" },
+      "install-deps-command": { type: "string" },
+      "without-power": { type: "boolean" },
+      token: { type: "string" },
+      "token-file": { type: "string" },
+      start: { type: "boolean" },
+      enable: { type: "boolean" },
+      "adopt-user-state": { type: "string" },
+      "allow-user-conflicts": { type: "boolean" },
+      "replace-release": { type: "boolean" },
+      port: { type: "string" },
+      origin: { type: "string" },
+      json: { type: "boolean" },
+      follow: { type: "boolean" },
+      "purge-data": { type: "boolean" },
+      "confirm-purge-history": { type: "boolean" },
+      "remove-users": { type: "boolean" },
+      "purge-program": { type: "boolean" },
+      "remove-group": { type: "boolean" },
+      "startup-timeout": { type: "string" },
+      prefix: { type: "string" },
+      "config-dir": { type: "string" },
+      "state-dir": { type: "string" },
+      "units-dir": { type: "string" },
+      "sysusers-dir": { type: "string" },
+      "udev-rules-dir": { type: "string" },
+      "powercap-root": { type: "string" },
+      "passwd-file": { type: "string" },
+      "group-file": { type: "string" },
+      "module-root": { type: "string" }
+    }
+  });
+  return { command, subcommand, values: parsed.values, positionals: parsed.positionals };
+}
+function stringValue(values, key) {
+  const value = values[key];
+  if (value === void 0) return void 0;
+  if (typeof value !== "string" || value === "") throw new SystemError("invalid-argument", `--${key} requires a value`);
+  return value;
+}
+function boolValue(values, key) {
+  return values[key] === true;
+}
+function pathsFrom(values) {
+  return {
+    ...stringValue(values, "prefix") ? { prefix: stringValue(values, "prefix") } : {},
+    ...stringValue(values, "config-dir") ? { configDir: stringValue(values, "config-dir") } : {},
+    ...stringValue(values, "state-dir") ? { stateDir: stringValue(values, "state-dir") } : {},
+    ...stringValue(values, "units-dir") ? { unitsDir: stringValue(values, "units-dir") } : {},
+    ...stringValue(values, "sysusers-dir") ? { sysusersDir: stringValue(values, "sysusers-dir") } : {},
+    ...stringValue(values, "udev-rules-dir") ? { udevRulesDir: stringValue(values, "udev-rules-dir") } : {},
+    ...stringValue(values, "powercap-root") ? { powercapRoot: stringValue(values, "powercap-root") } : {}
+  };
+}
+function roleFrom(values) {
+  const role = stringValue(values, "role");
+  if (role === void 0) return void 0;
+  if (role !== "local" && role !== "hub" && role !== "collector") throw new SystemError("invalid-role", "--role must be local, hub or collector");
+  return role;
+}
+function componentFrom(parsed, required) {
+  if (parsed.positionals.length > 1) {
+    throw new SystemError("invalid-argument", `${parsed.command} accepts at most one component (hub or collector)`);
+  }
+  const value = parsed.positionals[0];
+  if (value === void 0) {
+    if (required) throw new SystemError("missing-argument", `${parsed.command} requires hub or collector`);
+    return void 0;
+  }
+  if (value !== "hub" && value !== "collector") {
+    throw new SystemError("invalid-argument", `${parsed.command} expects hub or collector; got ${JSON.stringify(value)}`);
+  }
+  return value;
+}
+function startupTimeoutFrom(values) {
+  const raw = stringValue(values, "startup-timeout");
+  if (raw === void 0) return void 0;
+  const value = Number(raw);
+  if (!Number.isInteger(value) || value < 0 || value > 12e4) throw new SystemError("invalid-argument", "--startup-timeout must be 0-120000 ms");
+  return value;
+}
+function formatSystemReport(report) {
+  return `${JSON.stringify(report, null, 2)}
+`;
+}
+function humanPlan(plan) {
+  const lines = [
+    `Operation: ${plan.operation}${plan.apply ? "" : " (plan only; add --apply with sudo to execute)"}`,
+    `Role:      ${plan.role ?? "n/a"}${plan.role ? " (initial preset metadata)" : ""}`,
+    ...plan.component ? [`Component: ${plan.component}`] : [],
