npm - @corca-org/ceal-host-linux-arm64 - Versions diffs - 1.0.19 → 1.0.21 - Mend

@corca-org/ceal-host-linux-arm64 1.0.19 → 1.0.21

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (12) hide show

package/bin/ceal-host +0 -0
package/libexec/ceal-host/claude-hook.mjs +1327 -1211
package/libexec/ceal-host/claude-invocation-authentication.mjs +1986 -1272
package/libexec/ceal-host/claude-producer.mjs +1376 -1313
package/libexec/ceal-host/codex-hook.mjs +1215 -1392
package/libexec/ceal-host/codex-invocation-authentication.mjs +1924 -1364
package/libexec/ceal-host/codex-producer.mjs +1222 -1286
package/libexec/ceal-host/control.mjs +2818 -2076
package/libexec/ceal-host/relay.mjs +1733 -1811
package/package.json +1 -1
package/share/ceal-host/bundle-manifest.json +12 -12
package/share/ceal-host/bundle-manifest.sigstore.json +1 -1

package/libexec/ceal-host/relay.mjs CHANGED Viewed

@@ -29,16 +29,34 @@ function isPlainRecord(value) {
   return prototype === Object.prototype || prototype === null;
 }
+// packages/ceal-client-protocol/src/client-wire-contract.ts
+import { createHash } from "node:crypto";
 // packages/ceal-client-protocol/client-wire-contract.json
 var client_wire_contract_default = {
   schema_version: "ceal.client_wire_contract.v1",
+  doctor: {
+    schema_version: "ceal.doctor.v1"
+  },
+  client_commands: {
+    doctor: ["doctor"],
+    version: ["version"],
+    access_group_list: ["access-group", "list"]
+  },
+  client_environment: {
+    environment_prefix: "CEAL",
+    context_override_suffixes: ["GATEWAY_ORIGIN", "GATEWAY_TRANSPORT_ORIGIN", "ACCESS_TOKEN", "CONTEXT_STORE_PATH"]
+  },
   canonical_json: {
     ordering: "utf16_code_unit_ascending"
   },
   artifact_descriptor: {
-    operation_contract_bundle_schema_version: "ceal.operation_contract_bundle.v1",
-    schema_version: "ceal.verified_artifact_descriptor.v1",
-    binding_schema_version: "ceal.verified_artifact_binding.v1",
+    operation_contract_bundle_schema_name: "ceal.operation_contract_bundle",
+    operation_contract_bundle_fields: ["schema_version", "catalog_revision", "operations", "failure_guidance"],
+    schema_name: "ceal.verified_artifact_descriptor",
+    fields: ["schema_version", "kind", "media_type", "byte_count", "sha256", "binding"],
+    binding_schema_name: "ceal.verified_artifact_binding",
+    binding_fields: ["schema_version", "kind", "catalog_revision"],
     kind: "verified_artifact",
     binding_kind: "catalog",
     media_type: "application/json",
@@ -54,14 +72,16 @@ var client_wire_contract_default = {
       length: 72,
       pattern: "^catalog:[a-f0-9]{64}$"
     },
-    envelope_max_bytes: 389
+    envelope_max_bytes: 407
   },
   command_request: {
-    schema_version: "ceal.command_request.v1",
+    schema_name: "ceal.command_request",
+    fields: ["schema_version", "argv", "operation", "client_nonce", "context_token"],
     absolute_transport_max_bytes: 65536
   },
   command_resolution: {
-    schema_version: "ceal.gateway_command_resolution.v1",
+    schema_name: "ceal.gateway_command_resolution",
+    fields: ["schema_version", "kind", "ok", "execution_started", "program", "route", "authority", "routes", "operations", "required_action_sequence", "semantic_options", "result_delivery", "operation", "invocation", "entrypoints", "common_concepts", "withheld", "catalog_revision", "operation_id", "input", "transport", "output", "unresolved_inputs", "unresolved_refusal", "attempted_route", "did_you_mean", "error"],
     authority: {
       anonymous: {
         state: "anonymous",
@@ -101,7 +121,8 @@ var client_wire_contract_default = {
     }
   },
   command_response: {
-    schema_version: "ceal.command_response.v1",
+    schema_name: "ceal.command_response",
+    fields: ["schema_version", "exit_code", "document", "operation_id", "visible_output_max_bytes", "local_delivery", "verified_artifact"],
     descriptor_field: "verified_artifact",
     required_fields: [
       "schema_version",
@@ -125,29 +146,41 @@ var client_wire_contract_default = {
       "required_action_sequence",
       "withheld"
     ],
-    prompt_field: "prompt",
-    prompt_schema_version: "ceal.prompt.v1",
-    focused_prompt_document_fields: [
-      "catalog_revision",
-      "prompt"
-    ],
-    focused_prompt_continuation_document_fields: [
-      "catalog_revision",
-      "remaining_work",
-      "prompt"
-    ],
     discovery_command: "discovery",
-    discovery_manifest_schema_version: "ceal.discovery_manifest.v1",
+    discovery_manifest_schema_name: "ceal.discovery_manifest",
+    discovery_manifest_fields: ["schema_version", "skill", "authority_scope", "connector_kinds", "personal_connector_kinds", "guide_markdown", "renderer_version", "digest"],
     discovery_manifest_document_fields: [
       "discovery_manifest"
     ],
     exit_code_max: 125,
     bare_document_max_bytes: 65536,
-    complete_max_bytes: 66019
+    complete_max_bytes: 66046
+  },
+  host_invocation_authentication: {
+    request_schema_name: "ceal.host_invocation_authentication_request",
+    request_fields: [
+      "schema_version",
+      "client_nonce"
+    ],
+    result_schema_name: "ceal.host_invocation_authentication_result",
+    result_fields: [
+      "schema_version",
+      "context_token",
+      "expires_at"
+    ],
+    client_nonce: {
+      character_class_source: "A-Za-z0-9_-",
+      encoded_characters: 43
+    }
+  },
+  gateway_host_invocation_context_request: {
+    schema_name: "ceal.gateway_host_invocation_context_request",
+    fields: ["schema_version", "client_nonce", "context_expires_at", "request_work_context", "current_prompt", "visible_output_max_bytes"]
   },
   resource_stream: {
     path: "/api/ceal/v2/resources",
-    request_schema_version: "ceal.resource_stream_request.v1",
+    request_schema_name: "ceal.resource_stream_request",
+    request_fields: ["schema_version", "resource_ref", "client_nonce", "context_token"],
     ref_pattern: "^resource:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$",
     media_type_pattern: "^[a-z0-9][a-z0-9!#$&^_.+-]{0,63}/[a-z0-9][a-z0-9!#$&^_.+-]{0,63}$",
     filename_max_bytes: 512,
@@ -164,92 +197,6 @@ var client_wire_contract_default = {
   }
 };
-// packages/ceal-client-protocol/src/client-wire-contract.ts
-var CEAL_CLIENT_WIRE_CONTRACT = Object.freeze(client_wire_contract_default);
-var commandResolution = CEAL_CLIENT_WIRE_CONTRACT.command_resolution;
-var commandResolutionAuthority = commandResolution.authority;
-var commandResolutionSemanticOptions = commandResolution.semantic_options;
-var CEAL_GATEWAY_COMMAND_RESOLUTION_SCHEMA_VERSION = commandResolution.schema_version;
-var CEAL_ENCODED_JSON_DOCUMENT_MAX_BYTES = CEAL_CLIENT_WIRE_CONTRACT.encoded_json_document.max_bytes;
-var artifact = CEAL_CLIENT_WIRE_CONTRACT.artifact_descriptor;
-var request = CEAL_CLIENT_WIRE_CONTRACT.command_request;
-var response = CEAL_CLIENT_WIRE_CONTRACT.command_response;
-var CEAL_OPERATION_CONTRACT_BUNDLE_SCHEMA_VERSION = artifact.operation_contract_bundle_schema_version;
-var CEAL_VERIFIED_ARTIFACT_DESCRIPTOR_SCHEMA_VERSION = artifact.schema_version;
-var CEAL_VERIFIED_ARTIFACT_BINDING_SCHEMA_VERSION = artifact.binding_schema_version;
-var CEAL_VERIFIED_ARTIFACT_KIND = artifact.kind;
-var CEAL_VERIFIED_ARTIFACT_BINDING_KIND = artifact.binding_kind;
-var CEAL_VERIFIED_ARTIFACT_MEDIA_TYPE = artifact.media_type;
-var CEAL_VERIFIED_ARTIFACT_DIGEST_LENGTH = artifact.digest.length;
-var CEAL_VERIFIED_ARTIFACT_DIGEST_PATTERN = artifact.digest.pattern;
-var CEAL_VERIFIED_ARTIFACT_CATALOG_REVISION_LENGTH = artifact.catalog_revision.length;
-var CEAL_VERIFIED_ARTIFACT_CATALOG_REVISION_PATTERN = artifact.catalog_revision.pattern;
-var CEAL_VERIFIED_ARTIFACT_MAX_BYTES = CEAL_ENCODED_JSON_DOCUMENT_MAX_BYTES;
-var CEAL_VERIFIED_ARTIFACT_DESCRIPTOR_MAX_BYTES = artifact.envelope_max_bytes;
-var CEAL_COMMAND_REQUEST_SCHEMA_VERSION = request.schema_version;
-var CEAL_COMMAND_REQUEST_MAX_BYTES = request.absolute_transport_max_bytes;
-var CEAL_COMMAND_RESPONSE_BARE_DOCUMENT_MAX_BYTES = response.bare_document_max_bytes;
-var CEAL_COMMAND_RESPONSE_PROMPT_FIELD = response.prompt_field;
-var CEAL_COMMAND_RESPONSE_PROMPT_SCHEMA_VERSION = response.prompt_schema_version;
-var CEAL_COMMAND_RESPONSE_BARE_DOCUMENT_OPTIONAL_FIELDS = Object.freeze([...response.bare_document_optional_fields]);
-var CEAL_COMMAND_RESPONSE_PROMPT_DOCUMENT_FIELDS = Object.freeze([...response.bare_document_fields, response.prompt_field]);
-var CEAL_COMMAND_RESPONSE_FOCUSED_PROMPT_DOCUMENT_FIELDS = Object.freeze([...response.focused_prompt_document_fields]);
-var CEAL_COMMAND_RESPONSE_FOCUSED_PROMPT_CONTINUATION_DOCUMENT_FIELDS = Object.freeze([...response.focused_prompt_continuation_document_fields]);
-var CEAL_COMMAND_RESPONSE_DISCOVERY_COMMAND = response.discovery_command;
-var CEAL_COMMAND_RESPONSE_DISCOVERY_MANIFEST_SCHEMA_VERSION = response.discovery_manifest_schema_version;
-var CEAL_COMMAND_RESPONSE_DISCOVERY_MANIFEST_DOCUMENT_FIELDS = Object.freeze([...response.discovery_manifest_document_fields]);
-var CEAL_COMMAND_RESPONSE_MAX_BYTES = CEAL_ENCODED_JSON_DOCUMENT_MAX_BYTES;
-// packages/ceal-client-protocol/src/vocabulary.ts
-function vocabulary(words) {
-  return Object.freeze(words);
-}
-function isVocabularyWord(words, value) {
-  return words.some((word) => word === value);
-}
-// packages/ceal-client-protocol/src/gateway-response-types.ts
-var CEAL_OPERATION_READINESS_VALUES = vocabulary(["ready", "degraded", "unavailable", "unknown"]);
-var CEAL_TARGET_REQUIREMENTS = vocabulary(["required", "optional", "none"]);
-var CEAL_AUDIT_OUTCOMES = vocabulary(["succeeded", "denied", "failed"]);
-var CEAL_GATEWAY_PROVIDER_STEP_OUTCOMES = vocabulary(["completed", "rejected", "throttled", "failed"]);
-var CEAL_GATEWAY_READ_REUSE_DISPOSITIONS = vocabulary(["response_cache_hit", "corpus_hit", "corpus_hit_after_revalidation", "corpus_partial_provider_supplement", "provider_direct", "provider_continuation", "reuse_unavailable"]);
-var CEAL_GATEWAY_READ_REUSE_UNAVAILABLE_REASONS = vocabulary(["not_reported", "storage_unavailable", "coverage_incomplete", "freshness_refresh_required", "not_reusable", "bypassed"]);
-var CEAL_GATEWAY_DERIVED_STORE_FAILURE_CLASSES = vocabulary(["storage_unavailable", "decode_mismatch", "write_conflict", "quota", "store_error"]);
-var CEAL_POLICY_DECISIONS = vocabulary(["allowed", "denied", "not_evaluated"]);
-var CEAL_CONNECTOR_ROUTE_PHASES = vocabulary(["scope_observation", "target_selection", "route_resolution"]);
-var CEAL_CONNECTOR_ROUTE_CAUSES = vocabulary(["provider_throttled", "provider_unavailable", "binding_invalid", "scope_limit_exceeded"]);
-var CEAL_WRITE_SOURCE_KINDS = vocabulary(["authenticated_registered_client", "provider_authenticated_event"]);
-var CEAL_REFRESH_DELIVERIES = vocabulary(["initial", "recovery", "replay", "terminal_failure", "recovery_unavailable"]);
-var CEAL_CLIENT_OPERATIONS = vocabulary(["handshake", "discover", "call", "readback"]);
-var CEAL_WRITE_IDEMPOTENCY_POSTURES = vocabulary(["required", "optional", "not_required"]);
-var CEAL_WRITE_PROVIDER_READBACK_POSTURES = vocabulary(["required", "best_effort", "not_available"]);
-var CEAL_WRITE_ATTRIBUTIONS = vocabulary(["subject", "requester_event", "connector_integration"]);
-var CEAL_WRITE_RECEIPT_PROVIDER_STATES = vocabulary(["outcome_unknown", "verified", "not_dispatched"]);
-var CEAL_WRITE_RECEIPT_PROVIDER_READBACKS = vocabulary(["outcome_unknown", "verified", "not_applied"]);
-var CEAL_PROTOCOL_VERSION = "1.4.0";
-var CEAL_OPERATION_ACCESS_SCHEMA_VERSION = "ceal.operation_access.v1";
-var CEAL_GATEWAY_CONTINUATION_CURSOR_PHASES = vocabulary(["scan", "delivery", "terminal"]);
-var CEAL_GATEWAY_ACTIVE_CALL_PHASES = vocabulary([
-  "audited_call_pending",
-  "continuation_read_pending",
-  "continuation_write_pending",
-  "provider_pacing_pending",
-  "corpus_replay_pending",
-  "corpus_append_pending",
-  "corpus_fence_pending",
-  "corpus_content_pending",
-  "corpus_transaction_pending"
-]);
-var CEAL_CONNECTOR_ROUTE_FAILURE_KEYS = vocabulary(["connector_kind", "phase", "schema_version"]);
-var CEAL_CLASSIFIED_CONNECTOR_ROUTE_FAILURE_KEYS = vocabulary(["cause", ...CEAL_CONNECTOR_ROUTE_FAILURE_KEYS]);
-var CEAL_UNCLASSIFIED_CONNECTOR_ROUTE_FAILURE_KEYS = vocabulary(["connector_kind", "error_class", "phase", "schema_version"]);
-var CEAL_GATEWAY_ORGANIZATION_ROUTE_FACT_CALL_KEYS = Object.freeze([
-  "connector_ref",
-  "connector_revision",
-  "policy_decision_revision"
-]);
 // packages/ceal-client-protocol/src/operation-next-actions.ts
 var CEAL_REPEAT_REQUEST_NEXT_ACTION = "repeat_request";
 var CEAL_INSPECT_RECEIPT_NEXT_ACTION = "inspect_receipt";
@@ -316,7 +263,10 @@ var CALLER_RECOVERABLE_NEXT_ACTION_VALUES = [
   "follow_required_action_sequence",
   // The command needs caller-owned local materialization (for example an
   // @path file) before the Gateway can receive the argument.
-  "materialize_local_argument"
+  "materialize_local_argument",
+  // A peer's derived schema identifier changed with its field set; install or
+  // upgrade the CLI and Host Relay to the Gateway's release before retrying.
+  "upgrade_ceal_client"
 ];
 var CEAL_CALLER_RECOVERABLE_NEXT_ACTIONS = Object.freeze(CALLER_RECOVERABLE_NEXT_ACTION_VALUES);
 var NON_REMEDY_NEXT_ACTION_VALUES = [
@@ -429,47 +379,56 @@ var CEAL_OPERATION_WITHHELD_NEXT_ACTIONS = Object.freeze({
   personal_authorization_required: "connect_personal_account"
 });
-// packages/ceal-client-protocol/src/operation-withheld-cause.ts
-var CEAL_OPERATION_WITHHELD_CAUSES = vocabulary(["provider_permission", "access_level", "personal_authorization_required"]);
+// packages/ceal-client-protocol/src/vocabulary.ts
+function vocabulary(words) {
+  return Object.freeze(words);
+}
+function isVocabularyWord(words, value) {
+  return words.some((word) => word === value);
+}
-// packages/ceal-client-protocol/src/operation-contract-types.ts
-var CEAL_JSON_SCHEMA_2020_12 = "https://json-schema.org/draft/2020-12/schema";
-var CEAL_OPERATION_ERROR_SCHEMA_VERSION = "ceal.operation_error.v1";
-var CEAL_ARTIFACT_STAGE_TERMINALS = vocabulary(["chunk_accepted", "artifact_ready", "idempotency_replayed"]);
-var CEAL_RETRY_AFTER_MAX_MS = 60 * 60 * 1e3;
-var CEAL_JSON_SCHEMA_TYPES = vocabulary(["object", "array", "string", "integer", "number", "boolean", "null"]);
-var OBSERVATION_POSTURES = vocabulary(["direct_readback", "approved_no_readback", "operator_mediated", "excluded"]);
-var EFFECT_DOMAINS = vocabulary(["none", "gateway_state", "provider", "external_world"]);
-var SAFETY_CLASSES = vocabulary(["routine", "sensitive", "high_impact"]);
-var IDEMPOTENCY_CLASSES = vocabulary(["idempotent", "conditionally_idempotent", "non_idempotent"]);
-var REVERSIBILITY_CLASSES = vocabulary(["none", "reversible", "compensatable", "irreversible"]);
-var COMPENSATION_OWNERS = vocabulary(["none", "connector", "operator"]);
-var CANCELLATION_BOUNDARIES = vocabulary(["before_admission", "before_handoff", "after_handoff_reconcile"]);
-var HANDOFF_CLASSES = vocabulary(["not_applicable", "submission", "effect"]);
-var AUTHORITATIVE_READBACK_CLASSES = vocabulary(["required", "unavailable"]);
-var PROVIDER_READBACK_CLASSES = vocabulary(["required", "not_available", "not_applicable"]);
-var RECONCILIATION_CLASSES = vocabulary(["none", "automatic", "operator"]);
-var NO_READBACK_APPROVAL_CLASSES = vocabulary(["not_applicable", "explicit", "operator"]);
-var REPLAY_PREREQUISITES = vocabulary(["never", "fresh_admission", "reconciled_non_application", "operator_approval"]);
-var UNKNOWN_OUTCOMES = vocabulary(["reconcile", "operator_action", "excluded"]);
-var RECOVERY_OWNERS = vocabulary(["gateway", "connector", "operator"]);
-var CEAL_OPERATION_ADMISSION_STATES = vocabulary(["proposed", "refused", "admitted"]);
-var CEAL_OPERATION_EXECUTION_STATES = vocabulary(["not_started", "started", "completed"]);
-var CEAL_OPERATION_PROVIDER_HANDOFF_STATES = vocabulary(["not_offered", "offered", "accepted", "rejected", "unknown"]);
-var CEAL_OPERATION_EFFECT_STATES = vocabulary(["none", "applied", "failed", "unknown", "compensated"]);
-var CEAL_OPERATION_OBSERVATION_STATES = vocabulary(["not_started", "not_required", "pending", "observed", "unavailable"]);
-var CEAL_OPERATION_RECOVERY_KINDS = vocabulary(["none", "reconcile", "compensate", "operator_action"]);
-var CEAL_OPERATION_RECOVERY_STATUSES = vocabulary(["not_started", "active", "completed"]);
-var CEAL_OPERATION_PROVIDER_READBACK_AVAILABILITY = vocabulary(["not_started", "not_applicable", "not_available", "pending", "available"]);
-var CEAL_OPERATION_OFFERED_HANDOFF_STATES = vocabulary(["accepted", "rejected", "unknown"]);
-var CEAL_OPERATION_RECEIPT_AUTHORITY_KEYS = Object.freeze(["instance_ref", "access_group_ref", "principal_ref", "execution_subject_ref", "authority_revision_ref"]);
-var CEAL_OPERATION_APPROVAL_DISPOSITIONS = vocabulary([
-  "approval_not_required_by_policy",
-  "interactive_pending",
-  "interactive_granted",
-  "interactive_denied",
-  "interactive_expired",
-  "interactive_unavailable"
+// packages/ceal-client-protocol/src/gateway-response-types.ts
+var CEAL_OPERATION_READINESS_VALUES = vocabulary(["ready", "degraded", "unavailable", "unknown"]);
+var CEAL_TARGET_REQUIREMENTS = vocabulary(["required", "optional", "none"]);
+var CEAL_AUDIT_OUTCOMES = vocabulary(["succeeded", "denied", "failed"]);
+var CEAL_GATEWAY_PROVIDER_STEP_OUTCOMES = vocabulary(["completed", "rejected", "throttled", "failed"]);
+var CEAL_GATEWAY_READ_REUSE_DISPOSITIONS = vocabulary(["response_cache_hit", "corpus_hit", "corpus_hit_after_revalidation", "corpus_partial_provider_supplement", "provider_direct", "provider_continuation", "reuse_unavailable"]);
+var CEAL_GATEWAY_READ_REUSE_UNAVAILABLE_REASONS = vocabulary(["not_reported", "storage_unavailable", "coverage_incomplete", "freshness_refresh_required", "not_reusable", "bypassed"]);
+var CEAL_GATEWAY_DERIVED_STORE_FAILURE_CLASSES = vocabulary(["storage_unavailable", "decode_mismatch", "write_conflict", "quota", "store_error"]);
+var CEAL_POLICY_DECISIONS = vocabulary(["allowed", "denied", "not_evaluated"]);
+var CEAL_CONNECTOR_ROUTE_PHASES = vocabulary(["scope_observation", "target_selection", "route_resolution"]);
+var CEAL_CONNECTOR_ROUTE_CAUSES = vocabulary(["provider_throttled", "provider_unavailable", "binding_invalid", "scope_limit_exceeded"]);
+var CEAL_WRITE_SOURCE_KINDS = vocabulary(["authenticated_registered_client", "provider_authenticated_event"]);
+var CEAL_REFRESH_DELIVERIES = vocabulary(["initial", "recovery", "replay", "terminal_failure", "recovery_unavailable"]);
+var CEAL_CLIENT_OPERATIONS = vocabulary(["handshake", "discover", "call", "readback"]);
+var CEAL_WRITE_IDEMPOTENCY_POSTURES = vocabulary(["required", "optional", "not_required"]);
+var CEAL_WRITE_PROVIDER_READBACK_POSTURES = vocabulary(["required", "best_effort", "not_available"]);
+var CEAL_WRITE_ATTRIBUTIONS = vocabulary(["subject", "requester_event", "connector_integration"]);
+var CEAL_WRITE_RECEIPT_PROVIDER_STATES = vocabulary(["outcome_unknown", "verified", "not_dispatched"]);
+var CEAL_WRITE_RECEIPT_PROVIDER_READBACKS = vocabulary(["outcome_unknown", "verified", "not_applied"]);
+var CEAL_PROTOCOL_VERSION = "1.4.0";
+var CEAL_OPERATION_ACCESS_SCHEMA_VERSION = "ceal.operation_access.v1";
+var CEAL_GATEWAY_CALL_RESULT_SCHEMA_VERSION = "ceal.gateway_call_result.v1";
+var CEAL_GATEWAY_CONTINUATION_CURSOR_PHASES = vocabulary(["scan", "delivery", "terminal"]);
+var CEAL_GATEWAY_ACTIVE_CALL_PHASES = vocabulary([
+  "audited_call_pending",
+  "continuation_read_pending",
+  "continuation_write_pending",
+  "provider_pacing_pending",
+  "corpus_replay_pending",
+  "corpus_append_pending",
+  "corpus_fence_pending",
+  "corpus_content_pending",
+  "corpus_transaction_pending"
+]);
+var CEAL_CONNECTOR_ROUTE_FAILURE_KEYS = vocabulary(["connector_kind", "phase", "schema_version"]);
+var CEAL_CLASSIFIED_CONNECTOR_ROUTE_FAILURE_KEYS = vocabulary(["cause", ...CEAL_CONNECTOR_ROUTE_FAILURE_KEYS]);
+var CEAL_UNCLASSIFIED_CONNECTOR_ROUTE_FAILURE_KEYS = vocabulary(["connector_kind", "error_class", "phase", "schema_version"]);
+var CEAL_GATEWAY_AUDIT_CALL_DETAIL_SCHEMA_VERSION = "ceal.gateway_audit_call_detail.v1";
+var CEAL_GATEWAY_ORGANIZATION_ROUTE_FACT_CALL_KEYS = Object.freeze([
+  "connector_ref",
+  "connector_revision",
+  "policy_decision_revision"
 ]);
 // packages/ceal-client-protocol/src/gateway-validation-primitives.ts
@@ -609,6 +568,11 @@ function isCealJsonRecord(value) {
 }
 var CEAL_VALIDATION_STATUSES = vocabulary(["not_applicable", "valid", "invalid"]);
 var CEAL_PARSE_STATUSES = vocabulary(["not_applicable", "parsed", "parse_failed"]);
+function hasExactKeys(value, expected) {
+  const actual = Object.keys(value).sort();
+  const wanted = [...expected].sort();
+  return actual.length === wanted.length && actual.every((key, index) => key === wanted[index]);
+}
 function invalidByContext(options) {
   if (options.forbidAuthorityKeys) invalidRequest();
   invalidResponse();
@@ -683,51 +647,6 @@ function cut(text) {
   return text.length <= REFUSAL_VALUE_MAX_CHARS ? text : `${text.slice(0, REFUSAL_VALUE_MAX_CHARS)}...(+${text.length - REFUSAL_VALUE_MAX_CHARS} chars)`;
 }
-// packages/ceal-client-protocol/src/operation-access-class.ts
-var CEAL_OPERATION_ACCESS_CLASSES = vocabulary(["read", "write"]);
-// packages/ceal-client-protocol/src/domain-vocabulary.ts
-var CEAL_CONNECTOR_STATUSES = vocabulary(["active", "disabled", "disconnected"]);
-var CEAL_CONNECTOR_CUSTODIES = vocabulary(["organization", "personal"]);
-var CEAL_ACCESS_LEVELS = vocabulary(["none", "read", "read_write"]);
-var CEAL_PERSONAL_ACCESS_CEILINGS = vocabulary(["disabled", "read", "read_write"]);
-var CEAL_TARGET_REF_PATTERN = "^[^\\p{Cc}]+$";
-var TARGET_REF = new RegExp(CEAL_TARGET_REF_PATTERN, "u");
-var CEAL_TARGET_VISIBILITIES = vocabulary(["public", "private"]);
-var CEAL_PRINCIPAL_KINDS = vocabulary(["human", "runtime"]);
-var CEAL_PERSISTED_PRINCIPAL_KINDS = vocabulary(["human", "service", "runtime"]);
-var CEAL_ORGANIZATION_ROLES = vocabulary(["member", "admin"]);
-var CEAL_CALENDAR_PERIODS = vocabulary(["day", "week", "month"]);
-var LABEL_EXPECTATION = `public-safe display text of at most ${CEAL_PUBLIC_DISPLAY_NAME_MAX_BYTES} bytes`;
-// packages/ceal-client-protocol/src/safe-json-budget.ts
-var SAFE_JSON_MIN_BYTES_PER_NODE = 4;
-function safeJsonNodeBudgetForBytes(maxBytes) {
-  if (!Number.isSafeInteger(maxBytes) || maxBytes < SAFE_JSON_MIN_BYTES_PER_NODE) {
-    throw new RangeError(`safe-JSON byte cap is invalid: ${refusalFact("maxBytes", maxBytes, `at least ${SAFE_JSON_MIN_BYTES_PER_NODE} bytes`)}`);
-  }
-  return Math.floor(maxBytes / SAFE_JSON_MIN_BYTES_PER_NODE);
-}
-// packages/ceal-client-protocol/src/protocol-bounds.ts
-var CEAL_PROTOCOL_RESPONSE_VALUE_MAX_BYTES = 64 * 1024;
-var CEAL_PROTOCOL_RESPONSE_VALUE_MAX_NODES = safeJsonNodeBudgetForBytes(CEAL_PROTOCOL_RESPONSE_VALUE_MAX_BYTES);
-var OPERATION_SCHEMA_LITERAL_MAX_BYTES = CEAL_PROTOCOL_RESPONSE_VALUE_MAX_BYTES / 4;
-var CEAL_OPERATION_JSON_SCHEMA_BUDGET = Object.freeze({
-  max_depth: 8,
-  max_properties: 96,
-  max_string_length: OPERATION_SCHEMA_LITERAL_MAX_BYTES / 4,
-  max_alternatives: 8,
-  max_enum_values: 64,
-  max_literal_bytes: OPERATION_SCHEMA_LITERAL_MAX_BYTES,
-  /** @basis our_policy -- bounds explanatory schema prose carried in one catalog. */
-  max_description_characters: 1024,
-  /** @basis our_policy -- bounds regular-expression compilation input from one schema. */
-  max_pattern_characters: 256,
-  /** @basis our_policy -- bounds traversal work inside one already byte-bounded schema literal. */
-  max_literal_nodes: 512
-});
 // packages/ceal-client-protocol/src/operation-validation-primitives.ts
 var ISO_TIMESTAMP = /^(\d{4})-(\d{2})-(\d{2})[Tt](\d{2}):(\d{2}):(\d{2})(?:\.(\d{1,9}))?([Zz]|([+-])(\d{2}):(\d{2}))$/u;
 var CEAL_CALENDAR_DATE_PATTERN_SOURCE = "^\\d{4}-\\d{2}-\\d{2}$";
@@ -795,38 +714,366 @@ function requireIsoTimestamp(value, message) {
   if (!isCealIsoTimestamp(value)) throw new TypeError(message);
 }
-// packages/ceal-client-protocol/src/operation-json-schema.ts
-var JSON_DESCRIPTION_CONTROL_CHARACTER = new RegExp("\\p{Cc}", "u");
-// packages/ceal-client-protocol/src/operation-contract-validation.ts
-var CEAL_OPERATION_AUTHORITY_POLICY_KEYS = Object.freeze(["access_group", "instance_binding", "target", "admission_recheck"]);
-var MAX_OPERATION_INPUT_RESOLVER_BINDINGS = 96;
-var CEAL_OPERATION_DESCRIPTOR_REQUIRED_ENVELOPE_KEYS = Object.freeze(["schema_version", "id", "input_contract", "result_contract", "policy"]);
-var CEAL_OPERATION_DESCRIPTOR_OPTIONAL_ENVELOPE_KEYS = Object.freeze(["input_resolution", "summary"]);
-// packages/ceal-client-protocol/src/operation-catalog.ts
-var CEAL_OPERATION_CATALOG_SCHEMA_VERSION = "ceal.catalog.v3";
-var CLIENT_AUDIENCES = Object.freeze(["ceal", "cealctl", "agent"]);
-var CLIENT_AUDIENCE_SET = new Set(CLIENT_AUDIENCES);
+// packages/ceal-client-protocol/src/failure-guidance-table.ts
+var CEAL_FAILURE_REDACTION_CLASSES = vocabulary(["model_safe", "withheld"]);
+var CEAL_GATEWAY_STARTING_FAILURE_CODE = "gateway_starting";
+var CEAL_OWNER_BOOTSTRAP_ABSENT_FAILURE_CODE = "bootstrap_absent";
+var CEAL_OWNER_BOOTSTRAP_UNAVAILABLE_FAILURE_CODE = "bootstrap_unavailable";
+var LOCAL_COMMAND_INVALID = "The local command or argument is invalid.";
+var LOCAL_TRANSPORT_INCOMPLETE = "The local Ceal transport could not complete; report this as a gap.";
+var GATEWAY_TRANSPORT_UNAVAILABLE = "The Gateway transport is unavailable; ask an administrator to restore Gateway availability.";
+var HOST_AUTHENTICATION_UNAVAILABLE = "The Host could not authenticate this invocation; report this as a gap.";
+var SESSION_CONTEXT_UNAVAILABLE = "The local Gateway session context is unavailable.";
+function guidance(message, next_action, http_status, retryable = false, redaction_class = "model_safe") {
+  return Object.freeze({ message, next_action, http_status, retryable, redaction_class });
+}
+var CEAL_FAILURE_GUIDANCE_TABLE = Object.freeze({
+  invalid_command: guidance(LOCAL_COMMAND_INVALID, "correct_argument", 400),
+  invalid_argument: guidance(LOCAL_COMMAND_INVALID, "correct_argument", 400),
+  command_not_found: guidance(LOCAL_COMMAND_INVALID, "correct_argument", 404),
+  unknown_operation: guidance("The requested Operation is absent from the current verified catalog; report this as a gap unless a catalog suggestion names a replacement.", "answer_with_gap", 404),
+  local_route_unavailable: guidance("The requested local route is unavailable or its descriptor is invalid; report this as a gap.", "answer_with_gap", 404),
