@agentvault/muse-bridge 0.1.2 → 0.1.4

package/dist/index.js

@@ -9,20 +9,132 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/fence-auth.ts
+import {
+  copyFileSync,
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  unlinkSync,
+  writeFileSync
+} from "node:fs";
+import { join } from "node:path";
+function parseAuthJson(path2) {
+  try {
+    if (!existsSync(path2)) return void 0;
+    return JSON.parse(readFileSync(path2, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+function metaApiKeyFromAuth(parsed) {
+  if (!parsed || typeof parsed !== "object") return void 0;
+  const providers = parsed.providers;
+  if (!providers || typeof providers !== "object") return void 0;
+  const meta3 = providers.meta;
+  if (!meta3 || typeof meta3 !== "object") return void 0;
+  const key = meta3.api_key;
+  if (typeof key !== "string") return void 0;
+  const trimmed = key.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
+function isKeychainOnlyAuth(parsed) {
+  if (!parsed || typeof parsed !== "object") return false;
+  const providers = parsed.providers;
+  if (!providers || typeof providers !== "object") return false;
+  const meta3 = providers.meta;
+  if (!meta3 || typeof meta3 !== "object") return false;
+  return meta3.storage === "keychain" && !metaApiKeyFromAuth(parsed);
+}
+function readFenceMetaApiKey(fenceHome) {
+  return metaApiKeyFromAuth(parseAuthJson(join(fenceHome, ".config", "muse", "auth.json")));
+}
+function sidecarMetaApiKeyPath(dataDir) {
+  return join(dataDir, "meta-api-key.json");
+}
+function apiKeyFromSidecar(parsed) {
+  if (!parsed || typeof parsed !== "object") return void 0;
+  const key = parsed.api_key;
+  if (typeof key !== "string") return void 0;
+  const trimmed = key.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
+function readSidecarMetaApiKey(dataDir) {
+  return apiKeyFromSidecar(parseAuthJson(sidecarMetaApiKeyPath(dataDir)));
+}
+function harvestFenceApiKeyToSidecar(opts) {
+  const log = opts.log ?? (() => {
+  });
+  const fenceAuth = join(opts.fenceHome, ".config", "muse", "auth.json");
+  const fenceKey = readFenceMetaApiKey(opts.fenceHome);
+  const sidecar = sidecarMetaApiKeyPath(opts.dataDir);
+  const hadSidecar = !!readSidecarMetaApiKey(opts.dataDir);
+  if (fenceKey && !hadSidecar) {
+    mkdirSync(opts.dataDir, { recursive: true, mode: 448 });
+    writeFileSync(sidecar, JSON.stringify({ api_key: fenceKey }) + "\n", { encoding: "utf8" });
+    chmodSync(sidecar, 384);
+    log("[muse-bridge] moved fence Meta key out of auth.json so Muse will not hit the Keychain");
+  }
+  if (fenceKey && existsSync(fenceAuth)) {
+    unlinkSync(fenceAuth);
+  }
+  if (fenceKey && !hadSidecar) return "harvested";
+  if (hadSidecar) return "already-sidecar";
+  return "none";
+}
+function seedFenceCredential(opts) {
+  const log = opts.log ?? (() => {
+  });
+  const fenceAuth = join(opts.fenceHome, ".config", "muse", "auth.json");
+  if (existsSync(fenceAuth)) {
+    if (isKeychainOnlyAuth(parseAuthJson(fenceAuth))) {
+      unlinkSync(fenceAuth);
+      log(
+        "[muse-bridge] fence credential is keychain-only; removing it so the child does not hit the Keychain"
+      );
+    } else {
+      log("[muse-bridge] fence credential already present; leaving it untouched");
+      return "already-present";
+    }
+  }
+  const hostAuth = join(opts.hostHome, ".config", "muse", "auth.json");
+  if (!existsSync(hostAuth)) {
+    log("[muse-bridge] no host credential to seed (run `muse login`, or set META_API_KEY)");
+    return "no-host-credential";
+  }
+  if (isKeychainOnlyAuth(parseAuthJson(hostAuth))) {
+    log(
+      "[muse-bridge] host muse login is keychain-only; not copying it into the fence. Set META_API_KEY."
+    );
+    return "host-credential-keychain-only";
+  }
+  mkdirSync(join(opts.fenceHome, ".config", "muse"), { recursive: true });
+  copyFileSync(hostAuth, fenceAuth);
+  chmodSync(fenceAuth, 384);
+  log("[muse-bridge] seeded fence credential from the host muse login");
+  return "seeded";
+}
+var init_fence_auth = __esm({
+  "src/fence-auth.ts"() {
+    "use strict";
+  }
+});
+
 // src/config.ts
-import { existsSync, readFileSync, mkdirSync, chmodSync } from "node:fs";
-import { join, resolve, sep, dirname } from "node:path";
+import { existsSync as existsSync2, readFileSync as readFileSync2, mkdirSync as mkdirSync2, chmodSync as chmodSync2 } from "node:fs";
+import { join as join2, resolve, sep, dirname } from "node:path";
 import { tmpdir } from "node:os";
 function hasRecoverableBackup(dataDir) {
   try {
-    const parsed = JSON.parse(readFileSync(join(dataDir, BACKUP_FILE), "utf-8"));
+    const parsed = JSON.parse(readFileSync2(join2(dataDir, BACKUP_FILE), "utf-8"));
     return !!(parsed && parsed.deviceId && parsed.deviceJwt && parsed.sessions && Object.keys(parsed.sessions).length > 0);
   } catch {
     return false;
   }
 }
 function hasPersistedCreds(dataDir) {
-  if (CRED_FILES.some((f2) => existsSync(join(dataDir, f2)))) return true;
+  if (CRED_FILES.some((f2) => existsSync2(join2(dataDir, f2)))) return true;
   return hasRecoverableBackup(dataDir);
 }
 function slugify(name) {
@@ -54,8 +166,8 @@ function loadConfig(env, argv = []) {
   }
   const slug = slugify(agentName);
   const hostHome = env.HOME ?? "";
-  const dataDir = env.AV_DATA_DIR || join(hostHome, ".agentvault", "muse-room-bridge", slug);
-  const workspaceDir = env.AV_WORKSPACE_DIR || join(dirname(dataDir), "workspaces", slug);
+  const dataDir = env.AV_DATA_DIR || join2(hostHome, ".agentvault", "muse-room-bridge", slug);
+  const workspaceDir = env.AV_WORKSPACE_DIR || join2(dirname(dataDir), "workspaces", slug);
   const wsReal = resolve(workspaceDir);
   const ddReal = resolve(dataDir);
   if (wsReal === ddReal || wsReal.startsWith(ddReal + sep) || ddReal.startsWith(wsReal + sep)) {
@@ -64,8 +176,8 @@ function loadConfig(env, argv = []) {
     );
   }
   try {
-    mkdirSync(workspaceDir, { recursive: true, mode: 448 });
-    chmodSync(workspaceDir, 448);
+    mkdirSync2(workspaceDir, { recursive: true, mode: 448 });
+    chmodSync2(workspaceDir, 448);
   } catch (e) {
     throw new Error(
       `Failed to create/secure the agent workspace at ${workspaceDir} (override with AV_WORKSPACE_DIR): ${e.message}`
@@ -83,14 +195,15 @@ function loadConfig(env, argv = []) {
       "invite token required: pass it as the first argument or set AV_INVITE_TOKEN (or start from a data dir with existing credentials to reconnect)"
     );
   }
+  const fenceHome = env.AV_FENCE_HOME || join2(dataDir, "fence");
   return {
     inviteToken,
     dataDir,
     agentName,
     workspaceDir,
     musePath: env.AV_MUSE_PATH || "muse",
-    fenceHome: env.AV_FENCE_HOME || join(dataDir, "fence"),
-    apiKey: env.META_API_KEY || void 0,
+    fenceHome,
+    apiKey: env.META_API_KEY || readSidecarMetaApiKey(dataDir) || readFenceMetaApiKey(fenceHome) || void 0,
     hostHome,
     apiUrl: env.AV_API_URL ?? "https://api.agentvault.chat"
   };
@@ -99,6 +212,7 @@ var CRED_FILES, BACKUP_FILE, VERSION_FLAGS, HELP_FLAGS, KNOWN_FLAGS;
 var init_config = __esm({
   "src/config.ts"() {
     "use strict";
+    init_fence_auth();
     CRED_FILES = ["agentvault.json", "secure-channel.json"];
     BACKUP_FILE = "agentvault.json.bak";
     VERSION_FLAGS = ["--version", "-v"];
@@ -125,464 +239,6 @@ var init_log = __esm({
   }
 });
 
-// src/service/launcher.ts
-import { dirname as dirname2 } from "node:path";
-function sq(s2) {
-  return `'${s2.replace(/'/g, `'\\''`)}'`;
-}
-function candidateExpr(c2) {
-  return c2.includes("$") ? `"${c2}"` : sq(c2);
-}
-function renderLauncher(opts) {
-  const candidates = ["node", ...opts.fallbacks ?? FALLBACK_NODES];
-  const lines = [
-    "#!/usr/bin/env bash",
-    "# AgentVault muse-bridge launcher \u2014 regenerated on every `install`. Resolves node at",
-    "# boot so a node upgrade / version-manager switch can't strand the daemon."
-  ];
-  if (opts.installPath) lines.push(`export PATH=${sq(opts.installPath)}:"$PATH"`);
-  for (const c2 of candidates) {
-    lines.push(`if n=$(command -v ${candidateExpr(c2)} 2>/dev/null); then exec "$n" ${sq(opts.entrypoint)} "$@"; fi`);
-  }
-  lines.push(
-    `echo "[muse-bridge] node not found on PATH or known locations \u2014 re-run: agentvault-muse-bridge install" >&2`,
-    "exit 0"
-  );
-  return lines.join("\n") + "\n";
-}
-function writeLauncher(deps, spec) {
-  deps.mkdir(dirname2(spec.launcherPath));
-  deps.writeFile(spec.launcherPath, spec.launcherScript);
-  deps.chmod(spec.launcherPath, 493);
-}
-var FALLBACK_NODES;
-var init_launcher = __esm({
-  "src/service/launcher.ts"() {
-    "use strict";
-    FALLBACK_NODES = [
-      "/opt/homebrew/bin/node",
-      "/usr/local/bin/node",
-      "/usr/bin/node",
-      "$HOME/.volta/bin/node",
-      "$HOME/.asdf/shims/node",
-      "$HOME/.local/bin/node"
-    ];
-  }
-});
-
-// src/service/spec.ts
-import { join as join6 } from "node:path";
-function buildServiceSpec(cfg, opts) {
-  const env = {
-    AV_AGENT_NAME: cfg.agentName,
-    AV_DATA_DIR: cfg.dataDir,
-    AV_API_URL: cfg.apiUrl,
-    AV_FENCE_HOME: cfg.fenceHome,
-    AV_MUSE_PATH: cfg.musePath
-  };
-  if (cfg.workspaceDir) env.AV_WORKSPACE_DIR = cfg.workspaceDir;
-  const launcherPath = join6(cfg.dataDir, "launch-muse-bridge.sh");
-  return {
-    label: `dev.agentvault.muse-${slugify(cfg.agentName)}`,
-    programArgs: [launcherPath],
-    launcherPath,
-    launcherScript: renderLauncher({ installPath: opts.path, entrypoint: opts.entrypoint }),
-    env,
-    workingDir: cfg.workspaceDir ? cfg.workspaceDir : opts.home,
-    logOut: join6(cfg.dataDir, "logs", "muse-bridge.log"),
-    logErr: join6(cfg.dataDir, "logs", "muse-bridge.error.log"),
-    keepAliveUnlessCleanExit: true,
-    runAtLoad: true
-  };
-}
-var init_spec = __esm({
-  "src/service/spec.ts"() {
-    "use strict";
-    init_config();
-    init_launcher();
-  }
-});
-
-// src/service/launchd.ts
-import { dirname as dirname3, join as join7 } from "node:path";
-function esc(s2) {
-  return s2.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
-}
-function renderLaunchdPlist(spec) {
-  const args = spec.programArgs.map((a2) => `		<string>${esc(a2)}</string>`).join("\n");
-  const envEntries = Object.entries(spec.env).map(([k2, v2]) => `		<key>${esc(k2)}</key>
-		<string>${esc(v2)}</string>`).join("\n");
-  const keepAlive = spec.keepAliveUnlessCleanExit ? "<key>KeepAlive</key>\n	<dict>\n		<key>SuccessfulExit</key>\n		<false/>\n	</dict>" : "<key>KeepAlive</key>\n	<false/>";
-  return `<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>Label</key>
-	<string>${esc(spec.label)}</string>
-	<key>ProgramArguments</key>
-	<array>
-${args}
-	</array>
-	<key>EnvironmentVariables</key>
-	<dict>
-${envEntries}
-	</dict>
-	<key>WorkingDirectory</key>
-	<string>${esc(spec.workingDir)}</string>
-	<key>StandardOutPath</key>
-	<string>${esc(spec.logOut)}</string>
-	<key>StandardErrorPath</key>
-	<string>${esc(spec.logErr)}</string>
-	${keepAlive}
-	<key>RunAtLoad</key>
-	${spec.runAtLoad ? "<true/>" : "<false/>"}
-</dict>
-</plist>
-`;
-}
-function parsePlistEnv(xml) {
-  const out = {};
-  const keyIdx = xml.indexOf("<key>EnvironmentVariables</key>");
-  if (keyIdx < 0) return out;
-  const open = xml.indexOf("<dict>", keyIdx);
-  if (open < 0) return out;
-  let depth = 0;
-  let i2 = open;
-  let close = -1;
-  const tag = /<(\/?)dict>/g;
-  tag.lastIndex = open;
-  let m2;
-  while (m2 = tag.exec(xml)) {
-    depth += m2[1] ? -1 : 1;
-    if (depth === 0) {
-      close = m2.index;
-      break;
-    }
-    i2 = m2.index;
-  }
-  void i2;
-  if (close < 0) return out;
-  const body = xml.slice(open, close);
-  const pair = /<key>([\s\S]*?)<\/key>\s*<string>([\s\S]*?)<\/string>/g;
-  let p2;
-  while (p2 = pair.exec(body)) out[unesc(p2[1])] = unesc(p2[2]);
-  return out;
-}
-function unesc(s2) {
-  return s2.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&amp;/g, "&");
-}
-var LaunchdBackend;
-var init_launchd = __esm({
-  "src/service/launchd.ts"() {
-    "use strict";
-    init_launcher();
-    LaunchdBackend = class {
-      constructor(deps) {
-        this.deps = deps;
-      }
-      deps;
-      plistPath(label) {
-        return join7(this.deps.home, "Library", "LaunchAgents", `${label}.plist`);
-      }
-      domain() {
-        return `gui/${this.deps.uid}`;
-      }
-      install(spec) {
-        const path2 = this.plistPath(spec.label);
-        this.deps.mkdir(dirname3(spec.logOut));
-        writeLauncher(this.deps, spec);
-        this.deps.mkdir(dirname3(path2));
-        this.deps.writeFile(path2, renderLaunchdPlist(spec));
-        const svc = `${this.domain()}/${spec.label}`;
-        this.deps.exec("launchctl", ["bootout", svc]);
-        this.waitUntilGone(svc);
-        let r2 = this.deps.exec("launchctl", ["bootstrap", this.domain(), path2]);
-        for (let i2 = 0; i2 < 5 && r2.code !== 0; i2++) {
-          this.deps.exec("sleep", ["0.3"]);
-          r2 = this.deps.exec("launchctl", ["bootstrap", this.domain(), path2]);
-        }
-        this.deps.exec("launchctl", ["kickstart", "-k", svc]);
-      }
-      waitUntilGone(svc) {
-        for (let i2 = 0; i2 < 20; i2++) {
-          if (this.deps.exec("launchctl", ["print", svc]).code !== 0) return;
-          this.deps.exec("sleep", ["0.25"]);
-        }
-      }
-      restart(label) {
-        this.deps.exec("launchctl", ["kickstart", "-k", `${this.domain()}/${label}`]);
-      }
-      uninstall(label) {
-        this.deps.exec("launchctl", ["bootout", `${this.domain()}/${label}`]);
-        const path2 = this.plistPath(label);
-        if (this.deps.exists(path2)) this.deps.rm(path2);
-      }
-      status(label) {
-        const r2 = this.deps.exec("launchctl", ["print", `${this.domain()}/${label}`]);
-        return { loaded: r2.code === 0, detail: r2.stdout };
-      }
-      list(prefix) {
-        const dir = join7(this.deps.home, "Library", "LaunchAgents");
-        const out = [];
-        for (const name of this.deps.readdir(dir)) {
-          if (!name.startsWith(prefix) || !name.endsWith(".plist")) continue;
-          const path2 = join7(dir, name);
-          out.push({
-            label: name.slice(0, -".plist".length),
-            path: path2,
-            env: parsePlistEnv(this.deps.readFile(path2))
-          });
-        }
-        return out.sort((a2, b2) => a2.label.localeCompare(b2.label));
-      }
-    };
-  }
-});
-
-// src/service/systemd.ts
-import { dirname as dirname4, join as join8 } from "node:path";
-function q(s2) {
-  const esc3 = s2.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t").replace(/%/g, "%%");
-  return `"${esc3}"`;
-}
-function renderSystemdUnit(spec) {
-  const exec = spec.programArgs.map(q).join(" ");
-  const envLines = Object.entries(spec.env).map(([k2, v2]) => `Environment=${q(`${k2}=${v2}`)}`).join("\n");
-  return `[Unit]
-Description=AgentVault muse bridge (${spec.label})
-Wants=network-online.target
-After=network-online.target
-
-[Service]
-ExecStart=${exec}
-WorkingDirectory=${spec.workingDir}
-${envLines}
-Restart=on-failure
-SuccessExitStatus=0
-StandardOutput=append:${spec.logOut}
-StandardError=append:${spec.logErr}
-
-[Install]
-WantedBy=default.target
-`;
-}
-function parseUnitEnv(text) {
-  const out = {};
-  for (const line of text.split("\n")) {
-    const m2 = /^Environment="([\s\S]*)"\s*$/.exec(line.trim());
-    if (!m2) continue;
-    const eq = unq(m2[1]);
-    const at = eq.indexOf("=");
-    if (at <= 0) continue;
-    out[eq.slice(0, at)] = eq.slice(at + 1);
-  }
-  return out;
-}
-function unq(s2) {
-  return s2.replace(/%%/g, "%").replace(
-    /\\([\s\S])/g,
-    (_2, c2) => c2 === "n" ? "\n" : c2 === "r" ? "\r" : c2 === "t" ? "	" : c2
-  );
-}
-var SystemdBackend;
-var init_systemd = __esm({
-  "src/service/systemd.ts"() {
-    "use strict";
-    init_launcher();
-    SystemdBackend = class {
-      constructor(deps) {
-        this.deps = deps;
-      }
-      deps;
-      unitPath(label) {
-        return join8(this.deps.home, ".config", "systemd", "user", `${label}.service`);
-      }
-      install(spec) {
-        const path2 = this.unitPath(spec.label);
-        this.deps.mkdir(dirname4(spec.logOut));
-        writeLauncher(this.deps, spec);
-        this.deps.mkdir(dirname4(path2));
-        this.deps.writeFile(path2, renderSystemdUnit(spec));
-        this.deps.exec("loginctl", ["enable-linger", this.deps.user]);
-        this.deps.exec("systemctl", ["--user", "daemon-reload"]);
-        this.deps.exec("systemctl", ["--user", "enable", `${spec.label}.service`]);
-        this.deps.exec("systemctl", ["--user", "restart", `${spec.label}.service`]);
-      }
-      restart(label) {
-        this.deps.exec("systemctl", ["--user", "restart", `${label}.service`]);
-      }
-      uninstall(label) {
-        this.deps.exec("systemctl", ["--user", "disable", "--now", `${label}.service`]);
-        const path2 = this.unitPath(label);
-        if (this.deps.exists(path2)) this.deps.rm(path2);
-        this.deps.exec("systemctl", ["--user", "daemon-reload"]);
-      }
-      status(label) {
-        const enabled = this.deps.exec("systemctl", ["--user", "is-enabled", `${label}.service`]);
-        const active = this.deps.exec("systemctl", ["--user", "is-active", `${label}.service`]);
-        return { loaded: enabled.code === 0, detail: `${enabled.stdout.trim() || "?"} / ${active.stdout.trim() || "?"}` };
-      }
-      list(prefix) {
-        const dir = join8(this.deps.home, ".config", "systemd", "user");
-        const out = [];
-        for (const name of this.deps.readdir(dir)) {
-          if (!name.startsWith(prefix) || !name.endsWith(".service")) continue;
-          const path2 = join8(dir, name);
-          out.push({
-            label: name.slice(0, -".service".length),
-            path: path2,
-            env: parseUnitEnv(this.deps.readFile(path2))
-          });
-        }
-        return out.sort((a2, b2) => a2.label.localeCompare(b2.label));
-      }
-    };
-  }
-});
-
-// src/service/backend.ts
-import { spawnSync } from "node:child_process";
-import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync3, rmSync, existsSync as existsSync4, chmodSync as chmodSync4, readdirSync, readFileSync as readFileSync3 } from "node:fs";
-import { userInfo } from "node:os";
-function defaultDeps() {
-  return {
-    home: process.env.HOME ?? "",
-    uid: userInfo().uid,
-    user: userInfo().username,
-    exec: (cmd, args) => {
-      const r2 = spawnSync(cmd, args, { encoding: "utf8" });
-      return { code: r2.status ?? 1, stdout: r2.stdout ?? "" };
-    },
-    writeFile: (p2, d2) => writeFileSync3(p2, d2),
-    mkdir: (p2) => mkdirSync5(p2, { recursive: true }),
-    chmod: (p2, m2) => chmodSync4(p2, m2),
-    rm: (p2) => rmSync(p2, { force: true }),
-    exists: (p2) => existsSync4(p2),
-    readdir: (p2) => {
-      try {
-        return readdirSync(p2);
-      } catch {
-        return [];
-      }
-    },
-    readFile: (p2) => {
-      try {
-        return readFileSync3(p2, "utf8");
-      } catch {
-        return "";
-      }
-    }
-  };
-}
-function selectBackend(platform, deps) {
-  if (platform === "darwin") {
-    return new LaunchdBackend(deps ?? defaultDeps());
-  }
-  if (platform === "linux") {
-    return new SystemdBackend(deps ?? defaultDeps());
-  }
-  throw new Error(`unsupported platform for muse-bridge service install: ${platform}`);
-}
-var init_backend = __esm({
-  "src/service/backend.ts"() {
-    "use strict";
-    init_launchd();
-    init_systemd();
-  }
-});
-
-// src/service/subcommand.ts
-var subcommand_exports = {};
-__export(subcommand_exports, {
