@canonmsg/agent-sdk 13.2.1 → 13.3.0

package/dist/chunks/{chunk-HTLKCUQG.js → chunk-AVR7QCHK.js}

@@ -5,8 +5,9 @@ import {
   createHttpEndpointTransport,
   createNodeEndpointStore,
   validateEndpointContentBoundary
-} from "./chunk-BPSFHEAA.js";
+} from "./chunk-HFT75BNB.js";
 import {
+  AGENT_HOME_ELSEWHERE,
   CANON_ENDPOINT_PROTOCOL,
   CANON_VERB_WIRE_SCHEMA_VERSION,
   ENDPOINT_ACTION_PATTERN,
@@ -15,6 +16,7 @@ import {
   MLS_DEV_DISCLOSED_PROCESSING_FIELDS,
   MLS_DEV_GROUP_RECEIPT_CLOCK_SKEW,
   MLS_DEV_INTERACTION_LIMITS,
+  MLS_DEV_KEY_PACKAGE_CLAIM_LEASE_MS,
   MLS_DEV_REPLY_QUOTE_MAX_CHARACTERS,
   MLS_DEV_TEXT_PROTOCOL_V3,
   MLS_DEV_UNSUPPORTED_CONTENT_ACTIONS,
@@ -22,6 +24,7 @@ import {
   RUNTIME_CARD_FIELD_TYPES,
   RUNTIME_CARD_LINE_ITEM_COLUMN_TYPES,
   __name,
+  agentHomeElsewhereMessage,
   assertMlsDevInteractionPayloadBinding,
   canonicalEndpointJson,
   createMlsDevCredentialSigningInput,
@@ -36,6 +39,7 @@ import {
   getCanonEnvironmentContract,
   isCanonMediaOrigin,
   isCanonUploadUrl,
+  isConnectorRelayInstallation,
   isMlsDevInteractionAnswerAllowed,
   isMlsDevTextProtocol,
   isMlsEnvironmentId,
@@ -104,7 +108,7 @@ import {
   readMembershipChangeMetadata,
   resolveAllowedUploadMimeType,
   sanitizeDownloadFileName
-} from "./chunk-VIS5WXNH.js";
+} from "./chunk-CUPSYLBV.js";
 
 // src/media.ts
 import { createWriteStream as createWriteStream2 } from "node:fs";
@@ -1315,19 +1319,22 @@ async function recordMlsInteractionProjection(tx, event, timestamp) {
   await tx.put(key2, { event: copyJson(event), state: "settled", reason: "mls_interaction", createdAt: timestamp, updatedAt: timestamp });
 }
 __name(recordMlsInteractionProjection, "recordMlsInteractionProjection");
+var WORK_FLOOR_KEY = "recovery/work-floor";
+var beforeWorkFloor = /* @__PURE__ */ __name((floor, acceptedAt) => !!floor && Date.parse(acceptedAt) < Date.parse(floor.cutoverAt), "beforeWorkFloor");
 async function recordVerifiedMlsInboundEvent(tx, event, feedOrdinal, timestamp, own = false) {
   if (!event.conversationId || !Number.isSafeInteger(feedOrdinal) || feedOrdinal < 1) throw new Error("Invalid verified MLS input");
   const key2 = `inbound/${event.id}`, existing = await tx.get(key2);
   if (existing && existing.reason !== "mls_plaintext_withheld") return false;
+  const history = !own && beforeWorkFloor(await tx.get(WORK_FLOOR_KEY), timestamp);
   const record6 = {
     event: copyJson(event),
-    state: own ? "settled" : "observed",
-    ...own ? { reason: "own_mls_message" } : { queueKey: `inbound-ready/${encodeURIComponent(event.conversationId)}/mls/${String(feedOrdinal).padStart(16, "0")}/${encodeURIComponent(event.id)}` },
+    state: own || history ? "settled" : "observed",
+    ...own ? { reason: "own_mls_message" } : history ? { reason: "before_take_over" } : { queueKey: `inbound-ready/${encodeURIComponent(event.conversationId)}/mls/${String(feedOrdinal).padStart(16, "0")}/${encodeURIComponent(event.id)}` },
     createdAt: timestamp,
     updatedAt: timestamp
   };
   await tx.put(key2, record6);
-  if (!own) await enqueueInbound(tx, record6);
+  if (!own && !history) await enqueueInbound(tx, record6);
   return true;
 }
 __name(recordVerifiedMlsInboundEvent, "recordVerifiedMlsInboundEvent");
@@ -2261,7 +2268,7 @@ function createEndpointMediaPipeline(options) {
           const progress = /* @__PURE__ */ __name((phase) => resumeOptions?.onProgress?.({ phase, totalBytes, uploadedBytes: offsets.reduce((sum, offset) => sum + offset, 0) }), "progress");
           const publicationOperationId = /* @__PURE__ */ __name(() => `message:${flow.conversationId}:${flow.messageId}${flow.publicationGeneration ? `:g${flow.publicationGeneration}` : ""}`, "publicationOperationId");
           const publish = /* @__PURE__ */ __name(async (reconciling = false) => {
-            if (!reconciling && flow.requiresPublicationApproval && !await publicationGuards.get(id2)?.check()) {
+            if (!reconciling && flow.requiresPublicationApproval && !await publicationGuards.get(id2)?.check({ automaticResend: false })) {
               throw new EndpointError("Attachment publication requires a current audience approval", { code: "MEDIA_PUBLICATION_APPROVAL_REQUIRED", retryable: true });
             }
             flow.status = "sending";
@@ -4969,6 +4976,12 @@ var appIntentKey = /* @__PURE__ */ __name((operationId) => `mls-dev-group/applic
 var appOperationKey = /* @__PURE__ */ __name((deviceId, operationId) => `mls-dev-group/application-operation/${encodeURIComponent(deviceId)}/${encodeURIComponent(operationId)}`, "appOperationKey");
 var acceptedReceiptKey = /* @__PURE__ */ __name((operationId) => `mls-dev-group/accepted-receipt/${encodeURIComponent(operationId)}`, "acceptedReceiptKey");
 var appMessageKey = /* @__PURE__ */ __name((cid, messageId) => `mls-dev-group/application-id/${encodeURIComponent(cid)}/${encodeURIComponent(messageId)}`, "appMessageKey");
+var BEHIND_CODES = ["MLS_DEV_GROUP_HEAD_CHANGED", "MLS_DEV_GROUP_ADMISSION_CHANGED"];
+var MLS_DEV_RESEND_MAX = 3;