+  local_route_ambiguous: guidance("The requested local route is ambiguous; no local executable was selected. Report this as a gap.", "answer_with_gap", 400),
+  local_execution_unavailable: guidance("The selected local route executable is unavailable; report this as a gap.", "answer_with_gap", 500),
+  local_pickup_failed: guidance("The Host Request pickup failed; the Gateway command was not sent. Report this as a gap.", "answer_with_gap", 502),
+  invocation_authentication_unavailable: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "answer_with_gap", 401),
+  local_execution_cancellation_unknown: guidance("The selected local route cancellation outcome is unknown; a retry can repeat an effect the cancelled route already completed. Report this as a gap and do not retry.", "answer_with_gap", 409),
+  gateway_origin_required: guidance(SESSION_CONTEXT_UNAVAILABLE, "repair_or_adopt_session", 401),
+  access_token_required: guidance(SESSION_CONTEXT_UNAVAILABLE, "repair_or_adopt_session", 401),
+  context_pair_required: guidance(SESSION_CONTEXT_UNAVAILABLE, "repair_or_adopt_session", 401),
+  context_not_selected: guidance(SESSION_CONTEXT_UNAVAILABLE, "repair_or_adopt_session", 401),
+  context_store_invalid: guidance(SESSION_CONTEXT_UNAVAILABLE, "repair_or_adopt_session", 401),
+  context_store_conflict: guidance(SESSION_CONTEXT_UNAVAILABLE, "repair_or_adopt_session", 401),
+  refresh_invalid: guidance(SESSION_CONTEXT_UNAVAILABLE, "repair_or_adopt_session", 401),
+  refresh_expired: guidance(SESSION_CONTEXT_UNAVAILABLE, "repair_or_adopt_session", 401),
+  refresh_replayed: guidance(SESSION_CONTEXT_UNAVAILABLE, "repair_or_adopt_session", 401),
+  refresh_revoked: guidance(SESSION_CONTEXT_UNAVAILABLE, "repair_or_adopt_session", 401),
+  refresh_recovery_unavailable: guidance(SESSION_CONTEXT_UNAVAILABLE, "repair_or_adopt_session", 401),
+  refresh_custody_invalid: guidance(SESSION_CONTEXT_UNAVAILABLE, "repair_or_adopt_session", 401),
+  session_store_unwritable: guidance("The Ceal client could not write its local session store; the operating system refused the write (EACCES, EPERM, or EROFS). rerun_outside_agent_sandbox reruns it with escalated execution.", "rerun_outside_agent_sandbox", 500),
+  local_output_exists: guidance("The selected local output path already exists; nothing was written to it.", "choose_new_output_path", 400),
+  local_output_outside_result_root: guidance("The selected local output path lies outside this run's result root; only a path inside the result root named here is writable.", "choose_new_output_path", 400),
+  local_output_unwritable: guidance("The Ceal client could not write the result file at its local path; the operating system refused the write. When that step followed the Gateway call, the call may already have completed a write effect that a rerun repeats. rerun_outside_agent_sandbox reruns it with escalated execution.", "rerun_outside_agent_sandbox", 500),
+  local_output_unavailable: guidance("The Gateway result could not be materialized at the selected local path; report this as a gap.", "answer_with_gap", 500),
+  local_materialization_required: guidance("The Gateway result could not be materialized at the selected local path; report this as a gap.", "answer_with_gap", 500),
+  contract_artifact_cache_invalid: guidance("The verified contract artifact could not be stored in the private local cache; report this as a gap.", "answer_with_gap", 500),
+  response_encoding_failed: guidance("The local response could not be encoded; report this as a gap.", "answer_with_gap", 500),
+  request_timeout: guidance(GATEWAY_TRANSPORT_UNAVAILABLE, "ask_admin", 504),
+  request_failed: guidance(GATEWAY_TRANSPORT_UNAVAILABLE, "ask_admin", 502),
+  gateway_unavailable: guidance(GATEWAY_TRANSPORT_UNAVAILABLE, "ask_admin", 503, true),
+  contract_mismatch: guidance("Install or upgrade the Ceal CLI and Host Relay to the same release as the Gateway, then retry.", "upgrade_ceal_client", 409),
+  // `gateway_starting` is the one retryable envelope the serving gate answers on every route while starting
+  // (`cli/internal/client/gateway_startup_wait.go` re-drives it); the sentence is the client default that renders
+  // when the wait ends still unserved, moved from the `localFailureText` default branch.
+  [CEAL_GATEWAY_STARTING_FAILURE_CODE]: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 503, true),
+  gateway_internal_error: guidance("The Gateway failed without exposing internal state; report this as a gap.", "answer_with_gap", 500),
+  // The serving gate emits this code with no message; the sentence is the owner-normalized form of the
+  // `gateway_internal_error` guidance (decided with the operator 2026-10-13).
+  internal_error: guidance("The Gateway failed without exposing internal state.", "answer_with_gap", 500),
+  // Owned by the Gateway canonical adapter (`gateway/core/src/gateway-canonical-operation-http-adapter.ts`):
+  // the client variant of this sentence in `localFailureText` was retired when the client started reading this table.
+  request_body_too_large: guidance("The Gateway request body exceeds its bounded limit.", "reduce_request_size", 413),
+  // Restored verbatim from the retired `localFailureText` `unknown_outcome`
+  // case: the outcome is unknown, so a read may be retried while a write
+  // must receipt-check first. Collapsing both to "do not repeat the call"
+  // forbids the safe read retry the sentence exists to allow.
+  unknown_outcome: guidance("The transport outcome is unknown: a read may be retried; for a write, check write_receipt.get before repeating.", "answer_with_gap", 500),
+  // Restored verbatim from the retired `localFailureText`
+  // `refresh_unknown_outcome` case: a refresh that ends unknown leaves the
+  // session context unavailable, so the caller repairs or adopts the
+  // session instead of reporting a transport gap.
+  refresh_unknown_outcome: guidance(SESSION_CONTEXT_UNAVAILABLE, "repair_or_adopt_session", 401),
+  request_cancelled: guidance("The caller cancelled the request before it completed.", "retry", 400, true),
+  expired: guidance("The activation transaction or its administrator approval request expired before completion; repeat the original activation arguments to start a new transaction.", "repeat_original_arguments", 410, true),
+  denied: guidance("An administrator denied this device's activation request; ask an administrator whether to reconsider it.", "ask_admin", 403),
+  device_approval_pending_limit: guidance("Device approval requests are already waiting for an administrator decision; ask an administrator to decide a pending request before adding another device.", "ask_admin", 429),
+  session_already_adopted: guidance("The requested enrollment was not started because this machine already has a live session with the Gateway. Report this as a gap if that local session needs replacement.", "answer_with_gap", 409),
+  pending_adoption_limit: guidance("This device's pending activation file is full; another activation is refused while an administrator decision is pending. Report this as a gap.", "answer_with_gap", 429),
+  recovery_required: guidance("The Gateway could not safely complete the activation transaction automatically; ask an administrator to recover this transaction.", "ask_admin", 500),
+  unsupported_feature: guidance("This Ceal client does not support the Gateway's required activation protocol; ask an administrator to update the client.", "ask_admin", 501),
+  // Activation commit codes rendered through the `localFailureText` default before phase 2b; `retryable` is moved from the
+  // emitting sites in `cli/internal/client/gateway_installation_activation.go` and `activation.go:483`.
+  activation_state_commit_failed: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 500, true),
+  activation_response_invalid: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 502, true),
+  activation_rejected: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 502),
+  activation_failed: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 500),
+  activation_binding: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 400),
+  activation_crypto: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 500),
+  activation_state_invalid: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 500),
+  // Long-tail local codes rendered through the `localFailureText` default before phase 2b; sentences moved from that branch.
+  invalid_response: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 500),
+  invalid_configuration: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 500),
+  activation_state_unavailable: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 500),
+  activation_code_invalid: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 400),
+  activation_code_file_invalid: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 400),
+  activation_code_unavailable: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 404),
+  bootstrap_file_invalid: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 400),
+  bootstrap_not_active: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 409),
+  bootstrap_unauthorized: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 401),
+  // The Gateway owner-bootstrap store file was never created, so the Gateway
+  // holds no owner bootstrap to exchange (`gateway/src/host/owner-bootstrap-http-composition.ts`
+  // `absent`, stored at `gateway/src/shared/installation/owner-bootstrap-store.ts:162`);
+  // the sentence is the owner-normalized form of that store error. Non-retryable:
+  // repeating the exchange cannot create the store; only an administrator
+  // placing a bootstrap (fresh gateway setup) changes the outcome.
+  [CEAL_OWNER_BOOTSTRAP_ABSENT_FAILURE_CODE]: guidance("The Gateway holds no owner bootstrap to exchange; report this as a gap.", "answer_with_gap", 503),
+  // The Gateway owner-bootstrap store file exists but cannot be read, so the
+  // exchange cannot proceed (`gateway/src/host/owner-bootstrap-http-composition.ts`
+  // `unavailable`, stored at `gateway/src/shared/installation/owner-bootstrap-store.ts:163`);
+  // the sentence is the owner-normalized form of that store error. Retryable:
+  // unlike `absent`, a later exchange may succeed once the store is readable.
+  [CEAL_OWNER_BOOTSTRAP_UNAVAILABLE_FAILURE_CODE]: guidance("The Gateway owner bootstrap store is unavailable; retry the exchange.", "retry", 503, true),
+  context_selection_ambiguous: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 400),
+  session_authority_unverified: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 401),
+  session_authority_mismatch: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 409),
+  local_credential_lost: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 401),
+  local_capability_invalid: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 500),
+  host_unavailable: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 503),
+  host_activation_failed: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 500),
+  doctor_unavailable: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 503),
+  admin_sign_in_invalid: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 502),
+  // `invalid_request` renders through the client default today (local encode/path faults); Gateway-answered
+  // envelopes carry the Gateway message verbatim and never read this sentence.
+  invalid_request: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 400),
+  // Gateway canonical-route codes, sentences moved from their minting adapters; statuses moved from the
+  // `valid*Failure` decoder maps in `cli/internal/client/gateway_api.go` and `transport.go`.
+  invalid_json: guidance("The Gateway request body must be valid JSON.", "answer_with_gap", 400),
+  // Per-route variants name their route; the table holds the one stable guidance and the route's `allow`
+  // header stays the measured fact (decided with the operator 2026-10-13).
+  method_not_allowed: guidance("The HTTP method is not allowed for this Gateway route.", "answer_with_gap", 405),
+  request_target_too_large: guidance("The Gateway request target exceeds its bounded limit.", "reduce_request_size", 414),
+  route_not_found: guidance("The Gateway route is not present.", "answer_with_gap", 404),
+  artifact_unavailable: guidance("The Gateway artifact is unavailable.", "answer_with_gap", 503),
+  discovery_unavailable: guidance("The Gateway discovery manifest is unavailable.", "answer_with_gap", 503),
+  serialization_failed: guidance("The Gateway response could not be serialized.", "answer_with_gap", 500),
+  request_header_too_large: guidance("A consumed Gateway request header exceeds its bounded limit.", "answer_with_gap", 431),
+  request_work_context_missing: guidance("The Gateway command requires a Request work context.", "answer_with_gap", 400),
+  request_work_context_invalid: guidance("The Gateway Request work context encoding is invalid.", "answer_with_gap", 400),
+  request_work_context_refused: guidance("The Host-only discovery manifest takes no Request work context.", "answer_with_gap", 400),
+  // Moved from `gateway/src/operations/http-composition.ts` (`unauthorized`) and `command-runtime.ts:827`
+  // (`artifact_stale`); both travel with Gateway messages verbatim online, so these sentences are the
+  // owner fallback guidance. `unauthorized` re-authenticates through the session, hence its action.
+  unauthorized: guidance("Unauthorized.", "repair_or_adopt_session", 401),
+  artifact_stale: guidance("The requested contract artifact is not the current catalog artifact.", "answer_with_gap", 409),
+  // Host mint classifications. The CLI emits `invocation_authentication_unavailable` with the classification
+  // in its detail fact; rows without their own sentence share that code's moved sentence, while `next_action`
+  // is moved from `canonicalHostAuthenticationNextActions` (generated from `CEAL_HOST_AUTHENTICATION_POLICY`)
+  // and `retryable` from `hostAuthenticationFailureForCause` (`failure.nextAction == "retry"`). The three rows
+  // with their own sentences carry the retired policy remedies as Gateway-owned guidance. Statuses are the
+  // Gateway-owned mapping decided with the operator 2026-10-13. This covers every wire cause the maps at
+  // `host/invocation-authentication-command.ts:217-242` emit, through their policy classifications.
+  host_arguments_invalid: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "answer_with_gap", 400),
+  host_configuration_invalid: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "answer_with_gap", 500),
+  host_session_unavailable: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "answer_with_gap", 401),
+  // Moved from the retired `CEAL_HOST_AUTHENTICATION_POLICY` remedy: the
+  // missing exact-turn fact names the fresh Host turn, not a reinstall.
+  host_context_unavailable: guidance("The Host has not activated an invocation context for this session yet. Wait for the Host turn hook to register the session, then retry this command.", "retry", 401, true),
+  host_invocation_context_stale: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "retry", 401, true),
+  host_invocation_context_expired: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "retry", 401, true),
+  host_source_refused: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "answer_with_gap", 403),
+  host_registration_credential_refused: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "ask_admin", 403),
+  host_mint_gateway_unavailable: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "ask_admin", 503),
+  host_mint_gateway_rate_limited: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "answer_with_gap", 429),
+  host_mint_gateway_refused: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "answer_with_gap", 502),
+  host_mint_gateway_response_invalid: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "answer_with_gap", 502),
+  // Moved from the retired `CEAL_HOST_AUTHENTICATION_POLICY` remedy: the
+  // producer-frame fault names the administrator repair step.
+  host_producer_frame_invalid: guidance("Ask an administrator to inspect and repair the producer frame, then start a fresh Host turn.", "ask_admin", 400),
+  // Moved from the retired `CEAL_HOST_AUTHENTICATION_POLICY` remedy: the
+  // sandboxed Relay socket names the run-alone retry.
+  host_relay_permission_denied: guidance("An agent sandbox denied the Host Relay socket; run `ceal` as the only command, with no pipe, redirect, or `&&`, so the Host allow rule runs it outside the sandbox.", "rerun_outside_agent_sandbox", 403),
+  host_relay_unavailable: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "answer_with_gap", 503),
+  host_mint_transient_retryable: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "retry", 503, true),
+  host_mint_failed: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "answer_with_gap", 500),
+  host_relay_failed: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "answer_with_gap", 502),
+  host_refusal_invalid: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "answer_with_gap", 500)
+});
+function cealFailureGuidanceForCode(code) {
+  const entry2 = CEAL_FAILURE_GUIDANCE_TABLE[code];
+  if (entry2 === void 0) throw new TypeError(`Failure guidance code is not guided: ${code}.`);
+  return entry2;
+}
+var FAILURE_GUIDANCE_ENTRY_KEYS = Object.freeze(["message", "next_action", "http_status", "retryable", "redaction_class"]);
-// packages/ceal-client-protocol/src/schema-literals.ts
-var CEAL_SCHEMA_LITERALS = [
-  "ceal.activation_transport.v1",
-  CEAL_OPERATION_ACCESS_SCHEMA_VERSION,
-  CEAL_OPERATION_CATALOG_SCHEMA_VERSION,
-  "ceal.client_refresh_request.v1",
-  "ceal.client_refresh_result.v1",
-  "ceal.client_revoke_request.v1",
-  "ceal.client_revoke_result.v1",
-  CEAL_COMMAND_REQUEST_SCHEMA_VERSION,
-  "ceal.device_enrollment_challenge.v1",
-  "ceal.device_enrollment_challenge_request.v1",
-  "ceal.device_enrollment_hpke_aad.v1",
-  "ceal.device_enrollment_hpke_info.v1",
-  "ceal.device_enrollment_poll.v1",
-  "ceal.device_enrollment_poll_result.v1",
-  "ceal.device_enrollment_proof.v1",
-  "ceal.device_enrollment_start.v1",
+// packages/ceal-client-protocol/src/client-wire-contract.ts
+var CEAL_CLIENT_WIRE_CONTRACT = Object.freeze(client_wire_contract_default);
+var CEAL_CLIENT_DOCTOR_SCHEMA_VERSION = CEAL_CLIENT_WIRE_CONTRACT.doctor.schema_version;
+var clientCommands = CEAL_CLIENT_WIRE_CONTRACT.client_commands;
+var CEAL_CLIENT_DOCTOR_COMMAND = Object.freeze([...clientCommands.doctor]);
+var CEAL_CLIENT_VERSION_COMMAND = Object.freeze([...clientCommands.version]);
+var CEAL_CLIENT_ACCESS_GROUP_LIST_COMMAND = Object.freeze([...clientCommands.access_group_list]);
+function deriveCealClientWireSchemaVersion(schema) {
+  if (!/^ceal\.[a-z][a-z0-9_]*$/u.test(schema.schema_name) || !schema.fields.includes("schema_version") || new Set(schema.fields).size !== schema.fields.length || schema.fields.some((field) => typeof field !== "string" || !/^[a-z][a-z0-9_]*$/u.test(field))) {
+    throw new TypeError("Client wire schema name or field set is invalid.");
+  }
+  const fields = schema.fields.filter((field) => field !== "schema_version").sort();
+  const hash8 = createHash("sha256").update(cealCanonicalJson(fields), "utf8").digest("hex").slice(0, 8);
+  return `${schema.schema_name}.v1.${hash8}`;
+}
+var CealClientWireContractMismatchError = class extends Error {
+  code = "contract_mismatch";
+  next_action = cealFailureGuidanceForCode("contract_mismatch").next_action;
+  constructor(expected, actual) {
+    super(`The peer wire contract ${actual} does not match this client contract ${expected}.`);
+    this.name = "CealClientWireContractMismatchError";
+  }
+};
+function requireCealClientWireSchemaVersion(value, expected) {
+  if (typeof value === "string" && value !== expected) throw new CealClientWireContractMismatchError(expected, value);
+}
+var commandResolution = CEAL_CLIENT_WIRE_CONTRACT.command_resolution;
+var commandResolutionAuthority = commandResolution.authority;
+var commandResolutionSemanticOptions = commandResolution.semantic_options;
+var CEAL_GATEWAY_COMMAND_RESOLUTION_SCHEMA_VERSION = deriveCealClientWireSchemaVersion(commandResolution);
+var CEAL_ENCODED_JSON_DOCUMENT_MAX_BYTES = CEAL_CLIENT_WIRE_CONTRACT.encoded_json_document.max_bytes;
+var artifact = CEAL_CLIENT_WIRE_CONTRACT.artifact_descriptor;
+var request = CEAL_CLIENT_WIRE_CONTRACT.command_request;
+var response = CEAL_CLIENT_WIRE_CONTRACT.command_response;
+var CEAL_OPERATION_CONTRACT_BUNDLE_SCHEMA_VERSION = deriveCealClientWireSchemaVersion({ schema_name: artifact.operation_contract_bundle_schema_name, fields: artifact.operation_contract_bundle_fields });
+var CEAL_VERIFIED_ARTIFACT_DESCRIPTOR_SCHEMA_VERSION = deriveCealClientWireSchemaVersion(artifact);
+var CEAL_VERIFIED_ARTIFACT_BINDING_SCHEMA_VERSION = deriveCealClientWireSchemaVersion({ schema_name: artifact.binding_schema_name, fields: artifact.binding_fields });
+var CEAL_VERIFIED_ARTIFACT_KIND = artifact.kind;
+var CEAL_VERIFIED_ARTIFACT_BINDING_KIND = artifact.binding_kind;
+var CEAL_VERIFIED_ARTIFACT_MEDIA_TYPE = artifact.media_type;
+var CEAL_VERIFIED_ARTIFACT_DIGEST_LENGTH = artifact.digest.length;
+var CEAL_VERIFIED_ARTIFACT_DIGEST_PATTERN = artifact.digest.pattern;
+var CEAL_VERIFIED_ARTIFACT_CATALOG_REVISION_LENGTH = artifact.catalog_revision.length;
+var CEAL_VERIFIED_ARTIFACT_CATALOG_REVISION_PATTERN = artifact.catalog_revision.pattern;
+var CEAL_VERIFIED_ARTIFACT_MAX_BYTES = CEAL_ENCODED_JSON_DOCUMENT_MAX_BYTES;
+var CEAL_VERIFIED_ARTIFACT_DESCRIPTOR_MAX_BYTES = artifact.envelope_max_bytes;
+var CEAL_COMMAND_REQUEST_SCHEMA_VERSION = deriveCealClientWireSchemaVersion(request);
+var CEAL_COMMAND_REQUEST_MAX_BYTES = request.absolute_transport_max_bytes;
+var CEAL_COMMAND_RESPONSE_BARE_DOCUMENT_MAX_BYTES = response.bare_document_max_bytes;
+var CEAL_COMMAND_RESPONSE_BARE_DOCUMENT_OPTIONAL_FIELDS = Object.freeze([...response.bare_document_optional_fields]);
+var CEAL_COMMAND_RESPONSE_DISCOVERY_COMMAND = response.discovery_command;
+var CEAL_COMMAND_RESPONSE_DISCOVERY_MANIFEST_SCHEMA_VERSION = deriveCealClientWireSchemaVersion({ schema_name: response.discovery_manifest_schema_name, fields: response.discovery_manifest_fields });
+var CEAL_COMMAND_RESPONSE_SCHEMA_VERSION = deriveCealClientWireSchemaVersion(response);
+var CEAL_COMMAND_RESPONSE_DISCOVERY_MANIFEST_DOCUMENT_FIELDS = Object.freeze([...response.discovery_manifest_document_fields]);
+var CEAL_COMMAND_RESPONSE_MAX_BYTES = CEAL_ENCODED_JSON_DOCUMENT_MAX_BYTES;
+var CEAL_RESOURCE_STREAM_REQUEST_SCHEMA_VERSION = deriveCealClientWireSchemaVersion({ schema_name: CEAL_CLIENT_WIRE_CONTRACT.resource_stream.request_schema_name, fields: CEAL_CLIENT_WIRE_CONTRACT.resource_stream.request_fields });
+var CEAL_RESOURCE_STREAM_REQUEST_FIELDS = Object.freeze([...CEAL_CLIENT_WIRE_CONTRACT.resource_stream.request_fields]);
+// packages/ceal-client-protocol/src/operation-withheld-cause.ts
+var CEAL_OPERATION_WITHHELD_CAUSES = vocabulary(["provider_permission", "access_level", "personal_authorization_required"]);
+// packages/ceal-client-protocol/src/operation-contract-types.ts
+var CEAL_JSON_SCHEMA_2020_12 = "https://json-schema.org/draft/2020-12/schema";
+var CEAL_OPERATION_DESCRIPTOR_SCHEMA_VERSION = "ceal.operation_descriptor.v1";
+var CEAL_OPERATION_ERROR_SCHEMA_VERSION = "ceal.operation_error.v1";
+var CEAL_ARTIFACT_STAGE_TERMINALS = vocabulary(["chunk_accepted", "artifact_ready", "idempotency_replayed"]);
+var CEAL_RETRY_AFTER_MAX_MS = 60 * 60 * 1e3;
+var CEAL_JSON_SCHEMA_TYPES = vocabulary(["object", "array", "string", "integer", "number", "boolean", "null"]);
+var OBSERVATION_POSTURES = vocabulary(["direct_readback", "approved_no_readback", "operator_mediated", "excluded"]);
+var EFFECT_DOMAINS = vocabulary(["none", "gateway_state", "provider", "external_world"]);
+var SAFETY_CLASSES = vocabulary(["routine", "sensitive", "high_impact"]);
+var IDEMPOTENCY_CLASSES = vocabulary(["idempotent", "conditionally_idempotent", "non_idempotent"]);
+var REVERSIBILITY_CLASSES = vocabulary(["none", "reversible", "compensatable", "irreversible"]);
+var COMPENSATION_OWNERS = vocabulary(["none", "connector", "operator"]);
+var CANCELLATION_BOUNDARIES = vocabulary(["before_admission", "before_handoff", "after_handoff_reconcile"]);
+var HANDOFF_CLASSES = vocabulary(["not_applicable", "submission", "effect"]);
+var AUTHORITATIVE_READBACK_CLASSES = vocabulary(["required", "unavailable"]);
+var PROVIDER_READBACK_CLASSES = vocabulary(["required", "not_available", "not_applicable"]);
+var RECONCILIATION_CLASSES = vocabulary(["none", "automatic", "operator"]);
+var NO_READBACK_APPROVAL_CLASSES = vocabulary(["not_applicable", "explicit", "operator"]);
+var REPLAY_PREREQUISITES = vocabulary(["never", "fresh_admission", "reconciled_non_application", "operator_approval"]);
+var UNKNOWN_OUTCOMES = vocabulary(["reconcile", "operator_action", "excluded"]);
+var RECOVERY_OWNERS = vocabulary(["gateway", "connector", "operator"]);
+var CEAL_OPERATION_ADMISSION_STATES = vocabulary(["proposed", "refused", "admitted"]);
+var CEAL_OPERATION_EXECUTION_STATES = vocabulary(["not_started", "started", "completed"]);
+var CEAL_OPERATION_PROVIDER_HANDOFF_STATES = vocabulary(["not_offered", "offered", "accepted", "rejected", "unknown"]);
+var CEAL_OPERATION_EFFECT_STATES = vocabulary(["none", "applied", "failed", "unknown", "compensated"]);
+var CEAL_OPERATION_OBSERVATION_STATES = vocabulary(["not_started", "not_required", "pending", "observed", "unavailable"]);
+var CEAL_OPERATION_RECOVERY_KINDS = vocabulary(["none", "reconcile", "compensate", "operator_action"]);
+var CEAL_OPERATION_RECOVERY_STATUSES = vocabulary(["not_started", "active", "completed"]);
+var CEAL_OPERATION_PROVIDER_READBACK_AVAILABILITY = vocabulary(["not_started", "not_applicable", "not_available", "pending", "available"]);
+var CEAL_OPERATION_OFFERED_HANDOFF_STATES = vocabulary(["accepted", "rejected", "unknown"]);
+var CEAL_OPERATION_RECEIPT_AUTHORITY_KEYS = Object.freeze(["instance_ref", "access_group_ref", "principal_ref", "execution_subject_ref", "authority_revision_ref"]);
+var CEAL_OPERATION_APPROVAL_DISPOSITIONS = vocabulary([
+  "approval_not_required_by_policy",
+  "interactive_pending",
+  "interactive_granted",
+  "interactive_denied",
+  "interactive_expired",
+  "interactive_unavailable"
+]);
+// packages/ceal-client-protocol/src/operation-access-class.ts
