@canonmsg/agent-sdk 12.0.0 → 12.2.0

package/dist/chunks/{chunk-FPQFTTND.js → chunk-J63YVAKA.js}

@@ -27,6 +27,22 @@ function getCanonEnvironmentContract(value) {
 }
 __name(getCanonEnvironmentContract, "getCanonEnvironmentContract");
 
+// ../backend-contracts/src/clientFloor.ts
+var CANON_CLIENT_HEADER = "X-Canon-Client";
+var CLIENT_UPDATE_REQUIRED = "CLIENT_UPDATE_REQUIRED";
+var CANON_CLIENT_KINDS = ["app-ios", "app-android", "web", "runner", "hermes", "core", "connector"];
+var VERSION = /^(0|[1-9]\d{0,5})\.(0|[1-9]\d{0,5})\.(0|[1-9]\d{0,5})$/;
+var isKind = /* @__PURE__ */ __name((value) => CANON_CLIENT_KINDS.includes(value), "isKind");
+function isCanonClientVersion(value) {
+  return typeof value === "string" && VERSION.test(value);
+}
+__name(isCanonClientVersion, "isCanonClientVersion");
+function formatCanonClientHeader(client) {
+  if (!isKind(client.kind) || !isCanonClientVersion(client.version)) throw new Error("Invalid Canon client identity");
+  return `${client.kind}/${client.version}`;
+}
+__name(formatCanonClientHeader, "formatCanonClientHeader");
+
 // ../backend-contracts/src/media.ts
 function sanitizeDownloadFileName(value, fallback = "attachment") {
   const baseName = typeof value === "string" ? value.trim().split(/[\\/]/).filter(Boolean).pop() ?? "" : "";
@@ -45,6 +61,193 @@ function sanitizeDownloadFileName(value, fallback = "attachment") {
   return `${safeStem.replace(/[. -]+$/g, "")}${extension}`;
 }
 __name(sanitizeDownloadFileName, "sanitizeDownloadFileName");
+function describeAttachment(attachment) {
+  if (!attachment) return null;
+  if (attachment.kind === "image") return "\u{1F4F7} Image";
+  if (attachment.kind === "audio") return "\u{1F3A4} Voice message";
+  if (attachment.kind === "video") return "\u{1F3AC} Video";
+  return attachment.fileName ? `\u{1F4CE} ${attachment.fileName}` : "\u{1F4CE} File";
+}
+__name(describeAttachment, "describeAttachment");
+
+// ../backend-contracts/src/media-origins.generated.ts
+var MEDIA_ORIGINS = {
+  "canonmail-dev.firebasestorage.app": "https://dev.api.canonmail.com",
+  "canonmail-prod.firebasestorage.app": "https://api.canonmail.com"
+};
+
+// ../backend-contracts/src/media-url.ts
+function validMediaPath(path) {
+  const parts = path.split("/");
+  return parts.length === 4 && parts[0] === "media" && parts.every((part) => Boolean(part) && part !== "." && part !== ".." && !/[\u0000-\u001f\u007f\\]/.test(part));
+}
+__name(validMediaPath, "validMediaPath");
+function parseMediaStoragePath(value, bucket) {
+  if (typeof value !== "string") return null;
+  try {
+    const url = new URL(value);
+    if (url.protocol !== "https:" || url.username || url.password) return null;
+    let path;
+    const prefix = `/v0/b/${bucket}/o/`;
+    if (url.origin === "https://firebasestorage.googleapis.com" && url.pathname.startsWith(prefix)) {
+      path = decodeURIComponent(url.pathname.slice(prefix.length));
+    } else if (url.origin === MEDIA_ORIGINS[bucket] && url.pathname.startsWith("/files/")) {
+      path = `media/${decodeURIComponent(url.pathname.slice("/files/".length))}`;
+    } else return null;
+    return validMediaPath(path) ? path : null;
+  } catch {
+    return null;
+  }
+}
+__name(parseMediaStoragePath, "parseMediaStoragePath");
+function isCanonMediaOrigin(url) {
+  try {
+    return Object.values(MEDIA_ORIGINS).includes(new URL(url).origin);
+  } catch {
+    return false;
+  }
+}
+__name(isCanonMediaOrigin, "isCanonMediaOrigin");
+function isCanonUploadUrl(url, input) {
+  try {
+    const bucket = `${getCanonEnvironmentContract(input.environmentId).projectId}.firebasestorage.app`;
+    const parsed = new URL(url);
+    if (parsed.origin !== MEDIA_ORIGINS[bucket] || parsed.hash || [...parsed.searchParams.keys()].join() !== "token" || !parsed.searchParams.get("token")) return false;
+    const path = parseMediaStoragePath(url, bucket);
+    const [, conversationId, , file] = path?.split("/") ?? [];
+    const expected = input.poster ? `resumable-${input.uploadId}-poster.jpg` : null;
+    return conversationId === input.conversationId && (expected ? file === expected : !!file && file.startsWith(`resumable-${input.uploadId}.`) && /^[a-z0-9]{1,8}$/.test(file.slice(`resumable-${input.uploadId}.`.length)));
+  } catch {
+    return false;
+  }
+}
+__name(isCanonUploadUrl, "isCanonUploadUrl");
+
+// ../backend-contracts/src/upload-mime-types.ts
+var MIME_TYPE_RE = /^[a-z0-9.+-]+\/[a-z0-9.+-]+$/i;
+var SAFE_IMAGE_MIME_TYPES = /* @__PURE__ */ new Set([
+  "image/jpeg",
+  "image/png",
+  "image/webp",
+  "image/gif"
+]);
+var SAFE_AUDIO_MIME_TYPES = /* @__PURE__ */ new Set([
+  "audio/mp4",
+  "audio/x-m4a",
+  "audio/mpeg",
+  "audio/webm",
+  "audio/ogg",
+  "audio/wav",
+  // ADTS AAC — the future Android streamable-memo lane; harmless standalone.
+  "audio/aac"
+]);
+var SAFE_VIDEO_MIME_TYPES = /* @__PURE__ */ new Set([
+  "video/mp4",
+  "video/quicktime",
+  "video/webm",
+  "video/x-m4v"
+]);
+var SAFE_FILE_MIME_TYPES = /* @__PURE__ */ new Set([
+  "application/pdf",
+  "text/plain",
+  "text/markdown",
+  "text/x-markdown",
+  "text/csv",
+  "application/csv",
+  "application/json",
+  "application/zip",
+  "application/vnd.ms-excel",
+  "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"
+]);
+var SAFE_FILE_MIME_BY_EXTENSION = {
+  csv: "text/csv",
+  json: "application/json",
+  md: "text/markdown",
+  markdown: "text/markdown",
+  pdf: "application/pdf",
+  txt: "text/plain",
+  xls: "application/vnd.ms-excel",
+  xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  zip: "application/zip"
+};
+var SAFE_VIDEO_MIME_BY_EXTENSION = {
+  m4v: "video/x-m4v",
+  mov: "video/quicktime",
+  mp4: "video/mp4",
+  webm: "video/webm"
+};
+var SAFE_AUDIO_MIME_BY_EXTENSION = {
+  aac: "audio/aac",
+  m4a: "audio/x-m4a",
+  mp3: "audio/mpeg",
+  oga: "audio/ogg",
+  ogg: "audio/ogg",
+  wav: "audio/wav"
+};
+function normalizeMimeType(value) {
+  if (typeof value !== "string") return null;
+  const normalized = value.split(";")[0].trim().toLowerCase();
+  if (!MIME_TYPE_RE.test(normalized)) return null;
+  if (normalized === "image/jpg") return "image/jpeg";
+  return normalized;
+}
+__name(normalizeMimeType, "normalizeMimeType");
+function inferSafeFileMimeTypeFromName(value) {
+  if (typeof value !== "string") return null;
+  const extension = value.trim().split(/[\\/]/).pop()?.split(".").pop()?.toLowerCase() ?? "";
+  return SAFE_FILE_MIME_BY_EXTENSION[extension] ?? null;
+}
+__name(inferSafeFileMimeTypeFromName, "inferSafeFileMimeTypeFromName");
+function inferSafeVideoMimeTypeFromName(value) {
+  if (typeof value !== "string") return null;
+  const extension = value.trim().split(/[\\/]/).pop()?.split(".").pop()?.toLowerCase() ?? "";
+  return SAFE_VIDEO_MIME_BY_EXTENSION[extension] ?? null;
+}
+__name(inferSafeVideoMimeTypeFromName, "inferSafeVideoMimeTypeFromName");
+function inferSafeAudioMimeTypeFromName(value) {
+  if (typeof value !== "string") return null;
+  const extension = value.trim().split(/[\\/]/).pop()?.split(".").pop()?.toLowerCase() ?? "";
+  return SAFE_AUDIO_MIME_BY_EXTENSION[extension] ?? null;
+}
+__name(inferSafeAudioMimeTypeFromName, "inferSafeAudioMimeTypeFromName");
+function shouldTrustSafeFileName(mimeType) {
+  return !mimeType || mimeType === "application/octet-stream" || mimeType === "application/vnd.ms-excel" || mimeType === "text/plain";
+}
+__name(shouldTrustSafeFileName, "shouldTrustSafeFileName");
+function classifyAllowedUploadMimeType(value) {
+  const mimeType = normalizeMimeType(value);
+  if (!mimeType) return null;
+  if (SAFE_IMAGE_MIME_TYPES.has(mimeType)) return "image";
+  if (SAFE_AUDIO_MIME_TYPES.has(mimeType)) return "audio";
+  if (SAFE_VIDEO_MIME_TYPES.has(mimeType)) return "video";
+  if (SAFE_FILE_MIME_TYPES.has(mimeType)) return "file";
+  return null;
+}
+__name(classifyAllowedUploadMimeType, "classifyAllowedUploadMimeType");
+function resolveAllowedUploadMimeType(input) {
+  const normalizedMimeType = normalizeMimeType(input.mimeType);
+  const hasExplicitMimeType = typeof input.mimeType === "string" && input.mimeType.trim().length > 0;
+  const inferredVideoMimeType = inferSafeVideoMimeTypeFromName(input.fileName);
+  const inferredAudioMimeType = inferSafeAudioMimeTypeFromName(input.fileName);
+  const inferredFileMimeType = inferSafeFileMimeTypeFromName(input.fileName);
+  if (hasExplicitMimeType && !normalizedMimeType) {
+    return null;
+  }
+  if (inferredVideoMimeType && (!normalizedMimeType || normalizedMimeType === "application/octet-stream")) {
+    return inferredVideoMimeType;
+  }
+  if (inferredAudioMimeType && (!normalizedMimeType || normalizedMimeType === "application/octet-stream")) {
+    return inferredAudioMimeType;
+  }
+  if (inferredFileMimeType && shouldTrustSafeFileName(normalizedMimeType)) {
+    return inferredFileMimeType;
+  }
+  if (normalizedMimeType && classifyAllowedUploadMimeType(normalizedMimeType)) {
+    return normalizedMimeType;
+  }
+  return normalizedMimeType ? null : inferredFileMimeType;
+}
+__name(resolveAllowedUploadMimeType, "resolveAllowedUploadMimeType");
 
 // ../backend-contracts/src/mlsDevValidation.ts
 function invalid() {
@@ -57,14 +260,14 @@ function readMlsDataRecord(value, keys2, alternateKeys) {
   if (prototype !== Object.prototype && prototype !== null) invalid();
   const descriptors = Object.getOwnPropertyDescriptors(value);
   const ownKeys = Reflect.ownKeys(descriptors);
-  const shape = [keys2, ...alternateKeys ? [alternateKeys] : []].find((candidate) => ownKeys.length === candidate.length && ownKeys.every((key2) => typeof key2 === "string" && candidate.includes(key2)));
+  const shape = [keys2, ...alternateKeys ? [alternateKeys] : []].find((candidate) => ownKeys.length === candidate.length && ownKeys.every((key) => typeof key === "string" && candidate.includes(key)));
   if (!shape) invalid();
   const snapshot = /* @__PURE__ */ Object.create(null);
-  for (const key2 of ownKeys) {
-    if (typeof key2 !== "string") invalid();
-    const descriptor = descriptors[key2];
+  for (const key of ownKeys) {
+    if (typeof key !== "string") invalid();
+    const descriptor = descriptors[key];
     if (!descriptor.enumerable || !Object.hasOwn(descriptor, "value")) invalid();
-    snapshot[key2] = descriptor.value;
+    snapshot[key] = descriptor.value;
   }
   return snapshot;
 }
@@ -85,6 +288,51 @@ function requireMlsUuid(value) {
 }
 __name(requireMlsUuid, "requireMlsUuid");
 
+// ../backend-contracts/src/mlsEnvironment.ts
+var MLS_ENVIRONMENT_PROFILES = Object.freeze({
+  "canon-dev-v1": Object.freeze({
+    issuer: "canon-mls-dev-v1",
+    credentialType: "canon-mls-dev-credential+jws",
+    issuerKeyPath: "projects/canonmail-dev/locations/europe-west1/keyRings/canon-mls/cryptoKeys/device-issuer",
+    receiptKeyPath: "projects/canonmail-dev/locations/europe-west1/keyRings/canon-mls/cryptoKeys/feed-receipt"
+  }),
+  "canon-prod-v1": Object.freeze({
+    issuer: "canon-mls-prod-v1",
+    credentialType: "canon-mls-prod-credential+jws",
+    issuerKeyPath: "projects/canonmail-prod/locations/europe-west1/keyRings/canon-mls/cryptoKeys/device-issuer",
+    receiptKeyPath: "projects/canonmail-prod/locations/europe-west1/keyRings/canon-mls/cryptoKeys/feed-receipt"
+  })
+});
+function requireMlsEnvironmentId(value) {
+  if (!isMlsEnvironmentId(value)) throw new Error("INVALID_MLS_DATA");
+  return value;
+}
+__name(requireMlsEnvironmentId, "requireMlsEnvironmentId");
+function isMlsEnvironmentId(value) {
+  return typeof value === "string" && Object.hasOwn(MLS_ENVIRONMENT_PROFILES, value);
+}
+__name(isMlsEnvironmentId, "isMlsEnvironmentId");
+function mlsEnvironmentProfile(environmentId) {
+  return MLS_ENVIRONMENT_PROFILES[environmentId];
+}
+__name(mlsEnvironmentProfile, "mlsEnvironmentProfile");
+function mlsEnvironmentOfIssuerKeyVersion(value) {
+  return environmentOfKeyVersion(value, "issuerKeyPath");
+}
+__name(mlsEnvironmentOfIssuerKeyVersion, "mlsEnvironmentOfIssuerKeyVersion");
+function mlsEnvironmentOfReceiptKeyVersion(value) {
+  return environmentOfKeyVersion(value, "receiptKeyPath");
+}
+__name(mlsEnvironmentOfReceiptKeyVersion, "mlsEnvironmentOfReceiptKeyVersion");
+function environmentOfKeyVersion(value, key) {
+  for (const [environmentId, profile] of Object.entries(MLS_ENVIRONMENT_PROFILES)) {
+    const prefix = profile[key] + "/cryptoKeyVersions/";
+    if (value.startsWith(prefix) && /^[1-9][0-9]{0,9}$/.test(value.slice(prefix.length))) return environmentId;
+  }
+  return void 0;
+}
+__name(environmentOfKeyVersion, "environmentOfKeyVersion");
+
 // ../backend-contracts/src/mlsDevEnrollment.ts
 var MLS_DEV_ENROLLMENT_CHALLENGE_TTL_MS = 3e5;
 var MLS_DEV_ENROLLMENT_MAX_BYTES = 4096;
@@ -118,16 +366,12 @@ function installation(value) {
   return value;
 }
 __name(installation, "installation");
+function isMlsPrincipalId(value) {
+  return typeof value === "string" && value.length > 0 && value.length <= 512 && !/[\u0000-\u001f\u007f-\u009f]/.test(value) && !/[\ud800-\udfff]/.test(value.replace(/[\ud800-\udbff][\udc00-\udfff]/g, "")) && utf8.encode(value).length <= 512;
+}
+__name(isMlsPrincipalId, "isMlsPrincipalId");
 function principalId(value) {
-  if (typeof value !== "string" || value.length < 1 || value.length > 512 || /[\u0000-\u001f\u007f-\u009f]/.test(value)) invalid2();
-  for (let index = 0; index < value.length; index++) {
-    const unit = value.charCodeAt(index);
-    if (unit >= 55296 && unit <= 56319) {
-      const next = value.charCodeAt(++index);
-      if (!(next >= 56320 && next <= 57343)) invalid2();
-    } else if (unit >= 56320 && unit <= 57343) invalid2();
-  }
-  if (utf8.encode(value).length > 512) invalid2();
+  if (!isMlsPrincipalId(value)) invalid2();
   return value;
 }
 __name(principalId, "principalId");
@@ -209,7 +453,7 @@ function parseMlsDevEnrollmentChallenge(value) {
       version: requireMlsLiteral(input.version, 1),
       challengeId: requireMlsUuid(input.challengeId),
       deviceId: requireMlsUuid(input.deviceId),
-      environmentId: requireMlsLiteral(input.environmentId, "canon-dev-v1"),
+      environmentId: requireMlsEnvironmentId(input.environmentId),
       principal: principal(input.principal),
       installationId: installation(input.installationId),
       ciphersuite: requireMlsLiteral(input.ciphersuite, 1),
@@ -242,7 +486,7 @@ function parseMlsDevEnrollmentResult(value) {
       device: Object.freeze({
         version: requireMlsLiteral(device.version, 1),
         deviceId: requireMlsUuid(device.deviceId),
-        environmentId: requireMlsLiteral(device.environmentId, "canon-dev-v1"),
+        environmentId: requireMlsEnvironmentId(device.environmentId),
         principal: principal(device.principal),
         installationId: installation(device.installationId),
         ciphersuite: requireMlsLiteral(device.ciphersuite, 1),
@@ -333,11 +577,11 @@ function encoded2(value, bytes) {
   return value;
 }
 __name(encoded2, "encoded");
-function parseMlsDevIssuerKeyVersion(value) {
+function parseMlsDevIssuerKeyVersion(value, environmentId) {
   return boundary2(() => {
     if (typeof value !== "string" || value.length > 200) invalid3();
-    const match = /^projects\/canonmail-dev\/locations\/europe-west1\/keyRings\/canon-mls\/cryptoKeys\/device-issuer\/cryptoKeyVersions\/[1-9][0-9]{0,9}$/.exec(value);
-    if (!match || match[0] !== value) invalid3();
+    const owner = mlsEnvironmentOfIssuerKeyVersion(value);
+    if (!owner || environmentId !== void 0 && owner !== environmentId) invalid3();
     return value;
   });
 }
@@ -348,11 +592,12 @@ function parseMlsDevCredentialClaims(value) {
     const issuedAtMs = requireMlsInteger(input.issuedAtMs);
     const expiresAtMs = requireMlsInteger(input.expiresAtMs);
     if (expiresAtMs - issuedAtMs !== MLS_DEV_CREDENTIAL_TTL_MS) invalid3();
+    const device = parseMlsDevEnrollmentResult({ version: 1, authorization: "registration_only", device: input.device }).device;
     return bounded2({
       version: requireMlsLiteral(input.version, 1),
       credentialId: requireMlsUuid(input.credentialId),
-      issuer: requireMlsLiteral(input.issuer, "canon-mls-dev-v1"),
-      device: parseMlsDevEnrollmentResult({ version: 1, authorization: "registration_only", device: input.device }).device,
+      issuer: requireMlsLiteral(input.issuer, mlsEnvironmentProfile(device.environmentId).issuer),
+      device,
       generation: requireMlsInteger(input.generation, 1),
       issuedAtMs,
       expiresAtMs
@@ -363,7 +608,9 @@ __name(parseMlsDevCredentialClaims, "parseMlsDevCredentialClaims");
 function parseMlsDevCredentialUnsigned(value) {
   return boundary2(() => {
     const input = readMlsDataRecord(value, ["keyVersion", "claims"]);
-    return bounded2({ keyVersion: parseMlsDevIssuerKeyVersion(input.keyVersion), claims: parseMlsDevCredentialClaims(input.claims) });
+    const keyVersion = parseMlsDevIssuerKeyVersion(input.keyVersion), claims = parseMlsDevCredentialClaims(input.claims);
+    if (mlsEnvironmentOfIssuerKeyVersion(keyVersion) !== claims.device.environmentId) invalid3();
+    return bounded2({ keyVersion, claims });
   });
 }
 __name(parseMlsDevCredentialUnsigned, "parseMlsDevCredentialUnsigned");
@@ -423,7 +670,7 @@ function parseMlsDevCredentialRevocationReceipt(value) {
 }
 __name(parseMlsDevCredentialRevocationReceipt, "parseMlsDevCredentialRevocationReceipt");
 function signingInput(unsigned2) {
-  const header = { alg: "Ed25519", typ: "canon-mls-dev-credential+jws", kid: unsigned2.keyVersion };
+  const header = { alg: "Ed25519", typ: mlsEnvironmentProfile(unsigned2.claims.device.environmentId).credentialType, kid: unsigned2.keyVersion };
   const result = encodeCanonicalMlsBase64Url(utf82.encode(JSON.stringify(header))) + "." + encodeCanonicalMlsBase64Url(utf82.encode(JSON.stringify(unsigned2.claims)));
   if (result.length > MLS_DEV_CREDENTIAL_MAX_BYTES) invalid3();
   return result;
@@ -445,8 +692,8 @@ function parseMlsDevCredentialSigningInput(value) {
     if (parts.length !== 2) invalid3();
     const header = readMlsDataRecord(jsonSegment(parts[0]), ["alg", "typ", "kid"]);
     requireMlsLiteral(header.alg, "Ed25519");
-    requireMlsLiteral(header.typ, "canon-mls-dev-credential+jws");
     const unsigned2 = parseMlsDevCredentialUnsigned({ keyVersion: header.kid, claims: jsonSegment(parts[1]) });
+    requireMlsLiteral(header.typ, mlsEnvironmentProfile(unsigned2.claims.device.environmentId).credentialType);
     if (signingInput(unsigned2) !== value) invalid3();
     return unsigned2;
   });
@@ -476,6 +723,54 @@ function parseMlsDevCredentialReceipt(value) {
 }
 __name(parseMlsDevCredentialReceipt, "parseMlsDevCredentialReceipt");
 
