npm - @agentvault/muse-bridge - Versions diffs - 0.1.0 → 0.1.2 - Mend

@agentvault/muse-bridge 0.1.0 → 0.1.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (2) hide show

package/dist/index.js +573 -275
package/package.json +1 -1

package/dist/index.js CHANGED Viewed

@@ -260,6 +260,7 @@ function parsePlistEnv(xml) {
     }
     i2 = m2.index;
   }
+  void i2;
   if (close < 0) return out;
   const body = xml.slice(open, close);
   const pair = /<key>([\s\S]*?)<\/key>\s*<string>([\s\S]*?)<\/string>/g;
@@ -279,6 +280,7 @@ var init_launchd = __esm({
       constructor(deps) {
         this.deps = deps;
       }
+      deps;
       plistPath(label) {
         return join7(this.deps.home, "Library", "LaunchAgents", `${label}.plist`);
       }
@@ -391,6 +393,7 @@ var init_systemd = __esm({
       constructor(deps) {
         this.deps = deps;
       }
+      deps;
       unitPath(label) {
         return join8(this.deps.home, ".config", "systemd", "user", `${label}.service`);
       }
@@ -580,7 +583,7 @@ var init_subcommand = __esm({
   }
 });
-// ../../../../packages/plugin/dist/index.js
+// ../plugin/dist/index.js
 var dist_exports = {};
 __export(dist_exports, {
   AgentVaultMcpServer: () => AgentVaultMcpServer,
@@ -11615,6 +11618,18 @@ function orderDeliveryBatch(messages) {
     return createdAtOf(a2) - createdAtOf(b2);
   });
 }
+function noteObservedEpoch(current, seen) {
+  const n2 = Number(seen);
+  if (!Number.isInteger(n2) || n2 < 0)
+    return current;
+  return n2 > current ? n2 : current;
+}
+function needsPreSendResync(localEpoch, observedEpoch) {
+  if (!Number.isInteger(localEpoch) || !Number.isInteger(observedEpoch)) {
+    return false;
+  }
+  return observedEpoch > localEpoch;
+}
 async function ensureSecureDir(dir) {
   await mkdir(dir, { recursive: true, mode: DIR_MODE });
   try {
@@ -11780,7 +11795,7 @@ async function joinWithFirstMatchingKp(welcomeBytes, candidates) {
   return null;
 }
 function ownIdentity() {
-  const v2 = true ? "0.23.26" : FALLBACK;
+  const v2 = true ? "0.23.27" : FALLBACK;
   return `${PACKAGE}@${v2}`;
 }
 function buildClientVersion2(override) {
@@ -14754,7 +14769,7 @@ function _stringbool(Classes, _params) {
     type: "pipe",
     in: stringSchema,
     out: booleanSchema,
-    transform: (input, payload) => {
+    transform: ((input, payload) => {
       let data = input;
       if (params.case !== "sensitive")
         data = data.toLowerCase();
@@ -14773,14 +14788,14 @@ function _stringbool(Classes, _params) {
         });
         return {};
       }
-    },
-    reverseTransform: (input, _payload) => {
+    }),
+    reverseTransform: ((input, _payload) => {
       if (input === true) {
         return truthyArray[0] || "true";
       } else {
         return falsyArray[0] || "false";
       }
-    },
+    }),
     error: params.error
   });
   return codec2;
@@ -15794,11 +15809,13 @@ function assertCompleteRequestPrompt(request) {
   if (request.params.ref.type !== "ref/prompt") {
     throw new TypeError(`Expected CompleteRequestPrompt, but got ${request.params.ref.type}`);
   }
+  void request;
 }
 function assertCompleteRequestResourceTemplate(request) {
   if (request.params.ref.type !== "ref/resource") {
     throw new TypeError(`Expected CompleteRequestResourceTemplate, but got ${request.params.ref.type}`);
   }
+  void request;
 }
 function isTerminal(status) {
   return status === "completed" || status === "failed" || status === "cancelled";
@@ -17306,9 +17323,9 @@ function reportSkillInvocation(opts) {
   spanBuffer.push(span);
   return span;
 }
-var __create, __defProp2, __getOwnPropDesc, __getOwnPropNames2, __getProtoOf, __hasOwnProp, __esm2, __commonJS, __export2, __copyProps, __toESM, init_mls_commit_classify, __filename, __dirname, url2, path, Module, Module, root, window_, crypto_, randomValuesStandard, crypto4, randomValueNodeJS, _Module, libsodium_sumo_default, init_libsodium_sumo, a, r, t, c, libsodium_wrappers_default, init_libsodium_wrappers, init_keys, init_x3dh, MAX_SKIP, CHAIN_KEY_SEED, MSG_KEY_SEED, HEADER_KEY_SEED, DoubleRatchet, init_ratchet, init_file_crypto, DOMAIN_DID_DOCUMENT, DOMAIN_TRANSFER_INTENT, DOMAIN_TRANSFER_ACCEPT, BASE58_ALPHABET, init_did, BUILTIN_PATTERNS, ScanEngine, init_scan_engine, init_merkle, VC_CONTEXT_V2, AV_CREDENTIAL_CONTEXT, CRYPTOSUITE, BASE58_ALPHABET2, init_vc, init_transport, init_telemetry, TelemetryReporter, init_telemetry_reporter, CROCKFORD, ARGON2_OPSLIMIT, ARGON2_MEMLIMIT, SALT_BYTES, NONCE_BYTES, KEY_BYTES, BACKUP_VERSION, MAX_BACKUP_SIZE, init_backup, init_approval, encVoid, init_tlsEncoder, uint8Encoder, encodeUint8, decodeUint8, uint16Encoder, encodeUint16, decodeUint16, uint32Encoder, encodeUint32, decodeUint32, uint64Encoder, encodeUint64, decodeUint64, init_number, init_tlsDecoder, init_enumHelpers, defaultProposalTypes, defaultProposalTypeEncoder, encodeDefaultProposalType, decodeDefaultProposalType, init_defaultProposalType, defaultExtensionTypes, defaultExtensionTypeEncoder, encodeDefaultExtensionType, decodeDefaultExtensionType, init_defaultExtensionType, acceptAll, init_incomingMessageAction, MlsError, ValidationError, CodecError, UsageError, DependencyError, CryptoVerificationError, CryptoError, InternalError, init_mlsError, init_byteArray, varLenDataEncoder, decodeVarLenData, init_variableLength, init_constantTimeCompare, extensionTypeEncoder, encodeExtensionType, decodeExtensionType, extensionEncoder, encodeExtension, decodeExtension, init_extension, credentialTypes, credentialTypeEncoder, encodeCredentialType, decodeCredentialType, init_credentialType, credentialBasicEncoder, encodeCredentialBasic, credentialX509Encoder, encodeCredentialX509, credentialCustomEncoder, encodeCredentialCustom, credentialEncoder, encodeCredential, decodeCredentialBasic, decodeCredentialX509, decodeCredential, init_credential, externalSenderEncoder, encodeExternalSender, decodeExternalSender, init_externalSender, init_hash, init_optional, ciphersuites, ciphersuiteEncoder, encodeCiphersuite, decodeCiphersuite, ciphersuiteValues, init_ciphersuite, init_signature, protocolVersions, protocolVersionEncoder, encodeProtocolVersion, decodeProtocolVersion, init_protocolVersion, capabilitiesEncoder, encodeCapabilities, decodeCapabilities, init_capabilities, leafNodeSources, leafNodeSourceEncoder, encodeLeafNodeSource, decodeLeafNodeSource, init_leafNodeSource, lifetimeEncoder, encodeLifetime, decodeLifetime, defaultLifetime, init_lifetime, leafNodeDataEncoder, encodeLeafNodeData, decodeLeafNodeData, leafNodeInfoKeyPackageEncoder, encodeLeafNodeInfoKeyPackage, leafNodeInfoUpdateOmittedEncoder, encodeLeafNodeInfoUpdateOmitted, leafNodeInfoCommitOmittedEncoder, encodeLeafNodeInfoCommitOmitted, leafNodeInfoOmittedEncoder, encodeLeafNodeInfoOmitted, decodeLeafNodeInfoKeyPackage, decodeLeafNodeInfoUpdateOmitted, decodeLeafNodeInfoCommitOmitted, decodeLeafNodeInfoOmitted, leafNodeInfoUpdateEncoder, encodeLeafNodeInfoUpdate, leafNodeInfoCommitEncoder, encodeLeafNodeInfoCommit, leafNodeInfoEncoder, encodeLeafNodeInfo, decodeLeafNodeInfoUpdate, decodeLeafNodeInfoCommit, decodeLeafNodeInfo, leafNodeTBSEncoder, encodeLeafNodeTBS, leafNodeEncoder, encodeLeafNode, decodeLeafNode, decodeLeafNodeKeyPackage, decodeLeafNodeCommit, decodeLeafNodeUpdate, init_leafNode, keyPackageTBSEncoder, encodeKeyPackageTBS, decodeKeyPackageTBS, keyPackageEncoder, encodeKeyPackage, decodeKeyPackage, init_keyPackage, init_kdf, pskTypes, pskTypeEncoder, encodePskType, decodePskType, resumptionPSKUsages, resumptionPSKUsageEncoder, encodeResumptionPSKUsage, decodeResumptionPSKUsage, encodePskInfoExternal, encodePskInfoResumption, decodePskInfoResumption, pskInfoEncoder, encodePskInfo, decodePskInfo, pskIdEncoder, encodePskId, decodePskId, pskLabelEncoder, encodePskLabel, decodePskLabel, init_presharedkey, addEncoder, encodeAdd, decodeAdd, updateEncoder, encodeUpdate, decodeUpdate, removeEncoder, encodeRemove, decodeRemove, pskEncoder, encodePSK, decodePSK, reinitEncoder, encodeReinit, decodeReinit, externalInitEncoder, encodeExternalInit, decodeExternalInit, groupContextExtensionsEncoder, encodeGroupContextExtensions, decodeGroupContextExtensions, proposalAddEncoder, encodeProposalAdd, proposalUpdateEncoder, encodeProposalUpdate, proposalRemoveEncoder, encodeProposalRemove, proposalPSKEncoder, encodeProposalPSK, proposalReinitEncoder, encodeProposalReinit, proposalExternalInitEncoder, encodeProposalExternalInit, proposalGroupContextExtensionsEncoder, encodeProposalGroupContextExtensions, proposalCustomEncoder, encodeProposalCustom, proposalEncoder, encodeProposal, decodeProposalAdd, decodeProposalUpdate, decodeProposalRemove, decodeProposalPSK, decodeProposalReinit, decodeProposalExternalInit, decodeProposalGroupContextExtensions, decodeProposal, init_proposal, proposalOrRefTypes, proposalOrRefTypeEncoder, encodeProposalOrRefType, decodeProposalOrRefType, proposalOrRefProposalEncoder, encodeProposalOrRefProposal, proposalOrRefProposalRefEncoder, encodeProposalOrRefProposalRef, proposalOrRefEncoder, encodeProposalOrRef, decodeProposalOrRef, init_proposalOrRefType, init_hpke, groupContextEncoder, encodeGroupContext, decodeGroupContext, init_groupContext, nodeTypes, nodeTypeEncoder, encodeNodeType, decodeNodeType, init_nodeType, parentNodeEncoder, encodeParentNode, decodeParentNode, init_parentNode, init_treemath, nodeEncoder, encodeNode, decodeNode, ratchetTreeEncoder, encodeRatchetTree, decodeRatchetTree, init_ratchetTree, leafNodeHashInputEncoder, encodeLeafNodeHashInput, decodeLeafNodeHashInput, parentNodeHashInputEncoder, encodeParentNodeHashInput, decodeParentNodeHashInput, treeHashInputEncoder, encodeTreeHashInput, decodeTreeHashInput, init_treeHash, parentHashInputEncoder, encodeParentHashInput, decodeParentHashInput, init_parentHash, hpkeCiphertextEncoder, encodeHpkeCiphertext, decodeHpkeCiphertext, init_hpkeCiphertext, updatePathNodeEncoder, encodeUpdatePathNode, decodeUpdatePathNode, updatePathEncoder, encodeUpdatePath, decodeUpdatePath, init_updatePath, commitEncoder, encodeCommit, decodeCommit, init_commit, contentTypes, contentTypeEncoder, encodeContentType, decodeContentType, init_contentType, wireformats, wireformatEncoder, encodeWireformat, decodeWireformat, init_wireformat, senderTypes, senderTypeEncoder, encodeSenderType, decodeSenderType, senderEncoder, encodeSender, decodeSender, reuseGuardEncoder, encodeReuseGuard, decodeReuseGuard, senderDataEncoder, encodeSenderData, decodeSenderData, senderDataAADEncoder, encodeSenderDataAAD, decodeSenderDataAAD, init_sender, framedContentApplicationDataEncoder, encodeFramedContentApplicationData, framedContentProposalDataEncoder, encodeFramedContentProposalData, framedContentCommitDataEncoder, encodeFramedContentCommitData, framedContentInfoEncoder, encodeFramedContentInfo, decodeFramedContentApplicationData, decodeFramedContentProposalData, decodeFramedContentCommitData, decodeFramedContentInfo, framedContentEncoder, encodeFramedContent, decodeFramedContent, senderInfoEncoder, encodeSenderInfo, framedContentTBSEncoder, encodeFramedContentTBS, encodeFramedContentAuthDataContent, encodeFramedContentAuthDataCommit, framedContentAuthDataEncoder, encodeFramedContentAuthData, decodeFramedContentAuthDataCommit, init_framedContent, authenticatedContentEncoder, encodeAuthenticatedContent, decodeAuthenticatedContent, authenticatedContentTBMEncoder, encodeAuthenticatedContentTBM, init_authenticatedContent, publicMessageInfoEncoder, encodePublicMessageInfo, publicMessageEncoder, encodePublicMessage, decodePublicMessage, init_publicMessage, init_messageProtectionPublic, init_externalProposal, requiredCapabilitiesEncoder, encodeRequiredCapabilities, decodeRequiredCapabilities, init_requiredCapabilities, defaultAuthenticationService, init_authenticationService, defaultPaddingConfig, init_paddingConfig, defaultKeyPackageEqualityConfig, init_keyPackageEqualityConfig, defaultLifetimeConfig, init_lifetimeConfig, defaultKeyRetentionConfig, init_keyRetentionConfig, groupInfoTBSEncoder, encodeGroupInfoTBS, decodeGroupInfoTBS, groupInfoEncoder, encodeGroupInfo, decodeGroupInfo, init_groupInfo, keyScheduleEncoder, encodeKeySchedule, decodeKeySchedule, init_keySchedule, generationSecretEncoder, decodeGenerationSecret, secretTreeNodeEncoder, decodeSecretTreeNode, secretTreeEncoder, decodeSecretTree, init_secretTree, confirmedTranscriptHashInputEncoder, encodeConfirmedTranscriptHashInput, decodeConfirmedTranscriptHashInput, init_transcriptHash, groupSecretsEncoder, encodeGroupSecrets, decodeGroupSecrets, init_groupSecrets, encryptedGroupSecretsEncoder, encodeEncryptedGroupSecrets, decodeEncryptedGroupSecrets, welcomeEncoder, encodeWelcome, decodeWelcome, init_welcome, init_pathSecrets, privateKeyPathEncoder, decodePrivateKeyPath, init_privateKeyPath, proposalWithSenderEncoder, decodeProposalWithSender, unappliedProposalsEncoder, decodeUnappliedProposals, init_unappliedProposals, emptyPskIndex, init_pskIndex, init_addToMap, defaultClientConfig, init_clientConfig, init_array, stringEncoder, encodeString, decodeString, init_string, activeEncoder, suspendedPendingReinitEncoder, removedFromGroupEncoder, groupActiveStateEncoder, decodeGroupActiveState, init_groupActiveState, epochReceiverDataEncoder, decodeEpochReceiverData, init_epochReceiverData, groupStateEncoder, encodeGroupState, decodeGroupState, groupStateEncoderWithoutTree, encodeGroupStateWithoutTree, emptyProposals, init_clientState, privateMessageEncoder, encodePrivateMessage, decodePrivateMessage, privateContentAADEncoder, encodePrivateContentAAD, decodePrivateContentAAD, init_privateMessage, init_messageProtection, init_createMessage, init_createCommit, init_processMessages, init_makeHashImpl, HpkeError, InvalidParamError, SerializeError, DeserializeError, EncapError, DecapError, ExportError, SealError, OpenError, MessageLimitReachedError, DeriveKeyPairError, NotSupportedError, init_errors, dntGlobals, dntGlobalThis, init_dnt_shims, NativeAlgorithm, init_algorithm, Mode, KemId, KdfId, AeadId, init_identifiers, INPUT_LENGTH_LIMIT, INFO_LENGTH_LIMIT, MINIMUM_PSK_LENGTH, EMPTY, BYTE_TO_BIGINT_256, init_consts, SUITE_ID_HEADER_KEM, init_kemInterface, HPKE_VERSION, HkdfNative, HkdfSha256Native, HkdfSha384Native, HkdfSha512Native, init_hkdf, isCryptoKeyPair, init_misc, LABEL_EAE_PRK, LABEL_SHARED_SECRET, Dhkem, init_dhkem, KEM_USAGES, LABEL_DKP_PRK, LABEL_SK, init_dhkemPrimitives, Bignum, init_bignum, LABEL_CANDIDATE, ORDER_P_256, ORDER_P_384, ORDER_P_521, PKCS8_ALG_ID_P_256, PKCS8_ALG_ID_P_384, PKCS8_ALG_ID_P_521, EC_P_256_PARAMS, EC_P_384_PARAMS, EC_P_521_PARAMS, Ec, init_ec, init_xCryptoKey, init_xCurve, init_hybridkem, AEAD_USAGES, init_aeadEncryptionContext, _endianTestBuffer, _endianTestBytes, isLE, init_noble, init_hash2, _HMAC, hmac, init_hmac, init_md, U32_MASK64, _32n, init_u64, init_sha2, _0n, _1n, _2n, _7n, _256n, _0x71n, SHA3_PI, SHA3_ROTL, _SHA3_IOTA, IOTAS, SHA3_IOTA_H, SHA3_IOTA_L, init_sha3, init_modular, init_curve, init_montgomery, init_mod, AesGcmContext, Aes128Gcm, Aes256Gcm, init_aesGcm, init_exportOnly, init_emitNotSupported, LABEL_SEC, ExporterContextImpl, RecipientExporterContextImpl, SenderExporterContextImpl, init_exporterContext, EncryptionContextImpl, init_encryptionContext, __classPrivateFieldGet, __classPrivateFieldSet, _Mutex_locked, Mutex, init_mutex, __classPrivateFieldGet2, __classPrivateFieldSet2, _RecipientContextImpl_mutex, RecipientContextImpl, init_recipientContext, __classPrivateFieldGet3, __classPrivateFieldSet3, _SenderContextImpl_mutex, SenderContextImpl, init_senderContext, LABEL_BASE_NONCE, LABEL_EXP, LABEL_INFO_HASH, LABEL_KEY, LABEL_PSK_ID_HASH, LABEL_SECRET, SUITE_ID_HEADER_HPKE, CipherSuiteNative, init_cipherSuiteNative, DhkemP256HkdfSha256Native, DhkemP384HkdfSha384Native, DhkemP521HkdfSha512Native, init_dhkemNative, CipherSuite, DhkemP256HkdfSha256, DhkemP384HkdfSha384, DhkemP521HkdfSha512, HkdfSha256, HkdfSha384, HkdfSha512, init_native, ALG_NAME, PKCS8_ALG_ID_X25519, BASE_POINT_X25519, X25519, init_x25519, DhkemX25519HkdfSha256, init_dhkemX25519, PKCS8_ALG_ID_X448, init_x448, init_dhkemX448, init_mod2, init_hpke2, isLE2, wrapCipher, init_utils, encodeStr, sigma16, sigma32, sigma16_32, sigma32_32, BLOCK_LEN, BLOCK_LEN32, MAX_COUNTER, U32_EMPTY, _XorStreamPRG, createPRG, init_arx, Poly1305, poly1305, init_poly1305, chacha_exports, chacha20orig, chacha20, xchacha20, chacha8, chacha12, ZEROS16, updatePadded, ZEROS32, _poly1305_aead, chacha20poly1305, xchacha20poly1305, rngChacha20, rngChacha8, init_chacha, init_makeAead, init_makeKdfImpl, init_makeDhKem, init_makeHpke, defaultRng, init_rng, crypto2, init_cryptoNode, isLE3, swap32IfBE2, hasHexBuiltin, hexes, asciis, Hash, init_utils2, HashMD2, SHA256_IV2, SHA384_IV2, SHA512_IV2, init_md2, U32_MASK642, _32n2, shrSH2, shrSL2, rotrSH2, rotrSL2, rotrBH2, rotrBL2, rotlSH2, rotlSL2, rotlBH2, rotlBL2, add3L2, add3H2, add4L2, add4H2, add5L2, add5H2, init_u642, SHA256_K, SHA256_W, SHA256, K512, SHA512_Kh, SHA512_Kl, SHA512_W_H, SHA512_W_L, SHA512, SHA384, sha2563, sha5122, sha3842, init_sha22, _0n2, _1n2, isPosBig, bitMask, notImplemented, init_utils3, _0n3, _1n3, _2n2, _3n, _4n, _5n, _7n2, _8n, _9n, _16n, isNegativeLE, FIELD_FIELDS, init_modular2, _0n4, _1n4, pointPrecomputes, pointWindowSizes, wNAF, init_curve2, _0n5, _1n5, _2n3, _8n2, PrimeEdwardsPoint, init_edwards, os2ip, _DST_scalar, init_hash_to_curve, _0n6, _1n6, _2n4, init_montgomery2, ed25519_exports, _0n7, _1n7, _2n5, _3n2, _5n2, _8n3, ed25519_CURVE_p, ed25519_CURVE, ED25519_SQRT_M1, Fp, Fn, ed25519Defaults, ed25519, ed25519ctx, ed25519ph, x25519, ELL2_C1, ELL2_C2, ELL2_C3, ELL2_C1_EDWARDS, ed25519_hasher, SQRT_M1, SQRT_AD_MINUS_ONE, INVSQRT_A_MINUS_D, ONE_MINUS_D_SQ, D_MINUS_ONE_SQ, invertSqrt, MAX_255B, bytes255ToNumberLE, _RistrettoPoint, ristretto255, ristretto255_hasher, ED25519_TORSION_SUBGROUP, edwardsToMontgomery, RistrettoPoint, hashToCurve, encodeToCurve, hashToRistretto255, hash_to_ristretto255, init_ed25519, _0n8, _1n8, _2n6, _7n3, _256n2, _0x71n2, SHA3_PI2, SHA3_ROTL2, _SHA3_IOTA2, IOTAS2, SHA3_IOTA_H2, SHA3_IOTA_L2, rotlH, rotlL, Keccak, genShake, shake2562, init_sha32, ed448_exports, ed448_CURVE, E448_CURVE, shake256_114, shake256_64, _1n9, _2n7, _3n3, _4n2, _11n, _22n, _44n, _88n, _223n, Fp2, Fn2, Fp448, Fn448, ED448_DEF, ed448, ed448ph, E448, x448, ELL2_C12, ELL2_J, ed448_hasher, ONE_MINUS_D, ONE_MINUS_TWO_D, SQRT_MINUS_D, INVSQRT_MINUS_D, invertSqrt2, _DecafPoint, decaf448, decaf448_hasher, ED448_TORSION_SUBGROUP, DecafPoint, hashToCurve2, encodeToCurve2, hashToDecaf448, hash_to_decaf448, edwardsToMontgomery2, init_ed448, HMAC, hmac2, init_hmac2, divNearest, DERErr, DER, _0n9, _1n10, _2n8, _3n4, _4n3, init_weierstrass, init_shortw_utils, nist_exports, p256_CURVE, p384_CURVE, p521_CURVE, Fp256, Fp384, Fp521, p256, p256_hasher, p384, p384_hasher, p521, secp256r1, secp384r1, secp521r1, p521_hasher, init_nist, init_makeNobleSignatureImpl, defaultCryptoProvider, init_provider, init_getCiphersuiteImpl, init_resumption, oidNist2, init_utils4, HashMD3, SHA256_IV3, SHA384_IV3, SHA512_IV3, init_md3, U32_MASK643, _32n3, shrSH3, shrSL3, rotrSH3, rotrSL3, rotrBH3, rotrBL3, add3L3, add3H3, add4L3, add4H3, add5L3, add5H3, init_u643, SHA256_K2, SHA256_W2, SHA2_32B, _SHA256, K5122, SHA512_Kh2, SHA512_Kl2, SHA512_W_H2, SHA512_W_L2, SHA2_64B, _SHA512, _SHA384, sha2564, sha5123, sha3843, init_sha23, _HMAC2, hmac3, init_hmac3, init_makeHashImpl2, init_makeNobleSignatureImpl2, BLOCK_SIZE, ZEROS162, ZEROS322, POLY, mul2, swapLE, estimateWindow, GHASH, Polyval, ghash, polyval, init_polyval, BLOCK_SIZE2, BLOCK_SIZE32, EMPTY_BLOCK, POLY2, sbox, rotr32_8, rotl32_8, tableEncoding, xPowers, gcm, _CMAC, cmac, init_aes, init_makeAead2, init_makeKdfImpl2, init_makeDhKem2, init_makeHpke2, init_rng2, nobleCryptoProvider, init_provider2, mlsPublicMessageEncoder, encodeMlsPublicMessage, mlsWelcomeEncoder, encodeMlsWelcome, mlsPrivateMessageEncoder, encodeMlsPrivateMessage, mlsGroupInfoEncoder, encodeMlsGroupInfo, mlsKeyPackageEncoder, encodeMlsKeyPackage, mlsMessageContentEncoder, encodeMlsMessageContent, decodeMlsMessageContent, mlsMessageEncoder, encodeMlsMessage, decodeMlsMessage, init_message, greaseValues, defaultGreaseConfig, init_grease, init_defaultCapabilities, init_src, DEFAULT_CIPHERSUITE, MLSGroupManager, init_mls_group, DOMAIN, NONCE_BYTES2, init_owner_sync, init_mls_delivery_order, dist_exports2, init_dist2, DIR_MODE, FILE_MODE, init_secure_file, SYNC_LOCK_STALE_MS, pendingKpPath, init_mls_state, init_mls_kp_pool, PACKAGE, FALLBACK, MAX_LEN, DISALLOWED, init_client_version, CredentialStore, init_credential_store, init_crypto_helpers, STATE_FILE, LEGACY_STATE_FILE, init_state, init_transport2, A2ALogGate, init_a2a_log_gate, init_mls_membership_probe, openclaw_compat_exports, defaultImporter, HEARTBEAT_CANDIDATES, AGENT_EVENT_CANDIDATES, TRANSCRIPT_CANDIDATES, _heartbeatFn, _agentEventFn, _transcriptFn, init_openclaw_compat, http_handlers_exports, init_http_handlers, mcp_proxy_helpers_exports, init_mcp_proxy_helpers, workspace_handlers_exports, MAX_FILE_SIZE, init_workspace_handlers, ROOM_AGENT_TYPES, CREDENTIAL_MESSAGE_TYPES, CATCHUP_MESSAGE_TYPES, POLL_INTERVAL_MS, RECONNECT_BASE_MS, RECONNECT_MAX_MS, PENDING_POLL_INTERVAL_MS, OUTBOUND_DEDUPE_WINDOW_MS, OUTBOUND_DEDUPE_MAX_SUPPRESS_MS, OUTBOUND_DEDUPE_MAX, OUTBOUND_DEDUPE_TYPES, RETRY_CANDIDATE_TTL_MS, RETRY_CANDIDATE_MAX, SecureChannel, init_channel, init_types, DEFAULT_API_URL, DEFAULT_HTTP_PORT, init_account_config, init_lifecycle, _ocRuntime, _channels, agentVaultPlugin, init_openclaw_plugin, init_gateway_send, init_llm_response_parser, init_llm_cost, traceStore, init_fetch_interceptor, init_tool_audit, init_harness_compat, isUsingManagedRoutes, init_openclaw_entry, util, objectUtil, ZodParsedType, getParsedType, init_util, ZodIssueCode, ZodError, init_ZodError, errorMap, en_default, init_en, overrideErrorMap, init_errors2, makeIssue, ParseStatus, INVALID, DIRTY, OK, isAborted, isDirty, isValid, isAsync, init_parseUtil, init_typeAliases, errorUtil, init_errorUtil, ParseInputLazyPath, handleResult, ZodType, cuidRegex, cuid2Regex, ulidRegex, uuidRegex, nanoidRegex, jwtRegex, durationRegex, emailRegex, _emojiRegex, emojiRegex, ipv4Regex, ipv4CidrRegex, ipv6Regex, ipv6CidrRegex, base64Regex, base64urlRegex, dateRegexSource, dateRegex, ZodString, ZodNumber, ZodBigInt, ZodBoolean, ZodDate, ZodSymbol, ZodUndefined, ZodNull, ZodAny, ZodUnknown, ZodNever, ZodVoid, ZodArray, ZodObject, ZodUnion, getDiscriminator, ZodDiscriminatedUnion, ZodIntersection, ZodTuple, ZodRecord, ZodMap, ZodSet, ZodFunction, ZodLazy, ZodLiteral, ZodEnum, ZodNativeEnum, ZodPromise, ZodEffects, ZodOptional, ZodNullable, ZodDefault, ZodCatch, ZodNaN, ZodBranded, ZodPipeline, ZodReadonly, late, ZodFirstPartyTypeKind, stringType, numberType, nanType, bigIntType, booleanType, dateType, symbolType, undefinedType, nullType, anyType, unknownType, neverType, voidType, arrayType, objectType, strictObjectType, unionType, discriminatedUnionType, intersectionType, tupleType, recordType, mapType, setType, functionType, lazyType, literalType, enumType, nativeEnumType, promiseType, effectsType, optionalType, nullableType, preprocessType, pipelineType, init_types2, init_external, init_v3, NEVER, $ZodAsyncError, $ZodEncodeError, globalConfig, init_core, util_exports, EVALUATING, captureStackTrace, allowsEval, getParsedType2, propertyKeyTypes, primitiveTypes, NUMBER_FORMAT_RANGES, BIGINT_FORMAT_RANGES, Class, init_util2, initializer, $ZodError, $ZodRealError, init_errors3, _parse, parse, _parseAsync, parseAsync, _safeParse, safeParse, _safeParseAsync, safeParseAsync, _encode, _decode, _encodeAsync, _decodeAsync, _safeEncode, _safeDecode, _safeEncodeAsync, _safeDecodeAsync, init_parse, regexes_exports, cuid, cuid2, ulid, xid, ksuid, nanoid, duration, extendedDuration, guid, uuid, uuid4, uuid6, uuid7, email, html5Email, rfc5322Email, unicodeEmail, idnEmail, browserEmail, _emoji, ipv4, ipv6, mac, cidrv4, cidrv6, base64, base64url, hostname, domain, e164, dateSource, date, string, bigint, integer, number, boolean, _null, _undefined, lowercase, uppercase, hex, md5_hex, md5_base64, md5_base64url, sha1_hex, sha1_base64, sha1_base64url, sha256_hex, sha256_base64, sha256_base64url, sha384_hex, sha384_base64, sha384_base64url, sha512_hex, sha512_base64, sha512_base64url, init_regexes, $ZodCheck, numericOriginMap, $ZodCheckLessThan, $ZodCheckGreaterThan, $ZodCheckMultipleOf, $ZodCheckNumberFormat, $ZodCheckBigIntFormat, $ZodCheckMaxSize, $ZodCheckMinSize, $ZodCheckSizeEquals, $ZodCheckMaxLength, $ZodCheckMinLength, $ZodCheckLengthEquals, $ZodCheckStringFormat, $ZodCheckRegex, $ZodCheckLowerCase, $ZodCheckUpperCase, $ZodCheckIncludes, $ZodCheckStartsWith, $ZodCheckEndsWith, $ZodCheckProperty, $ZodCheckMimeType, $ZodCheckOverwrite, init_checks, Doc, init_doc, version, init_versions, $ZodType, $ZodString, $ZodStringFormat, $ZodGUID, $ZodUUID, $ZodEmail, $ZodURL, $ZodEmoji, $ZodNanoID, $ZodCUID, $ZodCUID2, $ZodULID, $ZodXID, $ZodKSUID, $ZodISODateTime, $ZodISODate, $ZodISOTime, $ZodISODuration, $ZodIPv4, $ZodIPv6, $ZodMAC, $ZodCIDRv4, $ZodCIDRv6, $ZodBase64, $ZodBase64URL, $ZodE164, $ZodJWT, $ZodCustomStringFormat, $ZodNumber, $ZodNumberFormat, $ZodBoolean, $ZodBigInt, $ZodBigIntFormat, $ZodSymbol, $ZodUndefined, $ZodNull, $ZodAny, $ZodUnknown, $ZodNever, $ZodVoid, $ZodDate, $ZodArray, $ZodObject, $ZodObjectJIT, $ZodUnion, $ZodXor, $ZodDiscriminatedUnion, $ZodIntersection, $ZodTuple, $ZodRecord, $ZodMap, $ZodSet, $ZodEnum, $ZodLiteral, $ZodFile, $ZodTransform, $ZodOptional, $ZodExactOptional, $ZodNullable, $ZodDefault, $ZodPrefault, $ZodNonOptional, $ZodSuccess, $ZodCatch, $ZodNaN, $ZodPipe, $ZodCodec, $ZodReadonly, $ZodTemplateLiteral, $ZodFunction, $ZodPromise, $ZodLazy, $ZodCustom, init_schemas, init_ar, init_az, init_be, init_bg, init_ca, init_cs, init_da, init_de, error, init_en2, init_eo, init_es, init_fa, init_fi, init_fr, init_fr_CA, init_he, init_hu, init_hy, init_id, init_is, init_it, init_ja, init_ka, init_km, init_kh, init_ko, init_lt, init_mk, init_ms, init_nl, init_no, init_ota, init_ps, init_pl, init_pt, init_ru, init_sl, init_sv, init_ta, init_th, init_tr, init_uk, init_ua, init_ur, init_uz, init_vi, init_zh_CN, init_zh_TW, init_yo, init_locales, _a2, $ZodRegistry, globalRegistry, init_registries, init_api, createToJSONSchemaMethod, createStandardJSONSchemaMethod, init_to_json_schema, formatMap, stringProcessor, numberProcessor, booleanProcessor, bigintProcessor, symbolProcessor, nullProcessor, undefinedProcessor, voidProcessor, neverProcessor, anyProcessor, unknownProcessor, dateProcessor, enumProcessor, literalProcessor, nanProcessor, templateLiteralProcessor, fileProcessor, successProcessor, customProcessor, functionProcessor, transformProcessor, mapProcessor, setProcessor, arrayProcessor, objectProcessor, unionProcessor, intersectionProcessor, tupleProcessor, recordProcessor, nullableProcessor, nonoptionalProcessor, defaultProcessor, prefaultProcessor, catchProcessor, pipeProcessor, readonlyProcessor, promiseProcessor, optionalProcessor, lazyProcessor, allProcessors, init_json_schema_processors, init_json_schema_generator, init_json_schema, init_core2, init_parse2, ZodMiniType, ZodMiniObject, init_schemas2, init_checks2, init_iso, init_coerce, init_external2, init_v4_mini, init_zod_compat, checks_exports2, init_checks3, iso_exports2, ZodISODateTime, ZodISODate, ZodISOTime, ZodISODuration, init_iso2, initializer2, ZodError2, ZodRealError, init_errors4, parse2, parseAsync2, safeParse3, safeParseAsync3, encode3, decode2, encodeAsync2, decodeAsync2, safeEncode2, safeDecode2, safeEncodeAsync2, safeDecodeAsync2, init_parse3, schemas_exports3, ZodType2, _ZodString, ZodString2, ZodStringFormat, ZodEmail, ZodGUID, ZodUUID, ZodURL, ZodEmoji, ZodNanoID, ZodCUID, ZodCUID2, ZodULID, ZodXID, ZodKSUID, ZodIPv4, ZodMAC, ZodIPv6, ZodCIDRv4, ZodCIDRv6, ZodBase64, ZodBase64URL, ZodE164, ZodJWT, ZodCustomStringFormat, ZodNumber2, ZodNumberFormat, ZodBoolean2, ZodBigInt2, ZodBigIntFormat, ZodSymbol2, ZodUndefined2, ZodNull2, ZodAny2, ZodUnknown2, ZodNever2, ZodVoid2, ZodDate2, ZodArray2, ZodObject2, ZodUnion2, ZodXor, ZodDiscriminatedUnion2, ZodIntersection2, ZodTuple2, ZodRecord2, ZodMap2, ZodSet2, ZodEnum2, ZodLiteral2, ZodFile, ZodTransform, ZodOptional2, ZodExactOptional, ZodNullable2, ZodDefault2, ZodPrefault, ZodNonOptional, ZodSuccess, ZodCatch2, ZodNaN2, ZodPipe, ZodCodec, ZodReadonly2, ZodTemplateLiteral, ZodLazy2, ZodPromise2, ZodFunction2, ZodCustom, describe2, meta2, stringbool, init_schemas3, ZodFirstPartyTypeKind2, init_compat, z2, init_from_json_schema, init_coerce2, init_external3, init_classic, init_v4, LATEST_PROTOCOL_VERSION, DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, RELATED_TASK_META_KEY, JSONRPC_VERSION, AssertObjectSchema, ProgressTokenSchema, CursorSchema, TaskCreationParamsSchema, TaskMetadataSchema, RelatedTaskMetadataSchema, RequestMetaSchema, BaseRequestParamsSchema, TaskAugmentedRequestParamsSchema, isTaskAugmentedRequestParams, RequestSchema, NotificationsParamsSchema, NotificationSchema, ResultSchema, RequestIdSchema, JSONRPCRequestSchema, isJSONRPCRequest, JSONRPCNotificationSchema, isJSONRPCNotification, JSONRPCResultResponseSchema, isJSONRPCResultResponse, ErrorCode, JSONRPCErrorResponseSchema, isJSONRPCErrorResponse, JSONRPCMessageSchema, JSONRPCResponseSchema, EmptyResultSchema, CancelledNotificationParamsSchema, CancelledNotificationSchema, IconSchema, IconsSchema, BaseMetadataSchema, ImplementationSchema, FormElicitationCapabilitySchema, ElicitationCapabilitySchema, ClientTasksCapabilitySchema, ServerTasksCapabilitySchema, ClientCapabilitiesSchema, InitializeRequestParamsSchema, InitializeRequestSchema, isInitializeRequest, ServerCapabilitiesSchema, InitializeResultSchema, InitializedNotificationSchema, PingRequestSchema, ProgressSchema, ProgressNotificationParamsSchema, ProgressNotificationSchema, PaginatedRequestParamsSchema, PaginatedRequestSchema, PaginatedResultSchema, TaskStatusSchema, TaskSchema, CreateTaskResultSchema, TaskStatusNotificationParamsSchema, TaskStatusNotificationSchema, GetTaskRequestSchema, GetTaskResultSchema, GetTaskPayloadRequestSchema, GetTaskPayloadResultSchema, ListTasksRequestSchema, ListTasksResultSchema, CancelTaskRequestSchema, CancelTaskResultSchema, ResourceContentsSchema, TextResourceContentsSchema, Base64Schema, BlobResourceContentsSchema, RoleSchema, AnnotationsSchema, ResourceSchema, ResourceTemplateSchema, ListResourcesRequestSchema, ListResourcesResultSchema, ListResourceTemplatesRequestSchema, ListResourceTemplatesResultSchema, ResourceRequestParamsSchema, ReadResourceRequestParamsSchema, ReadResourceRequestSchema, ReadResourceResultSchema, ResourceListChangedNotificationSchema, SubscribeRequestParamsSchema, SubscribeRequestSchema, UnsubscribeRequestParamsSchema, UnsubscribeRequestSchema, ResourceUpdatedNotificationParamsSchema, ResourceUpdatedNotificationSchema, PromptArgumentSchema, PromptSchema, ListPromptsRequestSchema, ListPromptsResultSchema, GetPromptRequestParamsSchema, GetPromptRequestSchema, TextContentSchema, ImageContentSchema, AudioContentSchema, ToolUseContentSchema, EmbeddedResourceSchema, ResourceLinkSchema, ContentBlockSchema, PromptMessageSchema, GetPromptResultSchema, PromptListChangedNotificationSchema, ToolAnnotationsSchema, ToolExecutionSchema, ToolSchema, ListToolsRequestSchema, ListToolsResultSchema, CallToolResultSchema, CompatibilityCallToolResultSchema, CallToolRequestParamsSchema, CallToolRequestSchema, ToolListChangedNotificationSchema, ListChangedOptionsBaseSchema, LoggingLevelSchema, SetLevelRequestParamsSchema, SetLevelRequestSchema, LoggingMessageNotificationParamsSchema, LoggingMessageNotificationSchema, ModelHintSchema, ModelPreferencesSchema, ToolChoiceSchema, ToolResultContentSchema, SamplingContentSchema, SamplingMessageContentBlockSchema, SamplingMessageSchema, CreateMessageRequestParamsSchema, CreateMessageRequestSchema, CreateMessageResultSchema, CreateMessageResultWithToolsSchema, BooleanSchemaSchema, StringSchemaSchema, NumberSchemaSchema, UntitledSingleSelectEnumSchemaSchema, TitledSingleSelectEnumSchemaSchema, LegacyTitledEnumSchemaSchema, SingleSelectEnumSchemaSchema, UntitledMultiSelectEnumSchemaSchema, TitledMultiSelectEnumSchemaSchema, MultiSelectEnumSchemaSchema, EnumSchemaSchema, PrimitiveSchemaDefinitionSchema, ElicitRequestFormParamsSchema, ElicitRequestURLParamsSchema, ElicitRequestParamsSchema, ElicitRequestSchema, ElicitationCompleteNotificationParamsSchema, ElicitationCompleteNotificationSchema, ElicitResultSchema, ResourceTemplateReferenceSchema, PromptReferenceSchema, CompleteRequestParamsSchema, CompleteRequestSchema, CompleteResultSchema, RootSchema, ListRootsRequestSchema, ListRootsResultSchema, RootsListChangedNotificationSchema, ClientRequestSchema, ClientNotificationSchema, ClientResultSchema, ServerRequestSchema, ServerNotificationSchema, ServerResultSchema, McpError, UrlElicitationRequiredError, init_types3, init_interfaces, ignoreOverride, defaultOptions, getDefaultOptions, init_Options, getRefs, init_Refs, init_errorMessages, getRelativePath, init_getRelativePath, init_any, init_array2, init_bigint, init_boolean, init_branded, parseCatchDef, init_catch, integerDateParser, init_date, init_default, init_effects, init_enum, isJsonSchema7AllOfType, init_intersection, init_literal, emojiRegex2, zodPatterns, ALPHA_NUMERIC, init_string2, init_record, init_map, init_nativeEnum, init_never, init_null, primitiveMappings, asAnyOf, init_union, init_nullable, init_number2, init_object, parseOptionalDef, init_optional2, parsePipelineDef, init_pipeline, init_promise, init_set, init_tuple, init_undefined, init_unknown, parseReadonlyDef, init_readonly, selectParser, init_selectParser, get$ref, addMeta, init_parseDef, init_parseTypes, zodToJsonSchema, init_zodToJsonSchema, init_esm, init_zod_json_schema_compat, DEFAULT_REQUEST_TIMEOUT_MSEC, Protocol, init_protocol, require_code, require_scope, require_codegen, require_util, require_names, require_errors, require_boolSchema, require_rules, require_applicability, require_dataType, require_defaults, require_code2, require_keyword, require_subschema, require_fast_deep_equal, require_json_schema_traverse, require_resolve, require_validate, require_validation_error, require_ref_error, require_compile, require_data, require_utils, require_schemes, require_fast_uri, require_uri, require_core, require_id, require_ref, require_core2, require_limitNumber, require_multipleOf, require_ucs2length, require_limitLength, require_pattern, require_limitProperties, require_required, require_limitItems, require_equal, require_uniqueItems, require_const, require_enum, require_validation, require_additionalItems, require_items, require_prefixItems, require_items2020, require_contains, require_dependencies, require_propertyNames, require_additionalProperties, require_properties, require_patternProperties, require_not, require_anyOf, require_oneOf, require_allOf, require_if, require_thenElse, require_applicator, require_format, require_format2, require_metadata, require_draft7, require_types, require_discriminator, require_json_schema_draft_07, require_ajv, require_formats, require_limit, require_dist, import_ajv, import_ajv_formats, AjvJsonSchemaValidator, init_ajv_provider, ExperimentalServerTasks, init_server, init_helpers, Server, init_server2, COMPLETABLE_SYMBOL, McpZodTypeKind, init_completable, init_uriTemplate, TOOL_NAME_REGEX, init_toolNameValidation, ExperimentalMcpServerTasks, init_mcp_server, init_zod, McpServer, EMPTY_OBJECT_JSON_SCHEMA, EMPTY_COMPLETION_RESULT, init_mcp, RequestError, toRequestError, GlobalRequest, Request2, newHeadersFromIncoming, wrapBodyStream, newRequestFromIncoming, getRequestCache, requestCache, incomingKey, urlKey, headersKey, abortControllerKey, getAbortController, requestPrototype, newRequest, responseCache, getResponseCache, cacheKey, GlobalResponse, Response2, buildOutgoingHttpHeaders, X_ALREADY_SENT, outgoingEnded, handleRequestError, handleFetchError, handleResponseError, flushHeaders, responseViaCache, isPromise, responseViaResponseObject, getRequestListener, init_dist22, WebStandardStreamableHTTPServerTransport, init_webStandardStreamableHttp, StreamableHTTPServerTransport, init_streamableHttp, AgentVaultMcpServer, init_mcp_server2, init_mcp_handlers, init_skill_manifest, init_skill_invoker, spanBuffer, init_skill_telemetry, PolicyEnforcer, init_policy_enforcer, VERSION, init_index;
+var __create, __defProp2, __getOwnPropDesc, __getOwnPropNames2, __getProtoOf, __hasOwnProp, __esm2, __commonJS, __export2, __copyProps, __toESM, init_mls_commit_classify, __filename, __dirname, url2, path, Module, Module, root, window_, crypto_, randomValuesStandard, crypto4, randomValueNodeJS, _Module, libsodium_sumo_default, init_libsodium_sumo, a, r, t, c, libsodium_wrappers_default, init_libsodium_wrappers, init_keys, init_x3dh, MAX_SKIP, CHAIN_KEY_SEED, MSG_KEY_SEED, HEADER_KEY_SEED, DoubleRatchet, init_ratchet, init_file_crypto, DOMAIN_DID_DOCUMENT, DOMAIN_TRANSFER_INTENT, DOMAIN_TRANSFER_ACCEPT, BASE58_ALPHABET, init_did, BUILTIN_PATTERNS, ScanEngine, init_scan_engine, init_merkle, VC_CONTEXT_V2, AV_CREDENTIAL_CONTEXT, CRYPTOSUITE, BASE58_ALPHABET2, init_vc, init_transport, init_telemetry, TelemetryReporter, init_telemetry_reporter, CROCKFORD, ARGON2_OPSLIMIT, ARGON2_MEMLIMIT, SALT_BYTES, NONCE_BYTES, KEY_BYTES, BACKUP_VERSION, MAX_BACKUP_SIZE, init_backup, init_approval, encVoid, init_tlsEncoder, uint8Encoder, encodeUint8, decodeUint8, uint16Encoder, encodeUint16, decodeUint16, uint32Encoder, encodeUint32, decodeUint32, uint64Encoder, encodeUint64, decodeUint64, init_number, init_tlsDecoder, init_enumHelpers, defaultProposalTypes, defaultProposalTypeEncoder, encodeDefaultProposalType, decodeDefaultProposalType, init_defaultProposalType, defaultExtensionTypes, defaultExtensionTypeEncoder, encodeDefaultExtensionType, decodeDefaultExtensionType, init_defaultExtensionType, acceptAll, init_incomingMessageAction, MlsError, ValidationError, CodecError, UsageError, DependencyError, CryptoVerificationError, CryptoError, InternalError, init_mlsError, init_byteArray, varLenDataEncoder, decodeVarLenData, init_variableLength, init_constantTimeCompare, extensionTypeEncoder, encodeExtensionType, decodeExtensionType, extensionEncoder, encodeExtension, decodeExtension, init_extension, credentialTypes, credentialTypeEncoder, encodeCredentialType, decodeCredentialType, init_credentialType, credentialBasicEncoder, encodeCredentialBasic, credentialX509Encoder, encodeCredentialX509, credentialCustomEncoder, encodeCredentialCustom, credentialEncoder, encodeCredential, decodeCredentialBasic, decodeCredentialX509, decodeCredential, init_credential, externalSenderEncoder, encodeExternalSender, decodeExternalSender, init_externalSender, init_hash, init_optional, ciphersuites, ciphersuiteEncoder, encodeCiphersuite, decodeCiphersuite, ciphersuiteValues, init_ciphersuite, init_signature, protocolVersions, protocolVersionEncoder, encodeProtocolVersion, decodeProtocolVersion, init_protocolVersion, capabilitiesEncoder, encodeCapabilities, decodeCapabilities, init_capabilities, leafNodeSources, leafNodeSourceEncoder, encodeLeafNodeSource, decodeLeafNodeSource, init_leafNodeSource, lifetimeEncoder, encodeLifetime, decodeLifetime, defaultLifetime, init_lifetime, leafNodeDataEncoder, encodeLeafNodeData, decodeLeafNodeData, leafNodeInfoKeyPackageEncoder, encodeLeafNodeInfoKeyPackage, leafNodeInfoUpdateOmittedEncoder, encodeLeafNodeInfoUpdateOmitted, leafNodeInfoCommitOmittedEncoder, encodeLeafNodeInfoCommitOmitted, leafNodeInfoOmittedEncoder, encodeLeafNodeInfoOmitted, decodeLeafNodeInfoKeyPackage, decodeLeafNodeInfoUpdateOmitted, decodeLeafNodeInfoCommitOmitted, decodeLeafNodeInfoOmitted, leafNodeInfoUpdateEncoder, encodeLeafNodeInfoUpdate, leafNodeInfoCommitEncoder, encodeLeafNodeInfoCommit, leafNodeInfoEncoder, encodeLeafNodeInfo, decodeLeafNodeInfoUpdate, decodeLeafNodeInfoCommit, decodeLeafNodeInfo, leafNodeTBSEncoder, encodeLeafNodeTBS, leafNodeEncoder, encodeLeafNode, decodeLeafNode, decodeLeafNodeKeyPackage, decodeLeafNodeCommit, decodeLeafNodeUpdate, init_leafNode, keyPackageTBSEncoder, encodeKeyPackageTBS, decodeKeyPackageTBS, keyPackageEncoder, encodeKeyPackage, decodeKeyPackage, init_keyPackage, init_kdf, pskTypes, pskTypeEncoder, encodePskType, decodePskType, resumptionPSKUsages, resumptionPSKUsageEncoder, encodeResumptionPSKUsage, decodeResumptionPSKUsage, encodePskInfoExternal, encodePskInfoResumption, decodePskInfoResumption, pskInfoEncoder, encodePskInfo, decodePskInfo, pskIdEncoder, encodePskId, decodePskId, pskLabelEncoder, encodePskLabel, decodePskLabel, init_presharedkey, addEncoder, encodeAdd, decodeAdd, updateEncoder, encodeUpdate, decodeUpdate, removeEncoder, encodeRemove, decodeRemove, pskEncoder, encodePSK, decodePSK, reinitEncoder, encodeReinit, decodeReinit, externalInitEncoder, encodeExternalInit, decodeExternalInit, groupContextExtensionsEncoder, encodeGroupContextExtensions, decodeGroupContextExtensions, proposalAddEncoder, encodeProposalAdd, proposalUpdateEncoder, encodeProposalUpdate, proposalRemoveEncoder, encodeProposalRemove, proposalPSKEncoder, encodeProposalPSK, proposalReinitEncoder, encodeProposalReinit, proposalExternalInitEncoder, encodeProposalExternalInit, proposalGroupContextExtensionsEncoder, encodeProposalGroupContextExtensions, proposalCustomEncoder, encodeProposalCustom, proposalEncoder, encodeProposal, decodeProposalAdd, decodeProposalUpdate, decodeProposalRemove, decodeProposalPSK, decodeProposalReinit, decodeProposalExternalInit, decodeProposalGroupContextExtensions, decodeProposal, init_proposal, proposalOrRefTypes, proposalOrRefTypeEncoder, encodeProposalOrRefType, decodeProposalOrRefType, proposalOrRefProposalEncoder, encodeProposalOrRefProposal, proposalOrRefProposalRefEncoder, encodeProposalOrRefProposalRef, proposalOrRefEncoder, encodeProposalOrRef, decodeProposalOrRef, init_proposalOrRefType, init_hpke, groupContextEncoder, encodeGroupContext, decodeGroupContext, init_groupContext, nodeTypes, nodeTypeEncoder, encodeNodeType, decodeNodeType, init_nodeType, parentNodeEncoder, encodeParentNode, decodeParentNode, init_parentNode, init_treemath, nodeEncoder, encodeNode, decodeNode, ratchetTreeEncoder, encodeRatchetTree, decodeRatchetTree, init_ratchetTree, leafNodeHashInputEncoder, encodeLeafNodeHashInput, decodeLeafNodeHashInput, parentNodeHashInputEncoder, encodeParentNodeHashInput, decodeParentNodeHashInput, treeHashInputEncoder, encodeTreeHashInput, decodeTreeHashInput, init_treeHash, parentHashInputEncoder, encodeParentHashInput, decodeParentHashInput, init_parentHash, hpkeCiphertextEncoder, encodeHpkeCiphertext, decodeHpkeCiphertext, init_hpkeCiphertext, updatePathNodeEncoder, encodeUpdatePathNode, decodeUpdatePathNode, updatePathEncoder, encodeUpdatePath, decodeUpdatePath, init_updatePath, commitEncoder, encodeCommit, decodeCommit, init_commit, contentTypes, contentTypeEncoder, encodeContentType, decodeContentType, init_contentType, wireformats, wireformatEncoder, encodeWireformat, decodeWireformat, init_wireformat, senderTypes, senderTypeEncoder, encodeSenderType, decodeSenderType, senderEncoder, encodeSender, decodeSender, reuseGuardEncoder, encodeReuseGuard, decodeReuseGuard, senderDataEncoder, encodeSenderData, decodeSenderData, senderDataAADEncoder, encodeSenderDataAAD, decodeSenderDataAAD, init_sender, framedContentApplicationDataEncoder, encodeFramedContentApplicationData, framedContentProposalDataEncoder, encodeFramedContentProposalData, framedContentCommitDataEncoder, encodeFramedContentCommitData, framedContentInfoEncoder, encodeFramedContentInfo, decodeFramedContentApplicationData, decodeFramedContentProposalData, decodeFramedContentCommitData, decodeFramedContentInfo, framedContentEncoder, encodeFramedContent, decodeFramedContent, senderInfoEncoder, encodeSenderInfo, framedContentTBSEncoder, encodeFramedContentTBS, encodeFramedContentAuthDataContent, encodeFramedContentAuthDataCommit, framedContentAuthDataEncoder, encodeFramedContentAuthData, decodeFramedContentAuthDataCommit, init_framedContent, authenticatedContentEncoder, encodeAuthenticatedContent, decodeAuthenticatedContent, authenticatedContentTBMEncoder, encodeAuthenticatedContentTBM, init_authenticatedContent, publicMessageInfoEncoder, encodePublicMessageInfo, publicMessageEncoder, encodePublicMessage, decodePublicMessage, init_publicMessage, init_messageProtectionPublic, init_externalProposal, requiredCapabilitiesEncoder, encodeRequiredCapabilities, decodeRequiredCapabilities, init_requiredCapabilities, defaultAuthenticationService, init_authenticationService, defaultPaddingConfig, init_paddingConfig, defaultKeyPackageEqualityConfig, init_keyPackageEqualityConfig, defaultLifetimeConfig, init_lifetimeConfig, defaultKeyRetentionConfig, init_keyRetentionConfig, groupInfoTBSEncoder, encodeGroupInfoTBS, decodeGroupInfoTBS, groupInfoEncoder, encodeGroupInfo, decodeGroupInfo, init_groupInfo, keyScheduleEncoder, encodeKeySchedule, decodeKeySchedule, init_keySchedule, generationSecretEncoder, decodeGenerationSecret, secretTreeNodeEncoder, decodeSecretTreeNode, secretTreeEncoder, decodeSecretTree, init_secretTree, confirmedTranscriptHashInputEncoder, encodeConfirmedTranscriptHashInput, decodeConfirmedTranscriptHashInput, init_transcriptHash, groupSecretsEncoder, encodeGroupSecrets, decodeGroupSecrets, init_groupSecrets, encryptedGroupSecretsEncoder, encodeEncryptedGroupSecrets, decodeEncryptedGroupSecrets, welcomeEncoder, encodeWelcome, decodeWelcome, init_welcome, init_pathSecrets, privateKeyPathEncoder, decodePrivateKeyPath, init_privateKeyPath, proposalWithSenderEncoder, decodeProposalWithSender, unappliedProposalsEncoder, decodeUnappliedProposals, init_unappliedProposals, emptyPskIndex, init_pskIndex, init_addToMap, defaultClientConfig, init_clientConfig, init_array, stringEncoder, encodeString, decodeString, init_string, activeEncoder, suspendedPendingReinitEncoder, removedFromGroupEncoder, groupActiveStateEncoder, decodeGroupActiveState, init_groupActiveState, epochReceiverDataEncoder, decodeEpochReceiverData, init_epochReceiverData, groupStateEncoder, encodeGroupState, decodeGroupState, groupStateEncoderWithoutTree, encodeGroupStateWithoutTree, emptyProposals, init_clientState, privateMessageEncoder, encodePrivateMessage, decodePrivateMessage, privateContentAADEncoder, encodePrivateContentAAD, decodePrivateContentAAD, init_privateMessage, init_messageProtection, init_createMessage, init_createCommit, init_processMessages, init_makeHashImpl, HpkeError, InvalidParamError, SerializeError, DeserializeError, EncapError, DecapError, ExportError, SealError, OpenError, MessageLimitReachedError, DeriveKeyPairError, NotSupportedError, init_errors, dntGlobals, dntGlobalThis, init_dnt_shims, NativeAlgorithm, init_algorithm, Mode, KemId, KdfId, AeadId, init_identifiers, INPUT_LENGTH_LIMIT, INFO_LENGTH_LIMIT, MINIMUM_PSK_LENGTH, EMPTY, BYTE_TO_BIGINT_256, init_consts, SUITE_ID_HEADER_KEM, init_kemInterface, HPKE_VERSION, HkdfNative, HkdfSha256Native, HkdfSha384Native, HkdfSha512Native, init_hkdf, isCryptoKeyPair, init_misc, LABEL_EAE_PRK, LABEL_SHARED_SECRET, Dhkem, init_dhkem, KEM_USAGES, LABEL_DKP_PRK, LABEL_SK, init_dhkemPrimitives, Bignum, init_bignum, LABEL_CANDIDATE, ORDER_P_256, ORDER_P_384, ORDER_P_521, PKCS8_ALG_ID_P_256, PKCS8_ALG_ID_P_384, PKCS8_ALG_ID_P_521, EC_P_256_PARAMS, EC_P_384_PARAMS, EC_P_521_PARAMS, Ec, init_ec, init_xCryptoKey, init_xCurve, init_hybridkem, AEAD_USAGES, init_aeadEncryptionContext, _endianTestBuffer, _endianTestBytes, isLE, init_noble, init_hash2, _HMAC, hmac, init_hmac, init_md, U32_MASK64, _32n, init_u64, init_sha2, _0n, _1n, _2n, _7n, _256n, _0x71n, SHA3_PI, SHA3_ROTL, _SHA3_IOTA, IOTAS, SHA3_IOTA_H, SHA3_IOTA_L, init_sha3, init_modular, init_curve, init_montgomery, init_mod, AesGcmContext, Aes128Gcm, Aes256Gcm, init_aesGcm, init_exportOnly, init_emitNotSupported, LABEL_SEC, ExporterContextImpl, RecipientExporterContextImpl, SenderExporterContextImpl, init_exporterContext, EncryptionContextImpl, init_encryptionContext, __classPrivateFieldGet, __classPrivateFieldSet, _Mutex_locked, Mutex, init_mutex, __classPrivateFieldGet2, __classPrivateFieldSet2, _RecipientContextImpl_mutex, RecipientContextImpl, init_recipientContext, __classPrivateFieldGet3, __classPrivateFieldSet3, _SenderContextImpl_mutex, SenderContextImpl, init_senderContext, LABEL_BASE_NONCE, LABEL_EXP, LABEL_INFO_HASH, LABEL_KEY, LABEL_PSK_ID_HASH, LABEL_SECRET, SUITE_ID_HEADER_HPKE, CipherSuiteNative, init_cipherSuiteNative, DhkemP256HkdfSha256Native, DhkemP384HkdfSha384Native, DhkemP521HkdfSha512Native, init_dhkemNative, CipherSuite, DhkemP256HkdfSha256, DhkemP384HkdfSha384, DhkemP521HkdfSha512, HkdfSha256, HkdfSha384, HkdfSha512, init_native, ALG_NAME, PKCS8_ALG_ID_X25519, BASE_POINT_X25519, X25519, init_x25519, DhkemX25519HkdfSha256, init_dhkemX25519, PKCS8_ALG_ID_X448, init_x448, init_dhkemX448, init_mod2, init_hpke2, isLE2, wrapCipher, init_utils, encodeStr, sigma16, sigma32, sigma16_32, sigma32_32, BLOCK_LEN, BLOCK_LEN32, MAX_COUNTER, U32_EMPTY, _XorStreamPRG, createPRG, init_arx, Poly1305, poly1305, init_poly1305, chacha_exports, chacha20orig, chacha20, xchacha20, chacha8, chacha12, ZEROS16, updatePadded, ZEROS32, _poly1305_aead, chacha20poly1305, xchacha20poly1305, rngChacha20, rngChacha8, init_chacha, init_makeAead, init_makeKdfImpl, init_makeDhKem, init_makeHpke, defaultRng, init_rng, crypto2, init_cryptoNode, isLE3, swap32IfBE2, hasHexBuiltin, hexes, asciis, Hash, init_utils2, HashMD2, SHA256_IV2, SHA384_IV2, SHA512_IV2, init_md2, U32_MASK642, _32n2, shrSH2, shrSL2, rotrSH2, rotrSL2, rotrBH2, rotrBL2, rotlSH2, rotlSL2, rotlBH2, rotlBL2, add3L2, add3H2, add4L2, add4H2, add5L2, add5H2, init_u642, SHA256_K, SHA256_W, SHA256, K512, SHA512_Kh, SHA512_Kl, SHA512_W_H, SHA512_W_L, SHA512, SHA384, sha2563, sha5122, sha3842, init_sha22, _0n2, _1n2, isPosBig, bitMask, notImplemented, init_utils3, _0n3, _1n3, _2n2, _3n, _4n, _5n, _7n2, _8n, _9n, _16n, isNegativeLE, FIELD_FIELDS, init_modular2, _0n4, _1n4, pointPrecomputes, pointWindowSizes, wNAF, init_curve2, _0n5, _1n5, _2n3, _8n2, PrimeEdwardsPoint, init_edwards, os2ip, _DST_scalar, init_hash_to_curve, _0n6, _1n6, _2n4, init_montgomery2, ed25519_exports, _0n7, _1n7, _2n5, _3n2, _5n2, _8n3, ed25519_CURVE_p, ed25519_CURVE, ED25519_SQRT_M1, Fp, Fn, ed25519Defaults, ed25519, ed25519ctx, ed25519ph, x25519, ELL2_C1, ELL2_C2, ELL2_C3, ELL2_C1_EDWARDS, ed25519_hasher, SQRT_M1, SQRT_AD_MINUS_ONE, INVSQRT_A_MINUS_D, ONE_MINUS_D_SQ, D_MINUS_ONE_SQ, invertSqrt, MAX_255B, bytes255ToNumberLE, _RistrettoPoint, ristretto255, ristretto255_hasher, ED25519_TORSION_SUBGROUP, edwardsToMontgomery, RistrettoPoint, hashToCurve, encodeToCurve, hashToRistretto255, hash_to_ristretto255, init_ed25519, _0n8, _1n8, _2n6, _7n3, _256n2, _0x71n2, SHA3_PI2, SHA3_ROTL2, _SHA3_IOTA2, IOTAS2, SHA3_IOTA_H2, SHA3_IOTA_L2, rotlH, rotlL, Keccak, genShake, shake2562, init_sha32, ed448_exports, ed448_CURVE, E448_CURVE, shake256_114, shake256_64, _1n9, _2n7, _3n3, _4n2, _11n, _22n, _44n, _88n, _223n, Fp2, Fn2, Fp448, Fn448, ED448_DEF, ed448, ed448ph, E448, x448, ELL2_C12, ELL2_J, ed448_hasher, ONE_MINUS_D, ONE_MINUS_TWO_D, SQRT_MINUS_D, INVSQRT_MINUS_D, invertSqrt2, _DecafPoint, decaf448, decaf448_hasher, ED448_TORSION_SUBGROUP, DecafPoint, hashToCurve2, encodeToCurve2, hashToDecaf448, hash_to_decaf448, edwardsToMontgomery2, init_ed448, HMAC, hmac2, init_hmac2, divNearest, DERErr, DER, _0n9, _1n10, _2n8, _3n4, _4n3, init_weierstrass, init_shortw_utils, nist_exports, p256_CURVE, p384_CURVE, p521_CURVE, Fp256, Fp384, Fp521, p256, p256_hasher, p384, p384_hasher, p521, secp256r1, secp384r1, secp521r1, p521_hasher, init_nist, init_makeNobleSignatureImpl, defaultCryptoProvider, init_provider, init_getCiphersuiteImpl, init_resumption, oidNist2, init_utils4, HashMD3, SHA256_IV3, SHA384_IV3, SHA512_IV3, init_md3, U32_MASK643, _32n3, shrSH3, shrSL3, rotrSH3, rotrSL3, rotrBH3, rotrBL3, add3L3, add3H3, add4L3, add4H3, add5L3, add5H3, init_u643, SHA256_K2, SHA256_W2, SHA2_32B, _SHA256, K5122, SHA512_Kh2, SHA512_Kl2, SHA512_W_H2, SHA512_W_L2, SHA2_64B, _SHA512, _SHA384, sha2564, sha5123, sha3843, init_sha23, _HMAC2, hmac3, init_hmac3, init_makeHashImpl2, init_makeNobleSignatureImpl2, BLOCK_SIZE, ZEROS162, ZEROS322, POLY, mul2, swapLE, estimateWindow, GHASH, Polyval, ghash, polyval, init_polyval, BLOCK_SIZE2, BLOCK_SIZE32, EMPTY_BLOCK, POLY2, sbox, rotr32_8, rotl32_8, tableEncoding, xPowers, gcm, _CMAC, cmac, init_aes, init_makeAead2, init_makeKdfImpl2, init_makeDhKem2, init_makeHpke2, init_rng2, nobleCryptoProvider, init_provider2, mlsPublicMessageEncoder, encodeMlsPublicMessage, mlsWelcomeEncoder, encodeMlsWelcome, mlsPrivateMessageEncoder, encodeMlsPrivateMessage, mlsGroupInfoEncoder, encodeMlsGroupInfo, mlsKeyPackageEncoder, encodeMlsKeyPackage, mlsMessageContentEncoder, encodeMlsMessageContent, decodeMlsMessageContent, mlsMessageEncoder, encodeMlsMessage, decodeMlsMessage, init_message, greaseValues, defaultGreaseConfig, init_grease, init_defaultCapabilities, init_src, DEFAULT_CIPHERSUITE, MLSGroupManager, init_mls_group, DOMAIN, NONCE_BYTES2, init_owner_sync, init_mls_delivery_order, init_mls_presend_epoch, dist_exports2, init_dist2, DIR_MODE, FILE_MODE, init_secure_file, SYNC_LOCK_STALE_MS, pendingKpPath, init_mls_state, init_mls_kp_pool, PACKAGE, FALLBACK, MAX_LEN, DISALLOWED, init_client_version, CredentialStore, init_credential_store, init_crypto_helpers, STATE_FILE, LEGACY_STATE_FILE, init_state, init_transport2, A2ALogGate, init_a2a_log_gate, init_mls_membership_probe, openclaw_compat_exports, defaultImporter, HEARTBEAT_CANDIDATES, AGENT_EVENT_CANDIDATES, TRANSCRIPT_CANDIDATES, _heartbeatFn, _agentEventFn, _transcriptFn, init_openclaw_compat, http_handlers_exports, init_http_handlers, mcp_proxy_helpers_exports, init_mcp_proxy_helpers, workspace_handlers_exports, MAX_FILE_SIZE, init_workspace_handlers, ROOM_AGENT_TYPES, CREDENTIAL_MESSAGE_TYPES, CATCHUP_MESSAGE_TYPES, POLL_INTERVAL_MS, RECONNECT_BASE_MS, RECONNECT_MAX_MS, PENDING_POLL_INTERVAL_MS, OUTBOUND_DEDUPE_WINDOW_MS, OUTBOUND_DEDUPE_MAX_SUPPRESS_MS, OUTBOUND_DEDUPE_MAX, OUTBOUND_DEDUPE_TYPES, RETRY_CANDIDATE_TTL_MS, RETRY_CANDIDATE_MAX, SecureChannel, init_channel, init_types, DEFAULT_API_URL, DEFAULT_HTTP_PORT, init_account_config, init_lifecycle, _ocRuntime, _channels, agentVaultPlugin, init_openclaw_plugin, init_gateway_send, init_llm_response_parser, init_llm_cost, traceStore, init_fetch_interceptor, init_tool_audit, init_harness_compat, isUsingManagedRoutes, init_openclaw_entry, util, objectUtil, ZodParsedType, getParsedType, init_util, ZodIssueCode, ZodError, init_ZodError, errorMap, en_default, init_en, overrideErrorMap, init_errors2, makeIssue, ParseStatus, INVALID, DIRTY, OK, isAborted, isDirty, isValid, isAsync, init_parseUtil, init_typeAliases, errorUtil, init_errorUtil, ParseInputLazyPath, handleResult, ZodType, cuidRegex, cuid2Regex, ulidRegex, uuidRegex, nanoidRegex, jwtRegex, durationRegex, emailRegex, _emojiRegex, emojiRegex, ipv4Regex, ipv4CidrRegex, ipv6Regex, ipv6CidrRegex, base64Regex, base64urlRegex, dateRegexSource, dateRegex, ZodString, ZodNumber, ZodBigInt, ZodBoolean, ZodDate, ZodSymbol, ZodUndefined, ZodNull, ZodAny, ZodUnknown, ZodNever, ZodVoid, ZodArray, ZodObject, ZodUnion, getDiscriminator, ZodDiscriminatedUnion, ZodIntersection, ZodTuple, ZodRecord, ZodMap, ZodSet, ZodFunction, ZodLazy, ZodLiteral, ZodEnum, ZodNativeEnum, ZodPromise, ZodEffects, ZodOptional, ZodNullable, ZodDefault, ZodCatch, ZodNaN, ZodBranded, ZodPipeline, ZodReadonly, late, ZodFirstPartyTypeKind, stringType, numberType, nanType, bigIntType, booleanType, dateType, symbolType, undefinedType, nullType, anyType, unknownType, neverType, voidType, arrayType, objectType, strictObjectType, unionType, discriminatedUnionType, intersectionType, tupleType, recordType, mapType, setType, functionType, lazyType, literalType, enumType, nativeEnumType, promiseType, effectsType, optionalType, nullableType, preprocessType, pipelineType, init_types2, init_external, init_v3, NEVER, $ZodAsyncError, $ZodEncodeError, globalConfig, init_core, util_exports, EVALUATING, captureStackTrace, allowsEval, getParsedType2, propertyKeyTypes, primitiveTypes, NUMBER_FORMAT_RANGES, BIGINT_FORMAT_RANGES, Class, init_util2, initializer, $ZodError, $ZodRealError, init_errors3, _parse, parse, _parseAsync, parseAsync, _safeParse, safeParse, _safeParseAsync, safeParseAsync, _encode, _decode, _encodeAsync, _decodeAsync, _safeEncode, _safeDecode, _safeEncodeAsync, _safeDecodeAsync, init_parse, regexes_exports, cuid, cuid2, ulid, xid, ksuid, nanoid, duration, extendedDuration, guid, uuid, uuid4, uuid6, uuid7, email, html5Email, rfc5322Email, unicodeEmail, idnEmail, browserEmail, _emoji, ipv4, ipv6, mac, cidrv4, cidrv6, base64, base64url, hostname, domain, e164, dateSource, date, string, bigint, integer, number, boolean, _null, _undefined, lowercase, uppercase, hex, md5_hex, md5_base64, md5_base64url, sha1_hex, sha1_base64, sha1_base64url, sha256_hex, sha256_base64, sha256_base64url, sha384_hex, sha384_base64, sha384_base64url, sha512_hex, sha512_base64, sha512_base64url, init_regexes, $ZodCheck, numericOriginMap, $ZodCheckLessThan, $ZodCheckGreaterThan, $ZodCheckMultipleOf, $ZodCheckNumberFormat, $ZodCheckBigIntFormat, $ZodCheckMaxSize, $ZodCheckMinSize, $ZodCheckSizeEquals, $ZodCheckMaxLength, $ZodCheckMinLength, $ZodCheckLengthEquals, $ZodCheckStringFormat, $ZodCheckRegex, $ZodCheckLowerCase, $ZodCheckUpperCase, $ZodCheckIncludes, $ZodCheckStartsWith, $ZodCheckEndsWith, $ZodCheckProperty, $ZodCheckMimeType, $ZodCheckOverwrite, init_checks, Doc, init_doc, version, init_versions, $ZodType, $ZodString, $ZodStringFormat, $ZodGUID, $ZodUUID, $ZodEmail, $ZodURL, $ZodEmoji, $ZodNanoID, $ZodCUID, $ZodCUID2, $ZodULID, $ZodXID, $ZodKSUID, $ZodISODateTime, $ZodISODate, $ZodISOTime, $ZodISODuration, $ZodIPv4, $ZodIPv6, $ZodMAC, $ZodCIDRv4, $ZodCIDRv6, $ZodBase64, $ZodBase64URL, $ZodE164, $ZodJWT, $ZodCustomStringFormat, $ZodNumber, $ZodNumberFormat, $ZodBoolean, $ZodBigInt, $ZodBigIntFormat, $ZodSymbol, $ZodUndefined, $ZodNull, $ZodAny, $ZodUnknown, $ZodNever, $ZodVoid, $ZodDate, $ZodArray, $ZodObject, $ZodObjectJIT, $ZodUnion, $ZodXor, $ZodDiscriminatedUnion, $ZodIntersection, $ZodTuple, $ZodRecord, $ZodMap, $ZodSet, $ZodEnum, $ZodLiteral, $ZodFile, $ZodTransform, $ZodOptional, $ZodExactOptional, $ZodNullable, $ZodDefault, $ZodPrefault, $ZodNonOptional, $ZodSuccess, $ZodCatch, $ZodNaN, $ZodPipe, $ZodCodec, $ZodReadonly, $ZodTemplateLiteral, $ZodFunction, $ZodPromise, $ZodLazy, $ZodCustom, init_schemas, init_ar, init_az, init_be, init_bg, init_ca, init_cs, init_da, init_de, error, init_en2, init_eo, init_es, init_fa, init_fi, init_fr, init_fr_CA, init_he, init_hu, init_hy, init_id, init_is, init_it, init_ja, init_ka, init_km, init_kh, init_ko, init_lt, init_mk, init_ms, init_nl, init_no, init_ota, init_ps, init_pl, init_pt, init_ru, init_sl, init_sv, init_ta, init_th, init_tr, init_uk, init_ua, init_ur, init_uz, init_vi, init_zh_CN, init_zh_TW, init_yo, init_locales, _a2, $ZodRegistry, globalRegistry, init_registries, init_api, createToJSONSchemaMethod, createStandardJSONSchemaMethod, init_to_json_schema, formatMap, stringProcessor, numberProcessor, booleanProcessor, bigintProcessor, symbolProcessor, nullProcessor, undefinedProcessor, voidProcessor, neverProcessor, anyProcessor, unknownProcessor, dateProcessor, enumProcessor, literalProcessor, nanProcessor, templateLiteralProcessor, fileProcessor, successProcessor, customProcessor, functionProcessor, transformProcessor, mapProcessor, setProcessor, arrayProcessor, objectProcessor, unionProcessor, intersectionProcessor, tupleProcessor, recordProcessor, nullableProcessor, nonoptionalProcessor, defaultProcessor, prefaultProcessor, catchProcessor, pipeProcessor, readonlyProcessor, promiseProcessor, optionalProcessor, lazyProcessor, allProcessors, init_json_schema_processors, init_json_schema_generator, init_json_schema, init_core2, init_parse2, ZodMiniType, ZodMiniObject, init_schemas2, init_checks2, init_iso, init_coerce, init_external2, init_v4_mini, init_zod_compat, checks_exports2, init_checks3, iso_exports2, ZodISODateTime, ZodISODate, ZodISOTime, ZodISODuration, init_iso2, initializer2, ZodError2, ZodRealError, init_errors4, parse2, parseAsync2, safeParse3, safeParseAsync3, encode3, decode2, encodeAsync2, decodeAsync2, safeEncode2, safeDecode2, safeEncodeAsync2, safeDecodeAsync2, init_parse3, schemas_exports3, ZodType2, _ZodString, ZodString2, ZodStringFormat, ZodEmail, ZodGUID, ZodUUID, ZodURL, ZodEmoji, ZodNanoID, ZodCUID, ZodCUID2, ZodULID, ZodXID, ZodKSUID, ZodIPv4, ZodMAC, ZodIPv6, ZodCIDRv4, ZodCIDRv6, ZodBase64, ZodBase64URL, ZodE164, ZodJWT, ZodCustomStringFormat, ZodNumber2, ZodNumberFormat, ZodBoolean2, ZodBigInt2, ZodBigIntFormat, ZodSymbol2, ZodUndefined2, ZodNull2, ZodAny2, ZodUnknown2, ZodNever2, ZodVoid2, ZodDate2, ZodArray2, ZodObject2, ZodUnion2, ZodXor, ZodDiscriminatedUnion2, ZodIntersection2, ZodTuple2, ZodRecord2, ZodMap2, ZodSet2, ZodEnum2, ZodLiteral2, ZodFile, ZodTransform, ZodOptional2, ZodExactOptional, ZodNullable2, ZodDefault2, ZodPrefault, ZodNonOptional, ZodSuccess, ZodCatch2, ZodNaN2, ZodPipe, ZodCodec, ZodReadonly2, ZodTemplateLiteral, ZodLazy2, ZodPromise2, ZodFunction2, ZodCustom, describe2, meta2, stringbool, init_schemas3, ZodFirstPartyTypeKind2, init_compat, z2, init_from_json_schema, init_coerce2, init_external3, init_classic, init_v4, LATEST_PROTOCOL_VERSION, DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, RELATED_TASK_META_KEY, JSONRPC_VERSION, AssertObjectSchema, ProgressTokenSchema, CursorSchema, TaskCreationParamsSchema, TaskMetadataSchema, RelatedTaskMetadataSchema, RequestMetaSchema, BaseRequestParamsSchema, TaskAugmentedRequestParamsSchema, isTaskAugmentedRequestParams, RequestSchema, NotificationsParamsSchema, NotificationSchema, ResultSchema, RequestIdSchema, JSONRPCRequestSchema, isJSONRPCRequest, JSONRPCNotificationSchema, isJSONRPCNotification, JSONRPCResultResponseSchema, isJSONRPCResultResponse, ErrorCode, JSONRPCErrorResponseSchema, isJSONRPCErrorResponse, JSONRPCMessageSchema, JSONRPCResponseSchema, EmptyResultSchema, CancelledNotificationParamsSchema, CancelledNotificationSchema, IconSchema, IconsSchema, BaseMetadataSchema, ImplementationSchema, FormElicitationCapabilitySchema, ElicitationCapabilitySchema, ClientTasksCapabilitySchema, ServerTasksCapabilitySchema, ClientCapabilitiesSchema, InitializeRequestParamsSchema, InitializeRequestSchema, isInitializeRequest, ServerCapabilitiesSchema, InitializeResultSchema, InitializedNotificationSchema, PingRequestSchema, ProgressSchema, ProgressNotificationParamsSchema, ProgressNotificationSchema, PaginatedRequestParamsSchema, PaginatedRequestSchema, PaginatedResultSchema, TaskStatusSchema, TaskSchema, CreateTaskResultSchema, TaskStatusNotificationParamsSchema, TaskStatusNotificationSchema, GetTaskRequestSchema, GetTaskResultSchema, GetTaskPayloadRequestSchema, GetTaskPayloadResultSchema, ListTasksRequestSchema, ListTasksResultSchema, CancelTaskRequestSchema, CancelTaskResultSchema, ResourceContentsSchema, TextResourceContentsSchema, Base64Schema, BlobResourceContentsSchema, RoleSchema, AnnotationsSchema, ResourceSchema, ResourceTemplateSchema, ListResourcesRequestSchema, ListResourcesResultSchema, ListResourceTemplatesRequestSchema, ListResourceTemplatesResultSchema, ResourceRequestParamsSchema, ReadResourceRequestParamsSchema, ReadResourceRequestSchema, ReadResourceResultSchema, ResourceListChangedNotificationSchema, SubscribeRequestParamsSchema, SubscribeRequestSchema, UnsubscribeRequestParamsSchema, UnsubscribeRequestSchema, ResourceUpdatedNotificationParamsSchema, ResourceUpdatedNotificationSchema, PromptArgumentSchema, PromptSchema, ListPromptsRequestSchema, ListPromptsResultSchema, GetPromptRequestParamsSchema, GetPromptRequestSchema, TextContentSchema, ImageContentSchema, AudioContentSchema, ToolUseContentSchema, EmbeddedResourceSchema, ResourceLinkSchema, ContentBlockSchema, PromptMessageSchema, GetPromptResultSchema, PromptListChangedNotificationSchema, ToolAnnotationsSchema, ToolExecutionSchema, ToolSchema, ListToolsRequestSchema, ListToolsResultSchema, CallToolResultSchema, CompatibilityCallToolResultSchema, CallToolRequestParamsSchema, CallToolRequestSchema, ToolListChangedNotificationSchema, ListChangedOptionsBaseSchema, LoggingLevelSchema, SetLevelRequestParamsSchema, SetLevelRequestSchema, LoggingMessageNotificationParamsSchema, LoggingMessageNotificationSchema, ModelHintSchema, ModelPreferencesSchema, ToolChoiceSchema, ToolResultContentSchema, SamplingContentSchema, SamplingMessageContentBlockSchema, SamplingMessageSchema, CreateMessageRequestParamsSchema, CreateMessageRequestSchema, CreateMessageResultSchema, CreateMessageResultWithToolsSchema, BooleanSchemaSchema, StringSchemaSchema, NumberSchemaSchema, UntitledSingleSelectEnumSchemaSchema, TitledSingleSelectEnumSchemaSchema, LegacyTitledEnumSchemaSchema, SingleSelectEnumSchemaSchema, UntitledMultiSelectEnumSchemaSchema, TitledMultiSelectEnumSchemaSchema, MultiSelectEnumSchemaSchema, EnumSchemaSchema, PrimitiveSchemaDefinitionSchema, ElicitRequestFormParamsSchema, ElicitRequestURLParamsSchema, ElicitRequestParamsSchema, ElicitRequestSchema, ElicitationCompleteNotificationParamsSchema, ElicitationCompleteNotificationSchema, ElicitResultSchema, ResourceTemplateReferenceSchema, PromptReferenceSchema, CompleteRequestParamsSchema, CompleteRequestSchema, CompleteResultSchema, RootSchema, ListRootsRequestSchema, ListRootsResultSchema, RootsListChangedNotificationSchema, ClientRequestSchema, ClientNotificationSchema, ClientResultSchema, ServerRequestSchema, ServerNotificationSchema, ServerResultSchema, McpError, UrlElicitationRequiredError, init_types3, init_interfaces, ignoreOverride, defaultOptions, getDefaultOptions, init_Options, getRefs, init_Refs, init_errorMessages, getRelativePath, init_getRelativePath, init_any, init_array2, init_bigint, init_boolean, init_branded, parseCatchDef, init_catch, integerDateParser, init_date, init_default, init_effects, init_enum, isJsonSchema7AllOfType, init_intersection, init_literal, emojiRegex2, zodPatterns, ALPHA_NUMERIC, init_string2, init_record, init_map, init_nativeEnum, init_never, init_null, primitiveMappings, asAnyOf, init_union, init_nullable, init_number2, init_object, parseOptionalDef, init_optional2, parsePipelineDef, init_pipeline, init_promise, init_set, init_tuple, init_undefined, init_unknown, parseReadonlyDef, init_readonly, selectParser, init_selectParser, get$ref, addMeta, init_parseDef, init_parseTypes, zodToJsonSchema, init_zodToJsonSchema, init_esm, init_zod_json_schema_compat, DEFAULT_REQUEST_TIMEOUT_MSEC, Protocol, init_protocol, require_code, require_scope, require_codegen, require_util, require_names, require_errors, require_boolSchema, require_rules, require_applicability, require_dataType, require_defaults, require_code2, require_keyword, require_subschema, require_fast_deep_equal, require_json_schema_traverse, require_resolve, require_validate, require_validation_error, require_ref_error, require_compile, require_data, require_utils, require_schemes, require_fast_uri, require_uri, require_core, require_id, require_ref, require_core2, require_limitNumber, require_multipleOf, require_ucs2length, require_limitLength, require_pattern, require_limitProperties, require_required, require_limitItems, require_equal, require_uniqueItems, require_const, require_enum, require_validation, require_additionalItems, require_items, require_prefixItems, require_items2020, require_contains, require_dependencies, require_propertyNames, require_additionalProperties, require_properties, require_patternProperties, require_not, require_anyOf, require_oneOf, require_allOf, require_if, require_thenElse, require_applicator, require_format, require_format2, require_metadata, require_draft7, require_types, require_discriminator, require_json_schema_draft_07, require_ajv, require_formats, require_limit, require_dist, import_ajv, import_ajv_formats, AjvJsonSchemaValidator, init_ajv_provider, ExperimentalServerTasks, init_server, init_helpers, Server, init_server2, COMPLETABLE_SYMBOL, McpZodTypeKind, init_completable, init_uriTemplate, TOOL_NAME_REGEX, init_toolNameValidation, ExperimentalMcpServerTasks, init_mcp_server, init_zod, McpServer, EMPTY_OBJECT_JSON_SCHEMA, EMPTY_COMPLETION_RESULT, init_mcp, RequestError, toRequestError, GlobalRequest, Request2, newHeadersFromIncoming, wrapBodyStream, newRequestFromIncoming, getRequestCache, requestCache, incomingKey, urlKey, headersKey, abortControllerKey, getAbortController, requestPrototype, newRequest, responseCache, getResponseCache, cacheKey, GlobalResponse, Response2, buildOutgoingHttpHeaders, X_ALREADY_SENT, outgoingEnded, handleRequestError, handleFetchError, handleResponseError, flushHeaders, responseViaCache, isPromise, responseViaResponseObject, getRequestListener, init_dist22, WebStandardStreamableHTTPServerTransport, init_webStandardStreamableHttp, StreamableHTTPServerTransport, init_streamableHttp, AgentVaultMcpServer, init_mcp_server2, init_mcp_handlers, init_skill_manifest, init_skill_invoker, spanBuffer, init_skill_telemetry, PolicyEnforcer, init_policy_enforcer, VERSION, init_index;
 var init_dist = __esm({
-  async "../../../../packages/plugin/dist/index.js"() {
+  async "../plugin/dist/index.js"() {
     "use strict";
     __create = Object.create;
     __defProp2 = Object.defineProperty;
@@ -17423,7 +17440,7 @@ var init_dist = __esm({
           }
         }
         _Module = Module;
-        Module.ready = new Promise(function(resolve32, reject) {
+        Module.ready = new Promise(function(resolve3, reject) {
           var Module2 = _Module;
           Module2.onAbort = reject;
           Module2.print = function(what) {
@@ -17435,7 +17452,7 @@ var init_dist = __esm({
           Module2.onRuntimeInitialized = function() {
             try {
               Module2._crypto_secretbox_keybytes();
-              resolve32();
+              resolve3();
             } catch (err2) {
               reject(err2);
             }
@@ -17546,7 +17563,7 @@ var init_dist = __esm({
               }, Module: function(binary) {
               }, Instance: function(module2, info) {
                 this.exports = // EMSCRIPTEN_START_ASM
-                function instantiate(ea2) {
+                (function instantiate(ea2) {
                   var a2;
                   var b2 = new Uint8Array(123);
                   for (var c2 = 25; c2 >= 0; --c2) {
@@ -57341,7 +57358,7 @@ var init_dist = __esm({
                     } } }), f: yi, g: ma2, h: Ba2, i: ma2, j: ka2, k: Le2, l: Je2, m: zg, n: yg, o: xg, p: wg, q: ka2, r: Ba2, s: ka2, t: ka2, u: Le2, v: ra2, w: vg, x: ug, y: tg, z: sg, A: Ba2, B: rg, C: qg, D: pg, E: ng, F: mg, G: lg, H: kg, I: jg, J: ka2, K: Ce2, L: Ba2, M: ma2, N: Ta2, O: ra2, P: ka2, Q: Oa2, R: Ba2, S: ma2, T: Ta2, U: ra2, V: ig, W: hg, X: gg, Y: fg, Z: ka2, _: Ma2, $: Ba2, aa: ma2, ba: Ta2, ca: ra2, da: ka2, ea: ka2, fa: Kg, ga: wd, ha: vd, ia: ra2, ja: ka2, ka: ka2, la: Cb, ma: ra2, na: Xa2, oa: eg, pa: qb, qa: dg, ra: cg, sa: ua2, ta: ka2, ua: Dc, va: ra2, wa: Va2, xa: ud, ya: Ya2, za: bg, Aa: ag, Ba: ka2, Ca: ka2, Da: Dc, Ea: ra2, Fa: ze2, Ga: ud, Ha: Ng, Ia: wd, Ja: vd, Ka: ka2, La: ka2, Ma: ka2, Na: ka2, Oa: Ma2, Pa: ka2, Qa: ma2, Ra: ma2, Sa: Ta2, Ta: dh2, Ua: ch, Va: bh, Wa: ah, Xa: Lb, Ya: Kb, Za: td, _a: sd, $a: rd, ab: $f, bb: _f, cb: Zf, db: qd, eb: Yf, fb: pd, gb: Xf, hb: Wf, ib: Uf, jb: Md, kb: tc, lb: nb, mb, nb: Lb, ob: Kb, pb: td, qb: sd, rb: ka2, sb: ka2, tb: ka2, ub: ka2, vb: Ma2, wb: ka2, xb: ma2, yb: ma2, zb: Ta2, Ab: Aa2, Bb: ka2, Cb: ma2, Db: ka2, Eb: ma2, Fb: Sa2, Gb: ka2, Hb: ma2, Ib: ka2, Jb: ma2, Kb: vb, Lb: ua2, Mb: ma2, Nb: ka2, Ob: ma2, Pb: ub, Qb: ua2, Rb: ma2, Sb: ka2, Tb: ma2, Ub: tb, Vb: ua2, Wb: ma2, Xb: ka2, Yb: ma2, Zb: ma2, _b: ua2, $b: ka2, ac: ma2, bc: ua2, cc: ka2, dc: Nd, ec: pe2, fc: od, gc: fh, hc: nd, ic: eh, jc: ra2, kc: ma2, lc: ua2, mc: ka2, nc: ma2, oc: ua2, pc: ka2, qc: ma2, rc: ma2, sc: pe2, tc: ra2, uc: od, vc: Tf, wc: Ja2, xc: xh, yc: nd, zc: Ia2, Ac: ua2, Bc: md, Cc: Lg, Dc: ka2, Ec: Ag, Fc: Ub, Gc: Sf, Hc: Ua2, Ic: Rf, Jc: ua2, Kc: Cb, Lc: Za2, Mc: ic, Nc: Ca2, Oc: md, Pc: ma2, Qc: ua2, Rc: Oa2, Sc: ka2, Tc: ld, Uc: Nd, Vc: ma2, Wc: ua2, Xc: Oa2, Yc: ka2, Zc: ld, _c: ra2, $c: Gh, ad: Fh, bd: Eh, cd: Dh, dd: ra2, ed: Ch, fd: ka2, gd: Ba2, hd: Bh, id: Cb, jd: ze2, kd: hi, ld: gi, md: fi, nd: ei, od: di, pd: ua2, qd: Ba2, rd: ci, sd: Dc, td: Gg, ud: nb, vd: Fg, wd: Eg, xd: ka2, yd: ka2, zd: ka2, Ad: ka2, Bd: Dg, Cd: Rc, Dd: ma2, Ed: ka2, Fd: kd, Gd: jd, Hd: Sg, Id: id, Jd: Rg, Kd: Qg, Ld: ra2, Md: kd, Nd: jd, Od: Ga2, Pd: id, Qd: Fa2, Rd: ma2, Sd: ka2, Td: Rc, Ud: ra2, Vd: Db, Wd: ma2, Xd: wa2, Yd: Ba2, Zd: wa2, _d: ma2, $d: yc, ae: wh, be: Vb, ce: wa2, de: xc, ee: wc, fe: vc, ge: me2, he: vh, ie: uh, je: Oa2, ke: th, le: Pf, me: Of, ne: Nf, oe: Mf, pe: Lf, qe: fb, re: ma2, se: wa2, te: Ba2, ue: wa2, ve: ma2, we: yc, xe: fe2, ye: Db, ze: wa2, Ae: xc, Be: wc, Ce: fb, De: ee2, Ee: Vb, Fe: de2, Ge: vc, He: uc, Ie: Kf, Je: hd, Ke: Jf, Le: Db, Me: fb, Ne: fb, Oe: ma2, Pe: wa2, Qe: Ba2, Re: wa2, Se: ma2, Te: yc, Ue: fe2, Ve: Db, We: wa2, Xe: xc, Ye: wc, Ze: fb, _e: ee2, $e: Vb, af: de2, bf: vc, cf: uc, df: Hf, ef: hd, ff: Gf, gf: Ff, hf: Ef, jf: sh, kf: Jg, lf: Ig, mf: Hg, nf: ka2, of: ka2, pf: Ea2, qf: wb, rf: ka2, sf: ka2, tf: ka2, uf: Ma2, vf: ka2, wf: ma2, xf: ma2, yf: Ta2, zf: Mg, Af: Lb, Bf: Kb, Cf: ra2, Df: rd, Ef: Df, Ff: qd, Gf: pd, Hf: Lb, If: Kb, Jf: ka2, Kf: Ma2, Lf: ka2, Mf: ma2, Nf: ma2, Of: Ta2, Pf: ra2, Qf: ra2, Rf: Mh, Sf: Lh, Tf: Kh, Uf: Cf, Vf: Bf, Wf: Jh, Xf: Ih, Yf: Ma2, Zf: ka2, _f: Hh, $f: Ba2, ag: Db, bg: fb, cg: Vb, dg: Oa2, eg: ma2, fg: Tg, gg: gd, hg: Je2, ig: Oa2, jg: ma2, kg: gd, lg: Cb, mg: ua2, ng: ka2, og: ka2, pg: ua2, qg: Wd, rg: lh, sg: kh, tg: jh, ug: fd, vg: ed, wg: dd, xg: cd, yg: ih, zg: ic, Ag: hh, Bg: gh, Cg: Cb, Dg: ua2, Eg: ka2, Fg: ka2, Gg: ua2, Hg: Wd, Ig: nh, Jg: mh, Kg: Vd, Lg: ic, Mg: Ud, Ng: Td, Og: Yd, Pg: Xd, Qg: ph, Rg: oh, Sg: cd, Tg: ed, Ug: dd, Vg: fd, Wg: ka2, Xg: Oa2, Yg: wa2, Zg: ka2, _g: Ce2, $g: wa2, ah: zf, bh: yf, ch: xf, dh: wf, eh: vf, fh: uf, gh: ra2, hh: ra2, ih: ka2, jh: Ma2, kh: wa2, lh: qh, mh: bd, nh: ad, oh: ra2, ph: ka2, qh: Oa2, rh: wa2, sh: tf, th: sf, uh: rf, vh: ra2, wh: bd, xh: qf, yh: ad, zh: ka2, Ah: Ma2, Bh: wa2, Ch: ra2, Dh: ma2, Eh: ka2, Fh: ua2, Gh: db, Hh: kb, Ih: xd, Jh: oi, Kh: ni, Lh: Ae2, Mh: mi, Nh: za2, Oh: li, Ph: ka2, Qh: ki, Rh: pf, Sh: Ah, Th: zh, Uh: yh, Vh: Bc, Wh: Ac, Xh: ti, Yh: ji, Zh: ii, _h: Cg, $h: Bg, ai: fb, bi: Ba2, ci: tc, di: nb, ei: rh, fi: $c, gi: of, hi: nf, ii: mf, ji: _c, ki: lf, li: Yc, mi: kf, ni: ka2, oi: ka2, pi: ka2, qi: ka2, ri: Ma2, si: ma2, ti: Ta2, ui: jf, vi: hf, wi: Md, xi: bi, yi: ai, zi: $h, Ai: _h, Bi: Zh, Ci: ye2, Di: xe2, Ei: we2, Fi: ve2, Gi: ue2, Hi: te2, Ii: se2, Ji: re2, Ki: ka2, Li: ua2, Mi: ka2, Ni: ua2, Oi: ka2, Pi: Yh, Qi: Xh, Ri: Wh, Si: Vh, Ti: Uh, Ui: Th, Vi: Sh, Wi: Rh, Xi: Qh, Yi: Ph, Zi: Oh, _i: re2, $i: Nh, aj: ka2, bj: ua2, cj: ua2, dj: ka2, ej: gf, fj: ma2, gj: wa2, hj: Ba2, ij: wa2, jj: ka2, kj: $g, lj: _g, mj: Zg, nj: wa2, oj: Ed, pj: wa2, qj: Yg, rj: Ed, sj: me2, tj: uc, uj: ff, vj: ef, wj: df, xj: cf, yj: Xg, zj: Wg, Aj: Vg, Bj: Ug, Cj: ka2, Dj: ka2, Ej: Pg, Fj: Og, Gj: ka2, Hj: ka2, Ij: $c, Jj: bf, Kj: _c, Lj: Yc, Mj: ka2, Nj: Ma2, Oj: ma2, Pj: Ta2, Qj: ma2, Rj: ma2, Sj: af, Tj: $e2, Uj: _e2, Vj: ka2, Wj: Oa2, Xj: wa2, Yj: ra2, Zj: Ze2, _j: Ye2, $j: ka2, ak: Oa2, bk: wa2, ck: ra2, dk: ka2, ek: Ma2, fk: wa2, gk: Xe2, hk: We2, ik: Ve2, jk: ra2, kk: Da2, lk: ta2 };
                   }
                   return da2(ea2);
-                }(info);
+                })(info);
               }, instantiate: function(binary, info) {
                 return { then: function(ok) {
                   var module2 = new WebAssembly2.Module(binary);
@@ -59523,6 +59540,11 @@ var init_dist = __esm({
             return { header: header2, headerSignature, ciphertext, nonce };
           }
           decrypt(message) {
+            if (this.state.peerIdentityPublicKey) {
+              if (!verifyHeaderSignature(message.header, message.headerSignature, this.state.peerIdentityPublicKey)) {
+                throw new Error("Header signature verification failed");
+              }
+            }
             const isV2 = message.envelopeVersion === "2.0.0" && message.encryptedHeader != null && message.headerNonce != null;
             const skippedResult = this.trySkippedKeys(message, isV2);
             if (skippedResult !== null) {
@@ -59536,14 +59558,14 @@ var init_dist = __esm({
               if (message.header.messageNumber === 0) {
                 try {
                   const { messageKey: testKey, headerKey: testHeaderKey, nextChainKey: nextChainKey2 } = kdfChainKey(this.state.rootKey);
-                  let ad2;
+                  let ad;
                   if (isV2) {
                     libsodium_wrappers_default.crypto_aead_xchacha20poly1305_ietf_decrypt(null, message.encryptedHeader, null, message.headerNonce, testHeaderKey);
-                    ad2 = message.encryptedHeader;
+                    ad = message.encryptedHeader;
                   } else {
-                    ad2 = serializeHeader(message.header);
+                    ad = serializeHeader(message.header);
                   }
-                  const ptBytes = libsodium_wrappers_default.crypto_aead_xchacha20poly1305_ietf_decrypt(null, message.ciphertext, ad2, message.nonce, testKey);
+                  const ptBytes = libsodium_wrappers_default.crypto_aead_xchacha20poly1305_ietf_decrypt(null, message.ciphertext, ad, message.nonce, testKey);
                   this.state.dhReceivingPublicKey = message.header.dhPublicKey;
                   this.state.receivingChain = {
                     chainKey: nextChainKey2,
@@ -59563,13 +59585,7 @@ var init_dist = __esm({
             this.skipMessages(this.state.receivingChain, message.header.messageNumber, message.header.dhPublicKey, isV2);
             const chain = this.state.receivingChain;
             const { nextChainKey, messageKey, headerKey } = kdfChainKey(chain.chainKey);
-            chain.chainKey = nextChainKey;
-            chain.messageNumber++;
-            if (this.state.peerIdentityPublicKey) {
-              if (!verifyHeaderSignature(message.header, message.headerSignature, this.state.peerIdentityPublicKey)) {
-                throw new Error("Header signature verification failed");
-              }
-            }
+            let plaintextBytes;
             if (isV2) {
               try {
                 libsodium_wrappers_default.crypto_aead_xchacha20poly1305_ietf_decrypt(null, message.encryptedHeader, null, message.headerNonce, headerKey);
@@ -59577,19 +59593,21 @@ var init_dist = __esm({
                 throw new Error("V2 header decryption failed");
               }
               try {
-                const plaintextBytes = libsodium_wrappers_default.crypto_aead_xchacha20poly1305_ietf_decrypt(null, message.ciphertext, message.encryptedHeader, message.nonce, messageKey);
-                return libsodium_wrappers_default.to_string(plaintextBytes);
+                plaintextBytes = libsodium_wrappers_default.crypto_aead_xchacha20poly1305_ietf_decrypt(null, message.ciphertext, message.encryptedHeader, message.nonce, messageKey);
               } catch {
                 throw new Error("V2 decryption failed: ciphertext tampered or wrong key");
               }
+            } else {
+              const ad = serializeHeader(message.header);
+              try {
+                plaintextBytes = libsodium_wrappers_default.crypto_aead_xchacha20poly1305_ietf_decrypt(null, message.ciphertext, ad, message.nonce, messageKey);
+              } catch {
+                throw new Error("Decryption failed: ciphertext tampered or wrong key");
+              }
             }
-            const ad = serializeHeader(message.header);
-            try {
-              const plaintextBytes = libsodium_wrappers_default.crypto_aead_xchacha20poly1305_ietf_decrypt(null, message.ciphertext, ad, message.nonce, messageKey);
-              return libsodium_wrappers_default.to_string(plaintextBytes);
-            } catch {
-              throw new Error("Decryption failed: ciphertext tampered or wrong key");
-            }
+            chain.chainKey = nextChainKey;
+            chain.messageNumber++;
+            return libsodium_wrappers_default.to_string(plaintextBytes);
           }
           dhRatchetReceive(theirDhPublic) {
             this.state.previousSendingChainLength = this.state.sendingChain?.messageNumber ?? 0;
@@ -63990,8 +64008,8 @@ var init_dist = __esm({
           }
           async lock() {
             let releaseLock;