+var CEAL_OPERATION_ACCESS_CLASSES = vocabulary(["read", "write"]);
+// packages/ceal-client-protocol/src/domain-vocabulary.ts
+var CEAL_CONNECTOR_STATUSES = vocabulary(["active", "disabled", "disconnected"]);
+var CEAL_CONNECTOR_CUSTODIES = vocabulary(["organization", "personal"]);
+var CEAL_ACCESS_LEVELS = vocabulary(["none", "read", "read_write"]);
+var CEAL_PERSONAL_ACCESS_CEILINGS = vocabulary(["disabled", "read", "read_write"]);
+var CEAL_TARGET_REF_PATTERN = "^[^\\p{Cc}]+$";
+var TARGET_REF = new RegExp(CEAL_TARGET_REF_PATTERN, "u");
+var CEAL_TARGET_VISIBILITIES = vocabulary(["public", "private"]);
+var CEAL_PRINCIPAL_KINDS = vocabulary(["human", "runtime"]);
+var CEAL_PERSISTED_PRINCIPAL_KINDS = vocabulary(["human", "service", "runtime"]);
+var CEAL_ORGANIZATION_ROLES = vocabulary(["member", "admin"]);
+var CEAL_CALENDAR_PERIODS = vocabulary(["day", "week", "month"]);
+var LABEL_EXPECTATION = `public-safe display text of at most ${CEAL_PUBLIC_DISPLAY_NAME_MAX_BYTES} bytes`;
+// packages/ceal-client-protocol/src/safe-json-budget.ts
+var SAFE_JSON_MIN_BYTES_PER_NODE = 4;
+function safeJsonNodeBudgetForBytes(maxBytes) {
+  if (!Number.isSafeInteger(maxBytes) || maxBytes < SAFE_JSON_MIN_BYTES_PER_NODE) {
+    throw new RangeError(`safe-JSON byte cap is invalid: ${refusalFact("maxBytes", maxBytes, `at least ${SAFE_JSON_MIN_BYTES_PER_NODE} bytes`)}`);
+  }
+  return Math.floor(maxBytes / SAFE_JSON_MIN_BYTES_PER_NODE);
+}
+// packages/ceal-client-protocol/src/protocol-bounds.ts
+var CEAL_PROTOCOL_RESPONSE_VALUE_MAX_BYTES = 64 * 1024;
+var CEAL_PROTOCOL_RESPONSE_VALUE_MAX_NODES = safeJsonNodeBudgetForBytes(CEAL_PROTOCOL_RESPONSE_VALUE_MAX_BYTES);
+var OPERATION_SCHEMA_LITERAL_MAX_BYTES = CEAL_PROTOCOL_RESPONSE_VALUE_MAX_BYTES / 4;
+var CEAL_OPERATION_JSON_SCHEMA_BUDGET = Object.freeze({
+  max_depth: 8,
+  max_properties: 96,
+  max_string_length: OPERATION_SCHEMA_LITERAL_MAX_BYTES / 4,
+  max_alternatives: 8,
+  max_enum_values: 64,
+  max_literal_bytes: OPERATION_SCHEMA_LITERAL_MAX_BYTES,
+  /** @basis our_policy -- bounds explanatory schema prose carried in one catalog. */
+  max_description_characters: 1024,
+  /** @basis our_policy -- bounds regular-expression compilation input from one schema. */
+  max_pattern_characters: 256,
+  /** @basis our_policy -- bounds traversal work inside one already byte-bounded schema literal. */
+  max_literal_nodes: 512
+});
+// packages/ceal-client-protocol/src/operation-json-schema.ts
+var JSON_DESCRIPTION_CONTROL_CHARACTER = new RegExp("\\p{Cc}", "u");
+// packages/ceal-client-protocol/src/operation-contract-validation.ts
+var CEAL_OPERATION_AUTHORITY_POLICY_KEYS = Object.freeze(["access_group", "instance_binding", "target", "admission_recheck"]);
+var MAX_OPERATION_INPUT_RESOLVER_BINDINGS = 96;
+var CEAL_OPERATION_DESCRIPTOR_REQUIRED_ENVELOPE_KEYS = Object.freeze(["schema_version", "id", "input_contract", "result_contract", "policy"]);
+var CEAL_OPERATION_DESCRIPTOR_OPTIONAL_ENVELOPE_KEYS = Object.freeze(["input_resolution", "summary"]);
+// packages/ceal-client-protocol/src/operation-catalog.ts
+var CEAL_OPERATION_CATALOG_SCHEMA_VERSION = "ceal.catalog.v3";
+var CLIENT_AUDIENCES = Object.freeze(["ceal", "cealctl", "agent"]);
+var CLIENT_AUDIENCE_SET = new Set(CLIENT_AUDIENCES);
+// packages/ceal-client-protocol/src/schema-literals.ts
+var CEAL_SCHEMA_LITERALS = [
+  "ceal.activation_transport.v1",
+  CEAL_OPERATION_ACCESS_SCHEMA_VERSION,
+  CEAL_OPERATION_CATALOG_SCHEMA_VERSION,
+  "ceal.client_refresh_request.v1",
+  "ceal.client_refresh_result.v1",
+  "ceal.client_revoke_request.v1",
+  "ceal.client_revoke_result.v1",
+  CEAL_COMMAND_REQUEST_SCHEMA_VERSION,
+  "ceal.device_enrollment_challenge.v1",
+  "ceal.device_enrollment_challenge_request.v1",
+  "ceal.device_enrollment_hpke_aad.v1",
+  "ceal.device_enrollment_hpke_info.v1",
+  "ceal.device_enrollment_poll.v1",
+  "ceal.device_enrollment_poll_result.v1",
+  "ceal.device_enrollment_proof.v1",
+  "ceal.device_enrollment_start.v1",
   "ceal.device_enrollment_start_result.v1",
   "ceal.effect_approval.v1",
   "ceal.effect_approval_confirmation.v1",
@@ -836,12 +1083,12 @@ var CEAL_SCHEMA_LITERALS = [
   "ceal.enrollment_result.v1",
   "ceal.first_activation_causal_join.v1",
   "ceal.gateway_announcement_policy.v1",
-  "ceal.gateway_audit_call_detail.v1",
+  CEAL_GATEWAY_AUDIT_CALL_DETAIL_SCHEMA_VERSION,
   "ceal.gateway_audit_event.v1",
   "ceal.gateway_audit_readback.v1",
   "ceal.gateway_authorization_snapshot.v1",
   "ceal.gateway_cache_origin.v1",
-  "ceal.gateway_call_result.v1",
+  CEAL_GATEWAY_CALL_RESULT_SCHEMA_VERSION,
   CEAL_GATEWAY_COMMAND_RESOLUTION_SCHEMA_VERSION,
   "ceal.gateway_connector_route_failure.v1",
   "ceal.gateway_discovery.v1",
@@ -866,7 +1113,7 @@ var CEAL_SCHEMA_LITERALS = [
   "ceal.host_observation.v1",
   "ceal.host_registration_request.v1",
   "ceal.host_registration_result.v1",
-  "ceal.operation_descriptor.v1",
+  CEAL_OPERATION_DESCRIPTOR_SCHEMA_VERSION,
   "ceal.operation_error.v1",
   "ceal.operation_failure.v1",
   "ceal.operation_failure.compact.v1",
@@ -975,11 +1222,22 @@ var CEAL_VERIFIED_ARTIFACT_DESCRIPTOR_JSON_SCHEMA = Object.freeze({
 var CEAL_OPAQUE_HANDLE_KINDS = vocabulary(["target", "message", "thread", "artifact", "document", "block", "object"]);
 var CEAL_OPAQUE_REF_KINDS = vocabulary([...CEAL_OPAQUE_HANDLE_KINDS, "result", "operation-receipt", "reply-receipt", "field", "notion-data-source"]);
+// packages/ceal-client-protocol/src/client-environment-generated.ts
+var CEAL_CLIENT_CONTEXT_OVERRIDE_ENVIRONMENTS = Object.freeze(["CEAL_GATEWAY_ORIGIN", "CEAL_GATEWAY_TRANSPORT_ORIGIN", "CEAL_ACCESS_TOKEN", "CEAL_CONTEXT_STORE_PATH"]);
+// packages/ceal-client-protocol/src/client-process-contract.ts
+var CEAL_CLIENT_VERSION_SCHEMA_SUFFIX = ".version.v1";
+var CEAL_CLIENT_VERSION_SCHEMA_VERSION = `ceal${CEAL_CLIENT_VERSION_SCHEMA_SUFFIX}`;
 // packages/ceal-client-protocol/src/bare-document.ts
 var REQUIRED_FIELDS = CEAL_CLIENT_WIRE_CONTRACT.command_response.bare_document_fields;
 var OPTIONAL_FIELDS = CEAL_CLIENT_WIRE_CONTRACT.command_response.bare_document_optional_fields;
+// packages/ceal-client-protocol/src/actor-kind.ts
+var CEAL_ACTOR_KINDS = vocabulary(["human", "bot", "app", "unknown"]);
 // packages/ceal-client-protocol/src/resource-row.ts
+var CEAL_RESOURCE_ROW_TITLE_MATCH_DISPOSITIONS = vocabulary(["exact", "not_exact", "unknown"]);
 var CEAL_RESOURCE_SEARCH_ORDERS = vocabulary(["relevance", "modified", "viewed", "created"]);
 var CEAL_RESOURCE_SEARCH_DIRECTIONS = vocabulary(["ascending", "descending"]);
 var CEAL_RESOURCE_SEARCH_FILTERS = vocabulary(["query", "modified_since", "since", "until", "authored_by_me", "authored_by", "include_replies", "kinds", "container_ref", "container_refs", "container_names", "addressed_to_me", "unread"]);
@@ -992,6 +1250,8 @@ var CEAL_ACTIVITY_TIMESTAMP_BASES = vocabulary([
   "resource_created",
   "review_submitted",
   "comment_created",
+  "reaction_created",
+  "ceal_write_completed",
   "event_start",
   "all_day_start",
   "file_created",
@@ -1026,6 +1286,10 @@ var CEAL_ACTIVITY_EVENT_KINDS = vocabulary([
   "github.review.submitted",
   "github.issue_comment.created",
   "github.review_comment.created",
+  "github.reaction.created",
+  "github.reaction.deleted",
+  "github.pull_request.review_requested",
+  "github.pull_request.review_request_removed",
   "calendar.organized",
   "calendar.accepted_invite",
   "calendar.recorded",
@@ -1047,6 +1311,10 @@ var CEAL_ACTIVITY_EVENT_TIMESTAMP_BASIS_MAP = Object.freeze({
   "github.pull_request.opened": "resource_created",
   "github.issue.edited": "resource_modified",
   "github.pull_request.edited": "resource_modified",
+  "github.reaction.created": "reaction_created",
+  "github.reaction.deleted": "ceal_write_completed",
+  "github.pull_request.review_requested": "ceal_write_completed",
+  "github.pull_request.review_request_removed": "ceal_write_completed",
   "calendar.organized": "resource_created",
   "drive.file.created": "file_created",
   "drive.file.modified": "file_modified_by_me",
@@ -1063,12 +1331,14 @@ var RESOURCE_ROW_KEY_RULES = Object.freeze({
   next: { required: true, timestamp: false },
   kind: { required: true, timestamp: false },
   matched_kinds: { required: false, timestamp: false },
+  title_match: { required: false, timestamp: false },
   title: { required: true, timestamp: false },
   container_label: { required: true, timestamp: false },
   container_ref: { required: false, timestamp: false },
   source_url: { required: false, timestamp: false },
   source: { required: true, timestamp: false },
   owner: { required: false, timestamp: false },
+  actor_kind: { required: false, timestamp: false },
   counterparts: { required: false, timestamp: false },
   attachments: { required: false, timestamp: false },
   created_at: { required: false, timestamp: true },
@@ -1076,9 +1346,18 @@ var RESOURCE_ROW_KEY_RULES = Object.freeze({
   modified_at: { required: false, timestamp: true },
   modified_at_local: { required: false, timestamp: true },
   viewed_by_me_at: { required: false, timestamp: true },
+  modified_by_me_at: { required: false, timestamp: true },
   own_ceal_write: { required: false, timestamp: false },
   owned_by_me: { required: false, timestamp: false },
+  mime_type: { required: false, timestamp: false },
+  size_bytes: { required: false, timestamp: false },
+  version: { required: false, timestamp: false },
+  trashed: { required: false, timestamp: false },
   visibility: { required: false, timestamp: false },
+  archived: { required: false, timestamp: false },
+  tag: { required: false, timestamp: false },
+  labels: { required: false, timestamp: false },
+  labels_incomplete: { required: false, timestamp: false },
   start: { required: false, timestamp: false },
   end: { required: false, timestamp: false },
   status: { required: false, timestamp: false },
@@ -1151,18 +1430,29 @@ var CEAL_REFRESH_FAILURE_CODES = vocabulary([
   // The serving gate answers this while the Gateway is still starting and the
   // refresh was never attempted; the same attempt stays retryable. It is never
   // stored by the session owner, only answered at the serving edge.
-  "gateway_starting"
+  CEAL_GATEWAY_STARTING_FAILURE_CODE
+]);
+var CEAL_CLIENT_REVOKE_FAILURE_CODES = vocabulary([
+  "refresh_invalid",
+  "refresh_expired",
+  "refresh_replayed",
+  "refresh_revoked"
 ]);
+var CEAL_PERSONAL_CLIENT_ACCESS_TOKEN_PREFIX = "ceal_personal_";
+var CEAL_PERSONAL_CLIENT_REFRESH_TOKEN_PREFIX = "ceal_refresh_";
+var PERSONAL_CLIENT_TOKEN_SUFFIX_PATTERN = "[A-Za-z0-9_-]{43}";
+var CEAL_PERSONAL_CLIENT_ACCESS_TOKEN = new RegExp(`^${CEAL_PERSONAL_CLIENT_ACCESS_TOKEN_PREFIX}${PERSONAL_CLIENT_TOKEN_SUFFIX_PATTERN}$`, "u");
+var CEAL_PERSONAL_CLIENT_REFRESH_TOKEN = new RegExp(`^${CEAL_PERSONAL_CLIENT_REFRESH_TOKEN_PREFIX}${PERSONAL_CLIENT_TOKEN_SUFFIX_PATTERN}$`, "u");
 // packages/ceal-client-protocol/src/request-validation-primitives.ts
-import { createHash } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
 var DIGEST = /^[a-f0-9]{64}$/u;
 var CEAL_SHA256_DIGEST_PATTERN = DIGEST.source;
 function isCealDigest(value) {
   return typeof value === "string" && DIGEST.test(value);
 }
 function cealRequestSha256(value) {
-  return createHash("sha256").update(cealCanonicalJson(value), "utf8").digest("hex");
+  return createHash2("sha256").update(cealCanonicalJson(value), "utf8").digest("hex");
 }
 function operationRecord(value, message) {
   requireOperationRecord(value, message);
@@ -1178,40 +1468,71 @@ function requirePrefixedRef(value, prefix, message) {
 // packages/ceal-client-protocol/src/request-authority.ts
 var CEAL_REQUEST_SCHEMA_VERSION = "ceal.request.v1";
 var CEAL_REQUEST_ARTIFACT_OWNERS = vocabulary(["gateway", "host", "connector"]);
-var CEAL_REQUEST_HOST_BINDING_KEYS = vocabulary(["prompt_ref", "host_session_ref", "host_turn_ref", "host_source_ref"]);
+var CEAL_HOST_INVOCATION_IDENTITY_KEYS = vocabulary(["host_session_ref", "host_turn_ref", "host_source_ref"]);
 var CEAL_REQUEST_ARTIFACT_RETENTION_CLASSES = vocabulary(["request", "source", "result"]);
 var CANCELLATION_STATES = vocabulary(["requested", "cancelled"]);
-var CEAL_REQUEST_KEYS = Object.freeze(["schema_version", "ceal_request_ref", "created_at", "authority", "prompt_ref", "host_session_ref", "host_turn_ref", "host_source_ref"]);
+var CEAL_REQUEST_KEYS = Object.freeze(["schema_version", "ceal_request_ref", "created_at", "authority"]);
+var CEAL_REQUEST_COMMON_PROPERTIES = Object.freeze({
+  schema_version: { type: "string", const: CEAL_REQUEST_SCHEMA_VERSION, maxLength: 32 },
+  ceal_request_ref: { type: "string", minLength: 1, maxLength: 128, pattern: "^ceal-request:[A-Za-z0-9][A-Za-z0-9._:-]{0,114}$" },
+  created_at: { type: "string", minLength: 1, maxLength: 64 },
+  authority: {
+    type: "object",
+    maxProperties: 5,
+    additionalProperties: false,
+    properties: {
+      instance_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
+      access_group_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
+      principal_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
+      execution_subject_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
+      authority_revision_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source }
+    },
+    required: ["instance_ref", "access_group_ref", "principal_ref", "execution_subject_ref", "authority_revision_ref"]
+  }
+});
+var CEAL_REQUEST_HOST_PROPERTIES = Object.freeze({
+  prompt_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
+  host_session_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
+  host_turn_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
+  host_input_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
+  host_source_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source }
+});
+var CEAL_REQUEST_CALLER_PROPERTIES = Object.freeze({
+  caller_call_group_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source, description: "Gateway-minted call-group identity for a non-Host caller." },
+  caller_call_input_sha256: { type: "string", minLength: 64, maxLength: 64, pattern: "^[a-f0-9]{64}$", description: "Commitment to the exact input for active non-Host identity-reuse checks; a migrated legacy call group commits to its legacy group key because the original input may no longer exist." }
+});
+var CEAL_REQUEST_OPTIONAL_PROPERTIES = Object.freeze({
+  requester_timezone: { type: "string", minLength: 1, maxLength: 128, description: "IANA timezone observed for the requester on this Request." },
+  device_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source, description: "Device that submitted this Request through its client session, including Host turns when the authenticated Host registration carries the device; absent for older records." }
+});
+var CEAL_REQUEST_HOST_REQUIRED_KEYS = Object.freeze([...CEAL_REQUEST_KEYS, ...CEAL_HOST_INVOCATION_IDENTITY_KEYS, "prompt_ref"]);
+var CEAL_REQUEST_CALLER_REQUIRED_KEYS = Object.freeze([...CEAL_REQUEST_KEYS, "caller_call_group_ref", "caller_call_input_sha256"]);
 var CEAL_REQUEST_JSON_SCHEMA = {
   type: "object",
-  maxProperties: 11,
+  description: "A Request has exactly one creation identity: the complete Host tuple and prompt reference, or a caller call-group identity. Caller Requests retain no prompt reference or prompt body.",
+  maxProperties: 13,
   additionalProperties: false,
   properties: {
-    schema_version: { type: "string", const: CEAL_REQUEST_SCHEMA_VERSION, maxLength: 32 },
-    ceal_request_ref: { type: "string", minLength: 1, maxLength: 128, pattern: "^ceal-request:[A-Za-z0-9][A-Za-z0-9._:-]{0,114}$" },
-    created_at: { type: "string", minLength: 1, maxLength: 64 },
-    authority: {
+    ...CEAL_REQUEST_COMMON_PROPERTIES,
+    ...CEAL_REQUEST_HOST_PROPERTIES,
+    ...CEAL_REQUEST_CALLER_PROPERTIES,
+    ...CEAL_REQUEST_OPTIONAL_PROPERTIES
+  },
+  required: CEAL_REQUEST_KEYS,
+  anyOf: [
+    {
       type: "object",
-      maxProperties: 5,
-      additionalProperties: false,
-      properties: {
-        instance_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
-        access_group_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
-        principal_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
-        execution_subject_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
-        authority_revision_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source }
-      },
-      required: ["instance_ref", "access_group_ref", "principal_ref", "execution_subject_ref", "authority_revision_ref"]
+      required: CEAL_REQUEST_HOST_REQUIRED_KEYS,
+      properties: { ...CEAL_REQUEST_COMMON_PROPERTIES, ...CEAL_REQUEST_HOST_PROPERTIES, ...CEAL_REQUEST_OPTIONAL_PROPERTIES },
+      additionalProperties: false
     },
-    prompt_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
-    host_session_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
-    host_turn_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
-    host_input_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
-    host_source_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
-    requester_timezone: { type: "string", minLength: 1, maxLength: 128, description: "IANA timezone observed for the requester on this Request." },
-    device_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source, description: "Device that submitted this Request through its client session; absent for Host turns and older records." }
-  },
-  required: CEAL_REQUEST_KEYS
+    {
+      type: "object",
+      required: CEAL_REQUEST_CALLER_REQUIRED_KEYS,
+      properties: { ...CEAL_REQUEST_COMMON_PROPERTIES, ...CEAL_REQUEST_CALLER_PROPERTIES, ...CEAL_REQUEST_OPTIONAL_PROPERTIES },
+      additionalProperties: false
+    }
+  ]
 };
 // packages/ceal-client-protocol/src/request-operands.ts
@@ -1322,10 +1643,6 @@ var CEAL_REQUEST_RUN_BATCH_JSON_SCHEMA = {
 };
 // packages/ceal-client-protocol/src/host-observation.ts
-var CEAL_HOST_INPUT_KINDS = vocabulary(["human", "host_automatic"]);
-function isCealHostInputKind(value) {
-  return typeof value === "string" && CEAL_HOST_INPUT_KINDS.some((kind) => kind === value);
-}
 var CEAL_HOST_OBSERVATION_REF_PREFIX = "host-observation:";
 var HOST_TOKEN_OBSERVATION_BREAKDOWN_KEYS = vocabulary(["cached_input", "cache_write_input", "reasoning_output"]);
 function validateCealHostObservationDraft(value) {
@@ -1336,7 +1653,7 @@ function validateCealHostObservationDraft(value) {
   assertHostObservationValue(record6.value, record6.observation_kind);
 }
 var CEAL_REQUEST_MAX_OBSERVATION_VALUE_BYTES = 64 * 1024;
-var CEAL_HOST_OBSERVATION_KINDS = vocabulary(["prompt", "session", "turn", "model", "token", "cost", "timing"]);
+var CEAL_HOST_OBSERVATION_KINDS = vocabulary(["prompt", "session", "turn", "model", "token", "timing"]);
 function isCealHostPromptObservationValue(value) {
   return isOperationRecord(value) && Object.keys(value).length === 1 && isCealDigest(value.body_sha256);
 }
@@ -1363,10 +1680,6 @@ function inspectHostKeys(value) {
 // packages/ceal-client-protocol/src/host-prompt-ref.ts
 var CEAL_HOST_PROMPT_DIGEST_PATTERN = "^[a-f0-9]{64}$";
 var PROMPT_DIGEST = new RegExp(CEAL_HOST_PROMPT_DIGEST_PATTERN, "u");
-function hostProducerPromptRef(promptSha256) {
-  if (!PROMPT_DIGEST.test(promptSha256)) throw new TypeError("Canonical Host prompt digest is invalid.");
-  return `ceal-host-prompt:${promptSha256}`;
-}
 // packages/ceal-client-protocol/src/request-effect-approval.ts
 var CEAL_EFFECT_APPROVAL_DECISION_CHECK_PHRASES = Object.freeze([
@@ -1459,18 +1772,115 @@ var CEAL_REQUEST_GRAPH_NODE_PREPARE_READINESS_JSON_SCHEMA = {
 };
 // packages/ceal-client-protocol/src/host-invocation-authentication.ts
-var CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_SCHEMA = "ceal.host_invocation_authentication_result.v1";
+var hostInvocationAuthenticationContract = CEAL_CLIENT_WIRE_CONTRACT.host_invocation_authentication;
+var CEAL_HOST_INVOCATION_AUTHENTICATION_REQUEST_SCHEMA = deriveCealClientWireSchemaVersion({ schema_name: hostInvocationAuthenticationContract.request_schema_name, fields: hostInvocationAuthenticationContract.request_fields });
+var CEAL_HOST_INVOCATION_AUTHENTICATION_REQUEST_FIELDS = Object.freeze([...hostInvocationAuthenticationContract.request_fields]);
+var CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_SCHEMA = deriveCealClientWireSchemaVersion({ schema_name: hostInvocationAuthenticationContract.result_schema_name, fields: hostInvocationAuthenticationContract.result_fields });
+var CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_FIELDS = Object.freeze([...hostInvocationAuthenticationContract.result_fields]);
+var CEAL_HOST_AUTHENTICATION_BUDGET_PATTERN_SOURCE = "^(?:0|[1-9][0-9]{0,8})$";
+var CEAL_HOST_AUTHENTICATION_BUDGET_PATTERN = new RegExp(CEAL_HOST_AUTHENTICATION_BUDGET_PATTERN_SOURCE, "u");
 var CEAL_HOST_INVOCATION_CONTEXT_PATH = "/api/ceal/v2/host-invocation-context";
-var CEAL_HOST_INGRESS_PATH = "/api/ceal/v2/host-ingress";
-var CEAL_HOST_NONCE_ENCODED_CHARACTERS = 43;
-var CEAL_HOST_CLIENT_NONCE_PATTERN = new RegExp(`^[A-Za-z0-9_-]{${CEAL_HOST_NONCE_ENCODED_CHARACTERS}}$`, "u");
-var CEAL_HOST_CONTEXT_TOKEN_PATTERN = new RegExp(`^ceal_context_[A-Za-z0-9_-]{${CEAL_HOST_NONCE_ENCODED_CHARACTERS}}$`, "u");
-var CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_MAX_BYTES = new TextEncoder().encode(`${JSON.stringify({
-  schema_version: CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_SCHEMA,
-  context_token: `ceal_context_${"A".repeat(CEAL_HOST_NONCE_ENCODED_CHARACTERS)}`,
-  expires_at: (/* @__PURE__ */ new Date("+010000-01-01T00:00:00.000Z")).toISOString()
-})}
+var CEAL_HOST_INVOCATION_CONTEXT_REQUEST_SCHEMA = "ceal.gateway_host_invocation_context_request.v2";
+var CEAL_HOST_INVOCATION_CONTEXT_REQUEST_MAX_BYTES = 16 * 1024;
+var CEAL_HOST_INVOCATION_HUMAN_MESSAGE_WINDOW_MAX_BYTES = 2 * 1024;
+var CEAL_HOST_INVOCATION_HUMAN_MESSAGE_WINDOW_MAX_MESSAGES = 32;
+var HOST_CONTEXT_EXPIRY_MAX_CHARS = 64;
+var CEAL_HOST_INVOCATION_CONTEXT_VISIBLE_OUTPUT_MAX_BYTES = CEAL_CANONICAL_HTTP_MAX_RESPONSE_BYTES;
+var CEAL_HOST_CONTEXT_TOKEN_PREFIX = "ceal_context_";
+function decodeCealHostInvocationContextRequest(value) {
+  if (!isCealJsonRecord(value)) throw invalidInvocationContextRequest();
+  requireCealClientWireSchemaVersion(value.schema_version, CEAL_HOST_INVOCATION_CONTEXT_REQUEST_SCHEMA);
+  if (!hasInvocationContextRequestKeys(value)) throw invalidInvocationContextRequest();
+  const clientNonce = requireClientNonce(value.client_nonce);
+  const expiresAt = requireContextExpiration(value.context_expires_at);
+  const hostBinding = requireHostBinding(value.host_binding);
+  const messageWindow = requireHumanMessageWindow(value.human_message_window);
+  const lastRequestRef = optionalSafeReference(value.last_seen_request_ref);
+  const visibleOutputMaxBytes = optionalVisibleOutputBudget(value.visible_output_max_bytes);
+  return Object.freeze({
+    schema_version: CEAL_HOST_INVOCATION_CONTEXT_REQUEST_SCHEMA,
+    client_nonce: clientNonce,
+    context_expires_at: expiresAt,
+    host_binding: Object.freeze({ ...hostBinding }),
+    human_message_window: messageWindow,
+    ...lastRequestRef === void 0 ? {} : { last_seen_request_ref: lastRequestRef },
+    ...visibleOutputMaxBytes === void 0 ? {} : { visible_output_max_bytes: visibleOutputMaxBytes }
+  });
+}
+function hasInvocationContextRequestKeys(value) {
+  const required = ["schema_version", "client_nonce", "context_expires_at", "host_binding", "human_message_window"];
+  const optional = ["last_seen_request_ref", "visible_output_max_bytes"];
+  const optionalKeys = Object.keys(value).filter((key) => optional.includes(key));
+  return hasExactKeys(value, [...required, ...optionalKeys]) && required.every((key) => Object.hasOwn(value, key)) && value.schema_version === CEAL_HOST_INVOCATION_CONTEXT_REQUEST_SCHEMA;
+}
+function requireClientNonce(value) {
+  if (typeof value !== "string" || !CEAL_HOST_CLIENT_NONCE_PATTERN.test(value)) throw invalidInvocationContextRequest();
+  return value;
+}
+function requireContextExpiration(value) {
+  if (typeof value !== "string" || value.length > HOST_CONTEXT_EXPIRY_MAX_CHARS || !Number.isFinite(Date.parse(value))) throw invalidInvocationContextRequest();
+  return value;
+}
+function requireHostBinding(value) {
+  if (!isCealJsonRecord(value) || !exactOptionalKeys(value, ["host_source_ref", "host_session_ref", "host_turn_ref"], []) || !safeReference(value.host_source_ref) || !safeReference(value.host_session_ref) || !safeReference(value.host_turn_ref)) throw invalidInvocationContextRequest();
+  return { host_source_ref: value.host_source_ref, host_session_ref: value.host_session_ref, host_turn_ref: value.host_turn_ref };
+}
+function requireHumanMessageWindow(value) {
+  if (!isCealJsonRecord(value) || !exactOptionalKeys(value, ["messages", "truncated"], []) || !Array.isArray(value.messages) || value.messages.length > CEAL_HOST_INVOCATION_HUMAN_MESSAGE_WINDOW_MAX_MESSAGES || typeof value.truncated !== "boolean") throw invalidInvocationContextRequest();
+  const messages = value.messages.map(decodeHumanMessage);
+  const bytes2 = new TextEncoder().encode(JSON.stringify(messages)).byteLength;
+  if (bytes2 > CEAL_HOST_INVOCATION_HUMAN_MESSAGE_WINDOW_MAX_BYTES) throw invalidInvocationContextRequest();
+  return Object.freeze({ messages: Object.freeze(messages), truncated: value.truncated });
+}
+function decodeHumanMessage(candidate) {
+  if (!isCealJsonRecord(candidate) || !exactOptionalKeys(candidate, ["host_turn_ref", "host_input_ref", "text"], []) || !safeReference(candidate.host_turn_ref) || !safeReference(candidate.host_input_ref) || typeof candidate.text !== "string") throw invalidInvocationContextRequest();
+  return Object.freeze({ host_turn_ref: candidate.host_turn_ref, host_input_ref: candidate.host_input_ref, text: candidate.text });
+}
+function optionalSafeReference(value) {
+  if (value === void 0) return void 0;
+  if (!safeReference(value)) throw invalidInvocationContextRequest();
+  return value;
+}
+function safeReference(value) {
+  return typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u.test(value);
+}
+function exactOptionalKeys(value, required, optional = []) {
+  const keys = Object.keys(value);
+  return required.every((key) => Object.hasOwn(value, key)) && keys.every((key) => required.includes(key) || optional.includes(key));
+}
+function optionalVisibleOutputBudget(value) {
+  if (value === void 0) return void 0;