+    ...plan.components ? [`Enabled:   ${COMPONENTS.filter((component) => plan.components[component]).join(", ") || "none"}`] : [],
+    `Prefix:    ${plan.paths.prefix}`,
+    `Config:    ${plan.paths.configDir}`,
+    `State:     ${plan.paths.stateDir}`,
+    `Units:     ${plan.paths.unitsDir}`,
+    `Accounts:  hub=${plan.accounts.hub} collector=${plan.accounts.collector} power=${plan.accounts.powerGroup}`,
+    "",
+    "Files:",
+    ...plan.files.map((file) => `  ${file.path} (${file.mode}) - ${file.purpose}`),
+    "",
+    "Commands:",
+    ...plan.commands.map((command) => `  ${command}`),
+    "",
+    ...plan.notes.map((note) => `- ${note}`)
+  ];
+  return `${lines.join("\n")}
+`;
+}
+function humanStatus(status) {
+  const paths = status.paths;
+  const database = status.database;
+  const components = status.components;
+  const power = status.power;
+  const adoption = status.adoption;
+  const lines = [
+    `Scope:     system`,
+    `Installed: ${status.installed === true ? "yes" : "no"}`,
+    `Role:      ${String(status.role ?? "n/a")} (initial preset metadata)`,
+    `Current:   ${status.currentVersion === null || status.currentVersion === void 0 ? "none" : `${status.currentVersion} (${status.current})`}`,
+    `Previous:  ${status.previousVersion === null || status.previousVersion === void 0 ? "none" : `${status.previousVersion} (${status.previous})`}`,
+    `Prefix:    ${paths.prefix}`,
+    `Config:    ${paths.configDir}`,
+    `State:     ${paths.stateDir}`,
+    `Database:  ${database.path} (${database.exists ? `schema ${database.schema ?? "unknown"}` : "absent"})${database.lock.live ? " RUNNING" : ""}`,
+    `Socket:    ${String(status.socket.path)}${status.socket.exists ? " (present)" : ""}`,
+    "",
+    "Components:",
+    ...(status.selected ? [status.selected] : [...COMPONENTS]).map((name) => {
+      const component = components[name];
+      const detail = name === "collector" ? `, ${component.destinations ?? 0} destination(s)` : "";
+      return `  ${name}: ${component.present ? "installed" : "missing"}, ${component.enabled ? "enabled" : "disabled"}, ${component.active ? "active" : "inactive"}, ${component.readiness}${detail}`;
+    }),
+    "",
+    `Power:     ${power.available ? `${power.domains.length} package counter(s)` : "no package counters"}; collector read ${power.collectorCanRead ? "yes" : "no"}; persistent ${power.persistent ? "yes" : "no"}; world-readable ${power.worldReadable ? "YES" : "no"}`,
+    ...power.problems.length > 0 ? ["Power notes:", ...power.problems.map((problem) => `  - ${problem}`)] : [],
+    ...adoption ? ["", `Adoption:  copied from ${adoption.source} (original preserved; reversible by deleting the system copy)`] : [],
+    ...status.stateError ? ["", `State warning: ${String(status.stateError)}`] : []
+  ];
+  return `${lines.join("\n")}
+`;
+}
+function printMutationReport(report) {
+  console.log(report.message);
+  if (report.password) console.log(`Owner password: ${report.password} (shown once; store it now)`);
+  if (report.awaitingConnection?.includes("collector")) {
+    console.log("Awaiting connection: create a collector grant at the hub, save it to a private (0600) file,");
+    console.log("then run `rigscope system connect https://<hub> --token-file <file> --apply`.");
+  }
+}
+async function runSystemCommand(argv) {
+  const parsed = parseSystemArgs(argv);
+  if (parsed.command === "help") {
+    console.log(HELP);
+    return 0;
+  }
+  const values = parsed.values;
+  const paths = pathsFrom(values);
+  const json = boolValue(values, "json");
+  const host = createSystemHost();
+  try {
+    if (parsed.command === "plan") {
+      if (parsed.values.source === void 0) throw new SystemError("missing-argument", "plan requires --source");
+      const plan = planSystemInstall({
+        apply: false,
+        source: stringValue(values, "source"),
+        role: roleFrom(values),
+        paths,
+        nodePath: stringValue(values, "node"),