+// ../backend-contracts/src/mlsDevFeedReceipt.ts
+var MlsDevFeedReceiptValidationError = class extends Error {
+  static {
+    __name(this, "MlsDevFeedReceiptValidationError");
+  }
+  code = "INVALID_MLS_DEV_FEED_RECEIPT";
+  constructor() {
+    super("INVALID_MLS_DEV_FEED_RECEIPT");
+    this.name = "MlsDevFeedReceiptValidationError";
+  }
+};
+function invalid4() {
+  throw new MlsDevFeedReceiptValidationError();
+}
+__name(invalid4, "invalid");
+function boundary3(read) {
+  try {
+    return read();
+  } catch {
+    return invalid4();
+  }
+}
+__name(boundary3, "boundary");
+function parseMlsDevReceiptKeyVersion(value, environmentId) {
+  return boundary3(() => {
+    if (typeof value !== "string" || value.length > 200) invalid4();
+    const owner = mlsEnvironmentOfReceiptKeyVersion(value);
+    if (!owner || environmentId !== void 0 && owner !== environmentId) invalid4();
+    return value;
+  });
+}
+__name(parseMlsDevReceiptKeyVersion, "parseMlsDevReceiptKeyVersion");
+function parseMlsDevFeedReceiptProof(value) {
+  return boundary3(() => {
+    const input = readMlsDataRecord(value, ["keyVersion", "signature"]);
+    decodeCanonicalMlsBase64Url(input.signature, 64);
+    return Object.freeze({ keyVersion: parseMlsDevReceiptKeyVersion(input.keyVersion), signature: input.signature });
+  });
+}
+__name(parseMlsDevFeedReceiptProof, "parseMlsDevFeedReceiptProof");
+var MLS_DEV_GROUP_RECEIPT_CLOCK_SKEW = "MLS_DEV_GROUP_RECEIPT_CLOCK_SKEW";
+function isMlsDevReceiptClockSkew(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const keys2 = Object.keys(value).sort().join(), input = value;
+  return (keys2 === "error,ok,retryable" || keys2 === "error,ok,retryable,version" && input.version === 1) && input.ok === false && input.error === MLS_DEV_GROUP_RECEIPT_CLOCK_SKEW && input.retryable === true;
+}
+__name(isMlsDevReceiptClockSkew, "isMlsDevReceiptClockSkew");
+
 // ../backend-contracts/src/mlsDevGroupFeed.ts
 var MLS_DEV_GROUP_FEED_MAX_ENTRIES = 4;
 var MLS_DEV_GROUP_FEED_MAX_BYTES = 4 * 1024 * 1024;
@@ -489,99 +784,104 @@ var MlsDevGroupFeedValidationError = class extends Error {
     this.name = "MlsDevGroupFeedValidationError";
   }
 };
-function invalid4() {
+function invalid5() {
   throw new MlsDevGroupFeedValidationError();
 }
-__name(invalid4, "invalid");
-function boundary3(read) {
+__name(invalid5, "invalid");
+function boundary4(read) {
   try {
     return read();
   } catch {
-    return invalid4();
+    return invalid5();
   }
 }
-__name(boundary3, "boundary");
+__name(boundary4, "boundary");
 function id(value) {
   if (typeof value !== "string" || !/^[A-Za-z0-9_.:~-]{1,200}$/.test(value) || value === "." || value === "..")
-    invalid4();
+    invalid5();
   return value;
 }
 __name(id, "id");
 function boolean(value) {
   if (typeof value !== "boolean")
-    invalid4();
+    invalid5();
   return value;
 }
 __name(boolean, "boolean");
 function bounded3(value) {
   if (new TextEncoder().encode(JSON.stringify(value)).length > MLS_DEV_GROUP_FEED_MAX_BYTES)
-    invalid4();
+    invalid5();
   return Object.freeze(value);
 }
 __name(bounded3, "bounded");
 function array(value) {
   if (!Array.isArray(value) || Object.getPrototypeOf(value) !== Array.prototype || value.length > MLS_DEV_GROUP_FEED_MAX_ENTRIES)
-    invalid4();
+    invalid5();
   const descriptors = Object.getOwnPropertyDescriptors(value);
   if (Reflect.ownKeys(descriptors).length !== value.length + 1)
-    invalid4();
+    invalid5();
   return Array.from({ length: value.length }, (_, index) => {
     const field = descriptors[index];
     if (!field || !field.enumerable || !Object.hasOwn(field, "value"))
-      invalid4();
+      invalid5();
     return field.value;
   });
 }
 __name(array, "array");
 function parseMlsDevGroupFeedEntry(value) {
-  return boundary3(() => {
-    const input = readMlsDataRecord(value, ["version", "ordinal", "kind", "accepted"], ["version", "ordinal", "kind", "receipt", "envelope"]);
+  return boundary4(() => {
+    const signed = value !== null && typeof value === "object" && Object.hasOwn(value, "receiptProof") ? ["receiptProof"] : [];
+    const input = readMlsDataRecord(value, ["version", "ordinal", "kind", "accepted", ...signed], ["version", "ordinal", "kind", "receipt", "envelope", ...signed]);
     const version = requireMlsLiteral(input.version, 1), ordinal = requireMlsInteger(input.ordinal, 1);
+    const proof = signed.length ? { receiptProof: parseMlsDevFeedReceiptProof(input.receiptProof) } : {};
     if (input.kind === "control") {
       if (!Object.hasOwn(input, "accepted"))
-        invalid4();
-      return bounded3({ version, ordinal, kind: "control", accepted: parseMlsDevGroupAcceptedControl(input.accepted) });
+        invalid5();
+      return bounded3({ version, ordinal, kind: "control", accepted: parseMlsDevGroupAcceptedControl(input.accepted), ...proof });
     }
     const kind = requireMlsLiteral(input.kind, "application"), receipt = parseMlsDevApplicationReceipt(input.receipt), envelope = parseMlsDevApplicationEnvelope(input.envelope);
     if (ordinal !== receipt.feedOrdinal || receipt.conversationId !== envelope.conversationId || receipt.groupId !== envelope.groupId || receipt.messageId !== envelope.messageId || JSON.stringify(receipt.head) !== JSON.stringify(envelope.expectedHead))
-      invalid4();
-    return bounded3({ version, ordinal, kind, receipt, envelope });
+      invalid5();
+    return bounded3({ version, ordinal, kind, receipt, envelope, ...proof });
   });
 }
 __name(parseMlsDevGroupFeedEntry, "parseMlsDevGroupFeedEntry");
 function parseMlsDevGroupFeedQuery(value) {
-  return boundary3(() => {
+  return boundary4(() => {
     const input = readMlsDataRecord(value, ["version", "conversationId", "credential", "afterOrdinal", "limit"]);
-    const limit = requireMlsInteger(input.limit, 1);
-    if (limit > MLS_DEV_GROUP_FEED_MAX_ENTRIES)
-      invalid4();
+    const limit2 = requireMlsInteger(input.limit, 1);
+    if (limit2 > MLS_DEV_GROUP_FEED_MAX_ENTRIES)
+      invalid5();
     parseMlsDevCredentialToken(input.credential);
-    return Object.freeze({ version: requireMlsLiteral(input.version, 1), conversationId: id(input.conversationId), credential: input.credential, afterOrdinal: requireMlsInteger(input.afterOrdinal), limit });
+    return Object.freeze({ version: requireMlsLiteral(input.version, 1), conversationId: id(input.conversationId), credential: input.credential, afterOrdinal: requireMlsInteger(input.afterOrdinal), limit: limit2 });
   });
 }
 __name(parseMlsDevGroupFeedQuery, "parseMlsDevGroupFeedQuery");
 function parseMlsDevGroupFeedResult(value) {
-  return boundary3(() => {
+  return boundary4(() => {
     const input = readMlsDataRecord(value, ["version", "protocol", "conversationId", "marker", "membershipRevision", "admissionId", "roster", "minimumOrdinal", "latestOrdinal", "nextOrdinal", "entries", "hasMore", "terminal"]);
     const conversationId = id(input.conversationId), marker = input.marker === null ? null : parseMlsDevGroupMarker(input.marker);
     const minimumOrdinal = input.minimumOrdinal === null ? null : requireMlsInteger(input.minimumOrdinal, 1);
     const latestOrdinal = requireMlsInteger(input.latestOrdinal), nextOrdinal = requireMlsInteger(input.nextOrdinal);
     const entries = array(input.entries).map(parseMlsDevGroupFeedEntry), hasMore = boolean(input.hasMore), terminal = boolean(input.terminal);
     if (nextOrdinal > latestOrdinal || minimumOrdinal !== null && minimumOrdinal > latestOrdinal || minimumOrdinal === null && (entries.length || nextOrdinal || hasMore || terminal) || !marker && (latestOrdinal || minimumOrdinal !== null || entries.length || terminal))
-      invalid4();
+      invalid5();
+    const protocol = isMlsDevTextProtocol(input.protocol) ? input.protocol : invalid5();
     for (let i = 0; i < entries.length; i++) {
       const entry = entries[i], subject = entry.kind === "control" ? entry.accepted.control : entry.envelope;
+      if (entry.kind === "application" && entry.envelope.interaction && !mlsDevProtocolCarriesCards(protocol))
+        invalid5();
       if (!marker || minimumOrdinal === null || entry.ordinal < minimumOrdinal || entry.ordinal > latestOrdinal || subject.conversationId !== conversationId || subject.groupId !== marker.groupId || i > 0 && entry.ordinal !== entries[i - 1].ordinal + 1)
-        invalid4();
+        invalid5();
       const head = entry.kind === "control" ? entry.accepted.head : entry.receipt.head;
       if (head.sequence > marker.head.sequence || head.epoch > marker.head.epoch)
-        invalid4();
+        invalid5();
     }
     if (entries.length && entries.at(-1).ordinal !== nextOrdinal || hasMore !== (minimumOrdinal !== null && nextOrdinal < latestOrdinal))
-      invalid4();
+      invalid5();
     return bounded3({
       version: requireMlsLiteral(input.version, 1),
-      protocol: requireMlsLiteral(input.protocol, MLS_DEV_TEXT_PROTOCOL),
+      protocol,
       conversationId,
       marker,
       membershipRevision: requireMlsInteger(input.membershipRevision),
@@ -611,25 +911,25 @@ var MlsDevKeyPackagesValidationError = class extends Error {
     this.name = "MlsDevKeyPackagesValidationError";
   }
 };
-function invalid5() {
+function invalid6() {
   throw new MlsDevKeyPackagesValidationError();
 }
-__name(invalid5, "invalid");
-function boundary4(read) {
+__name(invalid6, "invalid");
+function boundary5(read) {
   try {
     return read();
   } catch {
-    return invalid5();
+    return invalid6();
   }
 }
-__name(boundary4, "boundary");
+__name(boundary5, "boundary");
 function bounded4(value) {
-  if (new TextEncoder().encode(JSON.stringify(value)).length > MLS_DEV_KEY_PACKAGES_MAX_BYTES) invalid5();
+  if (new TextEncoder().encode(JSON.stringify(value)).length > MLS_DEV_KEY_PACKAGES_MAX_BYTES) invalid6();
   return Object.freeze(value);
 }
 __name(bounded4, "bounded");
 function id2(value) {
-  if (typeof value !== "string" || !/^[A-Za-z0-9_.:~-]{1,200}$/.test(value) || value === "." || value === "..") invalid5();
+  if (typeof value !== "string" || !/^[A-Za-z0-9_.:~-]{1,200}$/.test(value) || value === "." || value === "..") invalid6();
   return value;
 }
 __name(id2, "id");
@@ -639,18 +939,18 @@ function ref(value) {
 }
 __name(ref, "ref");
 function parseMlsDevKeyPackageWire(value) {
-  return boundary4(() => {
-    if (typeof value !== "string" || value.length < 2 || value.length > Math.ceil(MLS_DEV_KEY_PACKAGE_TLS_MAX_BYTES * 4 / 3)) invalid5();
+  return boundary5(() => {
+    if (typeof value !== "string" || value.length < 2 || value.length > Math.ceil(MLS_DEV_KEY_PACKAGE_TLS_MAX_BYTES * 4 / 3)) invalid6();
     const bytes = Math.floor(value.length * 3 / 4);
-    if (bytes < 1 || bytes > MLS_DEV_KEY_PACKAGE_TLS_MAX_BYTES || value.length !== Math.ceil(bytes * 4 / 3) || !/^[A-Za-z0-9_-]+$/.test(value)) invalid5();
+    if (bytes < 1 || bytes > MLS_DEV_KEY_PACKAGE_TLS_MAX_BYTES || value.length !== Math.ceil(bytes * 4 / 3) || !/^[A-Za-z0-9_-]+$/.test(value)) invalid6();
     const last = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_".indexOf(value.at(-1));
-    if (value.length % 4 === 2 && (last & 15) !== 0 || value.length % 4 === 3 && (last & 3) !== 0) invalid5();
+    if (value.length % 4 === 2 && (last & 15) !== 0 || value.length % 4 === 3 && (last & 3) !== 0) invalid6();
     return value;
   });
 }
 __name(parseMlsDevKeyPackageWire, "parseMlsDevKeyPackageWire");
 function parseMlsDevKeyPackageClaimPreconditions(value) {
-  return boundary4(() => {
+  return boundary5(() => {
     const input = readMlsDataRecord(value, ["conversationId", "membershipRevision", "admissionId", "targetAdmissionId"]);
     return Object.freeze({
       conversationId: id2(input.conversationId),
@@ -662,17 +962,17 @@ function parseMlsDevKeyPackageClaimPreconditions(value) {
 }
 __name(parseMlsDevKeyPackageClaimPreconditions, "parseMlsDevKeyPackageClaimPreconditions");
 function parseMlsDevKeyPackagePublish(value) {
-  return boundary4(() => {
+  return boundary5(() => {
     const input = readMlsDataRecord(value, ["version", "requestId", "keyPackage"]);
     return bounded4({ version: requireMlsLiteral(input.version, 1), requestId: requireMlsUuid(input.requestId), keyPackage: parseMlsDevKeyPackageWire(input.keyPackage) });
   });
 }
 __name(parseMlsDevKeyPackagePublish, "parseMlsDevKeyPackagePublish");
 function parseMlsDevKeyPackagePublicationReceipt(value) {
-  return boundary4(() => {
+  return boundary5(() => {
     const input = readMlsDataRecord(value, ["version", "authorization", "requestId", "keyPackageRef", "deviceId", "publishedAtMs", "expiresAtMs"]);
     const publishedAtMs = requireMlsInteger(input.publishedAtMs), expiresAtMs = requireMlsInteger(input.expiresAtMs);
-    if (publishedAtMs >= expiresAtMs) invalid5();
+    if (publishedAtMs >= expiresAtMs) invalid6();
     return bounded4({
       version: requireMlsLiteral(input.version, 1),
       authorization: requireMlsLiteral(input.authorization, "key_package_publication_only"),
@@ -686,7 +986,7 @@ function parseMlsDevKeyPackagePublicationReceipt(value) {
 }
 __name(parseMlsDevKeyPackagePublicationReceipt, "parseMlsDevKeyPackagePublicationReceipt");
 function parseMlsDevKeyPackageClaim(value) {
-  return boundary4(() => {
+  return boundary5(() => {
     const input = readMlsDataRecord(value, ["version", "requestId", "claimantCredential", "recipientDeviceId", "preconditions"]);
     parseMlsDevCredentialToken(input.claimantCredential);
     return bounded4({
@@ -700,7 +1000,7 @@ function parseMlsDevKeyPackageClaim(value) {
 }
 __name(parseMlsDevKeyPackageClaim, "parseMlsDevKeyPackageClaim");
 function parseMlsDevKeyPackageClaimReceipt(value) {
-  return boundary4(() => {
+  return boundary5(() => {
     const input = readMlsDataRecord(value, [
       "version",
       "authorization",
@@ -713,7 +1013,7 @@ function parseMlsDevKeyPackageClaimReceipt(value) {
       "claimedAtMs"
     ]);
     const claimantDeviceId = requireMlsUuid(input.claimantDeviceId), recipientDeviceId = requireMlsUuid(input.recipientDeviceId);
-    if (claimantDeviceId === recipientDeviceId) invalid5();
+    if (claimantDeviceId === recipientDeviceId) invalid6();
     return bounded4({
       version: requireMlsLiteral(input.version, 1),
       authorization: requireMlsLiteral(input.authorization, "key_package_claim_only"),
@@ -729,6 +1029,228 @@ function parseMlsDevKeyPackageClaimReceipt(value) {
 }
 __name(parseMlsDevKeyPackageClaimReceipt, "parseMlsDevKeyPackageClaimReceipt");
 