+var readersOf = /* @__PURE__ */ __name((roster) => [...new Set(roster.flatMap(({ device: { principal, installationId } }) => [
+  `${principal.type}:${principal.id}`,
+  ...isConnectorRelayInstallation(installationId) ? [`relay:${installationId}`] : []
+]))].sort(), "readersOf");
 var same6 = /* @__PURE__ */ __name((a, b) => canonicalEndpointJson(a) === canonicalEndpointJson(b), "same");
 async function roomRemoval(tx, conversationId) {
   const room = await tx.get(`conversation/${conversationId}`);
@@ -4996,6 +5009,10 @@ function fail6(code = "MLS_DEV_GROUP_STATE_INVALID", retryable = false) {
   throw new EndpointError(code, { code, retryable });
 }
 __name(fail6, "fail");
+function admissionOf(operation) {
+  return operation.request?.body.value?.preconditions?.admissionId;
+}
+__name(admissionOf, "admissionOf");
 function id(value) {
   if (typeof value !== "string" || !ENDPOINT_ID_PATTERN.test(value) || value === "." || value === "..") fail6("INVALID_MLS_DEV_GROUP_INPUT");
   return value;
@@ -5739,9 +5756,10 @@ function createMlsDevGroups(options, context, keyPackages, bridge) {
       const room = await tx.get(`conversation/${conversationId}`);
       const group = envelope((await readPreparationSnapshot(tx, scope4(conversationId))).protocolState, init.binding, conversationId);
       const missed = await tx.get(missedEarlierKey(conversationId)) === true ? { missedEarlier: true } : {};
+      const outside = !!room && !!room.mls && (!group || group.removed);
+      const noted = { ...missed, ...outside ? { outside: true } : {} };
       if (room?.mlsAdmissionHold !== true) {
-        const joining = !!room && !!room.mls && (!group || group.removed);
-        return Object.freeze({ held: joining, waitingPrincipalIds: Object.freeze(joining ? [init.identity.principalId] : []), ...missed });
+        return Object.freeze({ held: outside, waitingPrincipalIds: Object.freeze(outside ? [init.identity.principalId] : []), ...noted });
       }
       const accounts = mlsRoomAccounts(room, init.binding.environmentId);
       const admitted = new Set((group && !group.removed ? group.roster : []).map((entry) => mlsAccountOf(accounts, entry.device.principal)));
@@ -5754,7 +5772,7 @@ function createMlsDevGroups(options, context, keyPackages, bridge) {
         joinedAtMs: Number(room.mlsMemberJoinedAtMs),
         nowMs: context.clock()
       });
-      return Object.freeze({ held: waiting.length > 0, waitingPrincipalIds: Object.freeze(waiting), ...missed });
+      return Object.freeze({ held: waiting.length > 0, waitingPrincipalIds: Object.freeze(waiting), ...noted });
     });
   }
   __name(admissionHold, "admissionHold");
@@ -5762,7 +5780,7 @@ function createMlsDevGroups(options, context, keyPackages, bridge) {
     if ((await admissionHold(conversationId)).held) fail6("MLS_DEV_GROUP_ADMISSION_PENDING", true);
   }
   __name(assertNotHeld, "assertNotHeld");
-  async function sendText(input, operationId, guardId) {
+  async function sendText(input, operationId, guardId, resend) {
     const cid = input.conversationId, init = await initialized();
     const authoredHash = await bridge.hash(canonicalEndpointJson(guardId ? { ...input, guardId } : input));
     async function existing(tx) {
@@ -5774,10 +5792,11 @@ function createMlsDevGroups(options, context, keyPackages, bridge) {
     __name(existing, "existing");
     const previous = await store.transaction(existing);
     if (previous) return previous;
-    if (!await caughtUp(cid)) await refresh(cid);
+    if (resend || !await caughtUp(cid)) await refresh(cid);
     await assertNotHeld(cid);
     const messageId = input.messageId ?? id(context.ids());
     let captured, replyTo;
+    let replaced, written;
     const operation = await prepareAndCommitContent({
       store,
       scope: scope4(cid),
@@ -5785,7 +5804,9 @@ function createMlsDevGroups(options, context, keyPackages, bridge) {
       existing: /* @__PURE__ */ __name(async (tx, state) => {
         const previous2 = await existing(tx);
         if (previous2) return previous2;
-        if (await tx.get(appMessageKey(cid, messageId)) !== void 0 || await tx.get(mlsDevTextMessageKey(cid, messageId)) !== void 0) fail6("MLS_DEV_APPLICATION_ID_CONFLICT");
+        const mapped = await tx.get(appMessageKey(cid, messageId)), local = await tx.get(mlsDevTextMessageKey(cid, messageId));
+        if (resend ? mapped !== resend.previous.operationId || local?.message.operationId !== resend.previous.operationId || local.feedOrdinal !== null || local.deleted : mapped !== void 0 || local !== void 0) fail6("MLS_DEV_APPLICATION_ID_CONFLICT");
+        written = local?.createdAtMs;
         const current = await capture(tx, state, init, cid), group = current.envelope;
         if (!isMlsDevTextProtocol(current.protocol)) fail6("MLS_DEV_TEXT_PROTOCOL_UNSUPPORTED");
         if ((input.replyTo || input.mentions || input.item) && current.protocol !== MLS_DEV_TEXT_PROTOCOL_V3) fail6("MLS_DEV_TEXT_ONLY");
@@ -5794,7 +5815,8 @@ function createMlsDevGroups(options, context, keyPackages, bridge) {
           if (!Array.isArray(members) || input.mentions.some((mention) => !members.includes(mention))) fail6("MLS_DEV_MENTION_NOT_MEMBER");
         }
         if (input.item && !canonItemReference(input.item, cid, init.binding.environmentId)) fail6("MLS_DEV_ITEM_INVALID");
-        if (input.replyTo) {
+        if (resend?.replyTo) replyTo = resend.replyTo;
+        else if (input.replyTo) {
           const quote = mlsDevReplyQuote(await tx.get(mlsDevTextMessageKey(cid, input.replyTo)), MLS_DEV_REPLY_QUOTE_MAX_CHARACTERS);
           replyTo = { messageId: input.replyTo, quote: quote ?? fail6("MLS_DEV_REPLY_UNAVAILABLE") };
         }
@@ -5802,6 +5824,7 @@ function createMlsDevGroups(options, context, keyPackages, bridge) {
         await assertRoomOpen(tx, cid, group.roster);
         if (group.pending) fail6("MLS_DEV_GROUP_PENDING_CONTROL", true);
         if (!same6(group.head, current.authority?.marker?.head)) fail6("MLS_DEV_GROUP_HEAD_CHANGED", true);
+        if (resend?.readers && (readersOf(group.roster).some((reader) => !resend.readers.includes(reader)) || current.authority?.admissionId !== admissionOf(resend.previous))) fail6("MLS_DEV_RESEND_AUDIENCE_CHANGED");
         captured = current;
         return void 0;
       }, "existing"),
@@ -5853,8 +5876,24 @@ function createMlsDevGroups(options, context, keyPackages, bridge) {
       commit: /* @__PURE__ */ __name(async (tx, prepared, state) => {
         const current = await capture(tx, state, init, cid);
         if (current.fingerprint !== prepared.fingerprint) fail6("MLS_DEV_GROUP_DEPENDENCY_CHANGED", true);
-        const createdAtMs = context.clock(), timestamp = new Date(createdAtMs).toISOString();
-        await tx.put(appIntentKey(operationId), { version: 1, authoredHash, envelope: prepared.wire, envelopeHash: prepared.envelopeHash });
+        const timestamp = new Date(context.clock()).toISOString();
+        let queueOrder;
+        if (resend) {
+          const before = await tx.get(`operation/${resend.previous.operationId}`);
+          const settled = before && resend.receipt ? await bridge.settle(tx, before, resend.receipt, false) : before;
+          if (settled?.status !== "rejected" || settled.resentAs) fail6("MLS_DEV_RESEND_UNAVAILABLE");
+          if (resend.receipt) queueOrder = settled.queueOrder;
+          replaced = { ...settled, resentAs: operationId, updatedAt: timestamp };
+          await tx.put(`operation/${settled.operationId}`, replaced);
+        }
+        await tx.put(appIntentKey(operationId), {
+          version: 1,
+          authoredHash,
+          envelope: prepared.wire,
+          envelopeHash: prepared.envelopeHash,
+          readers: resend?.readers ?? readersOf(current.envelope.roster),
+          resends: resend?.resends ?? 0
+        });
         await tx.put(appMessageKey(cid, messageId), operationId);
         await putMlsDevTextMessage(tx, {
           version: 1,
@@ -5862,7 +5901,7 @@ function createMlsDevGroups(options, context, keyPackages, bridge) {
           senderId: init.binding.principal.id,
           senderType: principal.type,
           status: "queued",
-          createdAtMs,
+          createdAtMs: written ?? context.clock(),
           feedOrdinal: null
         });
         const media = prepared.text.kind === "item" ? { mediaUploadIds: [prepared.text.item.uploadId] } : {};
@@ -5875,7 +5914,9 @@ function createMlsDevGroups(options, context, keyPackages, bridge) {
           messageId,
           fingerprint: prepared.envelopeHash,
           ordering: "conversation",
+          ...queueOrder === void 0 ? {} : { queueOrder },
           ...guardId ? { guardId } : {},
+          ...resend?.receipt ? { automaticResend: true } : {},
           sensitive: false,
           status: "queued",
           attempts: 0,
@@ -5893,10 +5934,45 @@ function createMlsDevGroups(options, context, keyPackages, bridge) {
         });
       }, "commit")
     });
+    if (replaced) await bridge.afterReceipt(replaced);
     bridge.submitted(operation);
     return operation;
   }
   __name(sendText, "sendText");
+  async function resendText(operation, receipt) {
+    const cid = operation.conversationId, messageId = operation.messageId;
+    if (operation.action !== "mls_application" || !cid || !messageId) return void 0;
+    if (receipt && (receipt.status !== "rejected" || !BEHIND_CODES.includes(receipt.error?.code ?? ""))) return void 0;
+    const { intent: intent2, local } = await store.transaction(async (tx) => ({
+      intent: await tx.get(appIntentKey(operation.operationId)),
+      local: await tx.get(mlsDevTextMessageKey(cid, messageId))
+    }));
+    const message = local?.message;
+    if (!intent2 || !local || local.deleted || local.feedOrdinal !== null || message?.operationId !== operation.operationId || message.kind !== "text" && message.kind !== "item") return void 0;
+    if (receipt && (!intent2.readers || (intent2.resends ?? 0) >= MLS_DEV_RESEND_MAX)) return void 0;
+    const { replyTo, mentions, ...item } = message.kind === "item" ? message.item : { replyTo: message.replyTo, mentions: message.mentions };
+    const replyAuthority = operation.request?.body.value.replyAuthority;