-  labelFor: () => labelFor,
-  maybeRunServiceSubcommand: () => maybeRunServiceSubcommand
-});
-import { join as join9 } from "node:path";
-function requireAgentName(env) {
-  const name = env.AV_AGENT_NAME?.trim();
-  if (!name) {
-    throw new Error(
-      "AV_AGENT_NAME is required \u2014 it names WHICH agent's service to act on. Re-run as: AV_AGENT_NAME=<agent-name> agentvault-muse-bridge <subcommand>"
-    );
-  }
-  return name;
-}
-function labelFor(env) {
-  return `dev.agentvault.muse-${slugify(requireAgentName(env))}`;
-}
-function dataDirFor(env, agentName) {
-  if (env.AV_DATA_DIR) return env.AV_DATA_DIR;
-  return join9(env.HOME ?? "", ".agentvault", "muse-room-bridge", slugify(agentName));
-}
-function maybeRunServiceSubcommand(argv, env, deps) {
-  const cmd = argv[2];
-  if (!cmd) return false;
-  if (!SERVICE_CMDS.has(cmd)) {
-    const looksLikeToken = cmd.startsWith("av_tok_");
-    const looksLikeFlag = cmd.startsWith("-");
-    if (!looksLikeToken && !looksLikeFlag) {
-      throw new Error(
-        `unknown subcommand: ${cmd} \u2014 expected one of ${[...SERVICE_CMDS].join(", ")}, an invite token, or no argument at all`
-      );
-    }
-    return false;
-  }
-  const backend = deps?.backend ?? selectBackend(process.platform);
-  const entrypoint = deps?.entrypoint ?? process.argv[1];
-  const log = deps?.log ?? ((m2) => logLine("[muse-bridge] " + m2));
-  try {
-    if (cmd === "install") {
-      const agentName = requireAgentName(env);
-      assertInstallableEntrypoint(entrypoint);
-      const dataDir = dataDirFor(env, agentName);
-      if (!hasPersistedCreds(dataDir)) {
-        throw new Error(
-          "cannot install a supervised service before this agent has enrolled \u2014 run agentvault-muse-bridge <invite-token> once so credentials persist, then: AV_AGENT_NAME=<agent-name> agentvault-muse-bridge install"
-        );
-      }
-      const cfg = loadConfig(env, []);
-      const spec = buildServiceSpec(cfg, {
-        entrypoint,
-        home: env.HOME ?? "",
-        path: env.PATH ?? ""
-      });
-      backend.install(spec);
-      log(`installed service ${spec.label} \u2014 logs: ${spec.logErr}`);
-      log(`check it with: AV_AGENT_NAME=${cfg.agentName} agentvault-muse-bridge status`);
-    } else if (cmd === "uninstall") {
-      const label = labelFor(env);
-      backend.uninstall(label);
-      log(`uninstalled service ${label}`);
-    } else if (cmd === "restart") {
-      const label = labelFor(env);
-      backend.restart(label);
-      log(`restarted service ${label}`);
-    } else if (cmd === "status") {
-      const label = labelFor(env);
-      const st = backend.status(label);
-      log(`${label}: ${st.loaded ? "loaded" : "not loaded"}`);
-    } else if (cmd === "logs") {
-      const label = labelFor(env);
-      log(`logs for ${label} are at <dataDir>/logs/muse-bridge.log (tail -f it)`);
-    }
-  } catch (e) {
-    log(e.message);
-    process.exitCode = 1;
-  }
-  return true;
-}
-var SERVICE_CMDS;
-var init_subcommand = __esm({
-  "src/service/subcommand.ts"() {
-    "use strict";
-    init_config();
-    init_log();
-    init_spec();
-    init_backend();
-    SERVICE_CMDS = /* @__PURE__ */ new Set(["install", "uninstall", "restart", "status", "logs"]);
-  }
-});
-
 // ../plugin/dist/index.js
 var dist_exports = {};
 __export(dist_exports, {
@@ -611,6 +267,8 @@ __export(dist_exports, {
   mergeSkills: () => mergeSkills,
   onAgentEvent: () => onAgentEvent,
   onSessionTranscriptUpdate: () => onSessionTranscriptUpdate,
+  owesRoomReply: () => owesRoomReply,
+  parseMentions: () => parseMentions,
   parseSkillMd: () => parseSkillMd,
   parseTarget: () => parseTarget,
   reportSkillInvocation: () => reportSkillInvocation,
@@ -621,12 +279,13 @@ __export(dist_exports, {
   sendToRoom: () => sendToRoom,
   sendToTarget: () => sendToTarget,
   setOcRuntime: () => setOcRuntime,
+  stripMentions: () => stripMentions,
   wrapSkillExecution: () => wrapSkillExecution
 });
 import * as nc from "node:crypto";
 import { chmod, mkdir, writeFile } from "node:fs/promises";
 import { readdir, readFile, rename, rm } from "node:fs/promises";
-import { join as join10 } from "node:path";
+import { join as join6 } from "node:path";
 import { readFile as readFile2, rename as rename2, rm as rm2 } from "node:fs/promises";
 import { join as join22 } from "node:path";
 import { Readable } from "node:stream";
@@ -648,8 +307,19 @@ import { Http2ServerRequest as Http2ServerRequest2 } from "http2";
 import { Http2ServerRequest } from "http2";
 import { Readable as Readable2 } from "stream";
 import crypto3 from "crypto";
-import { readFileSync as readFileSync22, existsSync as existsSync5, readdirSync as readdirSync2 } from "node:fs";
+import { readFileSync as readFileSync22, existsSync as existsSync4, readdirSync } from "node:fs";
 import { resolve as resolve22, join as join52 } from "node:path";
+function stripWrappers(s2) {
+  let start = 0;
+  let end = s2.length;
+  while (start < end && WRAPPERS.includes(s2[start])) start++;
+  while (end > start && WRAPPERS.includes(s2[end - 1])) end--;
+  return s2.slice(start, end);
+}
+function isAbstention(text) {
+  if (typeof text !== "string") return false;
+  return stripWrappers(text).toLowerCase().startsWith(SENTINEL);
+}
 function toEpoch(v2) {
   if (typeof v2 === "bigint") return v2;
   if (typeof v2 === "number") {
@@ -1226,7 +896,7 @@ function W(e) {
   var n2 = p(t2, e);
   return g(r2), n2;
 }
-function q2(e, r2, t2) {
+function q(e, r2, t2) {
   var _2 = [];
   i(t2);
   var n2 = u(e = E(_2, e, "message")), s2 = e.length;
@@ -11646,7 +11316,7 @@ async function writeSecureFile(filePath, data, flag) {
 }
 function syncLockPath(dataDir, channelId) {
   const safe = channelId.replace(/[^a-zA-Z0-9_-]/g, "_");
-  return join10(dataDir, `mls-a2a-sync-${safe}.lock`);
+  return join6(dataDir, `mls-a2a-sync-${safe}.lock`);
 }
 async function acquireA2ASyncLock(dataDir, channelId) {
   await ensureSecureDir(dataDir);
@@ -11729,12 +11399,12 @@ async function clearPendingWelcome(dataDir, groupId) {
 }
 async function saveMlsState(dataDir, groupId, state) {
   await ensureSecureDir(dataDir);
-  const filePath = join10(dataDir, mlsFileName(groupId));
+  const filePath = join6(dataDir, mlsFileName(groupId));
   await writeSecureFile(filePath, state);
 }
 async function loadMlsState(dataDir, groupId) {
   try {
-    const filePath = join10(dataDir, mlsFileName(groupId));
+    const filePath = join6(dataDir, mlsFileName(groupId));
     return await readFile(filePath, "utf-8");
   } catch {
     return null;
@@ -11742,7 +11412,7 @@ async function loadMlsState(dataDir, groupId) {
 }
 async function deleteMlsState(dataDir, groupId) {
   try {
-    const filePath = join10(dataDir, mlsFileName(groupId));
+    const filePath = join6(dataDir, mlsFileName(groupId));
     await rm(filePath);
   } catch {
   }
@@ -11769,7 +11439,7 @@ async function quarantineOrphanedMlsState(dataDir, isStillMember, opts = {}) {
     }
     if (member === null || member === true) continue;
     try {
-      await rename(join10(dataDir, name), join10(dataDir, `${name}.orphaned`));
+      await rename(join6(dataDir, name), join6(dataDir, `${name}.orphaned`));
       quarantined.push(groupId);
     } catch {
     }
@@ -11795,10 +11465,10 @@ async function joinWithFirstMatchingKp(welcomeBytes, candidates) {
   return null;
 }
 function ownIdentity() {
-  const v2 = true ? "0.23.27" : FALLBACK;
+  const v2 = true ? "0.23.29" : FALLBACK;
   return `${PACKAGE}@${v2}`;
 }
-function buildClientVersion2(override) {
+function buildClientVersion(override) {
   try {
     const candidate = (override ?? "").trim();
     if (candidate) {
@@ -12520,7 +12190,7 @@ function formatChannelError(err) {
   }
   return `[AgentVault] channel error (non-fatal to the connection): ${msg}`;
 }
-function attachLifecycle2(channel, opts = {}) {
+function attachLifecycle(channel, opts = {}) {
   const log = opts.log ?? (() => {
   });
   const agentName = opts.agentName ?? "";
@@ -12793,6 +12463,51 @@ async function checkGateway(options) {
     return { ok: false, error: friendlyError(err) };
   }
 }
+function parseMentions(text) {
+  const mentions = [];
+  const re2 = /@(\w[\w]*)/gi;
+  let match;
+  while ((match = re2.exec(text)) !== null) {
+    mentions.push(match[1].toLowerCase());
+  }
+  return mentions;
+}
+function owesRoomReply(plaintext, agentName, accountId, senderIsAgent, roomDisplayName, ownDisplayName, selfResolved = true) {
+  const mentions = parseMentions(plaintext);
+  if (mentions.length === 0) return false;
+  if (mentions.includes("all") || mentions.includes("everyone")) {
+    return senderIsAgent !== true;
+  }
+  const ownNames = ownRoomNames(agentName, accountId, roomDisplayName, ownDisplayName);
+  if (mentions.some((m2) => ownNames.has(m2))) return true;
+  if (!selfResolved) return true;
+  return false;
+}
+function ownRoomNames(agentName, accountId, roomDisplayName, ownDisplayName) {
+  const names = /* @__PURE__ */ new Set();
+  const add4 = (n2) => {
+    if (!n2) return;
+    const lower = n2.toLowerCase();
+    names.add(lower);
+    names.add(lower.split(/[\s(]/)[0]);
+  };
+  add4(agentName);
+  add4(accountId);
+  add4(roomDisplayName);
+  add4(ownDisplayName);
+  return names;
+}
+function stripMentions(text, agentName, accountId, roomDisplayName, ownDisplayName) {
+  const ownNames = ownRoomNames(agentName, accountId, roomDisplayName, ownDisplayName);
+  return text.replace(/@(\w[\w]*)/gi, (full, name) => {
+    const lower = name.toLowerCase();
+    if (ownNames.has(lower)) {
+      return "";
+    }
+    if (lower === "all" || lower === "everyone") return "";
+    return full;
+  }).replace(/^\s+/, "").trim();
+}
 function getErrorMap() {
   return overrideErrorMap;
 }
@@ -13166,7 +12881,7 @@ function randomString(length = 10) {
   }
   return str;
 }
-function esc2(str) {
+function esc(str) {
   return JSON.stringify(str);
 }
 function slugify2(input) {
@@ -17076,7 +16791,7 @@ function parseSimpleYaml(yaml) {
 function loadSkillsFromDirectory(dir) {
   const skills = [];
   const absDir = resolve22(dir);
-  if (!existsSync5(absDir)) return skills;
+  if (!existsSync4(absDir)) return skills;
   const seen = /* @__PURE__ */ new Set();
   function tryLoad(filePath) {
     if (seen.has(filePath)) return;
@@ -17089,13 +16804,13 @@ function loadSkillsFromDirectory(dir) {
     }
   }
   try {
-    const entries = readdirSync2(absDir, { withFileTypes: true });
+    const entries = readdirSync(absDir, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.isFile() && entry.name.endsWith("SKILL.md")) {
         tryLoad(join52(absDir, entry.name));
       } else if (entry.isDirectory()) {
         const subSkill = join52(absDir, entry.name, "SKILL.md");
-        if (existsSync5(subSkill)) {
+        if (existsSync4(subSkill)) {
           tryLoad(subSkill);
         }
       }
@@ -17323,7 +17038,7 @@ function reportSkillInvocation(opts) {
   spanBuffer.push(span);
   return span;
 }
-var __create, __defProp2, __getOwnPropDesc, __getOwnPropNames2, __getProtoOf, __hasOwnProp, __esm2, __commonJS, __export2, __copyProps, __toESM, init_mls_commit_classify, __filename, __dirname, url2, path, Module, Module, root, window_, crypto_, randomValuesStandard, crypto4, randomValueNodeJS, _Module, libsodium_sumo_default, init_libsodium_sumo, a, r, t, c, libsodium_wrappers_default, init_libsodium_wrappers, init_keys, init_x3dh, MAX_SKIP, CHAIN_KEY_SEED, MSG_KEY_SEED, HEADER_KEY_SEED, DoubleRatchet, init_ratchet, init_file_crypto, DOMAIN_DID_DOCUMENT, DOMAIN_TRANSFER_INTENT, DOMAIN_TRANSFER_ACCEPT, BASE58_ALPHABET, init_did, BUILTIN_PATTERNS, ScanEngine, init_scan_engine, init_merkle, VC_CONTEXT_V2, AV_CREDENTIAL_CONTEXT, CRYPTOSUITE, BASE58_ALPHABET2, init_vc, init_transport, init_telemetry, TelemetryReporter, init_telemetry_reporter, CROCKFORD, ARGON2_OPSLIMIT, ARGON2_MEMLIMIT, SALT_BYTES, NONCE_BYTES, KEY_BYTES, BACKUP_VERSION, MAX_BACKUP_SIZE, init_backup, init_approval, encVoid, init_tlsEncoder, uint8Encoder, encodeUint8, decodeUint8, uint16Encoder, encodeUint16, decodeUint16, uint32Encoder, encodeUint32, decodeUint32, uint64Encoder, encodeUint64, decodeUint64, init_number, init_tlsDecoder, init_enumHelpers, defaultProposalTypes, defaultProposalTypeEncoder, encodeDefaultProposalType, decodeDefaultProposalType, init_defaultProposalType, defaultExtensionTypes, defaultExtensionTypeEncoder, encodeDefaultExtensionType, decodeDefaultExtensionType, init_defaultExtensionType, acceptAll, init_incomingMessageAction, MlsError, ValidationError, CodecError, UsageError, DependencyError, CryptoVerificationError, CryptoError, InternalError, init_mlsError, init_byteArray, varLenDataEncoder, decodeVarLenData, init_variableLength, init_constantTimeCompare, extensionTypeEncoder, encodeExtensionType, decodeExtensionType, extensionEncoder, encodeExtension, decodeExtension, init_extension, credentialTypes, credentialTypeEncoder, encodeCredentialType, decodeCredentialType, init_credentialType, credentialBasicEncoder, encodeCredentialBasic, credentialX509Encoder, encodeCredentialX509, credentialCustomEncoder, encodeCredentialCustom, credentialEncoder, encodeCredential, decodeCredentialBasic, decodeCredentialX509, decodeCredential, init_credential, externalSenderEncoder, encodeExternalSender, decodeExternalSender, init_externalSender, init_hash, init_optional, ciphersuites, ciphersuiteEncoder, encodeCiphersuite, decodeCiphersuite, ciphersuiteValues, init_ciphersuite, init_signature, protocolVersions, protocolVersionEncoder, encodeProtocolVersion, decodeProtocolVersion, init_protocolVersion, capabilitiesEncoder, encodeCapabilities, decodeCapabilities, init_capabilities, leafNodeSources, leafNodeSourceEncoder, encodeLeafNodeSource, decodeLeafNodeSource, init_leafNodeSource, lifetimeEncoder, encodeLifetime, decodeLifetime, defaultLifetime, init_lifetime, leafNodeDataEncoder, encodeLeafNodeData, decodeLeafNodeData, leafNodeInfoKeyPackageEncoder, encodeLeafNodeInfoKeyPackage, leafNodeInfoUpdateOmittedEncoder, encodeLeafNodeInfoUpdateOmitted, leafNodeInfoCommitOmittedEncoder, encodeLeafNodeInfoCommitOmitted, leafNodeInfoOmittedEncoder, encodeLeafNodeInfoOmitted, decodeLeafNodeInfoKeyPackage, decodeLeafNodeInfoUpdateOmitted, decodeLeafNodeInfoCommitOmitted, decodeLeafNodeInfoOmitted, leafNodeInfoUpdateEncoder, encodeLeafNodeInfoUpdate, leafNodeInfoCommitEncoder, encodeLeafNodeInfoCommit, leafNodeInfoEncoder, encodeLeafNodeInfo, decodeLeafNodeInfoUpdate, decodeLeafNodeInfoCommit, decodeLeafNodeInfo, leafNodeTBSEncoder, encodeLeafNodeTBS, leafNodeEncoder, encodeLeafNode, decodeLeafNode, decodeLeafNodeKeyPackage, decodeLeafNodeCommit, decodeLeafNodeUpdate, init_leafNode, keyPackageTBSEncoder, encodeKeyPackageTBS, decodeKeyPackageTBS, keyPackageEncoder, encodeKeyPackage, decodeKeyPackage, init_keyPackage, init_kdf, pskTypes, pskTypeEncoder, encodePskType, decodePskType, resumptionPSKUsages, resumptionPSKUsageEncoder, encodeResumptionPSKUsage, decodeResumptionPSKUsage, encodePskInfoExternal, encodePskInfoResumption, decodePskInfoResumption, pskInfoEncoder, encodePskInfo, decodePskInfo, pskIdEncoder, encodePskId, decodePskId, pskLabelEncoder, encodePskLabel, decodePskLabel, init_presharedkey, addEncoder, encodeAdd, decodeAdd, updateEncoder, encodeUpdate, decodeUpdate, removeEncoder, encodeRemove, decodeRemove, pskEncoder, encodePSK, decodePSK, reinitEncoder, encodeReinit, decodeReinit, externalInitEncoder, encodeExternalInit, decodeExternalInit, groupContextExtensionsEncoder, encodeGroupContextExtensions, decodeGroupContextExtensions, proposalAddEncoder, encodeProposalAdd, proposalUpdateEncoder, encodeProposalUpdate, proposalRemoveEncoder, encodeProposalRemove, proposalPSKEncoder, encodeProposalPSK, proposalReinitEncoder, encodeProposalReinit, proposalExternalInitEncoder, encodeProposalExternalInit, proposalGroupContextExtensionsEncoder, encodeProposalGroupContextExtensions, proposalCustomEncoder, encodeProposalCustom, proposalEncoder, encodeProposal, decodeProposalAdd, decodeProposalUpdate, decodeProposalRemove, decodeProposalPSK, decodeProposalReinit, decodeProposalExternalInit, decodeProposalGroupContextExtensions, decodeProposal, init_proposal, proposalOrRefTypes, proposalOrRefTypeEncoder, encodeProposalOrRefType, decodeProposalOrRefType, proposalOrRefProposalEncoder, encodeProposalOrRefProposal, proposalOrRefProposalRefEncoder, encodeProposalOrRefProposalRef, proposalOrRefEncoder, encodeProposalOrRef, decodeProposalOrRef, init_proposalOrRefType, init_hpke, groupContextEncoder, encodeGroupContext, decodeGroupContext, init_groupContext, nodeTypes, nodeTypeEncoder, encodeNodeType, decodeNodeType, init_nodeType, parentNodeEncoder, encodeParentNode, decodeParentNode, init_parentNode, init_treemath, nodeEncoder, encodeNode, decodeNode, ratchetTreeEncoder, encodeRatchetTree, decodeRatchetTree, init_ratchetTree, leafNodeHashInputEncoder, encodeLeafNodeHashInput, decodeLeafNodeHashInput, parentNodeHashInputEncoder, encodeParentNodeHashInput, decodeParentNodeHashInput, treeHashInputEncoder, encodeTreeHashInput, decodeTreeHashInput, init_treeHash, parentHashInputEncoder, encodeParentHashInput, decodeParentHashInput, init_parentHash, hpkeCiphertextEncoder, encodeHpkeCiphertext, decodeHpkeCiphertext, init_hpkeCiphertext, updatePathNodeEncoder, encodeUpdatePathNode, decodeUpdatePathNode, updatePathEncoder, encodeUpdatePath, decodeUpdatePath, init_updatePath, commitEncoder, encodeCommit, decodeCommit, init_commit, contentTypes, contentTypeEncoder, encodeContentType, decodeContentType, init_contentType, wireformats, wireformatEncoder, encodeWireformat, decodeWireformat, init_wireformat, senderTypes, senderTypeEncoder, encodeSenderType, decodeSenderType, senderEncoder, encodeSender, decodeSender, reuseGuardEncoder, encodeReuseGuard, decodeReuseGuard, senderDataEncoder, encodeSenderData, decodeSenderData, senderDataAADEncoder, encodeSenderDataAAD, decodeSenderDataAAD, init_sender, framedContentApplicationDataEncoder, encodeFramedContentApplicationData, framedContentProposalDataEncoder, encodeFramedContentProposalData, framedContentCommitDataEncoder, encodeFramedContentCommitData, framedContentInfoEncoder, encodeFramedContentInfo, decodeFramedContentApplicationData, decodeFramedContentProposalData, decodeFramedContentCommitData, decodeFramedContentInfo, framedContentEncoder, encodeFramedContent, decodeFramedContent, senderInfoEncoder, encodeSenderInfo, framedContentTBSEncoder, encodeFramedContentTBS, encodeFramedContentAuthDataContent, encodeFramedContentAuthDataCommit, framedContentAuthDataEncoder, encodeFramedContentAuthData, decodeFramedContentAuthDataCommit, init_framedContent, authenticatedContentEncoder, encodeAuthenticatedContent, decodeAuthenticatedContent, authenticatedContentTBMEncoder, encodeAuthenticatedContentTBM, init_authenticatedContent, publicMessageInfoEncoder, encodePublicMessageInfo, publicMessageEncoder, encodePublicMessage, decodePublicMessage, init_publicMessage, init_messageProtectionPublic, init_externalProposal, requiredCapabilitiesEncoder, encodeRequiredCapabilities, decodeRequiredCapabilities, init_requiredCapabilities, defaultAuthenticationService, init_authenticationService, defaultPaddingConfig, init_paddingConfig, defaultKeyPackageEqualityConfig, init_keyPackageEqualityConfig, defaultLifetimeConfig, init_lifetimeConfig, defaultKeyRetentionConfig, init_keyRetentionConfig, groupInfoTBSEncoder, encodeGroupInfoTBS, decodeGroupInfoTBS, groupInfoEncoder, encodeGroupInfo, decodeGroupInfo, init_groupInfo, keyScheduleEncoder, encodeKeySchedule, decodeKeySchedule, init_keySchedule, generationSecretEncoder, decodeGenerationSecret, secretTreeNodeEncoder, decodeSecretTreeNode, secretTreeEncoder, decodeSecretTree, init_secretTree, confirmedTranscriptHashInputEncoder, encodeConfirmedTranscriptHashInput, decodeConfirmedTranscriptHashInput, init_transcriptHash, groupSecretsEncoder, encodeGroupSecrets, decodeGroupSecrets, init_groupSecrets, encryptedGroupSecretsEncoder, encodeEncryptedGroupSecrets, decodeEncryptedGroupSecrets, welcomeEncoder, encodeWelcome, decodeWelcome, init_welcome, init_pathSecrets, privateKeyPathEncoder, decodePrivateKeyPath, init_privateKeyPath, proposalWithSenderEncoder, decodeProposalWithSender, unappliedProposalsEncoder, decodeUnappliedProposals, init_unappliedProposals, emptyPskIndex, init_pskIndex, init_addToMap, defaultClientConfig, init_clientConfig, init_array, stringEncoder, encodeString, decodeString, init_string, activeEncoder, suspendedPendingReinitEncoder, removedFromGroupEncoder, groupActiveStateEncoder, decodeGroupActiveState, init_groupActiveState, epochReceiverDataEncoder, decodeEpochReceiverData, init_epochReceiverData, groupStateEncoder, encodeGroupState, decodeGroupState, groupStateEncoderWithoutTree, encodeGroupStateWithoutTree, emptyProposals, init_clientState, privateMessageEncoder, encodePrivateMessage, decodePrivateMessage, privateContentAADEncoder, encodePrivateContentAAD, decodePrivateContentAAD, init_privateMessage, init_messageProtection, init_createMessage, init_createCommit, init_processMessages, init_makeHashImpl, HpkeError, InvalidParamError, SerializeError, DeserializeError, EncapError, DecapError, ExportError, SealError, OpenError, MessageLimitReachedError, DeriveKeyPairError, NotSupportedError, init_errors, dntGlobals, dntGlobalThis, init_dnt_shims, NativeAlgorithm, init_algorithm, Mode, KemId, KdfId, AeadId, init_identifiers, INPUT_LENGTH_LIMIT, INFO_LENGTH_LIMIT, MINIMUM_PSK_LENGTH, EMPTY, BYTE_TO_BIGINT_256, init_consts, SUITE_ID_HEADER_KEM, init_kemInterface, HPKE_VERSION, HkdfNative, HkdfSha256Native, HkdfSha384Native, HkdfSha512Native, init_hkdf, isCryptoKeyPair, init_misc, LABEL_EAE_PRK, LABEL_SHARED_SECRET, Dhkem, init_dhkem, KEM_USAGES, LABEL_DKP_PRK, LABEL_SK, init_dhkemPrimitives, Bignum, init_bignum, LABEL_CANDIDATE, ORDER_P_256, ORDER_P_384, ORDER_P_521, PKCS8_ALG_ID_P_256, PKCS8_ALG_ID_P_384, PKCS8_ALG_ID_P_521, EC_P_256_PARAMS, EC_P_384_PARAMS, EC_P_521_PARAMS, Ec, init_ec, init_xCryptoKey, init_xCurve, init_hybridkem, AEAD_USAGES, init_aeadEncryptionContext, _endianTestBuffer, _endianTestBytes, isLE, init_noble, init_hash2, _HMAC, hmac, init_hmac, init_md, U32_MASK64, _32n, init_u64, init_sha2, _0n, _1n, _2n, _7n, _256n, _0x71n, SHA3_PI, SHA3_ROTL, _SHA3_IOTA, IOTAS, SHA3_IOTA_H, SHA3_IOTA_L, init_sha3, init_modular, init_curve, init_montgomery, init_mod, AesGcmContext, Aes128Gcm, Aes256Gcm, init_aesGcm, init_exportOnly, init_emitNotSupported, LABEL_SEC, ExporterContextImpl, RecipientExporterContextImpl, SenderExporterContextImpl, init_exporterContext, EncryptionContextImpl, init_encryptionContext, __classPrivateFieldGet, __classPrivateFieldSet, _Mutex_locked, Mutex, init_mutex, __classPrivateFieldGet2, __classPrivateFieldSet2, _RecipientContextImpl_mutex, RecipientContextImpl, init_recipientContext, __classPrivateFieldGet3, __classPrivateFieldSet3, _SenderContextImpl_mutex, SenderContextImpl, init_senderContext, LABEL_BASE_NONCE, LABEL_EXP, LABEL_INFO_HASH, LABEL_KEY, LABEL_PSK_ID_HASH, LABEL_SECRET, SUITE_ID_HEADER_HPKE, CipherSuiteNative, init_cipherSuiteNative, DhkemP256HkdfSha256Native, DhkemP384HkdfSha384Native, DhkemP521HkdfSha512Native, init_dhkemNative, CipherSuite, DhkemP256HkdfSha256, DhkemP384HkdfSha384, DhkemP521HkdfSha512, HkdfSha256, HkdfSha384, HkdfSha512, init_native, ALG_NAME, PKCS8_ALG_ID_X25519, BASE_POINT_X25519, X25519, init_x25519, DhkemX25519HkdfSha256, init_dhkemX25519, PKCS8_ALG_ID_X448, init_x448, init_dhkemX448, init_mod2, init_hpke2, isLE2, wrapCipher, init_utils, encodeStr, sigma16, sigma32, sigma16_32, sigma32_32, BLOCK_LEN, BLOCK_LEN32, MAX_COUNTER, U32_EMPTY, _XorStreamPRG, createPRG, init_arx, Poly1305, poly1305, init_poly1305, chacha_exports, chacha20orig, chacha20, xchacha20, chacha8, chacha12, ZEROS16, updatePadded, ZEROS32, _poly1305_aead, chacha20poly1305, xchacha20poly1305, rngChacha20, rngChacha8, init_chacha, init_makeAead, init_makeKdfImpl, init_makeDhKem, init_makeHpke, defaultRng, init_rng, crypto2, init_cryptoNode, isLE3, swap32IfBE2, hasHexBuiltin, hexes, asciis, Hash, init_utils2, HashMD2, SHA256_IV2, SHA384_IV2, SHA512_IV2, init_md2, U32_MASK642, _32n2, shrSH2, shrSL2, rotrSH2, rotrSL2, rotrBH2, rotrBL2, rotlSH2, rotlSL2, rotlBH2, rotlBL2, add3L2, add3H2, add4L2, add4H2, add5L2, add5H2, init_u642, SHA256_K, SHA256_W, SHA256, K512, SHA512_Kh, SHA512_Kl, SHA512_W_H, SHA512_W_L, SHA512, SHA384, sha2563, sha5122, sha3842, init_sha22, _0n2, _1n2, isPosBig, bitMask, notImplemented, init_utils3, _0n3, _1n3, _2n2, _3n, _4n, _5n, _7n2, _8n, _9n, _16n, isNegativeLE, FIELD_FIELDS, init_modular2, _0n4, _1n4, pointPrecomputes, pointWindowSizes, wNAF, init_curve2, _0n5, _1n5, _2n3, _8n2, PrimeEdwardsPoint, init_edwards, os2ip, _DST_scalar, init_hash_to_curve, _0n6, _1n6, _2n4, init_montgomery2, ed25519_exports, _0n7, _1n7, _2n5, _3n2, _5n2, _8n3, ed25519_CURVE_p, ed25519_CURVE, ED25519_SQRT_M1, Fp, Fn, ed25519Defaults, ed25519, ed25519ctx, ed25519ph, x25519, ELL2_C1, ELL2_C2, ELL2_C3, ELL2_C1_EDWARDS, ed25519_hasher, SQRT_M1, SQRT_AD_MINUS_ONE, INVSQRT_A_MINUS_D, ONE_MINUS_D_SQ, D_MINUS_ONE_SQ, invertSqrt, MAX_255B, bytes255ToNumberLE, _RistrettoPoint, ristretto255, ristretto255_hasher, ED25519_TORSION_SUBGROUP, edwardsToMontgomery, RistrettoPoint, hashToCurve, encodeToCurve, hashToRistretto255, hash_to_ristretto255, init_ed25519, _0n8, _1n8, _2n6, _7n3, _256n2, _0x71n2, SHA3_PI2, SHA3_ROTL2, _SHA3_IOTA2, IOTAS2, SHA3_IOTA_H2, SHA3_IOTA_L2, rotlH, rotlL, Keccak, genShake, shake2562, init_sha32, ed448_exports, ed448_CURVE, E448_CURVE, shake256_114, shake256_64, _1n9, _2n7, _3n3, _4n2, _11n, _22n, _44n, _88n, _223n, Fp2, Fn2, Fp448, Fn448, ED448_DEF, ed448, ed448ph, E448, x448, ELL2_C12, ELL2_J, ed448_hasher, ONE_MINUS_D, ONE_MINUS_TWO_D, SQRT_MINUS_D, INVSQRT_MINUS_D, invertSqrt2, _DecafPoint, decaf448, decaf448_hasher, ED448_TORSION_SUBGROUP, DecafPoint, hashToCurve2, encodeToCurve2, hashToDecaf448, hash_to_decaf448, edwardsToMontgomery2, init_ed448, HMAC, hmac2, init_hmac2, divNearest, DERErr, DER, _0n9, _1n10, _2n8, _3n4, _4n3, init_weierstrass, init_shortw_utils, nist_exports, p256_CURVE, p384_CURVE, p521_CURVE, Fp256, Fp384, Fp521, p256, p256_hasher, p384, p384_hasher, p521, secp256r1, secp384r1, secp521r1, p521_hasher, init_nist, init_makeNobleSignatureImpl, defaultCryptoProvider, init_provider, init_getCiphersuiteImpl, init_resumption, oidNist2, init_utils4, HashMD3, SHA256_IV3, SHA384_IV3, SHA512_IV3, init_md3, U32_MASK643, _32n3, shrSH3, shrSL3, rotrSH3, rotrSL3, rotrBH3, rotrBL3, add3L3, add3H3, add4L3, add4H3, add5L3, add5H3, init_u643, SHA256_K2, SHA256_W2, SHA2_32B, _SHA256, K5122, SHA512_Kh2, SHA512_Kl2, SHA512_W_H2, SHA512_W_L2, SHA2_64B, _SHA512, _SHA384, sha2564, sha5123, sha3843, init_sha23, _HMAC2, hmac3, init_hmac3, init_makeHashImpl2, init_makeNobleSignatureImpl2, BLOCK_SIZE, ZEROS162, ZEROS322, POLY, mul2, swapLE, estimateWindow, GHASH, Polyval, ghash, polyval, init_polyval, BLOCK_SIZE2, BLOCK_SIZE32, EMPTY_BLOCK, POLY2, sbox, rotr32_8, rotl32_8, tableEncoding, xPowers, gcm, _CMAC, cmac, init_aes, init_makeAead2, init_makeKdfImpl2, init_makeDhKem2, init_makeHpke2, init_rng2, nobleCryptoProvider, init_provider2, mlsPublicMessageEncoder, encodeMlsPublicMessage, mlsWelcomeEncoder, encodeMlsWelcome, mlsPrivateMessageEncoder, encodeMlsPrivateMessage, mlsGroupInfoEncoder, encodeMlsGroupInfo, mlsKeyPackageEncoder, encodeMlsKeyPackage, mlsMessageContentEncoder, encodeMlsMessageContent, decodeMlsMessageContent, mlsMessageEncoder, encodeMlsMessage, decodeMlsMessage, init_message, greaseValues, defaultGreaseConfig, init_grease, init_defaultCapabilities, init_src, DEFAULT_CIPHERSUITE, MLSGroupManager, init_mls_group, DOMAIN, NONCE_BYTES2, init_owner_sync, init_mls_delivery_order, init_mls_presend_epoch, dist_exports2, init_dist2, DIR_MODE, FILE_MODE, init_secure_file, SYNC_LOCK_STALE_MS, pendingKpPath, init_mls_state, init_mls_kp_pool, PACKAGE, FALLBACK, MAX_LEN, DISALLOWED, init_client_version, CredentialStore, init_credential_store, init_crypto_helpers, STATE_FILE, LEGACY_STATE_FILE, init_state, init_transport2, A2ALogGate, init_a2a_log_gate, init_mls_membership_probe, openclaw_compat_exports, defaultImporter, HEARTBEAT_CANDIDATES, AGENT_EVENT_CANDIDATES, TRANSCRIPT_CANDIDATES, _heartbeatFn, _agentEventFn, _transcriptFn, init_openclaw_compat, http_handlers_exports, init_http_handlers, mcp_proxy_helpers_exports, init_mcp_proxy_helpers, workspace_handlers_exports, MAX_FILE_SIZE, init_workspace_handlers, ROOM_AGENT_TYPES, CREDENTIAL_MESSAGE_TYPES, CATCHUP_MESSAGE_TYPES, POLL_INTERVAL_MS, RECONNECT_BASE_MS, RECONNECT_MAX_MS, PENDING_POLL_INTERVAL_MS, OUTBOUND_DEDUPE_WINDOW_MS, OUTBOUND_DEDUPE_MAX_SUPPRESS_MS, OUTBOUND_DEDUPE_MAX, OUTBOUND_DEDUPE_TYPES, RETRY_CANDIDATE_TTL_MS, RETRY_CANDIDATE_MAX, SecureChannel, init_channel, init_types, DEFAULT_API_URL, DEFAULT_HTTP_PORT, init_account_config, init_lifecycle, _ocRuntime, _channels, agentVaultPlugin, init_openclaw_plugin, init_gateway_send, init_llm_response_parser, init_llm_cost, traceStore, init_fetch_interceptor, init_tool_audit, init_harness_compat, isUsingManagedRoutes, init_openclaw_entry, util, objectUtil, ZodParsedType, getParsedType, init_util, ZodIssueCode, ZodError, init_ZodError, errorMap, en_default, init_en, overrideErrorMap, init_errors2, makeIssue, ParseStatus, INVALID, DIRTY, OK, isAborted, isDirty, isValid, isAsync, init_parseUtil, init_typeAliases, errorUtil, init_errorUtil, ParseInputLazyPath, handleResult, ZodType, cuidRegex, cuid2Regex, ulidRegex, uuidRegex, nanoidRegex, jwtRegex, durationRegex, emailRegex, _emojiRegex, emojiRegex, ipv4Regex, ipv4CidrRegex, ipv6Regex, ipv6CidrRegex, base64Regex, base64urlRegex, dateRegexSource, dateRegex, ZodString, ZodNumber, ZodBigInt, ZodBoolean, ZodDate, ZodSymbol, ZodUndefined, ZodNull, ZodAny, ZodUnknown, ZodNever, ZodVoid, ZodArray, ZodObject, ZodUnion, getDiscriminator, ZodDiscriminatedUnion, ZodIntersection, ZodTuple, ZodRecord, ZodMap, ZodSet, ZodFunction, ZodLazy, ZodLiteral, ZodEnum, ZodNativeEnum, ZodPromise, ZodEffects, ZodOptional, ZodNullable, ZodDefault, ZodCatch, ZodNaN, ZodBranded, ZodPipeline, ZodReadonly, late, ZodFirstPartyTypeKind, stringType, numberType, nanType, bigIntType, booleanType, dateType, symbolType, undefinedType, nullType, anyType, unknownType, neverType, voidType, arrayType, objectType, strictObjectType, unionType, discriminatedUnionType, intersectionType, tupleType, recordType, mapType, setType, functionType, lazyType, literalType, enumType, nativeEnumType, promiseType, effectsType, optionalType, nullableType, preprocessType, pipelineType, init_types2, init_external, init_v3, NEVER, $ZodAsyncError, $ZodEncodeError, globalConfig, init_core, util_exports, EVALUATING, captureStackTrace, allowsEval, getParsedType2, propertyKeyTypes, primitiveTypes, NUMBER_FORMAT_RANGES, BIGINT_FORMAT_RANGES, Class, init_util2, initializer, $ZodError, $ZodRealError, init_errors3, _parse, parse, _parseAsync, parseAsync, _safeParse, safeParse, _safeParseAsync, safeParseAsync, _encode, _decode, _encodeAsync, _decodeAsync, _safeEncode, _safeDecode, _safeEncodeAsync, _safeDecodeAsync, init_parse, regexes_exports, cuid, cuid2, ulid, xid, ksuid, nanoid, duration, extendedDuration, guid, uuid, uuid4, uuid6, uuid7, email, html5Email, rfc5322Email, unicodeEmail, idnEmail, browserEmail, _emoji, ipv4, ipv6, mac, cidrv4, cidrv6, base64, base64url, hostname, domain, e164, dateSource, date, string, bigint, integer, number, boolean, _null, _undefined, lowercase, uppercase, hex, md5_hex, md5_base64, md5_base64url, sha1_hex, sha1_base64, sha1_base64url, sha256_hex, sha256_base64, sha256_base64url, sha384_hex, sha384_base64, sha384_base64url, sha512_hex, sha512_base64, sha512_base64url, init_regexes, $ZodCheck, numericOriginMap, $ZodCheckLessThan, $ZodCheckGreaterThan, $ZodCheckMultipleOf, $ZodCheckNumberFormat, $ZodCheckBigIntFormat, $ZodCheckMaxSize, $ZodCheckMinSize, $ZodCheckSizeEquals, $ZodCheckMaxLength, $ZodCheckMinLength, $ZodCheckLengthEquals, $ZodCheckStringFormat, $ZodCheckRegex, $ZodCheckLowerCase, $ZodCheckUpperCase, $ZodCheckIncludes, $ZodCheckStartsWith, $ZodCheckEndsWith, $ZodCheckProperty, $ZodCheckMimeType, $ZodCheckOverwrite, init_checks, Doc, init_doc, version, init_versions, $ZodType, $ZodString, $ZodStringFormat, $ZodGUID, $ZodUUID, $ZodEmail, $ZodURL, $ZodEmoji, $ZodNanoID, $ZodCUID, $ZodCUID2, $ZodULID, $ZodXID, $ZodKSUID, $ZodISODateTime, $ZodISODate, $ZodISOTime, $ZodISODuration, $ZodIPv4, $ZodIPv6, $ZodMAC, $ZodCIDRv4, $ZodCIDRv6, $ZodBase64, $ZodBase64URL, $ZodE164, $ZodJWT, $ZodCustomStringFormat, $ZodNumber, $ZodNumberFormat, $ZodBoolean, $ZodBigInt, $ZodBigIntFormat, $ZodSymbol, $ZodUndefined, $ZodNull, $ZodAny, $ZodUnknown, $ZodNever, $ZodVoid, $ZodDate, $ZodArray, $ZodObject, $ZodObjectJIT, $ZodUnion, $ZodXor, $ZodDiscriminatedUnion, $ZodIntersection, $ZodTuple, $ZodRecord, $ZodMap, $ZodSet, $ZodEnum, $ZodLiteral, $ZodFile, $ZodTransform, $ZodOptional, $ZodExactOptional, $ZodNullable, $ZodDefault, $ZodPrefault, $ZodNonOptional, $ZodSuccess, $ZodCatch, $ZodNaN, $ZodPipe, $ZodCodec, $ZodReadonly, $ZodTemplateLiteral, $ZodFunction, $ZodPromise, $ZodLazy, $ZodCustom, init_schemas, init_ar, init_az, init_be, init_bg, init_ca, init_cs, init_da, init_de, error, init_en2, init_eo, init_es, init_fa, init_fi, init_fr, init_fr_CA, init_he, init_hu, init_hy, init_id, init_is, init_it, init_ja, init_ka, init_km, init_kh, init_ko, init_lt, init_mk, init_ms, init_nl, init_no, init_ota, init_ps, init_pl, init_pt, init_ru, init_sl, init_sv, init_ta, init_th, init_tr, init_uk, init_ua, init_ur, init_uz, init_vi, init_zh_CN, init_zh_TW, init_yo, init_locales, _a2, $ZodRegistry, globalRegistry, init_registries, init_api, createToJSONSchemaMethod, createStandardJSONSchemaMethod, init_to_json_schema, formatMap, stringProcessor, numberProcessor, booleanProcessor, bigintProcessor, symbolProcessor, nullProcessor, undefinedProcessor, voidProcessor, neverProcessor, anyProcessor, unknownProcessor, dateProcessor, enumProcessor, literalProcessor, nanProcessor, templateLiteralProcessor, fileProcessor, successProcessor, customProcessor, functionProcessor, transformProcessor, mapProcessor, setProcessor, arrayProcessor, objectProcessor, unionProcessor, intersectionProcessor, tupleProcessor, recordProcessor, nullableProcessor, nonoptionalProcessor, defaultProcessor, prefaultProcessor, catchProcessor, pipeProcessor, readonlyProcessor, promiseProcessor, optionalProcessor, lazyProcessor, allProcessors, init_json_schema_processors, init_json_schema_generator, init_json_schema, init_core2, init_parse2, ZodMiniType, ZodMiniObject, init_schemas2, init_checks2, init_iso, init_coerce, init_external2, init_v4_mini, init_zod_compat, checks_exports2, init_checks3, iso_exports2, ZodISODateTime, ZodISODate, ZodISOTime, ZodISODuration, init_iso2, initializer2, ZodError2, ZodRealError, init_errors4, parse2, parseAsync2, safeParse3, safeParseAsync3, encode3, decode2, encodeAsync2, decodeAsync2, safeEncode2, safeDecode2, safeEncodeAsync2, safeDecodeAsync2, init_parse3, schemas_exports3, ZodType2, _ZodString, ZodString2, ZodStringFormat, ZodEmail, ZodGUID, ZodUUID, ZodURL, ZodEmoji, ZodNanoID, ZodCUID, ZodCUID2, ZodULID, ZodXID, ZodKSUID, ZodIPv4, ZodMAC, ZodIPv6, ZodCIDRv4, ZodCIDRv6, ZodBase64, ZodBase64URL, ZodE164, ZodJWT, ZodCustomStringFormat, ZodNumber2, ZodNumberFormat, ZodBoolean2, ZodBigInt2, ZodBigIntFormat, ZodSymbol2, ZodUndefined2, ZodNull2, ZodAny2, ZodUnknown2, ZodNever2, ZodVoid2, ZodDate2, ZodArray2, ZodObject2, ZodUnion2, ZodXor, ZodDiscriminatedUnion2, ZodIntersection2, ZodTuple2, ZodRecord2, ZodMap2, ZodSet2, ZodEnum2, ZodLiteral2, ZodFile, ZodTransform, ZodOptional2, ZodExactOptional, ZodNullable2, ZodDefault2, ZodPrefault, ZodNonOptional, ZodSuccess, ZodCatch2, ZodNaN2, ZodPipe, ZodCodec, ZodReadonly2, ZodTemplateLiteral, ZodLazy2, ZodPromise2, ZodFunction2, ZodCustom, describe2, meta2, stringbool, init_schemas3, ZodFirstPartyTypeKind2, init_compat, z2, init_from_json_schema, init_coerce2, init_external3, init_classic, init_v4, LATEST_PROTOCOL_VERSION, DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, RELATED_TASK_META_KEY, JSONRPC_VERSION, AssertObjectSchema, ProgressTokenSchema, CursorSchema, TaskCreationParamsSchema, TaskMetadataSchema, RelatedTaskMetadataSchema, RequestMetaSchema, BaseRequestParamsSchema, TaskAugmentedRequestParamsSchema, isTaskAugmentedRequestParams, RequestSchema, NotificationsParamsSchema, NotificationSchema, ResultSchema, RequestIdSchema, JSONRPCRequestSchema, isJSONRPCRequest, JSONRPCNotificationSchema, isJSONRPCNotification, JSONRPCResultResponseSchema, isJSONRPCResultResponse, ErrorCode, JSONRPCErrorResponseSchema, isJSONRPCErrorResponse, JSONRPCMessageSchema, JSONRPCResponseSchema, EmptyResultSchema, CancelledNotificationParamsSchema, CancelledNotificationSchema, IconSchema, IconsSchema, BaseMetadataSchema, ImplementationSchema, FormElicitationCapabilitySchema, ElicitationCapabilitySchema, ClientTasksCapabilitySchema, ServerTasksCapabilitySchema, ClientCapabilitiesSchema, InitializeRequestParamsSchema, InitializeRequestSchema, isInitializeRequest, ServerCapabilitiesSchema, InitializeResultSchema, InitializedNotificationSchema, PingRequestSchema, ProgressSchema, ProgressNotificationParamsSchema, ProgressNotificationSchema, PaginatedRequestParamsSchema, PaginatedRequestSchema, PaginatedResultSchema, TaskStatusSchema, TaskSchema, CreateTaskResultSchema, TaskStatusNotificationParamsSchema, TaskStatusNotificationSchema, GetTaskRequestSchema, GetTaskResultSchema, GetTaskPayloadRequestSchema, GetTaskPayloadResultSchema, ListTasksRequestSchema, ListTasksResultSchema, CancelTaskRequestSchema, CancelTaskResultSchema, ResourceContentsSchema, TextResourceContentsSchema, Base64Schema, BlobResourceContentsSchema, RoleSchema, AnnotationsSchema, ResourceSchema, ResourceTemplateSchema, ListResourcesRequestSchema, ListResourcesResultSchema, ListResourceTemplatesRequestSchema, ListResourceTemplatesResultSchema, ResourceRequestParamsSchema, ReadResourceRequestParamsSchema, ReadResourceRequestSchema, ReadResourceResultSchema, ResourceListChangedNotificationSchema, SubscribeRequestParamsSchema, SubscribeRequestSchema, UnsubscribeRequestParamsSchema, UnsubscribeRequestSchema, ResourceUpdatedNotificationParamsSchema, ResourceUpdatedNotificationSchema, PromptArgumentSchema, PromptSchema, ListPromptsRequestSchema, ListPromptsResultSchema, GetPromptRequestParamsSchema, GetPromptRequestSchema, TextContentSchema, ImageContentSchema, AudioContentSchema, ToolUseContentSchema, EmbeddedResourceSchema, ResourceLinkSchema, ContentBlockSchema, PromptMessageSchema, GetPromptResultSchema, PromptListChangedNotificationSchema, ToolAnnotationsSchema, ToolExecutionSchema, ToolSchema, ListToolsRequestSchema, ListToolsResultSchema, CallToolResultSchema, CompatibilityCallToolResultSchema, CallToolRequestParamsSchema, CallToolRequestSchema, ToolListChangedNotificationSchema, ListChangedOptionsBaseSchema, LoggingLevelSchema, SetLevelRequestParamsSchema, SetLevelRequestSchema, LoggingMessageNotificationParamsSchema, LoggingMessageNotificationSchema, ModelHintSchema, ModelPreferencesSchema, ToolChoiceSchema, ToolResultContentSchema, SamplingContentSchema, SamplingMessageContentBlockSchema, SamplingMessageSchema, CreateMessageRequestParamsSchema, CreateMessageRequestSchema, CreateMessageResultSchema, CreateMessageResultWithToolsSchema, BooleanSchemaSchema, StringSchemaSchema, NumberSchemaSchema, UntitledSingleSelectEnumSchemaSchema, TitledSingleSelectEnumSchemaSchema, LegacyTitledEnumSchemaSchema, SingleSelectEnumSchemaSchema, UntitledMultiSelectEnumSchemaSchema, TitledMultiSelectEnumSchemaSchema, MultiSelectEnumSchemaSchema, EnumSchemaSchema, PrimitiveSchemaDefinitionSchema, ElicitRequestFormParamsSchema, ElicitRequestURLParamsSchema, ElicitRequestParamsSchema, ElicitRequestSchema, ElicitationCompleteNotificationParamsSchema, ElicitationCompleteNotificationSchema, ElicitResultSchema, ResourceTemplateReferenceSchema, PromptReferenceSchema, CompleteRequestParamsSchema, CompleteRequestSchema, CompleteResultSchema, RootSchema, ListRootsRequestSchema, ListRootsResultSchema, RootsListChangedNotificationSchema, ClientRequestSchema, ClientNotificationSchema, ClientResultSchema, ServerRequestSchema, ServerNotificationSchema, ServerResultSchema, McpError, UrlElicitationRequiredError, init_types3, init_interfaces, ignoreOverride, defaultOptions, getDefaultOptions, init_Options, getRefs, init_Refs, init_errorMessages, getRelativePath, init_getRelativePath, init_any, init_array2, init_bigint, init_boolean, init_branded, parseCatchDef, init_catch, integerDateParser, init_date, init_default, init_effects, init_enum, isJsonSchema7AllOfType, init_intersection, init_literal, emojiRegex2, zodPatterns, ALPHA_NUMERIC, init_string2, init_record, init_map, init_nativeEnum, init_never, init_null, primitiveMappings, asAnyOf, init_union, init_nullable, init_number2, init_object, parseOptionalDef, init_optional2, parsePipelineDef, init_pipeline, init_promise, init_set, init_tuple, init_undefined, init_unknown, parseReadonlyDef, init_readonly, selectParser, init_selectParser, get$ref, addMeta, init_parseDef, init_parseTypes, zodToJsonSchema, init_zodToJsonSchema, init_esm, init_zod_json_schema_compat, DEFAULT_REQUEST_TIMEOUT_MSEC, Protocol, init_protocol, require_code, require_scope, require_codegen, require_util, require_names, require_errors, require_boolSchema, require_rules, require_applicability, require_dataType, require_defaults, require_code2, require_keyword, require_subschema, require_fast_deep_equal, require_json_schema_traverse, require_resolve, require_validate, require_validation_error, require_ref_error, require_compile, require_data, require_utils, require_schemes, require_fast_uri, require_uri, require_core, require_id, require_ref, require_core2, require_limitNumber, require_multipleOf, require_ucs2length, require_limitLength, require_pattern, require_limitProperties, require_required, require_limitItems, require_equal, require_uniqueItems, require_const, require_enum, require_validation, require_additionalItems, require_items, require_prefixItems, require_items2020, require_contains, require_dependencies, require_propertyNames, require_additionalProperties, require_properties, require_patternProperties, require_not, require_anyOf, require_oneOf, require_allOf, require_if, require_thenElse, require_applicator, require_format, require_format2, require_metadata, require_draft7, require_types, require_discriminator, require_json_schema_draft_07, require_ajv, require_formats, require_limit, require_dist, import_ajv, import_ajv_formats, AjvJsonSchemaValidator, init_ajv_provider, ExperimentalServerTasks, init_server, init_helpers, Server, init_server2, COMPLETABLE_SYMBOL, McpZodTypeKind, init_completable, init_uriTemplate, TOOL_NAME_REGEX, init_toolNameValidation, ExperimentalMcpServerTasks, init_mcp_server, init_zod, McpServer, EMPTY_OBJECT_JSON_SCHEMA, EMPTY_COMPLETION_RESULT, init_mcp, RequestError, toRequestError, GlobalRequest, Request2, newHeadersFromIncoming, wrapBodyStream, newRequestFromIncoming, getRequestCache, requestCache, incomingKey, urlKey, headersKey, abortControllerKey, getAbortController, requestPrototype, newRequest, responseCache, getResponseCache, cacheKey, GlobalResponse, Response2, buildOutgoingHttpHeaders, X_ALREADY_SENT, outgoingEnded, handleRequestError, handleFetchError, handleResponseError, flushHeaders, responseViaCache, isPromise, responseViaResponseObject, getRequestListener, init_dist22, WebStandardStreamableHTTPServerTransport, init_webStandardStreamableHttp, StreamableHTTPServerTransport, init_streamableHttp, AgentVaultMcpServer, init_mcp_server2, init_mcp_handlers, init_skill_manifest, init_skill_invoker, spanBuffer, init_skill_telemetry, PolicyEnforcer, init_policy_enforcer, VERSION, init_index;
+var __create, __defProp2, __getOwnPropDesc, __getOwnPropNames2, __getProtoOf, __hasOwnProp, __esm2, __commonJS, __export2, __copyProps, __toESM, SENTINEL, WRAPPERS, INSTRUCTION, init_abstention, init_mls_commit_classify, __filename, __dirname, url2, path, Module, Module, root, window_, crypto_, randomValuesStandard, crypto4, randomValueNodeJS, _Module, libsodium_sumo_default, init_libsodium_sumo, a, r, t, c, libsodium_wrappers_default, init_libsodium_wrappers, init_keys, init_x3dh, MAX_SKIP, CHAIN_KEY_SEED, MSG_KEY_SEED, HEADER_KEY_SEED, DoubleRatchet, init_ratchet, init_file_crypto, DOMAIN_DID_DOCUMENT, DOMAIN_TRANSFER_INTENT, DOMAIN_TRANSFER_ACCEPT, BASE58_ALPHABET, init_did, BUILTIN_PATTERNS, ScanEngine, init_scan_engine, init_merkle, VC_CONTEXT_V2, AV_CREDENTIAL_CONTEXT, CRYPTOSUITE, BASE58_ALPHABET2, init_vc, init_transport, init_telemetry, TelemetryReporter, init_telemetry_reporter, CROCKFORD, ARGON2_OPSLIMIT, ARGON2_MEMLIMIT, SALT_BYTES, NONCE_BYTES, KEY_BYTES, BACKUP_VERSION, MAX_BACKUP_SIZE, init_backup, init_approval, encVoid, init_tlsEncoder, uint8Encoder, encodeUint8, decodeUint8, uint16Encoder, encodeUint16, decodeUint16, uint32Encoder, encodeUint32, decodeUint32, uint64Encoder, encodeUint64, decodeUint64, init_number, init_tlsDecoder, init_enumHelpers, defaultProposalTypes, defaultProposalTypeEncoder, encodeDefaultProposalType, decodeDefaultProposalType, init_defaultProposalType, defaultExtensionTypes, defaultExtensionTypeEncoder, encodeDefaultExtensionType, decodeDefaultExtensionType, init_defaultExtensionType, acceptAll, init_incomingMessageAction, MlsError, ValidationError, CodecError, UsageError, DependencyError, CryptoVerificationError, CryptoError, InternalError, init_mlsError, init_byteArray, varLenDataEncoder, decodeVarLenData, init_variableLength, init_constantTimeCompare, extensionTypeEncoder, encodeExtensionType, decodeExtensionType, extensionEncoder, encodeExtension, decodeExtension, init_extension, credentialTypes, credentialTypeEncoder, encodeCredentialType, decodeCredentialType, init_credentialType, credentialBasicEncoder, encodeCredentialBasic, credentialX509Encoder, encodeCredentialX509, credentialCustomEncoder, encodeCredentialCustom, credentialEncoder, encodeCredential, decodeCredentialBasic, decodeCredentialX509, decodeCredential, init_credential, externalSenderEncoder, encodeExternalSender, decodeExternalSender, init_externalSender, init_hash, init_optional, ciphersuites, ciphersuiteEncoder, encodeCiphersuite, decodeCiphersuite, ciphersuiteValues, init_ciphersuite, init_signature, protocolVersions, protocolVersionEncoder, encodeProtocolVersion, decodeProtocolVersion, init_protocolVersion, capabilitiesEncoder, encodeCapabilities, decodeCapabilities, init_capabilities, leafNodeSources, leafNodeSourceEncoder, encodeLeafNodeSource, decodeLeafNodeSource, init_leafNodeSource, lifetimeEncoder, encodeLifetime, decodeLifetime, defaultLifetime, init_lifetime, leafNodeDataEncoder, encodeLeafNodeData, decodeLeafNodeData, leafNodeInfoKeyPackageEncoder, encodeLeafNodeInfoKeyPackage, leafNodeInfoUpdateOmittedEncoder, encodeLeafNodeInfoUpdateOmitted, leafNodeInfoCommitOmittedEncoder, encodeLeafNodeInfoCommitOmitted, leafNodeInfoOmittedEncoder, encodeLeafNodeInfoOmitted, decodeLeafNodeInfoKeyPackage, decodeLeafNodeInfoUpdateOmitted, decodeLeafNodeInfoCommitOmitted, decodeLeafNodeInfoOmitted, leafNodeInfoUpdateEncoder, encodeLeafNodeInfoUpdate, leafNodeInfoCommitEncoder, encodeLeafNodeInfoCommit, leafNodeInfoEncoder, encodeLeafNodeInfo, decodeLeafNodeInfoUpdate, decodeLeafNodeInfoCommit, decodeLeafNodeInfo, leafNodeTBSEncoder, encodeLeafNodeTBS, leafNodeEncoder, encodeLeafNode, decodeLeafNode, decodeLeafNodeKeyPackage, decodeLeafNodeCommit, decodeLeafNodeUpdate, init_leafNode, keyPackageTBSEncoder, encodeKeyPackageTBS, decodeKeyPackageTBS, keyPackageEncoder, encodeKeyPackage, decodeKeyPackage, init_keyPackage, init_kdf, pskTypes, pskTypeEncoder, encodePskType, decodePskType, resumptionPSKUsages, resumptionPSKUsageEncoder, encodeResumptionPSKUsage, decodeResumptionPSKUsage, encodePskInfoExternal, encodePskInfoResumption, decodePskInfoResumption, pskInfoEncoder, encodePskInfo, decodePskInfo, pskIdEncoder, encodePskId, decodePskId, pskLabelEncoder, encodePskLabel, decodePskLabel, init_presharedkey, addEncoder, encodeAdd, decodeAdd, updateEncoder, encodeUpdate, decodeUpdate, removeEncoder, encodeRemove, decodeRemove, pskEncoder, encodePSK, decodePSK, reinitEncoder, encodeReinit, decodeReinit, externalInitEncoder, encodeExternalInit, decodeExternalInit, groupContextExtensionsEncoder, encodeGroupContextExtensions, decodeGroupContextExtensions, proposalAddEncoder, encodeProposalAdd, proposalUpdateEncoder, encodeProposalUpdate, proposalRemoveEncoder, encodeProposalRemove, proposalPSKEncoder, encodeProposalPSK, proposalReinitEncoder, encodeProposalReinit, proposalExternalInitEncoder, encodeProposalExternalInit, proposalGroupContextExtensionsEncoder, encodeProposalGroupContextExtensions, proposalCustomEncoder, encodeProposalCustom, proposalEncoder, encodeProposal, decodeProposalAdd, decodeProposalUpdate, decodeProposalRemove, decodeProposalPSK, decodeProposalReinit, decodeProposalExternalInit, decodeProposalGroupContextExtensions, decodeProposal, init_proposal, proposalOrRefTypes, proposalOrRefTypeEncoder, encodeProposalOrRefType, decodeProposalOrRefType, proposalOrRefProposalEncoder, encodeProposalOrRefProposal, proposalOrRefProposalRefEncoder, encodeProposalOrRefProposalRef, proposalOrRefEncoder, encodeProposalOrRef, decodeProposalOrRef, init_proposalOrRefType, init_hpke, groupContextEncoder, encodeGroupContext, decodeGroupContext, init_groupContext, nodeTypes, nodeTypeEncoder, encodeNodeType, decodeNodeType, init_nodeType, parentNodeEncoder, encodeParentNode, decodeParentNode, init_parentNode, init_treemath, nodeEncoder, encodeNode, decodeNode, ratchetTreeEncoder, encodeRatchetTree, decodeRatchetTree, init_ratchetTree, leafNodeHashInputEncoder, encodeLeafNodeHashInput, decodeLeafNodeHashInput, parentNodeHashInputEncoder, encodeParentNodeHashInput, decodeParentNodeHashInput, treeHashInputEncoder, encodeTreeHashInput, decodeTreeHashInput, init_treeHash, parentHashInputEncoder, encodeParentHashInput, decodeParentHashInput, init_parentHash, hpkeCiphertextEncoder, encodeHpkeCiphertext, decodeHpkeCiphertext, init_hpkeCiphertext, updatePathNodeEncoder, encodeUpdatePathNode, decodeUpdatePathNode, updatePathEncoder, encodeUpdatePath, decodeUpdatePath, init_updatePath, commitEncoder, encodeCommit, decodeCommit, init_commit, contentTypes, contentTypeEncoder, encodeContentType, decodeContentType, init_contentType, wireformats, wireformatEncoder, encodeWireformat, decodeWireformat, init_wireformat, senderTypes, senderTypeEncoder, encodeSenderType, decodeSenderType, senderEncoder, encodeSender, decodeSender, reuseGuardEncoder, encodeReuseGuard, decodeReuseGuard, senderDataEncoder, encodeSenderData, decodeSenderData, senderDataAADEncoder, encodeSenderDataAAD, decodeSenderDataAAD, init_sender, framedContentApplicationDataEncoder, encodeFramedContentApplicationData, framedContentProposalDataEncoder, encodeFramedContentProposalData, framedContentCommitDataEncoder, encodeFramedContentCommitData, framedContentInfoEncoder, encodeFramedContentInfo, decodeFramedContentApplicationData, decodeFramedContentProposalData, decodeFramedContentCommitData, decodeFramedContentInfo, framedContentEncoder, encodeFramedContent, decodeFramedContent, senderInfoEncoder, encodeSenderInfo, framedContentTBSEncoder, encodeFramedContentTBS, encodeFramedContentAuthDataContent, encodeFramedContentAuthDataCommit, framedContentAuthDataEncoder, encodeFramedContentAuthData, decodeFramedContentAuthDataCommit, init_framedContent, authenticatedContentEncoder, encodeAuthenticatedContent, decodeAuthenticatedContent, authenticatedContentTBMEncoder, encodeAuthenticatedContentTBM, init_authenticatedContent, publicMessageInfoEncoder, encodePublicMessageInfo, publicMessageEncoder, encodePublicMessage, decodePublicMessage, init_publicMessage, init_messageProtectionPublic, init_externalProposal, requiredCapabilitiesEncoder, encodeRequiredCapabilities, decodeRequiredCapabilities, init_requiredCapabilities, defaultAuthenticationService, init_authenticationService, defaultPaddingConfig, init_paddingConfig, defaultKeyPackageEqualityConfig, init_keyPackageEqualityConfig, defaultLifetimeConfig, init_lifetimeConfig, defaultKeyRetentionConfig, init_keyRetentionConfig, groupInfoTBSEncoder, encodeGroupInfoTBS, decodeGroupInfoTBS, groupInfoEncoder, encodeGroupInfo, decodeGroupInfo, init_groupInfo, keyScheduleEncoder, encodeKeySchedule, decodeKeySchedule, init_keySchedule, generationSecretEncoder, decodeGenerationSecret, secretTreeNodeEncoder, decodeSecretTreeNode, secretTreeEncoder, decodeSecretTree, init_secretTree, confirmedTranscriptHashInputEncoder, encodeConfirmedTranscriptHashInput, decodeConfirmedTranscriptHashInput, init_transcriptHash, groupSecretsEncoder, encodeGroupSecrets, decodeGroupSecrets, init_groupSecrets, encryptedGroupSecretsEncoder, encodeEncryptedGroupSecrets, decodeEncryptedGroupSecrets, welcomeEncoder, encodeWelcome, decodeWelcome, init_welcome, init_pathSecrets, privateKeyPathEncoder, decodePrivateKeyPath, init_privateKeyPath, proposalWithSenderEncoder, decodeProposalWithSender, unappliedProposalsEncoder, decodeUnappliedProposals, init_unappliedProposals, emptyPskIndex, init_pskIndex, init_addToMap, defaultClientConfig, init_clientConfig, init_array, stringEncoder, encodeString, decodeString, init_string, activeEncoder, suspendedPendingReinitEncoder, removedFromGroupEncoder, groupActiveStateEncoder, decodeGroupActiveState, init_groupActiveState, epochReceiverDataEncoder, decodeEpochReceiverData, init_epochReceiverData, groupStateEncoder, encodeGroupState, decodeGroupState, groupStateEncoderWithoutTree, encodeGroupStateWithoutTree, emptyProposals, init_clientState, privateMessageEncoder, encodePrivateMessage, decodePrivateMessage, privateContentAADEncoder, encodePrivateContentAAD, decodePrivateContentAAD, init_privateMessage, init_messageProtection, init_createMessage, init_createCommit, init_processMessages, init_makeHashImpl, HpkeError, InvalidParamError, SerializeError, DeserializeError, EncapError, DecapError, ExportError, SealError, OpenError, MessageLimitReachedError, DeriveKeyPairError, NotSupportedError, init_errors, dntGlobals, dntGlobalThis, init_dnt_shims, NativeAlgorithm, init_algorithm, Mode, KemId, KdfId, AeadId, init_identifiers, INPUT_LENGTH_LIMIT, INFO_LENGTH_LIMIT, MINIMUM_PSK_LENGTH, EMPTY, BYTE_TO_BIGINT_256, init_consts, SUITE_ID_HEADER_KEM, init_kemInterface, HPKE_VERSION, HkdfNative, HkdfSha256Native, HkdfSha384Native, HkdfSha512Native, init_hkdf, isCryptoKeyPair, init_misc, LABEL_EAE_PRK, LABEL_SHARED_SECRET, Dhkem, init_dhkem, KEM_USAGES, LABEL_DKP_PRK, LABEL_SK, init_dhkemPrimitives, Bignum, init_bignum, LABEL_CANDIDATE, ORDER_P_256, ORDER_P_384, ORDER_P_521, PKCS8_ALG_ID_P_256, PKCS8_ALG_ID_P_384, PKCS8_ALG_ID_P_521, EC_P_256_PARAMS, EC_P_384_PARAMS, EC_P_521_PARAMS, Ec, init_ec, init_xCryptoKey, init_xCurve, init_hybridkem, AEAD_USAGES, init_aeadEncryptionContext, _endianTestBuffer, _endianTestBytes, isLE, init_noble, init_hash2, _HMAC, hmac, init_hmac, init_md, U32_MASK64, _32n, init_u64, init_sha2, _0n, _1n, _2n, _7n, _256n, _0x71n, SHA3_PI, SHA3_ROTL, _SHA3_IOTA, IOTAS, SHA3_IOTA_H, SHA3_IOTA_L, init_sha3, init_modular, init_curve, init_montgomery, init_mod, AesGcmContext, Aes128Gcm, Aes256Gcm, init_aesGcm, init_exportOnly, init_emitNotSupported, LABEL_SEC, ExporterContextImpl, RecipientExporterContextImpl, SenderExporterContextImpl, init_exporterContext, EncryptionContextImpl, init_encryptionContext, __classPrivateFieldGet, __classPrivateFieldSet, _Mutex_locked, Mutex, init_mutex, __classPrivateFieldGet2, __classPrivateFieldSet2, _RecipientContextImpl_mutex, RecipientContextImpl, init_recipientContext, __classPrivateFieldGet3, __classPrivateFieldSet3, _SenderContextImpl_mutex, SenderContextImpl, init_senderContext, LABEL_BASE_NONCE, LABEL_EXP, LABEL_INFO_HASH, LABEL_KEY, LABEL_PSK_ID_HASH, LABEL_SECRET, SUITE_ID_HEADER_HPKE, CipherSuiteNative, init_cipherSuiteNative, DhkemP256HkdfSha256Native, DhkemP384HkdfSha384Native, DhkemP521HkdfSha512Native, init_dhkemNative, CipherSuite, DhkemP256HkdfSha256, DhkemP384HkdfSha384, DhkemP521HkdfSha512, HkdfSha256, HkdfSha384, HkdfSha512, init_native, ALG_NAME, PKCS8_ALG_ID_X25519, BASE_POINT_X25519, X25519, init_x25519, DhkemX25519HkdfSha256, init_dhkemX25519, PKCS8_ALG_ID_X448, init_x448, init_dhkemX448, init_mod2, init_hpke2, isLE2, wrapCipher, init_utils, encodeStr, sigma16, sigma32, sigma16_32, sigma32_32, BLOCK_LEN, BLOCK_LEN32, MAX_COUNTER, U32_EMPTY, _XorStreamPRG, createPRG, init_arx, Poly1305, poly1305, init_poly1305, chacha_exports, chacha20orig, chacha20, xchacha20, chacha8, chacha12, ZEROS16, updatePadded, ZEROS32, _poly1305_aead, chacha20poly1305, xchacha20poly1305, rngChacha20, rngChacha8, init_chacha, init_makeAead, init_makeKdfImpl, init_makeDhKem, init_makeHpke, defaultRng, init_rng, crypto2, init_cryptoNode, isLE3, swap32IfBE2, hasHexBuiltin, hexes, asciis, Hash, init_utils2, HashMD2, SHA256_IV2, SHA384_IV2, SHA512_IV2, init_md2, U32_MASK642, _32n2, shrSH2, shrSL2, rotrSH2, rotrSL2, rotrBH2, rotrBL2, rotlSH2, rotlSL2, rotlBH2, rotlBL2, add3L2, add3H2, add4L2, add4H2, add5L2, add5H2, init_u642, SHA256_K, SHA256_W, SHA256, K512, SHA512_Kh, SHA512_Kl, SHA512_W_H, SHA512_W_L, SHA512, SHA384, sha2563, sha5122, sha3842, init_sha22, _0n2, _1n2, isPosBig, bitMask, notImplemented, init_utils3, _0n3, _1n3, _2n2, _3n, _4n, _5n, _7n2, _8n, _9n, _16n, isNegativeLE, FIELD_FIELDS, init_modular2, _0n4, _1n4, pointPrecomputes, pointWindowSizes, wNAF, init_curve2, _0n5, _1n5, _2n3, _8n2, PrimeEdwardsPoint, init_edwards, os2ip, _DST_scalar, init_hash_to_curve, _0n6, _1n6, _2n4, init_montgomery2, ed25519_exports, _0n7, _1n7, _2n5, _3n2, _5n2, _8n3, ed25519_CURVE_p, ed25519_CURVE, ED25519_SQRT_M1, Fp, Fn, ed25519Defaults, ed25519, ed25519ctx, ed25519ph, x25519, ELL2_C1, ELL2_C2, ELL2_C3, ELL2_C1_EDWARDS, ed25519_hasher, SQRT_M1, SQRT_AD_MINUS_ONE, INVSQRT_A_MINUS_D, ONE_MINUS_D_SQ, D_MINUS_ONE_SQ, invertSqrt, MAX_255B, bytes255ToNumberLE, _RistrettoPoint, ristretto255, ristretto255_hasher, ED25519_TORSION_SUBGROUP, edwardsToMontgomery, RistrettoPoint, hashToCurve, encodeToCurve, hashToRistretto255, hash_to_ristretto255, init_ed25519, _0n8, _1n8, _2n6, _7n3, _256n2, _0x71n2, SHA3_PI2, SHA3_ROTL2, _SHA3_IOTA2, IOTAS2, SHA3_IOTA_H2, SHA3_IOTA_L2, rotlH, rotlL, Keccak, genShake, shake2562, init_sha32, ed448_exports, ed448_CURVE, E448_CURVE, shake256_114, shake256_64, _1n9, _2n7, _3n3, _4n2, _11n, _22n, _44n, _88n, _223n, Fp2, Fn2, Fp448, Fn448, ED448_DEF, ed448, ed448ph, E448, x448, ELL2_C12, ELL2_J, ed448_hasher, ONE_MINUS_D, ONE_MINUS_TWO_D, SQRT_MINUS_D, INVSQRT_MINUS_D, invertSqrt2, _DecafPoint, decaf448, decaf448_hasher, ED448_TORSION_SUBGROUP, DecafPoint, hashToCurve2, encodeToCurve2, hashToDecaf448, hash_to_decaf448, edwardsToMontgomery2, init_ed448, HMAC, hmac2, init_hmac2, divNearest, DERErr, DER, _0n9, _1n10, _2n8, _3n4, _4n3, init_weierstrass, init_shortw_utils, nist_exports, p256_CURVE, p384_CURVE, p521_CURVE, Fp256, Fp384, Fp521, p256, p256_hasher, p384, p384_hasher, p521, secp256r1, secp384r1, secp521r1, p521_hasher, init_nist, init_makeNobleSignatureImpl, defaultCryptoProvider, init_provider, init_getCiphersuiteImpl, init_resumption, oidNist2, init_utils4, HashMD3, SHA256_IV3, SHA384_IV3, SHA512_IV3, init_md3, U32_MASK643, _32n3, shrSH3, shrSL3, rotrSH3, rotrSL3, rotrBH3, rotrBL3, add3L3, add3H3, add4L3, add4H3, add5L3, add5H3, init_u643, SHA256_K2, SHA256_W2, SHA2_32B, _SHA256, K5122, SHA512_Kh2, SHA512_Kl2, SHA512_W_H2, SHA512_W_L2, SHA2_64B, _SHA512, _SHA384, sha2564, sha5123, sha3843, init_sha23, _HMAC2, hmac3, init_hmac3, init_makeHashImpl2, init_makeNobleSignatureImpl2, BLOCK_SIZE, ZEROS162, ZEROS322, POLY, mul2, swapLE, estimateWindow, GHASH, Polyval, ghash, polyval, init_polyval, BLOCK_SIZE2, BLOCK_SIZE32, EMPTY_BLOCK, POLY2, sbox, rotr32_8, rotl32_8, tableEncoding, xPowers, gcm, _CMAC, cmac, init_aes, init_makeAead2, init_makeKdfImpl2, init_makeDhKem2, init_makeHpke2, init_rng2, nobleCryptoProvider, init_provider2, mlsPublicMessageEncoder, encodeMlsPublicMessage, mlsWelcomeEncoder, encodeMlsWelcome, mlsPrivateMessageEncoder, encodeMlsPrivateMessage, mlsGroupInfoEncoder, encodeMlsGroupInfo, mlsKeyPackageEncoder, encodeMlsKeyPackage, mlsMessageContentEncoder, encodeMlsMessageContent, decodeMlsMessageContent, mlsMessageEncoder, encodeMlsMessage, decodeMlsMessage, init_message, greaseValues, defaultGreaseConfig, init_grease, init_defaultCapabilities, init_src, DEFAULT_CIPHERSUITE, MLSGroupManager, init_mls_group, DOMAIN, NONCE_BYTES2, init_owner_sync, init_mls_delivery_order, init_mls_presend_epoch, dist_exports2, init_dist2, DIR_MODE, FILE_MODE, init_secure_file, SYNC_LOCK_STALE_MS, pendingKpPath, init_mls_state, init_mls_kp_pool, PACKAGE, FALLBACK, MAX_LEN, DISALLOWED, init_client_version, CredentialStore, init_credential_store, init_crypto_helpers, STATE_FILE, LEGACY_STATE_FILE, init_state, init_transport2, A2ALogGate, init_a2a_log_gate, init_mls_membership_probe, openclaw_compat_exports, defaultImporter, HEARTBEAT_CANDIDATES, AGENT_EVENT_CANDIDATES, TRANSCRIPT_CANDIDATES, _heartbeatFn, _agentEventFn, _transcriptFn, init_openclaw_compat, http_handlers_exports, init_http_handlers, mcp_proxy_helpers_exports, init_mcp_proxy_helpers, workspace_handlers_exports, MAX_FILE_SIZE, init_workspace_handlers, ROOM_AGENT_TYPES, CREDENTIAL_MESSAGE_TYPES, CATCHUP_MESSAGE_TYPES, POLL_INTERVAL_MS, RECONNECT_BASE_MS, RECONNECT_MAX_MS, PENDING_POLL_INTERVAL_MS, OUTBOUND_DEDUPE_WINDOW_MS, OUTBOUND_DEDUPE_MAX_SUPPRESS_MS, OUTBOUND_DEDUPE_MAX, OUTBOUND_DEDUPE_TYPES, RETRY_CANDIDATE_TTL_MS, RETRY_CANDIDATE_MAX, SecureChannel, init_channel, init_types, DEFAULT_API_URL, DEFAULT_HTTP_PORT, init_account_config, init_lifecycle, _ocRuntime, _channels, agentVaultPlugin, init_openclaw_plugin, init_gateway_send, init_room_protocol, init_llm_response_parser, init_llm_cost, traceStore, init_fetch_interceptor, init_tool_audit, init_harness_compat, isUsingManagedRoutes, init_openclaw_entry, util, objectUtil, ZodParsedType, getParsedType, init_util, ZodIssueCode, ZodError, init_ZodError, errorMap, en_default, init_en, overrideErrorMap, init_errors2, makeIssue, ParseStatus, INVALID, DIRTY, OK, isAborted, isDirty, isValid, isAsync, init_parseUtil, init_typeAliases, errorUtil, init_errorUtil, ParseInputLazyPath, handleResult, ZodType, cuidRegex, cuid2Regex, ulidRegex, uuidRegex, nanoidRegex, jwtRegex, durationRegex, emailRegex, _emojiRegex, emojiRegex, ipv4Regex, ipv4CidrRegex, ipv6Regex, ipv6CidrRegex, base64Regex, base64urlRegex, dateRegexSource, dateRegex, ZodString, ZodNumber, ZodBigInt, ZodBoolean, ZodDate, ZodSymbol, ZodUndefined, ZodNull, ZodAny, ZodUnknown, ZodNever, ZodVoid, ZodArray, ZodObject, ZodUnion, getDiscriminator, ZodDiscriminatedUnion, ZodIntersection, ZodTuple, ZodRecord, ZodMap, ZodSet, ZodFunction, ZodLazy, ZodLiteral, ZodEnum, ZodNativeEnum, ZodPromise, ZodEffects, ZodOptional, ZodNullable, ZodDefault, ZodCatch, ZodNaN, ZodBranded, ZodPipeline, ZodReadonly, late, ZodFirstPartyTypeKind, stringType, numberType, nanType, bigIntType, booleanType, dateType, symbolType, undefinedType, nullType, anyType, unknownType, neverType, voidType, arrayType, objectType, strictObjectType, unionType, discriminatedUnionType, intersectionType, tupleType, recordType, mapType, setType, functionType, lazyType, literalType, enumType, nativeEnumType, promiseType, effectsType, optionalType, nullableType, preprocessType, pipelineType, init_types2, init_external, init_v3, NEVER, $ZodAsyncError, $ZodEncodeError, globalConfig, init_core, util_exports, EVALUATING, captureStackTrace, allowsEval, getParsedType2, propertyKeyTypes, primitiveTypes, NUMBER_FORMAT_RANGES, BIGINT_FORMAT_RANGES, Class, init_util2, initializer, $ZodError, $ZodRealError, init_errors3, _parse, parse, _parseAsync, parseAsync, _safeParse, safeParse, _safeParseAsync, safeParseAsync, _encode, _decode, _encodeAsync, _decodeAsync, _safeEncode, _safeDecode, _safeEncodeAsync, _safeDecodeAsync, init_parse, regexes_exports, cuid, cuid2, ulid, xid, ksuid, nanoid, duration, extendedDuration, guid, uuid, uuid4, uuid6, uuid7, email, html5Email, rfc5322Email, unicodeEmail, idnEmail, browserEmail, _emoji, ipv4, ipv6, mac, cidrv4, cidrv6, base64, base64url, hostname, domain, e164, dateSource, date, string, bigint, integer, number, boolean, _null, _undefined, lowercase, uppercase, hex, md5_hex, md5_base64, md5_base64url, sha1_hex, sha1_base64, sha1_base64url, sha256_hex, sha256_base64, sha256_base64url, sha384_hex, sha384_base64, sha384_base64url, sha512_hex, sha512_base64, sha512_base64url, init_regexes, $ZodCheck, numericOriginMap, $ZodCheckLessThan, $ZodCheckGreaterThan, $ZodCheckMultipleOf, $ZodCheckNumberFormat, $ZodCheckBigIntFormat, $ZodCheckMaxSize, $ZodCheckMinSize, $ZodCheckSizeEquals, $ZodCheckMaxLength, $ZodCheckMinLength, $ZodCheckLengthEquals, $ZodCheckStringFormat, $ZodCheckRegex, $ZodCheckLowerCase, $ZodCheckUpperCase, $ZodCheckIncludes, $ZodCheckStartsWith, $ZodCheckEndsWith, $ZodCheckProperty, $ZodCheckMimeType, $ZodCheckOverwrite, init_checks, Doc, init_doc, version, init_versions, $ZodType, $ZodString, $ZodStringFormat, $ZodGUID, $ZodUUID, $ZodEmail, $ZodURL, $ZodEmoji, $ZodNanoID, $ZodCUID, $ZodCUID2, $ZodULID, $ZodXID, $ZodKSUID, $ZodISODateTime, $ZodISODate, $ZodISOTime, $ZodISODuration, $ZodIPv4, $ZodIPv6, $ZodMAC, $ZodCIDRv4, $ZodCIDRv6, $ZodBase64, $ZodBase64URL, $ZodE164, $ZodJWT, $ZodCustomStringFormat, $ZodNumber, $ZodNumberFormat, $ZodBoolean, $ZodBigInt, $ZodBigIntFormat, $ZodSymbol, $ZodUndefined, $ZodNull, $ZodAny, $ZodUnknown, $ZodNever, $ZodVoid, $ZodDate, $ZodArray, $ZodObject, $ZodObjectJIT, $ZodUnion, $ZodXor, $ZodDiscriminatedUnion, $ZodIntersection, $ZodTuple, $ZodRecord, $ZodMap, $ZodSet, $ZodEnum, $ZodLiteral, $ZodFile, $ZodTransform, $ZodOptional, $ZodExactOptional, $ZodNullable, $ZodDefault, $ZodPrefault, $ZodNonOptional, $ZodSuccess, $ZodCatch, $ZodNaN, $ZodPipe, $ZodCodec, $ZodReadonly, $ZodTemplateLiteral, $ZodFunction, $ZodPromise, $ZodLazy, $ZodCustom, init_schemas, init_ar, init_az, init_be, init_bg, init_ca, init_cs, init_da, init_de, error, init_en2, init_eo, init_es, init_fa, init_fi, init_fr, init_fr_CA, init_he, init_hu, init_hy, init_id, init_is, init_it, init_ja, init_ka, init_km, init_kh, init_ko, init_lt, init_mk, init_ms, init_nl, init_no, init_ota, init_ps, init_pl, init_pt, init_ru, init_sl, init_sv, init_ta, init_th, init_tr, init_uk, init_ua, init_ur, init_uz, init_vi, init_zh_CN, init_zh_TW, init_yo, init_locales, _a2, $ZodRegistry, globalRegistry, init_registries, init_api, createToJSONSchemaMethod, createStandardJSONSchemaMethod, init_to_json_schema, formatMap, stringProcessor, numberProcessor, booleanProcessor, bigintProcessor, symbolProcessor, nullProcessor, undefinedProcessor, voidProcessor, neverProcessor, anyProcessor, unknownProcessor, dateProcessor, enumProcessor, literalProcessor, nanProcessor, templateLiteralProcessor, fileProcessor, successProcessor, customProcessor, functionProcessor, transformProcessor, mapProcessor, setProcessor, arrayProcessor, objectProcessor, unionProcessor, intersectionProcessor, tupleProcessor, recordProcessor, nullableProcessor, nonoptionalProcessor, defaultProcessor, prefaultProcessor, catchProcessor, pipeProcessor, readonlyProcessor, promiseProcessor, optionalProcessor, lazyProcessor, allProcessors, init_json_schema_processors, init_json_schema_generator, init_json_schema, init_core2, init_parse2, ZodMiniType, ZodMiniObject, init_schemas2, init_checks2, init_iso, init_coerce, init_external2, init_v4_mini, init_zod_compat, checks_exports2, init_checks3, iso_exports2, ZodISODateTime, ZodISODate, ZodISOTime, ZodISODuration, init_iso2, initializer2, ZodError2, ZodRealError, init_errors4, parse2, parseAsync2, safeParse3, safeParseAsync3, encode3, decode2, encodeAsync2, decodeAsync2, safeEncode2, safeDecode2, safeEncodeAsync2, safeDecodeAsync2, init_parse3, schemas_exports3, ZodType2, _ZodString, ZodString2, ZodStringFormat, ZodEmail, ZodGUID, ZodUUID, ZodURL, ZodEmoji, ZodNanoID, ZodCUID, ZodCUID2, ZodULID, ZodXID, ZodKSUID, ZodIPv4, ZodMAC, ZodIPv6, ZodCIDRv4, ZodCIDRv6, ZodBase64, ZodBase64URL, ZodE164, ZodJWT, ZodCustomStringFormat, ZodNumber2, ZodNumberFormat, ZodBoolean2, ZodBigInt2, ZodBigIntFormat, ZodSymbol2, ZodUndefined2, ZodNull2, ZodAny2, ZodUnknown2, ZodNever2, ZodVoid2, ZodDate2, ZodArray2, ZodObject2, ZodUnion2, ZodXor, ZodDiscriminatedUnion2, ZodIntersection2, ZodTuple2, ZodRecord2, ZodMap2, ZodSet2, ZodEnum2, ZodLiteral2, ZodFile, ZodTransform, ZodOptional2, ZodExactOptional, ZodNullable2, ZodDefault2, ZodPrefault, ZodNonOptional, ZodSuccess, ZodCatch2, ZodNaN2, ZodPipe, ZodCodec, ZodReadonly2, ZodTemplateLiteral, ZodLazy2, ZodPromise2, ZodFunction2, ZodCustom, describe2, meta2, stringbool, init_schemas3, ZodFirstPartyTypeKind2, init_compat, z2, init_from_json_schema, init_coerce2, init_external3, init_classic, init_v4, LATEST_PROTOCOL_VERSION, DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, RELATED_TASK_META_KEY, JSONRPC_VERSION, AssertObjectSchema, ProgressTokenSchema, CursorSchema, TaskCreationParamsSchema, TaskMetadataSchema, RelatedTaskMetadataSchema, RequestMetaSchema, BaseRequestParamsSchema, TaskAugmentedRequestParamsSchema, isTaskAugmentedRequestParams, RequestSchema, NotificationsParamsSchema, NotificationSchema, ResultSchema, RequestIdSchema, JSONRPCRequestSchema, isJSONRPCRequest, JSONRPCNotificationSchema, isJSONRPCNotification, JSONRPCResultResponseSchema, isJSONRPCResultResponse, ErrorCode, JSONRPCErrorResponseSchema, isJSONRPCErrorResponse, JSONRPCMessageSchema, JSONRPCResponseSchema, EmptyResultSchema, CancelledNotificationParamsSchema, CancelledNotificationSchema, IconSchema, IconsSchema, BaseMetadataSchema, ImplementationSchema, FormElicitationCapabilitySchema, ElicitationCapabilitySchema, ClientTasksCapabilitySchema, ServerTasksCapabilitySchema, ClientCapabilitiesSchema, InitializeRequestParamsSchema, InitializeRequestSchema, isInitializeRequest, ServerCapabilitiesSchema, InitializeResultSchema, InitializedNotificationSchema, PingRequestSchema, ProgressSchema, ProgressNotificationParamsSchema, ProgressNotificationSchema, PaginatedRequestParamsSchema, PaginatedRequestSchema, PaginatedResultSchema, TaskStatusSchema, TaskSchema, CreateTaskResultSchema, TaskStatusNotificationParamsSchema, TaskStatusNotificationSchema, GetTaskRequestSchema, GetTaskResultSchema, GetTaskPayloadRequestSchema, GetTaskPayloadResultSchema, ListTasksRequestSchema, ListTasksResultSchema, CancelTaskRequestSchema, CancelTaskResultSchema, ResourceContentsSchema, TextResourceContentsSchema, Base64Schema, BlobResourceContentsSchema, RoleSchema, AnnotationsSchema, ResourceSchema, ResourceTemplateSchema, ListResourcesRequestSchema, ListResourcesResultSchema, ListResourceTemplatesRequestSchema, ListResourceTemplatesResultSchema, ResourceRequestParamsSchema, ReadResourceRequestParamsSchema, ReadResourceRequestSchema, ReadResourceResultSchema, ResourceListChangedNotificationSchema, SubscribeRequestParamsSchema, SubscribeRequestSchema, UnsubscribeRequestParamsSchema, UnsubscribeRequestSchema, ResourceUpdatedNotificationParamsSchema, ResourceUpdatedNotificationSchema, PromptArgumentSchema, PromptSchema, ListPromptsRequestSchema, ListPromptsResultSchema, GetPromptRequestParamsSchema, GetPromptRequestSchema, TextContentSchema, ImageContentSchema, AudioContentSchema, ToolUseContentSchema, EmbeddedResourceSchema, ResourceLinkSchema, ContentBlockSchema, PromptMessageSchema, GetPromptResultSchema, PromptListChangedNotificationSchema, ToolAnnotationsSchema, ToolExecutionSchema, ToolSchema, ListToolsRequestSchema, ListToolsResultSchema, CallToolResultSchema, CompatibilityCallToolResultSchema, CallToolRequestParamsSchema, CallToolRequestSchema, ToolListChangedNotificationSchema, ListChangedOptionsBaseSchema, LoggingLevelSchema, SetLevelRequestParamsSchema, SetLevelRequestSchema, LoggingMessageNotificationParamsSchema, LoggingMessageNotificationSchema, ModelHintSchema, ModelPreferencesSchema, ToolChoiceSchema, ToolResultContentSchema, SamplingContentSchema, SamplingMessageContentBlockSchema, SamplingMessageSchema, CreateMessageRequestParamsSchema, CreateMessageRequestSchema, CreateMessageResultSchema, CreateMessageResultWithToolsSchema, BooleanSchemaSchema, StringSchemaSchema, NumberSchemaSchema, UntitledSingleSelectEnumSchemaSchema, TitledSingleSelectEnumSchemaSchema, LegacyTitledEnumSchemaSchema, SingleSelectEnumSchemaSchema, UntitledMultiSelectEnumSchemaSchema, TitledMultiSelectEnumSchemaSchema, MultiSelectEnumSchemaSchema, EnumSchemaSchema, PrimitiveSchemaDefinitionSchema, ElicitRequestFormParamsSchema, ElicitRequestURLParamsSchema, ElicitRequestParamsSchema, ElicitRequestSchema, ElicitationCompleteNotificationParamsSchema, ElicitationCompleteNotificationSchema, ElicitResultSchema, ResourceTemplateReferenceSchema, PromptReferenceSchema, CompleteRequestParamsSchema, CompleteRequestSchema, CompleteResultSchema, RootSchema, ListRootsRequestSchema, ListRootsResultSchema, RootsListChangedNotificationSchema, ClientRequestSchema, ClientNotificationSchema, ClientResultSchema, ServerRequestSchema, ServerNotificationSchema, ServerResultSchema, McpError, UrlElicitationRequiredError, init_types3, init_interfaces, ignoreOverride, defaultOptions, getDefaultOptions, init_Options, getRefs, init_Refs, init_errorMessages, getRelativePath, init_getRelativePath, init_any, init_array2, init_bigint, init_boolean, init_branded, parseCatchDef, init_catch, integerDateParser, init_date, init_default, init_effects, init_enum, isJsonSchema7AllOfType, init_intersection, init_literal, emojiRegex2, zodPatterns, ALPHA_NUMERIC, init_string2, init_record, init_map, init_nativeEnum, init_never, init_null, primitiveMappings, asAnyOf, init_union, init_nullable, init_number2, init_object, parseOptionalDef, init_optional2, parsePipelineDef, init_pipeline, init_promise, init_set, init_tuple, init_undefined, init_unknown, parseReadonlyDef, init_readonly, selectParser, init_selectParser, get$ref, addMeta, init_parseDef, init_parseTypes, zodToJsonSchema, init_zodToJsonSchema, init_esm, init_zod_json_schema_compat, DEFAULT_REQUEST_TIMEOUT_MSEC, Protocol, init_protocol, require_code, require_scope, require_codegen, require_util, require_names, require_errors, require_boolSchema, require_rules, require_applicability, require_dataType, require_defaults, require_code2, require_keyword, require_subschema, require_fast_deep_equal, require_json_schema_traverse, require_resolve, require_validate, require_validation_error, require_ref_error, require_compile, require_data, require_utils, require_schemes, require_fast_uri, require_uri, require_core, require_id, require_ref, require_core2, require_limitNumber, require_multipleOf, require_ucs2length, require_limitLength, require_pattern, require_limitProperties, require_required, require_limitItems, require_equal, require_uniqueItems, require_const, require_enum, require_validation, require_additionalItems, require_items, require_prefixItems, require_items2020, require_contains, require_dependencies, require_propertyNames, require_additionalProperties, require_properties, require_patternProperties, require_not, require_anyOf, require_oneOf, require_allOf, require_if, require_thenElse, require_applicator, require_format, require_format2, require_metadata, require_draft7, require_types, require_discriminator, require_json_schema_draft_07, require_ajv, require_formats, require_limit, require_dist, import_ajv, import_ajv_formats, AjvJsonSchemaValidator, init_ajv_provider, ExperimentalServerTasks, init_server, init_helpers, Server, init_server2, COMPLETABLE_SYMBOL, McpZodTypeKind, init_completable, init_uriTemplate, TOOL_NAME_REGEX, init_toolNameValidation, ExperimentalMcpServerTasks, init_mcp_server, init_zod, McpServer, EMPTY_OBJECT_JSON_SCHEMA, EMPTY_COMPLETION_RESULT, init_mcp, RequestError, toRequestError, GlobalRequest, Request2, newHeadersFromIncoming, wrapBodyStream, newRequestFromIncoming, getRequestCache, requestCache, incomingKey, urlKey, headersKey, abortControllerKey, getAbortController, requestPrototype, newRequest, responseCache, getResponseCache, cacheKey, GlobalResponse, Response2, buildOutgoingHttpHeaders, X_ALREADY_SENT, outgoingEnded, handleRequestError, handleFetchError, handleResponseError, flushHeaders, responseViaCache, isPromise, responseViaResponseObject, getRequestListener, init_dist22, WebStandardStreamableHTTPServerTransport, init_webStandardStreamableHttp, StreamableHTTPServerTransport, init_streamableHttp, AgentVaultMcpServer, init_mcp_server2, init_mcp_handlers, init_skill_manifest, init_skill_invoker, spanBuffer, init_skill_telemetry, PolicyEnforcer, init_policy_enforcer, VERSION, init_index;
 var init_dist = __esm({
   async "../plugin/dist/index.js"() {
     "use strict";
@@ -17359,6 +17074,14 @@ var init_dist = __esm({
       isNodeMode || !mod4 || !mod4.__esModule ? __defProp2(target, "default", { value: mod4, enumerable: true }) : target,
       mod4
     ));
+    init_abstention = __esm2({
+      "src/abstention.ts"() {
+        "use strict";
+        SENTINEL = "[[no-reply]]";
+        WRAPPERS = " 	\r\n`\"'*_";
+        INSTRUCTION = "not every message needs an answer from you: if this one is not addressed to you and asks nothing of you, reply with exactly " + SENTINEL + " and nothing else \u2014 that is discarded, not posted, and is how you stay quiet; never post a message SAYING that you are staying quiet";
+      }
+    });
     init_mls_commit_classify = __esm2({
       "src/mls-commit-classify.ts"() {
         "use strict";
@@ -59368,7 +59091,7 @@ var init_dist = __esm({
         t = libsodium_sumo_default.ready.then(function() {
           function t2() {
             if (a._sodium_init() < 0) throw new Error("libsodium was not correctly initialized.");