+// ../backend-contracts/src/mlsDevInteraction.ts
+var MLS_DEV_INTERACTION_LIMITS = Object.freeze({ title: 200, details: 8e3, options: 10, optionLabel: 120, text: 4e3 });
+var MLS_DEV_SECRET_ANSWER_MAX_BYTES = MLS_DEV_INTERACTION_LIMITS.text * 4 + 16;
+var MLS_DEV_INTERACTION_WITHDRAW_REASONS = ["stopped", "turn_ended", "expired", "restart"];
+var MlsDevInteractionValidationError = class extends Error {
+  static {
+    __name(this, "MlsDevInteractionValidationError");
+  }
+  code = "INVALID_MLS_DEV_INTERACTION";
+  constructor() {
+    super("INVALID_MLS_DEV_INTERACTION");
+    this.name = "MlsDevInteractionValidationError";
+  }
+};
+var utf83 = new TextEncoder();
+function invalid7() {
+  throw new MlsDevInteractionValidationError();
+}
+__name(invalid7, "invalid");
+function boundary6(read) {
+  try {
+    return read();
+  } catch {
+    return invalid7();
+  }
+}
+__name(boundary6, "boundary");
+function id3(value) {
+  if (typeof value !== "string" || !/^[A-Za-z0-9_.:~-]{1,200}$/.test(value) || value === "." || value === "..") invalid7();
+  return value;
+}
+__name(id3, "id");
+function interactionId(value) {
+  if (typeof value !== "string" || !MLS_DEV_INTERACTION_ID_PATTERN.test(value) || value === "." || value === "..") invalid7();
+  return value;
+}
+__name(interactionId, "interactionId");
+function encoded3(value, bytes) {
+  decodeCanonicalMlsBase64Url(value, bytes);
+  return value;
+}
+__name(encoded3, "encoded");
+function wire(value, min, max) {
+  if (typeof value !== "string" || !/^[A-Za-z0-9_-]*$/.test(value) || value.length % 4 === 1) invalid7();
+  const bytes = Math.floor(value.length * 3 / 4);
+  if (bytes < min || bytes > max) invalid7();
+  const last = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_".indexOf(value.at(-1));
+  if (value.length % 4 === 2 && (last & 15) !== 0 || value.length % 4 === 3 && (last & 3) !== 0) invalid7();
+  return value;
+}
+__name(wire, "wire");
+function text(value, max) {
+  if (typeof value !== "string" || !value.trim() || [...value].length > max || new TextDecoder("utf-8", { fatal: true }).decode(utf83.encode(value)) !== value) invalid7();
+  return value;
+}
+__name(text, "text");
+function boolean2(value) {
+  if (typeof value !== "boolean") invalid7();
+  return value;
+}
+__name(boolean2, "boolean");
+function array2(value, min, max) {
+  if (!Array.isArray(value) || Object.getPrototypeOf(value) !== Array.prototype || value.length < min || value.length > max) invalid7();
+  const descriptors = Object.getOwnPropertyDescriptors(value);
+  if (Reflect.ownKeys(descriptors).length !== value.length + 1) invalid7();
+  return Array.from({ length: value.length }, (_, index) => {
+    const field = descriptors[index];
+    if (!field || !field.enumerable || !Object.hasOwn(field, "value")) invalid7();
+    return field.value;
+  });
+}
+__name(array2, "array");
+function closed(value, required, optional) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) invalid7();
+  const present2 = Reflect.ownKeys(value);
+  if (present2.some((key) => typeof key !== "string" || !required.includes(key) && !optional.includes(key))) invalid7();
+  return readMlsDataRecord(value, present2);
+}
+__name(closed, "closed");
+function ordered(value) {
+  return Object.freeze(Object.fromEntries(Object.entries(value).filter(([, field]) => field !== void 0)));
+}
+__name(ordered, "ordered");
+function parseMlsDevInteractionRequestBody(value) {
+  return boundary6(() => {
+    const input = closed(
+      value,
+      ["requestId", "kind", "title", "responderIds", "expiresAtMs"],
+      ["details", "options", "multiple", "risk", "allowSession", "scopeKey", "secretKey"]
+    );
+    const kind = input.kind;
+    if (typeof kind !== "string" || !MLS_DEV_INTERACTION_KINDS.includes(kind)) invalid7();
+    const has = /* @__PURE__ */ __name((key) => Object.hasOwn(input, key), "has");
+    const options = has("options") ? array2(input.options, 1, MLS_DEV_INTERACTION_LIMITS.options).map((option) => {
+      const fields2 = readMlsDataRecord(option, ["id", "label"]);
+      if (typeof fields2.id !== "string" || !/^[A-Za-z0-9_.:-]{1,64}$/.test(fields2.id)) invalid7();
+      return Object.freeze({ id: fields2.id, label: text(fields2.label, MLS_DEV_INTERACTION_LIMITS.optionLabel) });
+    }) : void 0;
+    if (options && new Set(options.map((option) => option.id)).size !== options.length) invalid7();
+    const binding3 = parseMlsDevInteractionBinding({ role: "request", requestId: input.requestId, kind, responderIds: input.responderIds, expiresAtMs: input.expiresAtMs });
+    if (binding3.role !== "request") invalid7();
+    if (kind !== "approval" && ["risk", "allowSession", "scopeKey"].some(has)) invalid7();
+    if (kind !== "question" && (has("options") || has("multiple"))) invalid7();
+    if (has("multiple") && !options) invalid7();
+    if (kind === "secret" !== has("secretKey")) invalid7();
+    const allowSession = has("allowSession") ? boolean2(input.allowSession) : void 0;
+    if (has("scopeKey") && (typeof input.scopeKey !== "string" || !/^[A-Za-z0-9_:-]{1,64}$/.test(input.scopeKey))) invalid7();
+    if (allowSession === true && !has("scopeKey")) invalid7();
+    if (has("risk") && input.risk !== "normal" && input.risk !== "destructive") invalid7();
+    const secretKey = has("secretKey") ? (() => {
+      const key = readMlsDataRecord(input.secretKey, ["kem", "publicKey"]);
+      return Object.freeze({ kem: requireMlsLiteral(key.kem, "x25519"), publicKey: encoded3(key.publicKey, 32) });
+    })() : void 0;
+    return ordered({
+      requestId: binding3.requestId,
+      kind: binding3.kind,
+      title: text(input.title, MLS_DEV_INTERACTION_LIMITS.title),
+      details: has("details") ? text(input.details, MLS_DEV_INTERACTION_LIMITS.details) : void 0,
+      options: options ? Object.freeze(options) : void 0,
+      multiple: has("multiple") ? boolean2(input.multiple) : void 0,
+      risk: input.risk,
+      allowSession,
+      scopeKey: input.scopeKey,
+      responderIds: binding3.responderIds,
+      expiresAtMs: binding3.expiresAtMs,
+      secretKey
+    });
+  });
+}
+__name(parseMlsDevInteractionRequestBody, "parseMlsDevInteractionRequestBody");
+function parseMlsDevInteractionAnswer(value) {
+  return boundary6(() => {
+    if (value === null || typeof value !== "object" || Array.isArray(value)) invalid7();
+    const keys2 = Reflect.ownKeys(value);
+    if (keys2.includes("decision")) {
+      const input = readMlsDataRecord(value, ["decision", "scope"]);
+      if (input.decision !== "allow" && input.decision !== "deny" || input.scope !== "once" && input.scope !== "session") invalid7();
+      return Object.freeze({ decision: input.decision, scope: input.scope });
+    }
+    if (keys2.includes("choices")) {
+      const choices = array2(readMlsDataRecord(value, ["choices"]).choices, 1, MLS_DEV_INTERACTION_LIMITS.options).map((choice) => {
+        if (typeof choice !== "string" || !/^[A-Za-z0-9_.:-]{1,64}$/.test(choice)) invalid7();
+        return choice;
+      });
+      if (new Set(choices).size !== choices.length) invalid7();
+      return Object.freeze({ choices: Object.freeze(choices) });
+    }
+    if (keys2.includes("text")) return Object.freeze({ text: text(readMlsDataRecord(value, ["text"]).text, MLS_DEV_INTERACTION_LIMITS.text) });
+    if (keys2.includes("sealed")) {
+      const sealed = readMlsDataRecord(readMlsDataRecord(value, ["sealed"]).sealed, ["enc", "ciphertext"]);
+      return Object.freeze({ sealed: Object.freeze({ enc: encoded3(sealed.enc, 32), ciphertext: wire(sealed.ciphertext, 17, MLS_DEV_SECRET_ANSWER_MAX_BYTES) }) });
+    }
+    if (readMlsDataRecord(value, ["cancelled"]).cancelled !== true) invalid7();
+    return Object.freeze({ cancelled: true });
+  });
+}
+__name(parseMlsDevInteractionAnswer, "parseMlsDevInteractionAnswer");
+function parseMlsDevInteractionResponseBody(value) {
+  return boundary6(() => {
+    const input = readMlsDataRecord(value, ["requestId", "agentId", "answer"]);
+    return Object.freeze({ requestId: interactionId(input.requestId), agentId: id3(input.agentId), answer: parseMlsDevInteractionAnswer(input.answer) });
+  });
+}
+__name(parseMlsDevInteractionResponseBody, "parseMlsDevInteractionResponseBody");
+function parseMlsDevInteractionWithdrawBody(value) {
+  return boundary6(() => {
+    const input = readMlsDataRecord(value, ["requestId", "reason"]);
+    if (!MLS_DEV_INTERACTION_WITHDRAW_REASONS.includes(input.reason)) invalid7();
+    return Object.freeze({ requestId: interactionId(input.requestId), reason: input.reason });
+  });
+}
+__name(parseMlsDevInteractionWithdrawBody, "parseMlsDevInteractionWithdrawBody");
+var payloadFields = ["version", "kind", "conversationId", "groupId", "messageId", "operationId", "senderDeviceId"];
+function parseMlsDevApplicationPayload(value) {
+  return boundary6(() => {
+    const kind = value && typeof value === "object" ? Object.getOwnPropertyDescriptor(value, "kind") : void 0;
+    if (!kind || !Object.hasOwn(kind, "value")) invalid7();
+    if (kind.value === "text") return parseMlsDevTextPayload(value);
+    if (kind.value === "item") return parseMlsDevItemPayload(value);
+    const input = readMlsDataRecord(value, [...payloadFields, "interaction"]);
+    const ids = {
+      version: requireMlsLiteral(input.version, 1),
+      kind: input.kind,
+      conversationId: id3(input.conversationId),
+      groupId: encoded3(input.groupId, 32),
+      messageId: id3(input.messageId),
+      operationId: id3(input.operationId),
+      senderDeviceId: requireMlsUuid(input.senderDeviceId)
+    };
+    if (ids.messageId.startsWith("membership-")) invalid7();
+    const interaction = kind.value === "interaction.request" ? parseMlsDevInteractionRequestBody(input.interaction) : kind.value === "interaction.response" ? parseMlsDevInteractionResponseBody(input.interaction) : kind.value === "interaction.withdraw" ? parseMlsDevInteractionWithdrawBody(input.interaction) : invalid7();
+    const payload = Object.freeze({ ...ids, interaction });
+    if (utf83.encode(JSON.stringify(payload)).length > MLS_DEV_TEXT_MAX_BYTES) invalid7();
+    return payload;
+  });
+}
+__name(parseMlsDevApplicationPayload, "parseMlsDevApplicationPayload");
+function assertMlsDevInteractionPayloadBinding(payload, binding3) {
+  boundary6(() => {
+    if (payload.kind === "text" || payload.kind === "item") {
+      if (binding3 !== void 0) invalid7();
+      return;
+    }
+    if (!binding3 || payload.interaction.requestId !== binding3.requestId) invalid7();
+    if (payload.kind === "interaction.request") {
+      if (binding3.role !== "request" || payload.interaction.kind !== binding3.kind || payload.interaction.expiresAtMs !== binding3.expiresAtMs || payload.interaction.responderIds.length !== 1 || payload.interaction.responderIds[0] !== binding3.responderIds[0]) invalid7();
+    } else if (payload.kind === "interaction.response") {
+      if (binding3.role !== "response" || payload.interaction.agentId !== binding3.agentId) invalid7();
+    } else if (binding3.role !== "withdraw") invalid7();
+  });
+}
+__name(assertMlsDevInteractionPayloadBinding, "assertMlsDevInteractionPayloadBinding");
+function isMlsDevInteractionAnswerAllowed(request, answer) {
+  if ("cancelled" in answer) return request.kind !== "approval";
+  if (request.kind === "approval") return "decision" in answer && (answer.scope !== "session" || request.allowSession === true);
+  if (request.kind === "secret") return "sealed" in answer;
+  if ("text" in answer) return !request.options;
+  if (!("choices" in answer) || !request.options) return false;
+  return (request.multiple === true || answer.choices.length === 1) && answer.choices.every((choice) => request.options.some((option) => option.id === choice));
+}
+__name(isMlsDevInteractionAnswerAllowed, "isMlsDevInteractionAnswerAllowed");
+
 // ../backend-contracts/src/mlsDevGroup.ts
 var MLS_DEV_GROUP_ROSTER_MAX = 32;
 var MLS_DEV_GROUP_TLS_MAX_BYTES = 256 * 1024;
@@ -737,6 +1259,7 @@ var MLS_DEV_GROUP_WRAPPED_MAX_BYTES = 3 * 1024 * 1024;
 var MLS_DEV_GROUP_PREPARATION_MAX_BYTES = 4 * 1024 * 1024;
 var MLS_DEV_GROUP_QUERY_MAX_BYTES = 4 * 1024 * 1024;
 var MLS_DEV_GROUP_QUERY_MAX_CONTROLS = 4;
+var MLS_DEV_GROUP_ADMISSION_MAX_CANDIDATES = 64;
 var MlsDevGroupValidationError = class extends Error {
   static {
     __name(this, "MlsDevGroupValidationError");
@@ -747,119 +1270,169 @@ var MlsDevGroupValidationError = class extends Error {
     this.name = "MlsDevGroupValidationError";
   }
 };
-var utf83 = new TextEncoder();
-function invalid6() {
+var utf84 = new TextEncoder();
+function invalid8() {
   throw new MlsDevGroupValidationError();
 }
-__name(invalid6, "invalid");
-function boundary5(read) {
+__name(invalid8, "invalid");
+function boundary7(read) {
   try {
     return read();
   } catch {
-    return invalid6();
+    return invalid8();
   }
 }
-__name(boundary5, "boundary");
+__name(boundary7, "boundary");
 function bounded5(value, maximum = MLS_DEV_GROUP_CONTROL_MAX_BYTES) {
-  if (utf83.encode(JSON.stringify(value)).length > maximum)
-    invalid6();
+  if (utf84.encode(JSON.stringify(value)).length > maximum)
+    invalid8();
   return Object.freeze(value);
 }
 __name(bounded5, "bounded");
-function id3(value) {
+function id4(value) {
   if (typeof value !== "string" || !/^[A-Za-z0-9_.:~-]{1,200}$/.test(value) || value === "." || value === "..")
-    invalid6();
+    invalid8();
   return value;
 }
-__name(id3, "id");
-function encoded3(value, bytes) {
+__name(id4, "id");
+function encoded4(value, bytes) {
   decodeCanonicalMlsBase64Url(value, bytes);
   return value;
 }
-__name(encoded3, "encoded");
-function boolean2(value) {
+__name(encoded4, "encoded");
+function boolean3(value) {
   if (typeof value !== "boolean")
-    invalid6();
+    invalid8();
   return value;
 }
-__name(boolean2, "boolean");
+__name(boolean3, "boolean");
+function textProtocol(value) {
+  if (!isMlsDevTextProtocol(value))
+    invalid8();
+  return value;
+}
+__name(textProtocol, "textProtocol");
 function token(value) {
   parseMlsDevCredentialToken(value);
   return value;
 }
 __name(token, "token");
-function wire(value) {
+function wire2(value) {
   if (typeof value !== "string" || value.length < 2 || value.length > Math.ceil(MLS_DEV_GROUP_TLS_MAX_BYTES * 4 / 3))
-    invalid6();
+    invalid8();
   const bytes = Math.floor(value.length * 3 / 4);
   if (value.length !== Math.ceil(bytes * 4 / 3) || !/^[A-Za-z0-9_-]+$/.test(value))
-    invalid6();
+    invalid8();
   const last = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_".indexOf(value.at(-1));
   if (value.length % 4 === 2 && (last & 15) !== 0 || value.length % 4 === 3 && (last & 3) !== 0)
-    invalid6();
+    invalid8();
   return value;
 }
-__name(wire, "wire");
-function array2(value, maximum) {
+__name(wire2, "wire");
+function plaintextJson(value) {
+  if (typeof value !== "string" || !value || utf84.encode(value).length > MLS_DEV_TEXT_MAX_BYTES || new TextDecoder("utf-8", { fatal: true }).decode(utf84.encode(value)) !== value)
+    invalid8();
+  return value;
+}
+__name(plaintextJson, "plaintextJson");
+function present(value, keys2) {
+  return value && typeof value === "object" ? keys2.filter((key) => Object.hasOwn(value, key)) : [];
+}
+__name(present, "present");
+var pick = /* @__PURE__ */ __name((value, keys2) => Object.fromEntries(keys2.map((key) => [key, value[key]])), "pick");
+var textExtras = /* @__PURE__ */ __name((text5) => ({ ...text5.replyTo ? { replyTo: text5.replyTo } : {}, ...text5.mentions ? { mentions: text5.mentions } : {} }), "textExtras");
+function sealedCiphertext(value) {
+  if (typeof value !== "string" || !/^[A-Za-z0-9_-]+$/.test(value) || value.length % 4 === 1) invalid8();
+  const bytes = Math.floor(value.length * 3 / 4);
+  if (bytes < 17 || bytes > MLS_DEV_SECRET_ANSWER_MAX_BYTES) invalid8();
+  const last = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_".indexOf(value.at(-1));
+  if (value.length % 4 === 2 && (last & 15) !== 0 || value.length % 4 === 3 && (last & 3) !== 0) invalid8();
+  return value;
+}
+__name(sealedCiphertext, "sealedCiphertext");
+function array3(value, maximum) {
   if (!Array.isArray(value) || Object.getPrototypeOf(value) !== Array.prototype || value.length > maximum)
-    invalid6();
+    invalid8();
   const descriptors = Object.getOwnPropertyDescriptors(value);
   if (Reflect.ownKeys(descriptors).length !== value.length + 1)
-    invalid6();
+    invalid8();
   return Array.from({ length: value.length }, (_, index) => {
     const descriptor = descriptors[index];
     if (!descriptor || !descriptor.enumerable || !Object.hasOwn(descriptor, "value"))
-      invalid6();
+      invalid8();
     return descriptor.value;
   });
 }
-__name(array2, "array");
+__name(array3, "array");
 function parseMlsDevGroupCreateConversation(value) {
-  return boundary5(() => {
+  return boundary7(() => {
     const input = readMlsDataRecord(value, ["name", "memberIds", "mlsDev"]), config = readMlsDataRecord(input.mlsDev, ["version", "conversationId", "credential"], ["version", "conversationId", "credential", "protocol"]);
     if (typeof input.name !== "string" || input.name.trim().length > 100)
-      invalid6();
-    const memberIds = array2(input.memberIds, 31).map((value2) => parseMlsDevEnrollmentPrincipal({ type: "human", id: value2 }).id);
+      invalid8();
+    const memberIds = array3(input.memberIds, 31).map((value2) => parseMlsDevEnrollmentPrincipal({ type: "human", id: value2 }).id);
     if (!memberIds.length || new Set(memberIds).size !== memberIds.length || memberIds.some((value2) => value2.includes("/") || value2 === "." || value2 === ".."))
-      invalid6();
-    return bounded5({ name: input.name, memberIds: Object.freeze(memberIds), mlsDev: Object.freeze({ version: requireMlsLiteral(config.version, 1), conversationId: id3(config.conversationId), credential: token(config.credential), ...Object.hasOwn(config, "protocol") ? { protocol: requireMlsLiteral(config.protocol, MLS_DEV_TEXT_PROTOCOL) } : {} }) }, 16 * 1024);
+      invalid8();
+    return bounded5({ name: input.name, memberIds: Object.freeze(memberIds), mlsDev: Object.freeze({ version: requireMlsLiteral(config.version, 1), conversationId: id4(config.conversationId), credential: token(config.credential), ...Object.hasOwn(config, "protocol") ? { protocol: textProtocol(config.protocol) } : {} }) }, 16 * 1024);
   });
 }
 __name(parseMlsDevGroupCreateConversation, "parseMlsDevGroupCreateConversation");
 function parseMlsDevGroupHead(value) {
-  return boundary5(() => {
+  return boundary7(() => {
     const input = readMlsDataRecord(value, ["sequence", "epoch", "hash"]);
-    return Object.freeze({ sequence: requireMlsInteger(input.sequence, 1), epoch: requireMlsInteger(input.epoch), hash: encoded3(input.hash, 32) });
+    return Object.freeze({ sequence: requireMlsInteger(input.sequence, 1), epoch: requireMlsInteger(input.epoch), hash: encoded4(input.hash, 32) });
   });
 }
 __name(parseMlsDevGroupHead, "parseMlsDevGroupHead");
 function parseMlsDevGroupMarker(value) {
-  return boundary5(() => {
+  return boundary7(() => {
     const input = readMlsDataRecord(value, ["version", "groupId", "head"]);
-    return Object.freeze({ version: requireMlsLiteral(input.version, 1), groupId: encoded3(input.groupId, 32), head: parseMlsDevGroupHead(input.head) });
+    return Object.freeze({ version: requireMlsLiteral(input.version, 1), groupId: encoded4(input.groupId, 32), head: parseMlsDevGroupHead(input.head) });
   });
 }
 __name(parseMlsDevGroupMarker, "parseMlsDevGroupMarker");
 function parseMlsDevGroupRoster(value) {
-  return boundary5(() => {
-    const values = array2(value, MLS_DEV_GROUP_ROSTER_MAX).map((item) => {
-      const entry = readMlsDataRecord(item, ["device", "admissionId"]);
-      return Object.freeze({ device: parseMlsDevEnrollmentResult({ version: 1, authorization: "registration_only", device: entry.device }).device, admissionId: id3(entry.admissionId) });
+  return boundary7(() => {
+    const values = array3(value, MLS_DEV_GROUP_ROSTER_MAX).map((item2) => {
+      const entry = readMlsDataRecord(item2, ["device", "admissionId"]);
+      return Object.freeze({ device: parseMlsDevEnrollmentResult({ version: 1, authorization: "registration_only", device: entry.device }).device, admissionId: id4(entry.admissionId) });
     });
     for (let i = 1; i < values.length; i++)
       if (values[i - 1].device.deviceId >= values[i].device.deviceId)
-        invalid6();
+        invalid8();
     return Object.freeze(values);
   });
 }
 __name(parseMlsDevGroupRoster, "parseMlsDevGroupRoster");
+var MLS_DEV_ROOM_REMOVAL_DEADLINE_MS = 72 * 60 * 60 * 1e3;
+function parseMlsDevRoomRemoval(value) {
+  return boundary7(() => {
+    const input = readMlsDataRecord(value, ["version", "status", "pending", "closedAtMs"]), devices = /* @__PURE__ */ new Set(), principals = /* @__PURE__ */ new Set();
+    const status = ["pending", "closing", "closed"].includes(input.status) ? input.status : invalid8();
+    const pending = array3(input.pending, MLS_DEV_GROUP_ROSTER_MAX).map((item2) => {
+      const entry = readMlsDataRecord(item2, ["principalId", "deviceIds", "deadlineAtMs"]);
+      const principalId2 = parseMlsDevEnrollmentPrincipal({ type: "human", id: entry.principalId }).id;
+      const deviceIds = array3(entry.deviceIds, MLS_DEV_GROUP_ROSTER_MAX).map(requireMlsUuid);
+      if (principals.has(principalId2)) invalid8();
+      principals.add(principalId2);
+      for (const deviceId of deviceIds) {
+        if (devices.has(deviceId)) invalid8();
+        devices.add(deviceId);
+      }
+      return Object.freeze({ principalId: principalId2, deviceIds: Object.freeze(deviceIds), deadlineAtMs: requireMlsInteger(entry.deadlineAtMs, 1) });
+    });
+    const closedAtMs = input.closedAtMs === null ? null : requireMlsInteger(input.closedAtMs, 1);
+    if (status === "pending" ? !pending.length || closedAtMs !== null : closedAtMs === null || status === "closed" && pending.length) invalid8();
+    return Object.freeze({ version: requireMlsLiteral(input.version, 1), status, pending: Object.freeze(pending), closedAtMs });
+  });
+}
+__name(parseMlsDevRoomRemoval, "parseMlsDevRoomRemoval");
 function parseMlsDevGroupPreconditions(value) {
-  return boundary5(() => {
+  return boundary7(() => {
     const input = readMlsDataRecord(value, ["membershipRevision", "admissionId", "targetAdmissionId"]);
     return Object.freeze({
       membershipRevision: requireMlsInteger(input.membershipRevision),
-      admissionId: id3(input.admissionId),
-      targetAdmissionId: input.targetAdmissionId === null ? null : id3(input.targetAdmissionId)
+      admissionId: id4(input.admissionId),
+      targetAdmissionId: input.targetAdmissionId === null ? null : id4(input.targetAdmissionId)
     });
   });
 }
@@ -883,37 +1456,40 @@ var unsignedFields = [
 ];
 function unsigned(input) {
   if (typeof input.kind !== "string" || !["create", "add", "remove"].includes(input.kind))
-    invalid6();
+    invalid8();
   const kind = input.kind;
   const senderCredential = token(input.senderCredential), sender = parseMlsDevCredentialToken(senderCredential).unsigned.claims.device;
   const expectedHead = input.expectedHead === null ? null : parseMlsDevGroupHead(input.expectedHead);
   const epoch = requireMlsInteger(input.epoch), preconditions = parseMlsDevGroupPreconditions(input.preconditions), roster = parseMlsDevGroupRoster(input.roster);
-  const groupInfo = input.groupInfo === null ? null : wire(input.groupInfo), commit = input.commit === null ? null : wire(input.commit);
-  const welcome = input.welcome === null ? null : wire(input.welcome);
+  const environmentId = requireMlsEnvironmentId(input.environmentId);
+  if (sender.environmentId !== environmentId || roster.some((entry) => entry.device.environmentId !== environmentId))
+    invalid8();
+  const groupInfo = input.groupInfo === null ? null : wire2(input.groupInfo), commit = input.commit === null ? null : wire2(input.commit);
+  const welcome = input.welcome === null ? null : wire2(input.welcome);
   const keyPackageClaim = input.keyPackageClaim === null ? null : parseMlsDevKeyPackageClaimReceipt(input.keyPackageClaim);
   const removedDeviceId = input.removedDeviceId === null ? null : requireMlsUuid(input.removedDeviceId);
   const own = roster.find((entry) => entry.device.deviceId === sender.deviceId);
   if (!own || JSON.stringify(own.device) !== JSON.stringify(sender) || own.admissionId !== preconditions.admissionId)
-    invalid6();
+    invalid8();
   if (kind === "create") {
     if (expectedHead !== null || epoch !== 0 || roster.length !== 1 || !groupInfo || commit !== null || welcome !== null || keyPackageClaim !== null || removedDeviceId !== null || preconditions.targetAdmissionId !== null)
-      invalid6();
+      invalid8();
   } else {
     if (!expectedHead || expectedHead.sequence >= Number.MAX_SAFE_INTEGER || expectedHead.epoch >= Number.MAX_SAFE_INTEGER || epoch !== expectedHead.epoch + 1 || !commit || preconditions.targetAdmissionId === null)
-      invalid6();
+      invalid8();
     if (kind === "add") {
       const target = roster.find((entry) => entry.device.deviceId === keyPackageClaim?.recipientDeviceId);
       if (!welcome || !keyPackageClaim || removedDeviceId !== null || !target || keyPackageClaim.claimantDeviceId !== sender.deviceId || keyPackageClaim.preconditions.conversationId !== input.conversationId || keyPackageClaim.preconditions.membershipRevision !== preconditions.membershipRevision || keyPackageClaim.preconditions.admissionId !== preconditions.admissionId || keyPackageClaim.preconditions.targetAdmissionId !== preconditions.targetAdmissionId || target.admissionId !== preconditions.targetAdmissionId)
-        invalid6();
+        invalid8();
     } else if (!removedDeviceId || removedDeviceId === sender.deviceId || roster.some((entry) => entry.device.deviceId === removedDeviceId) || welcome !== null || keyPackageClaim !== null)
-      invalid6();
+      invalid8();
   }
   return bounded5({
     version: requireMlsLiteral(input.version, 1),
-    environmentId: requireMlsLiteral(input.environmentId, "canon-dev-v1"),
+    environmentId,
     kind,
-    conversationId: id3(input.conversationId),
-    groupId: encoded3(input.groupId, 32),
+    conversationId: id4(input.conversationId),
+    groupId: encoded4(input.groupId, 32),
     senderCredential,
     expectedHead,
     epoch,
@@ -928,25 +1504,25 @@ function unsigned(input) {
 }
 __name(unsigned, "unsigned");
 function parseMlsDevGroupControl(value) {
-  return boundary5(() => {
+  return boundary7(() => {
     const input = readMlsDataRecord(value, [...unsignedFields, "proof"]);
-    return bounded5({ ...unsigned(input), proof: encoded3(input.proof, 64) });
+    return bounded5({ ...unsigned(input), proof: encoded4(input.proof, 64) });
   });
 }
 __name(parseMlsDevGroupControl, "parseMlsDevGroupControl");
 function parseMlsDevGroupAcceptedControl(value) {
-  return boundary5(() => {
+  return boundary7(() => {
     const input = readMlsDataRecord(value, ["version", "authorization", "operationId", "control", "head", "acceptedAtMs", "membershipRevision"]);
     const control = parseMlsDevGroupControl(input.control), head = parseMlsDevGroupHead(input.head);
     if (head.sequence !== (control.expectedHead?.sequence ?? 0) + 1 || head.epoch !== control.epoch)
-      invalid6();
+      invalid8();
     const membershipRevision = requireMlsInteger(input.membershipRevision);
     if (membershipRevision !== control.preconditions.membershipRevision && !(control.kind === "remove" && membershipRevision === control.preconditions.membershipRevision + 1))
-      invalid6();
+      invalid8();
     return bounded5({
       version: requireMlsLiteral(input.version, 1),
       authorization: requireMlsLiteral(input.authorization, "group_control_only"),
-      operationId: id3(input.operationId),
+      operationId: id4(input.operationId),
       control,
       head,
       acceptedAtMs: requireMlsInteger(input.acceptedAtMs),
@@ -955,40 +1531,65 @@ function parseMlsDevGroupAcceptedControl(value) {
   });
 }
 __name(parseMlsDevGroupAcceptedControl, "parseMlsDevGroupAcceptedControl");
+function parseMlsDevGroupAdmissionsResult(value) {
+  return boundary7(() => {
+    const input = readMlsDataRecord(value, ["version", "conversationId", "membershipRevision", "candidates", "waitingPrincipalIds"]);
+    const candidates = array3(input.candidates, MLS_DEV_GROUP_ADMISSION_MAX_CANDIDATES).map((raw) => {
+      const entry = readMlsDataRecord(raw, ["principal", "deviceId", "targetAdmissionId"]), principal2 = readMlsDataRecord(entry.principal, ["type", "id"]);
+      if (principal2.type !== "human" && principal2.type !== "ai_agent") invalid8();
+      return Object.freeze({
+        principal: Object.freeze({ type: principal2.type, id: id4(principal2.id) }),
+        deviceId: requireMlsUuid(entry.deviceId),
+        targetAdmissionId: id4(entry.targetAdmissionId)
+      });
+    });
+    if (new Set(candidates.map((entry) => entry.deviceId)).size !== candidates.length) invalid8();
+    const waiting = array3(input.waitingPrincipalIds, 32).map(id4);
+    if (new Set(waiting).size !== waiting.length) invalid8();
+    return bounded5(Object.freeze({
+      version: requireMlsLiteral(input.version, 1),
+      conversationId: id4(input.conversationId),
+      membershipRevision: requireMlsInteger(input.membershipRevision, 1),
+      candidates: Object.freeze(candidates),
+      waitingPrincipalIds: Object.freeze(waiting)
+    }), 64 * 1024);
+  });
+}
+__name(parseMlsDevGroupAdmissionsResult, "parseMlsDevGroupAdmissionsResult");
 function parseMlsDevGroupQuery(value) {
-  return boundary5(() => {
+  return boundary7(() => {
     const input = readMlsDataRecord(value, ["version", "conversationId", "credential", "afterSequence", "limit"]);
-    const limit = requireMlsInteger(input.limit, 1);
-    if (limit > MLS_DEV_GROUP_QUERY_MAX_CONTROLS)
-      invalid6();
+    const limit2 = requireMlsInteger(input.limit, 1);
+    if (limit2 > MLS_DEV_GROUP_QUERY_MAX_CONTROLS)
+      invalid8();
     return bounded5({
       version: requireMlsLiteral(input.version, 1),
-      conversationId: id3(input.conversationId),
+      conversationId: id4(input.conversationId),
       credential: token(input.credential),
       afterSequence: requireMlsInteger(input.afterSequence),
-      limit
+      limit: limit2
     }, 16 * 1024);
   });
 }
 __name(parseMlsDevGroupQuery, "parseMlsDevGroupQuery");
 function parseMlsDevGroupQueryResult(value) {
-  return boundary5(() => {
+  return boundary7(() => {
     const input = readMlsDataRecord(value, ["version", "conversationId", "marker", "membershipRevision", "admissionId", "roster", "controls", "nextSequence", "hasMore", "terminal"]);
-    const conversationId = id3(input.conversationId), marker = input.marker === null ? null : parseMlsDevGroupMarker(input.marker);
-    const controls = array2(input.controls, MLS_DEV_GROUP_QUERY_MAX_CONTROLS).map(parseMlsDevGroupAcceptedControl);
-    const nextSequence = requireMlsInteger(input.nextSequence), terminal = boolean2(input.terminal), hasMore = boolean2(input.hasMore);
+    const conversationId = id4(input.conversationId), marker = input.marker === null ? null : parseMlsDevGroupMarker(input.marker);
+    const controls = array3(input.controls, MLS_DEV_GROUP_QUERY_MAX_CONTROLS).map(parseMlsDevGroupAcceptedControl);
+    const nextSequence = requireMlsInteger(input.nextSequence), terminal = boolean3(input.terminal), hasMore = boolean3(input.hasMore);
     for (let i = 0; i < controls.length; i++) {
       if (!marker || controls[i].control.conversationId !== conversationId || controls[i].control.groupId !== marker.groupId || controls[i].head.sequence > marker.head.sequence || i > 0 && controls[i].head.sequence !== controls[i - 1].head.sequence + 1)
-        invalid6();
+        invalid8();
     }
     if (controls.length && controls.at(-1).head.sequence !== nextSequence || marker && nextSequence > marker.head.sequence || !marker && (controls.length || nextSequence || terminal || hasMore))
-      invalid6();
+      invalid8();
     return bounded5({
       version: requireMlsLiteral(input.version, 1),
       conversationId,
       marker,
       membershipRevision: requireMlsInteger(input.membershipRevision),
-      admissionId: id3(input.admissionId),
+      admissionId: id4(input.admissionId),
       roster: parseMlsDevGroupRoster(input.roster),
       controls: Object.freeze(controls),
       nextSequence,
@@ -999,42 +1600,43 @@ function parseMlsDevGroupQueryResult(value) {
 }
 __name(parseMlsDevGroupQueryResult, "parseMlsDevGroupQueryResult");
 function parseMlsDevGroupContext(value) {
-  return boundary5(() => {
+  return boundary7(() => {
     const input = readMlsDataRecord(value, ["version", "environmentId", "conversationId", "groupId", "deviceId", "installationId", "revision"], ["version", "environmentId", "conversationId", "groupId", "deviceId", "installationId", "revision", "protocol"]);
     const revision2 = requireMlsInteger(input.revision);
     if (revision2 >= Number.MAX_SAFE_INTEGER)
-      invalid6();
+      invalid8();
     return Object.freeze({
       version: requireMlsLiteral(input.version, 1),
-      environmentId: requireMlsLiteral(input.environmentId, "canon-dev-v1"),
-      conversationId: id3(input.conversationId),
-      groupId: encoded3(input.groupId, 32),
+      environmentId: requireMlsEnvironmentId(input.environmentId),
+      conversationId: id4(input.conversationId),
+      groupId: encoded4(input.groupId, 32),
       deviceId: requireMlsUuid(input.deviceId),
       installationId: parseMlsDevInstallationId(input.installationId),
       revision: revision2,
-      ...Object.hasOwn(input, "protocol") ? { protocol: requireMlsLiteral(input.protocol, MLS_DEV_TEXT_PROTOCOL) } : {}
+      ...Object.hasOwn(input, "protocol") ? { protocol: textProtocol(input.protocol) } : {}
     });
   });
 }
 __name(parseMlsDevGroupContext, "parseMlsDevGroupContext");
 function parseMlsDevGroupCommand(value) {
-  return boundary5(() => {
+  return boundary7(() => {
     if (!value || typeof value !== "object")
-      invalid6();
+      invalid8();
     const descriptor = Object.getOwnPropertyDescriptor(value, "op");
     if (!descriptor || !Object.hasOwn(descriptor, "value"))
-      invalid6();
+      invalid8();
     const op = descriptor.value;
     if (op === "process_application") {
       const input2 = readMlsDataRecord(value, ["op", "entry"]), entry = parseMlsDevGroupFeedEntry(input2.entry);
-      if (entry.kind !== "application")
-        invalid6();
+      if (entry.kind !== "application" || !entry.receiptProof)
+        invalid8();
       return bounded5({ op, entry });
     }
     if (op === "encrypt_text") {
-      const input2 = readMlsDataRecord(value, ["op", "operationId", "messageId", "credential", "expectedHead", "preconditions", "text"]);
+      const extras = present(value, ["replyTo", "mentions"]);
+      const input2 = readMlsDataRecord(value, ["op", "operationId", "messageId", "credential", "expectedHead", "preconditions", "text", ...extras]);
       const credential = token(input2.credential), senderDeviceId = parseMlsDevCredentialToken(credential).unsigned.claims.device.deviceId;
-      const text3 = parseMlsDevTextPayload({
+      const text5 = parseMlsDevTextPayload({
         version: 1,
         kind: "text",
         conversationId: "validation",
@@ -1042,117 +1644,283 @@ function parseMlsDevGroupCommand(value) {
         messageId: input2.messageId,
         operationId: input2.operationId,
         senderDeviceId,
-        text: input2.text
+        text: input2.text,
+        ...pick(input2, extras)
       });
       return bounded5({
         op,
-        operationId: text3.operationId,
-        messageId: text3.messageId,
+        operationId: text5.operationId,
+        messageId: text5.messageId,
         credential,
         expectedHead: parseMlsDevGroupHead(input2.expectedHead),
         preconditions: parseMlsDevApplicationPreconditions(input2.preconditions),
-        text: text3.text
+        text: text5.text,
+        ...textExtras(text5)
+      });
+    }
+    if (op === "encrypt_item") {
+      const input2 = readMlsDataRecord(value, ["op", "operationId", "messageId", "credential", "expectedHead", "preconditions", "item"]);
+      const credential = token(input2.credential), senderDeviceId = parseMlsDevCredentialToken(credential).unsigned.claims.device.deviceId;
+      const parsed = parseMlsDevItemPayload({
+        version: 1,
+        kind: "item",
+        conversationId: "validation",
+        groupId: "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+        messageId: input2.messageId,
+        operationId: input2.operationId,
+        senderDeviceId,
+        item: input2.item
+      });
+      return bounded5({
+        op,
+        operationId: parsed.operationId,
+        messageId: parsed.messageId,
+        credential,
+        expectedHead: parseMlsDevGroupHead(input2.expectedHead),
+        preconditions: parseMlsDevApplicationPreconditions(input2.preconditions),
+        item: parsed.item
+      });
+    }
+    if (op === "encrypt_interaction") {
+      const input2 = readMlsDataRecord(value, ["op", "operationId", "messageId", "credential", "expectedHead", "preconditions", "interaction", "body", "seal"]);
+      const credential = token(input2.credential), interaction = parseMlsDevInteractionBinding(input2.interaction);
+      const body = readMlsDataRecord(input2.body, Reflect.ownKeys(input2.body ?? {}).filter((key) => typeof key === "string"));
+      let seal = null;
+      if (interaction.role === "request") {
+        if (Object.hasOwn(body, "secretKey") || input2.seal !== null)
+          invalid8();
+        const parsed = parseMlsDevInteractionRequestBody(interaction.kind === "secret" ? { ...body, secretKey: { kem: "x25519", publicKey: "A".repeat(43) } } : body);
+        if (parsed.requestId !== interaction.requestId || parsed.kind !== interaction.kind || parsed.expiresAtMs !== interaction.expiresAtMs || parsed.responderIds[0] !== interaction.responderIds[0])
+          invalid8();
+      } else if (interaction.role === "response") {
+        if (input2.seal === null) {
+          const parsed = parseMlsDevInteractionResponseBody(body);
+          if (parsed.requestId !== interaction.requestId || parsed.agentId !== interaction.agentId || "sealed" in parsed.answer)
+            invalid8();
+        } else {
+          const fields3 = readMlsDataRecord(input2.seal, ["text", "publicKey", "requesterDeviceId"]), ids2 = readMlsDataRecord(body, ["requestId", "agentId"]);
+          if (ids2.requestId !== interaction.requestId || ids2.agentId !== interaction.agentId || typeof fields3.text !== "string" || !fields3.text.trim() || [...fields3.text].length > MLS_DEV_INTERACTION_LIMITS.text || utf84.encode(fields3.text).length > MLS_DEV_SECRET_ANSWER_MAX_BYTES - 16 || new TextDecoder("utf-8", { fatal: true }).decode(utf84.encode(fields3.text)) !== fields3.text)
+            invalid8();
+          seal = Object.freeze({ text: fields3.text, publicKey: encoded4(fields3.publicKey, 32), requesterDeviceId: requireMlsUuid(fields3.requesterDeviceId) });
+        }
+      } else if (input2.seal !== null || parseMlsDevInteractionWithdrawBody(body).requestId !== interaction.requestId)
+        invalid8();
+      const ids = parseMlsDevTextPayload({
+        version: 1,
+        kind: "text",
+        conversationId: "validation",
+        groupId: "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+        messageId: input2.messageId,
+        operationId: input2.operationId,
+        senderDeviceId: parseMlsDevCredentialToken(credential).unsigned.claims.device.deviceId,
+        text: "x"
+      });
+      if (utf84.encode(JSON.stringify(body)).length > MLS_DEV_TEXT_MAX_BYTES)
+        invalid8();
+      return bounded5({
+        op,
+        operationId: ids.operationId,
+        messageId: ids.messageId,
+        credential,
+        expectedHead: parseMlsDevGroupHead(input2.expectedHead),
+        preconditions: parseMlsDevApplicationPreconditions(input2.preconditions),
+        interaction,
+        body: Object.freeze(body),
+        seal
+      });
+    }
+    if (op === "open_secret_answer") {
+      const input2 = readMlsDataRecord(value, ["op", "requestId", "responderId", "responderDeviceId", "sealed"]), sealed = readMlsDataRecord(input2.sealed, ["enc", "ciphertext"]);
+      const binding3 = parseMlsDevInteractionBinding({ role: "response", requestId: input2.requestId, agentId: input2.responderId });
+      return bounded5({
+        op,
+        requestId: binding3.requestId,
+        responderId: id4(input2.responderId),
+        responderDeviceId: requireMlsUuid(input2.responderDeviceId),
+        sealed: Object.freeze({ enc: encoded4(sealed.enc, 32), ciphertext: sealedCiphertext(sealed.ciphertext) })
       });
     }
     if (op === "discard") {
       const input2 = readMlsDataRecord(value, ["op", "operationId", "control"]);
-      return bounded5({ op, operationId: id3(input2.operationId), control: parseMlsDevGroupControl(input2.control) });
+      return bounded5({ op, operationId: id4(input2.operationId), control: parseMlsDevGroupControl(input2.control) });
     }
     if (op === "finalize") {
       const input2 = readMlsDataRecord(value, ["op", "accepted"]);
       return bounded5({ op, accepted: parseMlsDevGroupAcceptedControl(input2.accepted) });
     }
     if (op === "join" || op === "process") {
-      const input2 = readMlsDataRecord(value, op === "join" ? ["op", "credential", "accepted", "keyPackageId"] : ["op", "credential", "accepted"]);
-      const common2 = { credential: token(input2.credential), accepted: parseMlsDevGroupAcceptedControl(input2.accepted) };
+      const input2 = readMlsDataRecord(value, op === "join" ? ["op", "credential", "accepted", "receiptProof", "feedOrdinal", "keyPackageId"] : ["op", "credential", "accepted", "receiptProof", "feedOrdinal"]);
+      const common2 = {
+        credential: token(input2.credential),
+        accepted: parseMlsDevGroupAcceptedControl(input2.accepted),
+        receiptProof: parseMlsDevFeedReceiptProof(input2.receiptProof),
+        feedOrdinal: requireMlsInteger(input2.feedOrdinal, 1)
+      };
       if (op === "join") {
         if (common2.accepted.control.kind !== "add")
-          invalid6();
+          invalid8();
         return bounded5({ op, ...common2, keyPackageId: requireMlsUuid(input2.keyPackageId) });
       }
       return bounded5({ op, ...common2 });
     }
     const common = ["op", "operationId", "credential", "preconditions"];
     const input = readMlsDataRecord(value, op === "create" ? common : op === "add" ? [...common, "expectedHead", "keyPackageClaim"] : op === "remove" ? [...common, "expectedHead", "removedDeviceId"] : []);
-    const fields = { operationId: id3(input.operationId), credential: token(input.credential), preconditions: parseMlsDevGroupPreconditions(input.preconditions) };
+    const fields2 = { operationId: id4(input.operationId), credential: token(input.credential), preconditions: parseMlsDevGroupPreconditions(input.preconditions) };
     if (op === "create") {
-      if (fields.preconditions.targetAdmissionId !== null)
-        invalid6();
-      return bounded5({ op, ...fields });
+      if (fields2.preconditions.targetAdmissionId !== null)
+        invalid8();
+      return bounded5({ op, ...fields2 });
     }
-    if (fields.preconditions.targetAdmissionId === null)
-      invalid6();
+    if (fields2.preconditions.targetAdmissionId === null)
+      invalid8();
     const expectedHead = parseMlsDevGroupHead(input.expectedHead);
     if (op === "add")
       return bounded5({
         op,
-        ...fields,
+        ...fields2,
         expectedHead,
         keyPackageClaim: parseMlsDevKeyPackageClaimReceipt(input.keyPackageClaim)
       });
     if (op === "remove")
       return bounded5({
         op,
-        ...fields,
+        ...fields2,
         expectedHead,
         removedDeviceId: requireMlsUuid(input.removedDeviceId)
       });
-    return invalid6();
+    return invalid8();
   });
 }
 __name(parseMlsDevGroupCommand, "parseMlsDevGroupCommand");
 function parseMlsDevGroupPreparation(value) {
-  return boundary5(() => {
+  return boundary7(() => {
     const input = readMlsDataRecord(value, ["wrappedState", "payload"]);
     if (typeof input.wrappedState !== "string" || input.wrappedState.length > MLS_DEV_GROUP_WRAPPED_MAX_BYTES || !input.wrappedState.startsWith("v1:"))
-      invalid6();
+      invalid8();
     const body = input.wrappedState.slice(3);
     if (body.length < 40 || body.length % 4 !== 0 || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(body))
-      invalid6();
+      invalid8();
     const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
     if (body.endsWith("==") && (alphabet.indexOf(body.at(-3)) & 15) !== 0 || !body.endsWith("==") && body.endsWith("=") && (alphabet.indexOf(body.at(-2)) & 3) !== 0)
-      invalid6();
+      invalid8();
     const kind = Object.getOwnPropertyDescriptor(input.payload ?? {}, "kind");
     if (!kind || !Object.hasOwn(kind, "value"))
-      invalid6();
+      invalid8();
     let payload;
     if (kind.value === "application") {
-      const fields = readMlsDataRecord(input.payload, ["kind", "envelope"]);
-      payload = Object.freeze({ kind: "application", envelope: parseMlsDevApplicationEnvelope(fields.envelope) });
+      const fields2 = readMlsDataRecord(input.payload, ["kind", "envelope", ...present(input.payload, ["payload"])]);
+      payload = Object.freeze({
+        kind: "application",
+        envelope: parseMlsDevApplicationEnvelope(fields2.envelope),
+        ...fields2.payload === void 0 ? {} : { payload: plaintextJson(fields2.payload) }
+      });
+    } else if (kind.value === "item") {
+      const fields2 = readMlsDataRecord(input.payload, ["kind", "messageId", "operationId", "senderDeviceId", "payload", "feedOrdinal"]);
+      const ids = parseMlsDevTextPayload({
+        version: 1,
+        kind: "text",
+        conversationId: "validation",
+        groupId: "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+        messageId: fields2.messageId,
+        operationId: fields2.operationId,
+        senderDeviceId: fields2.senderDeviceId,
+        text: "x"
+      });
+      payload = Object.freeze({
+        kind: "item",
+        messageId: ids.messageId,
+        operationId: ids.operationId,
+        senderDeviceId: ids.senderDeviceId,
+        payload: plaintextJson(fields2.payload),
+        feedOrdinal: requireMlsInteger(fields2.feedOrdinal, 1)
+      });
     } else if (kind.value === "text") {
-      const fields = readMlsDataRecord(input.payload, ["kind", "messageId", "operationId", "senderDeviceId", "text", "feedOrdinal"]);
-      const text3 = parseMlsDevTextPayload({
+      const extras = present(input.payload, ["replyTo", "mentions"]);
+      const fields2 = readMlsDataRecord(input.payload, ["kind", "messageId", "operationId", "senderDeviceId", "text", "feedOrdinal", ...extras]);
+      const text5 = parseMlsDevTextPayload({
         version: 1,
         kind: "text",
         conversationId: "validation",
         groupId: "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
-        messageId: fields.messageId,
-        operationId: fields.operationId,
-        senderDeviceId: fields.senderDeviceId,
-        text: fields.text
+        messageId: fields2.messageId,
+        operationId: fields2.operationId,
+        senderDeviceId: fields2.senderDeviceId,
+        text: fields2.text,
+        ...pick(fields2, extras)
       });
       payload = Object.freeze({
         kind: "text",
-        messageId: text3.messageId,
-        operationId: text3.operationId,
-        senderDeviceId: text3.senderDeviceId,
-        text: text3.text,
-        feedOrdinal: requireMlsInteger(fields.feedOrdinal, 1)
+        messageId: text5.messageId,
+        operationId: text5.operationId,
+        senderDeviceId: text5.senderDeviceId,
+        text: text5.text,
+        ...textExtras(text5),
+        feedOrdinal: requireMlsInteger(fields2.feedOrdinal, 1)
+      });
+    } else if (kind.value === "interaction_application") {
+      const fields2 = readMlsDataRecord(input.payload, ["kind", "envelope", "payload"]);
+      payload = Object.freeze({ kind: "interaction_application", envelope: parseMlsDevApplicationEnvelope(fields2.envelope), payload: plaintextJson(fields2.payload) });
+      if (!payload.envelope.interaction)
+        invalid8();
+    } else if (kind.value === "interaction") {
+      const fields2 = readMlsDataRecord(input.payload, ["kind", "messageId", "operationId", "senderDeviceId", "payload", "feedOrdinal"]);
+      const ids = parseMlsDevTextPayload({
+        version: 1,
+        kind: "text",
+        conversationId: "validation",
+        groupId: "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+        messageId: fields2.messageId,
+        operationId: fields2.operationId,
+        senderDeviceId: fields2.senderDeviceId,
+        text: "x"
+      });
+      payload = Object.freeze({
+        kind: "interaction",
+        messageId: ids.messageId,
+        operationId: ids.operationId,
+        senderDeviceId: ids.senderDeviceId,
+        payload: plaintextJson(fields2.payload),
+        feedOrdinal: requireMlsInteger(fields2.feedOrdinal, 1)
       });
+    } else if (kind.value === "invalid") {
+      const fields2 = readMlsDataRecord(input.payload, ["kind", "messageId", "operationId", "senderDeviceId", "feedOrdinal"]);
+      const ids = parseMlsDevTextPayload({
+        version: 1,
+        kind: "text",
+        conversationId: "validation",
+        groupId: "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+        messageId: fields2.messageId,
+        operationId: fields2.operationId,
+        senderDeviceId: fields2.senderDeviceId,
+        text: "x"
+      });
+      payload = Object.freeze({
+        kind: "invalid",
+        messageId: ids.messageId,
+        operationId: ids.operationId,
+        senderDeviceId: ids.senderDeviceId,
+        feedOrdinal: requireMlsInteger(fields2.feedOrdinal, 1)
+      });
+    } else if (kind.value === "secret") {
+      const fields2 = readMlsDataRecord(input.payload, ["kind", "requestId", "text"]);
+      const binding3 = parseMlsDevInteractionBinding({ role: "withdraw", requestId: fields2.requestId });
+      if (typeof fields2.text !== "string" || !fields2.text.trim() || [...fields2.text].length > MLS_DEV_INTERACTION_LIMITS.text || new TextDecoder("utf-8", { fatal: true }).decode(utf84.encode(fields2.text)) !== fields2.text)
+        invalid8();
+      payload = Object.freeze({ kind: "secret", requestId: binding3.requestId, text: fields2.text });
     } else if (kind.value === "control") {
-      const fields = readMlsDataRecord(input.payload, ["kind", "control"]);
-      payload = Object.freeze({ kind: "control", control: parseMlsDevGroupControl(fields.control) });
+      const fields2 = readMlsDataRecord(input.payload, ["kind", "control"]);
+      payload = Object.freeze({ kind: "control", control: parseMlsDevGroupControl(fields2.control) });
     } else if (kind.value === "discarded") {
-      const fields = readMlsDataRecord(input.payload, ["kind", "operationId", "head"]);
-      payload = Object.freeze({ kind: "discarded", operationId: id3(fields.operationId), head: fields.head === null ? null : parseMlsDevGroupHead(fields.head) });
+      const fields2 = readMlsDataRecord(input.payload, ["kind", "operationId", "head"]);
+      payload = Object.freeze({ kind: "discarded", operationId: id4(fields2.operationId), head: fields2.head === null ? null : parseMlsDevGroupHead(fields2.head) });
     } else {
-      const fields = readMlsDataRecord(input.payload, ["kind", "head", "roster", "removed", "consumedKeyPackageId"]);
+      const fields2 = readMlsDataRecord(input.payload, ["kind", "head", "roster", "removed", "consumedKeyPackageId"]);
       payload = Object.freeze({
-        kind: requireMlsLiteral(fields.kind, "applied"),
-        head: parseMlsDevGroupHead(fields.head),
-        roster: parseMlsDevGroupRoster(fields.roster),
-        removed: boolean2(fields.removed),
-        consumedKeyPackageId: fields.consumedKeyPackageId === null ? null : requireMlsUuid(fields.consumedKeyPackageId)
+        kind: requireMlsLiteral(fields2.kind, "applied"),
+        head: parseMlsDevGroupHead(fields2.head),
+        roster: parseMlsDevGroupRoster(fields2.roster),
+        removed: boolean3(fields2.removed),
+        consumedKeyPackageId: fields2.consumedKeyPackageId === null ? null : requireMlsUuid(fields2.consumedKeyPackageId)
       });
     }
     return bounded5({ wrappedState: input.wrappedState, payload }, MLS_DEV_GROUP_PREPARATION_MAX_BYTES);
@@ -1162,9 +1930,25 @@ __name(parseMlsDevGroupPreparation, "parseMlsDevGroupPreparation");
 
