@agentvault/muse-bridge 0.1.1 → 0.1.3

package/dist/index.js

@@ -9,20 +9,132 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/fence-auth.ts
+import {
+  copyFileSync,
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  unlinkSync,
+  writeFileSync
+} from "node:fs";
+import { join } from "node:path";
+function parseAuthJson(path2) {
+  try {
+    if (!existsSync(path2)) return void 0;
+    return JSON.parse(readFileSync(path2, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+function metaApiKeyFromAuth(parsed) {
+  if (!parsed || typeof parsed !== "object") return void 0;
+  const providers = parsed.providers;
+  if (!providers || typeof providers !== "object") return void 0;
+  const meta3 = providers.meta;
+  if (!meta3 || typeof meta3 !== "object") return void 0;
+  const key = meta3.api_key;
+  if (typeof key !== "string") return void 0;
+  const trimmed = key.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
+function isKeychainOnlyAuth(parsed) {
+  if (!parsed || typeof parsed !== "object") return false;
+  const providers = parsed.providers;
+  if (!providers || typeof providers !== "object") return false;
+  const meta3 = providers.meta;
+  if (!meta3 || typeof meta3 !== "object") return false;
+  return meta3.storage === "keychain" && !metaApiKeyFromAuth(parsed);
+}
+function readFenceMetaApiKey(fenceHome) {
+  return metaApiKeyFromAuth(parseAuthJson(join(fenceHome, ".config", "muse", "auth.json")));
+}
+function sidecarMetaApiKeyPath(dataDir) {
+  return join(dataDir, "meta-api-key.json");
+}
+function apiKeyFromSidecar(parsed) {
+  if (!parsed || typeof parsed !== "object") return void 0;
+  const key = parsed.api_key;
+  if (typeof key !== "string") return void 0;
+  const trimmed = key.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
+function readSidecarMetaApiKey(dataDir) {
+  return apiKeyFromSidecar(parseAuthJson(sidecarMetaApiKeyPath(dataDir)));
+}
+function harvestFenceApiKeyToSidecar(opts) {
+  const log = opts.log ?? (() => {
+  });
+  const fenceAuth = join(opts.fenceHome, ".config", "muse", "auth.json");
+  const fenceKey = readFenceMetaApiKey(opts.fenceHome);
+  const sidecar = sidecarMetaApiKeyPath(opts.dataDir);
+  const hadSidecar = !!readSidecarMetaApiKey(opts.dataDir);
+  if (fenceKey && !hadSidecar) {
+    mkdirSync(opts.dataDir, { recursive: true, mode: 448 });
+    writeFileSync(sidecar, JSON.stringify({ api_key: fenceKey }) + "\n", { encoding: "utf8" });
+    chmodSync(sidecar, 384);
+    log("[muse-bridge] moved fence Meta key out of auth.json so Muse will not hit the Keychain");
+  }
+  if (fenceKey && existsSync(fenceAuth)) {
+    unlinkSync(fenceAuth);
+  }
+  if (fenceKey && !hadSidecar) return "harvested";
+  if (hadSidecar) return "already-sidecar";
+  return "none";
+}
+function seedFenceCredential(opts) {
+  const log = opts.log ?? (() => {
+  });
+  const fenceAuth = join(opts.fenceHome, ".config", "muse", "auth.json");
+  if (existsSync(fenceAuth)) {
+    if (isKeychainOnlyAuth(parseAuthJson(fenceAuth))) {
+      unlinkSync(fenceAuth);
+      log(
+        "[muse-bridge] fence credential is keychain-only; removing it so the child does not hit the Keychain"
+      );
+    } else {
+      log("[muse-bridge] fence credential already present; leaving it untouched");
+      return "already-present";
+    }
+  }
+  const hostAuth = join(opts.hostHome, ".config", "muse", "auth.json");
+  if (!existsSync(hostAuth)) {
+    log("[muse-bridge] no host credential to seed (run `muse login`, or set META_API_KEY)");
+    return "no-host-credential";
+  }
+  if (isKeychainOnlyAuth(parseAuthJson(hostAuth))) {
+    log(
+      "[muse-bridge] host muse login is keychain-only; not copying it into the fence. Set META_API_KEY."
+    );
+    return "host-credential-keychain-only";
+  }
+  mkdirSync(join(opts.fenceHome, ".config", "muse"), { recursive: true });
+  copyFileSync(hostAuth, fenceAuth);
+  chmodSync(fenceAuth, 384);
+  log("[muse-bridge] seeded fence credential from the host muse login");
+  return "seeded";
+}
+var init_fence_auth = __esm({
+  "src/fence-auth.ts"() {
+    "use strict";
+  }
+});
+
 // src/config.ts
-import { existsSync, readFileSync, mkdirSync, chmodSync } from "node:fs";
-import { join, resolve, sep, dirname } from "node:path";
+import { existsSync as existsSync2, readFileSync as readFileSync2, mkdirSync as mkdirSync2, chmodSync as chmodSync2 } from "node:fs";
+import { join as join2, resolve, sep, dirname } from "node:path";
 import { tmpdir } from "node:os";
 function hasRecoverableBackup(dataDir) {
   try {
-    const parsed = JSON.parse(readFileSync(join(dataDir, BACKUP_FILE), "utf-8"));
+    const parsed = JSON.parse(readFileSync2(join2(dataDir, BACKUP_FILE), "utf-8"));
     return !!(parsed && parsed.deviceId && parsed.deviceJwt && parsed.sessions && Object.keys(parsed.sessions).length > 0);
   } catch {
     return false;
   }
 }
 function hasPersistedCreds(dataDir) {
-  if (CRED_FILES.some((f2) => existsSync(join(dataDir, f2)))) return true;
+  if (CRED_FILES.some((f2) => existsSync2(join2(dataDir, f2)))) return true;
   return hasRecoverableBackup(dataDir);
 }
 function slugify(name) {
@@ -54,8 +166,8 @@ function loadConfig(env, argv = []) {
   }
   const slug = slugify(agentName);
   const hostHome = env.HOME ?? "";
-  const dataDir = env.AV_DATA_DIR || join(hostHome, ".agentvault", "muse-room-bridge", slug);
-  const workspaceDir = env.AV_WORKSPACE_DIR || join(dirname(dataDir), "workspaces", slug);
+  const dataDir = env.AV_DATA_DIR || join2(hostHome, ".agentvault", "muse-room-bridge", slug);
+  const workspaceDir = env.AV_WORKSPACE_DIR || join2(dirname(dataDir), "workspaces", slug);
   const wsReal = resolve(workspaceDir);
   const ddReal = resolve(dataDir);
   if (wsReal === ddReal || wsReal.startsWith(ddReal + sep) || ddReal.startsWith(wsReal + sep)) {
@@ -64,8 +176,8 @@ function loadConfig(env, argv = []) {
     );
   }
   try {
-    mkdirSync(workspaceDir, { recursive: true, mode: 448 });
-    chmodSync(workspaceDir, 448);
+    mkdirSync2(workspaceDir, { recursive: true, mode: 448 });
+    chmodSync2(workspaceDir, 448);
   } catch (e) {
     throw new Error(
       `Failed to create/secure the agent workspace at ${workspaceDir} (override with AV_WORKSPACE_DIR): ${e.message}`
@@ -83,14 +195,15 @@ function loadConfig(env, argv = []) {
       "invite token required: pass it as the first argument or set AV_INVITE_TOKEN (or start from a data dir with existing credentials to reconnect)"
     );
   }
+  const fenceHome = env.AV_FENCE_HOME || join2(dataDir, "fence");
   return {
     inviteToken,
     dataDir,
     agentName,
     workspaceDir,
     musePath: env.AV_MUSE_PATH || "muse",
-    fenceHome: env.AV_FENCE_HOME || join(dataDir, "fence"),
-    apiKey: env.META_API_KEY || void 0,
+    fenceHome,
+    apiKey: env.META_API_KEY || readSidecarMetaApiKey(dataDir) || readFenceMetaApiKey(fenceHome) || void 0,
     hostHome,
     apiUrl: env.AV_API_URL ?? "https://api.agentvault.chat"
   };
@@ -99,6 +212,7 @@ var CRED_FILES, BACKUP_FILE, VERSION_FLAGS, HELP_FLAGS, KNOWN_FLAGS;
 var init_config = __esm({
   "src/config.ts"() {
     "use strict";
+    init_fence_auth();
     CRED_FILES = ["agentvault.json", "secure-channel.json"];
     BACKUP_FILE = "agentvault.json.bak";
     VERSION_FLAGS = ["--version", "-v"];
@@ -260,6 +374,7 @@ function parsePlistEnv(xml) {
     }
     i2 = m2.index;
   }
+  void i2;
   if (close < 0) return out;
   const body = xml.slice(open, close);
   const pair = /<key>([\s\S]*?)<\/key>\s*<string>([\s\S]*?)<\/string>/g;
@@ -279,6 +394,7 @@ var init_launchd = __esm({
       constructor(deps) {
         this.deps = deps;
       }
+      deps;
       plistPath(label) {
         return join7(this.deps.home, "Library", "LaunchAgents", `${label}.plist`);
       }
@@ -391,6 +507,7 @@ var init_systemd = __esm({
       constructor(deps) {
         this.deps = deps;
       }
+      deps;
       unitPath(label) {
         return join8(this.deps.home, ".config", "systemd", "user", `${label}.service`);
       }
@@ -439,7 +556,7 @@ var init_systemd = __esm({
 
 // src/service/backend.ts
 import { spawnSync } from "node:child_process";
-import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync3, rmSync, existsSync as existsSync4, chmodSync as chmodSync4, readdirSync, readFileSync as readFileSync3 } from "node:fs";
+import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync4, rmSync, existsSync as existsSync4, chmodSync as chmodSync4, readdirSync, readFileSync as readFileSync4 } from "node:fs";
 import { userInfo } from "node:os";
 function defaultDeps() {
   return {
@@ -450,7 +567,7 @@ function defaultDeps() {
       const r2 = spawnSync(cmd, args, { encoding: "utf8" });
       return { code: r2.status ?? 1, stdout: r2.stdout ?? "" };
     },
-    writeFile: (p2, d2) => writeFileSync3(p2, d2),
+    writeFile: (p2, d2) => writeFileSync4(p2, d2),
     mkdir: (p2) => mkdirSync5(p2, { recursive: true }),
     chmod: (p2, m2) => chmodSync4(p2, m2),
     rm: (p2) => rmSync(p2, { force: true }),
@@ -464,7 +581,7 @@ function defaultDeps() {
     },
     readFile: (p2) => {
       try {
-        return readFileSync3(p2, "utf8");
+        return readFileSync4(p2, "utf8");
       } catch {
         return "";
       }
@@ -633,7 +750,7 @@ import { randomUUID as randomUUID3 } from "node:crypto";
 import { EventEmitter } from "node:events";
 import { createServer as createServer2 } from "node:http";
 import { randomUUID as randomUUID22, createHash } from "node:crypto";
-import { readFileSync as readFileSync4 } from "node:fs";
+import { readFileSync as readFileSync5 } from "node:fs";
 import { homedir as osHomedir } from "node:os";
 import { writeFile as writeFile3, mkdir as mkdir3 } from "node:fs/promises";
 import { join as join42 } from "node:path";
@@ -11615,6 +11732,18 @@ function orderDeliveryBatch(messages) {
     return createdAtOf(a2) - createdAtOf(b2);
   });
 }
+function noteObservedEpoch(current, seen) {
+  const n2 = Number(seen);
+  if (!Number.isInteger(n2) || n2 < 0)
+    return current;
+  return n2 > current ? n2 : current;
+}
+function needsPreSendResync(localEpoch, observedEpoch) {
+  if (!Number.isInteger(localEpoch) || !Number.isInteger(observedEpoch)) {
+    return false;
+  }
+  return observedEpoch > localEpoch;
+}
 async function ensureSecureDir(dir) {
   await mkdir(dir, { recursive: true, mode: DIR_MODE });
   try {
@@ -11780,7 +11909,7 @@ async function joinWithFirstMatchingKp(welcomeBytes, candidates) {
   return null;
 }
 function ownIdentity() {
-  const v2 = true ? "0.23.26" : FALLBACK;
+  const v2 = true ? "0.23.27" : FALLBACK;
   return `${PACKAGE}@${v2}`;
 }
 function buildClientVersion2(override) {
@@ -14754,7 +14883,7 @@ function _stringbool(Classes, _params) {
     type: "pipe",
     in: stringSchema,
     out: booleanSchema,
-    transform: (input, payload) => {
+    transform: ((input, payload) => {
       let data = input;
       if (params.case !== "sensitive")
         data = data.toLowerCase();
@@ -14773,14 +14902,14 @@ function _stringbool(Classes, _params) {
         });
         return {};
       }
-    },
-    reverseTransform: (input, _payload) => {
+    }),
+    reverseTransform: ((input, _payload) => {
       if (input === true) {
         return truthyArray[0] || "true";
       } else {
         return falsyArray[0] || "false";
       }
-    },
+    }),
     error: params.error
   });
   return codec2;
@@ -15794,11 +15923,13 @@ function assertCompleteRequestPrompt(request) {
   if (request.params.ref.type !== "ref/prompt") {
     throw new TypeError(`Expected CompleteRequestPrompt, but got ${request.params.ref.type}`);
   }
+  void request;
 }
 function assertCompleteRequestResourceTemplate(request) {
   if (request.params.ref.type !== "ref/resource") {
     throw new TypeError(`Expected CompleteRequestResourceTemplate, but got ${request.params.ref.type}`);
   }
+  void request;
 }
 function isTerminal(status) {
   return status === "completed" || status === "failed" || status === "cancelled";
@@ -17306,7 +17437,7 @@ function reportSkillInvocation(opts) {
   spanBuffer.push(span);
   return span;
 }
-var __create, __defProp2, __getOwnPropDesc, __getOwnPropNames2, __getProtoOf, __hasOwnProp, __esm2, __commonJS, __export2, __copyProps, __toESM, init_mls_commit_classify, __filename, __dirname, url2, path, Module, Module, root, window_, crypto_, randomValuesStandard, crypto4, randomValueNodeJS, _Module, libsodium_sumo_default, init_libsodium_sumo, a, r, t, c, libsodium_wrappers_default, init_libsodium_wrappers, init_keys, init_x3dh, MAX_SKIP, CHAIN_KEY_SEED, MSG_KEY_SEED, HEADER_KEY_SEED, DoubleRatchet, init_ratchet, init_file_crypto, DOMAIN_DID_DOCUMENT, DOMAIN_TRANSFER_INTENT, DOMAIN_TRANSFER_ACCEPT, BASE58_ALPHABET, init_did, BUILTIN_PATTERNS, ScanEngine, init_scan_engine, init_merkle, VC_CONTEXT_V2, AV_CREDENTIAL_CONTEXT, CRYPTOSUITE, BASE58_ALPHABET2, init_vc, init_transport, init_telemetry, TelemetryReporter, init_telemetry_reporter, CROCKFORD, ARGON2_OPSLIMIT, ARGON2_MEMLIMIT, SALT_BYTES, NONCE_BYTES, KEY_BYTES, BACKUP_VERSION, MAX_BACKUP_SIZE, init_backup, init_approval, encVoid, init_tlsEncoder, uint8Encoder, encodeUint8, decodeUint8, uint16Encoder, encodeUint16, decodeUint16, uint32Encoder, encodeUint32, decodeUint32, uint64Encoder, encodeUint64, decodeUint64, init_number, init_tlsDecoder, init_enumHelpers, defaultProposalTypes, defaultProposalTypeEncoder, encodeDefaultProposalType, decodeDefaultProposalType, init_defaultProposalType, defaultExtensionTypes, defaultExtensionTypeEncoder, encodeDefaultExtensionType, decodeDefaultExtensionType, init_defaultExtensionType, acceptAll, init_incomingMessageAction, MlsError, ValidationError, CodecError, UsageError, DependencyError, CryptoVerificationError, CryptoError, InternalError, init_mlsError, init_byteArray, varLenDataEncoder, decodeVarLenData, init_variableLength, init_constantTimeCompare, extensionTypeEncoder, encodeExtensionType, decodeExtensionType, extensionEncoder, encodeExtension, decodeExtension, init_extension, credentialTypes, credentialTypeEncoder, encodeCredentialType, decodeCredentialType, init_credentialType, credentialBasicEncoder, encodeCredentialBasic, credentialX509Encoder, encodeCredentialX509, credentialCustomEncoder, encodeCredentialCustom, credentialEncoder, encodeCredential, decodeCredentialBasic, decodeCredentialX509, decodeCredential, init_credential, externalSenderEncoder, encodeExternalSender, decodeExternalSender, init_externalSender, init_hash, init_optional, ciphersuites, ciphersuiteEncoder, encodeCiphersuite, decodeCiphersuite, ciphersuiteValues, init_ciphersuite, init_signature, protocolVersions, protocolVersionEncoder, encodeProtocolVersion, decodeProtocolVersion, init_protocolVersion, capabilitiesEncoder, encodeCapabilities, decodeCapabilities, init_capabilities, leafNodeSources, leafNodeSourceEncoder, encodeLeafNodeSource, decodeLeafNodeSource, init_leafNodeSource, lifetimeEncoder, encodeLifetime, decodeLifetime, defaultLifetime, init_lifetime, leafNodeDataEncoder, encodeLeafNodeData, decodeLeafNodeData, leafNodeInfoKeyPackageEncoder, encodeLeafNodeInfoKeyPackage, leafNodeInfoUpdateOmittedEncoder, encodeLeafNodeInfoUpdateOmitted, leafNodeInfoCommitOmittedEncoder, encodeLeafNodeInfoCommitOmitted, leafNodeInfoOmittedEncoder, encodeLeafNodeInfoOmitted, decodeLeafNodeInfoKeyPackage, decodeLeafNodeInfoUpdateOmitted, decodeLeafNodeInfoCommitOmitted, decodeLeafNodeInfoOmitted, leafNodeInfoUpdateEncoder, encodeLeafNodeInfoUpdate, leafNodeInfoCommitEncoder, encodeLeafNodeInfoCommit, leafNodeInfoEncoder, encodeLeafNodeInfo, decodeLeafNodeInfoUpdate, decodeLeafNodeInfoCommit, decodeLeafNodeInfo, leafNodeTBSEncoder, encodeLeafNodeTBS, leafNodeEncoder, encodeLeafNode, decodeLeafNode, decodeLeafNodeKeyPackage, decodeLeafNodeCommit, decodeLeafNodeUpdate, init_leafNode, keyPackageTBSEncoder, encodeKeyPackageTBS, decodeKeyPackageTBS, keyPackageEncoder, encodeKeyPackage, decodeKeyPackage, init_keyPackage, init_kdf, pskTypes, pskTypeEncoder, encodePskType, decodePskType, resumptionPSKUsages, resumptionPSKUsageEncoder, encodeResumptionPSKUsage, decodeResumptionPSKUsage, encodePskInfoExternal, encodePskInfoResumption, decodePskInfoResumption, pskInfoEncoder, encodePskInfo, decodePskInfo, pskIdEncoder, encodePskId, decodePskId, pskLabelEncoder, encodePskLabel, decodePskLabel, init_presharedkey, addEncoder, encodeAdd, decodeAdd, updateEncoder, encodeUpdate, decodeUpdate, removeEncoder, encodeRemove, decodeRemove, pskEncoder, encodePSK, decodePSK, reinitEncoder, encodeReinit, decodeReinit, externalInitEncoder, encodeExternalInit, decodeExternalInit, groupContextExtensionsEncoder, encodeGroupContextExtensions, decodeGroupContextExtensions, proposalAddEncoder, encodeProposalAdd, proposalUpdateEncoder, encodeProposalUpdate, proposalRemoveEncoder, encodeProposalRemove, proposalPSKEncoder, encodeProposalPSK, proposalReinitEncoder, encodeProposalReinit, proposalExternalInitEncoder, encodeProposalExternalInit, proposalGroupContextExtensionsEncoder, encodeProposalGroupContextExtensions, proposalCustomEncoder, encodeProposalCustom, proposalEncoder, encodeProposal, decodeProposalAdd, decodeProposalUpdate, decodeProposalRemove, decodeProposalPSK, decodeProposalReinit, decodeProposalExternalInit, decodeProposalGroupContextExtensions, decodeProposal, init_proposal, proposalOrRefTypes, proposalOrRefTypeEncoder, encodeProposalOrRefType, decodeProposalOrRefType, proposalOrRefProposalEncoder, encodeProposalOrRefProposal, proposalOrRefProposalRefEncoder, encodeProposalOrRefProposalRef, proposalOrRefEncoder, encodeProposalOrRef, decodeProposalOrRef, init_proposalOrRefType, init_hpke, groupContextEncoder, encodeGroupContext, decodeGroupContext, init_groupContext, nodeTypes, nodeTypeEncoder, encodeNodeType, decodeNodeType, init_nodeType, parentNodeEncoder, encodeParentNode, decodeParentNode, init_parentNode, init_treemath, nodeEncoder, encodeNode, decodeNode, ratchetTreeEncoder, encodeRatchetTree, decodeRatchetTree, init_ratchetTree, leafNodeHashInputEncoder, encodeLeafNodeHashInput, decodeLeafNodeHashInput, parentNodeHashInputEncoder, encodeParentNodeHashInput, decodeParentNodeHashInput, treeHashInputEncoder, encodeTreeHashInput, decodeTreeHashInput, init_treeHash, parentHashInputEncoder, encodeParentHashInput, decodeParentHashInput, init_parentHash, hpkeCiphertextEncoder, encodeHpkeCiphertext, decodeHpkeCiphertext, init_hpkeCiphertext, updatePathNodeEncoder, encodeUpdatePathNode, decodeUpdatePathNode, updatePathEncoder, encodeUpdatePath, decodeUpdatePath, init_updatePath, commitEncoder, encodeCommit, decodeCommit, init_commit, contentTypes, contentTypeEncoder, encodeContentType, decodeContentType, init_contentType, wireformats, wireformatEncoder, encodeWireformat, decodeWireformat, init_wireformat, senderTypes, senderTypeEncoder, encodeSenderType, decodeSenderType, senderEncoder, encodeSender, decodeSender, reuseGuardEncoder, encodeReuseGuard, decodeReuseGuard, senderDataEncoder, encodeSenderData, decodeSenderData, senderDataAADEncoder, encodeSenderDataAAD, decodeSenderDataAAD, init_sender, framedContentApplicationDataEncoder, encodeFramedContentApplicationData, framedContentProposalDataEncoder, encodeFramedContentProposalData, framedContentCommitDataEncoder, encodeFramedContentCommitData, framedContentInfoEncoder, encodeFramedContentInfo, decodeFramedContentApplicationData, decodeFramedContentProposalData, decodeFramedContentCommitData, decodeFramedContentInfo, framedContentEncoder, encodeFramedContent, decodeFramedContent, senderInfoEncoder, encodeSenderInfo, framedContentTBSEncoder, encodeFramedContentTBS, encodeFramedContentAuthDataContent, encodeFramedContentAuthDataCommit, framedContentAuthDataEncoder, encodeFramedContentAuthData, decodeFramedContentAuthDataCommit, init_framedContent, authenticatedContentEncoder, encodeAuthenticatedContent, decodeAuthenticatedContent, authenticatedContentTBMEncoder, encodeAuthenticatedContentTBM, init_authenticatedContent, publicMessageInfoEncoder, encodePublicMessageInfo, publicMessageEncoder, encodePublicMessage, decodePublicMessage, init_publicMessage, init_messageProtectionPublic, init_externalProposal, requiredCapabilitiesEncoder, encodeRequiredCapabilities, decodeRequiredCapabilities, init_requiredCapabilities, defaultAuthenticationService, init_authenticationService, defaultPaddingConfig, init_paddingConfig, defaultKeyPackageEqualityConfig, init_keyPackageEqualityConfig, defaultLifetimeConfig, init_lifetimeConfig, defaultKeyRetentionConfig, init_keyRetentionConfig, groupInfoTBSEncoder, encodeGroupInfoTBS, decodeGroupInfoTBS, groupInfoEncoder, encodeGroupInfo, decodeGroupInfo, init_groupInfo, keyScheduleEncoder, encodeKeySchedule, decodeKeySchedule, init_keySchedule, generationSecretEncoder, decodeGenerationSecret, secretTreeNodeEncoder, decodeSecretTreeNode, secretTreeEncoder, decodeSecretTree, init_secretTree, confirmedTranscriptHashInputEncoder, encodeConfirmedTranscriptHashInput, decodeConfirmedTranscriptHashInput, init_transcriptHash, groupSecretsEncoder, encodeGroupSecrets, decodeGroupSecrets, init_groupSecrets, encryptedGroupSecretsEncoder, encodeEncryptedGroupSecrets, decodeEncryptedGroupSecrets, welcomeEncoder, encodeWelcome, decodeWelcome, init_welcome, init_pathSecrets, privateKeyPathEncoder, decodePrivateKeyPath, init_privateKeyPath, proposalWithSenderEncoder, decodeProposalWithSender, unappliedProposalsEncoder, decodeUnappliedProposals, init_unappliedProposals, emptyPskIndex, init_pskIndex, init_addToMap, defaultClientConfig, init_clientConfig, init_array, stringEncoder, encodeString, decodeString, init_string, activeEncoder, suspendedPendingReinitEncoder, removedFromGroupEncoder, groupActiveStateEncoder, decodeGroupActiveState, init_groupActiveState, epochReceiverDataEncoder, decodeEpochReceiverData, init_epochReceiverData, groupStateEncoder, encodeGroupState, decodeGroupState, groupStateEncoderWithoutTree, encodeGroupStateWithoutTree, emptyProposals, init_clientState, privateMessageEncoder, encodePrivateMessage, decodePrivateMessage, privateContentAADEncoder, encodePrivateContentAAD, decodePrivateContentAAD, init_privateMessage, init_messageProtection, init_createMessage, init_createCommit, init_processMessages, init_makeHashImpl, HpkeError, InvalidParamError, SerializeError, DeserializeError, EncapError, DecapError, ExportError, SealError, OpenError, MessageLimitReachedError, DeriveKeyPairError, NotSupportedError, init_errors, dntGlobals, dntGlobalThis, init_dnt_shims, NativeAlgorithm, init_algorithm, Mode, KemId, KdfId, AeadId, init_identifiers, INPUT_LENGTH_LIMIT, INFO_LENGTH_LIMIT, MINIMUM_PSK_LENGTH, EMPTY, BYTE_TO_BIGINT_256, init_consts, SUITE_ID_HEADER_KEM, init_kemInterface, HPKE_VERSION, HkdfNative, HkdfSha256Native, HkdfSha384Native, HkdfSha512Native, init_hkdf, isCryptoKeyPair, init_misc, LABEL_EAE_PRK, LABEL_SHARED_SECRET, Dhkem, init_dhkem, KEM_USAGES, LABEL_DKP_PRK, LABEL_SK, init_dhkemPrimitives, Bignum, init_bignum, LABEL_CANDIDATE, ORDER_P_256, ORDER_P_384, ORDER_P_521, PKCS8_ALG_ID_P_256, PKCS8_ALG_ID_P_384, PKCS8_ALG_ID_P_521, EC_P_256_PARAMS, EC_P_384_PARAMS, EC_P_521_PARAMS, Ec, init_ec, init_xCryptoKey, init_xCurve, init_hybridkem, AEAD_USAGES, init_aeadEncryptionContext, _endianTestBuffer, _endianTestBytes, isLE, init_noble, init_hash2, _HMAC, hmac, init_hmac, init_md, U32_MASK64, _32n, init_u64, init_sha2, _0n, _1n, _2n, _7n, _256n, _0x71n, SHA3_PI, SHA3_ROTL, _SHA3_IOTA, IOTAS, SHA3_IOTA_H, SHA3_IOTA_L, init_sha3, init_modular, init_curve, init_montgomery, init_mod, AesGcmContext, Aes128Gcm, Aes256Gcm, init_aesGcm, init_exportOnly, init_emitNotSupported, LABEL_SEC, ExporterContextImpl, RecipientExporterContextImpl, SenderExporterContextImpl, init_exporterContext, EncryptionContextImpl, init_encryptionContext, __classPrivateFieldGet, __classPrivateFieldSet, _Mutex_locked, Mutex, init_mutex, __classPrivateFieldGet2, __classPrivateFieldSet2, _RecipientContextImpl_mutex, RecipientContextImpl, init_recipientContext, __classPrivateFieldGet3, __classPrivateFieldSet3, _SenderContextImpl_mutex, SenderContextImpl, init_senderContext, LABEL_BASE_NONCE, LABEL_EXP, LABEL_INFO_HASH, LABEL_KEY, LABEL_PSK_ID_HASH, LABEL_SECRET, SUITE_ID_HEADER_HPKE, CipherSuiteNative, init_cipherSuiteNative, DhkemP256HkdfSha256Native, DhkemP384HkdfSha384Native, DhkemP521HkdfSha512Native, init_dhkemNative, CipherSuite, DhkemP256HkdfSha256, DhkemP384HkdfSha384, DhkemP521HkdfSha512, HkdfSha256, HkdfSha384, HkdfSha512, init_native, ALG_NAME, PKCS8_ALG_ID_X25519, BASE_POINT_X25519, X25519, init_x25519, DhkemX25519HkdfSha256, init_dhkemX25519, PKCS8_ALG_ID_X448, init_x448, init_dhkemX448, init_mod2, init_hpke2, isLE2, wrapCipher, init_utils, encodeStr, sigma16, sigma32, sigma16_32, sigma32_32, BLOCK_LEN, BLOCK_LEN32, MAX_COUNTER, U32_EMPTY, _XorStreamPRG, createPRG, init_arx, Poly1305, poly1305, init_poly1305, chacha_exports, chacha20orig, chacha20, xchacha20, chacha8, chacha12, ZEROS16, updatePadded, ZEROS32, _poly1305_aead, chacha20poly1305, xchacha20poly1305, rngChacha20, rngChacha8, init_chacha, init_makeAead, init_makeKdfImpl, init_makeDhKem, init_makeHpke, defaultRng, init_rng, crypto2, init_cryptoNode, isLE3, swap32IfBE2, hasHexBuiltin, hexes, asciis, Hash, init_utils2, HashMD2, SHA256_IV2, SHA384_IV2, SHA512_IV2, init_md2, U32_MASK642, _32n2, shrSH2, shrSL2, rotrSH2, rotrSL2, rotrBH2, rotrBL2, rotlSH2, rotlSL2, rotlBH2, rotlBL2, add3L2, add3H2, add4L2, add4H2, add5L2, add5H2, init_u642, SHA256_K, SHA256_W, SHA256, K512, SHA512_Kh, SHA512_Kl, SHA512_W_H, SHA512_W_L, SHA512, SHA384, sha2563, sha5122, sha3842, init_sha22, _0n2, _1n2, isPosBig, bitMask, notImplemented, init_utils3, _0n3, _1n3, _2n2, _3n, _4n, _5n, _7n2, _8n, _9n, _16n, isNegativeLE, FIELD_FIELDS, init_modular2, _0n4, _1n4, pointPrecomputes, pointWindowSizes, wNAF, init_curve2, _0n5, _1n5, _2n3, _8n2, PrimeEdwardsPoint, init_edwards, os2ip, _DST_scalar, init_hash_to_curve, _0n6, _1n6, _2n4, init_montgomery2, ed25519_exports, _0n7, _1n7, _2n5, _3n2, _5n2, _8n3, ed25519_CURVE_p, ed25519_CURVE, ED25519_SQRT_M1, Fp, Fn, ed25519Defaults, ed25519, ed25519ctx, ed25519ph, x25519, ELL2_C1, ELL2_C2, ELL2_C3, ELL2_C1_EDWARDS, ed25519_hasher, SQRT_M1, SQRT_AD_MINUS_ONE, INVSQRT_A_MINUS_D, ONE_MINUS_D_SQ, D_MINUS_ONE_SQ, invertSqrt, MAX_255B, bytes255ToNumberLE, _RistrettoPoint, ristretto255, ristretto255_hasher, ED25519_TORSION_SUBGROUP, edwardsToMontgomery, RistrettoPoint, hashToCurve, encodeToCurve, hashToRistretto255, hash_to_ristretto255, init_ed25519, _0n8, _1n8, _2n6, _7n3, _256n2, _0x71n2, SHA3_PI2, SHA3_ROTL2, _SHA3_IOTA2, IOTAS2, SHA3_IOTA_H2, SHA3_IOTA_L2, rotlH, rotlL, Keccak, genShake, shake2562, init_sha32, ed448_exports, ed448_CURVE, E448_CURVE, shake256_114, shake256_64, _1n9, _2n7, _3n3, _4n2, _11n, _22n, _44n, _88n, _223n, Fp2, Fn2, Fp448, Fn448, ED448_DEF, ed448, ed448ph, E448, x448, ELL2_C12, ELL2_J, ed448_hasher, ONE_MINUS_D, ONE_MINUS_TWO_D, SQRT_MINUS_D, INVSQRT_MINUS_D, invertSqrt2, _DecafPoint, decaf448, decaf448_hasher, ED448_TORSION_SUBGROUP, DecafPoint, hashToCurve2, encodeToCurve2, hashToDecaf448, hash_to_decaf448, edwardsToMontgomery2, init_ed448, HMAC, hmac2, init_hmac2, divNearest, DERErr, DER, _0n9, _1n10, _2n8, _3n4, _4n3, init_weierstrass, init_shortw_utils, nist_exports, p256_CURVE, p384_CURVE, p521_CURVE, Fp256, Fp384, Fp521, p256, p256_hasher, p384, p384_hasher, p521, secp256r1, secp384r1, secp521r1, p521_hasher, init_nist, init_makeNobleSignatureImpl, defaultCryptoProvider, init_provider, init_getCiphersuiteImpl, init_resumption, oidNist2, init_utils4, HashMD3, SHA256_IV3, SHA384_IV3, SHA512_IV3, init_md3, U32_MASK643, _32n3, shrSH3, shrSL3, rotrSH3, rotrSL3, rotrBH3, rotrBL3, add3L3, add3H3, add4L3, add4H3, add5L3, add5H3, init_u643, SHA256_K2, SHA256_W2, SHA2_32B, _SHA256, K5122, SHA512_Kh2, SHA512_Kl2, SHA512_W_H2, SHA512_W_L2, SHA2_64B, _SHA512, _SHA384, sha2564, sha5123, sha3843, init_sha23, _HMAC2, hmac3, init_hmac3, init_makeHashImpl2, init_makeNobleSignatureImpl2, BLOCK_SIZE, ZEROS162, ZEROS322, POLY, mul2, swapLE, estimateWindow, GHASH, Polyval, ghash, polyval, init_polyval, BLOCK_SIZE2, BLOCK_SIZE32, EMPTY_BLOCK, POLY2, sbox, rotr32_8, rotl32_8, tableEncoding, xPowers, gcm, _CMAC, cmac, init_aes, init_makeAead2, init_makeKdfImpl2, init_makeDhKem2, init_makeHpke2, init_rng2, nobleCryptoProvider, init_provider2, mlsPublicMessageEncoder, encodeMlsPublicMessage, mlsWelcomeEncoder, encodeMlsWelcome, mlsPrivateMessageEncoder, encodeMlsPrivateMessage, mlsGroupInfoEncoder, encodeMlsGroupInfo, mlsKeyPackageEncoder, encodeMlsKeyPackage, mlsMessageContentEncoder, encodeMlsMessageContent, decodeMlsMessageContent, mlsMessageEncoder, encodeMlsMessage, decodeMlsMessage, init_message, greaseValues, defaultGreaseConfig, init_grease, init_defaultCapabilities, init_src, DEFAULT_CIPHERSUITE, MLSGroupManager, init_mls_group, DOMAIN, NONCE_BYTES2, init_owner_sync, init_mls_delivery_order, dist_exports2, init_dist2, DIR_MODE, FILE_MODE, init_secure_file, SYNC_LOCK_STALE_MS, pendingKpPath, init_mls_state, init_mls_kp_pool, PACKAGE, FALLBACK, MAX_LEN, DISALLOWED, init_client_version, CredentialStore, init_credential_store, init_crypto_helpers, STATE_FILE, LEGACY_STATE_FILE, init_state, init_transport2, A2ALogGate, init_a2a_log_gate, init_mls_membership_probe, openclaw_compat_exports, defaultImporter, HEARTBEAT_CANDIDATES, AGENT_EVENT_CANDIDATES, TRANSCRIPT_CANDIDATES, _heartbeatFn, _agentEventFn, _transcriptFn, init_openclaw_compat, http_handlers_exports, init_http_handlers, mcp_proxy_helpers_exports, init_mcp_proxy_helpers, workspace_handlers_exports, MAX_FILE_SIZE, init_workspace_handlers, ROOM_AGENT_TYPES, CREDENTIAL_MESSAGE_TYPES, CATCHUP_MESSAGE_TYPES, POLL_INTERVAL_MS, RECONNECT_BASE_MS, RECONNECT_MAX_MS, PENDING_POLL_INTERVAL_MS, OUTBOUND_DEDUPE_WINDOW_MS, OUTBOUND_DEDUPE_MAX_SUPPRESS_MS, OUTBOUND_DEDUPE_MAX, OUTBOUND_DEDUPE_TYPES, RETRY_CANDIDATE_TTL_MS, RETRY_CANDIDATE_MAX, SecureChannel, init_channel, init_types, DEFAULT_API_URL, DEFAULT_HTTP_PORT, init_account_config, init_lifecycle, _ocRuntime, _channels, agentVaultPlugin, init_openclaw_plugin, init_gateway_send, init_llm_response_parser, init_llm_cost, traceStore, init_fetch_interceptor, init_tool_audit, init_harness_compat, isUsingManagedRoutes, init_openclaw_entry, util, objectUtil, ZodParsedType, getParsedType, init_util, ZodIssueCode, ZodError, init_ZodError, errorMap, en_default, init_en, overrideErrorMap, init_errors2, makeIssue, ParseStatus, INVALID, DIRTY, OK, isAborted, isDirty, isValid, isAsync, init_parseUtil, init_typeAliases, errorUtil, init_errorUtil, ParseInputLazyPath, handleResult, ZodType, cuidRegex, cuid2Regex, ulidRegex, uuidRegex, nanoidRegex, jwtRegex, durationRegex, emailRegex, _emojiRegex, emojiRegex, ipv4Regex, ipv4CidrRegex, ipv6Regex, ipv6CidrRegex, base64Regex, base64urlRegex, dateRegexSource, dateRegex, ZodString, ZodNumber, ZodBigInt, ZodBoolean, ZodDate, ZodSymbol, ZodUndefined, ZodNull, ZodAny, ZodUnknown, ZodNever, ZodVoid, ZodArray, ZodObject, ZodUnion, getDiscriminator, ZodDiscriminatedUnion, ZodIntersection, ZodTuple, ZodRecord, ZodMap, ZodSet, ZodFunction, ZodLazy, ZodLiteral, ZodEnum, ZodNativeEnum, ZodPromise, ZodEffects, ZodOptional, ZodNullable, ZodDefault, ZodCatch, ZodNaN, ZodBranded, ZodPipeline, ZodReadonly, late, ZodFirstPartyTypeKind, stringType, numberType, nanType, bigIntType, booleanType, dateType, symbolType, undefinedType, nullType, anyType, unknownType, neverType, voidType, arrayType, objectType, strictObjectType, unionType, discriminatedUnionType, intersectionType, tupleType, recordType, mapType, setType, functionType, lazyType, literalType, enumType, nativeEnumType, promiseType, effectsType, optionalType, nullableType, preprocessType, pipelineType, init_types2, init_external, init_v3, NEVER, $ZodAsyncError, $ZodEncodeError, globalConfig, init_core, util_exports, EVALUATING, captureStackTrace, allowsEval, getParsedType2, propertyKeyTypes, primitiveTypes, NUMBER_FORMAT_RANGES, BIGINT_FORMAT_RANGES, Class, init_util2, initializer, $ZodError, $ZodRealError, init_errors3, _parse, parse, _parseAsync, parseAsync, _safeParse, safeParse, _safeParseAsync, safeParseAsync, _encode, _decode, _encodeAsync, _decodeAsync, _safeEncode, _safeDecode, _safeEncodeAsync, _safeDecodeAsync, init_parse, regexes_exports, cuid, cuid2, ulid, xid, ksuid, nanoid, duration, extendedDuration, guid, uuid, uuid4, uuid6, uuid7, email, html5Email, rfc5322Email, unicodeEmail, idnEmail, browserEmail, _emoji, ipv4, ipv6, mac, cidrv4, cidrv6, base64, base64url, hostname, domain, e164, dateSource, date, string, bigint, integer, number, boolean, _null, _undefined, lowercase, uppercase, hex, md5_hex, md5_base64, md5_base64url, sha1_hex, sha1_base64, sha1_base64url, sha256_hex, sha256_base64, sha256_base64url, sha384_hex, sha384_base64, sha384_base64url, sha512_hex, sha512_base64, sha512_base64url, init_regexes, $ZodCheck, numericOriginMap, $ZodCheckLessThan, $ZodCheckGreaterThan, $ZodCheckMultipleOf, $ZodCheckNumberFormat, $ZodCheckBigIntFormat, $ZodCheckMaxSize, $ZodCheckMinSize, $ZodCheckSizeEquals, $ZodCheckMaxLength, $ZodCheckMinLength, $ZodCheckLengthEquals, $ZodCheckStringFormat, $ZodCheckRegex, $ZodCheckLowerCase, $ZodCheckUpperCase, $ZodCheckIncludes, $ZodCheckStartsWith, $ZodCheckEndsWith, $ZodCheckProperty, $ZodCheckMimeType, $ZodCheckOverwrite, init_checks, Doc, init_doc, version, init_versions, $ZodType, $ZodString, $ZodStringFormat, $ZodGUID, $ZodUUID, $ZodEmail, $ZodURL, $ZodEmoji, $ZodNanoID, $ZodCUID, $ZodCUID2, $ZodULID, $ZodXID, $ZodKSUID, $ZodISODateTime, $ZodISODate, $ZodISOTime, $ZodISODuration, $ZodIPv4, $ZodIPv6, $ZodMAC, $ZodCIDRv4, $ZodCIDRv6, $ZodBase64, $ZodBase64URL, $ZodE164, $ZodJWT, $ZodCustomStringFormat, $ZodNumber, $ZodNumberFormat, $ZodBoolean, $ZodBigInt, $ZodBigIntFormat, $ZodSymbol, $ZodUndefined, $ZodNull, $ZodAny, $ZodUnknown, $ZodNever, $ZodVoid, $ZodDate, $ZodArray, $ZodObject, $ZodObjectJIT, $ZodUnion, $ZodXor, $ZodDiscriminatedUnion, $ZodIntersection, $ZodTuple, $ZodRecord, $ZodMap, $ZodSet, $ZodEnum, $ZodLiteral, $ZodFile, $ZodTransform, $ZodOptional, $ZodExactOptional, $ZodNullable, $ZodDefault, $ZodPrefault, $ZodNonOptional, $ZodSuccess, $ZodCatch, $ZodNaN, $ZodPipe, $ZodCodec, $ZodReadonly, $ZodTemplateLiteral, $ZodFunction, $ZodPromise, $ZodLazy, $ZodCustom, init_schemas, init_ar, init_az, init_be, init_bg, init_ca, init_cs, init_da, init_de, error, init_en2, init_eo, init_es, init_fa, init_fi, init_fr, init_fr_CA, init_he, init_hu, init_hy, init_id, init_is, init_it, init_ja, init_ka, init_km, init_kh, init_ko, init_lt, init_mk, init_ms, init_nl, init_no, init_ota, init_ps, init_pl, init_pt, init_ru, init_sl, init_sv, init_ta, init_th, init_tr, init_uk, init_ua, init_ur, init_uz, init_vi, init_zh_CN, init_zh_TW, init_yo, init_locales, _a2, $ZodRegistry, globalRegistry, init_registries, init_api, createToJSONSchemaMethod, createStandardJSONSchemaMethod, init_to_json_schema, formatMap, stringProcessor, numberProcessor, booleanProcessor, bigintProcessor, symbolProcessor, nullProcessor, undefinedProcessor, voidProcessor, neverProcessor, anyProcessor, unknownProcessor, dateProcessor, enumProcessor, literalProcessor, nanProcessor, templateLiteralProcessor, fileProcessor, successProcessor, customProcessor, functionProcessor, transformProcessor, mapProcessor, setProcessor, arrayProcessor, objectProcessor, unionProcessor, intersectionProcessor, tupleProcessor, recordProcessor, nullableProcessor, nonoptionalProcessor, defaultProcessor, prefaultProcessor, catchProcessor, pipeProcessor, readonlyProcessor, promiseProcessor, optionalProcessor, lazyProcessor, allProcessors, init_json_schema_processors, init_json_schema_generator, init_json_schema, init_core2, init_parse2, ZodMiniType, ZodMiniObject, init_schemas2, init_checks2, init_iso, init_coerce, init_external2, init_v4_mini, init_zod_compat, checks_exports2, init_checks3, iso_exports2, ZodISODateTime, ZodISODate, ZodISOTime, ZodISODuration, init_iso2, initializer2, ZodError2, ZodRealError, init_errors4, parse2, parseAsync2, safeParse3, safeParseAsync3, encode3, decode2, encodeAsync2, decodeAsync2, safeEncode2, safeDecode2, safeEncodeAsync2, safeDecodeAsync2, init_parse3, schemas_exports3, ZodType2, _ZodString, ZodString2, ZodStringFormat, ZodEmail, ZodGUID, ZodUUID, ZodURL, ZodEmoji, ZodNanoID, ZodCUID, ZodCUID2, ZodULID, ZodXID, ZodKSUID, ZodIPv4, ZodMAC, ZodIPv6, ZodCIDRv4, ZodCIDRv6, ZodBase64, ZodBase64URL, ZodE164, ZodJWT, ZodCustomStringFormat, ZodNumber2, ZodNumberFormat, ZodBoolean2, ZodBigInt2, ZodBigIntFormat, ZodSymbol2, ZodUndefined2, ZodNull2, ZodAny2, ZodUnknown2, ZodNever2, ZodVoid2, ZodDate2, ZodArray2, ZodObject2, ZodUnion2, ZodXor, ZodDiscriminatedUnion2, ZodIntersection2, ZodTuple2, ZodRecord2, ZodMap2, ZodSet2, ZodEnum2, ZodLiteral2, ZodFile, ZodTransform, ZodOptional2, ZodExactOptional, ZodNullable2, ZodDefault2, ZodPrefault, ZodNonOptional, ZodSuccess, ZodCatch2, ZodNaN2, ZodPipe, ZodCodec, ZodReadonly2, ZodTemplateLiteral, ZodLazy2, ZodPromise2, ZodFunction2, ZodCustom, describe2, meta2, stringbool, init_schemas3, ZodFirstPartyTypeKind2, init_compat, z2, init_from_json_schema, init_coerce2, init_external3, init_classic, init_v4, LATEST_PROTOCOL_VERSION, DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, RELATED_TASK_META_KEY, JSONRPC_VERSION, AssertObjectSchema, ProgressTokenSchema, CursorSchema, TaskCreationParamsSchema, TaskMetadataSchema, RelatedTaskMetadataSchema, RequestMetaSchema, BaseRequestParamsSchema, TaskAugmentedRequestParamsSchema, isTaskAugmentedRequestParams, RequestSchema, NotificationsParamsSchema, NotificationSchema, ResultSchema, RequestIdSchema, JSONRPCRequestSchema, isJSONRPCRequest, JSONRPCNotificationSchema, isJSONRPCNotification, JSONRPCResultResponseSchema, isJSONRPCResultResponse, ErrorCode, JSONRPCErrorResponseSchema, isJSONRPCErrorResponse, JSONRPCMessageSchema, JSONRPCResponseSchema, EmptyResultSchema, CancelledNotificationParamsSchema, CancelledNotificationSchema, IconSchema, IconsSchema, BaseMetadataSchema, ImplementationSchema, FormElicitationCapabilitySchema, ElicitationCapabilitySchema, ClientTasksCapabilitySchema, ServerTasksCapabilitySchema, ClientCapabilitiesSchema, InitializeRequestParamsSchema, InitializeRequestSchema, isInitializeRequest, ServerCapabilitiesSchema, InitializeResultSchema, InitializedNotificationSchema, PingRequestSchema, ProgressSchema, ProgressNotificationParamsSchema, ProgressNotificationSchema, PaginatedRequestParamsSchema, PaginatedRequestSchema, PaginatedResultSchema, TaskStatusSchema, TaskSchema, CreateTaskResultSchema, TaskStatusNotificationParamsSchema, TaskStatusNotificationSchema, GetTaskRequestSchema, GetTaskResultSchema, GetTaskPayloadRequestSchema, GetTaskPayloadResultSchema, ListTasksRequestSchema, ListTasksResultSchema, CancelTaskRequestSchema, CancelTaskResultSchema, ResourceContentsSchema, TextResourceContentsSchema, Base64Schema, BlobResourceContentsSchema, RoleSchema, AnnotationsSchema, ResourceSchema, ResourceTemplateSchema, ListResourcesRequestSchema, ListResourcesResultSchema, ListResourceTemplatesRequestSchema, ListResourceTemplatesResultSchema, ResourceRequestParamsSchema, ReadResourceRequestParamsSchema, ReadResourceRequestSchema, ReadResourceResultSchema, ResourceListChangedNotificationSchema, SubscribeRequestParamsSchema, SubscribeRequestSchema, UnsubscribeRequestParamsSchema, UnsubscribeRequestSchema, ResourceUpdatedNotificationParamsSchema, ResourceUpdatedNotificationSchema, PromptArgumentSchema, PromptSchema, ListPromptsRequestSchema, ListPromptsResultSchema, GetPromptRequestParamsSchema, GetPromptRequestSchema, TextContentSchema, ImageContentSchema, AudioContentSchema, ToolUseContentSchema, EmbeddedResourceSchema, ResourceLinkSchema, ContentBlockSchema, PromptMessageSchema, GetPromptResultSchema, PromptListChangedNotificationSchema, ToolAnnotationsSchema, ToolExecutionSchema, ToolSchema, ListToolsRequestSchema, ListToolsResultSchema, CallToolResultSchema, CompatibilityCallToolResultSchema, CallToolRequestParamsSchema, CallToolRequestSchema, ToolListChangedNotificationSchema, ListChangedOptionsBaseSchema, LoggingLevelSchema, SetLevelRequestParamsSchema, SetLevelRequestSchema, LoggingMessageNotificationParamsSchema, LoggingMessageNotificationSchema, ModelHintSchema, ModelPreferencesSchema, ToolChoiceSchema, ToolResultContentSchema, SamplingContentSchema, SamplingMessageContentBlockSchema, SamplingMessageSchema, CreateMessageRequestParamsSchema, CreateMessageRequestSchema, CreateMessageResultSchema, CreateMessageResultWithToolsSchema, BooleanSchemaSchema, StringSchemaSchema, NumberSchemaSchema, UntitledSingleSelectEnumSchemaSchema, TitledSingleSelectEnumSchemaSchema, LegacyTitledEnumSchemaSchema, SingleSelectEnumSchemaSchema, UntitledMultiSelectEnumSchemaSchema, TitledMultiSelectEnumSchemaSchema, MultiSelectEnumSchemaSchema, EnumSchemaSchema, PrimitiveSchemaDefinitionSchema, ElicitRequestFormParamsSchema, ElicitRequestURLParamsSchema, ElicitRequestParamsSchema, ElicitRequestSchema, ElicitationCompleteNotificationParamsSchema, ElicitationCompleteNotificationSchema, ElicitResultSchema, ResourceTemplateReferenceSchema, PromptReferenceSchema, CompleteRequestParamsSchema, CompleteRequestSchema, CompleteResultSchema, RootSchema, ListRootsRequestSchema, ListRootsResultSchema, RootsListChangedNotificationSchema, ClientRequestSchema, ClientNotificationSchema, ClientResultSchema, ServerRequestSchema, ServerNotificationSchema, ServerResultSchema, McpError, UrlElicitationRequiredError, init_types3, init_interfaces, ignoreOverride, defaultOptions, getDefaultOptions, init_Options, getRefs, init_Refs, init_errorMessages, getRelativePath, init_getRelativePath, init_any, init_array2, init_bigint, init_boolean, init_branded, parseCatchDef, init_catch, integerDateParser, init_date, init_default, init_effects, init_enum, isJsonSchema7AllOfType, init_intersection, init_literal, emojiRegex2, zodPatterns, ALPHA_NUMERIC, init_string2, init_record, init_map, init_nativeEnum, init_never, init_null, primitiveMappings, asAnyOf, init_union, init_nullable, init_number2, init_object, parseOptionalDef, init_optional2, parsePipelineDef, init_pipeline, init_promise, init_set, init_tuple, init_undefined, init_unknown, parseReadonlyDef, init_readonly, selectParser, init_selectParser, get$ref, addMeta, init_parseDef, init_parseTypes, zodToJsonSchema, init_zodToJsonSchema, init_esm, init_zod_json_schema_compat, DEFAULT_REQUEST_TIMEOUT_MSEC, Protocol, init_protocol, require_code, require_scope, require_codegen, require_util, require_names, require_errors, require_boolSchema, require_rules, require_applicability, require_dataType, require_defaults, require_code2, require_keyword, require_subschema, require_fast_deep_equal, require_json_schema_traverse, require_resolve, require_validate, require_validation_error, require_ref_error, require_compile, require_data, require_utils, require_schemes, require_fast_uri, require_uri, require_core, require_id, require_ref, require_core2, require_limitNumber, require_multipleOf, require_ucs2length, require_limitLength, require_pattern, require_limitProperties, require_required, require_limitItems, require_equal, require_uniqueItems, require_const, require_enum, require_validation, require_additionalItems, require_items, require_prefixItems, require_items2020, require_contains, require_dependencies, require_propertyNames, require_additionalProperties, require_properties, require_patternProperties, require_not, require_anyOf, require_oneOf, require_allOf, require_if, require_thenElse, require_applicator, require_format, require_format2, require_metadata, require_draft7, require_types, require_discriminator, require_json_schema_draft_07, require_ajv, require_formats, require_limit, require_dist, import_ajv, import_ajv_formats, AjvJsonSchemaValidator, init_ajv_provider, ExperimentalServerTasks, init_server, init_helpers, Server, init_server2, COMPLETABLE_SYMBOL, McpZodTypeKind, init_completable, init_uriTemplate, TOOL_NAME_REGEX, init_toolNameValidation, ExperimentalMcpServerTasks, init_mcp_server, init_zod, McpServer, EMPTY_OBJECT_JSON_SCHEMA, EMPTY_COMPLETION_RESULT, init_mcp, RequestError, toRequestError, GlobalRequest, Request2, newHeadersFromIncoming, wrapBodyStream, newRequestFromIncoming, getRequestCache, requestCache, incomingKey, urlKey, headersKey, abortControllerKey, getAbortController, requestPrototype, newRequest, responseCache, getResponseCache, cacheKey, GlobalResponse, Response2, buildOutgoingHttpHeaders, X_ALREADY_SENT, outgoingEnded, handleRequestError, handleFetchError, handleResponseError, flushHeaders, responseViaCache, isPromise, responseViaResponseObject, getRequestListener, init_dist22, WebStandardStreamableHTTPServerTransport, init_webStandardStreamableHttp, StreamableHTTPServerTransport, init_streamableHttp, AgentVaultMcpServer, init_mcp_server2, init_mcp_handlers, init_skill_manifest, init_skill_invoker, spanBuffer, init_skill_telemetry, PolicyEnforcer, init_policy_enforcer, VERSION, init_index;
+var __create, __defProp2, __getOwnPropDesc, __getOwnPropNames2, __getProtoOf, __hasOwnProp, __esm2, __commonJS, __export2, __copyProps, __toESM, init_mls_commit_classify, __filename, __dirname, url2, path, Module, Module, root, window_, crypto_, randomValuesStandard, crypto4, randomValueNodeJS, _Module, libsodium_sumo_default, init_libsodium_sumo, a, r, t, c, libsodium_wrappers_default, init_libsodium_wrappers, init_keys, init_x3dh, MAX_SKIP, CHAIN_KEY_SEED, MSG_KEY_SEED, HEADER_KEY_SEED, DoubleRatchet, init_ratchet, init_file_crypto, DOMAIN_DID_DOCUMENT, DOMAIN_TRANSFER_INTENT, DOMAIN_TRANSFER_ACCEPT, BASE58_ALPHABET, init_did, BUILTIN_PATTERNS, ScanEngine, init_scan_engine, init_merkle, VC_CONTEXT_V2, AV_CREDENTIAL_CONTEXT, CRYPTOSUITE, BASE58_ALPHABET2, init_vc, init_transport, init_telemetry, TelemetryReporter, init_telemetry_reporter, CROCKFORD, ARGON2_OPSLIMIT, ARGON2_MEMLIMIT, SALT_BYTES, NONCE_BYTES, KEY_BYTES, BACKUP_VERSION, MAX_BACKUP_SIZE, init_backup, init_approval, encVoid, init_tlsEncoder, uint8Encoder, encodeUint8, decodeUint8, uint16Encoder, encodeUint16, decodeUint16, uint32Encoder, encodeUint32, decodeUint32, uint64Encoder, encodeUint64, decodeUint64, init_number, init_tlsDecoder, init_enumHelpers, defaultProposalTypes, defaultProposalTypeEncoder, encodeDefaultProposalType, decodeDefaultProposalType, init_defaultProposalType, defaultExtensionTypes, defaultExtensionTypeEncoder, encodeDefaultExtensionType, decodeDefaultExtensionType, init_defaultExtensionType, acceptAll, init_incomingMessageAction, MlsError, ValidationError, CodecError, UsageError, DependencyError, CryptoVerificationError, CryptoError, InternalError, init_mlsError, init_byteArray, varLenDataEncoder, decodeVarLenData, init_variableLength, init_constantTimeCompare, extensionTypeEncoder, encodeExtensionType, decodeExtensionType, extensionEncoder, encodeExtension, decodeExtension, init_extension, credentialTypes, credentialTypeEncoder, encodeCredentialType, decodeCredentialType, init_credentialType, credentialBasicEncoder, encodeCredentialBasic, credentialX509Encoder, encodeCredentialX509, credentialCustomEncoder, encodeCredentialCustom, credentialEncoder, encodeCredential, decodeCredentialBasic, decodeCredentialX509, decodeCredential, init_credential, externalSenderEncoder, encodeExternalSender, decodeExternalSender, init_externalSender, init_hash, init_optional, ciphersuites, ciphersuiteEncoder, encodeCiphersuite, decodeCiphersuite, ciphersuiteValues, init_ciphersuite, init_signature, protocolVersions, protocolVersionEncoder, encodeProtocolVersion, decodeProtocolVersion, init_protocolVersion, capabilitiesEncoder, encodeCapabilities, decodeCapabilities, init_capabilities, leafNodeSources, leafNodeSourceEncoder, encodeLeafNodeSource, decodeLeafNodeSource, init_leafNodeSource, lifetimeEncoder, encodeLifetime, decodeLifetime, defaultLifetime, init_lifetime, leafNodeDataEncoder, encodeLeafNodeData, decodeLeafNodeData, leafNodeInfoKeyPackageEncoder, encodeLeafNodeInfoKeyPackage, leafNodeInfoUpdateOmittedEncoder, encodeLeafNodeInfoUpdateOmitted, leafNodeInfoCommitOmittedEncoder, encodeLeafNodeInfoCommitOmitted, leafNodeInfoOmittedEncoder, encodeLeafNodeInfoOmitted, decodeLeafNodeInfoKeyPackage, decodeLeafNodeInfoUpdateOmitted, decodeLeafNodeInfoCommitOmitted, decodeLeafNodeInfoOmitted, leafNodeInfoUpdateEncoder, encodeLeafNodeInfoUpdate, leafNodeInfoCommitEncoder, encodeLeafNodeInfoCommit, leafNodeInfoEncoder, encodeLeafNodeInfo, decodeLeafNodeInfoUpdate, decodeLeafNodeInfoCommit, decodeLeafNodeInfo, leafNodeTBSEncoder, encodeLeafNodeTBS, leafNodeEncoder, encodeLeafNode, decodeLeafNode, decodeLeafNodeKeyPackage, decodeLeafNodeCommit, decodeLeafNodeUpdate, init_leafNode, keyPackageTBSEncoder, encodeKeyPackageTBS, decodeKeyPackageTBS, keyPackageEncoder, encodeKeyPackage, decodeKeyPackage, init_keyPackage, init_kdf, pskTypes, pskTypeEncoder, encodePskType, decodePskType, resumptionPSKUsages, resumptionPSKUsageEncoder, encodeResumptionPSKUsage, decodeResumptionPSKUsage, encodePskInfoExternal, encodePskInfoResumption, decodePskInfoResumption, pskInfoEncoder, encodePskInfo, decodePskInfo, pskIdEncoder, encodePskId, decodePskId, pskLabelEncoder, encodePskLabel, decodePskLabel, init_presharedkey, addEncoder, encodeAdd, decodeAdd, updateEncoder, encodeUpdate, decodeUpdate, removeEncoder, encodeRemove, decodeRemove, pskEncoder, encodePSK, decodePSK, reinitEncoder, encodeReinit, decodeReinit, externalInitEncoder, encodeExternalInit, decodeExternalInit, groupContextExtensionsEncoder, encodeGroupContextExtensions, decodeGroupContextExtensions, proposalAddEncoder, encodeProposalAdd, proposalUpdateEncoder, encodeProposalUpdate, proposalRemoveEncoder, encodeProposalRemove, proposalPSKEncoder, encodeProposalPSK, proposalReinitEncoder, encodeProposalReinit, proposalExternalInitEncoder, encodeProposalExternalInit, proposalGroupContextExtensionsEncoder, encodeProposalGroupContextExtensions, proposalCustomEncoder, encodeProposalCustom, proposalEncoder, encodeProposal, decodeProposalAdd, decodeProposalUpdate, decodeProposalRemove, decodeProposalPSK, decodeProposalReinit, decodeProposalExternalInit, decodeProposalGroupContextExtensions, decodeProposal, init_proposal, proposalOrRefTypes, proposalOrRefTypeEncoder, encodeProposalOrRefType, decodeProposalOrRefType, proposalOrRefProposalEncoder, encodeProposalOrRefProposal, proposalOrRefProposalRefEncoder, encodeProposalOrRefProposalRef, proposalOrRefEncoder, encodeProposalOrRef, decodeProposalOrRef, init_proposalOrRefType, init_hpke, groupContextEncoder, encodeGroupContext, decodeGroupContext, init_groupContext, nodeTypes, nodeTypeEncoder, encodeNodeType, decodeNodeType, init_nodeType, parentNodeEncoder, encodeParentNode, decodeParentNode, init_parentNode, init_treemath, nodeEncoder, encodeNode, decodeNode, ratchetTreeEncoder, encodeRatchetTree, decodeRatchetTree, init_ratchetTree, leafNodeHashInputEncoder, encodeLeafNodeHashInput, decodeLeafNodeHashInput, parentNodeHashInputEncoder, encodeParentNodeHashInput, decodeParentNodeHashInput, treeHashInputEncoder, encodeTreeHashInput, decodeTreeHashInput, init_treeHash, parentHashInputEncoder, encodeParentHashInput, decodeParentHashInput, init_parentHash, hpkeCiphertextEncoder, encodeHpkeCiphertext, decodeHpkeCiphertext, init_hpkeCiphertext, updatePathNodeEncoder, encodeUpdatePathNode, decodeUpdatePathNode, updatePathEncoder, encodeUpdatePath, decodeUpdatePath, init_updatePath, commitEncoder, encodeCommit, decodeCommit, init_commit, contentTypes, contentTypeEncoder, encodeContentType, decodeContentType, init_contentType, wireformats, wireformatEncoder, encodeWireformat, decodeWireformat, init_wireformat, senderTypes, senderTypeEncoder, encodeSenderType, decodeSenderType, senderEncoder, encodeSender, decodeSender, reuseGuardEncoder, encodeReuseGuard, decodeReuseGuard, senderDataEncoder, encodeSenderData, decodeSenderData, senderDataAADEncoder, encodeSenderDataAAD, decodeSenderDataAAD, init_sender, framedContentApplicationDataEncoder, encodeFramedContentApplicationData, framedContentProposalDataEncoder, encodeFramedContentProposalData, framedContentCommitDataEncoder, encodeFramedContentCommitData, framedContentInfoEncoder, encodeFramedContentInfo, decodeFramedContentApplicationData, decodeFramedContentProposalData, decodeFramedContentCommitData, decodeFramedContentInfo, framedContentEncoder, encodeFramedContent, decodeFramedContent, senderInfoEncoder, encodeSenderInfo, framedContentTBSEncoder, encodeFramedContentTBS, encodeFramedContentAuthDataContent, encodeFramedContentAuthDataCommit, framedContentAuthDataEncoder, encodeFramedContentAuthData, decodeFramedContentAuthDataCommit, init_framedContent, authenticatedContentEncoder, encodeAuthenticatedContent, decodeAuthenticatedContent, authenticatedContentTBMEncoder, encodeAuthenticatedContentTBM, init_authenticatedContent, publicMessageInfoEncoder, encodePublicMessageInfo, publicMessageEncoder, encodePublicMessage, decodePublicMessage, init_publicMessage, init_messageProtectionPublic, init_externalProposal, requiredCapabilitiesEncoder, encodeRequiredCapabilities, decodeRequiredCapabilities, init_requiredCapabilities, defaultAuthenticationService, init_authenticationService, defaultPaddingConfig, init_paddingConfig, defaultKeyPackageEqualityConfig, init_keyPackageEqualityConfig, defaultLifetimeConfig, init_lifetimeConfig, defaultKeyRetentionConfig, init_keyRetentionConfig, groupInfoTBSEncoder, encodeGroupInfoTBS, decodeGroupInfoTBS, groupInfoEncoder, encodeGroupInfo, decodeGroupInfo, init_groupInfo, keyScheduleEncoder, encodeKeySchedule, decodeKeySchedule, init_keySchedule, generationSecretEncoder, decodeGenerationSecret, secretTreeNodeEncoder, decodeSecretTreeNode, secretTreeEncoder, decodeSecretTree, init_secretTree, confirmedTranscriptHashInputEncoder, encodeConfirmedTranscriptHashInput, decodeConfirmedTranscriptHashInput, init_transcriptHash, groupSecretsEncoder, encodeGroupSecrets, decodeGroupSecrets, init_groupSecrets, encryptedGroupSecretsEncoder, encodeEncryptedGroupSecrets, decodeEncryptedGroupSecrets, welcomeEncoder, encodeWelcome, decodeWelcome, init_welcome, init_pathSecrets, privateKeyPathEncoder, decodePrivateKeyPath, init_privateKeyPath, proposalWithSenderEncoder, decodeProposalWithSender, unappliedProposalsEncoder, decodeUnappliedProposals, init_unappliedProposals, emptyPskIndex, init_pskIndex, init_addToMap, defaultClientConfig, init_clientConfig, init_array, stringEncoder, encodeString, decodeString, init_string, activeEncoder, suspendedPendingReinitEncoder, removedFromGroupEncoder, groupActiveStateEncoder, decodeGroupActiveState, init_groupActiveState, epochReceiverDataEncoder, decodeEpochReceiverData, init_epochReceiverData, groupStateEncoder, encodeGroupState, decodeGroupState, groupStateEncoderWithoutTree, encodeGroupStateWithoutTree, emptyProposals, init_clientState, privateMessageEncoder, encodePrivateMessage, decodePrivateMessage, privateContentAADEncoder, encodePrivateContentAAD, decodePrivateContentAAD, init_privateMessage, init_messageProtection, init_createMessage, init_createCommit, init_processMessages, init_makeHashImpl, HpkeError, InvalidParamError, SerializeError, DeserializeError, EncapError, DecapError, ExportError, SealError, OpenError, MessageLimitReachedError, DeriveKeyPairError, NotSupportedError, init_errors, dntGlobals, dntGlobalThis, init_dnt_shims, NativeAlgorithm, init_algorithm, Mode, KemId, KdfId, AeadId, init_identifiers, INPUT_LENGTH_LIMIT, INFO_LENGTH_LIMIT, MINIMUM_PSK_LENGTH, EMPTY, BYTE_TO_BIGINT_256, init_consts, SUITE_ID_HEADER_KEM, init_kemInterface, HPKE_VERSION, HkdfNative, HkdfSha256Native, HkdfSha384Native, HkdfSha512Native, init_hkdf, isCryptoKeyPair, init_misc, LABEL_EAE_PRK, LABEL_SHARED_SECRET, Dhkem, init_dhkem, KEM_USAGES, LABEL_DKP_PRK, LABEL_SK, init_dhkemPrimitives, Bignum, init_bignum, LABEL_CANDIDATE, ORDER_P_256, ORDER_P_384, ORDER_P_521, PKCS8_ALG_ID_P_256, PKCS8_ALG_ID_P_384, PKCS8_ALG_ID_P_521, EC_P_256_PARAMS, EC_P_384_PARAMS, EC_P_521_PARAMS, Ec, init_ec, init_xCryptoKey, init_xCurve, init_hybridkem, AEAD_USAGES, init_aeadEncryptionContext, _endianTestBuffer, _endianTestBytes, isLE, init_noble, init_hash2, _HMAC, hmac, init_hmac, init_md, U32_MASK64, _32n, init_u64, init_sha2, _0n, _1n, _2n, _7n, _256n, _0x71n, SHA3_PI, SHA3_ROTL, _SHA3_IOTA, IOTAS, SHA3_IOTA_H, SHA3_IOTA_L, init_sha3, init_modular, init_curve, init_montgomery, init_mod, AesGcmContext, Aes128Gcm, Aes256Gcm, init_aesGcm, init_exportOnly, init_emitNotSupported, LABEL_SEC, ExporterContextImpl, RecipientExporterContextImpl, SenderExporterContextImpl, init_exporterContext, EncryptionContextImpl, init_encryptionContext, __classPrivateFieldGet, __classPrivateFieldSet, _Mutex_locked, Mutex, init_mutex, __classPrivateFieldGet2, __classPrivateFieldSet2, _RecipientContextImpl_mutex, RecipientContextImpl, init_recipientContext, __classPrivateFieldGet3, __classPrivateFieldSet3, _SenderContextImpl_mutex, SenderContextImpl, init_senderContext, LABEL_BASE_NONCE, LABEL_EXP, LABEL_INFO_HASH, LABEL_KEY, LABEL_PSK_ID_HASH, LABEL_SECRET, SUITE_ID_HEADER_HPKE, CipherSuiteNative, init_cipherSuiteNative, DhkemP256HkdfSha256Native, DhkemP384HkdfSha384Native, DhkemP521HkdfSha512Native, init_dhkemNative, CipherSuite, DhkemP256HkdfSha256, DhkemP384HkdfSha384, DhkemP521HkdfSha512, HkdfSha256, HkdfSha384, HkdfSha512, init_native, ALG_NAME, PKCS8_ALG_ID_X25519, BASE_POINT_X25519, X25519, init_x25519, DhkemX25519HkdfSha256, init_dhkemX25519, PKCS8_ALG_ID_X448, init_x448, init_dhkemX448, init_mod2, init_hpke2, isLE2, wrapCipher, init_utils, encodeStr, sigma16, sigma32, sigma16_32, sigma32_32, BLOCK_LEN, BLOCK_LEN32, MAX_COUNTER, U32_EMPTY, _XorStreamPRG, createPRG, init_arx, Poly1305, poly1305, init_poly1305, chacha_exports, chacha20orig, chacha20, xchacha20, chacha8, chacha12, ZEROS16, updatePadded, ZEROS32, _poly1305_aead, chacha20poly1305, xchacha20poly1305, rngChacha20, rngChacha8, init_chacha, init_makeAead, init_makeKdfImpl, init_makeDhKem, init_makeHpke, defaultRng, init_rng, crypto2, init_cryptoNode, isLE3, swap32IfBE2, hasHexBuiltin, hexes, asciis, Hash, init_utils2, HashMD2, SHA256_IV2, SHA384_IV2, SHA512_IV2, init_md2, U32_MASK642, _32n2, shrSH2, shrSL2, rotrSH2, rotrSL2, rotrBH2, rotrBL2, rotlSH2, rotlSL2, rotlBH2, rotlBL2, add3L2, add3H2, add4L2, add4H2, add5L2, add5H2, init_u642, SHA256_K, SHA256_W, SHA256, K512, SHA512_Kh, SHA512_Kl, SHA512_W_H, SHA512_W_L, SHA512, SHA384, sha2563, sha5122, sha3842, init_sha22, _0n2, _1n2, isPosBig, bitMask, notImplemented, init_utils3, _0n3, _1n3, _2n2, _3n, _4n, _5n, _7n2, _8n, _9n, _16n, isNegativeLE, FIELD_FIELDS, init_modular2, _0n4, _1n4, pointPrecomputes, pointWindowSizes, wNAF, init_curve2, _0n5, _1n5, _2n3, _8n2, PrimeEdwardsPoint, init_edwards, os2ip, _DST_scalar, init_hash_to_curve, _0n6, _1n6, _2n4, init_montgomery2, ed25519_exports, _0n7, _1n7, _2n5, _3n2, _5n2, _8n3, ed25519_CURVE_p, ed25519_CURVE, ED25519_SQRT_M1, Fp, Fn, ed25519Defaults, ed25519, ed25519ctx, ed25519ph, x25519, ELL2_C1, ELL2_C2, ELL2_C3, ELL2_C1_EDWARDS, ed25519_hasher, SQRT_M1, SQRT_AD_MINUS_ONE, INVSQRT_A_MINUS_D, ONE_MINUS_D_SQ, D_MINUS_ONE_SQ, invertSqrt, MAX_255B, bytes255ToNumberLE, _RistrettoPoint, ristretto255, ristretto255_hasher, ED25519_TORSION_SUBGROUP, edwardsToMontgomery, RistrettoPoint, hashToCurve, encodeToCurve, hashToRistretto255, hash_to_ristretto255, init_ed25519, _0n8, _1n8, _2n6, _7n3, _256n2, _0x71n2, SHA3_PI2, SHA3_ROTL2, _SHA3_IOTA2, IOTAS2, SHA3_IOTA_H2, SHA3_IOTA_L2, rotlH, rotlL, Keccak, genShake, shake2562, init_sha32, ed448_exports, ed448_CURVE, E448_CURVE, shake256_114, shake256_64, _1n9, _2n7, _3n3, _4n2, _11n, _22n, _44n, _88n, _223n, Fp2, Fn2, Fp448, Fn448, ED448_DEF, ed448, ed448ph, E448, x448, ELL2_C12, ELL2_J, ed448_hasher, ONE_MINUS_D, ONE_MINUS_TWO_D, SQRT_MINUS_D, INVSQRT_MINUS_D, invertSqrt2, _DecafPoint, decaf448, decaf448_hasher, ED448_TORSION_SUBGROUP, DecafPoint, hashToCurve2, encodeToCurve2, hashToDecaf448, hash_to_decaf448, edwardsToMontgomery2, init_ed448, HMAC, hmac2, init_hmac2, divNearest, DERErr, DER, _0n9, _1n10, _2n8, _3n4, _4n3, init_weierstrass, init_shortw_utils, nist_exports, p256_CURVE, p384_CURVE, p521_CURVE, Fp256, Fp384, Fp521, p256, p256_hasher, p384, p384_hasher, p521, secp256r1, secp384r1, secp521r1, p521_hasher, init_nist, init_makeNobleSignatureImpl, defaultCryptoProvider, init_provider, init_getCiphersuiteImpl, init_resumption, oidNist2, init_utils4, HashMD3, SHA256_IV3, SHA384_IV3, SHA512_IV3, init_md3, U32_MASK643, _32n3, shrSH3, shrSL3, rotrSH3, rotrSL3, rotrBH3, rotrBL3, add3L3, add3H3, add4L3, add4H3, add5L3, add5H3, init_u643, SHA256_K2, SHA256_W2, SHA2_32B, _SHA256, K5122, SHA512_Kh2, SHA512_Kl2, SHA512_W_H2, SHA512_W_L2, SHA2_64B, _SHA512, _SHA384, sha2564, sha5123, sha3843, init_sha23, _HMAC2, hmac3, init_hmac3, init_makeHashImpl2, init_makeNobleSignatureImpl2, BLOCK_SIZE, ZEROS162, ZEROS322, POLY, mul2, swapLE, estimateWindow, GHASH, Polyval, ghash, polyval, init_polyval, BLOCK_SIZE2, BLOCK_SIZE32, EMPTY_BLOCK, POLY2, sbox, rotr32_8, rotl32_8, tableEncoding, xPowers, gcm, _CMAC, cmac, init_aes, init_makeAead2, init_makeKdfImpl2, init_makeDhKem2, init_makeHpke2, init_rng2, nobleCryptoProvider, init_provider2, mlsPublicMessageEncoder, encodeMlsPublicMessage, mlsWelcomeEncoder, encodeMlsWelcome, mlsPrivateMessageEncoder, encodeMlsPrivateMessage, mlsGroupInfoEncoder, encodeMlsGroupInfo, mlsKeyPackageEncoder, encodeMlsKeyPackage, mlsMessageContentEncoder, encodeMlsMessageContent, decodeMlsMessageContent, mlsMessageEncoder, encodeMlsMessage, decodeMlsMessage, init_message, greaseValues, defaultGreaseConfig, init_grease, init_defaultCapabilities, init_src, DEFAULT_CIPHERSUITE, MLSGroupManager, init_mls_group, DOMAIN, NONCE_BYTES2, init_owner_sync, init_mls_delivery_order, init_mls_presend_epoch, dist_exports2, init_dist2, DIR_MODE, FILE_MODE, init_secure_file, SYNC_LOCK_STALE_MS, pendingKpPath, init_mls_state, init_mls_kp_pool, PACKAGE, FALLBACK, MAX_LEN, DISALLOWED, init_client_version, CredentialStore, init_credential_store, init_crypto_helpers, STATE_FILE, LEGACY_STATE_FILE, init_state, init_transport2, A2ALogGate, init_a2a_log_gate, init_mls_membership_probe, openclaw_compat_exports, defaultImporter, HEARTBEAT_CANDIDATES, AGENT_EVENT_CANDIDATES, TRANSCRIPT_CANDIDATES, _heartbeatFn, _agentEventFn, _transcriptFn, init_openclaw_compat, http_handlers_exports, init_http_handlers, mcp_proxy_helpers_exports, init_mcp_proxy_helpers, workspace_handlers_exports, MAX_FILE_SIZE, init_workspace_handlers, ROOM_AGENT_TYPES, CREDENTIAL_MESSAGE_TYPES, CATCHUP_MESSAGE_TYPES, POLL_INTERVAL_MS, RECONNECT_BASE_MS, RECONNECT_MAX_MS, PENDING_POLL_INTERVAL_MS, OUTBOUND_DEDUPE_WINDOW_MS, OUTBOUND_DEDUPE_MAX_SUPPRESS_MS, OUTBOUND_DEDUPE_MAX, OUTBOUND_DEDUPE_TYPES, RETRY_CANDIDATE_TTL_MS, RETRY_CANDIDATE_MAX, SecureChannel, init_channel, init_types, DEFAULT_API_URL, DEFAULT_HTTP_PORT, init_account_config, init_lifecycle, _ocRuntime, _channels, agentVaultPlugin, init_openclaw_plugin, init_gateway_send, init_llm_response_parser, init_llm_cost, traceStore, init_fetch_interceptor, init_tool_audit, init_harness_compat, isUsingManagedRoutes, init_openclaw_entry, util, objectUtil, ZodParsedType, getParsedType, init_util, ZodIssueCode, ZodError, init_ZodError, errorMap, en_default, init_en, overrideErrorMap, init_errors2, makeIssue, ParseStatus, INVALID, DIRTY, OK, isAborted, isDirty, isValid, isAsync, init_parseUtil, init_typeAliases, errorUtil, init_errorUtil, ParseInputLazyPath, handleResult, ZodType, cuidRegex, cuid2Regex, ulidRegex, uuidRegex, nanoidRegex, jwtRegex, durationRegex, emailRegex, _emojiRegex, emojiRegex, ipv4Regex, ipv4CidrRegex, ipv6Regex, ipv6CidrRegex, base64Regex, base64urlRegex, dateRegexSource, dateRegex, ZodString, ZodNumber, ZodBigInt, ZodBoolean, ZodDate, ZodSymbol, ZodUndefined, ZodNull, ZodAny, ZodUnknown, ZodNever, ZodVoid, ZodArray, ZodObject, ZodUnion, getDiscriminator, ZodDiscriminatedUnion, ZodIntersection, ZodTuple, ZodRecord, ZodMap, ZodSet, ZodFunction, ZodLazy, ZodLiteral, ZodEnum, ZodNativeEnum, ZodPromise, ZodEffects, ZodOptional, ZodNullable, ZodDefault, ZodCatch, ZodNaN, ZodBranded, ZodPipeline, ZodReadonly, late, ZodFirstPartyTypeKind, stringType, numberType, nanType, bigIntType, booleanType, dateType, symbolType, undefinedType, nullType, anyType, unknownType, neverType, voidType, arrayType, objectType, strictObjectType, unionType, discriminatedUnionType, intersectionType, tupleType, recordType, mapType, setType, functionType, lazyType, literalType, enumType, nativeEnumType, promiseType, effectsType, optionalType, nullableType, preprocessType, pipelineType, init_types2, init_external, init_v3, NEVER, $ZodAsyncError, $ZodEncodeError, globalConfig, init_core, util_exports, EVALUATING, captureStackTrace, allowsEval, getParsedType2, propertyKeyTypes, primitiveTypes, NUMBER_FORMAT_RANGES, BIGINT_FORMAT_RANGES, Class, init_util2, initializer, $ZodError, $ZodRealError, init_errors3, _parse, parse, _parseAsync, parseAsync, _safeParse, safeParse, _safeParseAsync, safeParseAsync, _encode, _decode, _encodeAsync, _decodeAsync, _safeEncode, _safeDecode, _safeEncodeAsync, _safeDecodeAsync, init_parse, regexes_exports, cuid, cuid2, ulid, xid, ksuid, nanoid, duration, extendedDuration, guid, uuid, uuid4, uuid6, uuid7, email, html5Email, rfc5322Email, unicodeEmail, idnEmail, browserEmail, _emoji, ipv4, ipv6, mac, cidrv4, cidrv6, base64, base64url, hostname, domain, e164, dateSource, date, string, bigint, integer, number, boolean, _null, _undefined, lowercase, uppercase, hex, md5_hex, md5_base64, md5_base64url, sha1_hex, sha1_base64, sha1_base64url, sha256_hex, sha256_base64, sha256_base64url, sha384_hex, sha384_base64, sha384_base64url, sha512_hex, sha512_base64, sha512_base64url, init_regexes, $ZodCheck, numericOriginMap, $ZodCheckLessThan, $ZodCheckGreaterThan, $ZodCheckMultipleOf, $ZodCheckNumberFormat, $ZodCheckBigIntFormat, $ZodCheckMaxSize, $ZodCheckMinSize, $ZodCheckSizeEquals, $ZodCheckMaxLength, $ZodCheckMinLength, $ZodCheckLengthEquals, $ZodCheckStringFormat, $ZodCheckRegex, $ZodCheckLowerCase, $ZodCheckUpperCase, $ZodCheckIncludes, $ZodCheckStartsWith, $ZodCheckEndsWith, $ZodCheckProperty, $ZodCheckMimeType, $ZodCheckOverwrite, init_checks, Doc, init_doc, version, init_versions, $ZodType, $ZodString, $ZodStringFormat, $ZodGUID, $ZodUUID, $ZodEmail, $ZodURL, $ZodEmoji, $ZodNanoID, $ZodCUID, $ZodCUID2, $ZodULID, $ZodXID, $ZodKSUID, $ZodISODateTime, $ZodISODate, $ZodISOTime, $ZodISODuration, $ZodIPv4, $ZodIPv6, $ZodMAC, $ZodCIDRv4, $ZodCIDRv6, $ZodBase64, $ZodBase64URL, $ZodE164, $ZodJWT, $ZodCustomStringFormat, $ZodNumber, $ZodNumberFormat, $ZodBoolean, $ZodBigInt, $ZodBigIntFormat, $ZodSymbol, $ZodUndefined, $ZodNull, $ZodAny, $ZodUnknown, $ZodNever, $ZodVoid, $ZodDate, $ZodArray, $ZodObject, $ZodObjectJIT, $ZodUnion, $ZodXor, $ZodDiscriminatedUnion, $ZodIntersection, $ZodTuple, $ZodRecord, $ZodMap, $ZodSet, $ZodEnum, $ZodLiteral, $ZodFile, $ZodTransform, $ZodOptional, $ZodExactOptional, $ZodNullable, $ZodDefault, $ZodPrefault, $ZodNonOptional, $ZodSuccess, $ZodCatch, $ZodNaN, $ZodPipe, $ZodCodec, $ZodReadonly, $ZodTemplateLiteral, $ZodFunction, $ZodPromise, $ZodLazy, $ZodCustom, init_schemas, init_ar, init_az, init_be, init_bg, init_ca, init_cs, init_da, init_de, error, init_en2, init_eo, init_es, init_fa, init_fi, init_fr, init_fr_CA, init_he, init_hu, init_hy, init_id, init_is, init_it, init_ja, init_ka, init_km, init_kh, init_ko, init_lt, init_mk, init_ms, init_nl, init_no, init_ota, init_ps, init_pl, init_pt, init_ru, init_sl, init_sv, init_ta, init_th, init_tr, init_uk, init_ua, init_ur, init_uz, init_vi, init_zh_CN, init_zh_TW, init_yo, init_locales, _a2, $ZodRegistry, globalRegistry, init_registries, init_api, createToJSONSchemaMethod, createStandardJSONSchemaMethod, init_to_json_schema, formatMap, stringProcessor, numberProcessor, booleanProcessor, bigintProcessor, symbolProcessor, nullProcessor, undefinedProcessor, voidProcessor, neverProcessor, anyProcessor, unknownProcessor, dateProcessor, enumProcessor, literalProcessor, nanProcessor, templateLiteralProcessor, fileProcessor, successProcessor, customProcessor, functionProcessor, transformProcessor, mapProcessor, setProcessor, arrayProcessor, objectProcessor, unionProcessor, intersectionProcessor, tupleProcessor, recordProcessor, nullableProcessor, nonoptionalProcessor, defaultProcessor, prefaultProcessor, catchProcessor, pipeProcessor, readonlyProcessor, promiseProcessor, optionalProcessor, lazyProcessor, allProcessors, init_json_schema_processors, init_json_schema_generator, init_json_schema, init_core2, init_parse2, ZodMiniType, ZodMiniObject, init_schemas2, init_checks2, init_iso, init_coerce, init_external2, init_v4_mini, init_zod_compat, checks_exports2, init_checks3, iso_exports2, ZodISODateTime, ZodISODate, ZodISOTime, ZodISODuration, init_iso2, initializer2, ZodError2, ZodRealError, init_errors4, parse2, parseAsync2, safeParse3, safeParseAsync3, encode3, decode2, encodeAsync2, decodeAsync2, safeEncode2, safeDecode2, safeEncodeAsync2, safeDecodeAsync2, init_parse3, schemas_exports3, ZodType2, _ZodString, ZodString2, ZodStringFormat, ZodEmail, ZodGUID, ZodUUID, ZodURL, ZodEmoji, ZodNanoID, ZodCUID, ZodCUID2, ZodULID, ZodXID, ZodKSUID, ZodIPv4, ZodMAC, ZodIPv6, ZodCIDRv4, ZodCIDRv6, ZodBase64, ZodBase64URL, ZodE164, ZodJWT, ZodCustomStringFormat, ZodNumber2, ZodNumberFormat, ZodBoolean2, ZodBigInt2, ZodBigIntFormat, ZodSymbol2, ZodUndefined2, ZodNull2, ZodAny2, ZodUnknown2, ZodNever2, ZodVoid2, ZodDate2, ZodArray2, ZodObject2, ZodUnion2, ZodXor, ZodDiscriminatedUnion2, ZodIntersection2, ZodTuple2, ZodRecord2, ZodMap2, ZodSet2, ZodEnum2, ZodLiteral2, ZodFile, ZodTransform, ZodOptional2, ZodExactOptional, ZodNullable2, ZodDefault2, ZodPrefault, ZodNonOptional, ZodSuccess, ZodCatch2, ZodNaN2, ZodPipe, ZodCodec, ZodReadonly2, ZodTemplateLiteral, ZodLazy2, ZodPromise2, ZodFunction2, ZodCustom, describe2, meta2, stringbool, init_schemas3, ZodFirstPartyTypeKind2, init_compat, z2, init_from_json_schema, init_coerce2, init_external3, init_classic, init_v4, LATEST_PROTOCOL_VERSION, DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, RELATED_TASK_META_KEY, JSONRPC_VERSION, AssertObjectSchema, ProgressTokenSchema, CursorSchema, TaskCreationParamsSchema, TaskMetadataSchema, RelatedTaskMetadataSchema, RequestMetaSchema, BaseRequestParamsSchema, TaskAugmentedRequestParamsSchema, isTaskAugmentedRequestParams, RequestSchema, NotificationsParamsSchema, NotificationSchema, ResultSchema, RequestIdSchema, JSONRPCRequestSchema, isJSONRPCRequest, JSONRPCNotificationSchema, isJSONRPCNotification, JSONRPCResultResponseSchema, isJSONRPCResultResponse, ErrorCode, JSONRPCErrorResponseSchema, isJSONRPCErrorResponse, JSONRPCMessageSchema, JSONRPCResponseSchema, EmptyResultSchema, CancelledNotificationParamsSchema, CancelledNotificationSchema, IconSchema, IconsSchema, BaseMetadataSchema, ImplementationSchema, FormElicitationCapabilitySchema, ElicitationCapabilitySchema, ClientTasksCapabilitySchema, ServerTasksCapabilitySchema, ClientCapabilitiesSchema, InitializeRequestParamsSchema, InitializeRequestSchema, isInitializeRequest, ServerCapabilitiesSchema, InitializeResultSchema, InitializedNotificationSchema, PingRequestSchema, ProgressSchema, ProgressNotificationParamsSchema, ProgressNotificationSchema, PaginatedRequestParamsSchema, PaginatedRequestSchema, PaginatedResultSchema, TaskStatusSchema, TaskSchema, CreateTaskResultSchema, TaskStatusNotificationParamsSchema, TaskStatusNotificationSchema, GetTaskRequestSchema, GetTaskResultSchema, GetTaskPayloadRequestSchema, GetTaskPayloadResultSchema, ListTasksRequestSchema, ListTasksResultSchema, CancelTaskRequestSchema, CancelTaskResultSchema, ResourceContentsSchema, TextResourceContentsSchema, Base64Schema, BlobResourceContentsSchema, RoleSchema, AnnotationsSchema, ResourceSchema, ResourceTemplateSchema, ListResourcesRequestSchema, ListResourcesResultSchema, ListResourceTemplatesRequestSchema, ListResourceTemplatesResultSchema, ResourceRequestParamsSchema, ReadResourceRequestParamsSchema, ReadResourceRequestSchema, ReadResourceResultSchema, ResourceListChangedNotificationSchema, SubscribeRequestParamsSchema, SubscribeRequestSchema, UnsubscribeRequestParamsSchema, UnsubscribeRequestSchema, ResourceUpdatedNotificationParamsSchema, ResourceUpdatedNotificationSchema, PromptArgumentSchema, PromptSchema, ListPromptsRequestSchema, ListPromptsResultSchema, GetPromptRequestParamsSchema, GetPromptRequestSchema, TextContentSchema, ImageContentSchema, AudioContentSchema, ToolUseContentSchema, EmbeddedResourceSchema, ResourceLinkSchema, ContentBlockSchema, PromptMessageSchema, GetPromptResultSchema, PromptListChangedNotificationSchema, ToolAnnotationsSchema, ToolExecutionSchema, ToolSchema, ListToolsRequestSchema, ListToolsResultSchema, CallToolResultSchema, CompatibilityCallToolResultSchema, CallToolRequestParamsSchema, CallToolRequestSchema, ToolListChangedNotificationSchema, ListChangedOptionsBaseSchema, LoggingLevelSchema, SetLevelRequestParamsSchema, SetLevelRequestSchema, LoggingMessageNotificationParamsSchema, LoggingMessageNotificationSchema, ModelHintSchema, ModelPreferencesSchema, ToolChoiceSchema, ToolResultContentSchema, SamplingContentSchema, SamplingMessageContentBlockSchema, SamplingMessageSchema, CreateMessageRequestParamsSchema, CreateMessageRequestSchema, CreateMessageResultSchema, CreateMessageResultWithToolsSchema, BooleanSchemaSchema, StringSchemaSchema, NumberSchemaSchema, UntitledSingleSelectEnumSchemaSchema, TitledSingleSelectEnumSchemaSchema, LegacyTitledEnumSchemaSchema, SingleSelectEnumSchemaSchema, UntitledMultiSelectEnumSchemaSchema, TitledMultiSelectEnumSchemaSchema, MultiSelectEnumSchemaSchema, EnumSchemaSchema, PrimitiveSchemaDefinitionSchema, ElicitRequestFormParamsSchema, ElicitRequestURLParamsSchema, ElicitRequestParamsSchema, ElicitRequestSchema, ElicitationCompleteNotificationParamsSchema, ElicitationCompleteNotificationSchema, ElicitResultSchema, ResourceTemplateReferenceSchema, PromptReferenceSchema, CompleteRequestParamsSchema, CompleteRequestSchema, CompleteResultSchema, RootSchema, ListRootsRequestSchema, ListRootsResultSchema, RootsListChangedNotificationSchema, ClientRequestSchema, ClientNotificationSchema, ClientResultSchema, ServerRequestSchema, ServerNotificationSchema, ServerResultSchema, McpError, UrlElicitationRequiredError, init_types3, init_interfaces, ignoreOverride, defaultOptions, getDefaultOptions, init_Options, getRefs, init_Refs, init_errorMessages, getRelativePath, init_getRelativePath, init_any, init_array2, init_bigint, init_boolean, init_branded, parseCatchDef, init_catch, integerDateParser, init_date, init_default, init_effects, init_enum, isJsonSchema7AllOfType, init_intersection, init_literal, emojiRegex2, zodPatterns, ALPHA_NUMERIC, init_string2, init_record, init_map, init_nativeEnum, init_never, init_null, primitiveMappings, asAnyOf, init_union, init_nullable, init_number2, init_object, parseOptionalDef, init_optional2, parsePipelineDef, init_pipeline, init_promise, init_set, init_tuple, init_undefined, init_unknown, parseReadonlyDef, init_readonly, selectParser, init_selectParser, get$ref, addMeta, init_parseDef, init_parseTypes, zodToJsonSchema, init_zodToJsonSchema, init_esm, init_zod_json_schema_compat, DEFAULT_REQUEST_TIMEOUT_MSEC, Protocol, init_protocol, require_code, require_scope, require_codegen, require_util, require_names, require_errors, require_boolSchema, require_rules, require_applicability, require_dataType, require_defaults, require_code2, require_keyword, require_subschema, require_fast_deep_equal, require_json_schema_traverse, require_resolve, require_validate, require_validation_error, require_ref_error, require_compile, require_data, require_utils, require_schemes, require_fast_uri, require_uri, require_core, require_id, require_ref, require_core2, require_limitNumber, require_multipleOf, require_ucs2length, require_limitLength, require_pattern, require_limitProperties, require_required, require_limitItems, require_equal, require_uniqueItems, require_const, require_enum, require_validation, require_additionalItems, require_items, require_prefixItems, require_items2020, require_contains, require_dependencies, require_propertyNames, require_additionalProperties, require_properties, require_patternProperties, require_not, require_anyOf, require_oneOf, require_allOf, require_if, require_thenElse, require_applicator, require_format, require_format2, require_metadata, require_draft7, require_types, require_discriminator, require_json_schema_draft_07, require_ajv, require_formats, require_limit, require_dist, import_ajv, import_ajv_formats, AjvJsonSchemaValidator, init_ajv_provider, ExperimentalServerTasks, init_server, init_helpers, Server, init_server2, COMPLETABLE_SYMBOL, McpZodTypeKind, init_completable, init_uriTemplate, TOOL_NAME_REGEX, init_toolNameValidation, ExperimentalMcpServerTasks, init_mcp_server, init_zod, McpServer, EMPTY_OBJECT_JSON_SCHEMA, EMPTY_COMPLETION_RESULT, init_mcp, RequestError, toRequestError, GlobalRequest, Request2, newHeadersFromIncoming, wrapBodyStream, newRequestFromIncoming, getRequestCache, requestCache, incomingKey, urlKey, headersKey, abortControllerKey, getAbortController, requestPrototype, newRequest, responseCache, getResponseCache, cacheKey, GlobalResponse, Response2, buildOutgoingHttpHeaders, X_ALREADY_SENT, outgoingEnded, handleRequestError, handleFetchError, handleResponseError, flushHeaders, responseViaCache, isPromise, responseViaResponseObject, getRequestListener, init_dist22, WebStandardStreamableHTTPServerTransport, init_webStandardStreamableHttp, StreamableHTTPServerTransport, init_streamableHttp, AgentVaultMcpServer, init_mcp_server2, init_mcp_handlers, init_skill_manifest, init_skill_invoker, spanBuffer, init_skill_telemetry, PolicyEnforcer, init_policy_enforcer, VERSION, init_index;
 var init_dist = __esm({
   async "../../../../packages/plugin/dist/index.js"() {
     "use strict";
@@ -17546,7 +17677,7 @@ var init_dist = __esm({
               }, Module: function(binary) {
               }, Instance: function(module2, info) {
                 this.exports = // EMSCRIPTEN_START_ASM
-                function instantiate(ea2) {
+                (function instantiate(ea2) {
                   var a2;
                   var b2 = new Uint8Array(123);
                   for (var c2 = 25; c2 >= 0; --c2) {
@@ -57341,7 +57472,7 @@ var init_dist = __esm({
                     } } }), f: yi, g: ma2, h: Ba2, i: ma2, j: ka2, k: Le2, l: Je2, m: zg, n: yg, o: xg, p: wg, q: ka2, r: Ba2, s: ka2, t: ka2, u: Le2, v: ra2, w: vg, x: ug, y: tg, z: sg, A: Ba2, B: rg, C: qg, D: pg, E: ng, F: mg, G: lg, H: kg, I: jg, J: ka2, K: Ce2, L: Ba2, M: ma2, N: Ta2, O: ra2, P: ka2, Q: Oa2, R: Ba2, S: ma2, T: Ta2, U: ra2, V: ig, W: hg, X: gg, Y: fg, Z: ka2, _: Ma2, $: Ba2, aa: ma2, ba: Ta2, ca: ra2, da: ka2, ea: ka2, fa: Kg, ga: wd, ha: vd, ia: ra2, ja: ka2, ka: ka2, la: Cb, ma: ra2, na: Xa2, oa: eg, pa: qb, qa: dg, ra: cg, sa: ua2, ta: ka2, ua: Dc, va: ra2, wa: Va2, xa: ud, ya: Ya2, za: bg, Aa: ag, Ba: ka2, Ca: ka2, Da: Dc, Ea: ra2, Fa: ze2, Ga: ud, Ha: Ng, Ia: wd, Ja: vd, Ka: ka2, La: ka2, Ma: ka2, Na: ka2, Oa: Ma2, Pa: ka2, Qa: ma2, Ra: ma2, Sa: Ta2, Ta: dh2, Ua: ch, Va: bh, Wa: ah, Xa: Lb, Ya: Kb, Za: td, _a: sd, $a: rd, ab: $f, bb: _f, cb: Zf, db: qd, eb: Yf, fb: pd, gb: Xf, hb: Wf, ib: Uf, jb: Md, kb: tc, lb: nb, mb, nb: Lb, ob: Kb, pb: td, qb: sd, rb: ka2, sb: ka2, tb: ka2, ub: ka2, vb: Ma2, wb: ka2, xb: ma2, yb: ma2, zb: Ta2, Ab: Aa2, Bb: ka2, Cb: ma2, Db: ka2, Eb: ma2, Fb: Sa2, Gb: ka2, Hb: ma2, Ib: ka2, Jb: ma2, Kb: vb, Lb: ua2, Mb: ma2, Nb: ka2, Ob: ma2, Pb: ub, Qb: ua2, Rb: ma2, Sb: ka2, Tb: ma2, Ub: tb, Vb: ua2, Wb: ma2, Xb: ka2, Yb: ma2, Zb: ma2, _b: ua2, $b: ka2, ac: ma2, bc: ua2, cc: ka2, dc: Nd, ec: pe2, fc: od, gc: fh, hc: nd, ic: eh, jc: ra2, kc: ma2, lc: ua2, mc: ka2, nc: ma2, oc: ua2, pc: ka2, qc: ma2, rc: ma2, sc: pe2, tc: ra2, uc: od, vc: Tf, wc: Ja2, xc: xh, yc: nd, zc: Ia2, Ac: ua2, Bc: md, Cc: Lg, Dc: ka2, Ec: Ag, Fc: Ub, Gc: Sf, Hc: Ua2, Ic: Rf, Jc: ua2, Kc: Cb, Lc: Za2, Mc: ic, Nc: Ca2, Oc: md, Pc: ma2, Qc: ua2, Rc: Oa2, Sc: ka2, Tc: ld, Uc: Nd, Vc: ma2, Wc: ua2, Xc: Oa2, Yc: ka2, Zc: ld, _c: ra2, $c: Gh, ad: Fh, bd: Eh, cd: Dh, dd: ra2, ed: Ch, fd: ka2, gd: Ba2, hd: Bh, id: Cb, jd: ze2, kd: hi, ld: gi, md: fi, nd: ei, od: di, pd: ua2, qd: Ba2, rd: ci, sd: Dc, td: Gg, ud: nb, vd: Fg, wd: Eg, xd: ka2, yd: ka2, zd: ka2, Ad: ka2, Bd: Dg, Cd: Rc, Dd: ma2, Ed: ka2, Fd: kd, Gd: jd, Hd: Sg, Id: id, Jd: Rg, Kd: Qg, Ld: ra2, Md: kd, Nd: jd, Od: Ga2, Pd: id, Qd: Fa2, Rd: ma2, Sd: ka2, Td: Rc, Ud: ra2, Vd: Db, Wd: ma2, Xd: wa2, Yd: Ba2, Zd: wa2, _d: ma2, $d: yc, ae: wh, be: Vb, ce: wa2, de: xc, ee: wc, fe: vc, ge: me2, he: vh, ie: uh, je: Oa2, ke: th, le: Pf, me: Of, ne: Nf, oe: Mf, pe: Lf, qe: fb, re: ma2, se: wa2, te: Ba2, ue: wa2, ve: ma2, we: yc, xe: fe2, ye: Db, ze: wa2, Ae: xc, Be: wc, Ce: fb, De: ee2, Ee: Vb, Fe: de2, Ge: vc, He: uc, Ie: Kf, Je: hd, Ke: Jf, Le: Db, Me: fb, Ne: fb, Oe: ma2, Pe: wa2, Qe: Ba2, Re: wa2, Se: ma2, Te: yc, Ue: fe2, Ve: Db, We: wa2, Xe: xc, Ye: wc, Ze: fb, _e: ee2, $e: Vb, af: de2, bf: vc, cf: uc, df: Hf, ef: hd, ff: Gf, gf: Ff, hf: Ef, jf: sh, kf: Jg, lf: Ig, mf: Hg, nf: ka2, of: ka2, pf: Ea2, qf: wb, rf: ka2, sf: ka2, tf: ka2, uf: Ma2, vf: ka2, wf: ma2, xf: ma2, yf: Ta2, zf: Mg, Af: Lb, Bf: Kb, Cf: ra2, Df: rd, Ef: Df, Ff: qd, Gf: pd, Hf: Lb, If: Kb, Jf: ka2, Kf: Ma2, Lf: ka2, Mf: ma2, Nf: ma2, Of: Ta2, Pf: ra2, Qf: ra2, Rf: Mh, Sf: Lh, Tf: Kh, Uf: Cf, Vf: Bf, Wf: Jh, Xf: Ih, Yf: Ma2, Zf: ka2, _f: Hh, $f: Ba2, ag: Db, bg: fb, cg: Vb, dg: Oa2, eg: ma2, fg: Tg, gg: gd, hg: Je2, ig: Oa2, jg: ma2, kg: gd, lg: Cb, mg: ua2, ng: ka2, og: ka2, pg: ua2, qg: Wd, rg: lh, sg: kh, tg: jh, ug: fd, vg: ed, wg: dd, xg: cd, yg: ih, zg: ic, Ag: hh, Bg: gh, Cg: Cb, Dg: ua2, Eg: ka2, Fg: ka2, Gg: ua2, Hg: Wd, Ig: nh, Jg: mh, Kg: Vd, Lg: ic, Mg: Ud, Ng: Td, Og: Yd, Pg: Xd, Qg: ph, Rg: oh, Sg: cd, Tg: ed, Ug: dd, Vg: fd, Wg: ka2, Xg: Oa2, Yg: wa2, Zg: ka2, _g: Ce2, $g: wa2, ah: zf, bh: yf, ch: xf, dh: wf, eh: vf, fh: uf, gh: ra2, hh: ra2, ih: ka2, jh: Ma2, kh: wa2, lh: qh, mh: bd, nh: ad, oh: ra2, ph: ka2, qh: Oa2, rh: wa2, sh: tf, th: sf, uh: rf, vh: ra2, wh: bd, xh: qf, yh: ad, zh: ka2, Ah: Ma2, Bh: wa2, Ch: ra2, Dh: ma2, Eh: ka2, Fh: ua2, Gh: db, Hh: kb, Ih: xd, Jh: oi, Kh: ni, Lh: Ae2, Mh: mi, Nh: za2, Oh: li, Ph: ka2, Qh: ki, Rh: pf, Sh: Ah, Th: zh, Uh: yh, Vh: Bc, Wh: Ac, Xh: ti, Yh: ji, Zh: ii, _h: Cg, $h: Bg, ai: fb, bi: Ba2, ci: tc, di: nb, ei: rh, fi: $c, gi: of, hi: nf, ii: mf, ji: _c, ki: lf, li: Yc, mi: kf, ni: ka2, oi: ka2, pi: ka2, qi: ka2, ri: Ma2, si: ma2, ti: Ta2, ui: jf, vi: hf, wi: Md, xi: bi, yi: ai, zi: $h, Ai: _h, Bi: Zh, Ci: ye2, Di: xe2, Ei: we2, Fi: ve2, Gi: ue2, Hi: te2, Ii: se2, Ji: re2, Ki: ka2, Li: ua2, Mi: ka2, Ni: ua2, Oi: ka2, Pi: Yh, Qi: Xh, Ri: Wh, Si: Vh, Ti: Uh, Ui: Th, Vi: Sh, Wi: Rh, Xi: Qh, Yi: Ph, Zi: Oh, _i: re2, $i: Nh, aj: ka2, bj: ua2, cj: ua2, dj: ka2, ej: gf, fj: ma2, gj: wa2, hj: Ba2, ij: wa2, jj: ka2, kj: $g, lj: _g, mj: Zg, nj: wa2, oj: Ed, pj: wa2, qj: Yg, rj: Ed, sj: me2, tj: uc, uj: ff, vj: ef, wj: df, xj: cf, yj: Xg, zj: Wg, Aj: Vg, Bj: Ug, Cj: ka2, Dj: ka2, Ej: Pg, Fj: Og, Gj: ka2, Hj: ka2, Ij: $c, Jj: bf, Kj: _c, Lj: Yc, Mj: ka2, Nj: Ma2, Oj: ma2, Pj: Ta2, Qj: ma2, Rj: ma2, Sj: af, Tj: $e2, Uj: _e2, Vj: ka2, Wj: Oa2, Xj: wa2, Yj: ra2, Zj: Ze2, _j: Ye2, $j: ka2, ak: Oa2, bk: wa2, ck: ra2, dk: ka2, ek: Ma2, fk: wa2, gk: Xe2, hk: We2, ik: Ve2, jk: ra2, kk: Da2, lk: ta2 };
                   }