+    const input = {
+      conversationId: cid,
+      messageId,
+      ...message.kind === "item" ? { item } : { text: message.text },
+      ...replyTo ? { replyTo: replyTo.messageId } : {},
+      ...mentions?.length ? { mentions: [...mentions] } : {},
+      ...replyAuthority ? { replyAuthority } : {}
+    };
+    const successor = id(await bridge.hash(canonicalEndpointJson(["canon.mls.dev-resend.v1", operation.operationId])));
+    try {
+      return await sendText(input, successor, operation.guardId, {
+        previous: operation,
+        ...replyTo ? { replyTo } : {},
+        ...receipt ? { receipt, readers: intent2.readers, resends: (intent2.resends ?? 0) + 1 } : { resends: 0 }
+      });
+    } catch (error) {
+      if (!receipt || !(error instanceof EndpointError) || error.retryable || ["ENDPOINT_CLOSED", "PREPARATION_INSTALLATION_FENCED"].includes(error.code)) throw error;
+      return void 0;
+    }
+  }
+  __name(resendText, "resendText");
   async function holdText(input, operationId) {
     const cid = input.conversationId;
     if (input.item || input.replyAuthority || typeof input.text !== "string") return sendText(input, operationId);
@@ -6743,6 +6819,11 @@ function createMlsDevGroups(options, context, keyPackages, bridge) {
       const input = textInput(value), selectedId = id(operationId), selectedGuard = guardId === void 0 ? void 0 : id(guardId);
       return run(() => serializeInboundPreparation(store, input.conversationId, () => sendText(input, selectedId, selectedGuard)));
     },
+    /** A person's Retry of a text or item Canon refused: encrypted again for the room as it is now (`resendText`). */
+    resendText(operation) {
+      const cid = id(operation.conversationId);
+      return run(() => serializeInboundPreparation(store, cid, () => resendText(operation)));
+    },
     /** `sendText` for a person's composer: in a held room the text is kept, not refused (undefined), until `sendHeldTexts`. */
     holdText(value, operationId) {
       const input = textInput(value), selectedId = id(operationId);
@@ -6790,9 +6871,9 @@ function createMlsDevGroups(options, context, keyPackages, bridge) {
         return receipt;
       });
     },
-    async settleReceipt(operation, receipt) {
+    async settleReceipt(operation, receipt, options2) {
       if (!["mls_group_control", "mls_application"].includes(operation.action)) return false;
-      if (operation.action === "mls_application" && receipt.status !== "succeeded") return false;
+      if (operation.action === "mls_application" && receipt.status !== "succeeded") return !options2?.reconcileOnly && receipt.status === "rejected" && BEHIND_CODES.includes(receipt.error?.code ?? "") && !!operation.conversationId && await run(() => serializeInboundPreparation(store, operation.conversationId, () => resendText(operation, receipt))) !== void 0;
       if (receipt.status === "succeeded" && isMlsDevTextProtocol(await bridge.resolveProtocol?.(operation.conversationId ?? fail6()))) {
         const cid = operation.conversationId;
         const accepted2 = operation.action === "mls_application" ? parseMlsDevApplicationReceipt(receipt.result) : parseMlsDevGroupAcceptedControl(receipt.result);
@@ -6878,6 +6959,8 @@ function terminal(status) {
   return status === "succeeded" || status === "rejected";
 }
 __name(terminal, "terminal");
+var TAKE_OVER_OPERATION = "initialize-endpoint:take-over:";
+var TAKE_OVER_DISCARDED = "A take-over is not sent again by itself; start the runner with --take-over again";
 function safeError(error) {
   return error instanceof EndpointError ? error : new EndpointError("Canon delivery is deferred until the connection recovers");
 }
@@ -6969,6 +7052,19 @@ function createEndpoint(options) {
     return identity;
   });
   void initialization.catch(() => void 0);
+  const opened = initialization.then(() => store.transaction(async (tx) => {
+    for (let after; ; ) {
+      const page = await tx.scan("outbox/", { ...after ? { after } : {}, limit: 100 });
+      for (const entry of page) {
+        if (!entry.value.operationId.startsWith(TAKE_OVER_OPERATION)) continue;
+        const operation = await tx.get(key2(entry.value.operationId));
+        if (operation && !terminal(operation.status)) await discardOperation(tx, operation, TAKE_OVER_DISCARDED);
+      }
+      if (page.length < 100) return;
+      after = page.at(-1).key;
+    }
+  }));
+  void opened.catch(() => void 0);
   let mlsPrincipal;
   function readMlsPrincipalId() {
     mlsPrincipal ??= (async () => {
@@ -7180,6 +7276,7 @@ function createEndpoint(options) {
   const admissionTimers = /* @__PURE__ */ new Map();
   const ADMISSION_IDLE_MS = 10 * 6e4, CLAIM_JOURNAL_KEEP_MS = 60 * 6e4;
   const admissionUnfinished = /* @__PURE__ */ new Set();
+  const announcementLooks = /* @__PURE__ */ new Map();
   const claimAdds = /* @__PURE__ */ new Map(), CLAIM_ADDS_MAX = 3;
   const admissionRetry = { initial: options.mlsAdmissionRetryMs?.initial ?? 3e4, maximum: options.mlsAdmissionRetryMs?.maximum ?? 12e4 };
   function scheduleAdmission(conversationId, delayMs, discover = false) {