 // ../backend-contracts/src/mlsDevApplication.ts
 var MLS_DEV_TEXT_PROTOCOL = "canon.mls.dev-text.v1";
+var MLS_DEV_TEXT_PROTOCOL_V2 = "canon.mls.dev-text.v2";
+var MLS_DEV_TEXT_PROTOCOL_V3 = "canon.mls.dev-text.v3";
+var MLS_DEV_TEXT_PROTOCOLS = [MLS_DEV_TEXT_PROTOCOL, MLS_DEV_TEXT_PROTOCOL_V2, MLS_DEV_TEXT_PROTOCOL_V3];
+function isMlsDevTextProtocol(value) {
+  return MLS_DEV_TEXT_PROTOCOLS.some((protocol) => protocol === value);
+}
+__name(isMlsDevTextProtocol, "isMlsDevTextProtocol");
+function mlsDevProtocolCarriesCards(value) {
+  return value === MLS_DEV_TEXT_PROTOCOL_V2 || value === MLS_DEV_TEXT_PROTOCOL_V3;
+}
+__name(mlsDevProtocolCarriesCards, "mlsDevProtocolCarriesCards");
+var MLS_DEV_REPLY_QUOTE_MAX_CHARACTERS = 1024;
+var MLS_DEV_MENTIONS_MAX = 32;
+var MLS_DEV_INTERACTION_ID_PATTERN = /^[A-Za-z0-9_.:-]{1,160}$/;
+var MLS_DEV_INTERACTION_KINDS = ["approval", "question", "secret"];
 var MLS_DEV_APPLICATION_TLS_MAX_BYTES = 256 * 1024;
 var MLS_DEV_APPLICATION_MAX_BYTES = 384 * 1024;
 var MLS_DEV_TEXT_MAX_BYTES = 32 * 1024;
+var MLS_DEV_ITEM_TYPES = ["image", "video", "audio", "file"];
 var MlsDevApplicationValidationError = class extends Error {
   static {
     __name(this, "MlsDevApplicationValidationError");
@@ -1174,125 +1958,245 @@ var MlsDevApplicationValidationError = class extends Error {
     super("INVALID_MLS_DEV_APPLICATION");
     this.name = "MlsDevApplicationValidationError";
   }
-};
-var utf84 = new TextEncoder();
-function invalid7() {
+};
+var utf85 = new TextEncoder();
+function invalid9() {
   throw new MlsDevApplicationValidationError();
 }
-__name(invalid7, "invalid");
-function boundary6(read) {
+__name(invalid9, "invalid");
+function boundary8(read) {
   try {
     return read();
   } catch {
-    return invalid7();
+    return invalid9();
   }
 }
-__name(boundary6, "boundary");
+__name(boundary8, "boundary");
 function bounded6(value) {
-  if (utf84.encode(JSON.stringify(value)).length > MLS_DEV_APPLICATION_MAX_BYTES)
-    invalid7();
+  if (utf85.encode(JSON.stringify(value)).length > MLS_DEV_APPLICATION_MAX_BYTES)
+    invalid9();
   return Object.freeze(value);
 }
 __name(bounded6, "bounded");
-function id4(value) {
+function id5(value) {
   if (typeof value !== "string" || !/^[A-Za-z0-9_.:~-]{1,200}$/.test(value) || value === "." || value === "..")
-    invalid7();
+    invalid9();
   return value;
 }
-__name(id4, "id");
+__name(id5, "id");
+function isMlsDevMessageId(value) {
+  return typeof value === "string" && /^[A-Za-z0-9_.:~-]{1,200}$/.test(value) && value !== "." && value !== ".." && !value.startsWith("membership-");
+}
+__name(isMlsDevMessageId, "isMlsDevMessageId");
 function messageId(value) {
-  const result = id4(value);
-  if (result.startsWith("membership-"))
-    invalid7();
-  return result;
+  if (!isMlsDevMessageId(value))
+    invalid9();
+  return value;
 }
 __name(messageId, "messageId");
-function encoded4(value, bytes) {
+function interactionId2(value) {
+  if (typeof value !== "string" || !MLS_DEV_INTERACTION_ID_PATTERN.test(value) || value === "." || value === "..")
+    invalid9();
+  return value;
+}
+__name(interactionId2, "interactionId");
+function parseMlsDevInteractionBinding(value) {
+  return boundary8(() => {
+    const role = value && typeof value === "object" ? Object.getOwnPropertyDescriptor(value, "role") : void 0;
+    if (!role || !Object.hasOwn(role, "value"))
+      invalid9();
+    if (role.value === "request") {
+      const input2 = readMlsDataRecord(value, ["role", "requestId", "kind", "responderIds", "expiresAtMs"]);
+      if (typeof input2.kind !== "string" || !MLS_DEV_INTERACTION_KINDS.includes(input2.kind))
+        invalid9();
+      const responders = input2.responderIds;
+      if (!Array.isArray(responders) || Object.getPrototypeOf(responders) !== Array.prototype || responders.length !== 1 || Reflect.ownKeys(Object.getOwnPropertyDescriptors(responders)).length !== 2)
+        invalid9();
+      const only = Object.getOwnPropertyDescriptor(responders, 0);
+      if (!only || !only.enumerable || !Object.hasOwn(only, "value"))
+        invalid9();
+      const expiresAtMs = requireMlsInteger(input2.expiresAtMs, 1);
+      return Object.freeze({
+        role: "request",
+        requestId: interactionId2(input2.requestId),
+        kind: input2.kind,
+        responderIds: Object.freeze([id5(only.value)]),
+        expiresAtMs
+      });
+    }
+    if (role.value === "response") {
+      const input2 = readMlsDataRecord(value, ["role", "requestId", "agentId"]);
+      return Object.freeze({ role: "response", requestId: interactionId2(input2.requestId), agentId: id5(input2.agentId) });
+    }
+    const input = readMlsDataRecord(value, ["role", "requestId"]);
+    return Object.freeze({ role: requireMlsLiteral(input.role, "withdraw"), requestId: interactionId2(input.requestId) });
+  });
+}
+__name(parseMlsDevInteractionBinding, "parseMlsDevInteractionBinding");
+function encoded5(value, bytes) {
   decodeCanonicalMlsBase64Url(value, bytes);
   return value;
 }
-__name(encoded4, "encoded");
+__name(encoded5, "encoded");
 function parseMlsDevApplicationWire(value) {
-  return boundary6(() => {
+  return boundary8(() => {
     if (typeof value !== "string" || value.length < 2 || value.length > Math.ceil(MLS_DEV_APPLICATION_TLS_MAX_BYTES * 4 / 3))
-      invalid7();
+      invalid9();
     const bytes = Math.floor(value.length * 3 / 4);
     if (bytes > MLS_DEV_APPLICATION_TLS_MAX_BYTES || value.length !== Math.ceil(bytes * 4 / 3) || !/^[A-Za-z0-9_-]+$/.test(value))
-      invalid7();
+      invalid9();
     const last = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_".indexOf(value.at(-1));
     if (value.length % 4 === 2 && (last & 15) !== 0 || value.length % 4 === 3 && (last & 3) !== 0)
-      invalid7();
+      invalid9();
     return value;
   });
 }
 __name(parseMlsDevApplicationWire, "parseMlsDevApplicationWire");
 function parseMlsDevApplicationPreconditions(value) {
-  return boundary6(() => {
+  return boundary8(() => {
     const input = readMlsDataRecord(value, ["membershipRevision", "admissionId"]);
-    return Object.freeze({ membershipRevision: requireMlsInteger(input.membershipRevision), admissionId: id4(input.admissionId) });
+    return Object.freeze({ membershipRevision: requireMlsInteger(input.membershipRevision), admissionId: id5(input.admissionId) });
   });
 }
 __name(parseMlsDevApplicationPreconditions, "parseMlsDevApplicationPreconditions");
 var bindingFields = ["version", "environmentId", "conversationId", "groupId", "messageId", "senderCredential", "expectedHead", "preconditions"];
+var interactionBindingFields = [...bindingFields, "interaction"];
 function binding(input) {
-  parseMlsDevCredentialToken(input.senderCredential);
+  const environmentId = requireMlsEnvironmentId(input.environmentId);
+  if (parseMlsDevCredentialToken(input.senderCredential).unsigned.claims.device.environmentId !== environmentId) invalid9();
   return {
     version: requireMlsLiteral(input.version, 1),
-    environmentId: requireMlsLiteral(input.environmentId, "canon-dev-v1"),
-    conversationId: id4(input.conversationId),
-    groupId: encoded4(input.groupId, 32),
+    environmentId,
+    conversationId: id5(input.conversationId),
+    groupId: encoded5(input.groupId, 32),
     messageId: messageId(input.messageId),
     senderCredential: input.senderCredential,
     expectedHead: parseMlsDevGroupHead(input.expectedHead),
-    preconditions: parseMlsDevApplicationPreconditions(input.preconditions)
+    preconditions: parseMlsDevApplicationPreconditions(input.preconditions),
+    ...Object.hasOwn(input, "interaction") ? { interaction: parseMlsDevInteractionBinding(input.interaction) } : {}
   };
 }
 __name(binding, "binding");
+function fields(value, extra) {
+  return readMlsDataRecord(value, [...bindingFields, ...extra], [...interactionBindingFields, ...extra]);
+}
+__name(fields, "fields");
 function parseMlsDevApplicationEnvelope(value) {
-  return boundary6(() => {
-    const input = readMlsDataRecord(value, [...bindingFields, "ciphertext", "proof"]);
-    return bounded6({ ...binding(input), ciphertext: parseMlsDevApplicationWire(input.ciphertext), proof: encoded4(input.proof, 64) });
+  return boundary8(() => {
+    const input = fields(value, ["ciphertext", "proof"]);
+    return bounded6({ ...binding(input), ciphertext: parseMlsDevApplicationWire(input.ciphertext), proof: encoded5(input.proof, 64) });
   });
 }
 __name(parseMlsDevApplicationEnvelope, "parseMlsDevApplicationEnvelope");
 function parseMlsDevApplicationReceipt(value) {
-  return boundary6(() => {
+  return boundary8(() => {
     const input = readMlsDataRecord(value, ["version", "authorization", "operationId", "conversationId", "groupId", "messageId", "feedOrdinal", "head", "acceptedAtMs", "envelopeHash"]);
     return bounded6({
       version: requireMlsLiteral(input.version, 1),
       authorization: requireMlsLiteral(input.authorization, "encrypted_text_only"),
-      operationId: id4(input.operationId),
-      conversationId: id4(input.conversationId),
-      groupId: encoded4(input.groupId, 32),
+      operationId: id5(input.operationId),
+      conversationId: id5(input.conversationId),
+      groupId: encoded5(input.groupId, 32),
       messageId: messageId(input.messageId),
       feedOrdinal: requireMlsInteger(input.feedOrdinal, 1),
       head: parseMlsDevGroupHead(input.head),
       acceptedAtMs: requireMlsInteger(input.acceptedAtMs),
-      envelopeHash: encoded4(input.envelopeHash, 32)
+      envelopeHash: encoded5(input.envelopeHash, 32)
     });
   });
 }
 __name(parseMlsDevApplicationReceipt, "parseMlsDevApplicationReceipt");
+function text2(value) {
+  if (typeof value !== "string" || !value.trim() || utf85.encode(value).length > MLS_DEV_TEXT_MAX_BYTES || new TextDecoder("utf-8", { fatal: true }).decode(utf85.encode(value)) !== value)
+    invalid9();
+  return value;
+}
+__name(text2, "text");
+function textExtras2(value) {
+  const extras = {};
+  if (Object.hasOwn(value, "replyTo")) {
+    const reply = readMlsDataRecord(value.replyTo, ["messageId", "quote"]);
+    if ([...text2(reply.quote)].length > MLS_DEV_REPLY_QUOTE_MAX_CHARACTERS)
+      invalid9();
+    extras.replyTo = Object.freeze({ messageId: messageId(reply.messageId), quote: reply.quote });
+  }
+  if (Object.hasOwn(value, "mentions")) {
+    const mentions = value.mentions;
+    if (!Array.isArray(mentions) || mentions.length < 1 || mentions.length > MLS_DEV_MENTIONS_MAX || new Set(mentions).size !== mentions.length)
+      invalid9();
+    extras.mentions = Object.freeze(mentions.map(id5));
+  }
+  return extras;
+}
+__name(textExtras2, "textExtras");
+var optionalKeys = /* @__PURE__ */ __name((value, keys2) => value && typeof value === "object" ? keys2.filter((key) => Object.hasOwn(value, key)) : [], "optionalKeys");
 function parseMlsDevTextPayload(value) {
-  return boundary6(() => {
-    const input = readMlsDataRecord(value, ["version", "kind", "conversationId", "groupId", "messageId", "operationId", "senderDeviceId", "text"]);
-    if (typeof input.text !== "string" || !input.text.trim() || utf84.encode(input.text).length > MLS_DEV_TEXT_MAX_BYTES || new TextDecoder("utf-8", { fatal: true }).decode(utf84.encode(input.text)) !== input.text)
-      invalid7();
+  return boundary8(() => {
+    const input = readMlsDataRecord(value, ["version", "kind", "conversationId", "groupId", "messageId", "operationId", "senderDeviceId", "text", ...optionalKeys(value, ["replyTo", "mentions"])]);
     return bounded6({
       version: requireMlsLiteral(input.version, 1),
       kind: requireMlsLiteral(input.kind, "text"),
-      conversationId: id4(input.conversationId),
-      groupId: encoded4(input.groupId, 32),
+      conversationId: id5(input.conversationId),
+      groupId: encoded5(input.groupId, 32),
       messageId: messageId(input.messageId),
-      operationId: id4(input.operationId),
+      operationId: id5(input.operationId),
       senderDeviceId: requireMlsUuid(input.senderDeviceId),
-      text: input.text
+      text: text2(input.text),
+      ...textExtras2(input)
     });
   });
 }
 __name(parseMlsDevTextPayload, "parseMlsDevTextPayload");
-function framed(domain3, value, operationId) {
-  const operation = utf84.encode(id4(operationId)), json = utf84.encode(JSON.stringify(value)), prefix = utf84.encode(domain3);
+var itemFields = ["type", "uploadId", "url", "mimeType", "sizeBytes", "fileName", "width", "height", "durationMs", "thumbnailUrl", "caption", "replyTo", "mentions"];
+function httpsUrl(value) {
+  if (typeof value !== "string" || value.length > 2048) invalid9();
+  const url = boundary8(() => new URL(value));
+  if (url.protocol !== "https:" || url.username || url.password) invalid9();
+  return value;
+}
+__name(httpsUrl, "httpsUrl");
+var dimension = /* @__PURE__ */ __name((value) => requireMlsInteger(value, 0) <= 1e5 ? value : invalid9(), "dimension");
+function item(value) {
+  const input = readMlsDataRecord(value, ["type", "uploadId", "url", "mimeType", "sizeBytes", ...optionalKeys(value, itemFields.slice(5))]);
+  if (!MLS_DEV_ITEM_TYPES.some((type) => type === input.type) || typeof input.mimeType !== "string" || !/^[a-z0-9.+-]{1,64}\/[a-z0-9.+-]{1,128}$/i.test(input.mimeType))
+    invalid9();
+  if (input.fileName !== void 0 && (typeof input.fileName !== "string" || !input.fileName.trim() || [...input.fileName].length > 240))
+    invalid9();
+  return Object.freeze({
+    type: input.type,
+    uploadId: requireMlsUuid(input.uploadId),
+    url: httpsUrl(input.url),
+    mimeType: input.mimeType,
+    sizeBytes: requireMlsInteger(input.sizeBytes, 1),
+    ...input.fileName === void 0 ? {} : { fileName: input.fileName },
+    ...Object.fromEntries(["width", "height", "durationMs"].filter((key) => input[key] !== void 0).map((key) => [key, key === "durationMs" ? requireMlsInteger(input[key], 0) : dimension(input[key])])),
+    ...input.thumbnailUrl === void 0 ? {} : { thumbnailUrl: httpsUrl(input.thumbnailUrl) },
+    ...input.caption === void 0 ? {} : { caption: text2(input.caption) },
+    ...textExtras2(input)
+  });
+}
+__name(item, "item");
+function parseMlsDevItemPayload(value) {
+  return boundary8(() => {
+    const input = readMlsDataRecord(value, ["version", "kind", "conversationId", "groupId", "messageId", "operationId", "senderDeviceId", "item"]);
+    const payload = {
+      version: requireMlsLiteral(input.version, 1),
+      kind: requireMlsLiteral(input.kind, "item"),
+      conversationId: id5(input.conversationId),
+      groupId: encoded5(input.groupId, 32),
+      messageId: messageId(input.messageId),
+      operationId: id5(input.operationId),
+      senderDeviceId: requireMlsUuid(input.senderDeviceId),
+      item: item(input.item)
+    };
+    if (utf85.encode(JSON.stringify(payload)).length > MLS_DEV_TEXT_MAX_BYTES)
+      invalid9();
+    return bounded6(payload);
+  });
+}
+__name(parseMlsDevItemPayload, "parseMlsDevItemPayload");
+function framed(domain4, value, operationId) {
+  const operation = utf85.encode(id5(operationId)), json = utf85.encode(JSON.stringify(value)), prefix = utf85.encode(domain4);
   const result = new Uint8Array(prefix.length + 8 + operation.length + json.length), view = new DataView(result.buffer);
   let offset = 0;
   result.set(prefix, offset);
@@ -1308,7 +2212,7 @@ function framed(domain3, value, operationId) {
 }
 __name(framed, "framed");
 function encodeMlsDevApplicationEnvelopeHash(value, operationId) {
-  return boundary6(() => framed("canon.mls.dev-application-envelope.v1\0", parseMlsDevApplicationEnvelope(value), operationId));
+  return boundary8(() => framed("canon.mls.dev-application-envelope.v1\0", parseMlsDevApplicationEnvelope(value), operationId));
 }
 __name(encodeMlsDevApplicationEnvelopeHash, "encodeMlsDevApplicationEnvelopeHash");
 