                   return da2(ea2);
-                }(info);
+                })(info);
               }, instantiate: function(binary, info) {
                 return { then: function(ok) {
                   var module2 = new WebAssembly2.Module(binary);
@@ -59523,6 +59654,11 @@ var init_dist = __esm({
             return { header: header2, headerSignature, ciphertext, nonce };
           }
           decrypt(message) {
+            if (this.state.peerIdentityPublicKey) {
+              if (!verifyHeaderSignature(message.header, message.headerSignature, this.state.peerIdentityPublicKey)) {
+                throw new Error("Header signature verification failed");
+              }
+            }
             const isV2 = message.envelopeVersion === "2.0.0" && message.encryptedHeader != null && message.headerNonce != null;
             const skippedResult = this.trySkippedKeys(message, isV2);
             if (skippedResult !== null) {
@@ -59536,14 +59672,14 @@ var init_dist = __esm({
               if (message.header.messageNumber === 0) {
                 try {
                   const { messageKey: testKey, headerKey: testHeaderKey, nextChainKey: nextChainKey2 } = kdfChainKey(this.state.rootKey);
-                  let ad2;
+                  let ad;
                   if (isV2) {
                     libsodium_wrappers_default.crypto_aead_xchacha20poly1305_ietf_decrypt(null, message.encryptedHeader, null, message.headerNonce, testHeaderKey);
-                    ad2 = message.encryptedHeader;
+                    ad = message.encryptedHeader;
                   } else {
-                    ad2 = serializeHeader(message.header);
+                    ad = serializeHeader(message.header);
                   }
-                  const ptBytes = libsodium_wrappers_default.crypto_aead_xchacha20poly1305_ietf_decrypt(null, message.ciphertext, ad2, message.nonce, testKey);
+                  const ptBytes = libsodium_wrappers_default.crypto_aead_xchacha20poly1305_ietf_decrypt(null, message.ciphertext, ad, message.nonce, testKey);
                   this.state.dhReceivingPublicKey = message.header.dhPublicKey;
                   this.state.receivingChain = {
                     chainKey: nextChainKey2,
@@ -59563,13 +59699,7 @@ var init_dist = __esm({
             this.skipMessages(this.state.receivingChain, message.header.messageNumber, message.header.dhPublicKey, isV2);
             const chain = this.state.receivingChain;
             const { nextChainKey, messageKey, headerKey } = kdfChainKey(chain.chainKey);
-            chain.chainKey = nextChainKey;
-            chain.messageNumber++;
-            if (this.state.peerIdentityPublicKey) {
-              if (!verifyHeaderSignature(message.header, message.headerSignature, this.state.peerIdentityPublicKey)) {
-                throw new Error("Header signature verification failed");
-              }
-            }
+            let plaintextBytes;
             if (isV2) {
               try {
                 libsodium_wrappers_default.crypto_aead_xchacha20poly1305_ietf_decrypt(null, message.encryptedHeader, null, message.headerNonce, headerKey);
@@ -59577,19 +59707,21 @@ var init_dist = __esm({
                 throw new Error("V2 header decryption failed");
               }
               try {
-                const plaintextBytes = libsodium_wrappers_default.crypto_aead_xchacha20poly1305_ietf_decrypt(null, message.ciphertext, message.encryptedHeader, message.nonce, messageKey);
-                return libsodium_wrappers_default.to_string(plaintextBytes);
+                plaintextBytes = libsodium_wrappers_default.crypto_aead_xchacha20poly1305_ietf_decrypt(null, message.ciphertext, message.encryptedHeader, message.nonce, messageKey);
               } catch {
                 throw new Error("V2 decryption failed: ciphertext tampered or wrong key");
               }
+            } else {
+              const ad = serializeHeader(message.header);
+              try {
+                plaintextBytes = libsodium_wrappers_default.crypto_aead_xchacha20poly1305_ietf_decrypt(null, message.ciphertext, ad, message.nonce, messageKey);
+              } catch {
+                throw new Error("Decryption failed: ciphertext tampered or wrong key");
+              }
             }
-            const ad = serializeHeader(message.header);
-            try {
-              const plaintextBytes = libsodium_wrappers_default.crypto_aead_xchacha20poly1305_ietf_decrypt(null, message.ciphertext, ad, message.nonce, messageKey);
-              return libsodium_wrappers_default.to_string(plaintextBytes);
-            } catch {
-              throw new Error("Decryption failed: ciphertext tampered or wrong key");
-            }
+            chain.chainKey = nextChainKey;
+            chain.messageNumber++;
+            return libsodium_wrappers_default.to_string(plaintextBytes);
           }
           dhRatchetReceive(theirDhPublic) {
             this.state.previousSendingChainLength = this.state.sendingChain?.messageNumber ?? 0;
@@ -68621,6 +68753,11 @@ var init_dist = __esm({
         "use strict";
       }
     });
+    init_mls_presend_epoch = __esm2({
+      "../crypto/dist/mls-presend-epoch.js"() {
+        "use strict";
+      }
+    });
     dist_exports2 = {};
     __export2(dist_exports2, {
       AV_CREDENTIAL_CONTEXT: () => AV_CREDENTIAL_CONTEXT,
@@ -68690,7 +68827,9 @@ var init_dist = __esm({
       hexTransportToEncryptedMessage: () => hexTransportToEncryptedMessage,
       issueCredential: () => issueCredential,
       multibaseToPublicKey: () => multibaseToPublicKey,
+      needsPreSendResync: () => needsPreSendResync,
       normalizeBackupCode: () => normalizeBackupCode,
+      noteObservedEpoch: () => noteObservedEpoch,
       orderDeliveryBatch: () => orderDeliveryBatch,
       parseTraceparent: () => parseTraceparent,
       performX3DH: () => performX3DH,
@@ -68730,6 +68869,7 @@ var init_dist = __esm({
         init_mls_group();
         await init_owner_sync();
         init_mls_delivery_order();
+        init_mls_presend_epoch();
       }
     });
     init_secure_file = __esm2({
@@ -69004,6 +69144,7 @@ var init_dist = __esm({
         await init_libsodium_wrappers();
         await init_dist2();
         await init_dist2();
+        init_mls_presend_epoch();
         init_mls_state();
         await init_mls_kp_pool();
         init_client_version();
@@ -69117,6 +69258,17 @@ var init_dist = __esm({
            *  self-heal rather than be logged and dropped. */
           _mlsCommitFailCounts = /* @__PURE__ */ new Map();
           static MAX_MLS_DECRYPT_FAILS = 3;
+          /**
+           * #1084: consecutive resyncs that found NOTHING to apply, per group.
+           *
+           * "No new commits" means the server holds no commit past our epoch — we are
+           * NOT BEHIND. Treating that as corruption and re-keying is what drove the
+           * epoch churn (see `_resyncOnDivergence`). But a state that is genuinely
+           * broken while its epoch counter happens to match must still recover, so the
+           * suppression is bounded rather than absolute.
+           */
+          _resyncNoOpStrikes = /* @__PURE__ */ new Map();
+          static MAX_RESYNC_NOOPS = 3;
           /** Cached MLS KeyPackage bundle for this device (regenerated on each connect). */
           _mlsKeyPackage = null;
           /** Pending KeyPackage bundle from request-Welcome flow (used by _handleMlsWelcome). */
@@ -69154,6 +69306,13 @@ var init_dist = __esm({
           _kpPoolFilling = false;
           /** Buffer for MLS commits received before Welcome (keyed by groupId, sorted by epoch). */
           _pendingMlsCommits = /* @__PURE__ */ new Map();
+          /**
+           * #1013: the highest group epoch any inbound frame has reported, per MLS
+           * group id. Every inbound frame carries the epoch the group was at when it
+           * was produced, so each is a LOWER BOUND on the group's current epoch — the
+           * hint is monotonic and only ever rises.
+           */
+          _observedGroupEpochs = /* @__PURE__ */ new Map();
           /** In-memory credential store for renter-provided credentials (never persisted). */
           _credentialStore = new CredentialStore();
           /** Rooms whose roster has been refreshed from the backend at least once in
@@ -69869,7 +70028,13 @@ var init_dist = __esm({
                 }
                 try {
                   const plaintextBytes = new TextEncoder().encode(plaintext);
-                  const cipherBytes = await mlsGroup.encrypt(plaintextBytes);
+                  const cipherBytes = await this._encryptWithCatchUp(
+                    mlsGroup,
+                    `1to1-group:${gid}`,
+                    entry.mlsGroupId,
+                    `1:1 group ${gid.slice(0, 8)}`,
+                    plaintextBytes
+                  );
                   await saveMlsState(this.config.dataDir, entry.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
                   const payload = {
                     group_id: entry.mlsGroupId,
@@ -69916,7 +70081,14 @@ var init_dist = __esm({
                 }
                 if (mlsGroup?.isInitialized && mlsGroupId && Number(mlsGroup.epoch) > 0 && this._state === "ready" && this._ws) {
                   const plaintextBytes = new TextEncoder().encode(plaintext);
-                  const cipherBytes = await mlsGroup.encrypt(plaintextBytes);
+                  const sessionGroupKey = convGroupId && this._mlsGroups.has(`1to1-group:${convGroupId}`) ? `1to1-group:${convGroupId}` : `conv:${convId}`;
+                  const cipherBytes = await this._encryptWithCatchUp(
+                    mlsGroup,
+                    sessionGroupKey,
+                    mlsGroupId,
+                    `conversation ${convId.slice(0, 8)}`,
+                    plaintextBytes
+                  );
                   await saveMlsState(this.config.dataDir, mlsGroupId, JSON.stringify(mlsGroup.exportState()));
                   const payload = {
                     conversation_id: convId,
@@ -70011,7 +70183,14 @@ var init_dist = __esm({
                 }
                 try {
                   const plaintextBytes = new TextEncoder().encode(plaintext);
-                  const cipherBytes = await mlsGroup.encrypt(plaintextBytes);
+                  const mlsOnlyGroupKey = mlsOnlyConvGroupId && this._mlsGroups.has(`1to1-group:${mlsOnlyConvGroupId}`) ? `1to1-group:${mlsOnlyConvGroupId}` : `conv:${mlsConvId}`;
+                  const cipherBytes = await this._encryptWithCatchUp(
+                    mlsGroup,
+                    mlsOnlyGroupKey,
+                    resolvedMlsGroupId,
+                    `conversation ${mlsConvId.slice(0, 8)}`,
+                    plaintextBytes
+                  );
                   await saveMlsState(this.config.dataDir, resolvedMlsGroupId, JSON.stringify(mlsGroup.exportState()));
                   const payload = {
                     conversation_id: mlsConvId,
@@ -70106,7 +70285,7 @@ var init_dist = __esm({
            */
           sendActivitySpan(spanData) {
             if (!this._ws || this._ws.readyState !== WebSocket.OPEN) return;
-            const pluginVersion = true ? "0.23.26" : "0.0.0-dev";
+            const pluginVersion = true ? "0.23.27" : "0.0.0-dev";
             const agentName = this.config.agentName ?? "Agent";
             const resource = {
               "service.name": "agentvault-agent",
@@ -70316,7 +70495,13 @@ var init_dist = __esm({
               if (mlsGroup?.isInitialized) {
                 try {
                   const plaintextBytes = new TextEncoder().encode(plaintext);
-                  const ciphertext = await mlsGroup.encrypt(plaintextBytes);
+                  const ciphertext = await this._encryptWithCatchUp(
+                    mlsGroup,
+                    roomId,
+                    room.mlsGroupId,
+                    `room ${roomId.slice(0, 8)}`,
+                    plaintextBytes
+                  );
                   await saveMlsState(this.config.dataDir, room.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
                   if (this._state === "ready" && this._ws) {
                     this._ws.send(JSON.stringify({
@@ -71501,7 +71686,13 @@ var init_dist = __esm({
               const mlsGroup = this._mlsGroups.get(`a2a:${channelEntry.channelId}`);
               if (mlsGroup?.isInitialized) {
                 const plaintextBytes = new TextEncoder().encode(text);
-                const ciphertext = await mlsGroup.encrypt(plaintextBytes);
+                const ciphertext = await this._encryptWithCatchUp(
+                  mlsGroup,
+                  `a2a:${channelEntry.channelId}`,
+                  channelEntry.mlsGroupId,
+                  `A2A ${channelEntry.channelId.slice(0, 8)}`,
+                  plaintextBytes
+                );
                 await saveMlsState(
                   this.config.dataDir,
                   channelEntry.mlsGroupId,
@@ -71549,7 +71740,13 @@ var init_dist = __esm({
               const mlsGroup = this._mlsGroups.get(`a2a:${channelId}`);
               if (mlsGroup?.isInitialized) {
                 const plaintextBytes = new TextEncoder().encode(text);
-                const ciphertext = await mlsGroup.encrypt(plaintextBytes);
+                const ciphertext = await this._encryptWithCatchUp(
+                  mlsGroup,
+                  `a2a:${channelId}`,
+                  entry.mlsGroupId,
+                  `A2A ${channelId.slice(0, 8)}`,
+                  plaintextBytes
+                );
                 await saveMlsState(this.config.dataDir, entry.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
                 this._ws.send(JSON.stringify({
                   event: "a2a_message_mls",
@@ -72025,7 +72222,7 @@ var init_dist = __esm({
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.26" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.27" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -72349,7 +72546,7 @@ var init_dist = __esm({
                         agentVersion: this.config.agentVersion ?? "0.0.0",
                         // __AV_VERSION__ is injected by esbuild from package.json at build time.
                         // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                        pluginVersion: true ? "0.23.26" : "0.0.0-dev"
+                        pluginVersion: true ? "0.23.27" : "0.0.0-dev"
                       });
                       this._telemetryReporter.startAutoFlush(3e4);
                     }
@@ -72715,6 +72912,7 @@ var init_dist = __esm({
             const convGroupId = data.conversation_group_id;
             const groupId = data.group_id;
             const senderDeviceId = data.sender_device_id;
+            this._noteGroupEpoch(groupId, data.epoch);
             if (senderDeviceId === this._deviceId) return;
             let mgr;
             let mgrKey;
@@ -72792,9 +72990,15 @@ var init_dist = __esm({
                     })),
                     no_history: filtered.length === 0
                   });
-                  if (mgr && mlsGroupId) {
+                  if (mgr && mgrKey && mlsGroupId) {
                     const responseBytes = new TextEncoder().encode(responsePayload);
-                    const cipher = await mgr.encrypt(responseBytes);
+                    const cipher = await this._encryptWithCatchUp(
+                      mgr,
+                      mgrKey,
+                      mlsGroupId,
+                      `history catch-up ${mlsGroupId.slice(0, 8)}`,
+                      responseBytes
+                    );
                     await saveMlsState(this.config.dataDir, mlsGroupId, JSON.stringify(mgr.exportState()));
                     if (this._ws) {
                       this._ws.send(JSON.stringify({
@@ -73239,7 +73443,7 @@ ${messageText}`;
             }
             try {
               const configPath = join42(homedir, ".openclaw", "openclaw.json");
-              const raw = readFileSync4(configPath, "utf-8");
+              const raw = readFileSync5(configPath, "utf-8");
               const config2 = JSON.parse(raw);
               const agents = config2?.agents?.list;
               if (Array.isArray(agents) && agentName) {
@@ -73537,9 +73741,36 @@ ${messageText}`;
           // ---------------------------------------------------------------------------
           // MLS room message handlers
           // ---------------------------------------------------------------------------
+          /**
+           * #1014: hand a room-framed frame to the handler that owns its group family.