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 1 || value > CEAL_HOST_INVOCATION_CONTEXT_VISIBLE_OUTPUT_MAX_BYTES) throw invalidInvocationContextRequest();
+  return value;
+}
+function invalidInvocationContextRequest() {
+  return new TypeError("The Host invocation context request is invalid.");
+}
+function deriveCealHostInvocationNonceContract(contract = CEAL_CLIENT_WIRE_CONTRACT) {
+  const clientNonce = contract.host_invocation_authentication.client_nonce;
+  return {
+    encoded_characters: clientNonce.encoded_characters,
+    client_nonce_pattern_source: `^[${clientNonce.character_class_source}]{${clientNonce.encoded_characters}}$`,
+    context_token_pattern_source: `^${CEAL_HOST_CONTEXT_TOKEN_PREFIX}[${clientNonce.character_class_source}]{${clientNonce.encoded_characters}}$`
+  };
+}
+var hostNonceContract = deriveCealHostInvocationNonceContract();
+var CEAL_HOST_NONCE_ENCODED_CHARACTERS = hostNonceContract.encoded_characters;
+var CEAL_HOST_CLIENT_NONCE_PATTERN = new RegExp(hostNonceContract.client_nonce_pattern_source, "u");
+var CEAL_HOST_CONTEXT_TOKEN_PATTERN = new RegExp(hostNonceContract.context_token_pattern_source, "u");
+var CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_MAX_BYTES = deriveCealHostInvocationAuthenticationResultMaxBytes();
+function deriveCealHostInvocationAuthenticationResultMaxBytes(contract = CEAL_CLIENT_WIRE_CONTRACT) {
+  const hostAuthentication = contract.host_invocation_authentication;
+  const values = {
+    schema_version: deriveCealClientWireSchemaVersion({ schema_name: hostAuthentication.result_schema_name, fields: hostAuthentication.result_fields }),
+    context_token: `${CEAL_HOST_CONTEXT_TOKEN_PREFIX}${"A".repeat(hostAuthentication.client_nonce.encoded_characters)}`,
+    expires_at: (/* @__PURE__ */ new Date("+010000-01-01T00:00:00.000Z")).toISOString()
+  };
+  const fields = hostAuthentication.result_fields;
+  if (fields.some((field) => !Object.hasOwn(values, field))) throw new TypeError("Host invocation result fields have no bounded sample value.");
+  return new TextEncoder().encode(`${JSON.stringify(Object.fromEntries(fields.map((field) => [field, values[field]])))}
 `).byteLength;
+}
 var CEAL_HOST_MINT_REQUEST_CONTEXT_REFUSAL_REASONS = vocabulary([
   "request_authority_unavailable",
   "request_missing",
@@ -1494,6 +1904,7 @@ var CEAL_HOST_AUTHENTICATION_CAUSES = vocabulary([
   "host_credential_refused",
   "gateway_unavailable",
   "gateway_rate_limited",
+  "contract_mismatch",
   "gateway_refused",
   "gateway_response_invalid",
   "producer_frame_invalid",
@@ -1508,76 +1919,43 @@ var CEAL_HOST_AUTHENTICATION_POLICY = Object.freeze({
   invalid_arguments: Object.freeze({ classification: "host_arguments_invalid", next_action: "answer_with_gap" }),
   options_invalid: Object.freeze({ classification: "host_configuration_invalid", next_action: "answer_with_gap" }),
   session_unavailable: Object.freeze({ classification: "host_session_unavailable", next_action: "answer_with_gap" }),
-  context_unavailable: Object.freeze({ classification: "host_context_unavailable", next_action: "refresh_host_invocation_context", remedy: "the Host has no invocation context from the current transcript turn; run `ceal-host install` to repair the Host hook registration, then retry this command on a fresh Host turn" }),
-  context_replaced: Object.freeze({ classification: "host_invocation_context_stale", next_action: "refresh_host_invocation_context" }),
-  no_binding: Object.freeze({ classification: "host_binding_unavailable", next_action: "refresh_host_invocation_context" }),
-  context_stale: Object.freeze({ classification: "host_invocation_context_stale", next_action: "refresh_host_invocation_context" }),
-  context_expired: Object.freeze({ classification: "host_invocation_context_expired", next_action: "refresh_host_invocation_context" }),
+  context_unavailable: Object.freeze({ classification: "host_context_unavailable", next_action: "retry" }),
+  context_replaced: Object.freeze({ classification: "host_invocation_context_stale", next_action: "retry" }),
+  // `no_binding` now means the producer has no real current Host session. The
+  // Host Relay never uses it for an uncreated Gateway Request; there is no
+  // useful retry until the consumer is running inside a Host session.
+  no_binding: Object.freeze({ classification: "host_session_unavailable", next_action: "answer_with_gap" }),
+  context_stale: Object.freeze({ classification: "host_invocation_context_stale", next_action: "retry" }),
+  context_expired: Object.freeze({ classification: "host_invocation_context_expired", next_action: "retry" }),
   host_source_refused: Object.freeze({ classification: "host_source_refused", next_action: "answer_with_gap" }),
   host_credential_refused: Object.freeze({ classification: "host_registration_credential_refused", next_action: "ask_admin" }),
   gateway_unavailable: Object.freeze({ classification: "host_mint_gateway_unavailable", next_action: "ask_admin" }),
   gateway_rate_limited: Object.freeze({ classification: "host_mint_gateway_rate_limited", next_action: "answer_with_gap" }),
+  contract_mismatch: Object.freeze({ classification: "contract_mismatch", next_action: "upgrade_ceal_client" }),
   gateway_refused: Object.freeze({ classification: "host_mint_gateway_refused", next_action: "answer_with_gap" }),
   gateway_response_invalid: Object.freeze({ classification: "host_mint_gateway_response_invalid", next_action: "answer_with_gap" }),
-  producer_frame_invalid: Object.freeze({ classification: "host_producer_frame_invalid", next_action: "ask_admin", remedy: "ask an administrator to inspect and repair the producer frame, then start a fresh Host turn" }),
-  relay_permission_denied: Object.freeze({ classification: "host_relay_permission_denied", next_action: "rerun_outside_agent_sandbox", remedy: "an agent sandbox denied the Host Relay socket; run `ceal` as the only command, with no pipe, redirect, or `&&`, so the Host allow rule runs it outside the sandbox" }),
+  producer_frame_invalid: Object.freeze({ classification: "host_producer_frame_invalid", next_action: "ask_admin" }),
+  relay_permission_denied: Object.freeze({ classification: "host_relay_permission_denied", next_action: "rerun_outside_agent_sandbox" }),
   relay_unavailable: Object.freeze({ classification: "host_relay_unavailable", next_action: "answer_with_gap" }),
   transient_retryable: Object.freeze({ classification: "host_mint_transient_retryable", next_action: "retry" }),
   mint_failed: Object.freeze({ classification: "host_mint_failed", next_action: "answer_with_gap" }),
   relay_failed: Object.freeze({ classification: "host_relay_failed", next_action: "answer_with_gap" }),
   host_refusal_invalid: Object.freeze({ classification: "host_refusal_invalid", next_action: "answer_with_gap" })
 });
-function projectCealHostAuthenticationCause(diagnostic) {
-  return projectRelayCodeCause(diagnostic) ?? projectGatewayCodeCause(diagnostic) ?? projectGatewayStatusCause(diagnostic) ?? "mint_failed";
-}
-function projectRelayCodeCause(diagnostic) {
-  switch (diagnostic.relayCode) {
-    case "credential":
-      return "host_credential_refused";
-    case "configuration":
-      return "options_invalid";
-    case "payload_rejected":
-      return "producer_frame_invalid";
-    case "invalid_response":
-      return "gateway_response_invalid";
-    case "gateway_refused":
-      return projectGatewayRefusedCause(diagnostic);
-    case "gateway_unavailable":
-      return diagnostic.exhausted === true ? void 0 : "gateway_unavailable";
-    case void 0:
-    case "":
-      return void 0;
-    default:
-      return "mint_failed";
-  }
-}
-function projectGatewayRefusedCause(diagnostic) {
-  if (diagnostic.gatewayStatus === 401 || diagnostic.gatewayStatus === 403) return "host_credential_refused";
-  const stale = projectGatewayCodeCause(diagnostic);
-  if (stale !== void 0) return stale;
-  if (diagnostic.exhausted === true && (diagnostic.gatewayStatus === 408 || diagnostic.gatewayStatus === 429)) return "gateway_rate_limited";
-  return "gateway_refused";
-}
-function projectGatewayCodeCause(diagnostic) {
-  if (diagnostic.gatewayCode === "request_context_refused" && diagnostic.gatewayReason !== void 0 && isVocabularyWord(CEAL_HOST_MINT_REQUEST_CONTEXT_REFUSAL_REASONS, diagnostic.gatewayReason)) return "context_stale";
-  if (diagnostic.gatewayCode === "context_expired") return "context_expired";
-  if (diagnostic.gatewayCode === "host_source_refused") return "host_source_refused";
-  return void 0;
-}
-function projectGatewayStatusCause(diagnostic) {
-  if (diagnostic.gatewayStatus === 401 || diagnostic.gatewayStatus === 403) return "host_credential_refused";
-  if (diagnostic.exhausted === true && (diagnostic.gatewayStatus === 408 || diagnostic.gatewayStatus === 429)) return "gateway_rate_limited";
-  return void 0;
-}
 function decodeCealHostInvocationAuthenticationResult(value, now = /* @__PURE__ */ new Date()) {
-  if (!isCealJsonRecord(value) || !exactKeys(value, ["schema_version", "context_token", "expires_at"]) || value.schema_version !== CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_SCHEMA || typeof value.context_token !== "string" || !CEAL_HOST_CONTEXT_TOKEN_PATTERN.test(value.context_token) || typeof value.expires_at !== "string" || !validFutureTimestamp(value.expires_at, now)) {
+  return decodeHostInvocationAuthenticationResult(value, CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_FIELDS, now);
+}
+function decodeHostInvocationAuthenticationResult(value, fields, now) {
+  if (!isCealJsonRecord(value)) throw new TypeError("The Host invocation authentication result is invalid.");
+  requireCealClientWireSchemaVersion(value.schema_version, CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_SCHEMA);
+  if (!exactKeys(value, fields) || typeof value.context_token !== "string" || !CEAL_HOST_CONTEXT_TOKEN_PATTERN.test(value.context_token) || typeof value.expires_at !== "string" || !validFutureTimestamp(value.expires_at, now)) {
     throw new TypeError("The Host invocation authentication result is invalid.");
   }
   return Object.freeze({ schema_version: CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_SCHEMA, context_token: value.context_token, expires_at: value.expires_at });
 }
 function validFutureTimestamp(value, now) {
-  const timestamp3 = Date.parse(value);
-  return Number.isFinite(timestamp3) && new Date(timestamp3).toISOString() === value && timestamp3 > now.getTime();
+  const timestamp2 = Date.parse(value);
+  return Number.isFinite(timestamp2) && new Date(timestamp2).toISOString() === value && timestamp2 > now.getTime();
 }
 function exactKeys(value, expected) {
   const keys = Object.keys(value);
@@ -1590,9 +1968,6 @@ var CEAL_HOST_SERVICE_DIAGNOSTIC_EVENTS = vocabulary([
   "hook_invoked",
   "registration_written",
   "hook_failed",
-  "watcher_turn_observed",
-  "current_prompt_registered",
-  "current_prompt_registration_failed",
   "activation_recorded",
   "activation_failed",
   "watcher_scan_failed",
@@ -1615,6 +1990,9 @@ var CEAL_UNREAD_REASONS = vocabulary(["blocked", "unavailable", "too_large", "un
 var REQUIRED_FIELDS2 = Object.freeze(["schema_version", "operation_id", "path", "sha256"]);
 var FIELDS = /* @__PURE__ */ new Set([...REQUIRED_FIELDS2, "items_path", "row_count", "result_complete", "coverage", "local_result_root", "model_disclosure", "continue_argv", "how_to_read"]);
+// packages/ceal-client-protocol/src/discovery-manifest.ts
+var DISCOVERY_MANIFEST_KEYS = CEAL_CLIENT_WIRE_CONTRACT.command_response.discovery_manifest_fields;
 // packages/ceal-client-protocol/src/gateway-cache-origin-validation.ts
 var CEAL_MAX_CACHE_ORIGIN_AGE_MS = 30 * 24 * 60 * 60 * 1e3;
@@ -1673,6 +2051,7 @@ var ADMIN_UNAVAILABLE_REASONS = vocabulary([
   "legacy",
   "invalid_observation",
   "redacted",
+  "organization_setting_disabled",
   "owner_unavailable",
   "unit_unknown",
   "retention_gap",
@@ -1702,15 +2081,13 @@ var ADMIN_APPROVAL_DISPOSITIONS = CEAL_OPERATION_APPROVAL_DISPOSITIONS;
 var ADMIN_APPROVAL_POSTURES = vocabulary([...ADMIN_APPROVAL_DISPOSITIONS, "not_applicable"]);
 var ADMIN_LINEAGE_NODE_KINDS = vocabulary(["source_read", "synthesis_preview", "approval", "effect", "readback"]);
-// packages/ceal-client-protocol/src/actor-kind.ts
-var CEAL_ACTOR_KINDS = vocabulary(["human", "bot", "app", "unknown"]);
 // packages/ceal-client-protocol/src/device-enrollment.ts
 var CEAL_DEVICE_ENROLLMENT_POLL_FAILURE_CODES = Object.freeze(["unsupported_feature", "recovery_required", "expired", "denied"]);
 var POLL_RESULT_KEYS = Object.freeze(["retry_after_ms", "schema_version", "status"]);
 // packages/ceal-client-protocol/src/personal-client-session.ts
 var REFRESH_FAILURE_CODES = new Set(CEAL_REFRESH_FAILURE_CODES);
+var REVOKE_FAILURE_CODES = new Set(CEAL_CLIENT_REVOKE_FAILURE_CODES);
 // packages/ceal-client-protocol/src/index.ts
 var MAX_REQUEST_BYTES = 32 * 1024;
@@ -1746,60 +2123,251 @@ function errorCode(error) {
 }
 // host/service-log.ts
-import { copyFile, open, stat, truncate } from "node:fs/promises";
-import { isAbsolute } from "node:path";
-var HOST_SERVICE_LOG_ENVIRONMENT = "CEAL_HOST_SERVICE_LOG";
-var HOST_SERVICE_LOG_MAX_BYTES = 1024 * 1024;
-var HOST_SERVICE_LOG_CHECK_INTERVAL_MS = 6e4;
-function hostServiceLogPreviousPath(path) {
-  return `${path}.1`;
-}
-async function rotateHostServiceLog(path, maxBytes = HOST_SERVICE_LOG_MAX_BYTES) {
-  let size;
+import { copyFile, mkdir, stat, truncate, appendFile } from "node:fs/promises";
+import { dirname as dirname2, isAbsolute, posix, win32 as win322 } from "node:path";
+// host/secure-file.ts
+import { execFile } from "node:child_process";
+import { constants } from "node:fs";
+import { lstat, open } from "node:fs/promises";
+import { dirname, win32 } from "node:path";
+import { fileURLToPath } from "node:url";
+var SecureFileCustodyError = class extends Error {
+  name = "SecureFileCustodyError";
+  reason;
+  constructor(reason, message) {
+    super(message);
+    this.reason = reason;
+  }
+  get code() {
+    if (this.reason === "reparse_point") return "ELOOP";
+    if (this.reason === "not_found") return "ENOENT";
+    if (this.reason === "too_large") return "secure_file_too_large";
+    if (this.reason === "already_exists") return "EEXIST";
+    return this.reason === "not_private" ? "secure_file_not_private" : "secure_file_unavailable";
+  }
+};
+var WINDOWS_SECUREFS_REFUSAL_SCHEMA = "ceal.host_securefs_refusal.v1";
+var WINDOWS_SECUREFS_MAX_RANDOM_FILE_BYTES = 4096;
+var WINDOWS_SECUREFS_TIMEOUT_MS = 1e4;
+var WINDOWS_SECUREFS_DIAGNOSTIC_BYTES = 4096;
+function secureOpenFlags(flags, platform) {
+  if (platform === "win32") return flags;
+  const nofollow = constants.O_NOFOLLOW;
+  if (typeof nofollow === "number" && nofollow !== 0) return flags | nofollow;
+  throw new Error("Secure file reads require O_NOFOLLOW on this platform.");
+}
+async function openNoFollow(path, flags = constants.O_RDONLY, mode, platform = process.platform, _custody = {}) {
+  if (platform !== "win32") return await open(path, secureOpenFlags(flags, platform), mode);
+  return await openWindowsIdentityScreened(path, flags, mode);
+}
+async function openWindowsIdentityScreened(path, flags, mode) {
+  const handle = await open(path, flags, mode);
   try {
-    size = (await stat(path)).size;
+    const first = await handle.stat();
+    if (!first.isFile()) throw new SecureFileCustodyError("not_private", "The Windows Host file is not a regular file.");
+    await assertWindowsLinkFree(path, first);
+    await assertWindowsIdentityStable(handle, first, path);
+    return handle;
   } catch (error) {
-    if (isNotFound(error)) return false;
+    await handle.close();
     throw error;
   }
-  if (size <= maxBytes) return false;
-  await copyFile(path, hostServiceLogPreviousPath(path));
-  await truncate(path, 0);
-  return true;
 }
-function boundHostServiceLog(environment = process.env) {
-  const path = environment[HOST_SERVICE_LOG_ENVIRONMENT];
-  if (path === void 0 || !isAbsolute(path)) return () => void 0;
-  let reported = false;
-  const check = () => {
-    rotateHostServiceLog(path).catch((error) => {
-      if (reported) return;
-      reported = true;
-      process.stderr.write(`[host-service-log] rotation_failed code=${errorCode2(error)}
-`);
-    });
-  };
-  check();
-  const timer = setInterval(check, HOST_SERVICE_LOG_CHECK_INTERVAL_MS);
-  timer.unref();
-  return () => clearInterval(timer);
+async function assertWindowsLinkFree(path, first) {
+  const entry2 = await lstat(path);
+  if (entry2.isSymbolicLink() || entry2.dev !== first.dev || entry2.ino !== first.ino) {
+    throw new SecureFileCustodyError("reparse_point", "The Windows Host file path resolves through a reparse point.");
+  }
 }
-var HOST_SERVICE_LOG_TAIL_BYTES = 64 * 1024;
-function isNotFound(error) {
-  return errorCode2(error) === "ENOENT";
+async function assertWindowsIdentityStable(handle, first, path) {
+  const second = await handle.stat();
+  if (second.dev !== first.dev || second.ino !== first.ino || second.size !== first.size || second.mtimeMs !== first.mtimeMs) {
+    throw new SecureFileCustodyError("unavailable", "The Windows Host file changed while its identity was checked.");
+  }
+  const entry2 = await lstat(path);
+  if (entry2.isSymbolicLink()) throw new SecureFileCustodyError("reparse_point", "The Windows Host file path resolves through a reparse point.");
+  if (entry2.dev !== second.dev || entry2.ino !== second.ino) throw new SecureFileCustodyError("unavailable", "The Windows Host file path no longer names the opened file.");
+}
+async function readPrivateFileWithSecurefs(path, maxBytes, custody = {}) {
+  if (!Number.isSafeInteger(maxBytes) || maxBytes < 1) throw new TypeError("The securefs read bound must be a positive safe integer.");
+  const result2 = await runWindowsSecurefs(["internal", "securefs", "read-private-file", path, String(maxBytes)], maxBytes, custody);
+  if (result2.exit_code === 0 && result2.stderr.length === 0 && result2.stdout.length <= maxBytes) return result2.stdout;
+  if (result2.stdout.length !== 0) throw new SecureFileCustodyError("unavailable", "The Windows Host securefs command returned bytes with a refusal.");
+  if (result2.exit_code === 0) throw new SecureFileCustodyError("unavailable", "The Windows Host securefs command exceeded its output contract.");
+  throw securefsRefusal(result2.stderr);
+}
+async function createRandomPrivateFileWithSecurefs(path, byteLength2, custody = {}) {
+  if (!Number.isSafeInteger(byteLength2) || byteLength2 < 1 || byteLength2 > WINDOWS_SECUREFS_MAX_RANDOM_FILE_BYTES) throw new TypeError(`The securefs random-file size must be between 1 and ${WINDOWS_SECUREFS_MAX_RANDOM_FILE_BYTES} bytes.`);
+  const result2 = await runWindowsSecurefs(["internal", "securefs", "create-random-private-file", path, String(byteLength2)], 0, custody);
+  if (result2.exit_code === 0 && result2.stdout.length === 0 && result2.stderr.length === 0) return;
+  if (result2.stdout.length !== 0) throw new SecureFileCustodyError("unavailable", "The Windows Host securefs command returned unexpected creation bytes.");
+  if (result2.exit_code === 0) throw new SecureFileCustodyError("unavailable", "The Windows Host securefs command returned an invalid creation result.");
+  throw securefsRefusal(result2.stderr);
+}
+async function isPrivateWindowsDirectory(path, custody = {}) {
+  await lstat(path);
+  try {
+    const result2 = await runWindowsSecurefs(["internal", "securefs", "verify-private-dir", path], 0, custody);
+    if (result2.exit_code === 0 && result2.stdout.length === 0 && result2.stderr.length === 0) return true;
+    if (result2.stdout.length !== 0) throw new SecureFileCustodyError("unavailable", "The Windows Host directory proof returned unexpected bytes.");
+    if (result2.exit_code === 0) throw new SecureFileCustodyError("unavailable", "The Windows Host directory proof returned an invalid result.");
+    const refusal = securefsRefusal(result2.stderr);
+    if (refusal.reason === "not_private" || refusal.reason === "reparse_point") return false;
+    throw refusal;
+  } catch (error) {
+    if (error instanceof SecureFileCustodyError) throw error;
+    throw new SecureFileCustodyError("unavailable", "The Windows Host directory custody proof is unavailable.");
+  }
+}
+async function runWindowsSecurefs(args, maxBytes, custody) {
+  if (custody.run_securefs_command !== void 0) return await custody.run_securefs_command(args);
+  const executable = custody.securefs_executable ?? resolveInstalledHostExecutable();
+  const processArgs = [...custody.securefs_args_prefix ?? [], ...args];
+  return await new Promise((resolve, reject) => {
+    execFile(executable, processArgs, { encoding: "buffer", timeout: WINDOWS_SECUREFS_TIMEOUT_MS, maxBuffer: maxBytes + WINDOWS_SECUREFS_DIAGNOSTIC_BYTES }, (error, stdout, stderr) => {
+      const exitCode = error === null ? 0 : typeof error.code === "number" ? error.code : null;
+      if (exitCode === null) {
+        reject(new SecureFileCustodyError("unavailable", "The installed Windows Host securefs command could not run."));
+        return;
+      }
+      resolve({ exit_code: exitCode, stdout: Buffer.from(stdout), stderr: Buffer.from(stderr) });
+    });
+  });
+}
+function securefsRefusal(stderr) {
+  let value;
+  try {
+    value = JSON.parse(stderr.toString("utf8"));
+  } catch {
+    return new SecureFileCustodyError("unavailable", "The Windows Host securefs command returned an unreadable refusal.");
+  }
+  if (!isRecord(value) || value.schema_version !== WINDOWS_SECUREFS_REFUSAL_SCHEMA || typeof value.code !== "string") return new SecureFileCustodyError("unavailable", "The Windows Host securefs command returned an unreadable refusal.");
+  if (value.code === "reparse_point") return new SecureFileCustodyError("reparse_point", "The Windows Host securefs file is a reparse point.");
+  if (value.code === "not_found") return new SecureFileCustodyError("not_found", "The Windows Host securefs file was not found.");
+  if (value.code === "too_large") return new SecureFileCustodyError("too_large", "The Windows Host securefs file exceeds its read bound.");
+  if (value.code === "already_exists") return new SecureFileCustodyError("already_exists", "The Windows Host securefs target already exists.");
+  if (value.code === "not_private") return new SecureFileCustodyError("not_private", "The Windows Host securefs file is not private to the current user.");
+  return new SecureFileCustodyError("unavailable", "The Windows Host securefs command refused the file read.");
+}
+function resolveInstalledHostExecutable() {
+  const privateRuntimeRoot = dirname(fileURLToPath(import.meta.url));
+  return win32.join(privateRuntimeRoot, "..", "..", "bin", "ceal-host.exe");
+}
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isOwnedBy(uid, expectedUid) {
+  return Number.isSafeInteger(uid) && Number.isSafeInteger(expectedUid) && uid === expectedUid;
+}
+function isSelfOwned(uid, platform = process.platform, _handle) {
+  if (platform === "win32" || typeof process.geteuid !== "function") return false;
+  return isOwnedBy(uid, process.geteuid());
+}
+function isPrivateFileMode(mode, platform = process.platform, _handle) {
+  if (platform === "win32") return false;
+  return (mode & 63) === 0;
+}
+async function isPrivateDirectory(path, platform = process.platform, custody = {}) {
+  if (platform === "win32") return await isPrivateWindowsDirectory(path, custody);
+  const entry2 = await lstat(path);
+  return entry2.isDirectory() && !entry2.isSymbolicLink() && isSelfOwned(entry2.uid, platform) && isPrivateFileMode(entry2.mode, platform);
+}
+// host/service-log.ts
+var HOST_SERVICE_LOG_ENVIRONMENT = "CEAL_HOST_SERVICE_LOG";
+var HOST_SERVICE_LOG_ARGUMENT = "--ceal-host-service-log";
+var HostServiceLogArgumentError = class extends Error {
+  constructor() {
+    super("The Host service log argument must occur once with an absolute normalized path.");
+    this.name = "HostServiceLogArgumentError";
+  }
+};
+function consumeHostServiceLogArgument(args, platform = process.platform) {
+  const indexes = args.flatMap((value, index2) => value === HOST_SERVICE_LOG_ARGUMENT ? [index2] : []);
+  if (indexes.length === 0) return { args: [...args] };
+  const index = indexes[0];
+  if (index === void 0) throw new HostServiceLogArgumentError();
+  const path = args[index + 1];
+  const pathApi = platform === "win32" ? win322 : posix;
+  if (indexes.length !== 1 || path === void 0 || !pathApi.isAbsolute(path) || pathApi.normalize(path) !== path) throw new HostServiceLogArgumentError();
+  return { args: [...args.slice(0, index), ...args.slice(index + 2)], path };
+}
+var HOST_SERVICE_LOG_MAX_BYTES = 1024 * 1024;
+var HOST_SERVICE_LOG_CHECK_INTERVAL_MS = 6e4;
+function hostServiceLogPreviousPath(path) {
+  return `${path}.1`;
+}
+async function rotateHostServiceLog(path, maxBytes = HOST_SERVICE_LOG_MAX_BYTES) {
+  let size;
+  try {
+    size = (await stat(path)).size;
+  } catch (error) {
+    if (isNotFound(error)) return false;
+    throw error;
+  }
+  if (size <= maxBytes) return false;
+  await copyFile(path, hostServiceLogPreviousPath(path));
+  await truncate(path, 0);
+  return true;
+}
+function boundHostServiceLog(environment = process.env) {
+  const path = environment[HOST_SERVICE_LOG_ENVIRONMENT];
+  if (path === void 0 || !isAbsolute(path)) return () => void 0;
+  let reported = false;
+  const ready = ensureHostServiceLogDirectory(path);
+  const check = () => {
+    ready.then(() => rotateHostServiceLog(path)).catch((error) => {
+      if (reported) return;
+      reported = true;
+      process.stderr.write(`[host-service-log] rotation_failed code=${errorCode2(error)}
+`);
+    });
+  };
+  check();
+  const timer = setInterval(check, HOST_SERVICE_LOG_CHECK_INTERVAL_MS);
+  timer.unref();
+  return () => clearInterval(timer);
+}
+function writeHostServiceLogLine(line, environment = process.env) {
+  if (process.platform !== "win32") return;
+  const path = environment[HOST_SERVICE_LOG_ENVIRONMENT];
+  if (path === void 0 || !win322.isAbsolute(path) || win322.normalize(path) !== path) return;
+  void appendHostServiceLogLine(path, line).catch(() => void 0);
+}
+async function appendHostServiceLogLine(path, line) {
+  if (!isAbsolute(path)) return;
+  await ensureHostServiceLogDirectory(path);
+  await appendFile(path, line);
+}
+var HOST_SERVICE_LOG_TAIL_BYTES = 64 * 1024;
+var hostServiceLogDirectories = /* @__PURE__ */ new Map();