-            const nextLock = new Promise((resolve32) => {
-              releaseLock = resolve32;
+            const nextLock = new Promise((resolve3) => {
+              releaseLock = resolve3;
             });
             const previousLock = __classPrivateFieldGet(this, _Mutex_locked, "f");
             __classPrivateFieldSet(this, _Mutex_locked, nextLock, "f");
@@ -68621,6 +68639,11 @@ var init_dist = __esm({
         "use strict";
       }
     });
+    init_mls_presend_epoch = __esm2({
+      "../crypto/dist/mls-presend-epoch.js"() {
+        "use strict";
+      }
+    });
     dist_exports2 = {};
     __export2(dist_exports2, {
       AV_CREDENTIAL_CONTEXT: () => AV_CREDENTIAL_CONTEXT,
@@ -68690,7 +68713,9 @@ var init_dist = __esm({
       hexTransportToEncryptedMessage: () => hexTransportToEncryptedMessage,
       issueCredential: () => issueCredential,
       multibaseToPublicKey: () => multibaseToPublicKey,
+      needsPreSendResync: () => needsPreSendResync,
       normalizeBackupCode: () => normalizeBackupCode,
+      noteObservedEpoch: () => noteObservedEpoch,
       orderDeliveryBatch: () => orderDeliveryBatch,
       parseTraceparent: () => parseTraceparent,
       performX3DH: () => performX3DH,
@@ -68730,6 +68755,7 @@ var init_dist = __esm({
         init_mls_group();
         await init_owner_sync();
         init_mls_delivery_order();
+        init_mls_presend_epoch();
       }
     });
     init_secure_file = __esm2({
@@ -69004,6 +69030,7 @@ var init_dist = __esm({
         await init_libsodium_wrappers();
         await init_dist2();
         await init_dist2();
+        init_mls_presend_epoch();
         init_mls_state();
         await init_mls_kp_pool();
         init_client_version();
@@ -69117,6 +69144,17 @@ var init_dist = __esm({
            *  self-heal rather than be logged and dropped. */
           _mlsCommitFailCounts = /* @__PURE__ */ new Map();
           static MAX_MLS_DECRYPT_FAILS = 3;
+          /**
+           * #1084: consecutive resyncs that found NOTHING to apply, per group.
+           *
+           * "No new commits" means the server holds no commit past our epoch — we are
+           * NOT BEHIND. Treating that as corruption and re-keying is what drove the
+           * epoch churn (see `_resyncOnDivergence`). But a state that is genuinely
+           * broken while its epoch counter happens to match must still recover, so the
+           * suppression is bounded rather than absolute.
+           */
+          _resyncNoOpStrikes = /* @__PURE__ */ new Map();
+          static MAX_RESYNC_NOOPS = 3;
           /** Cached MLS KeyPackage bundle for this device (regenerated on each connect). */
           _mlsKeyPackage = null;
           /** Pending KeyPackage bundle from request-Welcome flow (used by _handleMlsWelcome). */
@@ -69154,6 +69192,13 @@ var init_dist = __esm({
           _kpPoolFilling = false;
           /** Buffer for MLS commits received before Welcome (keyed by groupId, sorted by epoch). */
           _pendingMlsCommits = /* @__PURE__ */ new Map();
+          /**
+           * #1013: the highest group epoch any inbound frame has reported, per MLS
+           * group id. Every inbound frame carries the epoch the group was at when it
+           * was produced, so each is a LOWER BOUND on the group's current epoch — the
+           * hint is monotonic and only ever rises.
+           */
+          _observedGroupEpochs = /* @__PURE__ */ new Map();
           /** In-memory credential store for renter-provided credentials (never persisted). */
           _credentialStore = new CredentialStore();
           /** Rooms whose roster has been refreshed from the backend at least once in
@@ -69869,7 +69914,13 @@ var init_dist = __esm({
                 }
                 try {
                   const plaintextBytes = new TextEncoder().encode(plaintext);
-                  const cipherBytes = await mlsGroup.encrypt(plaintextBytes);
+                  const cipherBytes = await this._encryptWithCatchUp(
+                    mlsGroup,
+                    `1to1-group:${gid}`,
+                    entry.mlsGroupId,
+                    `1:1 group ${gid.slice(0, 8)}`,
+                    plaintextBytes
+                  );
                   await saveMlsState(this.config.dataDir, entry.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
                   const payload = {
                     group_id: entry.mlsGroupId,
@@ -69916,7 +69967,14 @@ var init_dist = __esm({
                 }
                 if (mlsGroup?.isInitialized && mlsGroupId && Number(mlsGroup.epoch) > 0 && this._state === "ready" && this._ws) {
                   const plaintextBytes = new TextEncoder().encode(plaintext);
-                  const cipherBytes = await mlsGroup.encrypt(plaintextBytes);
+                  const sessionGroupKey = convGroupId && this._mlsGroups.has(`1to1-group:${convGroupId}`) ? `1to1-group:${convGroupId}` : `conv:${convId}`;
+                  const cipherBytes = await this._encryptWithCatchUp(
+                    mlsGroup,
+                    sessionGroupKey,
+                    mlsGroupId,
+                    `conversation ${convId.slice(0, 8)}`,
+                    plaintextBytes
+                  );
                   await saveMlsState(this.config.dataDir, mlsGroupId, JSON.stringify(mlsGroup.exportState()));
                   const payload = {
                     conversation_id: convId,
@@ -70011,7 +70069,14 @@ var init_dist = __esm({
                 }
                 try {
                   const plaintextBytes = new TextEncoder().encode(plaintext);
-                  const cipherBytes = await mlsGroup.encrypt(plaintextBytes);
+                  const mlsOnlyGroupKey = mlsOnlyConvGroupId && this._mlsGroups.has(`1to1-group:${mlsOnlyConvGroupId}`) ? `1to1-group:${mlsOnlyConvGroupId}` : `conv:${mlsConvId}`;
+                  const cipherBytes = await this._encryptWithCatchUp(
+                    mlsGroup,
+                    mlsOnlyGroupKey,
+                    resolvedMlsGroupId,
+                    `conversation ${mlsConvId.slice(0, 8)}`,
+                    plaintextBytes
+                  );
                   await saveMlsState(this.config.dataDir, resolvedMlsGroupId, JSON.stringify(mlsGroup.exportState()));
                   const payload = {
                     conversation_id: mlsConvId,
@@ -70106,7 +70171,7 @@ var init_dist = __esm({
            */
           sendActivitySpan(spanData) {
             if (!this._ws || this._ws.readyState !== WebSocket.OPEN) return;
-            const pluginVersion = true ? "0.23.26" : "0.0.0-dev";
+            const pluginVersion = true ? "0.23.27" : "0.0.0-dev";
             const agentName = this.config.agentName ?? "Agent";
             const resource = {
               "service.name": "agentvault-agent",
@@ -70191,7 +70256,7 @@ var init_dist = __esm({
            * Optional timeout rejects with an Error.
            */
           waitForDecision(decisionId, timeoutMs) {
-            return new Promise((resolve32, reject) => {
+            return new Promise((resolve3, reject) => {
               let timer = null;
               const handler = (plaintext, metadata) => {
                 if (metadata.messageType !== "decision_response") return;
@@ -70200,7 +70265,7 @@ var init_dist = __esm({
                   if (parsed.decision?.decision_id === decisionId) {
                     if (timer) clearTimeout(timer);
                     this.removeListener("message", handler);
-                    resolve32({
+                    resolve3({
                       decision_id: parsed.decision.decision_id,
                       selected_option_id: parsed.decision.selected_option_id,
                       resolved_at: parsed.decision.resolved_at,
@@ -70316,7 +70381,13 @@ var init_dist = __esm({
               if (mlsGroup?.isInitialized) {
                 try {
                   const plaintextBytes = new TextEncoder().encode(plaintext);
-                  const ciphertext = await mlsGroup.encrypt(plaintextBytes);
+                  const ciphertext = await this._encryptWithCatchUp(
+                    mlsGroup,
+                    roomId,
+                    room.mlsGroupId,
+                    `room ${roomId.slice(0, 8)}`,
+                    plaintextBytes
+                  );
                   await saveMlsState(this.config.dataDir, room.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
                   if (this._state === "ready" && this._ws) {
                     this._ws.send(JSON.stringify({
@@ -71501,7 +71572,13 @@ var init_dist = __esm({
               const mlsGroup = this._mlsGroups.get(`a2a:${channelEntry.channelId}`);
               if (mlsGroup?.isInitialized) {
                 const plaintextBytes = new TextEncoder().encode(text);
-                const ciphertext = await mlsGroup.encrypt(plaintextBytes);
+                const ciphertext = await this._encryptWithCatchUp(
+                  mlsGroup,
+                  `a2a:${channelEntry.channelId}`,
+                  channelEntry.mlsGroupId,
+                  `A2A ${channelEntry.channelId.slice(0, 8)}`,
+                  plaintextBytes
+                );
                 await saveMlsState(
                   this.config.dataDir,
                   channelEntry.mlsGroupId,
@@ -71549,7 +71626,13 @@ var init_dist = __esm({
               const mlsGroup = this._mlsGroups.get(`a2a:${channelId}`);
               if (mlsGroup?.isInitialized) {
                 const plaintextBytes = new TextEncoder().encode(text);
-                const ciphertext = await mlsGroup.encrypt(plaintextBytes);
+                const ciphertext = await this._encryptWithCatchUp(
+                  mlsGroup,
+                  `a2a:${channelId}`,
+                  entry.mlsGroupId,
+                  `A2A ${channelId.slice(0, 8)}`,
+                  plaintextBytes
+                );
                 await saveMlsState(this.config.dataDir, entry.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
                 this._ws.send(JSON.stringify({
                   event: "a2a_message_mls",
@@ -72025,7 +72108,7 @@ var init_dist = __esm({
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.26" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.27" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -72349,7 +72432,7 @@ var init_dist = __esm({
                         agentVersion: this.config.agentVersion ?? "0.0.0",
                         // __AV_VERSION__ is injected by esbuild from package.json at build time.
                         // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                        pluginVersion: true ? "0.23.26" : "0.0.0-dev"
+                        pluginVersion: true ? "0.23.27" : "0.0.0-dev"
                       });
                       this._telemetryReporter.startAutoFlush(3e4);
                     }
@@ -72715,6 +72798,7 @@ var init_dist = __esm({
             const convGroupId = data.conversation_group_id;
             const groupId = data.group_id;
             const senderDeviceId = data.sender_device_id;
+            this._noteGroupEpoch(groupId, data.epoch);
             if (senderDeviceId === this._deviceId) return;
             let mgr;
             let mgrKey;
@@ -72792,9 +72876,15 @@ var init_dist = __esm({
                     })),
                     no_history: filtered.length === 0
                   });
-                  if (mgr && mlsGroupId) {
+                  if (mgr && mgrKey && mlsGroupId) {
                     const responseBytes = new TextEncoder().encode(responsePayload);
-                    const cipher = await mgr.encrypt(responseBytes);
+                    const cipher = await this._encryptWithCatchUp(
+                      mgr,
+                      mgrKey,
+                      mlsGroupId,
+                      `history catch-up ${mlsGroupId.slice(0, 8)}`,
+                      responseBytes
+                    );
                     await saveMlsState(this.config.dataDir, mlsGroupId, JSON.stringify(mgr.exportState()));
                     if (this._ws) {
                       this._ws.send(JSON.stringify({
@@ -73537,9 +73627,36 @@ ${messageText}`;
           // ---------------------------------------------------------------------------
           // MLS room message handlers
           // ---------------------------------------------------------------------------
+          /**
+           * #1014: hand a room-framed frame to the handler that owns its group family.
+           *
+           * Returns true when the frame was routed. Routing means "give it to the right
+           * handler" — NOT "decrypt it as a room message". Decrypting under the wrong
+           * group is how MLS state gets corrupted, so an unplaceable group is left for
+           * the caller to self-heal rather than guessed at.
+           */
+          async _routeNonRoomGroupMessage(data, groupId) {
+            const target = this._resolveGroupFamily(groupId);
+            if (!target || target.family === "room") return false;
+            console.log(
+              `[SecureChannel] Room-framed message belongs to ${target.label} \u2014 routing to the handler that owns it (#1014)`
+            );
+            switch (target.family) {
+              case "shared1to1":
+                await this._handleMessageMLS({ ...data, conversation_group_id: target.id });
+                return true;
+              case "conversation":
+                await this._handleMessageMLS({ ...data, conversation_id: target.id });
+                return true;
+              case "a2a":
+                await this._handleA2AMessageMLS({ ...data, a2a_channel_id: target.id });
+                return true;
+            }
+          }
           async _handleRoomMessageMLS(data) {
             const groupId = data.group_id;
             const senderDeviceId = data.sender_device_id;
+            this._noteGroupEpoch(groupId, data.epoch);
             if (senderDeviceId === this._deviceId) return;
             let roomId;
             for (const [rid, room] of Object.entries(this._persisted?.rooms ?? {})) {
@@ -73553,7 +73670,9 @@ ${messageText}`;
                 roomId = data.room_id;
                 console.log(`[SecureChannel] Room ${roomId.slice(0, 8)} matched by room_id (group_id ${groupId?.slice(0, 8)} mismatch)`);
               } else {
+                if (await this._routeNonRoomGroupMessage(data, groupId)) return;
                 console.warn(`[SecureChannel] No room found for MLS group ${groupId?.slice(0, 8)}`);
+                if (groupId) void this._requestWelcomeSelfHeal(groupId);
                 return;
               }
             }
@@ -73741,63 +73860,63 @@ ${messageText}`;
               console.warn(`[SecureChannel] Failed to send history catchup response:`, sendErr);
             }
           }
+          /**
+           * Apply an inbound MLS commit to whichever group it addresses.
+           *
+           * Returns TRUE when the commit was applied, buffered, or handed to the
+           * failure ladder — i.e. when this agent has taken responsibility for it and
+           * the delivery-queue row may safely be acked. Returns FALSE when the commit
+           * names a group we hold no state for at all, so the caller must NACK and let
+           * the row survive.
+           *
+           * #1012: this used to loop `rooms` then `a2aChannels` and then END. A shared
+           * 1:1 commit (`mlsGroups`) and a legacy per-conversation commit
+           * (`mlsConversations`) matched neither. The call fell off the bottom with no
+           * log, no buffer and no error — and because it did not THROW,
+           * `_pullDeliveryQueue` acked the row and the server deleted it. An MLS commit
+           * cannot be regenerated, so the agent stayed at epoch N while the group moved
+           * to N+1 and every later send() encrypted at an epoch nobody could decrypt.
+           *
+           * The families are enumerated in ONE list resolved by ONE loop, because two
+           * hand-copied loops are exactly how the 1:1 path fell two families behind.