@@ -1329,12 +2233,6 @@ var RUNTIME_CARD_FIELD_TYPES = [
   "searchSelect",
   "lineItems"
 ];
-var RUNTIME_CARD_LIMITS = {
-  detailsRows: 32,
-  lineItemRows: 50,
-  lineItemColumns: 8,
-  searchSelectChoices: 100
-};
 var RUNTIME_CARD_LINE_ITEM_COLUMN_TYPES = [
   "text",
   "number",
@@ -1422,9 +2320,7 @@ var VERB_LIMITS = {
   externalSourceLabelChars: 80,
   /**
    * Contact-request note. Values longer than this are truncated by senders
-   * (slice(0,497)+'...') — the truncation is currently triplicated in
-   * functions/src/api/sendContextualMessage.ts, packages/core/src/reach-out.ts
-   * and the hermes plugin; this constant is the canonical figure.
+   * (slice(0,497)+'...'); this constant is the canonical figure.
    */
   contactRequestNoteChars: 500,
   /** Group membership cap incl. creator (functions/src/utils/conversations.ts MAX_GROUP_MEMBERS). */
@@ -1526,7 +2422,7 @@ var VERB_NATIVE_METADATA_KEYS = [
   "handles"
 ];
 var VERB_NATIVE_STRING_KEYS = VERB_NATIVE_METADATA_KEYS.filter(
-  (key2) => key2 !== "handles"
+  (key) => key !== "handles"
 );
 var RUNTIME_CORRELATION_VALUE_PATTERN = new RegExp(
   VERB_ID_PATTERNS.runtimeCorrelationValue
@@ -1728,7 +2624,7 @@ var sessionRuleDef = {
 };
 var runtimeCardDef = {
   type: "object",
-  description: `ENVELOPE-ONLY validation of a canon.card.v1 document: block structures are NOT checked here. Tool bindings MUST compose the full document schema via getVerbInputSchema(verb, { cardSchema: RUNTIME_CARD_JSON_SCHEMA_V1 }) so models cannot produce envelope-valid cards the platform rejects. Full document contract: @canonmsg/rich-cards RUNTIME_CARD_JSON_SCHEMA_V1 ($id https://canonmsg.com/schemas/canon.card.v1.json) \u2014 authoring caps title 120 / fallbackText 500 / blocks 24. Server envelope acceptance (interactionCard.ts): <= ${VERB_LIMITS.cardEnvelopeBytes} bytes serialized, title <= ${VERB_LIMITS.cardServerTitleChars}, fallbackText <= ${VERB_LIMITS.cardServerFallbackTextChars}, blocks <= ${VERB_LIMITS.cardServerBlocks}; no secret-bearing top-level keys.`,
+  description: `ENVELOPE-ONLY validation of a canon.card.v1 document: block structures are NOT checked here. Full document contract: @canonmsg/rich-cards RUNTIME_CARD_JSON_SCHEMA_V1 ($id https://canonmsg.com/schemas/canon.card.v1.json) \u2014 authoring caps title 120 / fallbackText 500 / blocks 24. Server envelope acceptance (interactionCard.ts): <= ${VERB_LIMITS.cardEnvelopeBytes} bytes serialized, title <= ${VERB_LIMITS.cardServerTitleChars}, fallbackText <= ${VERB_LIMITS.cardServerFallbackTextChars}, blocks <= ${VERB_LIMITS.cardServerBlocks}; no secret-bearing top-level keys.`,
   required: ["schema", "title", "fallbackText", "blocks"],
   additionalProperties: true,
   properties: {
@@ -1845,7 +2741,7 @@ var send_to_input = {
   ]
 };
 var send_to_result = {
-  description: "Canonical outcome vocabulary. Legacy binding drift documented in docs/design/verb-bindings.md (hermes 'opened' -> messaged without messageId; hermes 'denied' -> blocked).",
+  description: "Canonical outcome vocabulary.",
   oneOf: [
     {
       type: "object",
@@ -1861,6 +2757,20 @@ var send_to_result = {
         sessionSelection: { type: "string" }
       }
     },
+    {
+      type: "object",
+      required: ["status", "conversationId", "messageId", "openingText"],
+      additionalProperties: true,
+      description: "The room is encrypted, so Canon stored no opening text: the sender sends it encrypted under messageId.",
+      properties: {
+        status: { const: "opened" },
+        conversationId: { type: "string" },
+        messageId: { type: "string" },
+        openingText: { const: "deferred" },
+        created: { type: "boolean" },
+        reused: { type: "boolean" }
+      }
+    },
     {
       type: "object",
       required: ["status", "requestId"],
@@ -1871,6 +2781,12 @@ var send_to_result = {
         deferredIntentId: {
           type: ["string", "null"],
           description: "Present when the send is deferred until the contact request resolves."
+        },
+        conversationId: { type: "string" },
+        messageId: { type: "string" },
+        openingText: {
+          const: "deferred",
+          description: "The room is encrypted, so Canon stored no opening text: the sender sends it encrypted under messageId."
         }
       }
     },
@@ -1910,7 +2826,7 @@ var request_input_input = {
     responseUserId: {
       type: "string",
       pattern: VERB_ID_PATTERNS.runtimeId,
-      description: "Must be a human conversation member. Trust-critical bindings (hermes) derive this from turn provenance and ignore model-supplied values."
+      description: "Must be a human conversation member. Trust-critical bindings derive this from turn provenance and ignore model-supplied values."
     },
     native: REF("native"),
     turnId: { type: "string", maxLength: VERB_LIMITS.turnIdChars },
@@ -2755,9 +3671,9 @@ function splitTurnMetadata(metadata) {
   if (!metadata || typeof metadata !== "object") return { turn: void 0, rest: void 0 };
   const turn = {};
   const rest = {};
-  for (const [key2, value] of Object.entries(metadata)) {
-    if (TURN_KEYS.includes(key2)) turn[key2] = value;
-    else rest[key2] = value;
+  for (const [key, value] of Object.entries(metadata)) {
+    if (TURN_KEYS.includes(key)) turn[key] = value;
+    else rest[key] = value;
   }
   return {
     turn: Object.keys(turn).length ? turn : void 0,
@@ -2765,10 +3681,10 @@ function splitTurnMetadata(metadata) {
   };
 }
 __name(splitTurnMetadata, "splitTurnMetadata");
-function compact(record4) {
+function compact(record5) {
   const out = {};
-  for (const [key2, value] of Object.entries(record4)) {
-    if (value !== void 0) out[key2] = value;
+  for (const [key, value] of Object.entries(record5)) {
+    if (value !== void 0) out[key] = value;
   }
   return out;
 }
@@ -2948,12 +3864,12 @@ function parseDirectConversationSelection(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     throw new Error("selection must be an object");
   }
-  const record4 = value;
-  if (record4.mode === "latest_or_new" || record4.mode === "new") {
-    return { mode: record4.mode };
+  const record5 = value;
+  if (record5.mode === "latest_or_new" || record5.mode === "new") {
+    return { mode: record5.mode };
   }
-  if (record4.mode === "specific") {
-    const conversationId = typeof record4.conversationId === "string" ? record4.conversationId.trim() : "";
+  if (record5.mode === "specific") {
+    const conversationId = typeof record5.conversationId === "string" ? record5.conversationId.trim() : "";
     if (!conversationId) throw new Error("selection.conversationId is required");
     return { mode: "specific", conversationId };
   }
@@ -2978,10 +3894,10 @@ function record(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
 __name(record, "record");
-function text(value, max) {
+function text3(value, max) {
   return typeof value === "string" && value.length > 0 && value.length <= max ? value : void 0;
 }
-__name(text, "text");
+__name(text3, "text");
 function member(value, choices) {
   return choices.includes(value) ? value : void 0;
 }
@@ -3016,19 +3932,19 @@ function normalizeDispatch(value) {
       return primitive ? { kind: "primitive", primitive } : void 0;
     }
     case "control": {
-      const controlId = text(dispatch.controlId, 128);
-      return controlId ? defined({ kind: "control", controlId, value: text(dispatch.value, 1024) }) : void 0;
+      const controlId = text3(dispatch.controlId, 128);
+      return controlId ? defined({ kind: "control", controlId, value: text3(dispatch.value, 1024) }) : void 0;
     }
     case "text_passthrough": {
-      const template = text(dispatch.template, 2048);
+      const template = text3(dispatch.template, 2048);
       return template ? { kind: "text_passthrough", template } : void 0;
     }
     case "compose": {
-      const content = text(dispatch.text, 2048);
+      const content = text3(dispatch.text, 2048);
       return content ? { kind: "compose", text: content } : void 0;
     }
     case "open_details":
-      return defined({ kind: "open_details", target: text(dispatch.target, 128) });
+      return defined({ kind: "open_details", target: text3(dispatch.target, 128) });
     default:
       return void 0;
   }
@@ -3036,21 +3952,21 @@ function normalizeDispatch(value) {
 __name(normalizeDispatch, "normalizeDispatch");
 function normalizeArgument(value) {
   const arg = record(value);
-  const id6 = text(arg.id, 128);
-  const label = text(arg.label, 160);
+  const id7 = text3(arg.id, 128);
+  const label = text3(arg.label, 160);
   const kind = member(arg.kind, ["string", "enum", "boolean"]);
-  if (!id6 || !label || !kind) return void 0;
-  if (["required", "captureRemaining"].some((key2) => arg[key2] !== void 0 && typeof arg[key2] !== "boolean")) return void 0;
+  if (!id7 || !label || !kind) return void 0;
+  if (["required", "captureRemaining"].some((key) => arg[key] !== void 0 && typeof arg[key] !== "boolean")) return void 0;
   if (arg.choices !== void 0 && !Array.isArray(arg.choices)) return void 0;
   const choices = Array.isArray(arg.choices) ? arg.choices.slice(0, 128).flatMap((value2) => {
     const choice = record(value2);
-    const entry = text(choice.value, 1024);
-    const label2 = text(choice.label, 160);
-    return entry && label2 ? [defined({ value: entry, label: label2, description: text(choice.description, 1024) })] : [];
+    const entry = text3(choice.value, 1024);
+    const label2 = text3(choice.label, 160);
+    return entry && label2 ? [defined({ value: entry, label: label2, description: text3(choice.description, 1024) })] : [];
   }) : void 0;
   if (kind === "enum" && !choices?.length) return void 0;
   return defined({
-    id: id6,
+    id: id7,
     label,
     kind,
     choices,
@@ -3064,15 +3980,15 @@ function normalizePublicRuntimeCommands(value) {
   const seenIds = /* @__PURE__ */ new Set();
   const seenAliases = /* @__PURE__ */ new Set();
   const result = [];
-  for (const item of value.slice(0, MAX_PUBLIC_RUNTIME_COMMANDS)) {
-    const command = record(item);
-    const id6 = text(command.id, 128);
-    const label = text(command.label, 160);
+  for (const item2 of value.slice(0, MAX_PUBLIC_RUNTIME_COMMANDS)) {
+    const command = record(item2);
+    const id7 = text3(command.id, 128);
+    const label = text3(command.label, 160);
     const dispatch = normalizeDispatch(command.dispatch);
-    if (!id6 || !label || !dispatch || seenIds.has(id6) || command.visibility === "hidden" || command.sensitive === true) continue;
-    if (["ownerOnly", "sensitive"].some((key2) => command[key2] !== void 0 && typeof command[key2] !== "boolean")) continue;
-    if (["aliases", "args", "placements", "availability"].some((key2) => command[key2] !== void 0 && !Array.isArray(command[key2]))) continue;
-    const rawAliases = Array.isArray(command.aliases) && command.aliases.length ? command.aliases : [id6];
+    if (!id7 || !label || !dispatch || seenIds.has(id7) || command.visibility === "hidden" || command.sensitive === true) continue;
+    if (["ownerOnly", "sensitive"].some((key) => command[key] !== void 0 && typeof command[key] !== "boolean")) continue;
+    if (["aliases", "args", "placements", "availability"].some((key) => command[key] !== void 0 && !Array.isArray(command[key]))) continue;
+    const rawAliases = Array.isArray(command.aliases) && command.aliases.length ? command.aliases : [id7];
     const aliases = [...new Set(rawAliases.slice(0, 8).flatMap((value2) => {
       const alias = typeof value2 === "string" && value2.length <= 128 ? normalizeRuntimeCommandAlias(value2) : null;
       return alias && /^[A-Za-z0-9:_-]+$/.test(alias) && !seenAliases.has(alias.toLowerCase()) ? [alias] : [];
@@ -3080,20 +3996,20 @@ function normalizePublicRuntimeCommands(value) {
     if (!aliases.length) continue;
     const args = Array.isArray(command.args) ? command.args.slice(0, 12).map(normalizeArgument) : void 0;
     if (args?.some((arg) => !arg) || Array.isArray(command.args) && command.args.length > 12) continue;
-    seenIds.add(id6);
+    seenIds.add(id7);
     aliases.forEach((alias) => seenAliases.add(alias.toLowerCase()));
     result.push(defined({
-      id: id6,
+      id: id7,
       label,
       aliases,
       dispatch,
       args,
-      description: text(command.description, 1024),
+      description: text3(command.description, 1024),
       category: member(command.category, ["plan", "turn", "session", "runtime", "details", "skill", "custom"]),
       placements: members(command.placements, ["composer_slash", "command_palette", "session_strip"]),
       availability: members(command.availability, ["idle", "busy", "busy_with_queue", "waiting_input", "always"]),
       ownerOnly: typeof command.ownerOnly === "boolean" ? command.ownerOnly : void 0,
-      disabledReason: text(command.disabledReason, 1024),
+      disabledReason: text3(command.disabledReason, 1024),
       trailingTextBehavior: member(command.trailingTextBehavior, ["ignore", "send_as_prompt"]),
       primitive: member(command.primitive, PRIMITIVES),
       tier: member(command.tier, ["primary", "detail", "diagnostic"])
@@ -3127,14 +4043,14 @@ function normalizePublicRuntimeFacts(value) {
   const seen = /* @__PURE__ */ new Set();
   return value.slice(0, 16).flatMap((entry) => {
     const fact = record(entry);
-    const id6 = text(fact.id, 64);
-    const group = id6 && Object.hasOwn(PUBLIC_RUNTIME_FACT_GROUPS, id6) ? PUBLIC_RUNTIME_FACT_GROUPS[id6] : void 0;
-    const label = text(fact.label, 80);
-    const content = text(fact.value, 512);
-    if (!id6 || !group || !label || !content || seen.has(id6) || fact.sensitive === true || fact.visibility === "hidden") return [];
-    seen.add(id6);
+    const id7 = text3(fact.id, 64);
+    const group = id7 && Object.hasOwn(PUBLIC_RUNTIME_FACT_GROUPS, id7) ? PUBLIC_RUNTIME_FACT_GROUPS[id7] : void 0;
+    const label = text3(fact.label, 80);
+    const content = text3(fact.value, 512);
+    if (!id7 || !group || !label || !content || seen.has(id7) || fact.sensitive === true || fact.visibility === "hidden") return [];
+    seen.add(id7);
     return [defined({
-      id: id6,
+      id: id7,
       group,
       label,
       value: content,
@@ -3147,13 +4063,8 @@ function normalizePublicRuntimeFacts(value) {
 }
 __name(normalizePublicRuntimeFacts, "normalizePublicRuntimeFacts");
 
-// ../backend-contracts/src/workSessions.ts
-var WORK_SESSION_REQUEST_TTL_MS = 5 * 6e4;
-var SETTINGS_KEYS = ["projectId", "modelId", "reasoningEffort", "permissionMode", "executionMode"];
-var DETAIL_FIELDS = [...SETTINGS_KEYS, "projectLabel", "workingDirectory", "branch", "worktreePath", "sandbox", "approvalPolicy", "nativeThreadBehavior"];
-
 // ../backend-contracts/src/endpointContentPolicy.ts
-var MLS_DEV_UNSUPPORTED_CONTENT_ACTIONS = ["delete_message", "forward_message"];
+var MLS_DEV_UNSUPPORTED_CONTENT_ACTIONS = ["forward_message"];
 var ENDPOINT_CONTENT_ACTIONS = [
   "mls_application",
   "mls_group_control",
@@ -3161,8 +4072,6 @@ var ENDPOINT_CONTENT_ACTIONS = [
   "append_artifact_command",
   "retain_artifact_asset",
   "sync_phone_contacts",
-  "request_work_session",
-  "resolve_work_session_request",
   "update_agent_behavior_policy",
   "update_conversation_agent_behavior_policy",
   "send_message",
@@ -3215,6 +4124,8 @@ var ENDPOINT_CONTENT_ACTIONS = [
 var ENDPOINT_CONTENT_FUNCTION_QUERIES = [
   "mls_group_feed",
   "mls_group_controls",
+  "mls_group_admissions",
+  "mls_interactions",
   "list_artifacts",
   "get_artifact_log",
   "get_artifact_asset",
@@ -3222,9 +4133,6 @@ var ENDPOINT_CONTENT_FUNCTION_QUERIES = [
   "get_unread_summary",
   "peek_runtime_signal",
   "list_runtime_primitives",
-  "get_work_session_catalog",
-  "get_work_session_details",
-  "get_work_session_request",
   "get_agent_behavior_policy",
   "get_conversation_agent_behavior_policy",
   "get_ephemeral",
@@ -3246,7 +4154,8 @@ var ENDPOINT_CONTENT_FUNCTION_QUERIES = [
   "get_media_message",
   "get_voice_session",
   "get_image_generation",
-  "get_image_generation_status"
+  "get_image_generation_status",
+  "same_owner_agents"
 ];
 var ENDPOINT_CONTENT_QUERIES = [...ENDPOINT_CONTENT_FUNCTION_QUERIES, "admit_messages"];
 var ENDPOINT_CONTENT_EPHEMERALS = [
@@ -3360,7 +4269,8 @@ var actionRouting = {
   send_message: ["conversationId", "messageId", "replyTo", "mentions.*"],
   delete_message: ["conversationId", "messageId"],
   forward_message: ["sourceConversationId", "targetConversationId", "messageId"],
-  react: ["conversationId", "messageId"],
+  // A reaction is an action on a message's public stub, so its emoji is server-visible in encrypted rooms too (ruling 3).
+  react: ["conversationId", "messageId", "emoji"],
   send_contextual_message: ["conversationId"],
   create_interaction: ["conversationId", "requestId", "inputId", "approvalId", "cardId", "planId", "responseUserId"],
   consume_interaction: ["conversationId", "inputId", "approvalId", "cardId", "planId"],
@@ -3381,13 +4291,19 @@ var actionRouting = {
   set_block: ["targetUserId"],
   save_contact: ["contactUserId"],
   remove_contact: ["contactId", "contactUserId"],
-  session_control: ["conversationId", "agentId"],
+  // `signal.type` is the closed Stop family (interrupt, stop_and_drop, new_session) the server must read to deliver it;
+  // a runtime `primitive` (commands, arguments) stays private, so it remains refused in encrypted rooms.
+  session_control: ["conversationId", "agentId", "signal.type"],
   approve_contact_request: ["requestId"],
   reject_contact_request: ["requestId"],
   cancel_direct_request: ["requestId"],
   update_message_disposition: ["conversationId", "messageId"],
-  create_upload: ["conversationId"],
+  // An encrypted room's item uploads its bytes as in a plaintext room (they are not end-to-end encrypted, payload v3
+  // §4): the type, size and display hints are public; its file name and caption ride only inside the item.
+  create_upload: ["conversationId", "mimeType", "sizeBytes", "width", "height", "durationMs"],
   finalize_upload: ["uploadId"],
+  // An encrypted item's application names its uploads beside the ciphertext, for Canon to retain on acceptance.
+  mls_application: ["mediaUploadIds.*"],
   delete_upload: ["uploadId"],
   retry_video_processing: ["uploadId"],
   stage_media_message: ["conversationId", "messageId", "files.*.fileId", "contentVersion", ...preparedRoutingPaths.map((path) => `preparedContent.${path}`)],
@@ -3395,19 +4311,18 @@ var actionRouting = {
   renew_media_message_upload: ["conversationId", "messageId", "fileId", "generation"],
   finalize_memo_stream: ["conversationId", "streamId"],
   abort_memo_stream: ["streamId"],
-  create_voice_session: ["conversationId"],
+  create_voice_session: ["conversationId", "media"],
   join_voice_session: ["conversationId", "sessionId"],
   decline_voice_session: ["conversationId", "sessionId"],
   end_voice_session: ["conversationId", "sessionId"],
   consume_runtime_signal: ["conversationId", "expectedSignalId"],
   consume_runtime_primitive: ["conversationId", "requestId", "expectedRevision"],
   generate_image: ["conversationId", "requestId"],
-  request_work_session: ["conversationId", "agentId", "requestId"],
-  resolve_work_session_request: ["requestId"],
   update_agent_behavior_policy: ["agentId"],
   update_conversation_agent_behavior_policy: ["conversationId", "agentId"]
 };
 var queryRouting = {
+  mls_interactions: ["version", "conversationId"],
   list_artifacts: ["conversationId", "cursor", "limit"],
   get_artifact_log: ["conversationId", "artifactId", "afterSequence", "cursor", "limit"],
   get_artifact_asset: ["conversationId", "artifactId", "assetId"],
@@ -3433,12 +4348,19 @@ var queryRouting = {
   get_media_message: ["conversationId", "messageId", "installationId"],
   get_voice_session: ["conversationId", "sessionId"],
   get_image_generation: ["requestId"],
-  get_work_session_catalog: ["agentId"],
-  get_work_session_details: ["agentId", "conversationId"],
-  get_work_session_request: ["requestId"],
+  same_owner_agents: ["agentIds.*"],
   get_agent_behavior_policy: ["agentId"],
   get_conversation_agent_behavior_policy: ["conversationId", "agentId"]
 };
+var ENDPOINT_TURN_PRESENCE_STATES = ["thinking", "waiting_input", "interrupted", "idle"];
+var timestamp = /* @__PURE__ */ __name((value) => value === null || Number.isSafeInteger(value) && value >= 0, "timestamp");
+var turnPresence = {
+  state: /* @__PURE__ */ __name((value) => ENDPOINT_TURN_PRESENCE_STATES.includes(value), "state"),
+  // `turn-` and 32 random hex digits per encrypted turn: never the runner's own turn id, which seeds its cards' request ids.
+  turnId: /* @__PURE__ */ __name((value) => value === null || typeof value === "string" && /^turn-[0-9a-f]{32}$/.test(value), "turnId"),
+  openedAt: timestamp,
+  turnUpdatedAt: timestamp
+};
 var transientRouting = {
   create_memo_stream: ["conversationId", "streamId"],
   append_memo_chunk: ["streamId"],
@@ -3478,7 +4400,7 @@ function endpointOperationRequestRetention(action, body, envelope) {
   if (action !== "respond_interaction") return "journal";
   if (envelope && Object.keys(envelope).length > 0) return "memory";
   const routing = ["kind", "conversationId", "agentId", "requestId"];
-  const hasOnly = /* @__PURE__ */ __name((fields) => Object.keys(body).every((field) => fields.includes(field)), "hasOnly");
+  const hasOnly = /* @__PURE__ */ __name((fields2) => Object.keys(body).every((field) => fields2.includes(field)), "hasOnly");
   if (routing.some((field) => body[field] !== void 0 && typeof body[field] !== "string")) return "memory";
   if ((body.kind === "input" || body.kind === "card") && hasOnly([...routing, "status", "actionId"])) {
     if (!["submitted", "cancelled"].includes(String(body.status)) || body.actionId !== void 0 && typeof body.actionId !== "string") return "memory";
@@ -3501,8 +4423,8 @@ function endpointOperationRequestRetention(action, body, envelope) {
 __name(endpointOperationRequestRetention, "endpointOperationRequestRetention");
 function endpointContentBoundary(lane, name, payload) {
   if (!namesForLane[lane]?.includes(name)) throw new EndpointContentPolicyError(lane, name);
-  const record4 = payload && typeof payload === "object" ? payload : void 0;
-  if (lane === "query.request" && name === "get_ephemeral" && record4 && !ENDPOINT_CONTENT_EPHEMERAL_FAMILIES.includes(record4.family)) {
+  const record5 = payload && typeof payload === "object" ? payload : void 0;
+  if (lane === "query.request" && name === "get_ephemeral" && record5 && !ENDPOINT_CONTENT_EPHEMERAL_FAMILIES.includes(record5.family)) {
     throw new EndpointContentPolicyError(lane, `${name}/unknown-family`);
   }
   const requestRoutingPaths = (actionRouting[name] ?? []).flatMap((field) => [`body.value.${field}`, `envelope.${field}`]);
@@ -3510,7 +4432,7 @@ function endpointContentBoundary(lane, name, payload) {
     if (path.some((part) => secretSegments.has(part))) return "restricted-secret";
     if (lane === "operation.request" && ["respond_interaction", "sync_phone_contacts"].includes(name) && matches(path, "preparedContent.payload")) return "restricted-secret";
     if (lane === "operation.request" && ["respond_interaction", "sync_phone_contacts"].includes(name) && path[0] === "body" && path[1] === "value" && !publicMatch(path, requestRoutingPaths)) return "restricted-secret";
-    if (lane === "operation.receipt" && path[0] === "result" && (["consume_interaction", "respond_interaction"].includes(name) || record4?.resultReference?.kind === "interaction")) return "restricted-secret";
+    if (lane === "operation.receipt" && path[0] === "result" && (["consume_interaction", "respond_interaction"].includes(name) || record5?.resultReference?.kind === "interaction")) return "restricted-secret";
     let selected = payload;
     for (const part of path) selected = selected && typeof selected === "object" && Object.hasOwn(selected, part) ? selected[part] : void 0;
     if (selected !== null && typeof selected === "object") return "private-content";
@@ -3519,8 +4441,8 @@ function endpointContentBoundary(lane, name, payload) {
       if (name === "respond_interaction" && path[0] === "body" && path[1] === "value") return "restricted-secret";
       if (name === "sync_phone_contacts" && path[0] === "body" && path[1] === "value") return "restricted-secret";
       if (name === "verb_execute") {
-        const wire3 = record4?.body?.value;
-        const spec = VERB_WIRE_ENVELOPE_FIELDS[wire3?.verb];
+        const wire4 = record5?.body?.value;
+        const spec = VERB_WIRE_ENVELOPE_FIELDS[wire4?.verb];
         if (path[0] === "body" && path[1] === "value") {
           if (path.length === 3 && ["wire", "verb"].includes(path[2])) return "public-metadata";
           if (path[2] === "envelope" && spec) {
@@ -3532,7 +4454,7 @@ function endpointContentBoundary(lane, name, payload) {
       }
     } else if (lane === "operation.receipt") {
       if (publicMatch(path, [...protocolPaths, "status", "createdAt", "updatedAt", "error.code", "error.status", "error.retryable", "error.retryAfterMs", "resultError.code", "resultError.status", "resultReference.kind", "resultReference.conversationId", "resultReference.artifactId", "resultReference.assetId", "resultReference.uploadId", "resultReference.sessionId", "resultReference.requestId"])) return "public-metadata";
-      if (path[0] === "result" && (name === "consume_interaction" || name === "respond_interaction" || record4?.resultReference?.kind === "interaction")) return "restricted-secret";
+      if (path[0] === "result" && (name === "consume_interaction" || name === "respond_interaction" || record5?.resultReference?.kind === "interaction")) return "restricted-secret";
     } else if (lane === "query.request") {
       if (publicMatch(path, queryRouting[name] ?? [])) return "public-metadata";
     } else if (lane === "query.result" || lane === "ephemeral.result") {
@@ -3540,6 +4462,7 @@ function endpointContentBoundary(lane, name, payload) {
       if (name === "get_ephemeral" && path[0] === "value") return "private-content";
     } else if (lane === "ephemeral.request") {
       if (publicMatch(path, transientRouting[name] ?? [])) return "public-metadata";
+      if (name === "publish_turn" && path.length === 1 && Object.hasOwn(turnPresence, path[0]) && turnPresence[path[0]](selected)) return "public-metadata";
     } else if (lane === "event") {
       if (publicMatch(path, eventRouting(name))) return "public-metadata";
     }
@@ -3563,12 +4486,12 @@ var PreparedContentError = class extends Error {
     __name(this, "PreparedContentError");
   }
 };
-function invalid8() {
+function invalid10() {
   throw new PreparedContentError("INVALID_PREPARED_CONTENT");
 }
-__name(invalid8, "invalid");
+__name(invalid10, "invalid");
 var record2 = /* @__PURE__ */ __name((value) => !!value && typeof value === "object" && !Array.isArray(value), "record");
-var keys = /* @__PURE__ */ __name((value, allowed) => Object.keys(value).every((key2) => allowed.includes(key2)), "keys");
+var keys = /* @__PURE__ */ __name((value, allowed) => Object.keys(value).every((key) => allowed.includes(key)), "keys");
 var revision = /* @__PURE__ */ __name((value) => Number.isSafeInteger(value) && value >= 0, "revision");
 var blobIdentity = /* @__PURE__ */ __name((value) => typeof value === "string" && value.length > 0 && value.length <= 1024 && !/[\u0000-\u001f]/.test(value), "blobIdentity");
 var identity = /* @__PURE__ */ __name((value) => typeof value === "string" && ENDPOINT_ID_PATTERN.test(value), "identity");
@@ -3579,33 +4502,33 @@ function canonicalEndpointJson(value) {
   function encode(input) {
     if (input === null || typeof input !== "object") return JSON.stringify(input);
     if (Array.isArray(input)) return `[${input.map(encode).join(",")}]`;
-    const object2 = input;
-    return `{${Object.keys(object2).sort().map((key2) => `${JSON.stringify(key2)}:${encode(object2[key2])}`).join(",")}}`;
+    const object = input;
+    return `{${Object.keys(object).sort().map((key) => `${JSON.stringify(key)}:${encode(object[key])}`).join(",")}}`;
   }
   __name(encode, "encode");
   return encode(normalized);
 }
 __name(canonicalEndpointJson, "canonicalEndpointJson");
 function validateMetadata(value) {
-  if (!record2(value)) invalid8();
+  if (!record2(value)) invalid10();
   if (value.version !== PREPARED_CONTENT_VERSION) throw new PreparedContentError("UNSUPPORTED_PREPARED_CONTENT_VERSION");
   if (value.codec !== PREPARED_JSON_CODEC) throw new PreparedContentError("UNSUPPORTED_PREPARED_CONTENT_CODEC");
-  if (!keys(value, ["version", "context", "codec", "payload", "blobs", "expected"])) invalid8();
+  if (!keys(value, ["version", "context", "codec", "payload", "blobs", "expected"])) invalid10();
   const context = value.context;
-  if (!record2(context) || !keys(context, ["action", "conversationId", "messageId"]) || typeof context.action !== "string" || !ENDPOINT_ACTION_PATTERN.test(context.action) || context.conversationId !== void 0 && !identity(context.conversationId) || context.messageId !== void 0 && !identity(context.messageId)) invalid8();
+  if (!record2(context) || !keys(context, ["action", "conversationId", "messageId"]) || typeof context.action !== "string" || !ENDPOINT_ACTION_PATTERN.test(context.action) || context.conversationId !== void 0 && !identity(context.conversationId) || context.messageId !== void 0 && !identity(context.messageId)) invalid10();
   const expected = value.expected;
-  if (!record2(expected) || !keys(expected, ["installationGeneration", "protocolRevision", "admission"]) || !revision(expected.installationGeneration) || !revision(expected.protocolRevision)) invalid8();
+  if (!record2(expected) || !keys(expected, ["installationGeneration", "protocolRevision", "admission"]) || !revision(expected.installationGeneration) || !revision(expected.protocolRevision)) invalid10();
   if (expected.admission !== void 0) {
     const admission = expected.admission;
-    if (!record2(admission) || !keys(admission, ["conversationId", "membershipRevision", "admissionId", "targetAdmissionId"]) || ["conversationId", "admissionId", "targetAdmissionId"].some((key2) => admission[key2] !== void 0 && !identity(admission[key2])) || admission.membershipRevision !== void 0 && !revision(admission.membershipRevision) || context.conversationId !== void 0 && admission.conversationId !== void 0 && admission.conversationId !== context.conversationId) invalid8();
+    if (!record2(admission) || !keys(admission, ["conversationId", "membershipRevision", "admissionId", "targetAdmissionId"]) || ["conversationId", "admissionId", "targetAdmissionId"].some((key) => admission[key] !== void 0 && !identity(admission[key])) || admission.membershipRevision !== void 0 && !revision(admission.membershipRevision) || context.conversationId !== void 0 && admission.conversationId !== void 0 && admission.conversationId !== context.conversationId) invalid10();
   }
-  if (!Array.isArray(value.blobs)) invalid8();
+  if (!Array.isArray(value.blobs)) invalid10();
   const ids = /* @__PURE__ */ new Set();
   for (const [index, blob] of value.blobs.entries()) {
-    if (!record2(blob) || !keys(blob, ["id", "index"]) || !blobIdentity(blob.id) || blob.index !== index || ids.has(blob.id)) invalid8();
+    if (!record2(blob) || !keys(blob, ["id", "index"]) || !blobIdentity(blob.id) || blob.index !== index || ids.has(blob.id)) invalid10();
     ids.add(blob.id);
   }
-  if (typeof value.payload !== "string") invalid8();
+  if (typeof value.payload !== "string") invalid10();
 }
 __name(validateMetadata, "validateMetadata");
 function decodePreparedJsonContent(value) {
@@ -3614,18 +4537,18 @@ function decodePreparedJsonContent(value) {
   try {
     decoded = JSON.parse(value.payload);
   } catch {
-    invalid8();
+    invalid10();
   }
-  if (!record2(decoded) || !keys(decoded, ["body", "envelope"]) || !record2(decoded.body) || decoded.envelope !== void 0 && !record2(decoded.envelope)) invalid8();
-  if (canonicalEndpointJson(decoded) !== value.payload) invalid8();
+  if (!record2(decoded) || !keys(decoded, ["body", "envelope"]) || !record2(decoded.body) || decoded.envelope !== void 0 && !record2(decoded.envelope)) invalid10();
+  if (canonicalEndpointJson(decoded) !== value.payload) invalid10();
   const { body, envelope } = decoded;
   if (endpointOperationRequestRetention(value.context.action, body, envelope) === "memory") {
     throw new PreparedContentError("PREPARED_CONTENT_MEMORY_ONLY");
   }
   const effective = { ...body, ...envelope };
-  for (const key2 of ["conversationId", "messageId"]) {
-    const bound = value.context[key2];
-    if (bound !== void 0 && effective[key2] !== void 0 && effective[key2] !== bound) invalid8();
+  for (const key of ["conversationId", "messageId"]) {
+    const bound = value.context[key];
+    if (bound !== void 0 && effective[key] !== void 0 && effective[key] !== bound) invalid10();
   }
   return envelope === void 0 ? { body } : { body, envelope };
 }
@@ -3655,7 +4578,7 @@ function prepareJsonContent(input) {
 }
 __name(prepareJsonContent, "prepareJsonContent");
 function logicalMediaBlobId(conversationId, messageId2, index) {
-  if (!identity(conversationId) || !identity(messageId2) || !revision(index)) invalid8();
+  if (!identity(conversationId) || !identity(messageId2) || !revision(index)) invalid10();
   return JSON.stringify([conversationId, messageId2, index]);
 }
 __name(logicalMediaBlobId, "logicalMediaBlobId");
@@ -3671,10 +4594,130 @@ function isEndpointOperationReceipt(value) {
 }
 __name(isEndpointOperationReceipt, "isEndpointOperationReceipt");
 