+function ensureHostServiceLogDirectory(path) {
+  const directory = dirname2(path);
+  const existing = hostServiceLogDirectories.get(directory);
+  if (existing !== void 0) return existing;
+  const pending = mkdir(directory, { recursive: true, mode: 448 }).then(() => void 0).catch((error) => {
+    hostServiceLogDirectories.delete(directory);
+    throw error;
+  });
+  hostServiceLogDirectories.set(directory, pending);
+  return pending;
+}
+function isNotFound(error) {
+  return errorCode2(error) === "ENOENT";
 }
 function errorCode2(error) {
   return typeof error === "object" && error !== null && "code" in error && typeof error.code === "string" ? error.code : "unknown";
 }
 // host/runtime-source-paths.ts
-import { createHash as createHash2 } from "node:crypto";
-import { posix as posix2, win32 as win322 } from "node:path";
+import { createHash as createHash3 } from "node:crypto";
+import { posix as posix3, win32 as win324 } from "node:path";
 // host/absolute-path.ts
-import { posix, win32 } from "node:path";
+import { posix as posix2, win32 as win323 } from "node:path";
 function isAbsoluteNormalizedNonRootPath(value, flavor = process.platform, allowRoot = false) {
-  const pathApi = flavor === "win32" || flavor === "windows" ? win32 : posix;
+  const pathApi = flavor === "win32" || flavor === "windows" ? win323 : posix2;
   return typeof value === "string" && value.length <= 4096 && !value.includes("\0") && pathApi.isAbsolute(value) && pathApi.normalize(value) === value && (allowRoot || pathApi.parse(value).root !== value);
 }
@@ -1811,28 +2379,22 @@ function hostSourceUuid(sourceRef) {
 function hostRuntimeSourcePaths(stateRoot, sourceRef, platform = process.platform) {
   const sourceId = hostSourceUuid(sourceRef);
   if (!isAbsoluteNormalizedNonRootPath(stateRoot, platform) || sourceId === null) throw new TypeError("Host runtime source identity is invalid.");
-  const path = platform === "win32" ? win322 : posix2;
+  const path = platform === "win32" ? win324 : posix3;
   const sourcesRoot = path.join(stateRoot, "sources");
   const sourceRoot = path.join(sourcesRoot, sourceId);
   const runtimeRoot = path.join(stateRoot, "run");
-  const endpoint = platform === "win32" ? `\\\\.\\pipe\\ceal-host-${createHash2("sha256").update(`${stateRoot}\0${sourceRef}`).digest("hex").slice(0, 24)}` : path.join(runtimeRoot, `${sourceId}.sock`);
-  assertHostRuntimeIpcLength(endpoint, platform);
+  const endpoint = platform === "win32" ? `\\\\.\\pipe\\ceal-host-${createHash3("sha256").update(`${stateRoot}\0${sourceRef}`).digest("hex").slice(0, 24)}` : path.join(runtimeRoot, `${sourceId}.sock`);
   return { sourceId, sourcesRoot, sourceRoot, relayRoot: path.join(sourceRoot, "relay"), codexOutbox: path.join(sourceRoot, "producers", "codex", "outbox"), claudeOutbox: path.join(sourceRoot, "producers", "claude", "outbox"), endpoint, runtimeRoot };
 }
-function assertHostRuntimeIpcLength(endpoint, platform) {
-  if (platform === "win32") return;
-  const maximum = platform === "linux" ? 107 : 103;
-  if (Buffer.byteLength(endpoint, "utf8") > maximum) throw Object.assign(new TypeError(`ipc_endpoint_too_long: Host IPC path exceeds ${maximum} bytes; use a shorter Host state root.`), { code: "ipc_endpoint_too_long" });
-}
 function assertHostRelaySourcePaths(stateRoot, config, platform = process.platform) {
   const paths = hostRuntimeSourcePaths(stateRoot, config.host_source_ref, platform);
-  if (config.state_root !== paths.relayRoot || config.ipc_endpoint !== paths.endpoint) throw new TypeError("Host Relay state and IPC must belong to its configured source.");
+  if (config.state_root !== paths.relayRoot || platform !== "win32" && config.ipc_endpoint !== paths.endpoint) throw new TypeError("Host Relay state and IPC must belong to its configured source.");
+  return paths.endpoint;
 }
 // host/relay/src/host-relay-runtime.ts
-import { O_NOFOLLOW as O_NOFOLLOW3, O_RDONLY as O_RDONLY4 } from "node:constants";
-import { lstat as lstat4, open as open5 } from "node:fs/promises";
-import { dirname as dirname4, join as join7 } from "node:path";
+import { constants as constants4 } from "node:fs";
+import { dirname as dirname7, join as join6 } from "node:path";
 // host/abortable-wait.ts
 function waitForAbort(signal, milliseconds) {
@@ -1918,13 +2480,13 @@ function skipWhitespace(text, start) {
 }
 // host/relay/src/producer-frame.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 var HOST_PRODUCER_FRAME_SCHEMA = "ceal.host_producer_frame.v1";
 var HOST_PRODUCER_MAX_JSON_BYTES = 262144;
 var HOST_PRODUCER_FRAME_LENGTH_BYTES = Uint32Array.BYTES_PER_ELEMENT;
 var SAFE_REF2 = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
 var PRODUCERS = /* @__PURE__ */ new Set(["codex", "claude"]);
-var HOST_PRODUCER_FRAME_KINDS = ["session_started", "turn_started", "user_input", "turn_terminal", "producer_status"];
+var HOST_PRODUCER_FRAME_KINDS = ["session_started", "turn_started", "turn_terminal", "producer_status"];
 var FRAME_KINDS = new Set(HOST_PRODUCER_FRAME_KINDS);
 function isHostProducerFrameKind(value) {
   return typeof value === "string" && FRAME_KINDS.has(value);
@@ -1976,58 +2538,15 @@ function decodeHostProducerFrame(input) {
   return value;
 }
 function hostProducerFrameHash(frame) {
-  return createHash3("sha256").update(JSON.stringify(frame), "utf8").digest("hex");
-}
-function extractHostBindingSelector(frame) {
-  if (frame.frame_kind !== "user_input") return null;
-  if (!PRODUCERS.has(frame.producer_id) || !safeRef(frame.producer_installation_ref)) return null;
-  const payload = frame.payload;
-  if (!safeRef(payload.local_session_ref) || !safeRef(payload.local_turn_ref)) return null;
-  const aliases = payload.local_turn_aliases;
-  if (aliases === void 0) {
-    return Object.freeze({
-      producer_id: frame.producer_id,
-      producer_installation_ref: frame.producer_installation_ref,
-      local_session_ref: payload.local_session_ref,
-      local_turn_ref: payload.local_turn_ref,
-      local_turn_aliases: Object.freeze([])
-    });
-  }
-  if (!Array.isArray(aliases) || aliases.length > 16 || !aliases.every(safeRef) || new Set(aliases).size !== aliases.length) return null;
-  return Object.freeze({
-    producer_id: frame.producer_id,
-    producer_installation_ref: frame.producer_installation_ref,
-    local_session_ref: payload.local_session_ref,
-    local_turn_ref: payload.local_turn_ref,
-    local_turn_aliases: Object.freeze([...aliases])
-  });
-}
-function hostProducerIdentityRefs(hostSourceRef, frame, localSessionRef, localTurnRef, localInputRef) {
-  if (!opaqueHostSourceRef(hostSourceRef)) throw new TypeError("Gateway host source reference is invalid.");
-  const host_session_ref = localSessionRef === void 0 ? void 0 : `ceal-host-session:${cealRequestSha256({ host_source_ref: hostSourceRef, producer_id: frame.producer_id, producer_installation_ref: frame.producer_installation_ref, local_session_ref: localSessionRef })}`;
-  const host_turn_ref = host_session_ref === void 0 || localTurnRef === void 0 ? void 0 : `ceal-host-turn:${cealRequestSha256({ host_session_ref, local_turn_ref: localTurnRef })}`;
-  const host_input_ref = host_turn_ref === void 0 || localInputRef === void 0 ? void 0 : `ceal-host-input:${cealRequestSha256({ host_turn_ref, local_input_ref: localInputRef })}`;
-  const submission_ref = `ceal-host-frame:${cealRequestSha256({ host_source_ref: hostSourceRef, producer_id: frame.producer_id, producer_installation_ref: frame.producer_installation_ref, sequence: frame.sequence })}`;
-  return { host_session_ref: host_session_ref ?? "", ...host_turn_ref === void 0 ? {} : { host_turn_ref }, ...host_input_ref === void 0 ? {} : { host_input_ref }, submission_ref };
-}
-function hostProducerSessionRef(hostSourceRef, frame, localSessionRef) {
-  return requiredIdentity(hostProducerIdentityRefs(hostSourceRef, frame, localSessionRef).host_session_ref);
-}
-function hostProducerTurnRef(hostSourceRef, frame, localSessionRef, localTurnRef) {
-  return requiredIdentity(hostProducerIdentityRefs(hostSourceRef, frame, localSessionRef, localTurnRef).host_turn_ref);
-}
-function hostProducerInputRef(hostSourceRef, frame, localSessionRef, localTurnRef, localInputRef) {
-  return requiredIdentity(hostProducerIdentityRefs(hostSourceRef, frame, localSessionRef, localTurnRef, localInputRef).host_input_ref);
+  return createHash4("sha256").update(JSON.stringify(frame), "utf8").digest("hex");
 }
 function hostProducerSubmissionRef(hostSourceRef, frame) {
-  return requiredIdentity(hostProducerIdentityRefs(hostSourceRef, frame).submission_ref);
+  if (!opaqueHostSourceRef(hostSourceRef)) throw new TypeError("Gateway host source reference is invalid.");
+  return `ceal-host-frame:${cealRequestSha256({ host_source_ref: hostSourceRef, producer_id: frame.producer_id, producer_installation_ref: frame.producer_installation_ref, sequence: frame.sequence })}`;
 }
 function opaqueHostSourceRef(value) {
   return typeof value === "string" && SAFE_REF2.test(value) && !value.startsWith("ceal-host-source:");
 }
-function isHostSafeRef(value) {
-  return safeRef(value);
-}
 var BOUNDED_REFUSAL_WORD = /^[a-z][a-z0-9_]{0,63}$/u;
 function isBoundedRefusalWord(value) {
   return typeof value === "string" && BOUNDED_REFUSAL_WORD.test(value);
@@ -2044,16 +2563,13 @@ var HOST_RELAY_GATEWAY_ERROR_CODES = [
   "gateway_unavailable",
   "gateway_refused",
   "invalid_response",
+  "contract_mismatch",
   "payload_rejected"
 ];
 function isRelayGatewayErrorCode(value) {
   return isVocabularyWord(HOST_RELAY_GATEWAY_ERROR_CODES, value);
 }
 var RELAY_DELIVERY_DIAGNOSTIC_KEYS = ["relayCode", "gatewayStatus", "gatewayCode", "gatewayReason", "exhausted"];
-function requiredIdentity(value) {
-  if (value === void 0) throw new TypeError("Canonical Host identity is incomplete.");
-  return value;
-}
 function validateFrame(value) {
   if (!record(value)) throw new HostProducerFrameError("invalid_frame_shape");
   if (value.schema_version !== HOST_PRODUCER_FRAME_SCHEMA) throw new HostProducerFrameError("unsupported_frame_schema", `unsupported_frame_schema: ${refusalFact("schema_version", value.schema_version, HOST_PRODUCER_FRAME_SCHEMA)}`);
@@ -2063,7 +2579,7 @@ function validateFrame(value) {
   validatePayload(value.frame_kind, value.payload);
 }
 function validatePayload(kind, value) {
-  const valid = kind === "session_started" ? validSession(value) : kind === "turn_started" ? validTurn(value) : kind === "user_input" ? validInput(value) : kind === "turn_terminal" ? validTerminal(value) : validStatus(value);
+  const valid = kind === "session_started" ? validSession(value) : kind === "turn_started" ? validTurn(value) : kind === "turn_terminal" ? validTerminal(value) : validStatus(value);
   if (!valid) throw new HostProducerFrameError("invalid_frame_shape");
 }
 function validSession(value) {
@@ -2072,15 +2588,6 @@ function validSession(value) {
 function validTurn(value) {
   return exactOptional(value, ["local_session_ref", "local_turn_ref"], ["model", "observations"]) && safeRef(value.local_session_ref) && safeRef(value.local_turn_ref) && optionalText(value.model, 256) && validObservations(value.observations);
 }
-function validInput(value) {
-  return exactOptional(value, ["local_session_ref", "local_turn_ref", "local_input_ref", "input_kind", "origin_input", "observations"], ["local_turn_aliases", "context_expires_at"]) && safeRef(value.local_session_ref) && safeRef(value.local_turn_ref) && safeRef(value.local_input_ref) && validInputObservations(value.observations) && isCealHostInputKind(value.input_kind) && typeof value.origin_input === "boolean" && validInputOptionals(value);
-}
-function validInputObservations(value) {
-  return validObservations(value) && Array.isArray(value) && value.filter((item) => record(item) && item.observation_kind === "prompt").length === 1;
-}
-function validInputOptionals(value) {
-  return optionalRefs(value.local_turn_aliases) && (value.context_expires_at === void 0 || timestamp(value.context_expires_at));
-}
 function validTerminal(value) {
   return exactOptional(value, ["local_session_ref", "local_turn_ref", "terminal_state"], ["abort_reason", "duration_ms", "time_to_first_token_ms", "usage", "observations"]) && safeRef(value.local_session_ref) && safeRef(value.local_turn_ref) && validTerminalDisposition(value.terminal_state, value.abort_reason) && optionalNonNegative(value.duration_ms) && optionalNonNegative(value.time_to_first_token_ms) && (value.usage === void 0 || jsonValue(value.usage)) && validObservations(value.observations);
 }
@@ -2096,9 +2603,6 @@ function optionalText(value, maxLength) {
 function optionalNonNegative(value) {
   return value === void 0 || typeof value === "number" && Number.isFinite(value) && value >= 0;
 }
-function optionalRefs(value) {
-  return value === void 0 || Array.isArray(value) && value.length <= 16 && value.every(safeRef);
-}
 function validObservations(value) {
   if (value === void 0) return true;
   if (!Array.isArray(value) || value.length > 32) return false;
@@ -2143,27 +2647,78 @@ function exactOptional(value, required, optional) {
 // host/relay/src/relay-admission-store.ts
 import { readFile as readFile2 } from "node:fs/promises";
-import { join as join4 } from "node:path";
+import { join as join3 } from "node:path";
+// host/relay/src/durable-atomic-replacement.ts
+import { lstat as lstat2, mkdir as mkdir2, open as open2, rename, unlink } from "node:fs/promises";
+import { dirname as dirname3 } from "node:path";
+// host/windows-rename-retry.ts
+import { setTimeout as setTimeout2 } from "node:timers/promises";
+var RETRY_WINDOW_MS = 1e4;
+var RETRY_START_DELAY_MS = 100;
+var RETRY_MAX_DELAY_MS = 2e3;
+var RETRYABLE_CODES = /* @__PURE__ */ new Set(["EBUSY", "EPERM", "EACCES"]);
+var WindowsRenameRetryError = class extends Error {
+  code = "rename_unavailable";
+  constructor(target, attempts, options = {}) {
+    super(`Windows did not permit renaming into place within the bounded retry window: ${target} (after ${attempts} attempts). Wait for the process holding the path to release it, then rerun the same install or update command.`, options);
+    this.name = "WindowsRenameRetryError";
+  }
+};
+function resolveRetrySchedule(tuning) {
+  return {
+    windowMs: tuning.windowMs ?? RETRY_WINDOW_MS,
+    startDelayMs: tuning.startDelayMs ?? RETRY_START_DELAY_MS,
+    maxDelayMs: tuning.maxDelayMs ?? RETRY_MAX_DELAY_MS,
+    sleep: tuning.sleep ?? ((ms) => setTimeout2(ms)),
+    now: tuning.now ?? (() => Date.now())
+  };
+}
+async function renameWithWindowsRetry(operation, tuning) {
+  const schedule = resolveRetrySchedule(tuning);
+  const deadline = schedule.now() + schedule.windowMs;
+  let delayMs = schedule.startDelayMs;
+  let attempts = 0;
+  for (; ; ) {
+    attempts += 1;
+    try {
+      await operation();
+      return;
+    } catch (error) {
+      if (tuning.platform !== "win32" || !isRetryableRenameError(error)) throw error;
+      await sleepWithinWindow(schedule, deadline, delayMs, () => new WindowsRenameRetryError(tuning.target, attempts, { cause: error }));
+      delayMs = Math.min(delayMs * 2, schedule.maxDelayMs);
+    }
+  }
+}
+async function sleepWithinWindow(schedule, deadline, delayMs, exhausted) {
+  if (schedule.now() >= deadline) throw exhausted();
+  await schedule.sleep(Math.min(delayMs, deadline - schedule.now()));
+  if (schedule.now() >= deadline) throw exhausted();
+}
+function isRetryableRenameError(error) {
+  return typeof error === "object" && error !== null && "code" in error && typeof error.code === "string" && RETRYABLE_CODES.has(error.code);
+}
 // host/relay/src/durable-atomic-replacement.ts
-import { O_RDONLY } from "node:constants";
-import { lstat, mkdir, open as open2, rename, unlink } from "node:fs/promises";
-import { dirname } from "node:path";
 var DEFAULT_PORT = {
   platform: process.platform,
-  mkdir: (path, options) => mkdir(path, options),
-  lstat: (path) => lstat(path),
+  mkdir: (path, options) => mkdir2(path, options),
+  lstat: (path) => lstat2(path),
   open_file: (path) => open2(path, "wx", 384),
   rename,
   unlink,
-  open_directory: (path) => open2(path, O_RDONLY),
+  open_directory: (path) => open2(path),
   unique_ref: () => `${process.pid}.${crypto.randomUUID()}`
 };
 async function durableAtomicReplace(target, data, port = DEFAULT_PORT) {
-  const parent = dirname(target);
+  const parent = dirname3(target);
   await port.mkdir(parent, { recursive: true, mode: 448 });
   const parentStats = await port.lstat(parent);
-  if (!parentStats.isDirectory() || parentStats.isSymbolicLink() || !ownerPrivate(parentStats, port.platform)) throw new TypeError(`Host Relay durable-state directory is unsafe: ${refusalFacts([{ name: "parent_stats", value: parentStats, expected: "an owner-private directory" }, { name: "platform", value: port.platform }])}.`);
+  const expectedUid = typeof process.geteuid === "function" ? process.geteuid() : parentStats.uid;
+  const ownerPrivate = port.platform === "win32" || isOwnedBy(parentStats.uid, expectedUid) && isPrivateFileMode(parentStats.mode, port.platform);
+  if (!parentStats.isDirectory() || parentStats.isSymbolicLink() || !ownerPrivate) throw new TypeError(`Host Relay durable-state directory is unsafe: ${refusalFacts([{ name: "parent_stats", value: parentStats, expected: "an owner-private directory" }, { name: "platform", value: port.platform }])}.`);
   const temporary = `${target}.${port.unique_ref()}.new`;
   let staged;
   const failures = [];
@@ -2174,7 +2729,7 @@ async function durableAtomicReplace(target, data, port = DEFAULT_PORT) {
     const closing = staged;
     staged = void 0;
     await closing.close();
-    await port.rename(temporary, target);
+    await renameWithWindowsRetry(() => port.rename(temporary, target), { ...port.rename_retry, platform: port.platform, target });
     await syncParentDirectory(parent, port);
   } catch (error) {
     failures.push(error);
@@ -2200,11 +2755,6 @@ async function syncParentDirectory(path, port) {
   }
   if (failure !== void 0) throw failure;
 }
-function ownerPrivate(stats, platform) {
-  if (platform === "win32") return true;
-  const uid = typeof process.geteuid === "function" ? process.geteuid() : stats.uid;
-  return stats.uid === uid && (stats.mode & 63) === 0;
-}
 async function closeStaged(staged, failures) {
   if (staged !== void 0) try {
     await staged.close();
@@ -2230,249 +2780,10 @@ function errorCode3(error) {
   return typeof error === "object" && error !== null && "code" in error ? String(error.code) : null;
 }
-// host/relay/src/relay-request-binding-store.ts
-import { O_NOFOLLOW, O_RDONLY as O_RDONLY2 } from "node:constants";
-import { open as open3 } from "node:fs/promises";
-import { join as join2 } from "node:path";
-var HOST_RELAY_REQUEST_BINDING_SCHEMA = "ceal.host_relay_request_binding.v1";
-var STATE_SCHEMA = "ceal.host_relay_request_binding_state.v1";
-var SAFE_REF3 = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
-var MAX_BINDINGS = 8192;
-var MAX_STATE_BYTES = 8 * 1024 * 1024;
-var HostRelayBindingError = class extends TypeError {
-  name = "HostRelayBindingError";
-  code;
-  constructor(code, message) {
-    super(message);
-    this.code = code;
-  }
-};
-var RelayRequestBindingStore = class {
-  tail = Promise.resolve();
-  bindingWaiters = /* @__PURE__ */ new Set();
-  root;
-  constructor(root) {
-    if (typeof root !== "string" || root.length === 0) throw new TypeError("Host Relay binding root is invalid.");
-    this.root = root;
-  }
-  bind(input, now = /* @__PURE__ */ new Date()) {
-    const run = this.tail.then(() => this.bindLocked(input, now));
-    this.tail = run.then(() => void 0, () => void 0);
-    return run;
-  }
-  query(input) {
-    const run = this.tail.then(() => this.queryLocked(input));
-    this.tail = run.then(() => void 0, () => void 0);
-    return run;
-  }
-  waitForBinding(input, signal) {
-    validateQuery(input);
-    if (signal.aborted) return Promise.reject(new Error("Host Relay binding wait cancelled."));
-    return new Promise((resolve, reject) => {
-      let settled = false;
-      const finish = (result2, error) => {
-        if (settled) return;
-        settled = true;
-        this.bindingWaiters.delete(waiter);
-        signal.removeEventListener("abort", waiter.abort);
-        if (error !== void 0) reject(error);
-        else if (result2?.status === "ready") resolve(result2);
-      };
-      const abort = () => finish(void 0, new Error("Host Relay binding wait cancelled."));
-      const waiter = { query: input, resolve: (result2) => finish(result2), abort };
-      this.bindingWaiters.add(waiter);
-      signal.addEventListener("abort", abort, { once: true });
-      void this.query(input).then((result2) => {
-        if (result2.status === "ready") finish(result2);
-      }, (error) => finish(void 0, error));
-    });
-  }
-  async bindLocked(input, now) {
-    const candidate = bindingFromGateway(input, now);
-    const state = await this.read();
-    const existing = state.bindings.find((item) => sameCanonicalIdentity(item, candidate));
-    if (existing !== void 0) {
-      if (!sameBinding(existing, candidate)) throw new HostRelayBindingError("canonical_turn_rebound", `Host Relay canonical turn is already bound to another Request: ${refusalFacts([{ name: "candidate_request_ref", value: candidate.request_ref, expected: existing.request_ref }, { name: "candidate_prompt_ref", value: candidate.prompt_ref, expected: existing.prompt_ref }, { name: "candidate_context_expires_at", value: candidate.context_expires_at, expected: String(existing.context_expires_at) }, { name: "candidate_local_turn_aliases", value: candidate.local_turn_aliases, expected: JSON.stringify(existing.local_turn_aliases) }])}.`);
-      return existing;
-    }
-    if (state.bindings.length >= MAX_BINDINGS) throw new HostRelayBindingError("binding_capacity_exhausted", `Host Relay request binding capacity is exhausted: ${refusalFact("binding_count", state.bindings.length, `below ${MAX_BINDINGS}`)}.`);
-    const next = { schema_version: STATE_SCHEMA, bindings: [...state.bindings, candidate] };
-    await this.write(next);
-    this.resolveBindingWaiters(candidate);
-    return structuredClone(candidate);
-  }
-  resolveBindingWaiters(binding) {
-    for (const waiter of this.bindingWaiters) {
-      if (relayRequestBindingMatchesQuery(waiter.query, binding)) waiter.resolve({ status: "ready", binding: structuredClone(binding) });
-    }
-  }
-  async queryLocked(input) {
-    validateQuery(input);
-    const state = await this.read();
-    const matches = state.bindings.filter((binding2) => relayRequestBindingMatchesQuery(input, binding2));
-    if (matches.length === 0) return { status: "no_binding" };
-    const binding = matches[0];
-    if (binding === void 0) throw new TypeError("Host Relay binding query result is invalid.");
-    return { status: "ready", binding: structuredClone(binding) };
-  }
-  async read() {
-    let handle;
-    try {
-      handle = await open3(join2(this.root, "request-bindings.json"), O_RDONLY2 | O_NOFOLLOW);
-      const stats = await handle.stat();
-      if (!stats.isFile() || !ownerPrivate2(stats)) throw new TypeError(`Host Relay binding state is unsafe: ${refusalFacts([{ name: "state_is_file", value: stats.isFile(), expected: "true" }, { name: "state_uid", value: stats.uid, expected: String(process.geteuid?.() ?? stats.uid) }, { name: "state_mode", value: (stats.mode & 511).toString(8), expected: "no group or other permission bits" }])}.`);
-      if (stats.size > MAX_STATE_BYTES) throw new TypeError(`Host Relay binding state is unsafe: ${refusalFact("state_bytes", stats.size, `at most ${MAX_STATE_BYTES}`)}.`);
-      return decodeState(JSON.parse(await handle.readFile("utf8")));
-    } catch (error) {
-      if (errorCode4(error) === "ENOENT") return { schema_version: STATE_SCHEMA, bindings: [] };
-      throw error;
-    } finally {
-      await handle?.close();
-    }
-  }
-  async write(state) {
-    const encoded = JSON.stringify(state);
-    if (Buffer.byteLength(encoded, "utf8") > MAX_STATE_BYTES) throw new TypeError(`Host Relay binding state is too large: ${refusalFact("state_bytes", Buffer.byteLength(encoded, "utf8"), `at most ${MAX_STATE_BYTES}`)}.`);
-    await durableAtomicReplace(join2(this.root, "request-bindings.json"), encoded);
-  }
-};
-function relayRequestWorkContextFromBinding(binding) {
-  return createRelayRequestWorkContext({ request_ref: binding.request_ref, host_binding: {
-    host_source_ref: binding.host_source_ref,
-    host_session_ref: binding.host_session_ref,
-    host_turn_ref: binding.host_turn_ref,
-    host_input_ref: binding.host_input_ref,
-    prompt_ref: binding.prompt_ref
-  } });
-}
-function createRelayRequestWorkContext(input) {
-  if (!record2(input) || !exactKeys3(input, ["request_ref", "host_binding"]) || !safeRef2(input.request_ref) || !record2(input.host_binding)) {
-    throw new HostRelayBindingError("context_identity_missing", "Host Relay work context does not contain the complete acknowledged Host tuple.");
-  }
-  const hostBinding = input.host_binding;
-  if (!exactKeys3(hostBinding, ["host_source_ref", "host_session_ref", "host_turn_ref", "host_input_ref", "prompt_ref"]) || ![hostBinding.host_source_ref, hostBinding.host_session_ref, hostBinding.host_turn_ref, hostBinding.host_input_ref, hostBinding.prompt_ref].every(safeRef2)) {
-    throw new HostRelayBindingError("context_identity_missing", "Host Relay work context does not contain the complete acknowledged Host tuple.");
-  }
-  const hostSourceRef = requiredRef(hostBinding.host_source_ref);
-  const hostSessionRef = requiredRef(hostBinding.host_session_ref);
-  const hostTurnRef = requiredRef(hostBinding.host_turn_ref);
-  const hostInputRef = requiredRef(hostBinding.host_input_ref);
-  const promptRef = requiredRef(hostBinding.prompt_ref);
-  return Object.freeze({ request_ref: input.request_ref, host_binding: Object.freeze({
-    host_source_ref: hostSourceRef,
-    host_session_ref: hostSessionRef,
-    host_turn_ref: hostTurnRef,
-    host_input_ref: hostInputRef,
-    prompt_ref: promptRef
-  }) });
-}
-function bindingFromGateway(input, now) {
-  const payload = input.frame.payload;
-  const candidate = {
-    schema_version: HOST_RELAY_REQUEST_BINDING_SCHEMA,
-    producer_id: input.frame.producer_id,
-    producer_installation_ref: input.frame.producer_installation_ref,
-    local_session_ref: requiredRef(payload.local_session_ref),
-    local_turn_ref: requiredRef(payload.local_turn_ref),