+        copyNode: boolValue(values, "copy-node"),
+        port: stringValue(values, "port") ? Number(stringValue(values, "port")) : void 0,
+        origin: stringValue(values, "origin"),
+        adoptFrom: stringValue(values, "adopt-user-state"),
+        installDeps: boolValue(values, "install-deps"),
+        start: boolValue(values, "start"),
+        enable: boolValue(values, "enable")
+      });
+      console.log(json ? formatSystemReport(plan) : humanPlan(plan));
+      return 0;
+    }
+    if (parsed.command === "install") {
+      if (stringValue(values, "source") === void 0) throw new SystemError("missing-argument", "install requires --source");
+      const report = await installSystem({
+        apply: boolValue(values, "apply"),
+        source: stringValue(values, "source"),
+        role: roleFrom(values),
+        paths,
+        nodePath: stringValue(values, "node"),
+        copyNode: boolValue(values, "copy-node"),
+        port: stringValue(values, "port") ? Number(stringValue(values, "port")) : void 0,
+        origin: stringValue(values, "origin"),
+        adoptFrom: stringValue(values, "adopt-user-state"),
+        installDeps: boolValue(values, "install-deps"),
+        installDepsCommand: stringValue(values, "install-deps-command"),
+        power: boolValue(values, "without-power") ? false : void 0,
+        start: boolValue(values, "start"),
+        enable: boolValue(values, "enable"),
+        replaceRelease: boolValue(values, "replace-release"),
+        allowUserConflicts: boolValue(values, "allow-user-conflicts"),
+        startupTimeoutMs: startupTimeoutFrom(values),
+        host
+      });
+      if (json) console.log(formatSystemReport(report));
+      else if (report.plan) console.log(`Installed: no (plan only)
+
+${humanPlan(report.plan)}`);
+      else {
+        printMutationReport(report);
+        console.log(`Current: ${report.current ?? "none"}`);
+      }
+      return 0;
+    }
+    if (parsed.command === "status") {
+      const component = componentFrom(parsed, false);
+      const status = systemStatus({ paths, host, json, component, homeRoots: void 0 });
+      console.log(json ? formatSystemReport(status) : humanStatus(status));
+      return 0;
+    }
+    if (parsed.command === "logs") {
+      const selected = validateSystemPaths(paths);
+      const component = componentFrom(parsed, false);
+      const units = (component ? [unitFor(component)] : [UNIT_NAMES.hub, UNIT_NAMES.collector]).filter((unit) => (0, import_node_fs3.existsSync)((0, import_node_path3.join)(selected.unitsDir, unit)));
+      if (units.length === 0) throw new SystemError("not-installed", component ? `${component} logs are unavailable; its unit is not installed` : "no system services installed");
+      const result = (0, import_node_child_process.spawnSync)("journalctl", [...units.flatMap((unit) => ["--unit", unit]), "--lines=100", "--no-pager", ...boolValue(values, "follow") ? ["--follow"] : []], { stdio: "inherit" });
+      if (result.error) throw result.error;
+      return result.status ?? 1;
+    }
+    if (parsed.command === "enable" || parsed.command === "disable") {
+      const component = componentFrom(parsed, true);
+      const options = {
+        apply: boolValue(values, "apply"),
+        paths,
+        host,
+        component,
+        power: boolValue(values, "without-power") ? false : void 0,
+        startupTimeoutMs: startupTimeoutFrom(values)
+      };
+      const report = parsed.command === "enable" ? await enableSystem({ ...options, component }) : disableSystem({ ...options, component });
+      if (json) console.log(formatSystemReport(report));
+      else if (report.plan) console.log(humanPlan(report.plan));
+      else printMutationReport(report);
+      return 0;
+    }
+    if (parsed.command === "connect") {
+      const url = parsed.positionals[0];
+      if (url === void 0) throw new SystemError("missing-argument", "connect requires a hub URL");