+// ../backend-contracts/src/connectorRelay.ts
+var CONNECTOR_RELAY_INSTALLATION_PREFIX = "canon-relay:";
+var CONNECTOR_RELAY_INSTALLATION_PATTERN = /^canon-relay:[0-9a-f]{40}$/;
+function isConnectorRelayInstallation(installationId) {
+  return typeof installationId === "string" && installationId.startsWith(CONNECTOR_RELAY_INSTALLATION_PREFIX);
+}
+__name(isConnectorRelayInstallation, "isConnectorRelayInstallation");
+var CONNECTOR_RELAY_CREDENTIAL_PATTERN = /^canon_relay_[A-Za-z0-9_-]{43}$/;
+function isConnectorRelayCredential(value) {
+  return typeof value === "string" && CONNECTOR_RELAY_CREDENTIAL_PATTERN.test(value);
+}
+__name(isConnectorRelayCredential, "isConnectorRelayCredential");
+var CONNECTOR_RELAY_INPUT_ID_PATTERN = /^relay:[0-9a-f]{40}$/;
+var CONNECTOR_RELAY_MAX_BODY_BYTES = 256 * 1024;
+var CONNECTOR_RELAY_MAX_TEXT_BYTES = MLS_DEV_TEXT_MAX_BYTES;
+var CONNECTOR_RELAY_MAX_RESPONSE_BYTES = 4 * 1024 * 1024;
+var CONNECTOR_RELAY_ANSWER_WITHIN_MS = 7e3;
+function connectorRelayResponseBytes(value) {
+  return new TextEncoder().encode(JSON.stringify(value)).length;
+}
+__name(connectorRelayResponseBytes, "connectorRelayResponseBytes");
+var ConnectorRelayRequestError = class extends Error {
+  static {
+    __name(this, "ConnectorRelayRequestError");
+  }
+  name = "ConnectorRelayRequestError";
+};
+function invalid11(what) {
+  throw new ConnectorRelayRequestError(`Invalid relay request: ${what}`);
+}
+__name(invalid11, "invalid");
+function record3(value, required, optional = []) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) invalid11("expected an object");
+  const result = value;
+  for (const key of Object.keys(result)) if (!required.includes(key) && !optional.includes(key)) invalid11(`unexpected ${key}`);
+  for (const key of required) if (!Object.hasOwn(result, key)) invalid11(`missing ${key}`);
+  return result;
+}
+__name(record3, "record");
+function id6(value, what, pattern = ENDPOINT_ID_PATTERN) {
+  if (typeof value !== "string" || !pattern.test(value)) invalid11(what);
+  return value;
+}
+__name(id6, "id");
+function doc(value, what) {
+  if (typeof value !== "string" || !value || value.length > 200 || value.includes("/")) invalid11(what);
+  return value;
+}
+__name(doc, "doc");
+var room = /* @__PURE__ */ __name((value) => doc(value, "conversationId"), "room");
+function text4(value) {
+  if (typeof value !== "string" || !value.trim() || new TextEncoder().encode(value).length > CONNECTOR_RELAY_MAX_TEXT_BYTES) invalid11("text");
+  return value;
+}
+__name(text4, "text");
+function limit(value) {
+  if (value === void 0) return void 0;
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 1 || value > 100) invalid11("limit");
+  return value;
+}
+__name(limit, "limit");
+function parseConnectorRelayRequest(value) {
+  const body = record3(value, ["version", "agentId", "grantId", "op", "args"]);
+  if (body.version !== 1) invalid11("version");
+  const head = { version: 1, agentId: doc(body.agentId, "agentId"), grantId: id6(body.grantId, "grantId") };
+  switch (body.op) {
+    case "pending": {
+      const args = record3(body.args, ["conversationId"], ["limit"]);
+      return { ...head, op: "pending", args: { conversationId: room(args.conversationId), ...args.limit === void 0 ? {} : { limit: limit(args.limit) } } };
+    }
+    case "claim": {
+      const args = record3(body.args, ["inputId", "requestId"]);
+      return { ...head, op: "claim", args: { inputId: id6(args.inputId, "inputId", CONNECTOR_RELAY_INPUT_ID_PATTERN), requestId: id6(args.requestId, "requestId") } };
+    }
+    case "reply": {
+      const args = record3(body.args, ["inputId", "requestId", "text"]);
+      return { ...head, op: "reply", args: {
+        inputId: id6(args.inputId, "inputId", CONNECTOR_RELAY_INPUT_ID_PATTERN),
+        requestId: id6(args.requestId, "requestId"),
+        text: text4(args.text)
+      } };
+    }
+    case "settle": {
+      const args = record3(body.args, ["inputId", "requestId", "outcome"]);
+      if (!["completed", "no_reply", "failed"].includes(args.outcome)) invalid11("outcome");
+      return { ...head, op: "settle", args: {
+        inputId: id6(args.inputId, "inputId", CONNECTOR_RELAY_INPUT_ID_PATTERN),
+        requestId: id6(args.requestId, "requestId"),
+        outcome: args.outcome
+      } };
+    }
+    case "read": {
+      const args = record3(body.args, ["conversationId"], ["limit", "before"]);
+      if (args.before !== void 0 && (typeof args.before !== "string" || !/^[1-9][0-9]{0,15}$/.test(args.before))) invalid11("before");
+      return { ...head, op: "read", args: {
+        conversationId: room(args.conversationId),
+        ...args.limit === void 0 ? {} : { limit: limit(args.limit) },
+        ...args.before === void 0 ? {} : { before: args.before }
+      } };
+    }
+    case "send": {
+      const args = record3(body.args, ["conversationId", "messageId", "text"]);
+      return { ...head, op: "send", args: { conversationId: room(args.conversationId), messageId: id6(args.messageId, "messageId"), text: text4(args.text) } };
+    }
+    case "credential": {
+      const args = record3(body.args, ["installationId", "generation", "credential"]);
+      if (!Number.isSafeInteger(args.generation) || args.generation < 1) invalid11("generation");
+      if (!isConnectorRelayCredential(args.credential)) invalid11("credential");
+      return { ...head, op: "credential", args: {
+        installationId: id6(args.installationId, "installationId", CONNECTOR_RELAY_INSTALLATION_PATTERN),
+        generation: args.generation,
+        credential: args.credential
+      } };
+    }
+    default:
+      return invalid11("op");
+  }
+}
+__name(parseConnectorRelayRequest, "parseConnectorRelayRequest");
+
 // ../backend-contracts/src/deliveryObservation.ts
 var isTerminalDeliveryOutcome = /* @__PURE__ */ __name((outcome) => !["unknown", "pending"].includes(outcome), "isTerminalDeliveryOutcome");
 function mergeDeliveryObservation(current, next, expected) {
-  if (next.schemaVersion !== 2 || !Number.isSafeInteger(next.revision) || next.revision < 0 || !["unknown", "pending", "published", "cancelled", "expired", "rejected"].includes(next.outcome) || Object.entries(expected).some(([key2, value]) => next[key2] !== value)) return current;
+  if (next.schemaVersion !== 2 || !Number.isSafeInteger(next.revision) || next.revision < 0 || !["unknown", "pending", "published", "cancelled", "expired", "rejected"].includes(next.outcome) || Object.entries(expected).some(([key, value]) => next[key] !== value)) return current;
   if (current && (next.revision < current.revision || Object.keys(expected).length < 5 && (current.installationId !== next.installationId || current.environmentId !== next.environmentId) || isTerminalDeliveryOutcome(current.outcome) && next.outcome !== current.outcome || next.revision === current.revision && next.outcome !== current.outcome)) return current;
   return next;
 }
@@ -3695,7 +4738,7 @@ __name(classifyTransferHttpFailure, "classifyTransferHttpFailure");
 function classifyTransferReceipt(value, expected) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return "invalid";
   const receipt = value;
-  if (Object.entries(expected).some(([key2, field]) => receipt[key2] !== field)) return "invalid";
+  if (Object.entries(expected).some(([key, field]) => receipt[key] !== field)) return "invalid";
   switch (receipt.status) {
     case "succeeded":
       return "resultError" in receipt || !receipt.result || typeof receipt.result !== "object" || Array.isArray(receipt.result) ? "uncertain" : "result";
@@ -3712,17 +4755,8 @@ function classifyTransferReceipt(value, expected) {
 __name(classifyTransferReceipt, "classifyTransferReceipt");
 