-    local_turn_aliases: optionalRefs2(payload.local_turn_aliases),
-    prompt_ref: requiredRef(input.prompt_ref),
-    request_ref: requiredRef(input.request_ref),
-    bound_at: timestamp2(now.toISOString()),
-    ...payload.context_expires_at === void 0 ? {} : { context_expires_at: timestamp2(payload.context_expires_at) },
-    host_source_ref: requiredRef(input.host_binding.host_source_ref),
-    host_session_ref: requiredRef(input.host_binding.host_session_ref),
-    host_turn_ref: requiredRef(input.host_binding.host_turn_ref),
-    host_input_ref: requiredRef(input.host_binding.host_input_ref)
-  };
-  if (input.host_binding.prompt_ref !== input.prompt_ref) throw new HostRelayBindingError("context_identity_mismatch", "Host Relay binding prompt reference does not match the acknowledged submission.");
-  validateBinding(candidate);
-  return candidate;
-}
-function decodeState(value) {
-  if (!record2(value) || !exactKeys3(value, ["schema_version", "bindings"])) throw new TypeError(`Host Relay binding state is invalid: ${refusalFact("state_keys", record2(value) ? Object.keys(value) : [], "exactly schema_version and bindings")}.`);
-  if (value.schema_version !== STATE_SCHEMA) throw new TypeError(`Host Relay binding state is invalid: ${refusalFact("schema_version", value.schema_version, STATE_SCHEMA)}.`);
-  if (!Array.isArray(value.bindings)) throw new TypeError(`Host Relay binding state is invalid: ${refusalFact("bindings", value.bindings, "an array")}.`);
-  const bindings = value.bindings.map((item) => {
-    validateBinding(item);
-    return item;
-  });
-  const keys = bindings.map(bindingKey);
-  if (new Set(keys).size !== keys.length) throw new TypeError("Host Relay binding state contains duplicate canonical turns.");
-  return { schema_version: STATE_SCHEMA, bindings };
-}
-function validateBinding(value) {
-  if (!record2(value) || !exactOptionalKeys(value, ["schema_version", "producer_id", "producer_installation_ref", "local_session_ref", "local_turn_ref", "local_turn_aliases", "prompt_ref", "request_ref", "bound_at", "host_source_ref", "host_session_ref", "host_turn_ref", "host_input_ref"], ["context_expires_at"]) || !validBindingIdentity(value) || !validBindingRequest(value)) throw new TypeError("Host Relay request binding is invalid.");
-}
-function validBindingIdentity(value) {
-  return value.schema_version === HOST_RELAY_REQUEST_BINDING_SCHEMA && producer(value.producer_id) && [value.producer_installation_ref, value.local_session_ref, value.local_turn_ref].every(safeRef2) && refList(value.local_turn_aliases);
-}
-function validBindingRequest(value) {
-  const tuple = [value.host_source_ref, value.host_session_ref, value.host_turn_ref, value.host_input_ref];
-  return safeRef2(value.prompt_ref) && safeRef2(value.request_ref) && validTimestamp(value.bound_at) && (value.context_expires_at === void 0 || validTimestamp(value.context_expires_at)) && tuple.every(safeRef2);
-}
-function validateQuery(value) {
-  if (!record2(value) || !exactKeys3(value, ["producer_id", "producer_installation_ref", "local_session_ref", "local_turn_ref"]) || !producer(value.producer_id) || !safeRef2(value.producer_installation_ref) || !safeRef2(value.local_session_ref) || !safeRef2(value.local_turn_ref)) throw new TypeError("Host Relay binding query is invalid.");
-}
-function relayRequestBindingMatchesQuery(query, binding) {
-  return query.producer_id === binding.producer_id && query.local_session_ref === binding.local_session_ref && (query.local_turn_ref === binding.local_turn_ref || binding.local_turn_aliases.includes(query.local_turn_ref)) && query.producer_installation_ref === binding.producer_installation_ref;
-}
-function sameCanonicalIdentity(left, right) {
-  return bindingKey(left) === bindingKey(right);
-}
-function sameBinding(left, right) {
-  return left.request_ref === right.request_ref && left.prompt_ref === right.prompt_ref && left.context_expires_at === right.context_expires_at && left.host_source_ref === right.host_source_ref && left.host_session_ref === right.host_session_ref && left.host_turn_ref === right.host_turn_ref && left.host_input_ref === right.host_input_ref && JSON.stringify(left.local_turn_aliases) === JSON.stringify(right.local_turn_aliases);
-}
-function bindingKey(value) {
-  return `${value.producer_id}\0${value.producer_installation_ref}\0${value.local_session_ref}\0${value.local_turn_ref}`;
-}
-function requiredRef(value) {
-  if (!safeRef2(value)) throw new TypeError("Host Relay binding reference is invalid.");
-  return value;
-}
-function optionalRefs2(value) {
-  if (value === void 0) return [];
-  if (!refList(value)) throw new TypeError("Host Relay binding aliases are invalid.");
-  return [...value];
-}
-function timestamp2(value) {
-  if (!validTimestamp(value)) throw new TypeError("Host Relay binding timestamp is invalid.");
-  return value;
-}
-function producer(value) {
-  return value === "codex" || value === "claude";
-}
-function safeRef2(value) {
-  return typeof value === "string" && SAFE_REF3.test(value);
-}
-function refList(value) {
-  return Array.isArray(value) && value.length <= 16 && value.every(safeRef2) && new Set(value).size === value.length;
-}
-function validTimestamp(value) {
-  return typeof value === "string" && Number.isFinite(Date.parse(value));
-}
-function record2(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function exactKeys3(value, keys) {
-  return Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
-}
-function exactOptionalKeys(value, required, optional) {
-  const keys = Object.keys(value);
-  return required.every((key) => Object.hasOwn(value, key)) && keys.every((key) => required.includes(key) || optional.includes(key));
-}
-function errorCode4(error) {
-  return record2(error) && typeof error.code === "string" ? error.code : null;
-}
-function ownerPrivate2(stats) {
-  if (process.platform === "win32") return true;
-  const uid = typeof process.geteuid === "function" ? process.geteuid() : stats.uid;
-  return stats.uid === uid && (stats.mode & 63) === 0;
-}
 // host/relay/src/relay-quarantine-store.ts
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 import { readFile } from "node:fs/promises";
-import { join as join3 } from "node:path";
+import { join as join2 } from "node:path";
 var RELAY_QUARANTINE_SCHEMA = "ceal.host_relay_quarantine_state.v1";
 var RELAY_QUARANTINE_MAX_RECORDS = 512;
 var RELAY_QUARANTINE_MAX_BYTES = 16 * 1024 * 1024;
@@ -2492,8 +2803,8 @@ var RelayQuarantineStore = class {
     if (!Number.isSafeInteger(this.maxRecords) || this.maxRecords < 1 || this.maxRecords > RELAY_QUARANTINE_MAX_RECORDS) throw new TypeError(`Relay quarantine record cap is invalid: ${refusalFact("max_records", this.maxRecords, `between 1 and ${RELAY_QUARANTINE_MAX_RECORDS}`)}.`);
     if (!Number.isSafeInteger(this.maxBytes) || this.maxBytes < 1 || this.maxBytes > RELAY_QUARANTINE_MAX_BYTES) throw new TypeError(`Relay quarantine byte cap is invalid: ${refusalFact("max_bytes", this.maxBytes, `between 1 and ${RELAY_QUARANTINE_MAX_BYTES}`)}.`);
   }
-  async retainFrame(frame, reason, attribution, capturedAt = (/* @__PURE__ */ new Date()).toISOString()) {
-    await this.retain(encodeHostProducerFrame(frame), frame.producer_id, reason, capturedAt, attribution);
+  async retainFrame(frame, reason, capturedAt = (/* @__PURE__ */ new Date()).toISOString()) {
+    await this.retain(encodeHostProducerFrame(frame), frame.producer_id, reason, capturedAt);
   }
   async retainMalformed(rawFrame, reason, capturedAt = (/* @__PURE__ */ new Date()).toISOString()) {
     await this.retain(rawFrame, inferProducer(rawFrame), reason, capturedAt);
@@ -2505,53 +2816,37 @@ var RelayQuarantineStore = class {
     const records = state.producers[producerId].slice(-Math.min(limit, this.maxRecords)).map((record6) => structuredClone(record6));
     return { producer_id: producerId, records, total_bytes: records.reduce((total, record6) => total + record6.charged_bytes, 0) };
   }
-  /**
-   * The newest quarantined record whose exact-turn attribution matches the
-   * query, or null when evicted, unattributed, or for another turn. The
-   * file-backed state survives drain, restart, and overwrite.
-   */
-  async findNewestAttributedMatch(query) {
-    await this.tail;
-    const state = await this.readState();
-    const bucket = query.producer_id === "codex" || query.producer_id === "claude" ? state.producers[query.producer_id] : [];
-    for (let index = bucket.length - 1; index >= 0; index -= 1) {
-      const record6 = bucket[index];
-      if (record6 !== void 0 && attributedRecordMatchesQuery(record6, query)) return structuredClone(record6);
-    }
-    return null;
-  }
   async snapshot() {
     await this.tail;
     return this.readState();
   }
-  async retain(rawFrame, producerId, reason, capturedAt, attribution) {
+  async retain(rawFrame, producerId, reason, capturedAt) {
     const run = this.tail.then(async () => {
       if (!PRODUCERS2.includes(producerId) || !Number.isFinite(Date.parse(capturedAt))) throw new TypeError("Relay quarantine record identity is invalid.");
       const raw = Buffer.from(rawFrame).subarray(0, MAX_CAPTURE_BYTES);
       const state = await this.readState();
       const record6 = {
-        quarantine_ref: `quarantine:${createHash4("sha256").update(`${producerId}\0${reason}\0${capturedAt}\0`).update(raw).digest("hex")}`,
+        quarantine_ref: `quarantine:${createHash5("sha256").update(`${producerId}\0${reason}\0${capturedAt}\0`).update(raw).digest("hex")}`,
         producer_id: producerId,
         reason,
         captured_at: capturedAt,
-        frame_sha256: createHash4("sha256").update(raw).digest("hex"),
+        frame_sha256: createHash5("sha256").update(raw).digest("hex"),
         charged_bytes: raw.byteLength,
-        raw_frame_base64: raw.toString("base64"),
-        ...attribution === void 0 ? {} : { attribution: structuredClone(attribution) }
+        raw_frame_base64: raw.toString("base64")
       };
       const records = state.producers[producerId];
       records.push(record6);
       while (records.length > this.maxRecords || totalBytes(records) > this.maxBytes) records.shift();
-      await durableAtomicReplace(join3(this.root, "quarantine.json"), JSON.stringify(state));
+      await durableAtomicReplace(join2(this.root, "quarantine.json"), JSON.stringify(state));
     });
     this.tail = run.then(() => void 0, () => void 0);
     await run;
   }
   async readState() {
     try {
-      return decodeState2(JSON.parse(await readFile(join3(this.root, "quarantine.json"), "utf8")));
+      return decodeState(JSON.parse(await readFile(join2(this.root, "quarantine.json"), "utf8")));
     } catch (error) {
-      if (errorCode5(error) === "ENOENT") return emptyState();
+      if (errorCode4(error) === "ENOENT") return emptyState();
       throw error;
     }
   }
@@ -2562,9 +2857,9 @@ function emptyState() {
 function totalBytes(records) {
   return records.reduce((total, record6) => total + record6.charged_bytes, 0);
 }
-function decodeState2(value) {
-  if (!record3(value) || value.schema_version !== RELAY_QUARANTINE_SCHEMA) throw new TypeError(`Host Relay quarantine state is invalid: ${refusalFact("schema_version", record3(value) ? value.schema_version : void 0, RELAY_QUARANTINE_SCHEMA)}.`);
-  if (!record3(value.producers)) throw new TypeError(`Host Relay quarantine state is invalid: ${refusalFact("producer_ids", record3(value.producers) ? Object.keys(value.producers) : [], `the ${PRODUCERS2.length} quarantine producer buckets`)}.`);
+function decodeState(value) {
+  if (!record2(value) || value.schema_version !== RELAY_QUARANTINE_SCHEMA) throw new TypeError(`Host Relay quarantine state is invalid: ${refusalFact("schema_version", record2(value) ? value.schema_version : void 0, RELAY_QUARANTINE_SCHEMA)}.`);
+  if (!record2(value.producers)) throw new TypeError(`Host Relay quarantine state is invalid: ${refusalFact("producer_ids", record2(value.producers) ? Object.keys(value.producers) : [], `the ${PRODUCERS2.length} quarantine producer buckets`)}.`);
   const state = emptyState();
   for (const producerId of PRODUCERS2) {
     const records = value.producers[producerId];
@@ -2574,8 +2869,7 @@ function decodeState2(value) {
   return state;
 }
 function validRecord(value) {
-  if (!record3(value) || !validRecordIdentity(value)) return false;
-  return value.attribution === void 0 || validAttribution(value.attribution);
+  return record2(value) && validRecordIdentity(value);
 }
 function validRecordIdentity(value) {
   return typeof value.quarantine_ref === "string" && quarantineProducer(value.producer_id) && validReason(value.reason) && Number.isFinite(Date.parse(String(value.captured_at))) && typeof value.frame_sha256 === "string" && typeof value.raw_frame_base64 === "string" && validChargedBytes(value.charged_bytes);
@@ -2586,52 +2880,22 @@ function validReason(value) {
 function validChargedBytes(value) {
   return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
 }
-var ATTRIBUTION_REQUIRED_KEYS = ["producer_id", "producer_installation_ref", "local_session_ref", "local_turn_ref", "local_turn_aliases", "sequence", "frame_sha256"];
-var ATTRIBUTION_OPTIONAL_KEYS = ["diagnostic"];
-function validAttribution(value) {
-  if (!record3(value) || !hasExactKeys2(value, ATTRIBUTION_REQUIRED_KEYS, ATTRIBUTION_OPTIONAL_KEYS)) return false;
-  return validAttributionIdentity(value) && validAttributionAliases(value.local_turn_aliases) && validAttributionEnvelope(value) && (value.diagnostic === void 0 || validAttributionDiagnostic(value.diagnostic));
-}
-function validAttributionIdentity(value) {
-  return (value.producer_id === "codex" || value.producer_id === "claude") && isHostSafeRef(value.producer_installation_ref) && isHostSafeRef(value.local_session_ref) && isHostSafeRef(value.local_turn_ref);
-}
-function validAttributionAliases(value) {
-  return Array.isArray(value) && value.length <= 16 && value.every(isHostSafeRef);
-}
-function validAttributionEnvelope(value) {
-  return typeof value.sequence === "number" && Number.isSafeInteger(value.sequence) && value.sequence > 0 && typeof value.frame_sha256 === "string";
-}
-function validAttributionDiagnostic(value) {
-  if (!record3(value) || !hasExactKeys2(value, [], RELAY_DELIVERY_DIAGNOSTIC_KEYS)) return false;
-  return isUndefinedOr(value.relayCode, isRelayGatewayErrorCode) && isUndefinedOr(value.gatewayStatus, isSafeInteger) && isUndefinedOr(value.gatewayCode, isBoundedRefusalWord) && isUndefinedOr(value.gatewayReason, isBoundedRefusalWord) && isUndefinedOr(value.exhausted, isBoolean);
-}
-function isSafeInteger(value) {
-  return Number.isSafeInteger(value);
-}
-function isBoolean(value) {
-  return typeof value === "boolean";
-}
-function attributedRecordMatchesQuery(recordValue, query) {
-  const attribution = recordValue.attribution;
-  if (attribution === void 0) return false;
-  return attribution.producer_id === query.producer_id && attribution.producer_installation_ref === query.producer_installation_ref && attribution.local_session_ref === query.local_session_ref && (attribution.local_turn_ref === query.local_turn_ref || attribution.local_turn_aliases.includes(query.local_turn_ref));
-}
 function quarantineProducer(value) {
   return value === "codex" || value === "claude" || value === "unknown";
 }
 function inferProducer(rawFrame) {
   try {
     const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(Buffer.from(rawFrame).subarray(4)));
-    return record3(value) && (value.producer_id === "codex" || value.producer_id === "claude") ? value.producer_id : "unknown";
+    return record2(value) && (value.producer_id === "codex" || value.producer_id === "claude") ? value.producer_id : "unknown";
   } catch {
     return "unknown";
   }
 }
-function record3(value) {
+function record2(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function errorCode5(error) {
-  return record3(error) && typeof error.code === "string" ? error.code : null;
+function errorCode4(error) {
+  return record2(error) && typeof error.code === "string" ? error.code : null;
 }
 // host/relay/src/relay-admission-store.ts
@@ -2641,12 +2905,11 @@ var RETRY_SECONDS = [1, 2, 4, 8, 16, 32, 60];
 var MAX_RETRYABLE_ATTEMPTS = RETRY_SECONDS.length + 10;
 var RelayAdmissionStore = class {
   tail = Promise.resolve();
-  drainWaiters = /* @__PURE__ */ new Set();
   root;
   quarantine;
   limits;
   faultHooks;
-  constructor(root, limits = DEFAULT_LIMITS, faultHooks = {}, quarantine = new RelayQuarantineStore(join4(root, "quarantine"))) {
+  constructor(root, limits = DEFAULT_LIMITS, faultHooks = {}, quarantine = new RelayQuarantineStore(join3(root, "quarantine"))) {
     this.root = root;
     this.quarantine = quarantine;
     this.limits = limits;
@@ -2661,36 +2924,10 @@ var RelayAdmissionStore = class {
     await this.tail;
     return this.read();
   }
-  async hasPendingRequestBinding(query) {
-    const state = await this.read();
-    return state.entries.some((entry2) => pendingFrameMatchesBindingQuery(entry2, query));
-  }
   async drainRound(deliver, options) {
     const run = this.tail.then(() => this.drainLocked(deliver, options));
     this.tail = run.then(() => void 0, () => void 0);
-    const result2 = await run;
-    if (result2.delivered.length > 0 || result2.refused.length > 0 || result2.retained.length > 0) this.resolveDrainWaiters();
-    return result2;
-  }
-  waitForDrainChange(signal) {
-    if (signal.aborted) return Promise.reject(new Error("Host Relay admission wait cancelled."));
-    return new Promise((resolve, reject) => {
-      let settled = false;
-      const finish = (error) => {
-        if (settled) return;
-        settled = true;
-        this.drainWaiters.delete(waiter);
-        signal.removeEventListener("abort", waiter.abort);
-        if (error !== void 0) reject(error);
-        else resolve();
-      };
-      const waiter = { resolve: () => finish(), abort: () => finish(new Error("Host Relay admission wait cancelled.")) };
-      this.drainWaiters.add(waiter);
-      signal.addEventListener("abort", waiter.abort, { once: true });
-    });
-  }
-  resolveDrainWaiters() {
-    for (const waiter of this.drainWaiters) waiter.resolve();
+    return run;
   }
   async admitLocked(frame) {
     const state = await this.read();
@@ -2702,11 +2939,11 @@ var RelayAdmissionStore = class {
     const hash = hostProducerFrameHash(frame);
     const replay = replayCode(existing, hash, frame.sequence, installation2);
     if (replay !== null) {
-      if (replay === "frame_identity_conflict") await this.quarantine.retainFrame(frame, replay, attributionForFrame(frame, hash, frame.sequence));
+      if (replay === "frame_identity_conflict") await this.quarantine.retainFrame(frame, replay);
       return result(replay, installation2);
     }
     if (frame.sequence !== installation2.admitted_through_sequence + 1) {
-      await this.quarantine.retainFrame(frame, "sequence_gap", attributionForFrame(frame, hash, frame.sequence));
+      await this.quarantine.retainFrame(frame, "sequence_gap");
       return result("sequence_gap", installation2);
     }
     const chargedBytes = 4 + Buffer.byteLength(JSON.stringify(frame), "utf8");
@@ -2753,7 +2990,7 @@ var RelayAdmissionStore = class {
     if (!installation2) throw new TypeError("Host Relay delivery installation is unavailable.");
     if (outcome.status === "refused" || exhausted) {
       const diagnostic = exhaustedDiagnostic(outcome, exhausted);
-      await this.quarantine.retainFrame(head.frame, "gateway_refused", attributionForFrame(head.frame, head.hash, head.sequence, diagnostic));
+      await this.quarantine.retainFrame(head.frame, "gateway_refused");
       installation2.last_refusal = { sequence: head.sequence, submission_ref: input.submission_ref, ...refusalCause(outcome, head), ...diagnostic === void 0 ? {} : { diagnostic }, refused_at_ms: options.now_ms };
       refused.push(input.submission_ref);
     } else {
@@ -2784,31 +3021,19 @@ var RelayAdmissionStore = class {
   }
   async read() {
     try {
-      return decodeState3(JSON.parse(await readFile2(join4(this.root, "admission.json"), "utf8")));
+      return decodeState2(JSON.parse(await readFile2(join3(this.root, "admission.json"), "utf8")));
     } catch (error) {
-      if (errorCode6(error) === "ENOENT") return { schema_version: "ceal.host_relay_admission_state.v1", installations: {}, entries: [] };
+      if (errorCode5(error) === "ENOENT") return { schema_version: "ceal.host_relay_admission_state.v1", installations: {}, entries: [] };
       throw error;
     }
   }
   async write(state) {
-    await durableAtomicReplace(join4(this.root, "admission.json"), JSON.stringify(state));
+    await durableAtomicReplace(join3(this.root, "admission.json"), JSON.stringify(state));
   }
 };
 function installationKey(frame) {
   return `${frame.producer_id}\0${frame.producer_installation_ref}`;
 }
-function pendingFrameMatchesBindingQuery(entry2, query) {
-  const selector = extractHostBindingSelector(entry2.frame);
-  if (selector === null) return false;
-  return relayRequestBindingMatchesQuery(query, selector);
-}
-function attributionForFrame(frame, hash, sequence, diagnostic) {
-  const selector = extractHostBindingSelector(frame);
-  if (selector === null) return void 0;
-  if (frame.producer_id !== selector.producer_id || frame.producer_installation_ref !== selector.producer_installation_ref || frame.sequence !== sequence) return void 0;
-  if (hostProducerFrameHash(frame) !== hash) return void 0;
-  return { ...selector, sequence, frame_sha256: hash, ...diagnostic === void 0 ? {} : { diagnostic } };
-}
 function exhaustedDiagnostic(outcome, exhausted) {
   if (outcome.status !== "retryable" && outcome.status !== "refused") return void 0;
   if (outcome.diagnostic !== void 0) return exhausted ? { ...outcome.diagnostic, exhausted: true } : outcome.diagnostic;
@@ -2826,6 +3051,7 @@ function retryExhausted(outcome, entry2) {
   return outcome.status === "retryable" && entry2.retry_attempts >= MAX_RETRYABLE_ATTEMPTS;
 }
 function refusalCause(outcome, entry2) {
+  if (outcome.status === "refused" && outcome.code === "no_binding") return { code: "gateway_refused", message: "Gateway refused the Host producer frame." };
   if (outcome.status === "refused") return { code: outcome.code, message: outcome.message };
   const reason = outcome.status === "retryable" ? outcome.reason ?? "no reason reported" : "no reason reported";
   return { code: "retry_exhausted", message: `Gateway delivery stayed retryable through ${entry2.retry_attempts} attempts: ${reason}` };
@@ -2839,10 +3065,10 @@ function scheduleRetry(entry2, nowMs, reason) {
 function result(code, state) {
   return { code, admitted_through_sequence: state.admitted_through_sequence, delivered_through_sequence: state.delivered_through_sequence };
 }
-function errorCode6(error) {
+function errorCode5(error) {
   return typeof error === "object" && error !== null && "code" in error ? String(error.code) : null;
 }
-function decodeState3(value) {
+function decodeState2(value) {
   if (!stateRecord(value)) throw new TypeError("Host Relay admission state is invalid.");
   const installations = {};
   for (const [key, item] of Object.entries(value.installations)) {
@@ -2869,18 +3095,18 @@ function refusalRecord(value) {
 }
 function validDiagnostic(value) {
   if (!object(value) || !hasExactKeys2(value, [], RELAY_DELIVERY_DIAGNOSTIC_KEYS)) return false;
-  return isUndefinedOr(value.relayCode, isRelayGatewayErrorCode) && isUndefinedOr(value.gatewayStatus, isSafeInteger2) && isUndefinedOr(value.gatewayCode, isBoundedRefusalWord) && isUndefinedOr(value.gatewayReason, isBoundedRefusalWord) && isUndefinedOr(value.exhausted, isBoolean2);
+  return isUndefinedOr(value.relayCode, isRelayGatewayErrorCode) && isUndefinedOr(value.gatewayStatus, isSafeInteger) && isUndefinedOr(value.gatewayCode, isBoundedRefusalWord) && isUndefinedOr(value.gatewayReason, isBoundedRefusalWord) && isUndefinedOr(value.exhausted, isBoolean);
 }
-function isSafeInteger2(value) {
+function isSafeInteger(value) {
   return Number.isSafeInteger(value);
 }
-function isBoolean2(value) {
+function isBoolean(value) {
   return typeof value === "boolean";
 }
 function entry(value) {
-  return object(value) && producer2(value.producer_id) && typeof value.producer_installation_ref === "string" && Number.isSafeInteger(value.sequence) && typeof value.hash === "string" && Number.isSafeInteger(value.charged_bytes) && object(value.frame) && Number.isSafeInteger(value.retry_attempts) && Number.isSafeInteger(value.retry_at_ms);
+  return object(value) && producer(value.producer_id) && typeof value.producer_installation_ref === "string" && Number.isSafeInteger(value.sequence) && typeof value.hash === "string" && Number.isSafeInteger(value.charged_bytes) && object(value.frame) && Number.isSafeInteger(value.retry_attempts) && Number.isSafeInteger(value.retry_at_ms);
 }
-function producer2(value) {
+function producer(value) {
   return value === "codex" || value === "claude";
 }
 function object(value) {
@@ -2910,10 +3136,10 @@ function poisonEnvelopeMatches(entryValue, installation2) {
   return poisonEnvelopeSchema(frame) && poisonEnvelopeProducer(frame, entryValue) && poisonEnvelopeInstallation(frame, entryValue) && poisonEnvelopeEpoch(frame, installation2) && poisonEnvelopeSequence(frame, entryValue) && poisonEnvelopeKind(frame) && poisonEnvelopeTimestamp(frame);
 }
 function poisonEnvelopeSchema(frame) {
-  return frame.schema_version === "ceal.host_producer_frame.v1";
+  return frame.schema_version === HOST_PRODUCER_FRAME_SCHEMA;
 }
 function poisonEnvelopeProducer(frame, entryValue) {
-  return producer2(frame.producer_id) && frame.producer_id === entryValue.producer_id;
+  return producer(frame.producer_id) && frame.producer_id === entryValue.producer_id;
 }
 function poisonEnvelopeInstallation(frame, entryValue) {
   return opaqueHostSourceRef(frame.producer_installation_ref) && frame.producer_installation_ref === entryValue.producer_installation_ref;
@@ -2941,674 +3167,275 @@ function poisonSequenceInRange(entryValue, installation2) {
   return entryValue.sequence <= installation2.admitted_through_sequence;
 }
-// host/relay/src/relay-gateway-bridge.ts
-import { readFile as readFile3 } from "node:fs/promises";
-import { join as join5 } from "node:path";
-var STATE_SCHEMA2 = "ceal.host_relay_gateway_state.v1";
-var SAFE_REF4 = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