@@ -7206,13 +7303,24 @@ function createEndpoint(options) {
     const inRoster = new Set(group.roster.map((entry) => mlsAccountOf(accounts, entry.device.principal)));
     const invitee = local?.mlsInviteeId;
     const missing = [...local?.memberIds ?? [], ...typeof invitee === "string" ? [invitee] : []].some((memberId) => !inRoster.has(memberId)) || admissionUnfinished.has(conversationId);
-    if (!missing) admissionDelays.delete(conversationId);
-    const delay = admissionDelays.get(conversationId) ?? admissionRetry.initial;
     const announced = local?.mlsDeviceAnnouncedAtMs;
-    const due = announced !== announcementsSeen.get(conversationId) ? -Infinity : (admissionRuns.get(conversationId) ?? -Infinity) + (missing ? delay : ADMISSION_IDLE_MS);
-    if (clock() < due) return missing ? scheduleAdmission(conversationId, due - clock()) : void 0;
+    const fresh = announced !== announcementsSeen.get(conversationId);
+    if ((announcementLooks.get(conversationId)?.roster ?? Infinity) < group.roster.length) announcementLooks.delete(conversationId);
+    const look = announcementLooks.get(conversationId), retrying = missing || !!look;
+    if (!retrying) admissionDelays.delete(conversationId);
+    const delay = admissionDelays.get(conversationId) ?? admissionRetry.initial;
+    let due = fresh ? -Infinity : (admissionRuns.get(conversationId) ?? -Infinity) + (retrying ? delay : ADMISSION_IDLE_MS);
+    if (look && !missing) due = Math.min(due, look.untilMs);
+    if (clock() < due) return retrying ? scheduleAdmission(conversationId, due - clock()) : void 0;
     admitting.add(conversationId);
+    const watched = announcementsSeen.has(conversationId);
     announcementsSeen.set(conversationId, announced);
+    if (fresh && typeof announced === "number" && (watched || clock() < announced + MLS_DEV_KEY_PACKAGE_CLAIM_LEASE_MS)) {
+      announcementLooks.set(conversationId, {
+        untilMs: clock() + MLS_DEV_KEY_PACKAGE_CLAIM_LEASE_MS + admissionRetry.initial,
+        roster: group.roster.length
+      });
+    }
     try {
       admissionRuns.set(conversationId, clock());
       await mlsDevKeyPackages.pruneClaims(clock() - CLAIM_JOURNAL_KEEP_MS);
@@ -7270,13 +7378,16 @@ function createEndpoint(options) {
         admissionRuns.delete(conversationId);
         admissionDelays.delete(conversationId);
         admissionUnfinished.delete(conversationId);
+        announcementLooks.delete(conversationId);
         return scheduleAdmission(conversationId, admissionRetry.initial);
       }
       if (unfinished) admissionUnfinished.add(conversationId);
       else admissionUnfinished.delete(conversationId);
-      if (missing || unfinished) {
+      if ((announcementLooks.get(conversationId)?.untilMs ?? -Infinity) <= clock()) announcementLooks.delete(conversationId);
+      const looking = !missing && !unfinished ? announcementLooks.get(conversationId) : void 0;
+      if (missing || unfinished || looking) {
         admissionDelays.set(conversationId, Math.min(delay * 2, admissionRetry.maximum));
-        scheduleAdmission(conversationId, delay);
+        scheduleAdmission(conversationId, looking ? Math.min(delay, Math.max(0, looking.untilMs - clock())) : delay);
       }
     } finally {
       admitting.delete(conversationId);
@@ -7773,6 +7884,24 @@ function createEndpoint(options) {
     else await enqueueInbound(tx, next);
   }
   __name(writeInboundState, "writeInboundState");
+  async function discardOperation(tx, operation, message) {
+    const status = operation.attempted ? "uncertain" : "rejected";
+    const next = { ...operation, status, updatedAt: now(), receipt: {
+      ...deferredReceipt(operation),
+      status,
+      updatedAt: now(),
+      error: { code: "OPERATION_DISCARDED", message, retryable: false }
+    } };
+    delete next.request;
+    delete next.preparedContent;
+    delete next.lease;
+    delete next.nextAttemptAt;
+    await tx.put(key2(operation.operationId), next);
+    await settleMlsDevTextOperation(tx, next);
+    await removeOperationOutbox(tx, operation);
+    if (!operation.attempted) await settleOperationOrder(tx, operation);
+  }
+  __name(discardOperation, "discardOperation");
   function deferredReceipt(operation, error) {
     return operation.receipt ?? {
       protocol: CANON_ENDPOINT_PROTOCOL,
@@ -7894,12 +8023,18 @@ function createEndpoint(options) {
     if (mlsDevGroups && typeof made === "string" && ENDPOINT_ID_PATTERN.test(made)) void refreshMlsRoom(made, true).catch(() => void 0);
   }
   __name(afterReceipt, "afterReceipt");
-  async function persistReceipt(operation, receipt) {
-    if (await mlsDevGroups?.settleReceipt(operation, receipt)) return;
+  async function persistReceipt(operation, receipt, reconcileOnly = false) {
+    if (await mlsDevGroups?.settleReceipt(operation, receipt, { reconcileOnly })) return;
     const updated = await store.transaction((tx) => commitReceipt(tx, operation, receipt));
     await afterReceipt(updated);
   }
   __name(persistReceipt, "persistReceipt");
+  async function answerOf(operationId, receipt, reconcileOnly = false) {