-            for (var e = ["crypto_aead_aegis128l_decrypt", "crypto_aead_aegis128l_decrypt_detached", "crypto_aead_aegis128l_encrypt", "crypto_aead_aegis128l_encrypt_detached", "crypto_aead_aegis128l_keygen", "crypto_aead_aegis256_decrypt", "crypto_aead_aegis256_decrypt_detached", "crypto_aead_aegis256_encrypt", "crypto_aead_aegis256_encrypt_detached", "crypto_aead_aegis256_keygen", "crypto_aead_chacha20poly1305_decrypt", "crypto_aead_chacha20poly1305_decrypt_detached", "crypto_aead_chacha20poly1305_encrypt", "crypto_aead_chacha20poly1305_encrypt_detached", "crypto_aead_chacha20poly1305_ietf_decrypt", "crypto_aead_chacha20poly1305_ietf_decrypt_detached", "crypto_aead_chacha20poly1305_ietf_encrypt", "crypto_aead_chacha20poly1305_ietf_encrypt_detached", "crypto_aead_chacha20poly1305_ietf_keygen", "crypto_aead_chacha20poly1305_keygen", "crypto_aead_xchacha20poly1305_ietf_decrypt", "crypto_aead_xchacha20poly1305_ietf_decrypt_detached", "crypto_aead_xchacha20poly1305_ietf_encrypt", "crypto_aead_xchacha20poly1305_ietf_encrypt_detached", "crypto_aead_xchacha20poly1305_ietf_keygen", "crypto_auth", "crypto_auth_hmacsha256", "crypto_auth_hmacsha256_final", "crypto_auth_hmacsha256_init", "crypto_auth_hmacsha256_keygen", "crypto_auth_hmacsha256_update", "crypto_auth_hmacsha256_verify", "crypto_auth_hmacsha512", "crypto_auth_hmacsha512256", "crypto_auth_hmacsha512256_final", "crypto_auth_hmacsha512256_init", "crypto_auth_hmacsha512256_keygen", "crypto_auth_hmacsha512256_update", "crypto_auth_hmacsha512256_verify", "crypto_auth_hmacsha512_final", "crypto_auth_hmacsha512_init", "crypto_auth_hmacsha512_keygen", "crypto_auth_hmacsha512_update", "crypto_auth_hmacsha512_verify", "crypto_auth_keygen", "crypto_auth_verify", "crypto_box_beforenm", "crypto_box_curve25519xchacha20poly1305_beforenm", "crypto_box_curve25519xchacha20poly1305_detached", "crypto_box_curve25519xchacha20poly1305_detached_afternm", "crypto_box_curve25519xchacha20poly1305_easy", "crypto_box_curve25519xchacha20poly1305_easy_afternm", "crypto_box_curve25519xchacha20poly1305_keypair", "crypto_box_curve25519xchacha20poly1305_open_detached", "crypto_box_curve25519xchacha20poly1305_open_detached_afternm", "crypto_box_curve25519xchacha20poly1305_open_easy", "crypto_box_curve25519xchacha20poly1305_open_easy_afternm", "crypto_box_curve25519xchacha20poly1305_seal", "crypto_box_curve25519xchacha20poly1305_seal_open", "crypto_box_curve25519xchacha20poly1305_seed_keypair", "crypto_box_detached", "crypto_box_easy", "crypto_box_easy_afternm", "crypto_box_keypair", "crypto_box_open_detached", "crypto_box_open_easy", "crypto_box_open_easy_afternm", "crypto_box_seal", "crypto_box_seal_open", "crypto_box_seed_keypair", "crypto_core_ed25519_add", "crypto_core_ed25519_from_hash", "crypto_core_ed25519_from_uniform", "crypto_core_ed25519_is_valid_point", "crypto_core_ed25519_random", "crypto_core_ed25519_scalar_add", "crypto_core_ed25519_scalar_complement", "crypto_core_ed25519_scalar_invert", "crypto_core_ed25519_scalar_mul", "crypto_core_ed25519_scalar_negate", "crypto_core_ed25519_scalar_random", "crypto_core_ed25519_scalar_reduce", "crypto_core_ed25519_scalar_sub", "crypto_core_ed25519_sub", "crypto_core_hchacha20", "crypto_core_hsalsa20", "crypto_core_ristretto255_add", "crypto_core_ristretto255_from_hash", "crypto_core_ristretto255_is_valid_point", "crypto_core_ristretto255_random", "crypto_core_ristretto255_scalar_add", "crypto_core_ristretto255_scalar_complement", "crypto_core_ristretto255_scalar_invert", "crypto_core_ristretto255_scalar_mul", "crypto_core_ristretto255_scalar_negate", "crypto_core_ristretto255_scalar_random", "crypto_core_ristretto255_scalar_reduce", "crypto_core_ristretto255_scalar_sub", "crypto_core_ristretto255_sub", "crypto_generichash", "crypto_generichash_blake2b_salt_personal", "crypto_generichash_final", "crypto_generichash_init", "crypto_generichash_keygen", "crypto_generichash_update", "crypto_hash", "crypto_hash_sha256", "crypto_hash_sha256_final", "crypto_hash_sha256_init", "crypto_hash_sha256_update", "crypto_hash_sha512", "crypto_hash_sha512_final", "crypto_hash_sha512_init", "crypto_hash_sha512_update", "crypto_kdf_derive_from_key", "crypto_kdf_keygen", "crypto_kx_client_session_keys", "crypto_kx_keypair", "crypto_kx_seed_keypair", "crypto_kx_server_session_keys", "crypto_onetimeauth", "crypto_onetimeauth_final", "crypto_onetimeauth_init", "crypto_onetimeauth_keygen", "crypto_onetimeauth_update", "crypto_onetimeauth_verify", "crypto_pwhash", "crypto_pwhash_scryptsalsa208sha256", "crypto_pwhash_scryptsalsa208sha256_ll", "crypto_pwhash_scryptsalsa208sha256_str", "crypto_pwhash_scryptsalsa208sha256_str_verify", "crypto_pwhash_str", "crypto_pwhash_str_needs_rehash", "crypto_pwhash_str_verify", "crypto_scalarmult", "crypto_scalarmult_base", "crypto_scalarmult_ed25519", "crypto_scalarmult_ed25519_base", "crypto_scalarmult_ed25519_base_noclamp", "crypto_scalarmult_ed25519_noclamp", "crypto_scalarmult_ristretto255", "crypto_scalarmult_ristretto255_base", "crypto_secretbox_detached", "crypto_secretbox_easy", "crypto_secretbox_keygen", "crypto_secretbox_open_detached", "crypto_secretbox_open_easy", "crypto_secretstream_xchacha20poly1305_init_pull", "crypto_secretstream_xchacha20poly1305_init_push", "crypto_secretstream_xchacha20poly1305_keygen", "crypto_secretstream_xchacha20poly1305_pull", "crypto_secretstream_xchacha20poly1305_push", "crypto_secretstream_xchacha20poly1305_rekey", "crypto_shorthash", "crypto_shorthash_keygen", "crypto_shorthash_siphashx24", "crypto_sign", "crypto_sign_detached", "crypto_sign_ed25519_pk_to_curve25519", "crypto_sign_ed25519_sk_to_curve25519", "crypto_sign_ed25519_sk_to_pk", "crypto_sign_ed25519_sk_to_seed", "crypto_sign_final_create", "crypto_sign_final_verify", "crypto_sign_init", "crypto_sign_keypair", "crypto_sign_open", "crypto_sign_seed_keypair", "crypto_sign_update", "crypto_sign_verify_detached", "crypto_stream_chacha20", "crypto_stream_chacha20_ietf_xor", "crypto_stream_chacha20_ietf_xor_ic", "crypto_stream_chacha20_keygen", "crypto_stream_chacha20_xor", "crypto_stream_chacha20_xor_ic", "crypto_stream_keygen", "crypto_stream_xchacha20_keygen", "crypto_stream_xchacha20_xor", "crypto_stream_xchacha20_xor_ic", "randombytes_buf", "randombytes_buf_deterministic", "randombytes_close", "randombytes_random", "randombytes_set_implementation", "randombytes_stir", "randombytes_uniform", "sodium_version_string"], t3 = [x, k, S, T, w, Y, B, A, M, I, K, N, L, O, U, C, P, R, X, G, D, F, V, H, W, q2, z, j, J, Q, Z, $, ee, ae, re, te, _e, ne, se, ce, he, oe, pe, ye, ie, le, ue, de, ve, ge, be, fe, me, Ee, xe, ke, Se, Te, we, Ye, Be, Ae, Me, Ie, Ke, Ne, Le, Oe, Ue, Ce, Pe, Re, Xe, Ge, De, Fe, Ve, He, We, qe, ze, je, Je, Qe, Ze, $e, ea, aa, ra, ta, _a, na, sa, ca, ha, oa, pa, ya, ia, la, ua, da, va, ga, ba, fa, ma, Ea, xa, ka, Sa, Ta, wa, Ya, Ba, Aa, Ma, Ia, Ka, Na, La, Oa, Ua, Ca, Pa, Ra, Xa, Ga, Da, Fa, Va, Ha, Wa, qa, za, ja, Ja, Qa, Za, $a, er, ar, rr, tr, _r, nr, sr, cr, hr, or, pr, yr, ir, lr, ur, dr, vr, gr, br, fr, mr, Er, xr, kr, Sr, Tr, wr, Yr, Br, Ar, Mr, Ir, Kr, Nr, Lr, Or, Ur, Cr, Pr, Rr, Xr, Gr, Dr, Fr, Vr, Hr, Wr, qr], _3 = 0; _3 < t3.length; _3++) "function" == typeof a["_" + e[_3]] && (r[e[_3]] = t3[_3]);
+            for (var e = ["crypto_aead_aegis128l_decrypt", "crypto_aead_aegis128l_decrypt_detached", "crypto_aead_aegis128l_encrypt", "crypto_aead_aegis128l_encrypt_detached", "crypto_aead_aegis128l_keygen", "crypto_aead_aegis256_decrypt", "crypto_aead_aegis256_decrypt_detached", "crypto_aead_aegis256_encrypt", "crypto_aead_aegis256_encrypt_detached", "crypto_aead_aegis256_keygen", "crypto_aead_chacha20poly1305_decrypt", "crypto_aead_chacha20poly1305_decrypt_detached", "crypto_aead_chacha20poly1305_encrypt", "crypto_aead_chacha20poly1305_encrypt_detached", "crypto_aead_chacha20poly1305_ietf_decrypt", "crypto_aead_chacha20poly1305_ietf_decrypt_detached", "crypto_aead_chacha20poly1305_ietf_encrypt", "crypto_aead_chacha20poly1305_ietf_encrypt_detached", "crypto_aead_chacha20poly1305_ietf_keygen", "crypto_aead_chacha20poly1305_keygen", "crypto_aead_xchacha20poly1305_ietf_decrypt", "crypto_aead_xchacha20poly1305_ietf_decrypt_detached", "crypto_aead_xchacha20poly1305_ietf_encrypt", "crypto_aead_xchacha20poly1305_ietf_encrypt_detached", "crypto_aead_xchacha20poly1305_ietf_keygen", "crypto_auth", "crypto_auth_hmacsha256", "crypto_auth_hmacsha256_final", "crypto_auth_hmacsha256_init", "crypto_auth_hmacsha256_keygen", "crypto_auth_hmacsha256_update", "crypto_auth_hmacsha256_verify", "crypto_auth_hmacsha512", "crypto_auth_hmacsha512256", "crypto_auth_hmacsha512256_final", "crypto_auth_hmacsha512256_init", "crypto_auth_hmacsha512256_keygen", "crypto_auth_hmacsha512256_update", "crypto_auth_hmacsha512256_verify", "crypto_auth_hmacsha512_final", "crypto_auth_hmacsha512_init", "crypto_auth_hmacsha512_keygen", "crypto_auth_hmacsha512_update", "crypto_auth_hmacsha512_verify", "crypto_auth_keygen", "crypto_auth_verify", "crypto_box_beforenm", "crypto_box_curve25519xchacha20poly1305_beforenm", "crypto_box_curve25519xchacha20poly1305_detached", "crypto_box_curve25519xchacha20poly1305_detached_afternm", "crypto_box_curve25519xchacha20poly1305_easy", "crypto_box_curve25519xchacha20poly1305_easy_afternm", "crypto_box_curve25519xchacha20poly1305_keypair", "crypto_box_curve25519xchacha20poly1305_open_detached", "crypto_box_curve25519xchacha20poly1305_open_detached_afternm", "crypto_box_curve25519xchacha20poly1305_open_easy", "crypto_box_curve25519xchacha20poly1305_open_easy_afternm", "crypto_box_curve25519xchacha20poly1305_seal", "crypto_box_curve25519xchacha20poly1305_seal_open", "crypto_box_curve25519xchacha20poly1305_seed_keypair", "crypto_box_detached", "crypto_box_easy", "crypto_box_easy_afternm", "crypto_box_keypair", "crypto_box_open_detached", "crypto_box_open_easy", "crypto_box_open_easy_afternm", "crypto_box_seal", "crypto_box_seal_open", "crypto_box_seed_keypair", "crypto_core_ed25519_add", "crypto_core_ed25519_from_hash", "crypto_core_ed25519_from_uniform", "crypto_core_ed25519_is_valid_point", "crypto_core_ed25519_random", "crypto_core_ed25519_scalar_add", "crypto_core_ed25519_scalar_complement", "crypto_core_ed25519_scalar_invert", "crypto_core_ed25519_scalar_mul", "crypto_core_ed25519_scalar_negate", "crypto_core_ed25519_scalar_random", "crypto_core_ed25519_scalar_reduce", "crypto_core_ed25519_scalar_sub", "crypto_core_ed25519_sub", "crypto_core_hchacha20", "crypto_core_hsalsa20", "crypto_core_ristretto255_add", "crypto_core_ristretto255_from_hash", "crypto_core_ristretto255_is_valid_point", "crypto_core_ristretto255_random", "crypto_core_ristretto255_scalar_add", "crypto_core_ristretto255_scalar_complement", "crypto_core_ristretto255_scalar_invert", "crypto_core_ristretto255_scalar_mul", "crypto_core_ristretto255_scalar_negate", "crypto_core_ristretto255_scalar_random", "crypto_core_ristretto255_scalar_reduce", "crypto_core_ristretto255_scalar_sub", "crypto_core_ristretto255_sub", "crypto_generichash", "crypto_generichash_blake2b_salt_personal", "crypto_generichash_final", "crypto_generichash_init", "crypto_generichash_keygen", "crypto_generichash_update", "crypto_hash", "crypto_hash_sha256", "crypto_hash_sha256_final", "crypto_hash_sha256_init", "crypto_hash_sha256_update", "crypto_hash_sha512", "crypto_hash_sha512_final", "crypto_hash_sha512_init", "crypto_hash_sha512_update", "crypto_kdf_derive_from_key", "crypto_kdf_keygen", "crypto_kx_client_session_keys", "crypto_kx_keypair", "crypto_kx_seed_keypair", "crypto_kx_server_session_keys", "crypto_onetimeauth", "crypto_onetimeauth_final", "crypto_onetimeauth_init", "crypto_onetimeauth_keygen", "crypto_onetimeauth_update", "crypto_onetimeauth_verify", "crypto_pwhash", "crypto_pwhash_scryptsalsa208sha256", "crypto_pwhash_scryptsalsa208sha256_ll", "crypto_pwhash_scryptsalsa208sha256_str", "crypto_pwhash_scryptsalsa208sha256_str_verify", "crypto_pwhash_str", "crypto_pwhash_str_needs_rehash", "crypto_pwhash_str_verify", "crypto_scalarmult", "crypto_scalarmult_base", "crypto_scalarmult_ed25519", "crypto_scalarmult_ed25519_base", "crypto_scalarmult_ed25519_base_noclamp", "crypto_scalarmult_ed25519_noclamp", "crypto_scalarmult_ristretto255", "crypto_scalarmult_ristretto255_base", "crypto_secretbox_detached", "crypto_secretbox_easy", "crypto_secretbox_keygen", "crypto_secretbox_open_detached", "crypto_secretbox_open_easy", "crypto_secretstream_xchacha20poly1305_init_pull", "crypto_secretstream_xchacha20poly1305_init_push", "crypto_secretstream_xchacha20poly1305_keygen", "crypto_secretstream_xchacha20poly1305_pull", "crypto_secretstream_xchacha20poly1305_push", "crypto_secretstream_xchacha20poly1305_rekey", "crypto_shorthash", "crypto_shorthash_keygen", "crypto_shorthash_siphashx24", "crypto_sign", "crypto_sign_detached", "crypto_sign_ed25519_pk_to_curve25519", "crypto_sign_ed25519_sk_to_curve25519", "crypto_sign_ed25519_sk_to_pk", "crypto_sign_ed25519_sk_to_seed", "crypto_sign_final_create", "crypto_sign_final_verify", "crypto_sign_init", "crypto_sign_keypair", "crypto_sign_open", "crypto_sign_seed_keypair", "crypto_sign_update", "crypto_sign_verify_detached", "crypto_stream_chacha20", "crypto_stream_chacha20_ietf_xor", "crypto_stream_chacha20_ietf_xor_ic", "crypto_stream_chacha20_keygen", "crypto_stream_chacha20_xor", "crypto_stream_chacha20_xor_ic", "crypto_stream_keygen", "crypto_stream_xchacha20_keygen", "crypto_stream_xchacha20_xor", "crypto_stream_xchacha20_xor_ic", "randombytes_buf", "randombytes_buf_deterministic", "randombytes_close", "randombytes_random", "randombytes_set_implementation", "randombytes_stir", "randombytes_uniform", "sodium_version_string"], t3 = [x, k, S, T, w, Y, B, A, M, I, K, N, L, O, U, C, P, R, X, G, D, F, V, H, W, q, z, j, J, Q, Z, $, ee, ae, re, te, _e, ne, se, ce, he, oe, pe, ye, ie, le, ue, de, ve, ge, be, fe, me, Ee, xe, ke, Se, Te, we, Ye, Be, Ae, Me, Ie, Ke, Ne, Le, Oe, Ue, Ce, Pe, Re, Xe, Ge, De, Fe, Ve, He, We, qe, ze, je, Je, Qe, Ze, $e, ea, aa, ra, ta, _a, na, sa, ca, ha, oa, pa, ya, ia, la, ua, da, va, ga, ba, fa, ma, Ea, xa, ka, Sa, Ta, wa, Ya, Ba, Aa, Ma, Ia, Ka, Na, La, Oa, Ua, Ca, Pa, Ra, Xa, Ga, Da, Fa, Va, Ha, Wa, qa, za, ja, Ja, Qa, Za, $a, er, ar, rr, tr, _r, nr, sr, cr, hr, or, pr, yr, ir, lr, ur, dr, vr, gr, br, fr, mr, Er, xr, kr, Sr, Tr, wr, Yr, Br, Ar, Mr, Ir, Kr, Nr, Lr, Or, Ur, Cr, Pr, Rr, Xr, Gr, Dr, Fr, Vr, Hr, Wr, qr], _3 = 0; _3 < t3.length; _3++) "function" == typeof a["_" + e[_3]] && (r[e[_3]] = t3[_3]);
             var n3 = ["SODIUM_LIBRARY_VERSION_MAJOR", "SODIUM_LIBRARY_VERSION_MINOR", "crypto_aead_aegis128l_ABYTES", "crypto_aead_aegis128l_KEYBYTES", "crypto_aead_aegis128l_MESSAGEBYTES_MAX", "crypto_aead_aegis128l_NPUBBYTES", "crypto_aead_aegis128l_NSECBYTES", "crypto_aead_aegis256_ABYTES", "crypto_aead_aegis256_KEYBYTES", "crypto_aead_aegis256_MESSAGEBYTES_MAX", "crypto_aead_aegis256_NPUBBYTES", "crypto_aead_aegis256_NSECBYTES", "crypto_aead_aes256gcm_ABYTES", "crypto_aead_aes256gcm_KEYBYTES", "crypto_aead_aes256gcm_MESSAGEBYTES_MAX", "crypto_aead_aes256gcm_NPUBBYTES", "crypto_aead_aes256gcm_NSECBYTES", "crypto_aead_chacha20poly1305_ABYTES", "crypto_aead_chacha20poly1305_IETF_ABYTES", "crypto_aead_chacha20poly1305_IETF_KEYBYTES", "crypto_aead_chacha20poly1305_IETF_MESSAGEBYTES_MAX", "crypto_aead_chacha20poly1305_IETF_NPUBBYTES", "crypto_aead_chacha20poly1305_IETF_NSECBYTES", "crypto_aead_chacha20poly1305_KEYBYTES", "crypto_aead_chacha20poly1305_MESSAGEBYTES_MAX", "crypto_aead_chacha20poly1305_NPUBBYTES", "crypto_aead_chacha20poly1305_NSECBYTES", "crypto_aead_chacha20poly1305_ietf_ABYTES", "crypto_aead_chacha20poly1305_ietf_KEYBYTES", "crypto_aead_chacha20poly1305_ietf_MESSAGEBYTES_MAX", "crypto_aead_chacha20poly1305_ietf_NPUBBYTES", "crypto_aead_chacha20poly1305_ietf_NSECBYTES", "crypto_aead_xchacha20poly1305_IETF_ABYTES", "crypto_aead_xchacha20poly1305_IETF_KEYBYTES", "crypto_aead_xchacha20poly1305_IETF_MESSAGEBYTES_MAX", "crypto_aead_xchacha20poly1305_IETF_NPUBBYTES", "crypto_aead_xchacha20poly1305_IETF_NSECBYTES", "crypto_aead_xchacha20poly1305_ietf_ABYTES", "crypto_aead_xchacha20poly1305_ietf_KEYBYTES", "crypto_aead_xchacha20poly1305_ietf_MESSAGEBYTES_MAX", "crypto_aead_xchacha20poly1305_ietf_NPUBBYTES", "crypto_aead_xchacha20poly1305_ietf_NSECBYTES", "crypto_auth_BYTES", "crypto_auth_KEYBYTES", "crypto_auth_hmacsha256_BYTES", "crypto_auth_hmacsha256_KEYBYTES", "crypto_auth_hmacsha512256_BYTES", "crypto_auth_hmacsha512256_KEYBYTES", "crypto_auth_hmacsha512_BYTES", "crypto_auth_hmacsha512_KEYBYTES", "crypto_box_BEFORENMBYTES", "crypto_box_MACBYTES", "crypto_box_MESSAGEBYTES_MAX", "crypto_box_NONCEBYTES", "crypto_box_PUBLICKEYBYTES", "crypto_box_SEALBYTES", "crypto_box_SECRETKEYBYTES", "crypto_box_SEEDBYTES", "crypto_box_curve25519xchacha20poly1305_BEFORENMBYTES", "crypto_box_curve25519xchacha20poly1305_MACBYTES", "crypto_box_curve25519xchacha20poly1305_MESSAGEBYTES_MAX", "crypto_box_curve25519xchacha20poly1305_NONCEBYTES", "crypto_box_curve25519xchacha20poly1305_PUBLICKEYBYTES", "crypto_box_curve25519xchacha20poly1305_SEALBYTES", "crypto_box_curve25519xchacha20poly1305_SECRETKEYBYTES", "crypto_box_curve25519xchacha20poly1305_SEEDBYTES", "crypto_box_curve25519xsalsa20poly1305_BEFORENMBYTES", "crypto_box_curve25519xsalsa20poly1305_MACBYTES", "crypto_box_curve25519xsalsa20poly1305_MESSAGEBYTES_MAX", "crypto_box_curve25519xsalsa20poly1305_NONCEBYTES", "crypto_box_curve25519xsalsa20poly1305_PUBLICKEYBYTES", "crypto_box_curve25519xsalsa20poly1305_SECRETKEYBYTES", "crypto_box_curve25519xsalsa20poly1305_SEEDBYTES", "crypto_core_ed25519_BYTES", "crypto_core_ed25519_HASHBYTES", "crypto_core_ed25519_NONREDUCEDSCALARBYTES", "crypto_core_ed25519_SCALARBYTES", "crypto_core_ed25519_UNIFORMBYTES", "crypto_core_hchacha20_CONSTBYTES", "crypto_core_hchacha20_INPUTBYTES", "crypto_core_hchacha20_KEYBYTES", "crypto_core_hchacha20_OUTPUTBYTES", "crypto_core_hsalsa20_CONSTBYTES", "crypto_core_hsalsa20_INPUTBYTES", "crypto_core_hsalsa20_KEYBYTES", "crypto_core_hsalsa20_OUTPUTBYTES", "crypto_core_ristretto255_BYTES", "crypto_core_ristretto255_HASHBYTES", "crypto_core_ristretto255_NONREDUCEDSCALARBYTES", "crypto_core_ristretto255_SCALARBYTES", "crypto_core_salsa2012_CONSTBYTES", "crypto_core_salsa2012_INPUTBYTES", "crypto_core_salsa2012_KEYBYTES", "crypto_core_salsa2012_OUTPUTBYTES", "crypto_core_salsa208_CONSTBYTES", "crypto_core_salsa208_INPUTBYTES", "crypto_core_salsa208_KEYBYTES", "crypto_core_salsa208_OUTPUTBYTES", "crypto_core_salsa20_CONSTBYTES", "crypto_core_salsa20_INPUTBYTES", "crypto_core_salsa20_KEYBYTES", "crypto_core_salsa20_OUTPUTBYTES", "crypto_generichash_BYTES", "crypto_generichash_BYTES_MAX", "crypto_generichash_BYTES_MIN", "crypto_generichash_KEYBYTES", "crypto_generichash_KEYBYTES_MAX", "crypto_generichash_KEYBYTES_MIN", "crypto_generichash_blake2b_BYTES", "crypto_generichash_blake2b_BYTES_MAX", "crypto_generichash_blake2b_BYTES_MIN", "crypto_generichash_blake2b_KEYBYTES", "crypto_generichash_blake2b_KEYBYTES_MAX", "crypto_generichash_blake2b_KEYBYTES_MIN", "crypto_generichash_blake2b_PERSONALBYTES", "crypto_generichash_blake2b_SALTBYTES", "crypto_hash_BYTES", "crypto_hash_sha256_BYTES", "crypto_hash_sha512_BYTES", "crypto_kdf_BYTES_MAX", "crypto_kdf_BYTES_MIN", "crypto_kdf_CONTEXTBYTES", "crypto_kdf_KEYBYTES", "crypto_kdf_blake2b_BYTES_MAX", "crypto_kdf_blake2b_BYTES_MIN", "crypto_kdf_blake2b_CONTEXTBYTES", "crypto_kdf_blake2b_KEYBYTES", "crypto_kdf_hkdf_sha256_BYTES_MAX", "crypto_kdf_hkdf_sha256_BYTES_MIN", "crypto_kdf_hkdf_sha256_KEYBYTES", "crypto_kdf_hkdf_sha512_BYTES_MAX", "crypto_kdf_hkdf_sha512_BYTES_MIN", "crypto_kdf_hkdf_sha512_KEYBYTES", "crypto_kx_PUBLICKEYBYTES", "crypto_kx_SECRETKEYBYTES", "crypto_kx_SEEDBYTES", "crypto_kx_SESSIONKEYBYTES", "crypto_onetimeauth_BYTES", "crypto_onetimeauth_KEYBYTES", "crypto_onetimeauth_poly1305_BYTES", "crypto_onetimeauth_poly1305_KEYBYTES", "crypto_pwhash_ALG_ARGON2I13", "crypto_pwhash_ALG_ARGON2ID13", "crypto_pwhash_ALG_DEFAULT", "crypto_pwhash_BYTES_MAX", "crypto_pwhash_BYTES_MIN", "crypto_pwhash_MEMLIMIT_INTERACTIVE", "crypto_pwhash_MEMLIMIT_MAX", "crypto_pwhash_MEMLIMIT_MIN", "crypto_pwhash_MEMLIMIT_MODERATE", "crypto_pwhash_MEMLIMIT_SENSITIVE", "crypto_pwhash_OPSLIMIT_INTERACTIVE", "crypto_pwhash_OPSLIMIT_MAX", "crypto_pwhash_OPSLIMIT_MIN", "crypto_pwhash_OPSLIMIT_MODERATE", "crypto_pwhash_OPSLIMIT_SENSITIVE", "crypto_pwhash_PASSWD_MAX", "crypto_pwhash_PASSWD_MIN", "crypto_pwhash_SALTBYTES", "crypto_pwhash_STRBYTES", "crypto_pwhash_argon2i_BYTES_MAX", "crypto_pwhash_argon2i_BYTES_MIN", "crypto_pwhash_argon2i_MEMLIMIT_INTERACTIVE", "crypto