-var HOST_GATEWAY_ACKNOWLEDGEMENT_DISPOSITIONS = ["created", "adopted", "replayed", "approval_approved", "approval_denied", "approval_replayed"];
-function isHostGatewayAcknowledgementDisposition(value) {
-  return typeof value === "string" && HOST_GATEWAY_ACKNOWLEDGEMENT_DISPOSITIONS.some((disposition) => disposition === value);
-}
-var RelayGatewayBridge = class {
-  statePath;
-  hostSourceRef;
-  gateway;
-  timeoutMs;
-  onRequestBound;
-  tail = Promise.resolve();
-  constructor(options) {
-    if (typeof options.state_root !== "string" || options.state_root.length === 0 || !opaqueHostSourceRef(options.host_source_ref) || typeof options.gateway?.submitHostTurn !== "function") throw new TypeError("Host Relay Gateway bridge configuration is invalid.");
-    if (!validOptionalTimeout(options.timeout_ms)) throw new TypeError("Host Relay Gateway timeout is invalid.");
-    this.statePath = join5(options.state_root, "gateway-state.json");
-    this.hostSourceRef = options.host_source_ref;
-    this.gateway = options.gateway;
-    this.timeoutMs = options.timeout_ms ?? 5e3;
-    this.onRequestBound = options.on_request_bound ?? (() => void 0);
-  }
-  deliver(input) {
-    const run = this.tail.then(() => this.deliverLocked(input));
-    this.tail = run.then(() => void 0, () => void 0);
-    return run;
+// host/relay/src/relay-pipe-handshake.ts
+import { createHmac, randomBytes } from "node:crypto";
+import { constants as constants2 } from "node:fs";
+import { link, unlink as unlink2 } from "node:fs/promises";
+import { dirname as dirname4, join as join4 } from "node:path";
+var RELAY_PIPE_HANDSHAKE_TIMEOUT_MS = 5e3;
+var RELAY_PIPE_KEY_BYTES = 32;
+var RELAY_PIPE_KEY_FILENAME = "relay-pipe.key";
+var RELAY_PIPE_NONCE_BYTES = 32;
+var RELAY_PIPE_NONCE_PATTERN = /^[A-Za-z0-9_-]{43}$/u;
+var RELAY_PIPE_HELLO_SCHEMA = "ceal.host_relay_pipe_hello.v1";
+var RELAY_PIPE_CHALLENGE_SCHEMA = "ceal.host_relay_pipe_challenge.v1";
+var RELAY_PIPE_RESPONSE_SCHEMA = "ceal.host_relay_pipe_response.v1";
+var RELAY_PIPE_FRAME_BYTES = Uint32Array.BYTES_PER_ELEMENT;
+var RELAY_PIPE_FRAME_MAX_BYTES = 1024;
+var RelayPipeHandshakeError = class extends Error {
+  name = "RelayPipeHandshakeError";
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
   }
-  async deliverLocked(input) {
-    if (input.host_source_ref !== this.hostSourceRef) throw new TypeError(`Host Relay source binding does not match the Gateway source: ${refusalFacts([{ name: "input_host_source_ref", value: input.host_source_ref }, { name: "configured_host_source_ref", value: this.hostSourceRef }])}.`);
-    if (input.frame.frame_kind === "producer_status") return { status: "created" };
-    const state = await this.readState();
-    if (input.frame.frame_kind === "session_started") return this.stageSession(state, input);
-    if (input.frame.frame_kind === "turn_started") return this.stageTurn(state, input);
-    return input.frame.frame_kind === "user_input" ? this.deliverInput(state, input) : this.deliverTerminal(state, input);
+};
+function relayPipeKeyPath(relayStateRoot) {
+  return join4(relayStateRoot, RELAY_PIPE_KEY_FILENAME);
+}
+async function loadRelayPipeKey(relayStateRoot, platform = process.platform, custody = {}) {
+  const path = relayPipeKeyPath(relayStateRoot);
+  if (platform === "win32") return await loadWindowsRelayPipeKey(path, custody);
+  const existing = await readRelayPipeKey(path, platform, custody);
+  if (existing !== null) return existing;
+  return await createPosixRelayPipeKey(path, platform, custody);
+}
+async function loadWindowsRelayPipeKey(path, custody) {
+  const existing = await readRelayPipeKey(path, "win32", custody);
+  if (existing !== null) return existing;
+  try {
+    await createRandomPrivateFileWithSecurefs(path, RELAY_PIPE_KEY_BYTES, custody);
+  } catch (error) {
+    if (errorCode6(error) === "EEXIST") return await readWinnerPipeKey(path, "win32", custody);
+    throw new RelayPipeHandshakeError("pipe_key_unavailable", `Host Relay pipe key is unavailable at ${path}; delete it and restart the Host Relay.`);
   }
-  async stageSession(state, input) {
-    const localSessionRef = payloadRef(input.frame, "local_session_ref");
-    const hostSessionRef = hostProducerSessionRef(this.hostSourceRef, input.frame, localSessionRef);
-    const next = { ...state, sessions: { ...state.sessions, [hostSessionRef]: { observations: payloadObservations(input.frame), submission_ref: input.submission_ref } } };
-    await this.writeState(next);
-    return { status: "created" };
+  return await readWinnerPipeKey(path, "win32", custody);
+}
+async function createPosixRelayPipeKey(path, platform, custody) {
+  const key = randomBytes(RELAY_PIPE_KEY_BYTES);
+  const staging = `${path}.${randomBytes(8).toString("hex")}.tmp`;
+  let handle;
+  try {
+    handle = await openNoFollow(staging, constants2.O_WRONLY | constants2.O_CREAT | constants2.O_EXCL, 384);
+  } catch (error) {
+    if (errorCode6(error) !== "EEXIST") throw new RelayPipeHandshakeError("pipe_key_unavailable", `Host Relay pipe key is unavailable at ${path}.`);
+    return await readWinnerPipeKey(path, platform, custody);
   }
-  async stageTurn(state, input) {
-    const refs = frameRefs(input.frame, this.hostSourceRef);
-    const existing = state.turns[refs.host_turn_ref];
-    const nextTurn = {
-      host_session_ref: refs.host_session_ref,
-      observations: payloadObservations(input.frame),
-      submission_ref: input.submission_ref,
-      ...existing?.request_ref === void 0 ? {} : { request_ref: existing.request_ref },
-      ...existing?.prompt_ref === void 0 ? {} : { prompt_ref: existing.prompt_ref },
-      ...existing?.origin_host_input_ref === void 0 ? {} : { origin_host_input_ref: existing.origin_host_input_ref },
-      ...existing?.input_refused === void 0 ? {} : { input_refused: existing.input_refused }
-    };
-    await this.writeState({ ...state, turns: { ...state.turns, [refs.host_turn_ref]: nextTurn } });
-    return { status: "created" };
+  try {
+    const stats = await handle.stat();
+    if (!stats.isFile() || !isSelfOwned(stats.uid) || !isPrivateFileMode(stats.mode)) throw new RelayPipeHandshakeError("pipe_key_unavailable", `Host Relay pipe key at ${path} is not a private regular file owned by the current user.`);
+    await handle.writeFile(key);
+    await handle.sync();
+  } finally {
+    await handle.close();
   }
-  async deliverInput(state, input) {
-    const prepared = prepareInput(state, input, this.hostSourceRef);
-    const priorRefusal = refusedUnboundInput(prepared.turn);
-    if (priorRefusal !== void 0) return priorRefusal;
-    const outcome = await this.submit(prepared.submission);
-    if ("refusal" in outcome) {
-      if (outcome.refusal.definitive && prepared.turn !== void 0) await this.writeState({ ...state, turns: { ...state.turns, [prepared.refs.host_turn_ref]: { ...prepared.turn, input_refused: { code: outcome.refusal.code, message: outcome.refusal.message } } } });
-      return deliveryRefusal(outcome.refusal);
-    }
-    const acknowledgement2 = outcome.acknowledgement;
-    const nextTurn = bindInput(prepared, acknowledgement2.request_ref, input.submission_ref);
-    await this.writeState({ ...state, turns: { ...state.turns, [prepared.refs.host_turn_ref]: nextTurn } });
-    if (!bindsOriginInput(prepared)) return { status: "created" };
-    const bindingRequestRef = nextTurn.request_ref ?? acknowledgement2.request_ref;
-    const bindingPromptRef = nextTurn.prompt_ref ?? prepared.promptRef;
-    const bindingInputRef = nextTurn.origin_host_input_ref ?? prepared.hostInputRef;
-    const binding = { frame: structuredClone(input.frame), request_ref: bindingRequestRef, prompt_ref: bindingPromptRef, host_binding: {
-      host_source_ref: prepared.submission.identity.host_source_ref,
-      host_session_ref: prepared.submission.identity.host_session_ref,
-      host_turn_ref: prepared.submission.identity.host_turn_ref,
-      host_input_ref: bindingInputRef,
-      prompt_ref: bindingPromptRef
-    } };
-    const context = createRelayRequestWorkContext({ request_ref: bindingRequestRef, host_binding: binding.host_binding });
-    try {
-      await this.onRequestBound(binding, context);
-    } catch (error) {
-      if (error instanceof HostRelayBindingError) return { status: "refused", code: error.code, message: error.message };
-      return { status: "retryable", reason: `binding_store: ${errorMessage(error)}` };
-    }
-    return { status: "created" };
-  }
-  async deliverTerminal(state, input) {
-    const refs = frameRefs(input.frame, this.hostSourceRef);
-    const turn = state.turns[refs.host_turn_ref];
-    if (turn === void 0) return { status: "refused", code: "origin_turn_unknown", message: "The terminal frame names a turn whose start was never admitted." };
-    if (turn.request_ref === void 0 || turn.prompt_ref === void 0 || turn.origin_host_input_ref === void 0) {
-      if (turn.input_refused !== void 0) return { status: "refused", code: "origin_input_refused", message: `The terminal frame names a turn whose input was refused (${turn.input_refused.code}: ${turn.input_refused.message}).` };
-      return { status: "retryable", reason: "origin_turn_unbound" };
-    }
-    const outcome = await this.submit({
-      identity: { host_source_ref: this.hostSourceRef, host_session_ref: refs.host_session_ref, host_turn_ref: refs.host_turn_ref },
-      host_input_ref: turn.origin_host_input_ref,
-      input_kind: "host_automatic",
-      prompt_ref: turn.prompt_ref,
-      observations: payloadObservations(input.frame),
-      request_ref: turn.request_ref,
-      submission_ref: input.submission_ref
-    });
-    return "refusal" in outcome ? deliveryRefusal(outcome.refusal) : { status: "created" };
-  }
-  async submit(input) {
-    const controller2 = new AbortController();
-    const timeout = setTimeout(() => controller2.abort(), this.timeoutMs);
-    try {
-      const acknowledgement2 = await this.gateway.submitHostTurn(input, controller2.signal);
-      return SAFE_REF4.test(acknowledgement2.request_ref) && isHostGatewayAcknowledgementDisposition(acknowledgement2.disposition) ? { acknowledgement: acknowledgement2 } : { refusal: { code: "invalid_response", message: "Gateway acknowledgement identity is invalid.", definitive: false } };
-    } catch (error) {
-      return { refusal: submissionRefusal(error) };
-    } finally {
-      clearTimeout(timeout);
-    }
-  }
-  async readState() {
-    try {
-      const state = decodeState4(JSON.parse(await readFile3(this.statePath, "utf8")));
-      if (state.host_source_ref !== this.hostSourceRef) throw new TypeError(`Host Relay Gateway source binding changed: ${refusalFacts([{ name: "stored_host_source_ref", value: state.host_source_ref }, { name: "configured_host_source_ref", value: this.hostSourceRef }])}.`);
-      return state;
-    } catch (error) {
-      if (errorCode7(error) === "ENOENT") return { schema_version: STATE_SCHEMA2, host_source_ref: this.hostSourceRef, sessions: {}, turns: {} };
-      throw error;
-    }
-  }
-  async writeState(state) {
-    await durableAtomicReplace(this.statePath, JSON.stringify(state));
+  try {
+    await link(staging, path);
+  } catch (error) {
+    if (errorCode6(error) !== "EEXIST") throw new RelayPipeHandshakeError("pipe_key_unavailable", `Host Relay pipe key is unavailable at ${path}.`);
+    return await readWinnerPipeKey(path, platform, custody);
+  } finally {
+    await unlink2(staging).catch(() => void 0);
   }
-};
-var RETRYABLE_HTTP_STATUSES = /* @__PURE__ */ new Set([401, 403, 408, 429]);
-function submissionRefusal(error) {
-  const status = isRecord(error) && typeof error.status === "number" ? error.status : void 0;
-  const code = errorCode7(error) ?? "gateway_unavailable";
-  const definitive = code === "payload_rejected" || status !== void 0 && status >= 400 && status < 500 && !RETRYABLE_HTTP_STATUSES.has(status);
-  return { code, message: errorMessage(error), definitive, diagnostic: typedDiagnostic(error, status) };
-}
-function typedDiagnostic(error, status) {
-  if (!isRecord(error)) return status === void 0 ? {} : { gatewayStatus: status };
-  const gatewayCode = isBoundedRefusalWord(error.error_code) ? error.error_code : void 0;
-  const gatewayReason = isBoundedRefusalWord(error.refusal_reason) ? error.refusal_reason : void 0;
-  return {
-    ...typeof error.code === "string" ? { relayCode: error.code } : {},
-    ...status === void 0 ? {} : { gatewayStatus: status },
-    ...gatewayCode === void 0 ? {} : { gatewayCode },
-    ...gatewayReason === void 0 ? {} : { gatewayReason }
-  };
+  return Buffer.from(key);
 }
-function deliveryRefusal(refusal) {
-  const diagnostic = refusal.diagnostic === void 0 ? {} : { diagnostic: refusal.diagnostic };
-  return refusal.definitive ? { status: "refused", code: refusal.code, message: refusal.message, ...diagnostic } : { status: "retryable", reason: `${refusal.code}: ${refusal.message}`, ...diagnostic };
-}
-function errorMessage(error) {
-  return error instanceof Error ? error.message : String(error);
-}
-function frameRefs(frame, hostSourceRef) {
-  const localSessionRef = payloadRef(frame, "local_session_ref");
-  const localTurnRef = payloadRef(frame, "local_turn_ref");
-  const hostSessionRef = hostProducerSessionRef(hostSourceRef, frame, localSessionRef);
-  return { local_session_ref: localSessionRef, local_turn_ref: localTurnRef, host_session_ref: hostSessionRef, host_turn_ref: hostProducerTurnRef(hostSourceRef, frame, localSessionRef, localTurnRef) };
-}
-function prepareInput(state, input, hostSourceRef) {
-  const refs = frameRefs(input.frame, hostSourceRef);
-  const turn = state.turns[refs.host_turn_ref];
-  const promptRef = turn?.prompt_ref ?? hostProducerPromptRef(payloadPromptDigest(input.frame));
-  const hostInputRef = hostProducerInputRef(hostSourceRef, input.frame, refs.local_session_ref, refs.local_turn_ref, payloadRef(input.frame, "local_input_ref"));
-  const observations = uniqueObservations([...state.sessions[refs.host_session_ref]?.observations ?? [], ...turn?.observations ?? [], ...payloadObservations(input.frame)]);
-  const submission = compactSubmission({
-    identity: { host_source_ref: hostSourceRef, host_session_ref: refs.host_session_ref, host_turn_ref: refs.host_turn_ref },
-    host_input_ref: hostInputRef,
-    input_kind: payloadInputKind(input.frame),
-    prompt_ref: promptRef,
-    observations,
-    request_ref: turn?.request_ref,
-    submission_ref: input.submission_ref
-  });
-  return { refs, turn, promptRef, hostInputRef, submission };
+async function readWinnerPipeKey(path, platform, custody) {
+  const winner = await readRelayPipeKey(path, platform, custody);
+  if (winner === null) throw new RelayPipeHandshakeError("pipe_key_unavailable", `Host Relay pipe key is unavailable at ${path}.`);
+  return winner;
 }
-function bindInput(prepared, requestRef, submissionRef) {
-  return {
-    host_session_ref: prepared.refs.host_session_ref,
-    observations: prepared.turn?.observations ?? [],
-    submission_ref: prepared.turn?.submission_ref ?? submissionRef,
-    request_ref: prepared.turn?.request_ref ?? requestRef,
-    prompt_ref: prepared.turn?.prompt_ref ?? prepared.promptRef,
-    origin_host_input_ref: prepared.turn?.origin_host_input_ref ?? prepared.hostInputRef
-  };
+async function readRelayPipeKey(path, platform, custody) {
+  if (platform === "win32") return await readWindowsRelayPipeKey(path, custody);
+  return await readPosixRelayPipeKey(path);
 }
-function refusedUnboundInput(turn) {
-  if (turn?.request_ref !== void 0 || turn?.input_refused === void 0) return void 0;
-  return { status: "refused", code: "origin_input_refused", message: `The input frame names a turn whose origin input was refused (${turn.input_refused.code}: ${turn.input_refused.message}).` };
-}
-function bindsOriginInput(prepared) {
-  return prepared.turn?.request_ref === void 0 || prepared.turn.origin_host_input_ref === prepared.hostInputRef;
-}
-function payloadRef(frame, key) {
-  const value = frame.payload[key];
-  if (typeof value !== "string" || !SAFE_REF4.test(value)) throw new TypeError("Host Relay frame reference is invalid.");
-  return value;
-}
-function payloadPromptDigest(frame) {
-  const prompt = payloadObservations(frame).find((observation) => observation.observation_kind === "prompt");
-  if (prompt === void 0 || !isCealHostPromptObservationValue(prompt.value)) throw new TypeError("Host Relay prompt observation is invalid.");
-  return prompt.value.body_sha256;
-}
-function payloadObservations(frame) {
-  return Array.isArray(frame.payload.observations) ? frame.payload.observations.filter(isObservation) : [];
-}
-function payloadInputKind(frame) {
-  const value = frame.payload.input_kind;
-  if (!isCealHostInputKind(value)) throw new TypeError("Host Relay input kind is invalid.");
-  return value;
-}
-function uniqueObservations(values) {
-  const seen = /* @__PURE__ */ new Set();
-  return values.filter((value) => !seen.has(value.observation_ref) && Boolean(seen.add(value.observation_ref)));
-}
-function compactSubmission(value) {
-  return { identity: value.identity, host_input_ref: value.host_input_ref, input_kind: value.input_kind, prompt_ref: value.prompt_ref, observations: value.observations, submission_ref: value.submission_ref, ...value.request_ref === void 0 ? {} : { request_ref: value.request_ref } };
-}
-function isObservation(value) {
+async function readWindowsRelayPipeKey(path, custody) {
+  let key;
   try {
-    validateCealHostObservationDraft(value);
-    return true;
-  } catch {
-    return false;
+    key = await readPrivateFileWithSecurefs(path, RELAY_PIPE_KEY_BYTES, custody);
+  } catch (error) {
+    if (errorCode6(error) === "ENOENT" || errorCode6(error) === "ELOOP") return null;
+    throw new RelayPipeHandshakeError("pipe_key_unavailable", `Host Relay pipe key is unavailable at ${path}; delete it and restart the Host Relay.`);
   }
+  if (key.byteLength !== RELAY_PIPE_KEY_BYTES) throw new RelayPipeHandshakeError("pipe_key_unavailable", `Host Relay pipe key at ${path} has ${key.byteLength} bytes; want ${RELAY_PIPE_KEY_BYTES}. Delete the file and restart the Host Relay.`);
+  return Buffer.from(key);
 }
-function isRecord(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function validOptionalTimeout(value) {
-  return value === void 0 || Number.isSafeInteger(value) && Number(value) >= 1 && Number(value) <= 6e4;
-}
-function errorCode7(error) {
-  return isRecord(error) && typeof error.code === "string" ? error.code : null;
-}
-function decodeState4(value) {
-  if (!isRecord(value) || value.schema_version !== STATE_SCHEMA2) throw new TypeError(`Host Relay Gateway state is invalid: ${refusalFact("schema_version", isRecord(value) ? value.schema_version : void 0, STATE_SCHEMA2)}.`);
-  if (!opaqueHostSourceRef(value.host_source_ref)) throw new TypeError(`Host Relay Gateway state is invalid: ${refusalFact("host_source_ref", value.host_source_ref, "an opaque Host source reference")}.`);
-  if (!isRecord(value.sessions) || !isRecord(value.turns)) throw new TypeError(`Host Relay Gateway state is invalid: ${refusalFacts([{ name: "sessions_is_object", value: isRecord(value.sessions), expected: "true" }, { name: "turns_is_object", value: isRecord(value.turns), expected: "true" }])}.`);
-  return { schema_version: STATE_SCHEMA2, host_source_ref: value.host_source_ref, sessions: decodeSessions(value.sessions), turns: decodeTurns(value.turns) };
-}
-function decodeSessions(value) {
-  const result2 = {};
-  for (const [key, item] of Object.entries(value)) {
-    if (!SAFE_REF4.test(key) || !isRecord(item) || !Array.isArray(item.observations) || !item.observations.every(isObservation) || typeof item.submission_ref !== "string") throw new TypeError("Host Relay staged Session is invalid.");
-    result2[key] = { observations: item.observations, submission_ref: item.submission_ref };
+async function readPosixRelayPipeKey(path) {
+  let handle;
+  try {
+    handle = await openNoFollow(path);
+  } catch (error) {
+    if (errorCode6(error) === "ENOENT" || errorCode6(error) === "ELOOP") return null;
+    throw new RelayPipeHandshakeError("pipe_key_unavailable", `Host Relay pipe key is unavailable at ${path}.`);
   }
-  return result2;
-}
-function decodeTurns(value) {
-  const result2 = {};
-  for (const [key, item] of Object.entries(value)) {
-    if (!SAFE_REF4.test(key)) throw new TypeError("Host Relay staged turn is invalid.");
-    result2[key] = decodeTurn(item);
+  try {
+    const stats = await handle.stat();
+    if (!stats.isFile()) throw new RelayPipeHandshakeError("pipe_key_unavailable", `Host Relay pipe key at ${path} is not a regular file; delete it and restart the Host Relay.`);
+    if (!isSelfOwned(stats.uid) || !isPrivateFileMode(stats.mode)) throw new RelayPipeHandshakeError("pipe_key_unavailable", `Host Relay pipe key at ${path} is not a private file owned by the current user; delete it and restart the Host Relay.`);
+    if (stats.size !== RELAY_PIPE_KEY_BYTES) throw new RelayPipeHandshakeError("pipe_key_unavailable", `Host Relay pipe key at ${path} has ${stats.size} bytes; want ${RELAY_PIPE_KEY_BYTES}. Delete the file and restart the Host Relay.`);
+    return await handle.readFile();
+  } finally {
+    await handle.close();
   }
-  return result2;
 }
-function decodeTurn(item) {
-  if (!isRecord(item) || typeof item.host_session_ref !== "string" || !Array.isArray(item.observations) || !item.observations.every(isObservation) || typeof item.submission_ref !== "string") throw new TypeError("Host Relay staged turn is invalid.");
-  return {
-    host_session_ref: item.host_session_ref,
-    observations: item.observations,
-    submission_ref: item.submission_ref,
-    ...decodeTurnBinding(item),
-    ...isInputRefusal(item.input_refused) ? { input_refused: { code: item.input_refused.code, message: item.input_refused.message } } : {}
-  };
+function createPipeClientNonce() {
+  return randomBytes(RELAY_PIPE_NONCE_BYTES).toString("base64url");
 }
-function decodeTurnBinding(item) {
-  return { ...typeof item.request_ref === "string" ? { request_ref: item.request_ref } : {}, ...typeof item.prompt_ref === "string" ? { prompt_ref: item.prompt_ref } : {}, ...typeof item.origin_host_input_ref === "string" ? { origin_host_input_ref: item.origin_host_input_ref } : {} };
+function pipeProof(key, role, firstNonce, secondNonce) {
+  return createHmac("sha256", key).update(`${role}\0${firstNonce}\0${secondNonce}`, "utf8").digest("hex");
 }
-function isInputRefusal(value) {
-  return isRecord(value) && typeof value.code === "string" && typeof value.message === "string";
+function createPipeServerProof(key, clientNonce, serverNonce) {
+  return pipeProof(key, "server", clientNonce, serverNonce);
 }
-// host/relay/src/relay-gateway-http.ts
-import { O_NOFOLLOW as O_NOFOLLOW2, O_RDONLY as O_RDONLY3 } from "node:constants";
-import { lstat as lstat2, open as open4 } from "node:fs/promises";
-import { dirname as dirname2 } from "node:path";
-// host/gateway-http.ts
-var SAFE_HOST_REF = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
-function hostIngressBody(input, invalidEventTime) {
-  if (!isCealHostInputKind(input.input_kind)) throw new TypeError("Host ingress input kind is invalid.");
-  const prompt = input.observations.find((observation) => observation.observation_kind === "prompt");
-  const observedAt = prompt?.observed_at ?? input.observations[0]?.observed_at;
-  if (observedAt === void 0 || !Number.isFinite(Date.parse(observedAt))) throw invalidEventTime();
-  return {
-    submission_ref: input.submission_ref,
-    host_source_ref: input.identity.host_source_ref,
-    host_session_ref: input.identity.host_session_ref,
-    host_turn_ref: input.identity.host_turn_ref,
-    host_input_ref: input.host_input_ref,
-    input_kind: input.input_kind,
-    prompt_ref: input.prompt_ref,
-    observed_at: observedAt,
-    observations: input.observations,
-    ...input.request_ref === void 0 ? {} : { request_ref: input.request_ref }
-  };
-}
-async function responseJson(response2, invalidResponse2) {
-  try {
-    return await response2.json();
-  } catch {
-    throw invalidResponse2();
-  }
+function createPipeClientProof(key, serverNonce, clientNonce) {
+  return pipeProof(key, "client", serverNonce, clientNonce);
 }
-async function submitHostIngress(options) {
-  if (options.input.identity.host_source_ref !== options.expected_host_source_ref) throw options.sourceMismatch();
-  const body = JSON.stringify(hostIngressBody(options.input, options.invalidEventTime));
-  let response2;
-  try {
-    response2 = await options.fetcher(options.endpoint, {
-      method: "POST",
-      ...options.redirect === void 0 ? {} : { redirect: options.redirect },
-      headers: { authorization: `Bearer ${options.credential}`, "content-type": "application/json" },
-      body,
-      signal: options.signal
-    });
-  } catch {
-    throw options.unavailable();
-  }
-  const responseBody = await responseJson(response2, options.invalidResponse);
-  if (!response2.ok) throw options.refused(response2.status, responseBody);
-  return options.acknowledgement(responseBody);
+function encodePipeFrame(value) {
+  const body = Buffer.from(JSON.stringify(value), "utf8");
+  const output = Buffer.allocUnsafe(body.length + RELAY_PIPE_FRAME_BYTES);
+  output.writeUInt32BE(body.length, 0);
+  body.copy(output, RELAY_PIPE_FRAME_BYTES);
+  return output;
 }
-// host/relay/src/relay-gateway-http.ts
-var HOST_REGISTRATION_STATE_SCHEMA = "ceal.host_registration_state.v1";
-var HOST_REGISTRATION_STATE_KEYS = Object.freeze([
-  "credential_generation",
-  "gateway_request_origin",
-  "host_access_token",
-  "host_installation_ref",
-  "host_source_ref",
-  "registration_attempt_ref",
-  "schema_version",
-  "status"
-]);
-var HOST_REGISTRATION_STATE_MAX_BYTES = 65536;
-var HostRelayGatewayError = class extends Error {
-  name = "HostRelayGatewayError";
-  code;
-  /** HTTP status of a Gateway refusal, when one answered. */
-  status;
-  /** The Gateway's own refusal word, when it named one; a bounded token, never its message. */
-  error_code;
-  /** The Gateway mint refusal's bounded continuity reason, when it named one; a fixed token, never its message. */
-  refusal_reason;
-  constructor(code, message, status, errorCode9, refusalReason) {
-    super(message);
-    this.code = code;
-    if (status !== void 0) this.status = status;
-    if (errorCode9 !== void 0) this.error_code = errorCode9;
-    if (refusalReason !== void 0) this.refusal_reason = refusalReason;