+    if (receipt.action !== "mls_application" || receipt.status !== "rejected") return receipt;
+    const resentAs = (await store.transaction((tx) => tx.get(key2(operationId))))?.resentAs;
+    return resentAs ? endpoint.retry(resentAs, { reconcileOnly }) : receipt;
+  }
+  __name(answerOf, "answerOf");
   async function dispatch(operationId, reconcileOnly = false) {
     assertOpen();
     await initialization;
@@ -7939,12 +8074,17 @@ function createEndpoint(options) {
       await tx.put(key2(operationId), next);
       return { operation: next, acquired: true };
     });
+    if (operation.resentAs) return endpoint.retry(operation.resentAs, { reconcileOnly });
     if (terminal(operation.status) && operation.receipt) {
       if ((operation.receipt.resultReference || operation.resultEvicted) && operation.status === "succeeded") {
         const hydrated = await transport.getOperation(operationId, operation.installationId, controller.signal);
         if (!hydrated) throw new EndpointError("The private operation result is no longer available", { status: 410, code: "RESULT_EXPIRED", retryable: false, operationId });
         return hydrated;
       }
+      if (!reconcileOnly && operation.action === "mls_application" && operation.status === "rejected") {
+        await mlsDevGroups?.settleReceipt(operation, operation.receipt);
+        return answerOf(operationId, operation.receipt);
+      }
       return operation.receipt;
     }
     if (!acquired) {
@@ -7986,8 +8126,8 @@ function createEndpoint(options) {
           });
           return receipt2;
         }
-        await persistReceipt(operation, receipt2);
-        return receipt2;
+        await persistReceipt(operation, receipt2, reconcileOnly);
+        return answerOf(operationId, receipt2, reconcileOnly);
       }
       if (operation.attempted) {
         resolvingReceipt = true;
@@ -7995,7 +8135,7 @@ function createEndpoint(options) {
         resolvingReceipt = false;
         if (receipt2 && (receipt2.status !== "pending" || !operation.request && !sensitiveRequests.has(operationId))) {
           await persistReceipt(operation, receipt2);
-          return receipt2;
+          return answerOf(operationId, receipt2, reconcileOnly);
         }
       }
       if (clock() - Date.parse(operation.createdAt) > retryHorizonMs) {
@@ -8020,7 +8160,7 @@ function createEndpoint(options) {
         checkingDeliveryGuard = true;
         const guard = deliveryGuards.get(operation.guardId);
         if (!guard) throw new EndpointError("This publication requires its runtime to recheck the current audience", { code: "DELIVERY_GUARD_REQUIRED", retryable: true });
-        if (!await guard()) throw new EndpointError("Publication is withheld by the runtime policy", { code: "DELIVERY_GUARD_WITHHELD", retryable: true });
+        if (!await guard({ automaticResend: operation.automaticResend === true })) throw new EndpointError("Publication is withheld by the runtime policy", { code: "DELIVERY_GUARD_WITHHELD", retryable: true });
         assertOpen();
         checkingDeliveryGuard = false;
       }
@@ -8055,7 +8195,7 @@ function createEndpoint(options) {
       });
       const receipt = await transport.execute(request, controller.signal);
       await persistReceipt(operation, receipt);
-      return receipt;
+      return answerOf(operationId, receipt, reconcileOnly);
     } catch (error) {
       const failure = safeError(error);
       if (reconcileOnly && failure.retryable) {
@@ -8320,9 +8460,20 @@ function createEndpoint(options) {
       running.set(operationId, work);
       return work;
     },
-    async drain(drainOptions = {}) {
+    async resend(operationId) {
       assertOpen();
       await initialization;
+      let operation = await endpoint.getOperation(operationId);
+      while (operation?.resentAs) operation = await endpoint.getOperation(operation.resentAs);
+      if (!operation) throw new EndpointError("Unknown endpoint operation", { status: 404, code: "OPERATION_NOT_FOUND", retryable: false, operationId });
+      if (operation.status !== "rejected") return operation;
+      const resent = operation.action === "mls_application" && mlsDevGroups ? await mlsDevGroups.resendText(operation) : void 0;
+      if (!resent) throw new EndpointError("This message can no longer be sent again", { code: "OPERATION_NOT_RESENDABLE", retryable: false, operationId });
+      return resent;
+    },
+    async drain(drainOptions = {}) {
+      assertOpen();
+      await opened;
       await compactExpiredPayloads(store, clock());
       await sendDeferredOpeners(void 0, true).catch(() => void 0);
       let dispatched = 0;
@@ -8371,7 +8522,8 @@ function createEndpoint(options) {
       await initialization;
       return store.transaction((tx) => tx.get(key2(operationId)));
     },
-    waitForOperation(operationId, waitOptions = {}) {
+    waitForOperation(waited, waitOptions = {}) {
+      let operationId = waited;
       return new Promise((resolve3, reject) => {
         let finished = false;
         let checking = false;