_pwhash_argon2i_MEMLIMIT_MAX", "crypto_pwhash_argon2i_MEMLIMIT_MIN", "crypto_pwhash_argon2i_MEMLIMIT_MODERATE", "crypto_pwhash_argon2i_MEMLIMIT_SENSITIVE", "crypto_pwhash_argon2i_OPSLIMIT_INTERACTIVE", "crypto_pwhash_argon2i_OPSLIMIT_MAX", "crypto_pwhash_argon2i_OPSLIMIT_MIN", "crypto_pwhash_argon2i_OPSLIMIT_MODERATE", "crypto_pwhash_argon2i_OPSLIMIT_SENSITIVE", "crypto_pwhash_argon2i_PASSWD_MAX", "crypto_pwhash_argon2i_PASSWD_MIN", "crypto_pwhash_argon2i_SALTBYTES", "crypto_pwhash_argon2i_STRBYTES", "crypto_pwhash_argon2id_BYTES_MAX", "crypto_pwhash_argon2id_BYTES_MIN", "crypto_pwhash_argon2id_MEMLIMIT_INTERACTIVE", "crypto_pwhash_argon2id_MEMLIMIT_MAX", "crypto_pwhash_argon2id_MEMLIMIT_MIN", "crypto_pwhash_argon2id_MEMLIMIT_MODERATE", "crypto_pwhash_argon2id_MEMLIMIT_SENSITIVE", "crypto_pwhash_argon2id_OPSLIMIT_INTERACTIVE", "crypto_pwhash_argon2id_OPSLIMIT_MAX", "crypto_pwhash_argon2id_OPSLIMIT_MIN", "crypto_pwhash_argon2id_OPSLIMIT_MODERATE", "crypto_pwhash_argon2id_OPSLIMIT_SENSITIVE", "crypto_pwhash_argon2id_PASSWD_MAX", "crypto_pwhash_argon2id_PASSWD_MIN", "crypto_pwhash_argon2id_SALTBYTES", "crypto_pwhash_argon2id_STRBYTES", "crypto_pwhash_scryptsalsa208sha256_BYTES_MAX", "crypto_pwhash_scryptsalsa208sha256_BYTES_MIN", "crypto_pwhash_scryptsalsa208sha256_MEMLIMIT_INTERACTIVE", "crypto_pwhash_scryptsalsa208sha256_MEMLIMIT_MAX", "crypto_pwhash_scryptsalsa208sha256_MEMLIMIT_MIN", "crypto_pwhash_scryptsalsa208sha256_MEMLIMIT_SENSITIVE", "crypto_pwhash_scryptsalsa208sha256_OPSLIMIT_INTERACTIVE", "crypto_pwhash_scryptsalsa208sha256_OPSLIMIT_MAX", "crypto_pwhash_scryptsalsa208sha256_OPSLIMIT_MIN", "crypto_pwhash_scryptsalsa208sha256_OPSLIMIT_SENSITIVE", "crypto_pwhash_scryptsalsa208sha256_PASSWD_MAX", "crypto_pwhash_scryptsalsa208sha256_PASSWD_MIN", "crypto_pwhash_scryptsalsa208sha256_SALTBYTES", "crypto_pwhash_scryptsalsa208sha256_STRBYTES", "crypto_scalarmult_BYTES", "crypto_scalarmult_SCALARBYTES", "crypto_scalarmult_curve25519_BYTES", "crypto_scalarmult_curve25519_SCALARBYTES", "crypto_scalarmult_ed25519_BYTES", "crypto_scalarmult_ed25519_SCALARBYTES", "crypto_scalarmult_ristretto255_BYTES", "crypto_scalarmult_ristretto255_SCALARBYTES", "crypto_secretbox_KEYBYTES", "crypto_secretbox_MACBYTES", "crypto_secretbox_MESSAGEBYTES_MAX", "crypto_secretbox_NONCEBYTES", "crypto_secretbox_xchacha20poly1305_KEYBYTES", "crypto_secretbox_xchacha20poly1305_MACBYTES", "crypto_secretbox_xchacha20poly1305_MESSAGEBYTES_MAX", "crypto_secretbox_xchacha20poly1305_NONCEBYTES", "crypto_secretbox_xsalsa20poly1305_KEYBYTES", "crypto_secretbox_xsalsa20poly1305_MACBYTES", "crypto_secretbox_xsalsa20poly1305_MESSAGEBYTES_MAX", "crypto_secretbox_xsalsa20poly1305_NONCEBYTES", "crypto_secretstream_xchacha20poly1305_ABYTES", "crypto_secretstream_xchacha20poly1305_HEADERBYTES", "crypto_secretstream_xchacha20poly1305_KEYBYTES", "crypto_secretstream_xchacha20poly1305_MESSAGEBYTES_MAX", "crypto_secretstream_xchacha20poly1305_TAG_FINAL", "crypto_secretstream_xchacha20poly1305_TAG_MESSAGE", "crypto_secretstream_xchacha20poly1305_TAG_PUSH", "crypto_secretstream_xchacha20poly1305_TAG_REKEY", "crypto_shorthash_BYTES", "crypto_shorthash_KEYBYTES", "crypto_shorthash_siphash24_BYTES", "crypto_shorthash_siphash24_KEYBYTES", "crypto_shorthash_siphashx24_BYTES", "crypto_shorthash_siphashx24_KEYBYTES", "crypto_sign_BYTES", "crypto_sign_MESSAGEBYTES_MAX", "crypto_sign_PUBLICKEYBYTES", "crypto_sign_SECRETKEYBYTES", "crypto_sign_SEEDBYTES", "crypto_sign_ed25519_BYTES", "crypto_sign_ed25519_MESSAGEBYTES_MAX", "crypto_sign_ed25519_PUBLICKEYBYTES", "crypto_sign_ed25519_SECRETKEYBYTES", "crypto_sign_ed25519_SEEDBYTES", "crypto_stream_KEYBYTES", "crypto_stream_MESSAGEBYTES_MAX", "crypto_stream_NONCEBYTES", "crypto_stream_chacha20_IETF_KEYBYTES", "crypto_stream_chacha20_IETF_MESSAGEBYTES_MAX", "crypto_stream_chacha20_IETF_NONCEBYTES", "crypto_stream_chacha20_KEYBYTES", "crypto_stream_chacha20_MESSAGEBYTES_MAX", "crypto_stream_chacha20_NONCEBYTES", "crypto_stream_chacha20_ietf_KEYBYTES", "crypto_stream_chacha20_ietf_MESSAGEBYTES_MAX", "crypto_stream_chacha20_ietf_NONCEBYTES", "crypto_stream_salsa2012_KEYBYTES", "crypto_stream_salsa2012_MESSAGEBYTES_MAX", "crypto_stream_salsa2012_NONCEBYTES", "crypto_stream_salsa208_KEYBYTES", "crypto_stream_salsa208_MESSAGEBYTES_MAX", "crypto_stream_salsa208_NONCEBYTES", "crypto_stream_salsa20_KEYBYTES", "crypto_stream_salsa20_MESSAGEBYTES_MAX", "crypto_stream_salsa20_NONCEBYTES", "crypto_stream_xchacha20_KEYBYTES", "crypto_stream_xchacha20_MESSAGEBYTES_MAX", "crypto_stream_xchacha20_NONCEBYTES", "crypto_stream_xsalsa20_KEYBYTES", "crypto_stream_xsalsa20_MESSAGEBYTES_MAX", "crypto_stream_xsalsa20_NONCEBYTES", "crypto_verify_16_BYTES", "crypto_verify_32_BYTES", "crypto_verify_64_BYTES"];
             for (_3 = 0; _3 < n3.length; _3++) "function" == typeof (c3 = a["_" + n3[_3].toLowerCase()]) && (r[n3[_3]] = c3());
             var s3 = ["SODIUM_VERSION_STRING", "crypto_pwhash_STRPREFIX", "crypto_pwhash_argon2i_STRPREFIX", "crypto_pwhash_argon2id_STRPREFIX", "crypto_pwhash_scryptsalsa208sha256_STRPREFIX"];
@@ -68312,6 +68035,39 @@ var init_dist = __esm({
             const s2 = this._requireState();
             return s2.groupContext.groupId;
           }
+          /**
+           * Proof that this client actually holds the group's keys at its current
+           * epoch. Throws if not initialized.
+           *
+           * RFC 9420 §8.2's `epoch_authenticator`, derived from the epoch secret. Two
+           * properties make it the thing this codebase has been missing:
+           *
+           *   * every member at the same epoch computes the SAME value, so it is
+           *     comparable across clients and can be checked by a server;
+           *   * it cannot be computed without the key schedule, so possessing it is
+           *     evidence of membership rather than a claim about it. RFC 9420 names
+           *     this as its purpose: "to authenticate the shared group state".
+           *
+           * It is safe to publish. It is a KDF output over the epoch secret, not the
+           * secret, and the RFC intends it to be shown to out-of-band verifiers.
+           *
+           * WHY THIS EXISTS. `mls_groups.member_device_ids` records membership; the
+           * ability to decrypt lives only in one browser's localStorage. Nothing
+           * compared the two, and nothing could — so a device in the roster holding no
+           * keys was indistinguishable from a healthy one, on every signal the server
+           * has. Measured on production 2026-08-26: one owner device carried the keys
+           * for 19 of the 21 owner leaves on the platform, and one 1:1 group had been
+           * unreadable by its owner's browser for two months while every status column
+           * read healthy.
+           *
+           * `epoch` alone cannot do this job: it is a number the client reports about
+           * itself, it collides across groups, and a client that has lost its state
+           * still remembers one.
+           */
+          get epochAuthenticator() {
+            const s2 = this._requireState();
+            return s2.keySchedule.epochAuthenticator;
+          }
           /** The cipher suite name in use. */
           get ciphersuiteName() {
             return this._ciphersuiteName;
@@ -68462,11 +68218,84 @@ var init_dist = __esm({
             return { commit: commitBytes, welcome: welcomeBytes };
           }
           /**
-           * Remove a member from the group by leaf index.
+           * Admit N members with TWO commits total, replacing any stale leaf they hold.
+           *
+           * `addMembers` cannot do this alone: MLS rejects an Add for an identity
+           * already in the tree, so a member that lost its local state must be removed
+           * first. Doing that pair PER MEMBER is what the fulfiller did, and it is not
+           * merely slow — it is self-defeating.
+           *
+           * Live 2026-08-28 14:02:21-28Z: the owner sweep re-admitted 7 room members
+           * sequentially, each as its own removeMember + addMembers. Room 007 ran
+           * **epoch 71 -> 85 in seven seconds**, and the Welcome minted for member n
+           * named an epoch that member n+1's commit had already replaced — so six of
+           * seven were stale before they finished joining, and one (`smartcode`) could
+           * not replay forward afterwards at all.
            *
-           * @param memberIndex - The leaf index of the member to remove.
-           * @returns The commit message to broadcast.
+           * 🎯 A REPAIR THAT MOVES THE EPOCH ONCE PER MEMBER IS RACING ITSELF.
+           *
+           * ⚠️ **Why two commits and not one.** RFC 9420 §12.3 allows Remove and Add in
+           * a single commit, and ts-mls builds it happily — but with MORE THAN ONE of
+           * each, a REMAINING member fails to process it:
+           *
+           *     OpenError  at applyUpdatePathSecret (ts-mls/src/createCommit.ts:471)
+           *                at updatePrivateKeyPath  (processMessages.ts:397)
+           *
+           * One remove + one add in a single commit is fine; 2+2 is not. That is
+           * pinned by a test in `mls-group.test.ts` so this cannot be "optimised" back
+           * into one commit without the failure showing up first. Two commits still
+           * turns 7 members from 14 epochs into 2, and every joiner lands current.
+           *
+           * @param keyPackages - Fresh KeyPackages, one per member to admit. Members
+           *   already holding a leaf are removed by the first commit; members with no
+           *   leaf are plain adds. Duplicate identities keep the first KeyPackage.
+           * @returns Every commit to broadcast IN ORDER, and the Welcome to deliver to
+           *   EVERY member in the batch (each finds its own secrets inside it).
            */
+          async reAdmitMembers(keyPackages) {
+            this._requireState();
+            await this._ensureCiphersuite();
+            const seenIdentities = [];
+            const toAdd = [];
+            const leavesToRemove = [];
+            for (const kp of keyPackages) {
+              const identity = keyPackageIdentity(kp);
+              if (identity !== null) {
+                if (seenIdentities.some((id) => bytesEqual(id, identity)))
+                  continue;
+                seenIdentities.push(identity);
+                const leaf = this.memberLeafIndex(identity);
+                if (leaf !== null)
+                  leavesToRemove.push(leaf);
+              }
+              toAdd.push(kp);
+            }
+            if (toAdd.length === 0) {
+              throw new Error("reAdmitMembers: no members to admit");
+            }
+            const commits = [];
+            if (leavesToRemove.length > 0) {
+              const { commit } = await this.removeMembers(leavesToRemove);
+              commits.push({ commit, epoch: this.epoch });
+            }
+            const added = await this.addMembers(toAdd);
+            commits.push({ commit: added.commit, epoch: this.epoch });
+            return { commits, welcome: added.welcome };
+          }
+          async removeMembers(memberIndices) {
+            const s2 = this._requireState();
+            const cs = await this._ensureCiphersuite();
+            if (memberIndices.length === 0) {
+              throw new Error("removeMembers: no members to remove");
+            }
+            const extraProposals = memberIndices.map((removed) => ({
+              proposalType: "remove",
+              remove: { removed }
+            }));
+            const result = await createCommit({ state: s2, cipherSuite: cs, pskIndex: this._pskIndex }, { extraProposals });
+            this.state = result.newState;
+            return { commit: encodeMlsMessage(result.commit) };
+          }
           async removeMember(memberIndex) {
             const s2 = this._requireState();
             const cs = await this._ensureCiphersuite();
@@ -68770,7 +68599,7 @@ var init_dist = __esm({
         "use strict";
         init_secure_file();
         SYNC_LOCK_STALE_MS = 5 * 60 * 1e3;
-        pendingKpPath = (dataDir, groupId) => join10(dataDir, `mls-kp-pending-${groupId.replace(/[^a-zA-Z0-9_-]/g, "_")}.json`);
+        pendingKpPath = (dataDir, groupId) => join6(dataDir, `mls-kp-pending-${groupId.replace(/[^a-zA-Z0-9_-]/g, "_")}.json`);
       }
     });
     init_mls_kp_pool = __esm2({
@@ -69026,6 +68855,7 @@ var init_dist = __esm({
     init_channel = __esm2({
       async "src/channel.ts"() {
         "use strict";
+        init_abstention();
         init_mls_commit_classify();
         await init_libsodium_wrappers();
         await init_dist2();
@@ -69455,6 +69285,18 @@ var init_dist = __esm({
           get ownHubAddress() {
             return this._persisted?.hubAddress ?? "";
           }
+          /** This agent's AgentVault hub_id. "" until enrolment persists it.
+           *
+           * Lives in the credential store, NOT in the channel config — which is where
+           * the memory-recall helper was reading it from. `channel.config.hubId` is
+           * unset for every agent enrolled through the normal flow, so
+           * `channel.config.hubId || ""` produced `/api/v1/agents//memory/search`, a
+           * 404 on every inbound message, swallowed by `if (!res.ok) return ""`.
+           * Memory recall was silently dead while the hub_id sat right here.
+           */
+          get ownHubId() {
+            return this._persisted?.hubId ?? "";
+          }
           /** Public best-effort trigger to (re)resolve this agent's display_name.
            * Called lazily from the 1:1 DM path when the name is still unknown, so a
            * resolve that failed at connect (or a fresh agent that hadn't registered
@@ -69843,6 +69685,7 @@ var init_dist = __esm({
            * Each session gets the same plaintext encrypted independently.
            */
           async send(plaintext, options) {
+            if (isAbstention(plaintext)) return;
             if (this._state === "error" || this._state === "idle") {
               throw new Error("Channel is not ready");
             }
@@ -70171,7 +70014,7 @@ var init_dist = __esm({
            */
           sendActivitySpan(spanData) {
             if (!this._ws || this._ws.readyState !== WebSocket.OPEN) return;
-            const pluginVersion = true ? "0.23.27" : "0.0.0-dev";
+            const pluginVersion = true ? "0.23.29" : "0.0.0-dev";
             const agentName = this.config.agentName ?? "Agent";
             const resource = {
               "service.name": "agentvault-agent",
@@ -70365,6 +70208,7 @@ var init_dist = __esm({
            * Uses MLS (preferred) or pairwise fan-out as fallback.
            */
           async sendToRoom(roomId, plaintext, opts) {
+            if (isAbstention(plaintext)) return;
             if (!this._persisted?.rooms?.[roomId]) {
               throw new Error(`Room ${roomId} not found`);
             }
@@ -72064,7 +71908,7 @@ var init_dist = __esm({
               return;
             }
             const wsUrl = this.config.apiUrl.replace(/^http/, "ws");
-            const url22 = `${wsUrl}/api/v1/ws?token=${encodeURIComponent(this._deviceJwt)}&device_id=${this._deviceId}&client_version=${encodeURIComponent(buildClientVersion2(this.config.clientVersion))}`;
+            const url22 = `${wsUrl}/api/v1/ws?token=${encodeURIComponent(this._deviceJwt)}&device_id=${this._deviceId}&client_version=${encodeURIComponent(buildClientVersion(this.config.clientVersion))}`;
             const ws = new WebSocket(url22);
             this._ws = ws;
             ws.on("open", async () => {
@@ -72108,7 +71952,7 @@ var init_dist = __esm({
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.27" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.29" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -72432,7 +72276,7 @@ var init_dist = __esm({
                         agentVersion: this.config.agentVersion ?? "0.0.0",
                         // __AV_VERSION__ is injected by esbuild from package.json at build time.
                         // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                        pluginVersion: true ? "0.23.27" : "0.0.0-dev"
+                        pluginVersion: true ? "0.23.29" : "0.0.0-dev"
                       });
                       this._telemetryReporter.startAutoFlush(3e4);
                     }
@@ -76296,7 +76140,7 @@ ${messageText}`;
                 channel.on("error", (err) => {
                   _log?.(formatChannelError(err));
                 });
-                attachLifecycle2(channel, {
+                attachLifecycle(channel, {
                   agentName: account.agentName,
                   log: (m2) => _log?.(`[AgentVault] ${m2}`),
                   onTerminal: async () => {
@@ -76412,6 +76256,11 @@ ${actionsText}`);
         init_openclaw_compat();
       }
     });
+    init_room_protocol = __esm2({
+      "src/room-protocol.ts"() {
+        "use strict";
+      }
+    });
     init_llm_response_parser = __esm2({
       "src/llm-response-parser.ts"() {
         "use strict";
@@ -76443,6 +76292,7 @@ ${actionsText}`);
     init_openclaw_entry = __esm2({
       "src/openclaw-entry.ts"() {
         "use strict";
+        init_room_protocol();
         init_account_config();
         init_fetch_interceptor();
         init_http_handlers();
@@ -80226,7 +80076,7 @@ ${actionsText}`);
       cloneDef: () => cloneDef,
       createTransparentProxy: () => createTransparentProxy,
       defineLazy: () => defineLazy,
-      esc: () => esc2,
+      esc: () => esc,
       escapeRegex: () => escapeRegex,
       extend: () => extend,
       finalizeIssue: () => finalizeIssue,
@@ -81862,7 +81712,7 @@ ${actionsText}`);
             const doc = new Doc(["shape", "payload", "ctx"]);
             const normalized = _normalized.value;
             const parseStr = (key) => {
-              const k2 = esc2(key);
+              const k2 = esc(key);
               return `shape[${k2}]._zod.run({ value: input[${k2}], issues: [] }, ctx)`;
             };
             doc.write(`const input = payload.value;`);
@@ -81874,7 +81724,7 @@ ${actionsText}`);
             doc.write(`const newResult = {};`);
             for (const key of normalized.keys) {
               const id = ids[key];
-              const k2 = esc2(key);
+              const k2 = esc(key);
               const schema = shape[key];
               const isOptionalOut = schema?._zod?.optout === "optional";
               doc.write(`const ${id} = ${parseStr(key)};`);
@@ -97665,40 +97515,477 @@ data:
         init_skill_invoker();
         await init_skill_telemetry();
         await init_policy_enforcer();
-        VERSION = true ? "0.23.27" : "0.0.0-dev";
+        init_room_protocol();
+        VERSION = true ? "0.23.29" : "0.0.0-dev";
       }
     });
     await init_index();
   }
 });
 
-// src/index.ts
-init_config();
-init_log();
-import { chmodSync as chmodSync5, mkdirSync as mkdirSync6 } from "node:fs";
+// src/service/launcher.ts
+import { dirname as dirname2 } from "node:path";
+function sq(s2) {
+  return `'${s2.replace(/'/g, `'\\''`)}'`;
+}
+function candidateExpr(c2) {
+  return c2.includes("$") ? `"${c2}"` : sq(c2);
+}
+function renderLauncher(opts) {
+  const candidates = ["node", ...opts.fallbacks ?? FALLBACK_NODES];
+  const lines = [
+    "#!/usr/bin/env bash",
+    "# AgentVault muse-bridge launcher \u2014 regenerated on every `install`. Resolves node at",
+    "# boot so a node upgrade / version-manager switch can't strand the daemon."