+           */
           async _handleMlsCommit(data) {
             const groupId = data.group_id;
             const epoch = typeof data.epoch === "number" ? data.epoch : 0;
-            for (const [roomId, room] of Object.entries(this._persisted?.rooms ?? {})) {
-              if (room.mlsGroupId === groupId) {
-                const mlsGroup = this._mlsGroups.get(roomId);
-                if (mlsGroup?.isInitialized) {
-                  try {
-                    const commitBytes = new Uint8Array(Buffer.from(data.payload, "hex"));
-                    await mlsGroup.processCommit(commitBytes);
-                    await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mlsGroup.exportState()));
-                    console.log(`[SecureChannel] MLS commit processed for room ${roomId.slice(0, 8)} (epoch=${mlsGroup.epoch})`);
-                    this._mlsCommitFailCounts.delete(roomId);
-                  } catch (err) {
-                    await this._onCommitFailure(
-                      roomId,
-                      groupId,
-                      err,
-                      `room ${roomId.slice(0, 8)}`,
-                      data.epoch,
-                      mlsGroup.epoch
-                    );
-                  }
-                } else {
-                  this._bufferMlsCommit(groupId, epoch, data);
-                  console.log(`[SecureChannel] Buffered MLS commit for room ${roomId.slice(0, 8)} (epoch=${epoch}, group not initialized)`);
-                }
-                return;
+            this._noteGroupEpoch(groupId, data.epoch);
+            const target = this._resolveGroupFamily(groupId);
+            if (target) {
+              const { managerKey: groupKey, label } = target;
+              const mlsGroup = this._mlsGroups.get(groupKey);
+              if (!mlsGroup?.isInitialized) {
+                this._bufferMlsCommit(groupId, epoch, data);
+                console.log(`[SecureChannel] Buffered MLS commit for ${label} (epoch=${epoch}, group not initialized)`);
+                return true;
               }
-            }
-            for (const [chId, chState] of Object.entries(this._persisted?.a2aChannels ?? {})) {
-              if (chState.mlsGroupId === groupId) {
-                const mlsGroup = this._mlsGroups.get(`a2a:${chId}`);
-                if (mlsGroup?.isInitialized) {
-                  try {
-                    const commitBytes = new Uint8Array(Buffer.from(data.payload, "hex"));
-                    await mlsGroup.processCommit(commitBytes);
-                    await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mlsGroup.exportState()));
-                    console.log(`[SecureChannel] MLS commit processed for A2A ${chId.slice(0, 8)} (epoch=${mlsGroup.epoch})`);
-                    this._mlsCommitFailCounts.delete(`a2a:${chId}`);
-                  } catch (err) {
-                    await this._onCommitFailure(
-                      `a2a:${chId}`,
-                      groupId,
-                      err,
-                      `A2A ${chId.slice(0, 8)}`,
-                      data.epoch,
-                      mlsGroup.epoch
-                    );
-                  }
-                } else {
-                  this._bufferMlsCommit(groupId, epoch, data);
-                  console.log(`[SecureChannel] Buffered MLS commit for A2A ${chId.slice(0, 8)} (epoch=${epoch}, group not initialized)`);
-                }
-                return;
+              try {
+                const commitBytes = new Uint8Array(Buffer.from(data.payload, "hex"));
+                await mlsGroup.processCommit(commitBytes);
+                await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mlsGroup.exportState()));
+                console.log(`[SecureChannel] MLS commit processed for ${label} (epoch=${mlsGroup.epoch})`);
+                this._mlsCommitFailCounts.delete(groupKey);
+              } catch (err) {
+                await this._onCommitFailure(
+                  groupKey,
+                  groupId,
+                  err,
+                  label,
+                  data.epoch,
+                  mlsGroup.epoch
+                );
               }
+              return true;
             }
+            this._bufferMlsCommit(groupId, epoch, data);
+            console.warn(
+              `[SecureChannel] MLS commit for UNKNOWN group ${String(groupId).slice(0, 8)} (epoch=${epoch}) \u2014 buffered, requesting a Welcome, NOT acked`
+            );
+            if (groupId) void this._requestWelcomeSelfHeal(groupId);
+            return false;
           }
           /** Buffer an MLS commit for replay after Welcome join. Max 50 per group. */
           _bufferMlsCommit(groupId, epoch, data) {
@@ -73987,6 +74106,229 @@ ${messageText}`;
            *   `1to1-group:<gid>`, `a2a:<channelId>`, …) — also the decrypt-fail-count key.
            * @param groupId  the server-side MLS group id used in the /sync URL.
            */
+          /**
+           * #1015 — the ONLY place this package fulfils a Welcome request.
+           *
+           * Add the members, transmit, and record `fulfilled` **only for the targets
+           * whose frames actually went out**. Every one of the five sites that used to
+           * do this by hand followed the same sequence and had the same three holes:
+           * `this._ws` null (both sends skipped by an `if`), a CLOSING socket (`send`
+           * returns without throwing), and a fulfil POST wrapped in `.catch(() => {})`.
+           *
+           * A fulfilled request is never re-requested. So a Welcome that evaporated
+           * left the requester locked out, the fulfiller at epoch N+1, everyone else at
+           * N, and the bridging commit untransmitted and impossible to regenerate — a
+           * permanently wedged group in which every signal read success.
+           *
+           * Returns the number of requests actually fulfilled.
+           */
+          async _fulfilWelcomeRequests(opts) {
+            const { mlsGroup, mlsGroupId, label, welcomeFields, targets } = opts;
+            if (targets.length === 0) return 0;
+            if (!this._wsIsOpen()) {
+              console.warn(
+                `[SecureChannel] ${label}: socket is not OPEN \u2014 NOT advancing the group; ${targets.length} request(s) stay pending for the next pull`
+              );
+              return 0;
+            }
+            const snapshot = mlsGroup.exportState();
+            const { commit, welcome } = await mlsGroup.addMembers(targets.map((t2) => t2.keyPackage));
+            const commitSent = await this._sendFrameConfirmed(
+              {
+                event: "mls_commit",
+                data: {
+                  group_id: mlsGroupId,
+                  epoch: Number(mlsGroup.epoch),
+                  payload: Buffer.from(commit).toString("hex")
+                }
+              },
+              `${label} commit`
+            );
+            if (!commitSent) {
+              mlsGroup.importState(snapshot);
+              console.warn(
+                `[SecureChannel] ${label}: commit was NOT written \u2014 rolled back to epoch ${Number(mlsGroup.epoch)}, nothing fulfilled, requests stay pending`
+              );
+              return 0;
+            }
+            await saveMlsState(this.config.dataDir, mlsGroupId, JSON.stringify(mlsGroup.exportState()));
+            if (!welcome) {
+              console.warn(
+                `[SecureChannel] ${label}: addMembers produced NO Welcome \u2014 ${targets.length} request(s) left pending rather than marked fulfilled`
+              );
+              return 0;
+            }
+            let fulfilled = 0;
+            for (const t2 of targets) {
+              const sent = await this._sendFrameConfirmed(
+                {
+                  event: "mls_welcome",
+                  data: {
+                    target_device_id: t2.deviceId,
+                    group_id: mlsGroupId,
+                    ...welcomeFields,
+                    payload: Buffer.from(welcome).toString("hex")
+                  }
+                },
+                `${label} welcome\u2192${t2.deviceId.slice(0, 8)}`
+              );
+              if (!sent) {
+                console.warn(
+                  `[SecureChannel] ${label}: Welcome for ${t2.deviceId.slice(0, 8)} was NOT written \u2014 leaving the request PENDING so the next pull retries it`
+                );
+                continue;
+              }
+              if (await this._postFulfilWelcome(mlsGroupId, t2.requestId, `${label} ${t2.deviceId.slice(0, 8)}`)) {
+                fulfilled++;
+              }
+            }
+            return fulfilled;
+          }
+          /**
+           * Resolve an MLS group id to the family that owns it.
+           *
+           * There are four: rooms, A2A channels, shared 1:1 groups, and the legacy
+           * per-conversation groups. They all store the MLS group id under
+           * `mlsGroupId`; they differ only in the key their live `MLSGroupManager` sits
+           * under in `_mlsGroups`.
+           *
+           * ONE resolver, because hand-copying this enumeration is what produced
+           * #1012 (`_handleMlsCommit` handled two families of four), #1014 (a
+           * room-framed 1:1 replay matched nothing) and #1016 (a rejoin dropped only
+           * the room manager). Three bugs, one missing abstraction.
+           */
+          _resolveGroupFamily(mlsGroupId) {
+            if (!mlsGroupId) return null;
+            const families = [
+              { family: "room", entries: this._persisted?.rooms, managerKey: (id) => id, label: "room" },
+              { family: "a2a", entries: this._persisted?.a2aChannels, managerKey: (id) => `a2a:${id}`, label: "A2A" },
+              { family: "shared1to1", entries: this._persisted?.mlsGroups, managerKey: (id) => `1to1-group:${id}`, label: "1:1 group" },
+              { family: "conversation", entries: this._persisted?.mlsConversations, managerKey: (id) => `conv:${id}`, label: "conversation" }
+            ];
+            for (const f2 of families) {
+              for (const [id, entry] of Object.entries(f2.entries ?? {})) {
+                if (entry?.mlsGroupId !== mlsGroupId) continue;
+                return {
+                  family: f2.family,
+                  id,
+                  managerKey: f2.managerKey(id),
+                  label: `${f2.label} ${id.slice(0, 8)}`
+                };
+              }
+            }
+            return null;
+          }
+          /** #1015: is the socket in a state that can actually take a write? */
+          _wsIsOpen() {
+            return this._ws?.readyState === 1;
+          }
+          /**
+           * #1015: write one frame and report whether the socket took it.
+           *
+           * `ws.send()` on a CLOSING or CLOSED socket returns WITHOUT throwing — the
+           * error surfaces only through the callback, and every fulfilment site passed
+           * none. So a Welcome could be "sent" into a dead socket and the requester
+           * still marked `fulfilled`, which it never re-requests.
+           */
+          _sendFrameConfirmed(frame, label) {
+            const ws = this._ws;
+            if (!ws || ws.readyState !== 1) {
+              console.warn(
+                `[SecureChannel] ${label}: socket is not OPEN (readyState=${ws?.readyState ?? "null"}) \u2014 frame NOT written`
+              );
+              return Promise.resolve(false);
+            }
+            return new Promise((resolve3) => {
+              try {
+                ws.send(JSON.stringify(frame), (err) => {
+                  if (err) {
+                    console.error(`[SecureChannel] ${label}: socket refused the frame:`, err);
+                    resolve3(false);
+                  } else {
+                    resolve3(true);
+                  }
+                });
+              } catch (err) {
+                console.error(`[SecureChannel] ${label}: send threw:`, err);
+                resolve3(false);
+              }
+            });
+          }
+          /**
+           * #1015: record a Welcome as fulfilled — and say so when it fails.
+           *
+           * The batched shared-1:1 site posted this with `.catch(() => {})`, so an HTTP
+           * failure here was invisible on top of the sends being invisible.
+           */
+          async _postFulfilWelcome(mlsGroupId, requestId, label) {
+            try {
+              const res = await fetch(
+                `${this.config.apiUrl}/api/v1/mls/groups/${mlsGroupId}/fulfill-welcome`,
+                {
+                  method: "POST",
+                  headers: { Authorization: `Bearer ${this._deviceJwt}`, "Content-Type": "application/json" },
+                  body: JSON.stringify({ request_id: requestId })
+                }
+              );
+              if (!res.ok) {
+                console.warn(`[SecureChannel] ${label}: fulfill-welcome returned ${res.status}`);
+                return false;
+              }
+              return true;
+            } catch (err) {
+              console.warn(`[SecureChannel] ${label}: fulfill-welcome failed:`, err);
+              return false;
+            }
+          }
+          /**
+           * #1013: fold an epoch seen on an inbound frame into the running hint.
+           *
+           * Anything unusable (missing, non-numeric, negative, fractional) is ignored
+           * rather than defaulted. A defaulted epoch here would be a guess, and a guess
+           * that reads LOW silently disables the check it exists to drive.
+           */
+          _noteGroupEpoch(mlsGroupId, epoch) {
+            if (typeof mlsGroupId !== "string" || !mlsGroupId) return;
+            const current = this._observedGroupEpochs.get(mlsGroupId) ?? 0;
+            const next = noteObservedEpoch(current, epoch);
+            if (next > current) this._observedGroupEpochs.set(mlsGroupId, next);
+          }
+          /**
+           * #1013 — the ONLY place this package encrypts an MLS application message.
+           *
+           * Catch up first when the group is known to have moved past us, then encrypt.
+           * Hermes has done this since #440 and the browser since #996; the plugin —
+           * the implementation that actually ships to customers — did not, so an agent
+           * that missed one commit encrypted every later message at an epoch nobody
+           * could read, while the server stored and relayed it and every signal read
+           * 200.
+           *
+           * Funnelling every sender through one method is the point. A guard applied at
+           * seven call sites decays to a guard applied at six: that is exactly how
+           * `_handleMlsCommit` ended up handling two group families out of four (#1012).
+           *
+           * Best-effort by design. A catch-up that cannot replay — or that throws — must
+           * NOT block the send; we fall through and encrypt at the local epoch, which is
+           * precisely today's behaviour, so the worst case is no regression.
+           */
+          async _encryptWithCatchUp(mlsGroup, groupKey, mlsGroupId, label, plaintextBytes) {
+            const observed = this._observedGroupEpochs.get(mlsGroupId);
+            if (observed !== void 0 && needsPreSendResync(Number(mlsGroup.epoch), observed)) {
+              console.warn(
+                `[SecureChannel] ${label}: local epoch ${Number(mlsGroup.epoch)} is behind the observed group epoch ${observed} \u2014 catching up before encrypt (#1013)`
+              );
+              try {
+                if (!await this._resyncOnDivergence(groupKey, mlsGroupId)) {
+                  console.warn(
+                    `[SecureChannel] ${label}: catch-up could not replay \u2014 sending at epoch ${Number(mlsGroup.epoch)}. Peers past this epoch will not read it.`
+                  );
+                }
+              } catch (err) {
+                console.warn(`[SecureChannel] ${label}: catch-up failed:`, err);
+              }
+            }
+            return await mlsGroup.encrypt(plaintextBytes);
+          }
           async _resyncOnDivergence(groupKey, groupId) {
             const mgr = this._mlsGroups.get(groupKey);
             if (!mgr?.isInitialized) return false;
@@ -74013,11 +74355,24 @@ ${messageText}`;
                 applied++;
               }
               if (applied === 0) {
-                console.log(`[SecureChannel] Resync for ${groupId.slice(0, 8)}: no new commits to apply (epoch=${mgr.epoch})`);
+                const strikes = (this._resyncNoOpStrikes.get(groupKey) ?? 0) + 1;
+                this._resyncNoOpStrikes.set(groupKey, strikes);
+                if (strikes < _SecureChannel.MAX_RESYNC_NOOPS) {
+                  this._mlsDecryptFailCounts.delete(groupKey);
+                  console.log(
+                    `[SecureChannel] Resync for ${groupId.slice(0, 8)}: already current at epoch=${mgr.epoch} (strike ${strikes}/${_SecureChannel.MAX_RESYNC_NOOPS}) \u2014 NOT re-keying (#1084)`
+                  );
+                  return true;
+                }
+                this._resyncNoOpStrikes.delete(groupKey);
+                console.warn(
+                  `[SecureChannel] Resync for ${groupId.slice(0, 8)}: still failing at epoch=${mgr.epoch} after ${_SecureChannel.MAX_RESYNC_NOOPS} no-op resyncs \u2014 escalating to re-key`
+                );
                 return false;
               }
               await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mgr.exportState()));
               this._mlsDecryptFailCounts.delete(groupKey);
+              this._resyncNoOpStrikes.delete(groupKey);
               console.log(
                 `[SecureChannel] Resync-on-divergence: applied ${applied} missed commit(s) for ${groupId.slice(0, 8)}, now epoch=${mgr.epoch}`
               );
@@ -74404,6 +74759,7 @@ ${messageText}`;
                 const ackedIds = [];
                 const nackedIds = [];
                 for (const msg of messages) {
+                  let handled = true;
                   try {
                     if (msg.sender_device_id === this._deviceId) {
                       ackedIds.push(msg.queue_id);
@@ -74420,7 +74776,7 @@ ${messageText}`;
                         a2a_channel_id: msg.a2a_channel_id
                       });
                     } else if (msg.message_type === "commit") {
-                      await this._handleMlsCommit({
+                      handled = await this._handleMlsCommit({
                         group_id: msg.group_id,
                         sender_device_id: msg.sender_device_id,
                         epoch: msg.epoch,
@@ -74458,9 +74814,18 @@ ${messageText}`;
                           conversation_group_id: msg.conversation_group_id,
                           created_at: msg.created_at
                         });
+                      } else {
+                        handled = false;
+                        console.warn(
+                          `[SecureChannel] Delivery application row ${String(msg.message_id).slice(0, 8)} names no room, A2A channel or conversation \u2014 NOT acked`
+                        );
                       }
                     }
-                    ackedIds.push(msg.queue_id);
+                    if (handled) {
+                      ackedIds.push(msg.queue_id);
+                    } else {
+                      nackedIds.push(msg.queue_id);
+                    }
                   } catch (err) {
                     console.warn(`[SecureChannel] Delivery ${msg.message_type} processing failed:`, err);
                     nackedIds.push(msg.queue_id);
@@ -74529,38 +74894,20 @@ ${messageText}`;
                       if (!kpHex) continue;
                       const kpBytes = new Uint8Array(Buffer.from(kpHex, "hex"));
                       const memberKp = MLSGroupManager.deserializeKeyPackage(kpBytes);
-                      const { commit, welcome } = await mlsGroup.addMembers([memberKp]);
-                      if (this._ws) {
-                        this._ws.send(JSON.stringify({
-                          event: "mls_commit",
-                          data: {
-                            group_id: roomState.mlsGroupId,
-                            epoch: Number(mlsGroup.epoch),
-                            payload: Buffer.from(commit).toString("hex")
-                          }
-                        }));
-                      }
-                      if (welcome && this._ws) {
-                        this._ws.send(JSON.stringify({
-                          event: "mls_welcome",
-                          data: {
-                            target_device_id: req.requesting_device_id,
-                            group_id: roomState.mlsGroupId,
-                            room_id: roomId,
-                            payload: Buffer.from(welcome).toString("hex")
-                          }
-                        }));
+                      const done = await this._fulfilWelcomeRequests({
+                        mlsGroup,
+                        mlsGroupId: roomState.mlsGroupId,
+                        label: `room ${roomId.slice(0, 8)}`,
+                        welcomeFields: { room_id: roomId },
+                        targets: [{
+                          requestId: req.id,
+                          deviceId: req.requesting_device_id,
+                          keyPackage: memberKp
+                        }]
+                      });
+                      if (done > 0) {
+                        console.log(`[SecureChannel] Fulfilled Welcome for ${req.requesting_device_id.slice(0, 8)} in room ${roomId.slice(0, 8)}`);
                       }
-                      await fetch(
-                        `${this.config.apiUrl}/api/v1/mls/groups/${roomState.mlsGroupId}/fulfill-welcome`,
-                        {
-                          method: "POST",
-                          headers: { Authorization: `Bearer ${this._deviceJwt}`, "Content-Type": "application/json" },
-                          body: JSON.stringify({ request_id: req.id })
-                        }
-                      );
-                      await saveMlsState(this.config.dataDir, roomState.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
-                      console.log(`[SecureChannel] Fulfilled Welcome for ${req.requesting_device_id.slice(0, 8)} in room ${roomId.slice(0, 8)}`);
                     } catch (fulfillErr) {
                       console.warn(`[SecureChannel] Welcome fulfill failed for ${req.requesting_device_id.slice(0, 8)}:`, fulfillErr);
                     }
@@ -74599,65 +74946,38 @@ ${messageText}`;
                     validReqs.push({ req, kp: MLSGroupManager.deserializeKeyPackage(kpBytes) });
                   }
                   if (validReqs.length === 0) continue;
+                  const sharedTargets = validReqs.map((v2) => ({
+                    requestId: v2.req.id,
+                    deviceId: v2.req.requesting_device_id,
+                    keyPackage: v2.kp
+                  }));
                   try {
-                    const { commit, welcome } = await mlsGroup.addMembers(validReqs.map((v2) => v2.kp));
-                    if (this._ws) {