 // ../backend-contracts/src/artifacts.ts
-var ARTIFACT_PROTOCOL_VERSION = 2;
-var ARTIFACT_PROTOCOL_MIN_VERSION = 2;
-var artifactSchemaName = /* @__PURE__ */ __name((version) => `canon.artifact.v${version}`, "artifactSchemaName");
 var ARTIFACT_COMMAND_MAX_BYTES = 64 * 1024;
 var ARTIFACT_STATE_MAX_BYTES = 128 * 1024;
-var ARTIFACT_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,159}$/;
-var ARTIFACT_KEY_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
-var RESERVED_KEYS = /* @__PURE__ */ new Set(["constructor", "prototype", "toString", "__proto__", "hasOwnProperty", "valueOf"]);
-var ARTIFACT_KINDS = ["chess", "form", "image"];
-var ARTIFACT_COMMAND_TYPES = ["create", "chess.move", "chess.resign", "form.set", "form.fields", "image.add", "image.select", "archive"];
-var ARTIFACT_FORM_FIELD_TYPES = ["text", "textarea", "number", "date", "select", "checkbox", "email", "tel", "url"];
 var ARTIFACT_LIMITS = Object.freeze({
   titleChars: 120,
   chessMaxPlies: 600,
@@ -3747,604 +4781,7 @@ var ARTIFACT_LIMITS = Object.freeze({
   outcomes: 200,
   outcomeMessageChars: 500
 });
-function isArtifactId(value) {
-  return typeof value === "string" && ARTIFACT_ID_PATTERN.test(value);
-}
-__name(isArtifactId, "isArtifactId");
-function isArtifactKey(value) {
-  return typeof value === "string" && ARTIFACT_KEY_PATTERN.test(value) && !RESERVED_KEYS.has(value);
-}
-__name(isArtifactKey, "isArtifactKey");
-var ArtifactValidationError = class extends Error {
-  static {
-    __name(this, "ArtifactValidationError");
-  }
-  constructor(message) {
-    super(message);
-    this.name = "ArtifactValidationError";
-  }
-};
-var isObject = /* @__PURE__ */ __name((value) => value !== null && typeof value === "object" && !Array.isArray(value), "isObject");
-function quoteArtifactText(value) {
-  if (typeof value === "number" || typeof value === "boolean") return JSON.stringify(String(value));
-  if (typeof value !== "string") return value === null ? "(null)" : value === void 0 ? "(nothing)" : Array.isArray(value) ? "(a list)" : typeof value === "object" ? "(an object)" : "(an unsupported value)";
-  return JSON.stringify(value.length > 80 ? `${value.slice(0, 80)}\u2026` : value);
-}
-__name(quoteArtifactText, "quoteArtifactText");
-var CONTROL_RUNS = /[\u0000-\u001F\u007F-\u009F\u2028\u2029]+/g;
-function artifactSingleLine(value) {
-  return value.replace(CONTROL_RUNS, " ").trim();
-}
-__name(artifactSingleLine, "artifactSingleLine");
-var fail = /* @__PURE__ */ __name((message) => {
-  throw new ArtifactValidationError(message);
-}, "fail");
-function exactKeys(value, allowed, where) {
-  for (const key2 of Object.keys(value)) if (!allowed.includes(key2)) fail(`Unexpected property ${quoteArtifactText(key2)} in ${where}`);
-}
-__name(exactKeys, "exactKeys");
-function boundedText(value, maximum, what, options = {}) {
-  if (value === void 0 && !options.required) return void 0;
-  if (typeof value !== "string") return fail(`${what} must be text`);
-  const text3 = artifactSingleLine(value);
-  if (options.required && !text3) return fail(`${what} must not be empty`);
-  if (text3.length > maximum) return fail(`${what} must be at most ${maximum} characters`);
-  return text3 || void 0;
-}
-__name(boundedText, "boundedText");
-var ISO_DATE = /^(\d{4})-(\d{2})-(\d{2})$/;
-function isCalendarDate(value) {
-  const match = ISO_DATE.exec(value);
-  if (!match) return false;
-  const [year, month, day] = [Number(match[1]), Number(match[2]), Number(match[3])];
-  if (month < 1 || month > 12 || day < 1) return false;
-  const days = [31, year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0) ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31][month - 1];
-  return day <= days;
-}
-__name(isCalendarDate, "isCalendarDate");
-function roundFormNumber(value, decimals) {
-  if (!Number.isFinite(value) || !Number.isSafeInteger(decimals) || decimals < 0 || decimals > 20) return value;
-  const [mantissa, exponent = "0"] = String(Math.abs(value)).split("e");
-  const shifted = Math.round(Number(`${mantissa}e${Number(exponent) + decimals}`));
-  const [m2, e2 = "0"] = String(shifted).split("e");
-  const rounded = Number(`${m2}e${Number(e2) - decimals}`);
-  if (!Number.isFinite(rounded)) return value;
-  const signed = value < 0 ? -rounded : rounded;
-  return signed === 0 ? 0 : signed;
-}
-__name(roundFormNumber, "roundFormNumber");
 var NUMBER_MAX_TEXT = String(ARTIFACT_LIMITS.formNumberMax).replace(/\B(?=(\d{3})+(?!\d))/g, ",");
-function validateFormValue(spec, value) {
-  const name = spec.label ? quoteArtifactText(spec.label) : "Value";
-  if (value === void 0 || value === null || value === "") return null;
-  switch (spec.type) {
-    case "text":
-    case "textarea":
-    case "email":
-    case "tel":
-    case "url":
-      if (typeof value !== "string") return fail(`${name} must be text`);
-      if (value.length > ARTIFACT_LIMITS.formValueChars) return fail(`${name} must be at most ${ARTIFACT_LIMITS.formValueChars} characters`);
-      return value;
-    case "date":
-      if (typeof value !== "string" || !isCalendarDate(value)) return fail(`${name} must be a calendar date (YYYY-MM-DD)`);
-      return value;
-    case "select":
-      if (typeof value !== "string" || !spec.options?.includes(value)) return fail(`${name} must be one of: ${(spec.options ?? []).slice(0, 10).map(quoteArtifactText).join(", ")}${(spec.options?.length ?? 0) > 10 ? ", \u2026" : ""}`);
-      return value;
-    case "number":
-      if (typeof value !== "number" || !Number.isFinite(value)) return fail(`${name} must be a number`);
-      if (Math.abs(value) > ARTIFACT_LIMITS.formNumberMax) return fail(`${name} must be between -${NUMBER_MAX_TEXT} and ${NUMBER_MAX_TEXT}`);
-      return spec.decimals === void 0 ? value === 0 ? 0 : value : roundFormNumber(value, spec.decimals);
-    case "checkbox":
-      if (typeof value !== "boolean") return fail(`${name} must be true or false`);
-      return value;
-    default:
-      return fail(`${name} has an unknown type`);
-  }
-}
-__name(validateFormValue, "validateFormValue");
-function formValuesEqual(a, b) {
-  const left = a === void 0 || a === "" ? null : a;
-  const right = b === void 0 || b === "" ? null : b;
-  return left === right;
-}
-__name(formValuesEqual, "formValuesEqual");
-function formatFormValue(value) {
-  if (value === void 0 || value === null || value === "") return "empty";
-  if (typeof value === "boolean") return value ? "checked" : "unchecked";
-  if (typeof value === "number") return String(value);
-  return quoteArtifactText(value);
-}
-__name(formatFormValue, "formatFormValue");
-function normalizeOptions(value, type, where) {
-  if (type !== "select") {
-    if (value !== void 0) fail(`Only select inputs have options (${where})`);
-    return void 0;
-  }
-  if (!Array.isArray(value) || value.length < 1 || value.length > ARTIFACT_LIMITS.formOptions) return fail(`${where} needs 1 to ${ARTIFACT_LIMITS.formOptions} options`);
-  const options = value.map((option) => boundedText(option, ARTIFACT_LIMITS.formOptionChars, `An option of ${where}`, { required: true }));
-  if (new Set(options).size !== options.length) fail(`Options of ${where} must be unique`);
-  return options;
-}
-__name(normalizeOptions, "normalizeOptions");
-function normalizeDecimals(value, type, where) {
-  if (value === void 0) return void 0;
-  if (type !== "number") return fail(`Only number inputs have decimals (${where})`);
-  if (!Number.isSafeInteger(value) || value < 0 || value > ARTIFACT_LIMITS.formMaxDecimals) return fail(`Decimals of ${where} must be a whole number from 0 to ${ARTIFACT_LIMITS.formMaxDecimals}`);
-  return value;
-}
-__name(normalizeDecimals, "normalizeDecimals");
-function normalizeFormField(value) {
-  if (!isObject(value)) return fail("Each field must be an object");
-  if (!isArtifactKey(value.id)) return fail(`Field ID ${quoteArtifactText(value.id ?? "")} must be 1-64 letters, digits, '-' or '_'`);
-  const where = `field ${quoteArtifactText(value.id)}`;
-  exactKeys(value, ["id", "label", "type", "options", "required", "placeholder", "help", "decimals"], where);
-  const label = boundedText(value.label, ARTIFACT_LIMITS.formLabelChars, `The label of ${where}`, { required: true });
-  if (typeof value.type !== "string" || !ARTIFACT_FORM_FIELD_TYPES.includes(value.type)) return fail(`The type of ${where} must be one of ${ARTIFACT_FORM_FIELD_TYPES.join(", ")}`);
-  const type = value.type;
-  if (value.required !== void 0 && typeof value.required !== "boolean") fail(`required of ${where} must be true or false`);
-  const options = normalizeOptions(value.options, type, where);
-  const decimals = normalizeDecimals(value.decimals, type, where);
-  const placeholder = boundedText(value.placeholder, ARTIFACT_LIMITS.formHintChars, `The placeholder of ${where}`);
-  const help = boundedText(value.help, ARTIFACT_LIMITS.formHintChars, `The help text of ${where}`);
-  return {
-    id: value.id,
-    label,
-    type,
-    ...options ? { options } : {},
-    ...value.required === true ? { required: true } : {},
-    ...placeholder ? { placeholder } : {},
-    ...help ? { help } : {},
-    ...decimals !== void 0 ? { decimals } : {}
-  };
-}
-__name(normalizeFormField, "normalizeFormField");
-function normalizeColumn(value) {
-  if (!isObject(value)) return fail("Each table column must be an object");
-  if (!isArtifactKey(value.id)) return fail(`Column ID ${quoteArtifactText(value.id ?? "")} must be 1-64 letters, digits, '-' or '_'`);
-  const where = `column ${quoteArtifactText(value.id)}`;
-  exactKeys(value, ["id", "label", "type", "options", "decimals", "sum"], where);
-  const label = boundedText(value.label, ARTIFACT_LIMITS.formLabelChars, `The label of ${where}`, { required: true });
-  if (typeof value.type !== "string" || value.type === "textarea" || !ARTIFACT_FORM_FIELD_TYPES.includes(value.type)) return fail(`The type of ${where} must be one of ${ARTIFACT_FORM_FIELD_TYPES.filter((type2) => type2 !== "textarea").join(", ")}`);
-  const type = value.type;
-  const options = normalizeOptions(value.options, type, where);
-  const decimals = normalizeDecimals(value.decimals, type, where);
-  if (value.sum !== void 0 && typeof value.sum !== "boolean") fail(`sum of ${where} must be true or false`);
-  if (value.sum === true && type !== "number") fail(`Only number columns can be summed (${where})`);
-  return { id: value.id, label, type, ...options ? { options } : {}, ...decimals !== void 0 ? { decimals } : {}, ...value.sum === true ? { sum: true } : {} };
-}
-__name(normalizeColumn, "normalizeColumn");
-function normalizeFormTable(value) {
-  if (!isObject(value)) return fail("table must be { label?, columns }");
-  exactKeys(value, ["label", "columns"], "the table");
-  const label = boundedText(value.label, ARTIFACT_LIMITS.formLabelChars, "The table label");
-  if (!Array.isArray(value.columns) || value.columns.length < 1 || value.columns.length > ARTIFACT_LIMITS.formColumns) return fail(`A table needs 1 to ${ARTIFACT_LIMITS.formColumns} columns`);
-  const columns = value.columns.map(normalizeColumn);
-  if (new Set(columns.map((column) => column.id)).size !== columns.length) fail("Column IDs must be unique");
-  return { ...label ? { label } : {}, columns };
-}
-__name(normalizeFormTable, "normalizeFormTable");
-function normalizeFormCells(table, value, where) {
-  if (!isObject(value)) return fail(`The cells of ${where} must be an object`);
-  const columns = new Map(table.columns.map((column) => [column.id, column]));
-  for (const key2 of Object.keys(value)) if (!columns.has(key2)) fail(`Unknown column ${quoteArtifactText(key2)} in ${where}. Columns: ${table.columns.map((column) => column.id).join(", ")}`);
-  const cells = {};
-  for (const column of table.columns) cells[column.id] = validateFormValue(column, Object.hasOwn(value, column.id) ? value[column.id] : null);
-  return cells;
-}
-__name(normalizeFormCells, "normalizeFormCells");
-function normalizeFormInput(input) {
-  if (!isObject(input)) return fail("A form needs { fields, values?, table?, rows? }");
-  exactKeys(input, ["fields", "values", "table", "rows"], "the form");
-  if (!Array.isArray(input.fields) || input.fields.length > ARTIFACT_LIMITS.formFields) return fail(`A form needs a fields list of at most ${ARTIFACT_LIMITS.formFields} fields`);
-  const fields = input.fields.map(normalizeFormField);
-  const ids = /* @__PURE__ */ new Set();
-  for (const field of fields) {
-    if (ids.has(field.id)) fail(`Field ID ${quoteArtifactText(field.id)} is used twice`);
-    ids.add(field.id);
-  }
-  const values = {};
-  if (input.values !== void 0 && !isObject(input.values)) fail("values must be an object keyed by field ID");
-  const given = input.values ?? {};
-  for (const key2 of Object.keys(given)) if (!ids.has(key2)) fail(`Unknown field ${quoteArtifactText(key2)} in values. Fields: ${fields.map((field) => field.id).join(", ") || "none"}`);
-  for (const field of fields) values[field.id] = validateFormValue(field, Object.hasOwn(given, field.id) ? given[field.id] : null);
-  const table = input.table === void 0 ? void 0 : normalizeFormTable(input.table);
-  const rows = [];
-  if (input.rows !== void 0) {
-    if (!Array.isArray(input.rows)) return fail("rows must be a list");
-    if (input.rows.length && !table) fail("Rows need a table with columns");
-    if (input.rows.length > ARTIFACT_LIMITS.formRows) fail(`A table holds at most ${ARTIFACT_LIMITS.formRows} rows`);
-    const rowIds = /* @__PURE__ */ new Set();
-    input.rows.forEach((row, index) => {
-      if (!isObject(row)) fail(`Row ${index + 1} must be { id?, cells }`);
-      const value = row;
-      exactKeys(value, ["id", "cells"], `row ${index + 1}`);
-      const id6 = value.id === void 0 ? `r-${index + 1}` : value.id;
-      if (!isArtifactKey(id6)) fail(`Row ID ${quoteArtifactText(id6)} must be 1-64 letters, digits, '-' or '_'`);
-      if (rowIds.has(id6)) fail(`Row ID ${quoteArtifactText(id6)} is used twice`);
-      rowIds.add(id6);
-      rows.push({ id: id6, cells: normalizeFormCells(table, value.cells ?? {}, `row ${index + 1}`) });
-    });
-  }
-  return { fields, values, ...table ? { table } : {}, rows };
-}
-__name(normalizeFormInput, "normalizeFormInput");
-
-// ../backend-contracts/src/artifactActions.ts
-var ARTIFACT_UPDATE_ACTION_TYPES = ["chess.move", "chess.resign", "form.set", "form.fields", "image.select", "archive"];
-function object(properties, required = [], description) {
-  return { type: "object", properties, required, additionalProperties: false, ...description ? { description } : {} };
-}
-__name(object, "object");
-function id5(description) {
-  return { type: "string", pattern: ARTIFACT_ID_PATTERN.source, description };
-}
-__name(id5, "id");
-function key(description) {
-  return { type: "string", pattern: ARTIFACT_KEY_PATTERN.source, description };
-}
-__name(key, "key");
-function scalarSchema() {
-  return { type: ["string", "number", "boolean", "null"] };
-}
-__name(scalarSchema, "scalarSchema");
-function valueMap(description) {
-  return { type: "object", additionalProperties: scalarSchema(), description };
-}
-__name(valueMap, "valueMap");
-function text2(max, description) {
-  return { type: "string", minLength: 1, maxLength: max, ...description ? { description } : {} };
-}
-__name(text2, "text");
-function fieldSchemas() {
-  const options = { type: "array", items: text2(ARTIFACT_LIMITS.formOptionChars), minItems: 1, maxItems: ARTIFACT_LIMITS.formOptions, description: "The choices (select only)." };
-  const decimals = { type: "integer", minimum: 0, maximum: ARTIFACT_LIMITS.formMaxDecimals, description: "Number only: round to this many decimals." };
-  return {
-    field: object({
-      id: key("Stable field ID: letters, digits, - or _."),
-      label: text2(ARTIFACT_LIMITS.formLabelChars),
-      type: { enum: [...ARTIFACT_FORM_FIELD_TYPES] },
-      options,
-      required: { type: "boolean", description: "Marked as required (a hint; empty values are allowed)." },
-      placeholder: text2(ARTIFACT_LIMITS.formHintChars),
-      help: text2(ARTIFACT_LIMITS.formHintChars),
-      decimals
-    }, ["id", "label", "type"]),
-    column: object({
-      id: key("Stable column ID."),
-      label: text2(ARTIFACT_LIMITS.formLabelChars),
-      type: { enum: ARTIFACT_FORM_FIELD_TYPES.filter((type) => type !== "textarea") },
-      options,
-      decimals,
-      sum: { type: "boolean", description: "Number only: show the column total." }
-    }, ["id", "label", "type"])
-  };
-}
-__name(fieldSchemas, "fieldSchemas");
-var ARTIFACT_ID_DESCRIPTION = "The work\u2019s artifactId (from artifact_list, artifact_create or a message reference).";
-var LAST_ATTACHMENT_INDEX = VERB_LIMITS.messageAttachments - 1;
-function artifactActionSchemas() {
-  const { field, column } = fieldSchemas();
-  const fraction = /* @__PURE__ */ __name(() => ({ type: "number", minimum: 0, maximum: 1 }), "fraction");
-  return {
-    create: object({
-      kind: { enum: ["chess", "form", "image"] },
-      title: text2(ARTIFACT_LIMITS.titleChars),
-      chess: object({ playAs: { enum: ["white", "black"], description: "Your seat. Omit for an open board." }, fen: text2(100, "Optional starting position (FEN).") }, [], 'Only for kind "chess".'),
-      form: object({
-        fields: { type: "array", maxItems: ARTIFACT_LIMITS.formFields, items: field },
-        values: valueMap("Initial values keyed by field ID."),
-        table: object({ label: text2(ARTIFACT_LIMITS.formLabelChars), columns: { type: "array", minItems: 1, maxItems: ARTIFACT_LIMITS.formColumns, items: column } }, ["columns"], "Optional table of line items."),
-        rows: { type: "array", maxItems: ARTIFACT_LIMITS.formRows, items: object({ id: key("Optional row ID."), cells: valueMap("Cell values keyed by column ID.") }, ["cells"]) }
-      }, ["fields"], 'Required for kind "form".')
-    }, ["kind", "title"]),
-    update: {
-      description: "What to change. Pick one action by its type.",
-      oneOf: [
-        object({ type: { const: "chess.move" }, move: text2(16, 'Your move in SAN ("Nf3", "exd5", "O-O", "e8=Q") or UCI ("g1f3").') }, ["type", "move"]),
-        object({ type: { const: "chess.resign" } }, ["type"]),
-        object({
-          type: { const: "form.set" },
-          values: valueMap('Field values keyed by field ID. Numbers may be given as numeric text; "" or null empties a value.'),
-          cells: { type: "array", maxItems: ARTIFACT_LIMITS.formChanges, items: object({ row: key("Row ID"), column: key("Column ID"), value: scalarSchema() }, ["row", "column", "value"]) },
-          addRows: { type: "array", maxItems: ARTIFACT_LIMITS.formChanges, items: object({ id: key("Optional row ID; generated when omitted (returned as addedRowIds)."), cells: valueMap("Cell values keyed by column ID.") }, ["cells"]) },
-          removeRows: { type: "array", maxItems: ARTIFACT_LIMITS.formChanges, items: key("Row ID") }
-        }, ["type"]),
-        object({ type: { const: "form.fields" }, add: { type: "array", maxItems: ARTIFACT_LIMITS.formFields, items: field }, remove: { type: "array", maxItems: ARTIFACT_LIMITS.formFields, items: key("Field ID") } }, ["type"]),
-        object({ type: { const: "image.select" }, variantId: id5("The version to make current.") }, ["type", "variantId"]),
-        object({ type: { const: "archive" }, archived: { type: "boolean", description: "true archives the work (read-only); false restores it." } }, ["type", "archived"])
-      ]
-    },
-    generateImage: object({
-      prompt: text2(ARTIFACT_LIMITS.imagePromptChars, "What to generate or change."),
-      label: text2(ARTIFACT_LIMITS.imageLabelChars, 'A short name for the new version, e.g. "darker sky".'),
-      from: {
-        description: '"current", "new", or the version to edit (a version ID, or { variantId }).',
-        anyOf: [{ type: "string", pattern: ARTIFACT_ID_PATTERN.source }, object({ variantId: id5("The version to edit.") }, ["variantId"])]
-      },
-      region: object({ x: fraction(), y: fraction(), width: fraction(), height: fraction() }, ["x", "y", "width", "height"], "Optional area to change.")
-    }, ["prompt", "label", "from"]),
-    addImage: object({
-      label: text2(ARTIFACT_LIMITS.imageLabelChars, "A short name for the version."),
-      prompt: text2(ARTIFACT_LIMITS.imagePromptChars, "Optional: how the image was made."),
-      sourceVariantId: id5("Optional: the version this one was derived from."),
-      path: text2(4096, "Absolute path of a local JPEG or PNG file (only where the host allows local files)."),
-      messageId: id5("A message in this conversation with an image attached."),
-      attachmentIndex: { type: "integer", minimum: 0, maximum: LAST_ATTACHMENT_INDEX, description: "Which attachment of that message (default: its first image)." }
-    }, ["label"])
-  };
-}
-__name(artifactActionSchemas, "artifactActionSchemas");
-function withArtifactId(schema) {
-  return { ...schema, properties: { artifactId: id5(ARTIFACT_ID_DESCRIPTION), ...schema.properties }, required: ["artifactId", ...schema.required] };
-}
-__name(withArtifactId, "withArtifactId");
-function artifactToolInputSchemas() {
-  const actions = artifactActionSchemas();
-  return {
-    artifact_list: object({}),
-    artifact_read: object({
-      artifactId: id5(ARTIFACT_ID_DESCRIPTION),
-      revisionId: id5("Optional earlier revision to read (from a message reference)."),
-      variantId: id5("Image work: show this version instead of the current one.")
-    }, ["artifactId"]),
-    artifact_create: actions.create,
-    artifact_update: object({
-      artifactId: id5(ARTIFACT_ID_DESCRIPTION),
-      action: actions.update,
-      basedOnRevisionId: id5("Rarely needed: base the change on this revision instead of the version you last saw.")
-    }, ["artifactId", "action"]),
-    artifact_generate_image: withArtifactId(actions.generateImage),
-    artifact_add_image: withArtifactId(actions.addImage)
-  };
-}
-__name(artifactToolInputSchemas, "artifactToolInputSchemas");
-var isObject2 = /* @__PURE__ */ __name((input) => input !== null && typeof input === "object" && !Array.isArray(input), "isObject");
-var fail2 = /* @__PURE__ */ __name((message) => {
-  throw new ArtifactValidationError(message);
-}, "fail");
-var quote = quoteArtifactText;
-function exactKeys2(input, allowed, where) {
-  for (const name of Object.keys(input)) if (!allowed.includes(name)) fail2(`Unexpected ${JSON.stringify(name.slice(0, 40))} in ${where}`);
-}
-__name(exactKeys2, "exactKeys");
-function textArg(input, name, max, required = false) {
-  if (input === void 0 && !required) return void 0;
-  if (typeof input !== "string" || !input.trim() || input.length > max) return fail2(`${name} must be text of at most ${max} characters`);
-  return input;
-}
-__name(textArg, "textArg");
-function lineArg(input, name, max) {
-  const line = artifactSingleLine(textArg(input, name, max, true));
-  return line || fail2(`${name} must be text of at most ${max} characters`);
-}
-__name(lineArg, "lineArg");
-function idArg(input, name) {
-  if (input === void 0) return void 0;
-  return isArtifactId(input) ? input : fail2(`${name} must be an ID (letters, digits, _ . : -)`);
-}
-__name(idArg, "idArg");
-var isScalar = /* @__PURE__ */ __name((input) => input === null || typeof input === "string" || typeof input === "boolean" || typeof input === "number" && Number.isFinite(input), "isScalar");
-function scalar(input, where) {
-  return isScalar(input) ? input : fail2(`${where} must be text, a number, true, false or null`);
-}
-__name(scalar, "scalar");
-function scalars(input, what, known) {
-  return Object.fromEntries(Object.entries(input).map(([name, item]) => {
-    if (known && !known.ids.includes(name)) fail2(`Unknown ${what} ${quote(name)} in ${known.where}. ${known.list}: ${known.ids.join(", ") || "none"}`);
-    return [name, scalar(item, `The value of ${what} ${quote(name)}`)];
-  }));
-}
-__name(scalars, "scalars");
-function uniqueFields(fields) {
-  const seen = /* @__PURE__ */ new Set();
-  for (const field of fields) {
-    if (seen.has(field.id)) fail2(`Field ID ${quote(field.id)} is used twice`);
-    seen.add(field.id);
-  }
-}
-__name(uniqueFields, "uniqueFields");
-function chessAction(title, input, prefix) {
-  if (input.playAs !== void 0 && input.playAs !== "white" && input.playAs !== "black") fail2(`${prefix}playAs must be "white" or "black"`);
-  if (input.fen !== void 0 && (typeof input.fen !== "string" || !input.fen.trim() || input.fen.length > 100)) fail2(`${prefix}fen must be a FEN string`);
-  if (input.opponent !== void 0 && !isArtifactId(input.opponent)) fail2("opponent must be a participant ID");
-  return {
-    kind: "chess",
-    title,
-    ...input.playAs !== void 0 ? { playAs: input.playAs } : {},
-    ...input.opponent !== void 0 ? { opponent: input.opponent } : {},
-    ...input.fen !== void 0 ? { fen: input.fen.trim() } : {}
-  };
-}
-__name(chessAction, "chessAction");
-function formAction(title, input) {
-  if (!Array.isArray(input.fields) || input.fields.length > ARTIFACT_LIMITS.formFields) return fail2(`A form needs a fields list of at most ${ARTIFACT_LIMITS.formFields} fields`);
-  const fields = input.fields.map(normalizeFormField);
-  uniqueFields(fields);
-  const fieldIds = fields.map((field) => field.id);
-  if (input.values !== void 0 && !isObject2(input.values)) fail2("values must be an object keyed by field ID");
-  const values = input.values === void 0 ? void 0 : scalars(input.values, "field", { ids: fieldIds, where: "values", list: "Fields" });
-  const table = input.table === void 0 ? void 0 : normalizeFormTable(input.table);
-  let rows;
-  if (input.rows !== void 0) {
-    if (!Array.isArray(input.rows)) return fail2("rows must be a list");
-    if (input.rows.length && !table) fail2("Rows need a table with columns");
-    if (input.rows.length > ARTIFACT_LIMITS.formRows) fail2(`A table holds at most ${ARTIFACT_LIMITS.formRows} rows`);
-    const columnIds = table?.columns.map((column) => column.id) ?? [];
-    const rowIds = /* @__PURE__ */ new Set();
-    rows = input.rows.map((row, index) => {
-      const where = `row ${index + 1}`;
-      if (!isObject2(row)) return fail2(`Row ${index + 1} must be { id?, cells }`);
-      exactKeys2(row, ["id", "cells"], where);
-      if (row.id !== void 0) {
-        if (!isArtifactKey(row.id)) fail2(`Row ID ${quote(row.id)} must be 1-64 letters, digits, '-' or '_'`);
-        if (rowIds.has(row.id)) fail2(`Row ID ${quote(row.id)} is used twice`);
-        rowIds.add(row.id);
-      }
-      if (row.cells !== void 0 && !isObject2(row.cells)) fail2(`The cells of ${where} must be an object`);
-      return { ...row.id !== void 0 ? { id: row.id } : {}, cells: scalars(row.cells ?? {}, "column", { ids: columnIds, where, list: "Columns" }) };
-    });
-  }
-  return { kind: "form", title, fields, ...values ? { values } : {}, ...table ? { table } : {}, ...rows ? { rows } : {} };
-}
-__name(formAction, "formAction");
-function parseArtifactCreateAction(input) {
-  if (!isObject2(input)) return fail2("Describe the work to create: { kind, title, ... }");
-  const title = lineArg(input.title, "title", ARTIFACT_LIMITS.titleChars);
-  switch (input.kind) {
-    case "chess":
-      exactKeys2(input, ["kind", "title", "playAs", "opponent", "fen"], "a chess game");
-      return chessAction(title, input, "");
-    case "form":
-      exactKeys2(input, ["kind", "title", "fields", "values", "table", "rows"], "a form");
-      return formAction(title, input);
-    case "image":
-      exactKeys2(input, ["kind", "title"], "an image");
-      return { kind: "image", title };
-    default:
-      return fail2('kind must be "chess", "form" or "image"');
-  }
-}
-__name(parseArtifactCreateAction, "parseArtifactCreateAction");
-function formSetAction(input) {
-  exactKeys2(input, ["type", "values", "cells", "addRows", "removeRows"], "form.set");
-  const action = { type: "form.set" };
-  let count = 0;
-  if (input.values !== void 0) {
-    if (!isObject2(input.values)) fail2("values must be an object keyed by field ID");
-    action.values = scalars(input.values, "field");
-    count += Object.keys(action.values).length;
-  }
-  if (input.cells !== void 0) {
-    if (!Array.isArray(input.cells)) fail2("cells must be a list of { row, column, value }");
-    action.cells = input.cells.map((cell) => {
-      if (!isObject2(cell) || typeof cell.row !== "string" || typeof cell.column !== "string" || !Object.hasOwn(cell, "value")) return fail2("Each cell must be { row, column, value }");
-      exactKeys2(cell, ["row", "column", "value"], "a cell");
-      return { row: cell.row, column: cell.column, value: scalar(cell.value, `The value of column ${quote(cell.column)} in row ${quote(cell.row)}`) };
-    });
-    count += action.cells.length;
-  }
-  if (input.addRows !== void 0) {
-    if (!Array.isArray(input.addRows)) fail2("addRows must be a list of { id?, cells }");
-    const taken = /* @__PURE__ */ new Set();
-    action.addRows = input.addRows.map((row) => {
-      if (!isObject2(row) || row.cells !== void 0 && !isObject2(row.cells)) return fail2("Each added row must be { id?, cells }");
-      exactKeys2(row, ["id", "cells"], "an added row");
-      if (row.id !== void 0) {
-        if (!isArtifactKey(row.id)) fail2(`Row ID ${quote(row.id)} must be 1-64 letters, digits, '-' or '_'`);
-        if (taken.has(row.id)) fail2(`Row ID ${quote(row.id)} is already used`);
-        taken.add(row.id);
-      }
-      return { ...row.id !== void 0 ? { id: row.id } : {}, cells: scalars(row.cells ?? {}, "column") };
-    });
-    count += action.addRows.length;
-  }
-  if (input.removeRows !== void 0) {
-    if (!Array.isArray(input.removeRows) || input.removeRows.some((item) => typeof item !== "string")) fail2("removeRows must be a list of row IDs");
-    action.removeRows = [...input.removeRows];
-    count += action.removeRows.length;
-  }
-  if (!count) fail2("form.set needs values, cells, addRows or removeRows");
-  if (count > ARTIFACT_LIMITS.formChanges) fail2(`One form.set can make at most ${ARTIFACT_LIMITS.formChanges} changes`);
-  return action;
-}
-__name(formSetAction, "formSetAction");
-function formFieldsAction(input) {
-  exactKeys2(input, ["type", "add", "remove"], "form.fields");
-  if (input.add !== void 0 && !Array.isArray(input.add)) fail2("add must be a list of fields");
-  if (input.remove !== void 0 && (!Array.isArray(input.remove) || input.remove.some((item) => typeof item !== "string"))) fail2("remove must be a list of field IDs");
-  const add = input.add ?? [];
-  const remove = input.remove ?? [];
-  if (!add.length && !remove.length) fail2("form.fields needs fields to add or field IDs to remove");
-  if (add.length > ARTIFACT_LIMITS.formFields) fail2(`A form holds at most ${ARTIFACT_LIMITS.formFields} fields`);
-  const fields = add.map(normalizeFormField);
-  uniqueFields(fields);
-  const removed = /* @__PURE__ */ new Set();
-  for (const name of remove) {
-    if (removed.has(name)) fail2(`Field ${quote(name)} is removed twice`);
-    removed.add(name);
-  }
-  for (const field of fields) if (removed.has(field.id)) fail2(`Field ${quote(field.id)} cannot be removed and added again in one command; field types do not change`);
-  return { type: "form.fields", ...fields.length ? { add: fields } : {}, ...remove.length ? { remove: [...remove] } : {} };
-}
-__name(formFieldsAction, "formFieldsAction");
-function parseArtifactUpdateAction(input) {
-  if (!isObject2(input) || typeof input.type !== "string" || !ARTIFACT_UPDATE_ACTION_TYPES.includes(input.type)) {
-    return fail2(`action.type must be one of ${ARTIFACT_UPDATE_ACTION_TYPES.join(", ")}`);
-  }
-  const type = input.type;
-  switch (type) {
-    case "chess.move": {
-      exactKeys2(input, ["type", "move"], "chess.move");
-      const move = typeof input.move === "string" ? input.move.trim() : "";
-      if (!move || move.length > 16) return fail2('move must be a move in SAN (for example "Nf3") or UCI (for example "g1f3")');
-      return { type, move };
-    }
-    case "chess.resign":
-      exactKeys2(input, ["type"], "chess.resign");
-      return { type };
-    case "image.select":
-      exactKeys2(input, ["type", "variantId"], "image.select");
-      if (!isArtifactId(input.variantId)) return fail2("variantId must be a version ID from the image work");
-      return { type, variantId: input.variantId };
-    case "archive":
-      exactKeys2(input, ["type", "archived"], "archive");
-      if (typeof input.archived !== "boolean") return fail2("archived must be true or false");
-      return { type, archived: input.archived };
-    case "form.fields":
-      return formFieldsAction(input);
-    case "form.set":
-      return formSetAction(input);
-  }
-}
-__name(parseArtifactUpdateAction, "parseArtifactUpdateAction");
-var REGION_MESSAGE = "The region must be fractions of the image: x, y, width and height between 0 and 1";
-function parseArtifactImageRegion(input) {
-  if (!isObject2(input)) return fail2(REGION_MESSAGE);
-  exactKeys2(input, ["x", "y", "width", "height"], "region");
-  const { x, y, width, height } = input;
-  if ([x, y, width, height].some((item) => typeof item !== "number" || !Number.isFinite(item) || item < 0 || item > 1) || width <= 0 || height <= 0 || x + width > 1 || y + height > 1) return fail2(REGION_MESSAGE);
-  return { x, y, width, height };
-}
-__name(parseArtifactImageRegion, "parseArtifactImageRegion");
-function parseArtifactImageSource(input) {
-  if (input === "current" || input === "new") return input;
-  if (isArtifactId(input)) return { variantId: input };
-  if (isObject2(input) && Object.keys(input).length === 1 && isArtifactId(input.variantId)) return { variantId: input.variantId };
-  return fail2("from must be 'current', 'new' or a version ID");
-}
-__name(parseArtifactImageSource, "parseArtifactImageSource");
-function parseArtifactGenerateImageAction(input) {
-  if (!isObject2(input)) return fail2("Describe the image to generate");
-  exactKeys2(input, ["prompt", "label", "from", "region"], "the image request");
-  const prompt = textArg(input.prompt, "prompt", ARTIFACT_LIMITS.imagePromptChars, true).trim();
-  const label = lineArg(input.label, "label", ARTIFACT_LIMITS.imageLabelChars);
-  const from = parseArtifactImageSource(input.from);
-  return { prompt, label, from, ...input.region !== void 0 ? { region: parseArtifactImageRegion(input.region) } : {} };
-}
-__name(parseArtifactGenerateImageAction, "parseArtifactGenerateImageAction");
-function parseArtifactAddImageAction(input) {
-  if (!isObject2(input)) return fail2("Describe the image to add: { label, path | messageId }");
-  exactKeys2(input, ["label", "prompt", "sourceVariantId", "path", "messageId", "attachmentIndex"], "the image");
-  const label = lineArg(input.label, "label", ARTIFACT_LIMITS.imageLabelChars);
-  const prompt = textArg(input.prompt, "prompt", ARTIFACT_LIMITS.imagePromptChars)?.trim();
-  const sourceVariantId = idArg(input.sourceVariantId, "sourceVariantId");
-  const path = textArg(input.path, "path", 4096);
-  const messageId2 = idArg(input.messageId, "messageId");
-  const index = input.attachmentIndex;
-  if (index !== void 0 && (!Number.isSafeInteger(index) || index < 0 || index > LAST_ATTACHMENT_INDEX)) fail2(`attachmentIndex must be from 0 to ${LAST_ATTACHMENT_INDEX}`);
-  if (path && (messageId2 || index !== void 0)) fail2("Give either path or messageId (with attachmentIndex), not both");
-  return {
-    label,
-    ...prompt ? { prompt } : {},
-    ...sourceVariantId ? { sourceVariantId } : {},
-    ...path ? { path } : {},
-    ...messageId2 ? { messageId: messageId2 } : {},
-    ...index !== void 0 ? { attachmentIndex: index } : {}
-  };
-}
-__name(parseArtifactAddImageAction, "parseArtifactAddImageAction");
 