@@ -8397,7 +8549,11 @@ function createEndpoint(options) {
           if (finished || checking) return;
           checking = true;
           try {
-            const operation = await endpoint.getOperation(operationId);
+            let operation = await endpoint.getOperation(operationId);
+            while (operation?.resentAs) {
+              operationId = operation.resentAs;
+              operation = await endpoint.getOperation(operationId);
+            }
             if (!operation) return finish(void 0, new EndpointError("Unknown endpoint operation", { status: 404, code: "OPERATION_NOT_FOUND", retryable: false, operationId }));
             if (operation.status === "uncertain") return finish(void 0, new EndpointError("Delivery outcome requires reconciliation", { code: "OPERATION_UNCERTAIN", retryable: false, operationId }));
             if (terminal(operation.status) && operation.receipt) {
@@ -8660,6 +8816,57 @@ function createEndpoint(options) {
     startRecovery: recovery.start,
     configureRecoveryBaseline: recovery.configureBaseline,
     getRecoveryBaseline: recovery.getBaseline,
+    async startWorkAt(cutoverAt) {
+      assertOpen();
+      await initialization;
+      if (typeof cutoverAt !== "string" || !Number.isFinite(Date.parse(cutoverAt))) {
+        throw new EndpointError("Invalid work floor", { code: "INVALID_RECOVERY_BASELINE", retryable: false });
+      }
+      const sweep = await store.transaction(async (tx) => {
+        const floor = await tx.get(WORK_FLOOR_KEY);
+        const at = floor ? Date.parse(floor.cutoverAt) : -Infinity, next = Date.parse(cutoverAt);
+        if (at > next || at === next && floor?.swept) return false;
+        if (at < next) await tx.put(WORK_FLOOR_KEY, { cutoverAt });
+        return true;
+      });
+      if (!sweep) return;
+      for (let after; ; ) {
+        const page = await store.transaction(async (tx) => {
+          const floor = await tx.get(WORK_FLOOR_KEY);
+          const answered = await completions.answered(tx);
+          const entries2 = await tx.scan("inbound/", { ...after ? { after } : {}, limit: 100 });
+          for (const { key: recordKey, value } of entries2) {
+            if (value.state === "settled" || value.externalClaim || answered.has(value.event.id) || !beforeWorkFloor(floor, value.createdAt)) continue;
+            const next = { ...value, state: "settled", reason: "before_take_over", updatedAt: now() };
+            delete next.lease;
+            delete next.handoffGeneration;
+            delete next.handoffInstallationGeneration;
+            await removeInboundReady(tx, value);
+            await tx.put(recordKey, next);
+          }
+          return entries2;
+        });
+        if (page.length < 100) break;
+        after = page.at(-1).key;
+      }
+      await store.transaction(async (tx) => {
+        const floor = await tx.get(WORK_FLOOR_KEY);
+        if (floor && Date.parse(floor.cutoverAt) === Date.parse(cutoverAt)) await tx.put(WORK_FLOOR_KEY, { cutoverAt: floor.cutoverAt, swept: true });
+      });
+    },
+    async takeOverHome() {
+      assertOpen();
+      await opened;
+      const operationId = `${TAKE_OVER_OPERATION}${ids()}`;
+      const { cutoverAt } = await endpoint.executeResult({ action: "initialize_endpoint", body: {} }, { operationId }).catch(async (error) => {
+        await store.transaction(async (tx) => {
+          const current = await tx.get(key2(operationId));
+          if (current && !terminal(current.status)) await discardOperation(tx, current, TAKE_OVER_DISCARDED);
+        });
+        throw error;
+      });
+      await endpoint.startWorkAt(cutoverAt);
+    },
     refreshRecovery: recovery.refresh,
     planRecoveryMigration(baseline, conversationIds) {
       assertOpen();
@@ -8768,23 +8975,11 @@ function createEndpoint(options) {
         const batch = await store.transaction(async (tx) => {
           const entries2 = await tx.scan("operation/", { after, limit: 100 });
           for (const entry of entries2) {
-            if (!terminal(entry.value.status)) {
-              const status = entry.value.attempted ? "uncertain" : "rejected";
-              const next = { ...entry.value, status, updatedAt: now(), receipt: {
-                ...deferredReceipt(entry.value),
-                status,
-                updatedAt: now(),
-                error: { code: "OPERATION_DISCARDED", message: "Local delivery was cancelled", retryable: false }
-              } };
-              delete next.request;
-              delete next.preparedContent;
-              delete next.lease;
-              delete next.nextAttemptAt;
-              await tx.put(entry.key, next);
-              await settleMlsDevTextOperation(tx, next);
+            if (!terminal(entry.value.status)) await discardOperation(tx, entry.value, "Local delivery was cancelled");
+            else {
+              await removeOperationOutbox(tx, entry.value);
+              await settleOperationOrder(tx, entry.value);
             }
-            await removeOperationOutbox(tx, entry.value);