-                      this._ws.send(JSON.stringify({
-                        event: "mls_commit",
-                        data: {
-                          group_id: entry.mlsGroupId,
-                          epoch: Number(mlsGroup.epoch),
-                          payload: Buffer.from(commit).toString("hex")
-                        }
-                      }));
-                    }
-                    if (welcome && this._ws) {
-                      for (const { req } of validReqs) {
-                        this._ws.send(JSON.stringify({
-                          event: "mls_welcome",
-                          data: {
-                            target_device_id: req.requesting_device_id,
-                            group_id: entry.mlsGroupId,
-                            conversation_group_id: gid,
-                            payload: Buffer.from(welcome).toString("hex")
-                          }
-                        }));
-                      }
-                    }
-                    for (const { req } of validReqs) {
-                      await fetch(
-                        `${this.config.apiUrl}/api/v1/mls/groups/${entry.mlsGroupId}/fulfill-welcome`,
-                        {
-                          method: "POST",
-                          headers: { Authorization: `Bearer ${this._deviceJwt}`, "Content-Type": "application/json" },
-                          body: JSON.stringify({ request_id: req.id })
-                        }
-                      ).catch(() => {
-                      });
+                    const done = await this._fulfilWelcomeRequests({
+                      mlsGroup,
+                      mlsGroupId: entry.mlsGroupId,
+                      label: `shared group ${gid.slice(0, 8)}`,
+                      welcomeFields: { conversation_group_id: gid },
+                      targets: sharedTargets
+                    });
+                    if (done > 0) {
+                      console.log(`[SecureChannel] Batched Welcome for ${done}/${validReqs.length} devices in shared group ${gid.slice(0, 8)} (epoch=${mlsGroup.epoch})`);
                     }
-                    await saveMlsState(this.config.dataDir, entry.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
-                    console.log(`[SecureChannel] Batched Welcome for ${validReqs.length} devices in shared group ${gid.slice(0, 8)} (epoch=${mlsGroup.epoch})`);
                   } catch (batchErr) {
                     console.warn(`[SecureChannel] Batched Welcome failed for shared group ${gid.slice(0, 8)}, falling back to individual:`, batchErr);
-                    for (const { req, kp } of validReqs) {
+                    for (const target of sharedTargets) {
                       try {
-                        const { commit, welcome } = await mlsGroup.addMembers([kp]);
-                        if (this._ws) {
-                          this._ws.send(JSON.stringify({ event: "mls_commit", data: { group_id: entry.mlsGroupId, epoch: Number(mlsGroup.epoch), payload: Buffer.from(commit).toString("hex") } }));
-                        }
-                        if (welcome && this._ws) {
-                          this._ws.send(JSON.stringify({ event: "mls_welcome", data: { target_device_id: req.requesting_device_id, group_id: entry.mlsGroupId, conversation_group_id: gid, payload: Buffer.from(welcome).toString("hex") } }));
-                        }
-                        await fetch(`${this.config.apiUrl}/api/v1/mls/groups/${entry.mlsGroupId}/fulfill-welcome`, {
-                          method: "POST",
-                          headers: { Authorization: `Bearer ${this._deviceJwt}`, "Content-Type": "application/json" },
-                          body: JSON.stringify({ request_id: req.id })
-                        }).catch(() => {
+                        const done = await this._fulfilWelcomeRequests({
+                          mlsGroup,
+                          mlsGroupId: entry.mlsGroupId,
+                          label: `shared group ${gid.slice(0, 8)}`,
+                          welcomeFields: { conversation_group_id: gid },
+                          targets: [target]
                         });
-                        await saveMlsState(this.config.dataDir, entry.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
-                        console.log(`[SecureChannel] Individual Welcome for ${req.requesting_device_id.slice(0, 8)} in shared group ${gid.slice(0, 8)}`);
+                        if (done > 0) {
+                          console.log(`[SecureChannel] Individual Welcome for ${target.deviceId.slice(0, 8)} in shared group ${gid.slice(0, 8)}`);
+                        }
                       } catch (indivErr) {
-                        console.warn(`[SecureChannel] Individual Welcome failed for ${req.requesting_device_id.slice(0, 8)}:`, indivErr);
+                        console.warn(`[SecureChannel] Individual Welcome failed for ${target.deviceId.slice(0, 8)}:`, indivErr);
                       }
                     }
                   }
@@ -74689,38 +75009,20 @@ ${messageText}`;
                       if (!kpHex) continue;
                       const kpBytes = new Uint8Array(Buffer.from(kpHex, "hex"));
                       const memberKp = MLSGroupManager.deserializeKeyPackage(kpBytes);
-                      const { commit, welcome } = await mlsGroup.addMembers([memberKp]);
-                      if (this._ws) {
-                        this._ws.send(JSON.stringify({
-                          event: "mls_commit",
-                          data: {
-                            group_id: convEntry.mlsGroupId,
-                            epoch: Number(mlsGroup.epoch),
-                            payload: Buffer.from(commit).toString("hex")
-                          }
-                        }));
-                      }
-                      if (welcome && this._ws) {
-                        this._ws.send(JSON.stringify({
-                          event: "mls_welcome",
-                          data: {
-                            target_device_id: req.requesting_device_id,
-                            group_id: convEntry.mlsGroupId,
-                            conversation_id: convId,
-                            payload: Buffer.from(welcome).toString("hex")
-                          }
-                        }));
+                      const done = await this._fulfilWelcomeRequests({
+                        mlsGroup,
+                        mlsGroupId: convEntry.mlsGroupId,
+                        label: `conv ${convId.slice(0, 8)}`,
+                        welcomeFields: { conversation_id: convId },
+                        targets: [{
+                          requestId: req.id,
+                          deviceId: req.requesting_device_id,
+                          keyPackage: memberKp
+                        }]
+                      });
+                      if (done > 0) {
+                        console.log(`[SecureChannel] Fulfilled Welcome for ${req.requesting_device_id.slice(0, 8)} in conv ${convId.slice(0, 8)}`);
                       }
-                      await fetch(
-                        `${this.config.apiUrl}/api/v1/mls/groups/${convEntry.mlsGroupId}/fulfill-welcome`,
-                        {
-                          method: "POST",
-                          headers: { Authorization: `Bearer ${this._deviceJwt}`, "Content-Type": "application/json" },
-                          body: JSON.stringify({ request_id: req.id })
-                        }
-                      );
-                      await saveMlsState(this.config.dataDir, convEntry.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
-                      console.log(`[SecureChannel] Fulfilled Welcome for ${req.requesting_device_id.slice(0, 8)} in conv ${convId.slice(0, 8)}`);
                     } catch (fulfillErr) {
                       console.warn(`[SecureChannel] Conv Welcome fulfill failed for ${req.requesting_device_id.slice(0, 8)}:`, fulfillErr);
                     }
@@ -74901,12 +75203,13 @@ ${messageText}`;
                       } catch (distErr) {
                         console.warn(`[SecureChannel] A2A distribute network error:`, distErr);
                       }
-                      if (!distributed && this._ws) {
-                        this._ws.send(JSON.stringify({
+                      if (!distributed && this._wsIsOpen()) {
+                        const a2aLabel = `A2A ${chId.slice(0, 8)}`;
+                        const commitSent = await this._sendFrameConfirmed({
                           event: "mls_commit",
                           data: { group_id: chState.mlsGroupId, epoch: Number(mlsGroup.epoch), payload: commitHex }
-                        }));
-                        this._ws.send(JSON.stringify({
+                        }, `${a2aLabel} commit`);
+                        const welcomeSent = commitSent && await this._sendFrameConfirmed({
                           event: "mls_welcome",
                           data: {
                             target_device_id: req.requesting_device_id,
@@ -74914,7 +75217,11 @@ ${messageText}`;
                             a2a_channel_id: chId,
                             payload: welcomeHex
                           }
-                        }));
+                        }, `${a2aLabel} welcome`);
+                        if (!welcomeSent) {
+                          console.warn(`[SecureChannel] ${a2aLabel}: Welcome frames were NOT written \u2014 leaving the request pending`);
+                          continue;
+                        }
                         try {
                           await fetch(
                             `${this.config.apiUrl}/api/v1/mls/groups/${chState.mlsGroupId}/distribute`,
@@ -74937,16 +75244,15 @@ ${messageText}`;
                         console.warn(`[SecureChannel] Cannot deliver Welcome \u2014 HTTP distribute and WS both unavailable`);
                         continue;
                       }
-                      await fetch(
-                        `${this.config.apiUrl}/api/v1/mls/groups/${chState.mlsGroupId}/fulfill-welcome`,
-                        {
-                          method: "POST",
-                          headers: { Authorization: `Bearer ${this._deviceJwt}`, "Content-Type": "application/json" },
-                          body: JSON.stringify({ request_id: req.id })
-                        }
+                      const a2aFulfilled = await this._postFulfilWelcome(
+                        chState.mlsGroupId,
+                        req.id,
+                        `A2A ${chId.slice(0, 8)}`
                       );
                       await saveMlsState(this.config.dataDir, chState.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
-                      console.log(`[SecureChannel] Fulfilled A2A Welcome for ${req.requesting_device_id.slice(0, 8)} in channel ${chId.slice(0, 8)}`);
+                      if (a2aFulfilled) {
+                        console.log(`[SecureChannel] Fulfilled A2A Welcome for ${req.requesting_device_id.slice(0, 8)} in channel ${chId.slice(0, 8)}`);
+                      }
                     } catch (fulfillErr) {
                       console.log(`[SecureChannel] A2A Welcome fulfill failed: ${fulfillErr instanceof Error ? fulfillErr.message : String(fulfillErr)}`);
                     }
@@ -75120,12 +75426,12 @@ ${messageText}`;
               console.log(`[SecureChannel] MLS sync: re-join needed for group ${groupId?.slice(0, 8)}`);
               if (groupId) {
                 await deleteMlsState(this.config.dataDir, groupId);
-                for (const [roomId, room] of Object.entries(this._persisted?.rooms ?? {})) {
-                  if (room.mlsGroupId === groupId) {
-                    this._mlsGroups.delete(roomId);
-                    break;
-                  }
+                const target = this._resolveGroupFamily(groupId);
+                if (target) {
+                  this._mlsGroups.delete(target.managerKey);
+                  console.log(`[SecureChannel] MLS sync rejoin: dropped local state for ${target.label}`);
                 }
+                void this._requestWelcomeSelfHeal(groupId);
               }
             } else if (action === "replay_complete") {
               console.log(`[SecureChannel] MLS sync complete for group ${groupId?.slice(0, 8)} (${data.count} messages replayed)`);
@@ -75137,6 +75443,7 @@ ${messageText}`;
            */
           async _handleA2AMessageMLS(data) {
             const groupId = data.group_id;
+            this._noteGroupEpoch(groupId, data.epoch);
             const channelId = data.channel_id ?? data.a2a_channel_id;
             let a2aChannelId = channelId;
             if (!a2aChannelId) {
@@ -83557,10 +83864,10 @@ ${actionsText}`);
           inst.with = inst.check;
           inst.clone = (_def, params) => clone(inst, _def, params);
           inst.brand = () => inst;
-          inst.register = (reg, meta3) => {
+          inst.register = ((reg, meta3) => {
             reg.add(inst, meta3);
             return inst;
-          };
+          });
           inst.apply = (fn) => fn(inst);
         });
         ZodMiniObject = /* @__PURE__ */ $constructor("ZodMiniObject", (inst, def) => {
@@ -83947,10 +84254,10 @@ ${actionsText}`);
           inst.with = inst.check;
           inst.clone = (def2, params) => clone(inst, def2, params);
           inst.brand = () => inst;
-          inst.register = (reg, meta3) => {
+          inst.register = ((reg, meta3) => {
             reg.add(inst, meta3);
             return inst;
-          };
+          });
           inst.parse = (data, params) => parse2(inst, data, params, { callee: inst.parse });
           inst.safeParse = (data, params) => safeParse3(inst, data, params);
           inst.parseAsync = async (data, params) => parseAsync2(inst, data, params, { callee: inst.parseAsync });
@@ -87277,7 +87584,7 @@ ${actionsText}`);
                   return;
                 }
                 const pollInterval = task2.pollInterval ?? this._options?.defaultTaskPollInterval ?? 1e3;
-                await new Promise((resolve32) => setTimeout(resolve32, pollInterval));
+                await new Promise((resolve3) => setTimeout(resolve3, pollInterval));
                 options?.signal?.throwIfAborted();
               }
             } catch (error2) {
@@ -87294,7 +87601,7 @@ ${actionsText}`);
            */
           request(request, resultSchema, options) {
             const { relatedRequestId, resumptionToken, onresumptiontoken, task, relatedTask } = options ?? {};
-            return new Promise((resolve32, reject) => {
+            return new Promise((resolve3, reject) => {
               const earlyReject = (error2) => {
                 reject(error2);
               };
@@ -87372,7 +87679,7 @@ ${actionsText}`);
                   if (!parseResult.success) {
                     reject(parseResult.error);
                   } else {
-                    resolve32(parseResult.data);
+                    resolve3(parseResult.data);
                   }
                 } catch (error2) {
                   reject(error2);
@@ -87633,12 +87940,12 @@ ${actionsText}`);
               }
             } catch {
             }
-            return new Promise((resolve32, reject) => {
+            return new Promise((resolve3, reject) => {
               if (signal.aborted) {
                 reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
                 return;
               }
-              const timeoutId = setTimeout(resolve32, interval);
+              const timeoutId = setTimeout(resolve3, interval);
               signal.addEventListener("abort", () => {
                 clearTimeout(timeoutId);
                 reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
@@ -90623,7 +90930,7 @@ ${actionsText}`);
           const schOrFunc = root3.refs[ref];
           if (schOrFunc)
             return schOrFunc;
-          let _sch = resolve32.call(this, root3, ref);
+          let _sch = resolve3.call(this, root3, ref);
           if (_sch === void 0) {
             const schema = (_a3 = root3.localRefs) === null || _a3 === void 0 ? void 0 : _a3[ref];
             const { schemaId } = this.opts;
@@ -90650,7 +90957,7 @@ ${actionsText}`);
         function sameSchemaEnv(s1, s2) {
           return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
         }
-        function resolve32(root3, ref) {
+        function resolve3(root3, ref) {
           let sch;
           while (typeof (sch = this.refs[ref]) == "string")
             ref = sch;
@@ -91217,7 +91524,7 @@ ${actionsText}`);
           }
           return uri;
         }
-        function resolve32(baseURI, relativeURI, options) {
+        function resolve3(baseURI, relativeURI, options) {
           const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
           const resolved = resolveComponent(parse3(baseURI, schemelessOptions), parse3(relativeURI, schemelessOptions), schemelessOptions, true);
           schemelessOptions.skipEscape = true;
@@ -91444,7 +91751,7 @@ ${actionsText}`);
         var fastUri = {
           SCHEMES,
           normalize,
-          resolve: resolve32,
+          resolve: resolve3,
           resolveComponent,
           equal,
           serialize,
@@ -95281,7 +95588,7 @@ ${actionsText}`);
             let task = createTaskResult.task;
             const pollInterval = task.pollInterval ?? 5e3;
             while (task.status !== "completed" && task.status !== "failed" && task.status !== "cancelled") {
-              await new Promise((resolve32) => setTimeout(resolve32, pollInterval));
+              await new Promise((resolve3) => setTimeout(resolve3, pollInterval));
               const updatedTask = await extra.taskStore.getTask(taskId);
               if (!updatedTask) {
                 throw new McpError(ErrorCode.InternalError, `Task ${taskId} not found during polling`);
@@ -96145,7 +96452,7 @@ ${actionsText}`);
                 });
                 if (!chunk) {
                   if (i2 === 1) {
-                    await new Promise((resolve32) => setTimeout(resolve32));
+                    await new Promise((resolve3) => setTimeout(resolve3));
                     maxReadCount = 3;
                     continue;
                   }
@@ -96644,9 +96951,9 @@ data:
               const initRequest = messages.find((m2) => isInitializeRequest(m2));
               const clientProtocolVersion = initRequest ? initRequest.params.protocolVersion : req.headers.get("mcp-protocol-version") ?? DEFAULT_NEGOTIATED_PROTOCOL_VERSION;
               if (this._enableJsonResponse) {
-                return new Promise((resolve32) => {
+                return new Promise((resolve3) => {
                   this._streamMapping.set(streamId, {
-                    resolveJson: resolve32,
+                    resolveJson: resolve3,
                     cleanup: () => {
                       this._streamMapping.delete(streamId);
                     }
@@ -97358,7 +97665,7 @@ data:
         init_skill_invoker();
         await init_skill_telemetry();
         await init_policy_enforcer();
-        VERSION = true ? "0.23.26" : "0.0.0-dev";
+        VERSION = true ? "0.23.27" : "0.0.0-dev";
       }
     });
     await init_index();
@@ -97369,8 +97676,6 @@ data:
 init_config();
 init_log();
 import { chmodSync as chmodSync5, mkdirSync as mkdirSync6 } from "node:fs";
-import { resolve as resolve3 } from "node:path";
-import { pathToFileURL } from "node:url";
 // src/fence-auth.ts
 import { copyFileSync, chmodSync as chmodSync2, existsSync as existsSync2, mkdirSync as mkdirSync2 } from "node:fs";
@@ -97401,6 +97706,8 @@ var MuseSession = class {
     this.driver = driver;
     this.opts = opts;
   }
+  driver;
+  opts;
   queue = [];
   running = false;
   current = null;
@@ -97562,6 +97869,7 @@ var MuseDriver = class {
     this.spawnFn = opts.spawnFn ?? defaultSpawn;
     this.turnTimeoutMs = opts.turnTimeoutMs ?? DEFAULT_TURN_TIMEOUT_MS;
   }
+  opts;
   spawnFn;
   turnTimeoutMs;
   persistedId = null;
@@ -97648,7 +97956,7 @@ var MuseDriver = class {
     }
   }
   execJsonl(spawn2) {
-    return new Promise((resolve4, reject) => {
+    return new Promise((resolve3, reject) => {
       let reaped = false;
       let timedOut = false;
       let buf = "";
@@ -97672,7 +97980,7 @@ var MuseDriver = class {
         }
         const spoke = this.current?.spoke ?? false;
         if (terminal?.ok === true) {
-          resolve4({ text: terminal.text, spoke });
+          resolve3({ text: terminal.text, spoke });
           return;
         }
         if (terminal?.ok === false) {
@@ -97775,7 +98083,7 @@ function onData(stream, fn) {
   stream?.on("data", fn);
 }
 function collectOutput(child) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve3, reject) => {
     let stdout = "";
     let stderr = "";
     let settled = false;
@@ -97794,18 +98102,18 @@ function collectOutput(child) {
       finish(() => reject(err instanceof Error ? err : new Error(String(err))));
     });
     child.on("exit", () => {
-      finish(() => resolve4(stdout + stderr));
+      finish(() => resolve3(stdout + stderr));
     });
   });
 }
 function waitForExit(child, ms) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve3) => {
     let done = false;
     const finish = (value) => {
       if (done) return;
       done = true;
       clearTimeout(timer);
-      resolve4(value);
+      resolve3(value);
     };
     const timer = setTimeout(() => finish(false), ms);
     child.on("exit", () => finish(true));
@@ -98073,9 +98381,9 @@ data: ${JSON.stringify(out)}
       res.writeHead(200, { "content-type": "application/json", ...extra }).end(JSON.stringify(out));
     });
   }
-  await new Promise((resolve4, reject) => {
+  await new Promise((resolve3, reject) => {
     server.once("error", reject);
-    server.listen(0, "127.0.0.1", () => resolve4());
+    server.listen(0, "127.0.0.1", () => resolve3());
   });
   const addr = server.address();
   if (!addr || typeof addr === "string") throw new Error("room MCP server failed to bind");
@@ -98086,8 +98394,8 @@ data: ${JSON.stringify(out)}
     token,
     seenMethods: () => [...seen],
     seenHttp: () => traces.map((t2) => ({ ...t2 })),
-    close: () => new Promise((resolve4) => {
-      server.close(() => resolve4());
+    close: () => new Promise((resolve3) => {
+      server.close(() => resolve3());
       server.closeAllConnections?.();
     })
   };
@@ -98273,7 +98581,7 @@ function mkdir700(path2) {
   chmodSync5(path2, 448);
 }
 function packageVersion() {
-  return true ? "0.1.0" : void 0;
+  return true ? "0.1.2" : void 0;
 }
 function helpText(version2) {
   return [
@@ -98432,17 +98740,7 @@ async function main(opts = {}) {
     shuttingDown: () => shuttingDown
   };
 }
-function launchedAsCli() {
-  if (process.env.VITEST) return false;
-  const entry = process.argv[1];
-  if (!entry) return false;
-  try {
-    return import.meta.url === pathToFileURL(resolve3(entry)).href;
-  } catch {
-    return false;
-  }
-}
-if (launchedAsCli()) {
+if (!process.env.VITEST) {
   main().catch((err) => {
     logLine("[muse-bridge] fatal:", err);
     process.exit(1);