+  ];
+  if (opts.installPath) lines.push(`export PATH=${sq(opts.installPath)}:"$PATH"`);
+  for (const c2 of candidates) {
+    lines.push(`if n=$(command -v ${candidateExpr(c2)} 2>/dev/null); then exec "$n" ${sq(opts.entrypoint)} "$@"; fi`);
+  }
+  lines.push(
+    `echo "[muse-bridge] node not found on PATH or known locations \u2014 re-run: agentvault-muse-bridge install" >&2`,
+    "exit 0"
+  );
+  return lines.join("\n") + "\n";
+}
+function writeLauncher(deps, spec) {
+  deps.mkdir(dirname2(spec.launcherPath));
+  deps.writeFile(spec.launcherPath, spec.launcherScript);
+  deps.chmod(spec.launcherPath, 493);
+}
+var FALLBACK_NODES;
+var init_launcher = __esm({
+  "src/service/launcher.ts"() {
+    "use strict";
+    FALLBACK_NODES = [
+      "/opt/homebrew/bin/node",
+      "/usr/local/bin/node",
+      "/usr/bin/node",
+      "$HOME/.volta/bin/node",
+      "$HOME/.asdf/shims/node",
+      "$HOME/.local/bin/node"
+    ];
+  }
+});
 
-// src/fence-auth.ts
-import { copyFileSync, chmodSync as chmodSync2, existsSync as existsSync2, mkdirSync as mkdirSync2 } from "node:fs";
-import { join as join2 } from "node:path";
-function seedFenceCredential(opts) {
-  const log = opts.log ?? (() => {
-  });
-  const fenceAuth = join2(opts.fenceHome, ".config", "muse", "auth.json");
-  if (existsSync2(fenceAuth)) {
-    log("[muse-bridge] fence credential already present; leaving it untouched");
-    return "already-present";
+// src/service/spec.ts
+import { join as join7 } from "node:path";
+function buildServiceSpec(cfg, opts) {
+  const env = {
+    AV_AGENT_NAME: cfg.agentName,
+    AV_DATA_DIR: cfg.dataDir,
+    AV_API_URL: cfg.apiUrl,
+    AV_FENCE_HOME: cfg.fenceHome,
+    AV_MUSE_PATH: cfg.musePath
+  };
+  if (cfg.workspaceDir) env.AV_WORKSPACE_DIR = cfg.workspaceDir;
+  const launcherPath = join7(cfg.dataDir, "launch-muse-bridge.sh");
+  return {
+    label: `dev.agentvault.muse-${slugify(cfg.agentName)}`,
+    programArgs: [launcherPath],
+    launcherPath,
+    launcherScript: renderLauncher({ installPath: opts.path, entrypoint: opts.entrypoint }),
+    env,
+    workingDir: cfg.workspaceDir ? cfg.workspaceDir : opts.home,
+    logOut: join7(cfg.dataDir, "logs", "muse-bridge.log"),
+    logErr: join7(cfg.dataDir, "logs", "muse-bridge.error.log"),
+    keepAliveUnlessCleanExit: true,
+    runAtLoad: true
+  };
+}
+var init_spec = __esm({
+  "src/service/spec.ts"() {
+    "use strict";
+    init_config();
+    init_launcher();
   }
-  const hostAuth = join2(opts.hostHome, ".config", "muse", "auth.json");
-  if (!existsSync2(hostAuth)) {
-    log("[muse-bridge] no host credential to seed (run `muse login`, or set META_API_KEY)");
-    return "no-host-credential";
+});
+
+// src/service/launchd.ts
+import { dirname as dirname3, join as join8 } from "node:path";
+function esc2(s2) {
+  return s2.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function renderLaunchdPlist(spec) {
+  const args = spec.programArgs.map((a2) => `		<string>${esc2(a2)}</string>`).join("\n");
+  const envEntries = Object.entries(spec.env).map(([k2, v2]) => `		<key>${esc2(k2)}</key>
+		<string>${esc2(v2)}</string>`).join("\n");
+  const keepAlive = spec.keepAliveUnlessCleanExit ? "<key>KeepAlive</key>\n	<dict>\n		<key>SuccessfulExit</key>\n		<false/>\n	</dict>" : "<key>KeepAlive</key>\n	<false/>";
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>Label</key>
+	<string>${esc2(spec.label)}</string>
+	<key>ProgramArguments</key>
+	<array>
+${args}
+	</array>
+	<key>EnvironmentVariables</key>
+	<dict>
+${envEntries}
+	</dict>
+	<key>WorkingDirectory</key>
+	<string>${esc2(spec.workingDir)}</string>
+	<key>StandardOutPath</key>
+	<string>${esc2(spec.logOut)}</string>
+	<key>StandardErrorPath</key>
+	<string>${esc2(spec.logErr)}</string>
+	${keepAlive}
+	<key>RunAtLoad</key>
+	${spec.runAtLoad ? "<true/>" : "<false/>"}
+</dict>
+</plist>
+`;
+}
+function parsePlistEnv(xml) {
+  const out = {};
+  const keyIdx = xml.indexOf("<key>EnvironmentVariables</key>");
+  if (keyIdx < 0) return out;
+  const open = xml.indexOf("<dict>", keyIdx);
+  if (open < 0) return out;
+  let depth = 0;
+  let i2 = open;
+  let close = -1;
+  const tag = /<(\/?)dict>/g;
+  tag.lastIndex = open;
+  let m2;
+  while (m2 = tag.exec(xml)) {
+    depth += m2[1] ? -1 : 1;
+    if (depth === 0) {
+      close = m2.index;
+      break;
+    }
+    i2 = m2.index;
   }
-  mkdirSync2(join2(opts.fenceHome, ".config", "muse"), { recursive: true });
-  copyFileSync(hostAuth, fenceAuth);
-  chmodSync2(fenceAuth, 384);
-  log("[muse-bridge] seeded fence credential from the host muse login");
-  return "seeded";
+  void i2;
+  if (close < 0) return out;
+  const body = xml.slice(open, close);
+  const pair = /<key>([\s\S]*?)<\/key>\s*<string>([\s\S]*?)<\/string>/g;
+  let p2;
+  while (p2 = pair.exec(body)) out[unesc(p2[1])] = unesc(p2[2]);
+  return out;
+}
+function unesc(s2) {
+  return s2.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&amp;/g, "&");
+}
+var LaunchdBackend;
+var init_launchd = __esm({
+  "src/service/launchd.ts"() {
+    "use strict";
+    init_launcher();
+    LaunchdBackend = class {
+      constructor(deps) {
+        this.deps = deps;
+      }
+      deps;
+      plistPath(label) {
+        return join8(this.deps.home, "Library", "LaunchAgents", `${label}.plist`);
+      }
+      domain() {
+        return `gui/${this.deps.uid}`;
+      }
+      install(spec) {
+        const path2 = this.plistPath(spec.label);
+        this.deps.mkdir(dirname3(spec.logOut));
+        writeLauncher(this.deps, spec);
+        this.deps.mkdir(dirname3(path2));
+        this.deps.writeFile(path2, renderLaunchdPlist(spec));
+        const svc = `${this.domain()}/${spec.label}`;
+        this.deps.exec("launchctl", ["bootout", svc]);
+        this.waitUntilGone(svc);
+        let r2 = this.deps.exec("launchctl", ["bootstrap", this.domain(), path2]);
+        for (let i2 = 0; i2 < 5 && r2.code !== 0; i2++) {
+          this.deps.exec("sleep", ["0.3"]);
+          r2 = this.deps.exec("launchctl", ["bootstrap", this.domain(), path2]);
+        }
+        this.deps.exec("launchctl", ["kickstart", "-k", svc]);
+      }
+      waitUntilGone(svc) {
+        for (let i2 = 0; i2 < 20; i2++) {
+          if (this.deps.exec("launchctl", ["print", svc]).code !== 0) return;
+          this.deps.exec("sleep", ["0.25"]);
+        }
+      }
+      restart(label) {
+        this.deps.exec("launchctl", ["kickstart", "-k", `${this.domain()}/${label}`]);
+      }
+      uninstall(label) {
+        this.deps.exec("launchctl", ["bootout", `${this.domain()}/${label}`]);
+        const path2 = this.plistPath(label);
+        if (this.deps.exists(path2)) this.deps.rm(path2);
+      }
+      status(label) {
+        const r2 = this.deps.exec("launchctl", ["print", `${this.domain()}/${label}`]);
+        return { loaded: r2.code === 0, detail: r2.stdout };
+      }
+      list(prefix) {
+        const dir = join8(this.deps.home, "Library", "LaunchAgents");
+        const out = [];
+        for (const name of this.deps.readdir(dir)) {
+          if (!name.startsWith(prefix) || !name.endsWith(".plist")) continue;
+          const path2 = join8(dir, name);
+          out.push({
+            label: name.slice(0, -".plist".length),
+            path: path2,
+            env: parsePlistEnv(this.deps.readFile(path2))
+          });
+        }
+        return out.sort((a2, b2) => a2.label.localeCompare(b2.label));
+      }
+    };
+  }
+});
+
+// src/service/systemd.ts
+import { dirname as dirname4, join as join9 } from "node:path";
+function q2(s2) {
+  const esc3 = s2.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t").replace(/%/g, "%%");
+  return `"${esc3}"`;
+}
+function renderSystemdUnit(spec) {
+  const exec = spec.programArgs.map(q2).join(" ");
+  const envLines = Object.entries(spec.env).map(([k2, v2]) => `Environment=${q2(`${k2}=${v2}`)}`).join("\n");
+  return `[Unit]
+Description=AgentVault muse bridge (${spec.label})
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+ExecStart=${exec}
+WorkingDirectory=${spec.workingDir}
+${envLines}
+Restart=on-failure
+SuccessExitStatus=0
+StandardOutput=append:${spec.logOut}
+StandardError=append:${spec.logErr}
+
+[Install]
+WantedBy=default.target
+`;
+}
+function parseUnitEnv(text) {
+  const out = {};
+  for (const line of text.split("\n")) {
+    const m2 = /^Environment="([\s\S]*)"\s*$/.exec(line.trim());
+    if (!m2) continue;
+    const eq = unq(m2[1]);
+    const at = eq.indexOf("=");
+    if (at <= 0) continue;
+    out[eq.slice(0, at)] = eq.slice(at + 1);
+  }
+  return out;
+}
+function unq(s2) {
+  return s2.replace(/%%/g, "%").replace(
+    /\\([\s\S])/g,
+    (_2, c2) => c2 === "n" ? "\n" : c2 === "r" ? "\r" : c2 === "t" ? "	" : c2
+  );
+}
+var SystemdBackend;
+var init_systemd = __esm({
+  "src/service/systemd.ts"() {
+    "use strict";
+    init_launcher();
+    SystemdBackend = class {
+      constructor(deps) {
+        this.deps = deps;
+      }
+      deps;
+      unitPath(label) {
+        return join9(this.deps.home, ".config", "systemd", "user", `${label}.service`);
+      }
+      install(spec) {
+        const path2 = this.unitPath(spec.label);
+        this.deps.mkdir(dirname4(spec.logOut));
+        writeLauncher(this.deps, spec);
+        this.deps.mkdir(dirname4(path2));
+        this.deps.writeFile(path2, renderSystemdUnit(spec));
+        this.deps.exec("loginctl", ["enable-linger", this.deps.user]);
+        this.deps.exec("systemctl", ["--user", "daemon-reload"]);
+        this.deps.exec("systemctl", ["--user", "enable", `${spec.label}.service`]);
+        this.deps.exec("systemctl", ["--user", "restart", `${spec.label}.service`]);
+      }
+      restart(label) {
+        this.deps.exec("systemctl", ["--user", "restart", `${label}.service`]);
+      }
+      uninstall(label) {
+        this.deps.exec("systemctl", ["--user", "disable", "--now", `${label}.service`]);
+        const path2 = this.unitPath(label);
+        if (this.deps.exists(path2)) this.deps.rm(path2);
+        this.deps.exec("systemctl", ["--user", "daemon-reload"]);
+      }
+      status(label) {
+        const enabled = this.deps.exec("systemctl", ["--user", "is-enabled", `${label}.service`]);
+        const active = this.deps.exec("systemctl", ["--user", "is-active", `${label}.service`]);
+        return { loaded: enabled.code === 0, detail: `${enabled.stdout.trim() || "?"} / ${active.stdout.trim() || "?"}` };
+      }
+      list(prefix) {
+        const dir = join9(this.deps.home, ".config", "systemd", "user");
+        const out = [];
+        for (const name of this.deps.readdir(dir)) {
+          if (!name.startsWith(prefix) || !name.endsWith(".service")) continue;
+          const path2 = join9(dir, name);
+          out.push({
+            label: name.slice(0, -".service".length),
+            path: path2,
+            env: parseUnitEnv(this.deps.readFile(path2))
+          });
+        }
+        return out.sort((a2, b2) => a2.label.localeCompare(b2.label));
+      }
+    };
+  }
+});
+
+// src/service/backend.ts
+import { spawnSync } from "node:child_process";
+import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync4, rmSync, existsSync as existsSync5, chmodSync as chmodSync4, readdirSync as readdirSync2, readFileSync as readFileSync5 } from "node:fs";
+import { userInfo } from "node:os";
+function defaultDeps() {
+  return {
+    home: process.env.HOME ?? "",
+    uid: userInfo().uid,
+    user: userInfo().username,
+    exec: (cmd, args) => {
+      const r2 = spawnSync(cmd, args, { encoding: "utf8" });
+      return { code: r2.status ?? 1, stdout: r2.stdout ?? "" };
+    },
+    writeFile: (p2, d2) => writeFileSync4(p2, d2),
+    mkdir: (p2) => mkdirSync5(p2, { recursive: true }),
+    chmod: (p2, m2) => chmodSync4(p2, m2),
+    rm: (p2) => rmSync(p2, { force: true }),
+    exists: (p2) => existsSync5(p2),
+    readdir: (p2) => {
+      try {
+        return readdirSync2(p2);
+      } catch {
+        return [];
+      }
+    },
+    readFile: (p2) => {
+      try {
+        return readFileSync5(p2, "utf8");
+      } catch {
+        return "";
+      }
+    }
+  };
+}
+function selectBackend(platform, deps) {
+  if (platform === "darwin") {
+    return new LaunchdBackend(deps ?? defaultDeps());
+  }
+  if (platform === "linux") {
+    return new SystemdBackend(deps ?? defaultDeps());
+  }
+  throw new Error(`unsupported platform for muse-bridge service install: ${platform}`);
+}
+var init_backend = __esm({
+  "src/service/backend.ts"() {
+    "use strict";
+    init_launchd();
+    init_systemd();
+  }
+});
+
+// src/service/subcommand.ts
+var subcommand_exports = {};
+__export(subcommand_exports, {
+  labelFor: () => labelFor,
+  maybeRunServiceSubcommand: () => maybeRunServiceSubcommand
+});
+import { join as join10 } from "node:path";
+function requireAgentName(env) {
+  const name = env.AV_AGENT_NAME?.trim();
+  if (!name) {
+    throw new Error(
+      "AV_AGENT_NAME is required \u2014 it names WHICH agent's service to act on. Re-run as: AV_AGENT_NAME=<agent-name> agentvault-muse-bridge <subcommand>"
+    );
+  }
+  return name;
+}
+function labelFor(env) {
+  return `dev.agentvault.muse-${slugify(requireAgentName(env))}`;
+}
+function dataDirFor(env, agentName) {
+  if (env.AV_DATA_DIR) return env.AV_DATA_DIR;
+  return join10(env.HOME ?? "", ".agentvault", "muse-room-bridge", slugify(agentName));
+}
+function maybeRunServiceSubcommand(argv, env, deps) {
+  const cmd = argv[2];
+  if (!cmd) return false;
+  if (!SERVICE_CMDS.has(cmd)) {
+    const looksLikeToken = cmd.startsWith("av_tok_");
+    const looksLikeFlag = cmd.startsWith("-");
+    if (!looksLikeToken && !looksLikeFlag) {
+      throw new Error(
+        `unknown subcommand: ${cmd} \u2014 expected one of ${[...SERVICE_CMDS].join(", ")}, an invite token, or no argument at all`
+      );
+    }
+    return false;
+  }
+  const backend = deps?.backend ?? selectBackend(process.platform);
+  const entrypoint = deps?.entrypoint ?? process.argv[1];
+  const log = deps?.log ?? ((m2) => logLine("[muse-bridge] " + m2));
+  try {
+    if (cmd === "install") {
+      const agentName = requireAgentName(env);
+      assertInstallableEntrypoint(entrypoint);
+      const dataDir = dataDirFor(env, agentName);
+      if (!hasPersistedCreds(dataDir)) {
+        throw new Error(
+          "cannot install a supervised service before this agent has enrolled \u2014 run agentvault-muse-bridge <invite-token> once so credentials persist, then: AV_AGENT_NAME=<agent-name> agentvault-muse-bridge install"
+        );
+      }
+      const cfg = loadConfig(env, []);
+      const spec = buildServiceSpec(cfg, {
+        entrypoint,
+        home: env.HOME ?? "",
+        path: env.PATH ?? ""
+      });
+      backend.install(spec);
+      log(`installed service ${spec.label} \u2014 logs: ${spec.logErr}`);
+      log(`check it with: AV_AGENT_NAME=${cfg.agentName} agentvault-muse-bridge status`);
+    } else if (cmd === "uninstall") {
+      const label = labelFor(env);
+      backend.uninstall(label);
+      log(`uninstalled service ${label}`);
+    } else if (cmd === "restart") {
+      const label = labelFor(env);
+      backend.restart(label);
+      log(`restarted service ${label}`);
+    } else if (cmd === "status") {
+      const label = labelFor(env);
+      const st = backend.status(label);
+      log(`${label}: ${st.loaded ? "loaded" : "not loaded"}`);
+    } else if (cmd === "logs") {
+      const label = labelFor(env);
+      log(`logs for ${label} are at <dataDir>/logs/muse-bridge.log (tail -f it)`);
+    }
+  } catch (e) {
+    log(e.message);
+    process.exitCode = 1;
+  }
+  return true;
 }
+var SERVICE_CMDS;
+var init_subcommand = __esm({
+  "src/service/subcommand.ts"() {
+    "use strict";
+    init_config();
+    init_log();
+    init_spec();
+    init_backend();
+    SERVICE_CMDS = /* @__PURE__ */ new Set(["install", "uninstall", "restart", "status", "logs"]);
+  }
+});
+
+// src/index.ts
+init_config();
+init_log();
+init_fence_auth();
+import { chmodSync as chmodSync5, mkdirSync as mkdirSync6 } from "node:fs";
 
 // src/muse-session.ts
 var MuseSession = class {
@@ -97812,7 +98099,7 @@ ${item.text}` : item.text;
 // src/muse-driver.ts
 import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync2, writeFileSync } from "node:fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "node:fs";
 import { join as join4 } from "node:path";
 
 // src/muse-spawn.ts
@@ -97881,14 +98168,14 @@ var MuseDriver = class {
     mkdirSync3(this.opts.dataDir, { recursive: true });
     const file2 = join4(this.opts.dataDir, SESSION_FILE);
     if (existsSync3(file2)) {
-      const existing = readFileSync2(file2, "utf8").trim();
+      const existing = readFileSync3(file2, "utf8").trim();
       if (existing) {
         this.persistedId = existing;
         return existing;
       }
     }
     this.persistedId = randomUUID();
-    writeFileSync(file2, this.persistedId + "\n", { encoding: "utf8" });
+    writeFileSync2(file2, this.persistedId + "\n", { encoding: "utf8" });
     return this.persistedId;
   }
   sessionId() {
@@ -98402,7 +98689,7 @@ data: ${JSON.stringify(out)}
 }
 
 // src/settings-mcp.ts
-import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync2, chmodSync as chmodSync3 } from "node:fs";
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync3, chmodSync as chmodSync3 } from "node:fs";
 import { join as join5 } from "node:path";
 function writeFenceMcpSettings(fenceHome, opts) {
   const dir = join5(fenceHome, ".config", "muse");
@@ -98419,11 +98706,12 @@ function writeFenceMcpSettings(fenceHome, opts) {
       }
     }
   };
-  writeFileSync2(dest, JSON.stringify(body, null, 2) + "\n", { mode: 384 });
+  writeFileSync3(dest, JSON.stringify(body, null, 2) + "\n", { mode: 384 });
   chmodSync3(dest, 384);
 }
 
 // src/bridge.ts
+await init_dist();
 var workAllowedFlag = false;
 var gatesRemovedFlag = false;
 function workAllowed() {
@@ -98480,7 +98768,7 @@ var ActiveTarget = class {
     };
   }
 };
-function attachLifecycle(channel, opts = {}) {
+function attachLifecycle2(channel, opts = {}) {
   const log = opts.log ?? (() => {
   });
   const onTerminal = opts.onTerminal ?? ((_reason, o2) => process.exit(o2.restart ? 1 : 0));
@@ -98504,9 +98792,32 @@ function roomTurnPrefix(roomId, senderName, roomName) {
   const room = roomName ? `"${roomName}"` : roomId.slice(0, 8);
   return `[room ${room} | ${senderName}]`;
 }
+function _makeOwesReply(agentName, channel, log) {
+  let warnedNoIdentity = false;
+  return (e) => {
+    const own = agentName ?? "";
+    const hub = channel.ownDisplayName ?? "";
+    if (!own && !hub && !warnedNoIdentity) {
+      warnedNoIdentity = true;
+      log(
+        "WARNING: this bridge has no agentName and no hub display_name, so it cannot recognise its own @mention (#1107). It will answer @all and any @-addressed message (fail-open), but targeted replies will be unreliable. Set the agent name in the bridge config."
+      );
+    }
+    return owesRoomReply(
+      e.plaintext,
+      own,
+      own,
+      e.senderIsAgent,
+      void 0,
+      hub,
+      Boolean(own || hub)
+    );
+  };
+}
 function wireBridge(channel, session, target, opts = {}) {
   const log = opts.log ?? (() => {
   });
+  const _owesReply = _makeOwesReply(opts.agentName, channel, log);
   channel.on("error", (err) => {
     const msg = err instanceof Error ? err.message : String(err);
     log(`channel error (non-fatal, not a reconnect trigger): ${msg}`);
@@ -98553,7 +98864,7 @@ function wireBridge(channel, session, target, opts = {}) {
       target.snapshotReply(channel, log),
       {
         autoReplyOnText: false,
-        replyExpected: e.senderIsAgent === false
+        replyExpected: _owesReply(e)
       }
     );
   });
@@ -98571,7 +98882,7 @@ function wireBridge(channel, session, target, opts = {}) {
 }
 
 // src/version.ts
-function buildClientVersion(version2) {
+function buildClientVersion2(version2) {
   return `@agentvault/muse-bridge@${version2 ?? "dev"}`;
 }
 
@@ -98581,7 +98892,7 @@ function mkdir700(path2) {
   chmodSync5(path2, 448);
 }
 function packageVersion() {
-  return true ? "0.1.2" : void 0;
+  return true ? "0.1.4" : void 0;
 }
 function helpText(version2) {
   return [
@@ -98627,7 +98938,7 @@ async function main(opts = {}) {
   }
   const info = parseInfoFlags(argv.slice(2));
   if (info.showVersion || info.showHelp) {
-    const version2 = buildClientVersion(packageVersion());
+    const version2 = buildClientVersion2(packageVersion());
     if (info.showVersion) printLine(version2);
     if (info.showHelp) printLine(helpText(version2));
     exit(0);
@@ -98642,6 +98953,14 @@ async function main(opts = {}) {
     hostHome: cfg.hostHome,
     log: (m2) => logLine(m2)
   });
+  harvestFenceApiKeyToSidecar({
+    dataDir: cfg.dataDir,
+    fenceHome: cfg.fenceHome,
+    log: (m2) => logLine(m2)
+  });
+  if (!cfg.apiKey) {
+    cfg.apiKey = readSidecarMetaApiKey(cfg.dataDir) || readFenceMetaApiKey(cfg.fenceHome) || void 0;
+  }
   let shuttingDown = false;
   let exiting = false;
   let driver;
@@ -98701,7 +99020,7 @@ async function main(opts = {}) {
     return;
   }
   logLine(`[muse-bridge] muse session ${driver.sessionId()} ready`);
-  const clientVersion = buildClientVersion(packageVersion());
+  const clientVersion = buildClientVersion2(packageVersion());
   if (opts.createChannel) {
     channel = opts.createChannel({
       inviteToken: cfg.inviteToken,
@@ -98724,9 +99043,12 @@ async function main(opts = {}) {
   }
   const target = new ActiveTarget();
   wireBridge(channel, session, target, {
+    // #1107: needed to recognise this agent's own @mention. Without it the
+    // agent can only answer @all.
+    agentName: cfg.agentName,
     log: (m2) => logLine("[muse-bridge] " + m2)
   });
-  attachLifecycle(channel, {
+  attachLifecycle2(channel, {
     log: (m2) => logLine("[muse-bridge] " + m2),
     onTerminal: (_reason, o2) => void shutdown(o2.restart ? 1 : 0)
   });