-            if (!entry.value.attempted || terminal(entry.value.status)) await settleOperationOrder(tx, entry.value);
           }
           return entries2;
         });
@@ -8894,7 +9089,7 @@ async function acquireAgentEndpoint(input) {
   }
   const requestedMls = input.options.mlsDev;
   const mls = requestedMls ? await (async () => {
-    const crypto2 = await import("./mls-crypto-ZBEC26B5.js");
+    const crypto2 = await import("./mls-crypto-AW7TY744.js");
     const configuration = crypto2.parseMlsDevClientConfiguration(requestedMls.configuration);
     if (configuration.environmentId !== environmentId || baseUrl !== CANON_RUNTIME_ENDPOINT_DEFAULTS[configuration.environmentId]?.apiBaseUrl || configuration.principalIds && !configuration.principalIds.includes(input.principalId) || !Number.isSafeInteger(input.ownershipVersion) || input.ownershipVersion < 0) throw new Error("MLS_DEV_AGENT_CONFIGURATION_BINDING_MISMATCH");
     const custody = requestedMls.custody;
@@ -9079,6 +9274,17 @@ function isDiscoverAgentsResult(value) {
   return isRecord(value) && Array.isArray(value.agents) && value.agents.every(isAgentDirectoryEntry) && (value.nextCursor === null || typeof value.nextCursor === "string");
 }
 __name(isDiscoverAgentsResult, "isDiscoverAgentsResult");
+function homeClaim(input) {
+  const first = input.baseline ? void 0 : "initialize-endpoint";
+  if (isConnectorRelayInstallation(input.installationId)) return first;
+  if (input.home?.kind === "connector") return input.runner ? "refuse" : void 0;
+  const holder = input.home?.installationId;
+  if (holder === void 0 || holder === input.installationId) return first;
+  if (!input.runner) return void 0;
+  if (!input.baseline) return first;
+  return input.takeOver ? "take-over" : "refuse";
+}
+__name(homeClaim, "homeClaim");
 var CanonClient = class {
   static {
     __name(this, "CanonClient");
@@ -9110,12 +9316,29 @@ var CanonClient = class {
         options: this.endpointOptions
       });
       try {
-        if (context.endpointBootstrapEligible && this.endpointOptions.autoDrain !== false && !await lease.endpoint.getRecoveryBaseline()) {
-          const baseline = await lease.endpoint.executeResult(
-            { action: "initialize_endpoint", body: {} },
-            { operationId: "initialize-endpoint" }
-          );
-          await lease.endpoint.configureRecoveryBaseline(baseline);
+        if (context.endpointBootstrapEligible && this.endpointOptions.autoDrain !== false) {
+          const baseline = await lease.endpoint.getRecoveryBaseline();
+          const { installationId } = await lease.endpoint.ready();
+          const home = context.home;
+          const claim = homeClaim({
+            installationId,
+            home,
+            baseline: !!baseline,
+            runner: !!this.endpointOptions.claimHome,
+            takeOver: !!this.endpointOptions.takeOver
+          });
+          if (claim === "refuse") {
+            throw new EndpointError(agentHomeElsewhereMessage(context.displayName, home), { status: 409, code: AGENT_HOME_ELSEWHERE, retryable: false });
+          }
+          if (claim === "take-over") await lease.endpoint.takeOverHome();
+          else if (claim) {
+            await lease.endpoint.configureRecoveryBaseline(await lease.endpoint.executeResult(
+              { action: "initialize_endpoint", body: {} },
+              { operationId: claim }
+            ));
+          } else if (home?.kind === "runner" && home.installationId === installationId && home.since) {
+            await lease.endpoint.startWorkAt(new Date(home.since).toISOString());
+          }
         }
         return lease;
       } catch (error) {
@@ -10280,8 +10503,16 @@ async function ensureAgentProfile(options) {
     await verifyCanonRuntimeConnection(connection);
     return { status: "approved", apiKey: existing.apiKey, agentId: existing.agentId, agentName: existing.agentName };
   }
+  const requestedAgentId = input.requestedAgentId ?? (options.reconnect && !pending ? existing?.agentId : void 0);
+  if (options.reconnect && !pending && !requestedAgentId) {
+    throw new Error(`Canon profile "${profile}" has no saved agent to reconnect: give input.requestedAgentId, or register without reconnect`);
+  }
+  if (options.reconnect && !pending && existing && requestedAgentId !== existing.agentId) {
+    throw new Error("Saved Canon profile belongs to another agent identity");
+  }
   return resumeRegistration({
     ...options,
+    input: { ...input, ...requestedAgentId ? { requestedAgentId } : {} },
     store: {
       load: /* @__PURE__ */ __name(() => loadPendingRegistrations()[profile], "load"),
       save: /* @__PURE__ */ __name((session) => {
@@ -11534,14 +11765,15 @@ export {
   loadProfiles,
   isProfileLocked,
   acquireLock,
+  loadPendingRegistrations,
   clearPendingRegistration,
   ensureAgentProfile,
   initRTDBAuth,
   renderCanonHostInboundContent,
   createRuntimeStatePublisher,
   isPendingCanonOperation,
+  utf8ByteLength,
   splitTextWithinBytes,
-  readCliPackageVersion,
   runCli,
   BoundedFileReadError,
   readBoundedRegularFileHandle,