+           *
+           * Returns true when the frame was routed. Routing means "give it to the right
+           * handler" — NOT "decrypt it as a room message". Decrypting under the wrong
+           * group is how MLS state gets corrupted, so an unplaceable group is left for
+           * the caller to self-heal rather than guessed at.
+           */
+          async _routeNonRoomGroupMessage(data, groupId) {
+            const target = this._resolveGroupFamily(groupId);
+            if (!target || target.family === "room") return false;
+            console.log(
+              `[SecureChannel] Room-framed message belongs to ${target.label} \u2014 routing to the handler that owns it (#1014)`
+            );
+            switch (target.family) {
+              case "shared1to1":
+                await this._handleMessageMLS({ ...data, conversation_group_id: target.id });
+                return true;
+              case "conversation":
+                await this._handleMessageMLS({ ...data, conversation_id: target.id });
+                return true;
+              case "a2a":
+                await this._handleA2AMessageMLS({ ...data, a2a_channel_id: target.id });
+                return true;
+            }
+          }
           async _handleRoomMessageMLS(data) {
             const groupId = data.group_id;
             const senderDeviceId = data.sender_device_id;
+            this._noteGroupEpoch(groupId, data.epoch);
             if (senderDeviceId === this._deviceId) return;
             let roomId;
             for (const [rid, room] of Object.entries(this._persisted?.rooms ?? {})) {
@@ -73553,7 +73784,9 @@ ${messageText}`;
                 roomId = data.room_id;
                 console.log(`[SecureChannel] Room ${roomId.slice(0, 8)} matched by room_id (group_id ${groupId?.slice(0, 8)} mismatch)`);
               } else {
+                if (await this._routeNonRoomGroupMessage(data, groupId)) return;
                 console.warn(`[SecureChannel] No room found for MLS group ${groupId?.slice(0, 8)}`);
+                if (groupId) void this._requestWelcomeSelfHeal(groupId);
                 return;
               }
             }
@@ -73741,63 +73974,63 @@ ${messageText}`;
               console.warn(`[SecureChannel] Failed to send history catchup response:`, sendErr);
             }
           }
+          /**
+           * Apply an inbound MLS commit to whichever group it addresses.
+           *
+           * Returns TRUE when the commit was applied, buffered, or handed to the
+           * failure ladder — i.e. when this agent has taken responsibility for it and
+           * the delivery-queue row may safely be acked. Returns FALSE when the commit
+           * names a group we hold no state for at all, so the caller must NACK and let
+           * the row survive.
+           *
+           * #1012: this used to loop `rooms` then `a2aChannels` and then END. A shared
+           * 1:1 commit (`mlsGroups`) and a legacy per-conversation commit
+           * (`mlsConversations`) matched neither. The call fell off the bottom with no
+           * log, no buffer and no error — and because it did not THROW,
+           * `_pullDeliveryQueue` acked the row and the server deleted it. An MLS commit
+           * cannot be regenerated, so the agent stayed at epoch N while the group moved
+           * to N+1 and every later send() encrypted at an epoch nobody could decrypt.
+           *
+           * The families are enumerated in ONE list resolved by ONE loop, because two
+           * hand-copied loops are exactly how the 1:1 path fell two families behind.
+           */
           async _handleMlsCommit(data) {
             const groupId = data.group_id;
             const epoch = typeof data.epoch === "number" ? data.epoch : 0;
-            for (const [roomId, room] of Object.entries(this._persisted?.rooms ?? {})) {
-              if (room.mlsGroupId === groupId) {
-                const mlsGroup = this._mlsGroups.get(roomId);
-                if (mlsGroup?.isInitialized) {
-                  try {
-                    const commitBytes = new Uint8Array(Buffer.from(data.payload, "hex"));
-                    await mlsGroup.processCommit(commitBytes);
-                    await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mlsGroup.exportState()));
-                    console.log(`[SecureChannel] MLS commit processed for room ${roomId.slice(0, 8)} (epoch=${mlsGroup.epoch})`);
-                    this._mlsCommitFailCounts.delete(roomId);
-                  } catch (err) {
-                    await this._onCommitFailure(
-                      roomId,
-                      groupId,
-                      err,
-                      `room ${roomId.slice(0, 8)}`,
-                      data.epoch,
-                      mlsGroup.epoch
-                    );
-                  }
-                } else {
-                  this._bufferMlsCommit(groupId, epoch, data);
-                  console.log(`[SecureChannel] Buffered MLS commit for room ${roomId.slice(0, 8)} (epoch=${epoch}, group not initialized)`);
-                }
-                return;
+            this._noteGroupEpoch(groupId, data.epoch);
+            const target = this._resolveGroupFamily(groupId);
+            if (target) {
+              const { managerKey: groupKey, label } = target;
+              const mlsGroup = this._mlsGroups.get(groupKey);
+              if (!mlsGroup?.isInitialized) {
+                this._bufferMlsCommit(groupId, epoch, data);
+                console.log(`[SecureChannel] Buffered MLS commit for ${label} (epoch=${epoch}, group not initialized)`);
+                return true;
               }
-            }
-            for (const [chId, chState] of Object.entries(this._persisted?.a2aChannels ?? {})) {
-              if (chState.mlsGroupId === groupId) {
-                const mlsGroup = this._mlsGroups.get(`a2a:${chId}`);
-                if (mlsGroup?.isInitialized) {
-                  try {
-                    const commitBytes = new Uint8Array(Buffer.from(data.payload, "hex"));
-                    await mlsGroup.processCommit(commitBytes);
-                    await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mlsGroup.exportState()));
-                    console.log(`[SecureChannel] MLS commit processed for A2A ${chId.slice(0, 8)} (epoch=${mlsGroup.epoch})`);
-                    this._mlsCommitFailCounts.delete(`a2a:${chId}`);
-                  } catch (err) {
-                    await this._onCommitFailure(
-                      `a2a:${chId}`,
-                      groupId,
-                      err,
-                      `A2A ${chId.slice(0, 8)}`,
-                      data.epoch,
-                      mlsGroup.epoch
-                    );
-                  }
-                } else {
-                  this._bufferMlsCommit(groupId, epoch, data);
-                  console.log(`[SecureChannel] Buffered MLS commit for A2A ${chId.slice(0, 8)} (epoch=${epoch}, group not initialized)`);
-                }
-                return;
+              try {
+                const commitBytes = new Uint8Array(Buffer.from(data.payload, "hex"));
+                await mlsGroup.processCommit(commitBytes);
+                await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mlsGroup.exportState()));
+                console.log(`[SecureChannel] MLS commit processed for ${label} (epoch=${mlsGroup.epoch})`);
+                this._mlsCommitFailCounts.delete(groupKey);
+              } catch (err) {
+                await this._onCommitFailure(
+                  groupKey,
+                  groupId,
+                  err,
+                  label,
+                  data.epoch,
+                  mlsGroup.epoch
+                );
               }
+              return true;
             }
+            this._bufferMlsCommit(groupId, epoch, data);
+            console.warn(
+              `[SecureChannel] MLS commit for UNKNOWN group ${String(groupId).slice(0, 8)} (epoch=${epoch}) \u2014 buffered, requesting a Welcome, NOT acked`
+            );
+            if (groupId) void this._requestWelcomeSelfHeal(groupId);
+            return false;
           }
           /** Buffer an MLS commit for replay after Welcome join. Max 50 per group. */
           _bufferMlsCommit(groupId, epoch, data) {
@@ -73987,6 +74220,229 @@ ${messageText}`;
            *   `1to1-group:<gid>`, `a2a:<channelId>`, …) — also the decrypt-fail-count key.
            * @param groupId  the server-side MLS group id used in the /sync URL.
            */
+          /**
+           * #1015 — the ONLY place this package fulfils a Welcome request.
+           *
+           * Add the members, transmit, and record `fulfilled` **only for the targets
+           * whose frames actually went out**. Every one of the five sites that used to
+           * do this by hand followed the same sequence and had the same three holes:
+           * `this._ws` null (both sends skipped by an `if`), a CLOSING socket (`send`
+           * returns without throwing), and a fulfil POST wrapped in `.catch(() => {})`.
+           *
+           * A fulfilled request is never re-requested. So a Welcome that evaporated
+           * left the requester locked out, the fulfiller at epoch N+1, everyone else at
+           * N, and the bridging commit untransmitted and impossible to regenerate — a
+           * permanently wedged group in which every signal read success.
+           *
+           * Returns the number of requests actually fulfilled.
+           */
+          async _fulfilWelcomeRequests(opts) {
+            const { mlsGroup, mlsGroupId, label, welcomeFields, targets } = opts;
+            if (targets.length === 0) return 0;
+            if (!this._wsIsOpen()) {
+              console.warn(
+                `[SecureChannel] ${label}: socket is not OPEN \u2014 NOT advancing the group; ${targets.length} request(s) stay pending for the next pull`
+              );
+              return 0;
+            }
+            const snapshot = mlsGroup.exportState();
+            const { commit, welcome } = await mlsGroup.addMembers(targets.map((t2) => t2.keyPackage));
+            const commitSent = await this._sendFrameConfirmed(
+              {
+                event: "mls_commit",
+                data: {
+                  group_id: mlsGroupId,
+                  epoch: Number(mlsGroup.epoch),
+                  payload: Buffer.from(commit).toString("hex")
+                }
+              },
+              `${label} commit`
+            );
+            if (!commitSent) {
+              mlsGroup.importState(snapshot);
+              console.warn(
+                `[SecureChannel] ${label}: commit was NOT written \u2014 rolled back to epoch ${Number(mlsGroup.epoch)}, nothing fulfilled, requests stay pending`
+              );
+              return 0;
+            }
+            await saveMlsState(this.config.dataDir, mlsGroupId, JSON.stringify(mlsGroup.exportState()));
+            if (!welcome) {
+              console.warn(
+                `[SecureChannel] ${label}: addMembers produced NO Welcome \u2014 ${targets.length} request(s) left pending rather than marked fulfilled`
+              );
+              return 0;
+            }
+            let fulfilled = 0;
+            for (const t2 of targets) {
+              const sent = await this._sendFrameConfirmed(
+                {
+                  event: "mls_welcome",
+                  data: {
+                    target_device_id: t2.deviceId,
+                    group_id: mlsGroupId,
+                    ...welcomeFields,
+                    payload: Buffer.from(welcome).toString("hex")
+                  }
+                },
+                `${label} welcome\u2192${t2.deviceId.slice(0, 8)}`
+              );
+              if (!sent) {
+                console.warn(
+                  `[SecureChannel] ${label}: Welcome for ${t2.deviceId.slice(0, 8)} was NOT written \u2014 leaving the request PENDING so the next pull retries it`
+                );
+                continue;
+              }
+              if (await this._postFulfilWelcome(mlsGroupId, t2.requestId, `${label} ${t2.deviceId.slice(0, 8)}`)) {
+                fulfilled++;
+              }
+            }
+            return fulfilled;
+          }
+          /**
+           * Resolve an MLS group id to the family that owns it.
+           *
+           * There are four: rooms, A2A channels, shared 1:1 groups, and the legacy
+           * per-conversation groups. They all store the MLS group id under
+           * `mlsGroupId`; they differ only in the key their live `MLSGroupManager` sits
+           * under in `_mlsGroups`.
+           *
+           * ONE resolver, because hand-copying this enumeration is what produced
+           * #1012 (`_handleMlsCommit` handled two families of four), #1014 (a
+           * room-framed 1:1 replay matched nothing) and #1016 (a rejoin dropped only
+           * the room manager). Three bugs, one missing abstraction.
+           */
+          _resolveGroupFamily(mlsGroupId) {
+            if (!mlsGroupId) return null;
+            const families = [
+              { family: "room", entries: this._persisted?.rooms, managerKey: (id) => id, label: "room" },
+              { family: "a2a", entries: this._persisted?.a2aChannels, managerKey: (id) => `a2a:${id}`, label: "A2A" },
+              { family: "shared1to1", entries: this._persisted?.mlsGroups, managerKey: (id) => `1to1-group:${id}`, label: "1:1 group" },
+              { family: "conversation", entries: this._persisted?.mlsConversations, managerKey: (id) => `conv:${id}`, label: "conversation" }
+            ];
+            for (const f2 of families) {
+              for (const [id, entry] of Object.entries(f2.entries ?? {})) {
+                if (entry?.mlsGroupId !== mlsGroupId) continue;
+                return {
+                  family: f2.family,
+                  id,
+                  managerKey: f2.managerKey(id),
+                  label: `${f2.label} ${id.slice(0, 8)}`
+                };
+              }
+            }
+            return null;
+          }
+          /** #1015: is the socket in a state that can actually take a write? */
+          _wsIsOpen() {
+            return this._ws?.readyState === 1;
+          }
+          /**
+           * #1015: write one frame and report whether the socket took it.
+           *
+           * `ws.send()` on a CLOSING or CLOSED socket returns WITHOUT throwing — the
+           * error surfaces only through the callback, and every fulfilment site passed
+           * none. So a Welcome could be "sent" into a dead socket and the requester
+           * still marked `fulfilled`, which it never re-requests.
+           */
+          _sendFrameConfirmed(frame, label) {
+            const ws = this._ws;
+            if (!ws || ws.readyState !== 1) {
+              console.warn(
+                `[SecureChannel] ${label}: socket is not OPEN (readyState=${ws?.readyState ?? "null"}) \u2014 frame NOT written`
+              );
+              return Promise.resolve(false);
+            }
+            return new Promise((resolve3) => {
+              try {
+                ws.send(JSON.stringify(frame), (err) => {
+                  if (err) {
+                    console.error(`[SecureChannel] ${label}: socket refused the frame:`, err);
+                    resolve3(false);
+                  } else {
+                    resolve3(true);
+                  }
+                });
+              } catch (err) {
+                console.error(`[SecureChannel] ${label}: send threw:`, err);
+                resolve3(false);
+              }
+            });
+          }
+          /**
+           * #1015: record a Welcome as fulfilled — and say so when it fails.
+           *
+           * The batched shared-1:1 site posted this with `.catch(() => {})`, so an HTTP
+           * failure here was invisible on top of the sends being invisible.
+           */
+          async _postFulfilWelcome(mlsGroupId, requestId, label) {
+            try {
+              const res = await fetch(
+                `${this.config.apiUrl}/api/v1/mls/groups/${mlsGroupId}/fulfill-welcome`,
+                {
+                  method: "POST",
+                  headers: { Authorization: `Bearer ${this._deviceJwt}`, "Content-Type": "application/json" },
+                  body: JSON.stringify({ request_id: requestId })
+                }
+              );
+              if (!res.ok) {
+                console.warn(`[SecureChannel] ${label}: fulfill-welcome returned ${res.status}`);
+                return false;
+              }
+              return true;
+            } catch (err) {
+              console.warn(`[SecureChannel] ${label}: fulfill-welcome failed:`, err);
+              return false;
+            }
+          }
+          /**
+           * #1013: fold an epoch seen on an inbound frame into the running hint.
+           *
+           * Anything unusable (missing, non-numeric, negative, fractional) is ignored
+           * rather than defaulted. A defaulted epoch here would be a guess, and a guess
+           * that reads LOW silently disables the check it exists to drive.
+           */
+          _noteGroupEpoch(mlsGroupId, epoch) {
+            if (typeof mlsGroupId !== "string" || !mlsGroupId) return;
+            const current = this._observedGroupEpochs.get(mlsGroupId) ?? 0;
+            const next = noteObservedEpoch(current, epoch);
+            if (next > current) this._observedGroupEpochs.set(mlsGroupId, next);
+          }
+          /**
+           * #1013 — the ONLY place this package encrypts an MLS application message.
+           *
+           * Catch up first when the group is known to have moved past us, then encrypt.
+           * Hermes has done this since #440 and the browser since #996; the plugin —
+           * the implementation that actually ships to customers — did not, so an agent
+           * that missed one commit encrypted every later message at an epoch nobody
+           * could read, while the server stored and relayed it and every signal read
+           * 200.
+           *
+           * Funnelling every sender through one method is the point. A guard applied at
+           * seven call sites decays to a guard applied at six: that is exactly how
+           * `_handleMlsCommit` ended up handling two group families out of four (#1012).
+           *
+           * Best-effort by design. A catch-up that cannot replay — or that throws — must
+           * NOT block the send; we fall through and encrypt at the local epoch, which is
+           * precisely today's behaviour, so the worst case is no regression.