+      if (parsed.positionals.length > 1) throw new SystemError("invalid-argument", "connect accepts one hub URL");
+      const tokenFile = stringValue(values, "token-file");
+      if (tokenFile === void 0) throw new SystemError("missing-argument", "connect requires --token-file with a private (0600) grant file");
+      const report = await connectSystem({
+        apply: boolValue(values, "apply"),
+        paths,
+        host,
+        url,
+        tokenFile,
+        power: boolValue(values, "without-power") ? false : void 0,
+        startupTimeoutMs: startupTimeoutFrom(values)
+      });
+      if (json) console.log(formatSystemReport(report));
+      else if (report.plan) console.log(humanPlan(report.plan));
+      else printMutationReport(report);
+      return 0;
+    }
+    if (parsed.command === "start" || parsed.command === "stop" || parsed.command === "restart") {
+      const component = componentFrom(parsed, false);
+      const options = {
+        apply: boolValue(values, "apply"),
+        paths,
+        host,
+        component,
+        enable: boolValue(values, "enable"),
+        startupTimeoutMs: startupTimeoutFrom(values)
+      };
+      const report = parsed.command === "start" ? await startSystem(options) : parsed.command === "stop" ? stopSystem(options) : await restartSystem(options);
+      if (json) console.log(formatSystemReport(report));
+      else if (report.plan) console.log(humanPlan(report.plan));
+      else printMutationReport(report);
+      return 0;
+    }
+    if (parsed.command === "upgrade") {
+      const report = await upgradeSystem({
+        apply: boolValue(values, "apply"),
+        source: stringValue(values, "source") ?? "",
+        paths,
+        host,
+        start: boolValue(values, "start"),
+        installDeps: boolValue(values, "install-deps"),
+        installDepsCommand: stringValue(values, "install-deps-command"),
+        replaceRelease: boolValue(values, "replace-release"),
+        startupTimeoutMs: startupTimeoutFrom(values)
+      });
+      if (json) console.log(formatSystemReport(report));
+      else if (report.plan) console.log(humanPlan(report.plan));
+      else console.log(`${report.message}
+Backup: ${report.backupPath ?? "none"}`);
+      return 0;
+    }
+    if (parsed.command === "rollback") {
+      const report = await rollbackSystem({ apply: boolValue(values, "apply"), paths, host, start: boolValue(values, "start"), startupTimeoutMs: startupTimeoutFrom(values) });
+      if (json) console.log(formatSystemReport(report));
+      else if (report.plan) console.log(humanPlan(report.plan));
+      else console.log(`${report.message}
+Backup: ${report.backupPath ?? "none"}`);
+      return 0;
+    }
+    if (parsed.command === "uninstall") {
+      const report = uninstallSystem({
+        apply: boolValue(values, "apply"),
+        paths,
+        host,
+        purgeData: boolValue(values, "purge-data"),
+        confirmPurgeHistory: boolValue(values, "confirm-purge-history"),
+        removeUsers: boolValue(values, "remove-users"),
+        purgeProgram: boolValue(values, "purge-program")
+      });
+      if (json) console.log(formatSystemReport(report));
+      else if (report.plan) console.log(humanPlan(report.plan));
+      else console.log(report.message);
+      return 0;
+    }
+    if (parsed.command === "power") {
+      const sub = parsed.subcommand ?? "status";
+      if (sub === "status") {
+        const access = powerStatus({
+          paths,
+          passwdFile: stringValue(values, "passwd-file"),
+          groupFile: stringValue(values, "group-file"),
+          moduleRoot: stringValue(values, "module-root")
+        });
+        if (json) console.log(formatSystemReport(access));
+        else {
+          console.log(`Driver:    ${access.driver.length > 0 ? access.driver.join(", ") : "not detected"}`);
+          console.log(`Domains:   ${access.domains.length} package counter(s)`);
+          for (const domain of access.domains) {