 // ../backend-contracts/src/mlsDevCredentialReconciliation.ts
 var MLS_DEV_CREDENTIAL_RECONCILIATION_CHALLENGE_TTL_MS = 3e5;
@@ -4359,32 +4796,32 @@ var MlsDevCredentialReconciliationValidationError = class extends Error {
     this.name = "MlsDevCredentialReconciliationValidationError";
   }
 };
-var utf85 = new TextEncoder();
-var domain2 = utf85.encode("canon.mls.credential-reconciliation-proof.v1\0");
-function invalid9() {
+var utf86 = new TextEncoder();
+var domain2 = utf86.encode("canon.mls.credential-reconciliation-proof.v1\0");
+function invalid12() {
   throw new MlsDevCredentialReconciliationValidationError();
 }
-__name(invalid9, "invalid");
-function boundary7(read) {
+__name(invalid12, "invalid");
+function boundary9(read) {
   try {
     return read();
   } catch {
-    return invalid9();
+    return invalid12();
   }
 }
-__name(boundary7, "boundary");
+__name(boundary9, "boundary");
 function bounded7(value) {
-  if (utf85.encode(JSON.stringify(value)).length > MLS_DEV_CREDENTIAL_RECONCILIATION_MAX_BYTES) invalid9();
+  if (utf86.encode(JSON.stringify(value)).length > MLS_DEV_CREDENTIAL_RECONCILIATION_MAX_BYTES) invalid12();
   return Object.freeze(value);
 }
 __name(bounded7, "bounded");
-function encoded5(value, bytes) {
+function encoded6(value, bytes) {
   decodeCanonicalMlsBase64Url(value, bytes);
   return value;
 }
-__name(encoded5, "encoded");
+__name(encoded6, "encoded");
 function parseMlsDevCredentialReconciliationBegin(value) {
-  return boundary7(() => {
+  return boundary9(() => {
     const input = readMlsDataRecord(value, ["version", "deviceId", "requestId", "expectedCredentialGeneration"]);
     return bounded7({
       version: requireMlsLiteral(input.version, 1),
@@ -4396,7 +4833,7 @@ function parseMlsDevCredentialReconciliationBegin(value) {
 }
 __name(parseMlsDevCredentialReconciliationBegin, "parseMlsDevCredentialReconciliationBegin");
 function parseMlsDevCredentialReconciliationChallenge(value) {
-  return boundary7(() => {
+  return boundary9(() => {
     const input = readMlsDataRecord(value, [
       "version",
       "challengeId",
@@ -4409,12 +4846,12 @@ function parseMlsDevCredentialReconciliationChallenge(value) {
     ]);
     const device = parseMlsDevEnrollmentResult({ version: 1, authorization: "registration_only", device: input.device }).device;
     const issuedAtMs = requireMlsInteger(input.issuedAtMs), expiresAtMs = requireMlsInteger(input.expiresAtMs);
-    if (issuedAtMs < device.registeredAtMs || expiresAtMs - issuedAtMs !== MLS_DEV_CREDENTIAL_RECONCILIATION_CHALLENGE_TTL_MS) invalid9();
+    if (issuedAtMs < device.registeredAtMs || expiresAtMs - issuedAtMs !== MLS_DEV_CREDENTIAL_RECONCILIATION_CHALLENGE_TTL_MS) invalid12();
     return bounded7({
       version: requireMlsLiteral(input.version, 1),
       challengeId: requireMlsUuid(input.challengeId),
       requestId: requireMlsUuid(input.requestId),
-      nonce: encoded5(input.nonce, 32),
+      nonce: encoded6(input.nonce, 32),
       device,
       expectedCredentialGeneration: requireMlsInteger(input.expectedCredentialGeneration),
       issuedAtMs,
@@ -4424,18 +4861,18 @@ function parseMlsDevCredentialReconciliationChallenge(value) {
 }
 __name(parseMlsDevCredentialReconciliationChallenge, "parseMlsDevCredentialReconciliationChallenge");
 function parseMlsDevCredentialReconciliationComplete(value) {
-  return boundary7(() => {
+  return boundary9(() => {
     const input = readMlsDataRecord(value, ["version", "challengeId", "proof"]);
-    return bounded7({ version: requireMlsLiteral(input.version, 1), challengeId: requireMlsUuid(input.challengeId), proof: encoded5(input.proof, 64) });
+    return bounded7({ version: requireMlsLiteral(input.version, 1), challengeId: requireMlsUuid(input.challengeId), proof: encoded6(input.proof, 64) });
   });
 }
 __name(parseMlsDevCredentialReconciliationComplete, "parseMlsDevCredentialReconciliationComplete");
 function parseMlsDevCredentialReconciliationReceipt(value) {
-  return boundary7(() => {
+  return boundary9(() => {
     const input = readMlsDataRecord(value, ["version", "authorization", "challenge", "observedCredentialGeneration", "observedAtMs"]);
     const challenge = parseMlsDevCredentialReconciliationChallenge(input.challenge);
     const observedCredentialGeneration = requireMlsInteger(input.observedCredentialGeneration), observedAtMs = requireMlsInteger(input.observedAtMs);
-    if (observedCredentialGeneration < challenge.expectedCredentialGeneration || observedAtMs < challenge.issuedAtMs || observedAtMs >= challenge.expiresAtMs) invalid9();
+    if (observedCredentialGeneration < challenge.expectedCredentialGeneration || observedAtMs < challenge.issuedAtMs || observedAtMs >= challenge.expiresAtMs) invalid12();
     return bounded7({
       version: requireMlsLiteral(input.version, 1),
       authorization: requireMlsLiteral(input.authorization, "credential_generation_observation_only"),
@@ -4461,51 +4898,51 @@ var MlsDevDeviceCustodyValidationError = class extends Error {
     this.name = "MlsDevDeviceCustodyValidationError";
   }
 };
-var utf86 = new TextEncoder();
-function invalid10() {
+var utf87 = new TextEncoder();
+function invalid13() {
   throw new MlsDevDeviceCustodyValidationError();
 }
-__name(invalid10, "invalid");
-function boundary8(read) {
+__name(invalid13, "invalid");
+function boundary10(read) {
   try {
     return read();
   } catch {
-    return invalid10();
+    return invalid13();
   }
 }
-__name(boundary8, "boundary");
-function bounded8(value, limit) {
-  if (utf86.encode(JSON.stringify(value)).length > limit) invalid10();
+__name(boundary10, "boundary");
+function bounded8(value, limit2) {
+  if (utf87.encode(JSON.stringify(value)).length > limit2) invalid13();
   return Object.freeze(value);
 }
 __name(bounded8, "bounded");
 function binding2(input) {
   return {
     version: requireMlsLiteral(input.version, 1),
-    environmentId: requireMlsLiteral(input.environmentId, "canon-dev-v1"),
+    environmentId: requireMlsEnvironmentId(input.environmentId),
     principal: parseMlsDevEnrollmentPrincipal(input.principal),
     installationId: parseMlsDevInstallationId(input.installationId)
   };
 }
 __name(binding2, "binding");
 function parseMlsDevDeviceBinding(value) {
-  return boundary8(() => bounded8(binding2(readMlsDataRecord(value, ["version", "environmentId", "principal", "installationId"])), MLS_DEV_DEVICE_CONTEXT_MAX_BYTES));
+  return boundary10(() => bounded8(binding2(readMlsDataRecord(value, ["version", "environmentId", "principal", "installationId"])), MLS_DEV_DEVICE_CONTEXT_MAX_BYTES));
 }
 __name(parseMlsDevDeviceBinding, "parseMlsDevDeviceBinding");
 function parseMlsDevDeviceContext(value) {
-  return boundary8(() => {
+  return boundary10(() => {
     const input = readMlsDataRecord(value, ["version", "environmentId", "principal", "installationId", "revision"]);
     const revision2 = requireMlsInteger(input.revision);
-    if (revision2 >= Number.MAX_SAFE_INTEGER) invalid10();
+    if (revision2 >= Number.MAX_SAFE_INTEGER) invalid13();
     return bounded8({ ...binding2(input), revision: revision2 }, MLS_DEV_DEVICE_CONTEXT_MAX_BYTES);
   });
 }
 __name(parseMlsDevDeviceContext, "parseMlsDevDeviceContext");
 function parseMlsDevDeviceCommand(value) {
-  return boundary8(() => {
-    if (value === null || typeof value !== "object") invalid10();
+  return boundary10(() => {
+    if (value === null || typeof value !== "object") invalid13();
     const descriptor = Object.getOwnPropertyDescriptor(value, "op");
-    if (!descriptor || !Object.hasOwn(descriptor, "value")) invalid10();
+    if (!descriptor || !Object.hasOwn(descriptor, "value")) invalid13();
     if (descriptor.value === "create") {
       const input2 = readMlsDataRecord(value, ["op"]);
       return Object.freeze({ op: requireMlsLiteral(input2.op, "create") });
@@ -4521,19 +4958,19 @@ function parseMlsDevDeviceCommand(value) {
       const input2 = readMlsDataRecord(value, ["op", "challenge", "expectedCredentialGeneration"]);
       const challenge2 = parseMlsDevCredentialReconciliationChallenge(input2.challenge);
       const expectedCredentialGeneration2 = requireMlsInteger(input2.expectedCredentialGeneration);
-      if (challenge2.expectedCredentialGeneration !== expectedCredentialGeneration2) invalid10();
+      if (challenge2.expectedCredentialGeneration !== expectedCredentialGeneration2) invalid13();
       return bounded8({
         op: requireMlsLiteral(input2.op, "credential_reconciliation_proof"),
         challenge: challenge2,
         expectedCredentialGeneration: expectedCredentialGeneration2
       }, MLS_DEV_DEVICE_COMMAND_MAX_BYTES);
     }
-    if (descriptor.value !== "credential_proof") invalid10();
+    if (descriptor.value !== "credential_proof") invalid13();
     const input = readMlsDataRecord(value, ["op", "challenge", "registrationResult", "expectedCredentialGeneration"]);
     const challenge = parseMlsDevCredentialChallenge(input.challenge);
     const registrationResult = parseMlsDevEnrollmentResult(input.registrationResult);
     const expectedCredentialGeneration = requireMlsInteger(input.expectedCredentialGeneration);
-    if (expectedCredentialGeneration >= Number.MAX_SAFE_INTEGER || challenge.credential.claims.generation !== expectedCredentialGeneration + 1 || JSON.stringify(challenge.credential.claims.device) !== JSON.stringify(registrationResult.device)) invalid10();
+    if (expectedCredentialGeneration >= Number.MAX_SAFE_INTEGER || challenge.credential.claims.generation !== expectedCredentialGeneration + 1 || JSON.stringify(challenge.credential.claims.device) !== JSON.stringify(registrationResult.device)) invalid13();
     return bounded8({
       op: requireMlsLiteral(input.op, "credential_proof"),
       challenge,
@@ -4543,29 +4980,29 @@ function parseMlsDevDeviceCommand(value) {
   });
 }
 __name(parseMlsDevDeviceCommand, "parseMlsDevDeviceCommand");
-function encoded6(value, bytes) {
+function encoded7(value, bytes) {
   decodeCanonicalMlsBase64Url(value, bytes);
   return value;
 }
-__name(encoded6, "encoded");
+__name(encoded7, "encoded");
 function wrapped(value) {
-  if (typeof value !== "string" || value.length > MLS_DEV_DEVICE_WRAPPED_STATE_MAX_BYTES || !value.startsWith("v1:")) invalid10();
+  if (typeof value !== "string" || value.length > MLS_DEV_DEVICE_WRAPPED_STATE_MAX_BYTES || !value.startsWith("v1:")) invalid13();
   const body = value.slice(3);
-  if (body.length < 40 || body.length % 4 !== 0 || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(body)) invalid10();
+  if (body.length < 40 || body.length % 4 !== 0 || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(body)) invalid13();
   const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
-  if (body.endsWith("==") && (alphabet.indexOf(body.at(-3)) & 15) !== 0) invalid10();
-  if (!body.endsWith("==") && body.endsWith("=") && (alphabet.indexOf(body.at(-2)) & 3) !== 0) invalid10();
+  if (body.endsWith("==") && (alphabet.indexOf(body.at(-3)) & 15) !== 0) invalid13();
+  if (!body.endsWith("==") && body.endsWith("=") && (alphabet.indexOf(body.at(-2)) & 3) !== 0) invalid13();
   return value;
 }
 __name(wrapped, "wrapped");
 function parseMlsDevDevicePreparation(value, op) {
-  return boundary8(() => {
-    if (!["create", "enrollment_proof", "credential_proof", "credential_reconciliation_proof"].includes(op)) invalid10();
+  return boundary10(() => {
+    if (!["create", "enrollment_proof", "credential_proof", "credential_reconciliation_proof"].includes(op)) invalid13();
     const input = readMlsDataRecord(value, ["wrappedState", "payload"]);
     const payload = readMlsDataRecord(input.payload, op === "create" ? ["signaturePublicKey"] : ["signaturePublicKey", "proof"]);
     return bounded8({ wrappedState: wrapped(input.wrappedState), payload: Object.freeze({
-      signaturePublicKey: encoded6(payload.signaturePublicKey, 32),
-      ...op === "create" ? {} : { proof: encoded6(payload.proof, 64) }
+      signaturePublicKey: encoded7(payload.signaturePublicKey, 32),
+      ...op === "create" ? {} : { proof: encoded7(payload.proof, 64) }
     }) }, MLS_DEV_DEVICE_COMMAND_MAX_BYTES);
   });
 }
@@ -4586,56 +5023,56 @@ var MlsDevKeyPackageValidationError = class extends Error {
     this.name = "MlsDevKeyPackageValidationError";
   }
 };
-var utf87 = new TextEncoder();
-function invalid11() {
+var utf88 = new TextEncoder();
+function invalid14() {
   throw new MlsDevKeyPackageValidationError();
 }
-__name(invalid11, "invalid");
-function boundary9(read) {
+__name(invalid14, "invalid");
+function boundary11(read) {
   try {
     return read();
   } catch {
-    return invalid11();
+    return invalid14();
   }
 }
-__name(boundary9, "boundary");
+__name(boundary11, "boundary");
 function bounded9(value, maximum) {
-  if (utf87.encode(JSON.stringify(value)).length > maximum) invalid11();
+  if (utf88.encode(JSON.stringify(value)).length > maximum) invalid14();
   return Object.freeze(value);
 }
 __name(bounded9, "bounded");
-function encoded7(value, bytes) {
+function encoded8(value, bytes) {
   decodeCanonicalMlsBase64Url(value, bytes);
   return value;
 }
-__name(encoded7, "encoded");
-function wire2(value) {
-  if (typeof value !== "string" || value.length < 2 || value.length > Math.ceil(MLS_DEV_KEY_PACKAGE_WIRE_MAX_BYTES * 4 / 3)) invalid11();
+__name(encoded8, "encoded");
+function wire3(value) {
+  if (typeof value !== "string" || value.length < 2 || value.length > Math.ceil(MLS_DEV_KEY_PACKAGE_WIRE_MAX_BYTES * 4 / 3)) invalid14();
   const bytes = Math.floor(value.length * 3 / 4);
-  if (bytes < 1 || bytes > MLS_DEV_KEY_PACKAGE_WIRE_MAX_BYTES || value.length !== Math.ceil(bytes * 4 / 3) || !/^[A-Za-z0-9_-]+$/.test(value)) invalid11();
+  if (bytes < 1 || bytes > MLS_DEV_KEY_PACKAGE_WIRE_MAX_BYTES || value.length !== Math.ceil(bytes * 4 / 3) || !/^[A-Za-z0-9_-]+$/.test(value)) invalid14();
   const last = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_".indexOf(value.at(-1));
-  if (value.length % 4 === 2 && (last & 15) !== 0 || value.length % 4 === 3 && (last & 3) !== 0) invalid11();
+  if (value.length % 4 === 2 && (last & 15) !== 0 || value.length % 4 === 3 && (last & 3) !== 0) invalid14();
   return value;
 }
-__name(wire2, "wire");
+__name(wire3, "wire");
 function wrapped2(value) {
-  if (typeof value !== "string" || value.length > MLS_DEV_KEY_PACKAGE_WRAPPED_STATE_MAX_BYTES || !value.startsWith("v1:")) invalid11();
+  if (typeof value !== "string" || value.length > MLS_DEV_KEY_PACKAGE_WRAPPED_STATE_MAX_BYTES || !value.startsWith("v1:")) invalid14();
   const body = value.slice(3);
-  if (body.length < 40 || body.length % 4 !== 0 || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(body)) invalid11();
+  if (body.length < 40 || body.length % 4 !== 0 || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(body)) invalid14();
   const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
-  if (body.endsWith("==") && (alphabet.indexOf(body.at(-3)) & 15) !== 0) invalid11();
-  if (!body.endsWith("==") && body.endsWith("=") && (alphabet.indexOf(body.at(-2)) & 3) !== 0) invalid11();
+  if (body.endsWith("==") && (alphabet.indexOf(body.at(-3)) & 15) !== 0) invalid14();
+  if (!body.endsWith("==") && body.endsWith("=") && (alphabet.indexOf(body.at(-2)) & 3) !== 0) invalid14();
   const bytes = body.length / 4 * 3 - (body.endsWith("==") ? 2 : body.endsWith("=") ? 1 : 0);
-  if (bytes > 128 * 1024 + 28) invalid11();
+  if (bytes > 128 * 1024 + 28) invalid14();
   return value;
 }
 __name(wrapped2, "wrapped");
 function parseMlsDevKeyPackageId(value) {
-  return boundary9(() => requireMlsUuid(value));
+  return boundary11(() => requireMlsUuid(value));
 }
 __name(parseMlsDevKeyPackageId, "parseMlsDevKeyPackageId");
 function parseMlsDevKeyPackageCommand(value) {
-  return boundary9(() => {
+  return boundary11(() => {
     const input = readMlsDataRecord(value, ["version", "op", "keyPackageId", "credential"]);
     const token2 = parseMlsDevCredentialToken(input.credential);
     parseMlsDevEnrollmentPrincipal(token2.unsigned.claims.device.principal);
@@ -4649,7 +5086,7 @@ function parseMlsDevKeyPackageCommand(value) {
 }
 __name(parseMlsDevKeyPackageCommand, "parseMlsDevKeyPackageCommand");
 function parseMlsDevKeyPackagePayload(value) {
-  return boundary9(() => {
+  return boundary11(() => {
     const input = readMlsDataRecord(value, [
       "version",
       "keyPackageId",
@@ -4664,7 +5101,7 @@ function parseMlsDevKeyPackagePayload(value) {
       "expiresAtMs"
     ]);
     const notBeforeMs = requireMlsInteger(input.notBeforeMs), expiresAtMs = requireMlsInteger(input.expiresAtMs);
-    if (notBeforeMs % 1e3 !== 0 || expiresAtMs % 1e3 !== 0 || expiresAtMs <= notBeforeMs || expiresAtMs - notBeforeMs > 864e5) invalid11();
+    if (notBeforeMs % 1e3 !== 0 || expiresAtMs % 1e3 !== 0 || expiresAtMs <= notBeforeMs || expiresAtMs - notBeforeMs > 864e5) invalid14();
     return bounded9({
       version: requireMlsLiteral(input.version, 1),
       keyPackageId: requireMlsUuid(input.keyPackageId),
@@ -4672,9 +5109,9 @@ function parseMlsDevKeyPackagePayload(value) {
       credentialId: requireMlsUuid(input.credentialId),
       credentialGeneration: requireMlsInteger(input.credentialGeneration, 1),
       ciphersuite: requireMlsLiteral(input.ciphersuite, 1),
-      signaturePublicKey: encoded7(input.signaturePublicKey, 32),
-      keyPackage: wire2(input.keyPackage),
-      keyPackageRef: encoded7(input.keyPackageRef, 32),
+      signaturePublicKey: encoded8(input.signaturePublicKey, 32),
+      keyPackage: wire3(input.keyPackage),
+      keyPackageRef: encoded8(input.keyPackageRef, 32),
       notBeforeMs,
       expiresAtMs
     }, MLS_DEV_KEY_PACKAGE_PREPARATION_MAX_BYTES);
@@ -4682,7 +5119,7 @@ function parseMlsDevKeyPackagePayload(value) {
 }
 __name(parseMlsDevKeyPackagePayload, "parseMlsDevKeyPackagePayload");
 function parseMlsDevKeyPackagePreparation(value) {
-  return boundary9(() => {
+  return boundary11(() => {
     const input = readMlsDataRecord(value, ["wrappedState", "payload"]);
     return bounded9(
       { wrappedState: wrapped2(input.wrappedState), payload: parseMlsDevKeyPackagePayload(input.payload) },
@@ -4692,6 +5129,74 @@ function parseMlsDevKeyPackagePreparation(value) {
 }
 __name(parseMlsDevKeyPackagePreparation, "parseMlsDevKeyPackagePreparation");
 
+// ../backend-contracts/src/mlsPrincipalAlias.ts
+var MLS_PRINCIPAL_ALIAS_PREFIX = "mlsa_";
+var ALIAS_PATTERN = /^mlsa_[A-Za-z0-9_-]{43}$/;
+var utf89 = new TextEncoder();
+var domain3 = utf89.encode("canon.mls.principal-alias.v1\0");
+function invalid15() {
+  throw new Error("INVALID_MLS_PRINCIPAL_ALIAS");
+}
+__name(invalid15, "invalid");
+function isMlsPrincipalAlias(value) {
+  return typeof value === "string" && ALIAS_PATTERN.test(value);
+}
+__name(isMlsPrincipalAlias, "isMlsPrincipalAlias");
+function isMlsAccountId(value) {
+  return isMlsPrincipalId(value) && !value.includes("/") && value !== "." && value !== "..";
+}
+__name(isMlsAccountId, "isMlsAccountId");
+function accountId(value) {
+  if (!isMlsAccountId(value) || ALIAS_PATTERN.test(value)) invalid15();
+  return value;
+}
+__name(accountId, "accountId");
+function parseMlsPrincipalOpening(value) {
+  try {
+    const input = readMlsDataRecord(value, ["type", "accountId", "salt"]);
+    if (input.type !== "human" && input.type !== "ai_agent") invalid15();
+    decodeCanonicalMlsBase64Url(input.salt, 32);
+    return Object.freeze({ type: input.type, accountId: accountId(input.accountId), salt: input.salt });
+  } catch {
+    return invalid15();
+  }
+}
+__name(parseMlsPrincipalOpening, "parseMlsPrincipalOpening");
+function encodeMlsPrincipalAliasInput(environmentId, opening) {
+  const value = parseMlsPrincipalOpening(opening);
+  const environment = utf89.encode(requireMlsEnvironmentId(environmentId));
+  const id7 = utf89.encode(value.accountId);
+  const output = new Uint8Array(domain3.length + 4 + environment.length + 1 + 4 + id7.length + 32);
+  const view = new DataView(output.buffer);
+  let offset = 0;
+  const raw = /* @__PURE__ */ __name((bytes) => {
+    output.set(bytes, offset);
+    offset += bytes.length;
+  }, "raw");
+  const lp = /* @__PURE__ */ __name((bytes) => {
+    view.setUint32(offset, bytes.length);
+    offset += 4;
+    raw(bytes);
+  }, "lp");
+  raw(domain3);
+  lp(environment);
+  output[offset++] = value.type === "human" ? 0 : 1;
+  lp(id7);
+  raw(decodeCanonicalMlsBase64Url(value.salt, 32));
+  return output;
+}
+__name(encodeMlsPrincipalAliasInput, "encodeMlsPrincipalAliasInput");
+function parseMlsRoomIdentities(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) invalid15();
+  const output = /* @__PURE__ */ Object.create(null);
+  for (const [alias, opening] of Object.entries(readMlsDataRecord(value, Object.keys(value)))) {
+    if (!isMlsPrincipalAlias(alias)) invalid15();
+    output[alias] = parseMlsPrincipalOpening(opening);
+  }
+  return Object.freeze(output);
+}
+__name(parseMlsRoomIdentities, "parseMlsRoomIdentities");
+
 // ../endpoint/src/runtime-api-origins.generated.ts
 var RUNTIME_API_ORIGINS = {
   "canon-dev-v1": "https://dev.api.canonmail.com",
@@ -4699,76 +5204,86 @@ var RUNTIME_API_ORIGINS = {
 };
 
 // ../endpoint/src/mls-crypto.ts
-var MLS_DEV_DEVICE_HTTP_CONFIGURATION = Object.freeze({
-  enrollmentUrl: `${RUNTIME_API_ORIGINS["canon-dev-v1"]}/mls/enrollment`,
-  credentialUrl: `${RUNTIME_API_ORIGINS["canon-dev-v1"]}/mls/credential`,
-  reconciliationUrl: `${RUNTIME_API_ORIGINS["canon-dev-v1"]}/mls/reconciliation`,
-  keyPackagesUrl: `${RUNTIME_API_ORIGINS["canon-dev-v1"]}/mls/key-packages`,
-  trustedOrigins: Object.freeze([RUNTIME_API_ORIGINS["canon-dev-v1"]])
-});
-function invalid12() {
+function mlsDevDeviceHttpConfiguration(environmentId) {
+  if (!isMlsEnvironmentId(environmentId)) invalid16();
+  const origin = RUNTIME_API_ORIGINS[environmentId];
+  return Object.freeze({
+    enrollmentUrl: `${origin}/mls/enrollment`,
+    credentialUrl: `${origin}/mls/credential`,
+    reconciliationUrl: `${origin}/mls/reconciliation`,
+    keyPackagesUrl: `${origin}/mls/key-packages`,
+    trustedOrigins: Object.freeze([origin])
+  });
+}
+__name(mlsDevDeviceHttpConfiguration, "mlsDevDeviceHttpConfiguration");
+function invalid16() {
   throw new Error("MLS_DEV_CLIENT_CONFIGURATION_INVALID");
 }
-__name(invalid12, "invalid");
-function record3(value, keys2) {
-  if (!value || typeof value !== "object" || Array.isArray(value) || ![Object.prototype, null].includes(Object.getPrototypeOf(value))) invalid12();
-  const fields = Object.getOwnPropertyDescriptors(value);
-  if (Reflect.ownKeys(fields).length !== keys2.length || keys2.some((key2) => !Object.hasOwn(fields, key2) || !Object.hasOwn(fields[key2], "value"))) invalid12();
+__name(invalid16, "invalid");
+function record4(value, keys2) {
+  if (!value || typeof value !== "object" || Array.isArray(value) || ![Object.prototype, null].includes(Object.getPrototypeOf(value))) invalid16();
+  const fields2 = Object.getOwnPropertyDescriptors(value);
+  if (Reflect.ownKeys(fields2).length !== keys2.length || keys2.some((key) => !Object.hasOwn(fields2, key) || !Object.hasOwn(fields2[key], "value"))) invalid16();
   return value;
 }
-__name(record3, "record");
+__name(record4, "record");
 function primeOrderPoint(value) {
   const point = ed25519.Point.fromBytes(value, false);
   return !point.isSmallOrder() && point.isTorsionFree();
 }
 __name(primeOrderPoint, "primeOrderPoint");
-function issuerKeys(value) {
-  if (!Array.isArray(value) || value.length < 1 || value.length > 8) invalid12();
+function issuerKeys(value, environmentId, receipt = false) {
+  if (!Array.isArray(value) || value.length < 1 || value.length > 8) invalid16();
   const seen = /* @__PURE__ */ new Set();
-  return Object.freeze(Array.from(value, (item) => {
-    const key2 = record3(item, ["keyVersion", "signaturePublicKey"]);
-    const keyVersion = parseMlsDevIssuerKeyVersion(key2.keyVersion);
-    if (seen.has(keyVersion) || typeof key2.signaturePublicKey !== "string" || !primeOrderPoint(decodeCanonicalMlsBase64Url(key2.signaturePublicKey, 32))) invalid12();
+  let environment = environmentId;
+  return Object.freeze(Array.from(value, (item2) => {
+    const key = record4(item2, ["keyVersion", "signaturePublicKey"]);
+    const keyVersion = receipt ? parseMlsDevReceiptKeyVersion(key.keyVersion, environment) : parseMlsDevIssuerKeyVersion(key.keyVersion, environment);
+    environment ??= receipt ? mlsEnvironmentOfReceiptKeyVersion(keyVersion) : mlsEnvironmentOfIssuerKeyVersion(keyVersion);
+    if (seen.has(keyVersion) || typeof key.signaturePublicKey !== "string" || !primeOrderPoint(decodeCanonicalMlsBase64Url(key.signaturePublicKey, 32))) invalid16();
     seen.add(keyVersion);
-    return Object.freeze({ keyVersion, signaturePublicKey: key2.signaturePublicKey });
+    return Object.freeze({ keyVersion, signaturePublicKey: key.signaturePublicKey });
   }));
 }
 __name(issuerKeys, "issuerKeys");
 function parseMlsDevClientConfiguration(value) {
   try {
-    const input = record3(value, ["version", "environmentId", "enabled", "principalIds", "issuerKeys"]);
-    if (input.version !== 1 || input.environmentId !== "canon-dev-v1" || input.enabled !== true || !Array.isArray(input.principalIds) || input.principalIds.length < 1 || input.principalIds.length > 100) invalid12();
-    const principalIds = Array.from(input.principalIds, (id6) => parseMlsDevEnrollmentPrincipal({ type: "human", id: id6 }).id);
-    if (new Set(principalIds).size !== principalIds.length) invalid12();
+    const listed = !!value && typeof value === "object" && Object.hasOwn(value, "principalIds");
+    const input = record4(value, ["version", "environmentId", "enabled", ...listed ? ["principalIds"] : [], "issuerKeys", "receiptKeys"]);
+    if (input.version !== 1 || !isMlsEnvironmentId(input.environmentId) || input.enabled !== true || listed && (!Array.isArray(input.principalIds) || input.principalIds.length < 1 || input.principalIds.length > 100)) invalid16();
+    const environmentId = input.environmentId;
+    const principalIds = listed ? Array.from(input.principalIds, (id7) => parseMlsDevEnrollmentPrincipal({ type: "human", id: id7 }).id) : void 0;
+    if (principalIds && new Set(principalIds).size !== principalIds.length) invalid16();
     return Object.freeze({
       version: 1,
-      environmentId: "canon-dev-v1",
+      environmentId,
       enabled: true,
-      principalIds: Object.freeze(principalIds),
-      issuerKeys: issuerKeys(input.issuerKeys)
+      ...principalIds ? { principalIds: Object.freeze(principalIds) } : {},
+      issuerKeys: issuerKeys(input.issuerKeys, environmentId),
+      receiptKeys: issuerKeys(input.receiptKeys, environmentId, true)
     });
   } catch {
-    return invalid12();
+    return invalid16();
   }
 }
 __name(parseMlsDevClientConfiguration, "parseMlsDevClientConfiguration");
 function createMlsDevCredentialVerifier(options) {
   let trusted;
   try {
-    trusted = new Map(issuerKeys(options.issuerKeys).map((key2) => [key2.keyVersion, key2.signaturePublicKey]));
+    trusted = new Map(issuerKeys(options.issuerKeys).map((key) => [key.keyVersion, key.signaturePublicKey]));
   } catch {
-    return invalid12();
+    return invalid16();
   }
   const clock = options.clock ?? Date.now;
   return async (value) => {
     try {
       const receipt = parseMlsDevCredentialReceipt(value);
       const parsed = parseMlsDevCredentialToken(receipt.credential);
-      const key2 = trusted.get(parsed.unsigned.keyVersion);
+      const key = trusted.get(parsed.unsigned.keyVersion);
       const now = clock();
       const { issuedAtMs, expiresAtMs } = parsed.unsigned.claims;
-      if (!key2 || !Number.isSafeInteger(now) || now < issuedAtMs || now >= expiresAtMs) return false;
-      const publicKey = decodeCanonicalMlsBase64Url(key2, 32);
+      if (!key || !Number.isSafeInteger(now) || now < issuedAtMs || now >= expiresAtMs) return false;
+      const publicKey = decodeCanonicalMlsBase64Url(key, 32);
       const signature = decodeCanonicalMlsBase64Url(parsed.signature, 64);
       if (!primeOrderPoint(publicKey) || !primeOrderPoint(signature.subarray(0, 32))) return false;
       return ed25519.verify(signature, new TextEncoder().encode(parsed.signingInput), publicKey, { zip215: false });
@@ -4782,7 +5297,16 @@ __name(createMlsDevCredentialVerifier, "createMlsDevCredentialVerifier");
 export {
   __name,
   getCanonEnvironmentContract,
+  CANON_CLIENT_HEADER,
+  CLIENT_UPDATE_REQUIRED,
+  isCanonClientVersion,
+  formatCanonClientHeader,
   sanitizeDownloadFileName,
+  describeAttachment,
+  isCanonMediaOrigin,
+  isCanonUploadUrl,
+  resolveAllowedUploadMimeType,
+  isMlsEnvironmentId,
   MLS_DEV_ENROLLMENT_MAX_BYTES,
   parseMlsDevEnrollmentPrincipal,
   parseMlsDevEnrollmentBegin,
@@ -4799,6 +5323,8 @@ export {
   createMlsDevCredentialSigningInput,
   parseMlsDevCredentialToken,
   parseMlsDevCredentialReceipt,
+  MLS_DEV_GROUP_RECEIPT_CLOCK_SKEW,
+  isMlsDevReceiptClockSkew,
   parseMlsDevGroupFeedEntry,
   parseMlsDevGroupFeedQuery,
   parseMlsDevGroupFeedResult,
@@ -4808,23 +5334,36 @@ export {
   parseMlsDevKeyPackagePublicationReceipt,
   parseMlsDevKeyPackageClaim,
   parseMlsDevKeyPackageClaimReceipt,
+  MLS_DEV_INTERACTION_LIMITS,
+  parseMlsDevInteractionRequestBody,
+  parseMlsDevInteractionResponseBody,
+  parseMlsDevInteractionWithdrawBody,
+  parseMlsDevApplicationPayload,
+  assertMlsDevInteractionPayloadBinding,
+  isMlsDevInteractionAnswerAllowed,
   parseMlsDevGroupCreateConversation,
   parseMlsDevGroupHead,
   parseMlsDevGroupMarker,
   parseMlsDevGroupRoster,
+  parseMlsDevRoomRemoval,
   parseMlsDevGroupControl,
   parseMlsDevGroupAcceptedControl,
+  parseMlsDevGroupAdmissionsResult,
   parseMlsDevGroupQuery,
   parseMlsDevGroupQueryResult,
   parseMlsDevGroupContext,
   parseMlsDevGroupCommand,
   parseMlsDevGroupPreparation,
-  MLS_DEV_TEXT_PROTOCOL,
+  MLS_DEV_TEXT_PROTOCOL_V3,
+  isMlsDevTextProtocol,
+  mlsDevProtocolCarriesCards,
+  MLS_DEV_REPLY_QUOTE_MAX_CHARACTERS,
+  MLS_DEV_TEXT_MAX_BYTES,
   parseMlsDevApplicationReceipt,
   parseMlsDevTextPayload,
+  parseMlsDevItemPayload,
   encodeMlsDevApplicationEnvelopeHash,
   RUNTIME_CARD_FIELD_TYPES,
-  RUNTIME_CARD_LIMITS,
   RUNTIME_CARD_LINE_ITEM_COLUMN_TYPES,
   readMembershipChangeMetadata,
   formatMembershipChangeNotice,
@@ -4850,36 +5389,20 @@ export {
   ENDPOINT_ID_PATTERN,
   ENDPOINT_ACTION_PATTERN,
   isEndpointOperationReceipt,
+  CONNECTOR_RELAY_INSTALLATION_PREFIX,
+  CONNECTOR_RELAY_INSTALLATION_PATTERN,
+  isConnectorRelayInstallation,
+  isConnectorRelayCredential,
+  CONNECTOR_RELAY_MAX_BODY_BYTES,
+  CONNECTOR_RELAY_MAX_RESPONSE_BYTES,
+  CONNECTOR_RELAY_ANSWER_WITHIN_MS,
+  connectorRelayResponseBytes,
+  ConnectorRelayRequestError,
+  parseConnectorRelayRequest,
   mergeDeliveryObservation,
   projectDeliveryStatus,
   classifyTransferHttpFailure,
   classifyTransferReceipt,
-  ARTIFACT_PROTOCOL_VERSION,
-  ARTIFACT_PROTOCOL_MIN_VERSION,
-  artifactSchemaName,
-  ARTIFACT_COMMAND_MAX_BYTES,
-  ARTIFACT_STATE_MAX_BYTES,
-  ARTIFACT_KINDS,
-  ARTIFACT_COMMAND_TYPES,
-  ARTIFACT_LIMITS,
-  isArtifactId,
-  isArtifactKey,
-  ArtifactValidationError,
-  quoteArtifactText,
-  artifactSingleLine,
-  roundFormNumber,
-  validateFormValue,
-  formValuesEqual,
-  formatFormValue,
-  normalizeFormField,
-  normalizeFormCells,
-  normalizeFormInput,
-  artifactToolInputSchemas,
-  parseArtifactCreateAction,
-  parseArtifactUpdateAction,
-  parseArtifactImageRegion,
-  parseArtifactGenerateImageAction,
-  parseArtifactAddImageAction,
   MLS_DEV_CREDENTIAL_RECONCILIATION_MAX_BYTES,
   parseMlsDevCredentialReconciliationBegin,
   parseMlsDevCredentialReconciliationChallenge,
@@ -4893,7 +5416,12 @@ export {
   parseMlsDevKeyPackageCommand,
   parseMlsDevKeyPackagePayload,
   parseMlsDevKeyPackagePreparation,
-  MLS_DEV_DEVICE_HTTP_CONFIGURATION,
+  MLS_PRINCIPAL_ALIAS_PREFIX,
+  isMlsPrincipalAlias,
+  parseMlsPrincipalOpening,
+  encodeMlsPrincipalAliasInput,
+  parseMlsRoomIdentities,
+  mlsDevDeviceHttpConfiguration,
   parseMlsDevClientConfiguration,
   createMlsDevCredentialVerifier
 };