+           */
+          async _encryptWithCatchUp(mlsGroup, groupKey, mlsGroupId, label, plaintextBytes) {
+            const observed = this._observedGroupEpochs.get(mlsGroupId);
+            if (observed !== void 0 && needsPreSendResync(Number(mlsGroup.epoch), observed)) {
+              console.warn(
+                `[SecureChannel] ${label}: local epoch ${Number(mlsGroup.epoch)} is behind the observed group epoch ${observed} \u2014 catching up before encrypt (#1013)`
+              );
+              try {
+                if (!await this._resyncOnDivergence(groupKey, mlsGroupId)) {
+                  console.warn(
+                    `[SecureChannel] ${label}: catch-up could not replay \u2014 sending at epoch ${Number(mlsGroup.epoch)}. Peers past this epoch will not read it.`
+                  );
+                }
+              } catch (err) {
+                console.warn(`[SecureChannel] ${label}: catch-up failed:`, err);
+              }
+            }
+            return await mlsGroup.encrypt(plaintextBytes);
+          }
           async _resyncOnDivergence(groupKey, groupId) {
             const mgr = this._mlsGroups.get(groupKey);
             if (!mgr?.isInitialized) return false;
@@ -74013,11 +74469,24 @@ ${messageText}`;
                 applied++;
               }
               if (applied === 0) {
-                console.log(`[SecureChannel] Resync for ${groupId.slice(0, 8)}: no new commits to apply (epoch=${mgr.epoch})`);
+                const strikes = (this._resyncNoOpStrikes.get(groupKey) ?? 0) + 1;
+                this._resyncNoOpStrikes.set(groupKey, strikes);
+                if (strikes < _SecureChannel.MAX_RESYNC_NOOPS) {
+                  this._mlsDecryptFailCounts.delete(groupKey);
+                  console.log(
+                    `[SecureChannel] Resync for ${groupId.slice(0, 8)}: already current at epoch=${mgr.epoch} (strike ${strikes}/${_SecureChannel.MAX_RESYNC_NOOPS}) \u2014 NOT re-keying (#1084)`
+                  );
+                  return true;
+                }
+                this._resyncNoOpStrikes.delete(groupKey);
+                console.warn(
+                  `[SecureChannel] Resync for ${groupId.slice(0, 8)}: still failing at epoch=${mgr.epoch} after ${_SecureChannel.MAX_RESYNC_NOOPS} no-op resyncs \u2014 escalating to re-key`
+                );
                 return false;
               }
               await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mgr.exportState()));
               this._mlsDecryptFailCounts.delete(groupKey);
+              this._resyncNoOpStrikes.delete(groupKey);
               console.log(
                 `[SecureChannel] Resync-on-divergence: applied ${applied} missed commit(s) for ${groupId.slice(0, 8)}, now epoch=${mgr.epoch}`
               );
@@ -74404,6 +74873,7 @@ ${messageText}`;
                 const ackedIds = [];
                 const nackedIds = [];
                 for (const msg of messages) {
+                  let handled = true;
                   try {
                     if (msg.sender_device_id === this._deviceId) {
                       ackedIds.push(msg.queue_id);
@@ -74420,7 +74890,7 @@ ${messageText}`;
                         a2a_channel_id: msg.a2a_channel_id
                       });
                     } else if (msg.message_type === "commit") {
-                      await this._handleMlsCommit({
+                      handled = await this._handleMlsCommit({
                         group_id: msg.group_id,
                         sender_device_id: msg.sender_device_id,
                         epoch: msg.epoch,
@@ -74458,9 +74928,18 @@ ${messageText}`;
                           conversation_group_id: msg.conversation_group_id,
                           created_at: msg.created_at
                         });
+                      } else {
+                        handled = false;
+                        console.warn(
+                          `[SecureChannel] Delivery application row ${String(msg.message_id).slice(0, 8)} names no room, A2A channel or conversation \u2014 NOT acked`
+                        );
                       }
                     }
-                    ackedIds.push(msg.queue_id);
+                    if (handled) {
+                      ackedIds.push(msg.queue_id);
+                    } else {
+                      nackedIds.push(msg.queue_id);
+                    }
                   } catch (err) {
                     console.warn(`[SecureChannel] Delivery ${msg.message_type} processing failed:`, err);
                     nackedIds.push(msg.queue_id);
@@ -74529,38 +75008,20 @@ ${messageText}`;
                       if (!kpHex) continue;
                       const kpBytes = new Uint8Array(Buffer.from(kpHex, "hex"));
                       const memberKp = MLSGroupManager.deserializeKeyPackage(kpBytes);
-                      const { commit, welcome } = await mlsGroup.addMembers([memberKp]);
-                      if (this._ws) {
-                        this._ws.send(JSON.stringify({
-                          event: "mls_commit",
-                          data: {
-                            group_id: roomState.mlsGroupId,
-                            epoch: Number(mlsGroup.epoch),
-                            payload: Buffer.from(commit).toString("hex")
-                          }
-                        }));
-                      }
-                      if (welcome && this._ws) {
-                        this._ws.send(JSON.stringify({
-                          event: "mls_welcome",
-                          data: {
-                            target_device_id: req.requesting_device_id,
-                            group_id: roomState.mlsGroupId,
-                            room_id: roomId,
-                            payload: Buffer.from(welcome).toString("hex")
-                          }
-                        }));
+                      const done = await this._fulfilWelcomeRequests({
+                        mlsGroup,
+                        mlsGroupId: roomState.mlsGroupId,
+                        label: `room ${roomId.slice(0, 8)}`,
+                        welcomeFields: { room_id: roomId },
+                        targets: [{
+                          requestId: req.id,
+                          deviceId: req.requesting_device_id,
+                          keyPackage: memberKp
+                        }]
+                      });
+                      if (done > 0) {
+                        console.log(`[SecureChannel] Fulfilled Welcome for ${req.requesting_device_id.slice(0, 8)} in room ${roomId.slice(0, 8)}`);
                       }
-                      await fetch(
-                        `${this.config.apiUrl}/api/v1/mls/groups/${roomState.mlsGroupId}/fulfill-welcome`,
-                        {
-                          method: "POST",
-                          headers: { Authorization: `Bearer ${this._deviceJwt}`, "Content-Type": "application/json" },
-                          body: JSON.stringify({ request_id: req.id })
-                        }
-                      );
-                      await saveMlsState(this.config.dataDir, roomState.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
-                      console.log(`[SecureChannel] Fulfilled Welcome for ${req.requesting_device_id.slice(0, 8)} in room ${roomId.slice(0, 8)}`);
                     } catch (fulfillErr) {
                       console.warn(`[SecureChannel] Welcome fulfill failed for ${req.requesting_device_id.slice(0, 8)}:`, fulfillErr);
                     }
@@ -74599,65 +75060,38 @@ ${messageText}`;
                     validReqs.push({ req, kp: MLSGroupManager.deserializeKeyPackage(kpBytes) });
                   }
                   if (validReqs.length === 0) continue;
+                  const sharedTargets = validReqs.map((v2) => ({
+                    requestId: v2.req.id,
+                    deviceId: v2.req.requesting_device_id,
+                    keyPackage: v2.kp
+                  }));
                   try {
-                    const { commit, welcome } = await mlsGroup.addMembers(validReqs.map((v2) => v2.kp));
-                    if (this._ws) {
-                      this._ws.send(JSON.stringify({
-                        event: "mls_commit",
-                        data: {
-                          group_id: entry.mlsGroupId,
-                          epoch: Number(mlsGroup.epoch),
-                          payload: Buffer.from(commit).toString("hex")
-                        }
-                      }));
-                    }
-                    if (welcome && this._ws) {
-                      for (const { req } of validReqs) {
-                        this._ws.send(JSON.stringify({
-                          event: "mls_welcome",
-                          data: {
-                            target_device_id: req.requesting_device_id,
-                            group_id: entry.mlsGroupId,
-                            conversation_group_id: gid,
-                            payload: Buffer.from(welcome).toString("hex")
-                          }
-                        }));
-                      }
-                    }
-                    for (const { req } of validReqs) {
-                      await fetch(
-                        `${this.config.apiUrl}/api/v1/mls/groups/${entry.mlsGroupId}/fulfill-welcome`,
-                        {
-                          method: "POST",
-                          headers: { Authorization: `Bearer ${this._deviceJwt}`, "Content-Type": "application/json" },
-                          body: JSON.stringify({ request_id: req.id })
-                        }
-                      ).catch(() => {
-                      });
+                    const done = await this._fulfilWelcomeRequests({
+                      mlsGroup,
+                      mlsGroupId: entry.mlsGroupId,
+                      label: `shared group ${gid.slice(0, 8)}`,
+                      welcomeFields: { conversation_group_id: gid },
+                      targets: sharedTargets
+                    });
+                    if (done > 0) {
+                      console.log(`[SecureChannel] Batched Welcome for ${done}/${validReqs.length} devices in shared group ${gid.slice(0, 8)} (epoch=${mlsGroup.epoch})`);
                     }
-                    await saveMlsState(this.config.dataDir, entry.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
-                    console.log(`[SecureChannel] Batched Welcome for ${validReqs.length} devices in shared group ${gid.slice(0, 8)} (epoch=${mlsGroup.epoch})`);
                   } catch (batchErr) {
                     console.warn(`[SecureChannel] Batched Welcome failed for shared group ${gid.slice(0, 8)}, falling back to individual:`, batchErr);
-                    for (const { req, kp } of validReqs) {
+                    for (const target of sharedTargets) {
                       try {
-                        const { commit, welcome } = await mlsGroup.addMembers([kp]);
-                        if (this._ws) {
-                          this._ws.send(JSON.stringify({ event: "mls_commit", data: { group_id: entry.mlsGroupId, epoch: Number(mlsGroup.epoch), payload: Buffer.from(commit).toString("hex") } }));
-                        }
-                        if (welcome && this._ws) {
-                          this._ws.send(JSON.stringify({ event: "mls_welcome", data: { target_device_id: req.requesting_device_id, group_id: entry.mlsGroupId, conversation_group_id: gid, payload: Buffer.from(welcome).toString("hex") } }));
-                        }
-                        await fetch(`${this.config.apiUrl}/api/v1/mls/groups/${entry.mlsGroupId}/fulfill-welcome`, {
-                          method: "POST",
-                          headers: { Authorization: `Bearer ${this._deviceJwt}`, "Content-Type": "application/json" },
-                          body: JSON.stringify({ request_id: req.id })
-                        }).catch(() => {
+                        const done = await this._fulfilWelcomeRequests({
+                          mlsGroup,
+                          mlsGroupId: entry.mlsGroupId,
+                          label: `shared group ${gid.slice(0, 8)}`,
+                          welcomeFields: { conversation_group_id: gid },
+                          targets: [target]
                         });
-                        await saveMlsState(this.config.dataDir, entry.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
-                        console.log(`[SecureChannel] Individual Welcome for ${req.requesting_device_id.slice(0, 8)} in shared group ${gid.slice(0, 8)}`);
+                        if (done > 0) {
+                          console.log(`[SecureChannel] Individual Welcome for ${target.deviceId.slice(0, 8)} in shared group ${gid.slice(0, 8)}`);
+                        }
                       } catch (indivErr) {
-                        console.warn(`[SecureChannel] Individual Welcome failed for ${req.requesting_device_id.slice(0, 8)}:`, indivErr);
+                        console.warn(`[SecureChannel] Individual Welcome failed for ${target.deviceId.slice(0, 8)}:`, indivErr);
                       }
                     }
                   }
@@ -74689,38 +75123,20 @@ ${messageText}`;
                       if (!kpHex) continue;
                       const kpBytes = new Uint8Array(Buffer.from(kpHex, "hex"));
                       const memberKp = MLSGroupManager.deserializeKeyPackage(kpBytes);
-                      const { commit, welcome } = await mlsGroup.addMembers([memberKp]);
-                      if (this._ws) {
-                        this._ws.send(JSON.stringify({
-                          event: "mls_commit",
-                          data: {
-                            group_id: convEntry.mlsGroupId,
-                            epoch: Number(mlsGroup.epoch),
-                            payload: Buffer.from(commit).toString("hex")
-                          }
-                        }));
-                      }
-                      if (welcome && this._ws) {
-                        this._ws.send(JSON.stringify({
-                          event: "mls_welcome",
-                          data: {
-                            target_device_id: req.requesting_device_id,
-                            group_id: convEntry.mlsGroupId,
-                            conversation_id: convId,
-                            payload: Buffer.from(welcome).toString("hex")
-                          }
-                        }));
+                      const done = await this._fulfilWelcomeRequests({
+                        mlsGroup,
+                        mlsGroupId: convEntry.mlsGroupId,
+                        label: `conv ${convId.slice(0, 8)}`,
+                        welcomeFields: { conversation_id: convId },
+                        targets: [{
+                          requestId: req.id,
+                          deviceId: req.requesting_device_id,
+                          keyPackage: memberKp
+                        }]
+                      });
+                      if (done > 0) {
+                        console.log(`[SecureChannel] Fulfilled Welcome for ${req.requesting_device_id.slice(0, 8)} in conv ${convId.slice(0, 8)}`);
                       }
-                      await fetch(
-                        `${this.config.apiUrl}/api/v1/mls/groups/${convEntry.mlsGroupId}/fulfill-welcome`,
-                        {
-                          method: "POST",
-                          headers: { Authorization: `Bearer ${this._deviceJwt}`, "Content-Type": "application/json" },
-                          body: JSON.stringify({ request_id: req.id })
-                        }
-                      );
-                      await saveMlsState(this.config.dataDir, convEntry.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
-                      console.log(`[SecureChannel] Fulfilled Welcome for ${req.requesting_device_id.slice(0, 8)} in conv ${convId.slice(0, 8)}`);
                     } catch (fulfillErr) {
                       console.warn(`[SecureChannel] Conv Welcome fulfill failed for ${req.requesting_device_id.slice(0, 8)}:`, fulfillErr);
                     }
@@ -74901,12 +75317,13 @@ ${messageText}`;
                       } catch (distErr) {
                         console.warn(`[SecureChannel] A2A distribute network error:`, distErr);
                       }
-                      if (!distributed && this._ws) {
-                        this._ws.send(JSON.stringify({
+                      if (!distributed && this._wsIsOpen()) {
+                        const a2aLabel = `A2A ${chId.slice(0, 8)}`;
+                        const commitSent = await this._sendFrameConfirmed({
                           event: "mls_commit",
                           data: { group_id: chState.mlsGroupId, epoch: Number(mlsGroup.epoch), payload: commitHex }
-                        }));
-                        this._ws.send(JSON.stringify({
+                        }, `${a2aLabel} commit`);
+                        const welcomeSent = commitSent && await this._sendFrameConfirmed({
                           event: "mls_welcome",
                           data: {
                             target_device_id: req.requesting_device_id,
@@ -74914,7 +75331,11 @@ ${messageText}`;
                             a2a_channel_id: chId,
                             payload: welcomeHex
                           }
-                        }));
+                        }, `${a2aLabel} welcome`);
+                        if (!welcomeSent) {
+                          console.warn(`[SecureChannel] ${a2aLabel}: Welcome frames were NOT written \u2014 leaving the request pending`);
+                          continue;
+                        }
                         try {
                           await fetch(
                             `${this.config.apiUrl}/api/v1/mls/groups/${chState.mlsGroupId}/distribute`,
@@ -74937,16 +75358,15 @@ ${messageText}`;
                         console.warn(`[SecureChannel] Cannot deliver Welcome \u2014 HTTP distribute and WS both unavailable`);
                         continue;
                       }
-                      await fetch(
-                        `${this.config.apiUrl}/api/v1/mls/groups/${chState.mlsGroupId}/fulfill-welcome`,
-                        {
-                          method: "POST",
-                          headers: { Authorization: `Bearer ${this._deviceJwt}`, "Content-Type": "application/json" },
-                          body: JSON.stringify({ request_id: req.id })
-                        }
+                      const a2aFulfilled = await this._postFulfilWelcome(
+                        chState.mlsGroupId,
+                        req.id,
+                        `A2A ${chId.slice(0, 8)}`
                       );
                       await saveMlsState(this.config.dataDir, chState.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
-                      console.log(`[SecureChannel] Fulfilled A2A Welcome for ${req.requesting_device_id.slice(0, 8)} in channel ${chId.slice(0, 8)}`);
+                      if (a2aFulfilled) {
+                        console.log(`[SecureChannel] Fulfilled A2A Welcome for ${req.requesting_device_id.slice(0, 8)} in channel ${chId.slice(0, 8)}`);
+                      }
                     } catch (fulfillErr) {
                       console.log(`[SecureChannel] A2A Welcome fulfill failed: ${fulfillErr instanceof Error ? fulfillErr.message : String(fulfillErr)}`);
                     }
@@ -75120,12 +75540,12 @@ ${messageText}`;
               console.log(`[SecureChannel] MLS sync: re-join needed for group ${groupId?.slice(0, 8)}`);
               if (groupId) {
                 await deleteMlsState(this.config.dataDir, groupId);
-                for (const [roomId, room] of Object.entries(this._persisted?.rooms ?? {})) {
-                  if (room.mlsGroupId === groupId) {
-                    this._mlsGroups.delete(roomId);
-                    break;
-                  }
+                const target = this._resolveGroupFamily(groupId);
+                if (target) {
+                  this._mlsGroups.delete(target.managerKey);
+                  console.log(`[SecureChannel] MLS sync rejoin: dropped local state for ${target.label}`);
                 }
+                void this._requestWelcomeSelfHeal(groupId);
               }
             } else if (action === "replay_complete") {
               console.log(`[SecureChannel] MLS sync complete for group ${groupId?.slice(0, 8)} (${data.count} messages replayed)`);
@@ -75137,6 +75557,7 @@ ${messageText}`;
            */
           async _handleA2AMessageMLS(data) {
             const groupId = data.group_id;
+            this._noteGroupEpoch(groupId, data.epoch);
             const channelId = data.channel_id ?? data.a2a_channel_id;
             let a2aChannelId = channelId;
             if (!a2aChannelId) {
@@ -83557,10 +83978,10 @@ ${actionsText}`);
           inst.with = inst.check;
           inst.clone = (_def, params) => clone(inst, _def, params);
           inst.brand = () => inst;
-          inst.register = (reg, meta3) => {
+          inst.register = ((reg, meta3) => {
             reg.add(inst, meta3);
             return inst;
-          };
+          });
           inst.apply = (fn) => fn(inst);
         });
         ZodMiniObject = /* @__PURE__ */ $constructor("ZodMiniObject", (inst, def) => {
@@ -83947,10 +84368,10 @@ ${actionsText}`);
           inst.with = inst.check;
           inst.clone = (def2, params) => clone(inst, def2, params);
           inst.brand = () => inst;
-          inst.register = (reg, meta3) => {
+          inst.register = ((reg, meta3) => {
             reg.add(inst, meta3);
             return inst;
-          };
+          });
           inst.parse = (data, params) => parse2(inst, data, params, { callee: inst.parse });
           inst.safeParse = (data, params) => safeParse3(inst, data, params);
           inst.parseAsync = async (data, params) => parseAsync2(inst, data, params, { callee: inst.parseAsync });
@@ -97358,7 +97779,7 @@ data:
         init_skill_invoker();
         await init_skill_telemetry();
         await init_policy_enforcer();
-        VERSION = true ? "0.23.26" : "0.0.0-dev";
+        VERSION = true ? "0.23.27" : "0.0.0-dev";
       }
     });
     await init_index();
@@ -97368,37 +97789,17 @@ data:
 // src/index.ts
 init_config();
 init_log();
+init_fence_auth();
 import { chmodSync as chmodSync5, mkdirSync as mkdirSync6 } from "node:fs";
 
-// src/fence-auth.ts
-import { copyFileSync, chmodSync as chmodSync2, existsSync as existsSync2, mkdirSync as mkdirSync2 } from "node:fs";
-import { join as join2 } from "node:path";
-function seedFenceCredential(opts) {
-  const log = opts.log ?? (() => {
-  });
-  const fenceAuth = join2(opts.fenceHome, ".config", "muse", "auth.json");
-  if (existsSync2(fenceAuth)) {
-    log("[muse-bridge] fence credential already present; leaving it untouched");
-    return "already-present";
-  }
-  const hostAuth = join2(opts.hostHome, ".config", "muse", "auth.json");
-  if (!existsSync2(hostAuth)) {
-    log("[muse-bridge] no host credential to seed (run `muse login`, or set META_API_KEY)");
-    return "no-host-credential";
-  }
-  mkdirSync2(join2(opts.fenceHome, ".config", "muse"), { recursive: true });
-  copyFileSync(hostAuth, fenceAuth);
-  chmodSync2(fenceAuth, 384);
-  log("[muse-bridge] seeded fence credential from the host muse login");
-  return "seeded";
-}
-
 // src/muse-session.ts
 var MuseSession = class {
   constructor(driver, opts = {}) {
     this.driver = driver;
     this.opts = opts;
   }
+  driver;
+  opts;
   queue = [];
   running = false;
   current = null;
@@ -97503,7 +97904,7 @@ ${item.text}` : item.text;
 // src/muse-driver.ts
 import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync2, writeFileSync } from "node:fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "node:fs";
 import { join as join4 } from "node:path";
 
 // src/muse-spawn.ts
@@ -97560,6 +97961,7 @@ var MuseDriver = class {
     this.spawnFn = opts.spawnFn ?? defaultSpawn;
     this.turnTimeoutMs = opts.turnTimeoutMs ?? DEFAULT_TURN_TIMEOUT_MS;
   }
+  opts;
   spawnFn;
   turnTimeoutMs;
   persistedId = null;
@@ -97571,14 +97973,14 @@ var MuseDriver = class {
     mkdirSync3(this.opts.dataDir, { recursive: true });
     const file2 = join4(this.opts.dataDir, SESSION_FILE);
     if (existsSync3(file2)) {
-      const existing = readFileSync2(file2, "utf8").trim();
+      const existing = readFileSync3(file2, "utf8").trim();
       if (existing) {
         this.persistedId = existing;
         return existing;
       }
     }
     this.persistedId = randomUUID();
-    writeFileSync(file2, this.persistedId + "\n", { encoding: "utf8" });
+    writeFileSync2(file2, this.persistedId + "\n", { encoding: "utf8" });
     return this.persistedId;
   }
   sessionId() {
@@ -98092,7 +98494,7 @@ data: ${JSON.stringify(out)}
 }
 
 // src/settings-mcp.ts
-import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync2, chmodSync as chmodSync3 } from "node:fs";
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync3, chmodSync as chmodSync3 } from "node:fs";
 import { join as join5 } from "node:path";
 function writeFenceMcpSettings(fenceHome, opts) {
   const dir = join5(fenceHome, ".config", "muse");
@@ -98109,7 +98511,7 @@ function writeFenceMcpSettings(fenceHome, opts) {
       }
     }
   };
-  writeFileSync2(dest, JSON.stringify(body, null, 2) + "\n", { mode: 384 });
+  writeFileSync3(dest, JSON.stringify(body, null, 2) + "\n", { mode: 384 });
   chmodSync3(dest, 384);
 }
 
@@ -98271,7 +98673,7 @@ function mkdir700(path2) {
   chmodSync5(path2, 448);
 }
 function packageVersion() {
-  return true ? "0.1.1" : void 0;
+  return true ? "0.1.3" : void 0;
 }
 function helpText(version2) {
   return [
@@ -98332,6 +98734,14 @@ async function main(opts = {}) {
     hostHome: cfg.hostHome,
     log: (m2) => logLine(m2)
   });
+  harvestFenceApiKeyToSidecar({
+    dataDir: cfg.dataDir,
+    fenceHome: cfg.fenceHome,
+    log: (m2) => logLine(m2)
+  });
+  if (!cfg.apiKey) {
+    cfg.apiKey = readSidecarMetaApiKey(cfg.dataDir) || readFenceMetaApiKey(cfg.fenceHome) || void 0;
+  }
   let shuttingDown = false;
   let exiting = false;
   let driver;