+            console.log(`  ${domain.name}: energy ${domain.energy?.mode ?? "missing"} ${domain.energy?.readable ? "collector-readable" : "denied"}${domain.energy?.worldReadable ? " WORLD-READABLE" : ""}`);
+          }
+          console.log(`Access:    collector read ${access.collectorCanRead ? "yes" : "no"}; persistent ${access.persistent ? "yes" : "no"}; world-readable ${access.worldReadable ? "YES" : "no"}`);
+          for (const problem of access.problems) console.log(`  - ${problem}`);
+        }
+        return access.worldReadable || access.writableByCollector ? 1 : 0;
+      }
+      if (sub === "grant") {
+        const report = grantPower({
+          apply: boolValue(values, "apply"),
+          paths,
+          host,
+          passwdFile: stringValue(values, "passwd-file"),
+          groupFile: stringValue(values, "group-file"),
+          moduleRoot: stringValue(values, "module-root")
+        });
+        if (json) console.log(formatSystemReport(report));
+        else if (report.plan) console.log(humanPlan(report.plan));
+        else console.log(report.message);
+        return 0;
+      }
+      if (sub === "revoke") {
+        const report = revokePower({
+          apply: boolValue(values, "apply"),
+          paths,
+          host,
+          removeGroup: boolValue(values, "remove-group"),
+          passwdFile: stringValue(values, "passwd-file"),
+          groupFile: stringValue(values, "group-file"),
+          moduleRoot: stringValue(values, "module-root")
+        });
+        if (json) console.log(formatSystemReport(report));
+        else if (report.plan) console.log(humanPlan(report.plan));
+        else console.log(report.message);
+        return 0;
+      }
+      throw new SystemError("unknown-command", "system power expects status, grant or revoke");
+    }
+    throw new SystemError("unknown-command", `unknown system command ${JSON.stringify(parsed.command)}; run rigscope system help`);
+  } catch (error) {
+    if (json) {
+      console.log(formatSystemReport({ ok: false, error: error instanceof Error ? error.message : String(error), code: error instanceof SystemError ? error.code : "error" }));
+    } else {
+      console.error(`rigscope system: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    return 1;
+  }
+}
+function isMainModule() {
+  try {
+    return require.main === module;
+  } catch {
+    return true;
+  }
+}
+if (isMainModule()) {
+  runSystemCommand(process.argv.slice(2)).then((code) => {
+    process.exitCode = code;
+  }).catch((error) => {
+    console.error(`rigscope system: ${error instanceof Error ? error.message : String(error)}`);
+    process.exitCode = 1;
+  });
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  COMPONENTS,
+  DEFAULT_NODE_PATH,
+  DEFAULT_SYSTEM_ACCOUNTS,
+  POWER_STATE_FILE_NAME,
+  POWER_SYSUSERS_NAME,
+  RAPL_RULE_NAME,
+  STATE_FILE_NAME,
+  SYSTEM_SCOPE,
+  SYSTEM_STATE_FORMAT_VERSION,
+  SYSUSERS_NAME,
+  SystemError,
+  UNIT_NAMES,
+  assertDirectoryStopped,
+  assertManagedFileOwnership,
+  collectorEnvPath,
+  collectorStatePath,
+  componentEnabled,
+  componentSet,
+  componentsForRole,
+  connectDestinationUrl,
+  connectSystem,
+  createSystemHost,
+  defaultSystemPaths,
+  detectPowerDriver,
+  detectUserInstallations,
+  disableSystem,
+  enableSystem,
+  enabledComponents,
+  formatSystemReport,
+  grantPower,
+  hubDatabasePath,
+  hubEnrollmentPath,
+  hubEnvPath,
+  hubSocketPath,
+  inspectPowerAccess,
+  installSystem,
+  powerStatus,
+  powerSysusersPath,
+  raplRulePath,
+  readSystemState,
+  renderPowerSysusers,
+  renderRaplRule,
+  renderSystemCollectorUnit,
+  renderSystemHubUnit,
+  renderSysusers,
+  restartSystem,
+  revokePower,
+  rolesFor,
+  rollbackSystem,
+  runSystemCommand,
+  startSystem,
+  stateFilePath,
+  stopSystem,
+  systemStatus,
+  systemdQuote,
+  sysusersPath,
+  uninstallSystem,
+  unitFor,
+  unitNamesFor,
+  unitNamesForComponents,
+  upgradeSystem,
+  validateAccounts,
+  validateSystemPaths,
+  verifySystemHealth
+});