-  }
-};
-var GATEWAY_REFUSAL_CODE_PATTERN = /^[a-z][a-z0-9_]{0,63}$/u;
-async function gatewayRefusal(response2) {
+function decodePipeFrame(buffer) {
+  if (buffer.length < RELAY_PIPE_FRAME_BYTES) return null;
+  const length = buffer.readUInt32BE(0);
+  if (length === 0 || length > RELAY_PIPE_FRAME_MAX_BYTES) throw new RelayPipeHandshakeError("pipe_handshake_invalid", `Host Relay pipe handshake frame declares ${length} bytes; want between 1 and ${RELAY_PIPE_FRAME_MAX_BYTES}.`);
+  if (buffer.length < length + RELAY_PIPE_FRAME_BYTES) return null;
+  let value;
   try {
-    const body = await response2.json();
-    if (!isCealJsonRecord(body)) return {};
-    const code = typeof body.error_code === "string" && GATEWAY_REFUSAL_CODE_PATTERN.test(body.error_code) ? body.error_code : void 0;
-    const reason = code === "request_context_refused" && typeof body.reason === "string" && GATEWAY_REFUSAL_CODE_PATTERN.test(body.reason) && isVocabularyWord(CEAL_HOST_MINT_REQUEST_CONTEXT_REFUSAL_REASONS, body.reason) ? body.reason : void 0;
-    return {
-      ...code === void 0 ? {} : { code },
-      ...reason === void 0 ? {} : { reason }
-    };
+    value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(buffer.subarray(RELAY_PIPE_FRAME_BYTES, length + RELAY_PIPE_FRAME_BYTES)));
   } catch {
-    return {};
+    throw new RelayPipeHandshakeError("pipe_handshake_invalid", "Host Relay pipe handshake frame is not JSON.");
   }
+  return { value, rest: buffer.subarray(length + RELAY_PIPE_FRAME_BYTES) };
 }
-function submitRefusalCode(body) {
-  if (!isCealJsonRecord(body) || typeof body.error_code !== "string" || !GATEWAY_REFUSAL_CODE_PATTERN.test(body.error_code)) return void 0;
-  return body.error_code;
+function validNonce(value) {
+  return typeof value === "string" && RELAY_PIPE_NONCE_PATTERN.test(value);
 }
-function refusalMessage(status, body) {
-  const record6 = isCealJsonRecord(body) ? body : {};
-  const code = typeof record6.error_code === "string" ? record6.error_code : "unknown";
-  const message = typeof record6.message === "string" ? `: ${record6.message}` : "";
-  return `Gateway Host ingress refused the submission (${status} ${code}${message}).`;
+function writePipeFrame(socket, frame) {
+  if (socket.write(frame)) return Promise.resolve();
+  return new Promise((resolve, reject) => {
+    socket.once("drain", resolve);
+    socket.once("error", reject);
+    socket.once("close", () => reject(new RelayPipeHandshakeError("pipe_handshake_invalid", "Host Relay pipe handshake connection closed.")));
+  });
 }
-function createHostRelayGatewayHttpPort(options) {
-  if (!SAFE_HOST_REF.test(options.host_source_ref) || options.host_source_ref.startsWith("ceal-host-source:") || typeof options.registration_state_file !== "string" || options.registration_state_file.length === 0) {
-    throw new HostRelayGatewayError("configuration", "Host Relay Gateway binding is invalid.");
-  }
-  return Object.freeze({
-    async submitHostTurn(input, signal) {
-      if (input.identity.host_source_ref !== options.host_source_ref) throw new HostRelayGatewayError("payload_rejected", `Host Relay source binding changed: ${refusalFacts([{ name: "input_host_source_ref", value: input.identity.host_source_ref }, { name: "configured_host_source_ref", value: options.host_source_ref }])}.`);
-      const registration = await readHostRegistrationAuthority(options.registration_state_file, options.host_source_ref);
-      const endpoint = hostRelayGatewayEndpoint(registration.gateway_request_origin);
-      return await submitHostIngress({
-        input,
-        expected_host_source_ref: options.host_source_ref,
-        endpoint,
-        credential: registration.host_access_token,
-        fetcher: options.fetch ?? fetch,
-        signal,
-        redirect: "error",
-        sourceMismatch: () => new HostRelayGatewayError("payload_rejected", "Host Relay source binding changed."),
-        invalidEventTime: () => new HostRelayGatewayError("payload_rejected", "Host Relay submission has no event time."),
-        unavailable: () => new HostRelayGatewayError("gateway_unavailable", "Gateway Host ingress is unavailable."),
-        invalidResponse: () => new HostRelayGatewayError("invalid_response", "Gateway Host ingress response is not JSON."),
-        refused: (status, body) => new HostRelayGatewayError("gateway_refused", refusalMessage(status, body), status, submitRefusalCode(body)),
-        acknowledgement
-      });
-    },
-    async mintInvocationContext(input, signal) {
-      const registration = await readHostRegistrationAuthority(options.registration_state_file, options.host_source_ref);
-      let response2;
+function readPipeFrames() {
+  let buffer = Buffer.alloc(0);
+  let pending = null;
+  const feed = (chunk) => {
+    buffer = Buffer.concat([buffer, chunk]);
+    if (pending === null) return;
+    let frame;
+    try {
+      frame = decodePipeFrame(buffer);
+    } catch (error) {
+      const waiting2 = pending;
+      pending = null;
+      waiting2.reject(error instanceof Error ? error : new RelayPipeHandshakeError("pipe_handshake_invalid", "Host Relay pipe handshake frame is invalid."));
+      return;
+    }
+    if (frame === null) return;
+    buffer = frame.rest;
+    const waiting = pending;
+    pending = null;
+    waiting.resolve({ value: frame.value, rest: Buffer.alloc(0) });
+  };
+  const waiter = {
+    wait: () => new Promise((resolve, reject) => {
+      let frame;
       try {
-        response2 = await (options.fetch ?? fetch)(hostRelayGatewayRoute(registration.gateway_request_origin, CEAL_HOST_INVOCATION_CONTEXT_PATH), {
-          method: "POST",
-          redirect: "error",
-          signal,
-          headers: { authorization: `Bearer ${registration.host_access_token}`, "content-type": "application/json" },
-          body: JSON.stringify({ schema_version: "ceal.gateway_host_invocation_context_request.v1", ...input })
-        });
-      } catch {
-        throw new HostRelayGatewayError("gateway_unavailable", "Gateway Host invocation context is unavailable.");
-      }
-      if (!response2.ok) {
-        const refusal = await gatewayRefusal(response2);
-        throw new HostRelayGatewayError(response2.status === 401 ? "credential" : "gateway_refused", `Gateway Host invocation context was refused (${response2.status}).`, response2.status, refusal.code, refusal.reason);
+        frame = decodePipeFrame(buffer);
+      } catch (error) {
+        reject(error instanceof Error ? error : new RelayPipeHandshakeError("pipe_handshake_invalid", "Host Relay pipe handshake frame is invalid."));
+        return;
       }
-      let value;
-      try {
-        value = await response2.json();
-      } catch {
-        throw new HostRelayGatewayError("invalid_response", "Gateway Host invocation context response is not JSON.");
+      if (frame !== null) {
+        buffer = frame.rest;
+        resolve({ value: frame.value, rest: Buffer.alloc(0) });
+        return;
       }
-      try {
-        return decodeCealHostInvocationAuthenticationResult(value);
-      } catch {
-        throw new HostRelayGatewayError("invalid_response", "Gateway Host invocation context response is invalid.");
+      pending = { resolve, reject };
+    }),
+    cancel: (error) => {
+      if (pending !== null) {
+        const waiting = pending;
+        pending = null;
+        waiting.reject(error);
       }
     }
-  });
-}
-function hostRelayGatewayEndpoint(value) {
-  return hostRelayGatewayRoute(value, CEAL_HOST_INGRESS_PATH);
-}
-function hostRelayGatewayRoute(value, path) {
-  let parsed;
-  try {
-    parsed = new URL(value);
-  } catch {
-    throw new HostRelayGatewayError("configuration", "Host Relay Gateway origin is invalid.");
-  }
-  const hostname = parsed.hostname.toLowerCase().replace(/\.+$/u, "");
-  if (/\s|\0/u.test(value) || hostname === "" || !validPort(parsed) || !isExplicitLoopbackHttp(parsed, hostname) && !isSecureHttps(parsed)) {
-    throw new HostRelayGatewayError("configuration", `Host Relay Gateway origin is invalid: ${refusalFacts([{ name: "protocol", value: parsed.protocol, expected: "https:, or http: with an explicit loopback port" }, { name: "hostname", value: hostname }, { name: "port", value: parsed.port }])}.`);
-  }
-  if (hasOriginDecoration(value, parsed)) {
-    throw new HostRelayGatewayError("configuration", `Host Relay Gateway origin is invalid: ${refusalFacts([{ name: "origin", value: parsed.origin }, { name: "has_userinfo", value: parsed.username !== "" || parsed.password !== "", expected: "false" }, { name: "pathname", value: parsed.pathname, expected: "/" }, { name: "search", value: parsed.search, expected: "an empty query" }, { name: "hash", value: parsed.hash, expected: "an empty fragment" }])}.`);
-  }
-  return `${parsed.origin}${path}`;
-}
-function isExplicitLoopbackHttp(parsed, hostname) {
-  return parsed.protocol === "http:" && parsed.port !== "" && (hostname === "127.0.0.1" || hostname === "[::1]");
-}
-function isSecureHttps(parsed) {
-  return parsed.protocol === "https:";
-}
-function validPort(parsed) {
-  if (parsed.port === "") return true;
-  const port = Number(parsed.port);
-  return Number.isInteger(port) && port >= 1 && port <= 65535;
+  };
+  return { waiter, feed, remainder: () => buffer };
+}
+function attachHandshakeReader(socket, waiter, feed) {
+  const onData = (chunk) => feed(Buffer.from(chunk));
+  const onError = (error) => waiter.cancel(error);
+  const onClose = () => waiter.cancel(new RelayPipeHandshakeError("pipe_handshake_invalid", "Host Relay pipe handshake connection closed."));
+  socket.on("data", onData);
+  socket.once("error", onError);
+  socket.once("close", onClose);
+  return () => {
+    socket.removeListener("data", onData);
+    socket.removeListener("error", onError);
+    socket.removeListener("close", onClose);
+  };
 }
-function hasOriginDecoration(value, parsed) {
-  const schemeEnd = value.indexOf("://");
-  const authority = schemeEnd < 0 ? "" : value.slice(schemeEnd + 3);
-  const suffixOffset = authority.search(/[\\/?#]/u);
-  const rawSuffix = suffixOffset < 0 ? "" : authority.slice(suffixOffset);
-  return parsed.username !== "" || parsed.password !== "" || parsed.pathname !== "/" || parsed.search !== "" || parsed.hash !== "" || rawSuffix !== "" && rawSuffix !== "/";
+function handshakeTimeout(timeoutMs) {
+  let timer;
+  const done = new Promise((_resolve, reject) => {
+    timer = setTimeout(() => reject(new RelayPipeHandshakeError("pipe_handshake_timeout", `Host Relay pipe handshake stalled past ${timeoutMs} ms; dropping the connection.`)), timeoutMs);
+    timer.unref?.();
+  });
+  return { done, clear: () => clearTimeout(timer) };
 }
-async function readHostRegistrationAuthority(path, expectedHostSourceRef) {
-  let handle;
+async function conductPipeServerHandshake(socket, key, timeoutMs = RELAY_PIPE_HANDSHAKE_TIMEOUT_MS) {
+  const bound = handshakeTimeout(timeoutMs);
+  const { waiter, feed, remainder } = readPipeFrames();
+  const detach = attachHandshakeReader(socket, waiter, feed);
   try {
-    await assertOwnerPrivateDirectory(dirname2(path));
-    handle = await open4(path, O_RDONLY3 | O_NOFOLLOW2);
-    const stats = await handle.stat();
-    if (!stats.isFile() || !ownerPrivate3(stats)) throw new HostRelayGatewayError("credential", "Host Relay credential file is not owner-private.");
-    const raw = await handle.readFile("utf8");
-    if (Buffer.byteLength(raw, "utf8") > HOST_REGISTRATION_STATE_MAX_BYTES) throw new HostRelayGatewayError("credential", `Host registration state is invalid: ${refusalFact("registration_state_bytes", Buffer.byteLength(raw, "utf8"), `at most ${HOST_REGISTRATION_STATE_MAX_BYTES}`)}.`);
-    let value;
-    try {
-      value = JSON.parse(raw);
-    } catch {
-      throw new HostRelayGatewayError("credential", "Host registration state is invalid.");
+    const hello = await Promise.race([waiter.wait(), bound.done]);
+    if (!isRecord2(hello.value) || hello.value.schema_version !== RELAY_PIPE_HELLO_SCHEMA || !validNonce(hello.value.client_nonce)) {
+      throw new RelayPipeHandshakeError("pipe_handshake_invalid", "Host Relay pipe client hello is invalid; dropping the connection without an answer.");
     }
-    return decodeHostRegistrationAuthority(value, expectedHostSourceRef);
-  } catch (error) {
-    if (error instanceof HostRelayGatewayError) throw error;
-    throw new HostRelayGatewayError("credential", "Host Relay credential file is unavailable.");
+    const clientNonce = hello.value.client_nonce;
+    const serverNonce = createPipeClientNonce();
+    const serverProof = createPipeServerProof(key, clientNonce, serverNonce);
+    await Promise.race([writePipeFrame(socket, encodePipeFrame({ schema_version: RELAY_PIPE_CHALLENGE_SCHEMA, server_nonce: serverNonce, server_proof: serverProof })), bound.done]);
+    const response2 = await Promise.race([waiter.wait(), bound.done]);
+    if (!isRecord2(response2.value) || response2.value.schema_version !== RELAY_PIPE_RESPONSE_SCHEMA || typeof response2.value.client_proof !== "string") {
+      throw new RelayPipeHandshakeError("pipe_handshake_invalid", "Host Relay pipe client proof is invalid; dropping the connection without an answer.");
+    }
+    const expected = createPipeClientProof(key, serverNonce, clientNonce);
+    if (!timingSafeEqualHex(expected, response2.value.client_proof)) {
+      throw new RelayPipeHandshakeError("pipe_handshake_invalid", "Host Relay pipe client proof failed; dropping the connection without an answer.");
+    }
+    return remainder();
   } finally {
-    await handle?.close();
+    bound.clear();
+    detach();
   }
 }
-function decodeHostRegistrationAuthority(value, expectedHostSourceRef) {
-  const keys = HOST_REGISTRATION_STATE_KEYS;
-  const fieldCount = isCealJsonRecord(value) ? Object.keys(value).length : 0;
-  const missing = isCealJsonRecord(value) ? keys.filter((key) => !Object.hasOwn(value, key)).length : keys.length;
-  if (!isCealJsonRecord(value) || fieldCount !== keys.length || missing !== 0) throw new HostRelayGatewayError("credential", `Host registration state is invalid or does not match this Relay: ${refusalFacts([{ name: "registration_field_count", value: fieldCount, expected: `exactly ${keys.length}` }, { name: "missing_registration_field_count", value: missing, expected: "0" }])}.`);
-  if (!validRegistrationIdentity(value, expectedHostSourceRef)) throw new HostRelayGatewayError("credential", `Host registration state is invalid or does not match this Relay: ${refusalFacts([{ name: "schema_version", value: value.schema_version, expected: "ceal.host_registration_state.v1" }, { name: "status", value: value.status, expected: "active" }, { name: "host_source_ref", value: value.host_source_ref, expected: expectedHostSourceRef }, { name: "registration_attempt_ref", value: value.registration_attempt_ref, expected: "host-registration-attempt:<uuid>" }, { name: "host_installation_ref", value: value.host_installation_ref, expected: "host-installation:<uuid>" }])}.`);
-  if (!validRegistrationCredential(value)) throw new HostRelayGatewayError("credential", `Host registration state is invalid or does not match this Relay: ${refusalFacts([{ name: "credential_generation", value: value.credential_generation, expected: "a positive safe integer" }, { name: "host_access_token_matches_registered_shape", value: validHostAccessToken(value.host_access_token), expected: "true" }])}.`);
-  if (!validGatewayOrigin(value.gateway_request_origin)) throw new HostRelayGatewayError("credential", `Host registration state is invalid or does not match this Relay: ${refusalFact("gateway_request_origin", value.gateway_request_origin, "an HTTPS origin or explicit-port loopback HTTP origin")}.`);
-  return { gateway_request_origin: value.gateway_request_origin, host_access_token: value.host_access_token };
+function timingSafeEqualHex(left, right) {
+  if (left.length !== right.length) return false;
+  let diff = 0;
+  for (let index = 0; index < left.length; index += 1) diff |= left.charCodeAt(index) ^ right.charCodeAt(index);
+  return diff === 0;
 }
-function validRegistrationIdentity(value, expectedHostSourceRef) {
-  return value.schema_version === HOST_REGISTRATION_STATE_SCHEMA && value.status === "active" && value.host_source_ref === expectedHostSourceRef && typeof value.registration_attempt_ref === "string" && CEAL_HOST_REGISTRATION_ATTEMPT_REF_PATTERN.test(value.registration_attempt_ref) && typeof value.host_installation_ref === "string" && CEAL_HOST_INSTALLATION_REF_PATTERN.test(value.host_installation_ref) && typeof value.host_source_ref === "string" && hostSourceUuid(value.host_source_ref) !== null;
-}
-function validRegistrationCredential(value) {
-  return Number.isSafeInteger(value.credential_generation) && Number(value.credential_generation) > 0 && validHostAccessToken(value.host_access_token);
-}
-function validHostAccessToken(value) {
-  return typeof value === "string" && CEAL_HOST_ACCESS_TOKEN_PATTERN.test(value);
-}
-function validGatewayOrigin(value) {
-  try {
-    if (typeof value !== "string") return false;
-    hostRelayGatewayEndpoint(value);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function assertOwnerPrivateDirectory(path) {
-  const stats = await lstat2(path);
-  if (!stats.isDirectory() || stats.isSymbolicLink() || !ownerPrivate3(stats)) throw new HostRelayGatewayError("credential", "Host Relay credential directory is not owner-private.");
-}
-function ownerPrivate3(stats) {
-  if (process.platform === "win32") return true;
-  const uid = typeof process.geteuid === "function" ? process.geteuid() : stats.uid;
-  return stats.uid === uid && (stats.mode & 63) === 0;
+function isRecord2(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function acknowledgement(value) {
-  const fields = isCealJsonRecord(value) ? value : {};
-  if (!isCealJsonRecord(value) || value.ok !== true || value.status !== "accepted" || typeof value.request_ref !== "string" || !SAFE_HOST_REF.test(value.request_ref) || !isHostGatewayAcknowledgementDisposition(value.disposition)) {
-    throw new HostRelayGatewayError("invalid_response", `Gateway Host ingress acknowledgement is invalid: ${refusalFacts([{ name: "ok", value: fields.ok, expected: "true" }, { name: "status", value: fields.status, expected: "accepted" }, { name: "request_ref", value: fields.request_ref, expected: "a safe Host reference" }, { name: "disposition", value: fields.disposition, expected: "a Gateway acknowledgement disposition" }])}.`);
-  }
-  return { request_ref: value.request_ref, disposition: value.disposition };
+function errorCode6(error) {
+  return typeof error === "object" && error !== null && "code" in error ? String(error.code) : null;
 }
 // host/relay/src/relay-ipc.ts
-import { chmod, lstat as lstat3, rename as rename2, unlink as unlink2 } from "node:fs/promises";
+import { chmod, lstat as lstat3, rename as rename2, unlink as unlink3 } from "node:fs/promises";
 import { createConnection, createServer } from "node:net";
-import { dirname as dirname3, join as join6 } from "node:path";
-// host/relay/src/current-prompt-custody.ts
-import { createHash as createHash5 } from "node:crypto";
-var HOST_CURRENT_PROMPT_MAX_BYTES = 256 * 1024;
-var MAX_CURRENT_PROMPTS = 1024;
-var HostCurrentPromptCustody = class {
-  #records = /* @__PURE__ */ new Map();
-  #consumed = /* @__PURE__ */ new Map();
-  #now;
-  constructor(now = Date.now) {
-    this.#now = now;
-  }
-  register(identity, prompt, expiresAt) {
-    const bytes2 = Buffer.byteLength(prompt, "utf8");
-    const expiry = Date.parse(expiresAt);
-    if (bytes2 === 0 || bytes2 > HOST_CURRENT_PROMPT_MAX_BYTES || !Number.isFinite(expiry) || expiry <= this.#now()) throw new TypeError("current_prompt_unavailable");
-    if (hostProducerPromptRef(createHash5("sha256").update(prompt, "utf8").digest("hex")) !== identity.prompt_ref) throw new TypeError("current_prompt_unavailable");
-    this.#purge();
-    const key = promptKey(identity);
-    if (this.#consumed.has(key)) return;
-    if (!this.#records.has(key) && this.#records.size + this.#consumed.size >= MAX_CURRENT_PROMPTS) throw new TypeError("current_prompt_unavailable");
-    this.#records.set(key, { prompt, expires_at_ms: expiry });
-  }
-  /** Transfer this turn's prompt into at most one authenticated invocation. */
-  take(identity) {
-    this.#purge();
-    const key = promptKey(identity);
-    const prompt = this.#records.get(key)?.prompt;
-    if (prompt !== void 0) {
-      const expiresAt = this.#records.get(key)?.expires_at_ms;
-      this.#records.delete(key);
-      if (expiresAt !== void 0) this.#consumed.set(key, expiresAt);
-    }
-    return prompt;
-  }
-  #purge() {
-    const now = this.#now();
-    for (const [key, value] of this.#records) if (value.expires_at_ms <= now) this.#records.delete(key);
-    for (const [key, expiresAt] of this.#consumed) if (expiresAt <= now) this.#consumed.delete(key);
-  }
-};
-function promptKey(value) {
-  return [value.producer_id, value.producer_installation_ref, value.local_session_ref, value.local_turn_ref, value.prompt_ref].join("\0");
-}
-// host/relay/src/relay-ipc.ts
-var HOST_RELAY_REQUEST_BINDING_KEYS = Object.freeze([
-  "schema_version",
-  "producer_id",
-  "producer_installation_ref",
-  "local_session_ref",
-  "local_turn_ref",
-  "local_turn_aliases",
-  "prompt_ref",
-  "request_ref",
-  "bound_at",
-  "host_source_ref",
-  "host_session_ref",
-  "host_turn_ref",
-  "host_input_ref"
-]);
+import { dirname as dirname5, join as join5 } from "node:path";
 var HOST_RELAY_IPC_RESPONSE_SCHEMA = "ceal.host_relay_admission.v1";
-var HOST_RELAY_BINDING_QUERY_SCHEMA = "ceal.host_relay_binding_query.v1";
-var HOST_RELAY_BINDING_RESULT_SCHEMA = "ceal.host_relay_binding_result.v1";
-var HOST_RELAY_INVOCATION_CONTEXT_QUERY_SCHEMA = "ceal.host_relay_invocation_context_query.v1";
-var HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA = "ceal.host_relay_invocation_context_result.v1";
-var HOST_RELAY_CURRENT_PROMPT_REGISTER_SCHEMA = "ceal.host_relay_current_prompt_register.v1";
-var HOST_RELAY_CURRENT_PROMPT_RESULT_SCHEMA = "ceal.host_relay_current_prompt_result.v1";
+var HOST_RELAY_INVOCATION_CONTEXT_QUERY_SCHEMA = "ceal.host_relay_invocation_context_query.v2";
+var HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA = "ceal.host_relay_invocation_context_result.v2";
 var HOST_RELAY_IPC_LENGTH_BYTES = Uint32Array.BYTES_PER_ELEMENT;
-var HOST_RELAY_INVOCATION_MINT_REFUSAL_REASONS = vocabulary([
-  "context_stale",
-  "context_expired",
-  "host_source_refused",
-  "host_credential_refused",
-  "gateway_unavailable",
-  "gateway_refused",
-  "gateway_response_invalid",
-  "gateway_rate_limited",
-  "producer_frame_invalid",
-  "deadline",
-  "cancelled",
-  "mint_failed",
-  "relay_failed",
-  "request_authority_unavailable",
-  "request_missing",
-  "authority_mismatch",
-  "host_source_mismatch",
-  "host_session_mismatch",
-  "host_turn_mismatch",
-  "host_input_mismatch",
-  "host_prompt_mismatch"
-]);
-var HOST_RELAY_DIRECT_WIRE_MINT_REASONS = vocabulary([
-  "context_stale",
-  "context_expired",
-  "host_source_refused",
-  "host_credential_refused",
-  "gateway_unavailable",
-  "gateway_rate_limited",
-  "gateway_refused",
-  "gateway_response_invalid",
-  "producer_frame_invalid"
-]);
-var HostRelayInvocationMintRefusal = class extends Error {
-  reason;
-  constructor(reason) {
-    super(reason);
-    this.name = "HostRelayInvocationMintRefusal";
-    this.reason = reason;
-  }
-};
-var HOST_RELAY_INVOCATION_MINT_OUTCOMES = vocabulary(["completed", "caller_cancelled", "deadline", "failed", "no_binding"]);
 var HOST_RELAY_EXCHANGE_FAILURES = vocabulary([
   "permission_denied",
   "socket_missing",
@@ -3631,26 +3458,14 @@ var HostRelayIpcError = class extends Error {
 };
 async function startHostRelayIpcServer(options) {
   return withRelayEndpointLock(options.endpoint, async () => {
-    if (process.platform === "win32") {
-      await assertEndpointVacant(options.endpoint);
-    } else {
-      await assertTrustedEndpointParent(options.endpoint);
-      await removeStaleRelayEndpoint(options.endpoint, options.testHooks);
-    }
+    const lastSeenRequestBySession = /* @__PURE__ */ new Map();
+    if (process.platform === "win32") return startWindowsPipeServer(options, lastSeenRequestBySession);
+    await assertTrustedEndpointParent(options.endpoint);
+    await removeStaleRelayEndpoint(options.endpoint, options.testHooks);
     const active = /* @__PURE__ */ new Map();
     const sockets = /* @__PURE__ */ new Set();
     const quarantine = options.quarantine ?? options.admission.quarantine;
-    const currentPrompts = options.currentPrompts ?? new HostCurrentPromptCustody();
-    const server = createServer((socket) => serveSocket(socket, options, currentPrompts, quarantine, active, sockets));
-    if (process.platform === "win32") {
-      try {
-        await listen(server, options.endpoint);
-      } catch (error) {
-        await abandonRelayServer(server, sockets);
-        throw error;
-      }
-      return { endpoint: options.endpoint, close: () => closeServer(server, sockets, options.endpoint) };
-    }
+    const server = createServer((socket) => serveSocket(socket, options, quarantine, active, sockets, Buffer.alloc(0), lastSeenRequestBySession));
     const staging = stagingRelayEndpoint(options.endpoint);
     await listenStagingRelayEndpoint(server, sockets, staging);
     let owned;
@@ -3674,39 +3489,105 @@ function encodeHostRelayIpcResponse(response2) {
   body.copy(result2, HOST_RELAY_IPC_LENGTH_BYTES);
   return result2;
 }
-function serveSocket(socket, options, currentPrompts, quarantine, active, sockets) {
-  const state = { buffer: Buffer.alloc(0), closed: false, tail: Promise.resolve(), abort: new AbortController() };
-  sockets.add(socket);
-  socket.on("data", (chunk) => {
-    state.buffer = Buffer.concat([state.buffer, Buffer.from(chunk)]);
-    state.tail = state.tail.then(() => drainFrames(socket, state, options, currentPrompts, quarantine, active)).catch(() => {
-      writeResponse(socket, errorResponse("relay_unavailable"));
-      socket.end();
+async function startWindowsPipeServer(options, lastSeenRequestBySession) {
+  if (options.pipeKey === void 0) throw new HostRelayIpcError("relay_unavailable", "Host Relay pipe key is unavailable; refusing to serve Windows pipe clients it cannot admit.");
+  const active = /* @__PURE__ */ new Map();
+  const sockets = /* @__PURE__ */ new Set();
+  const quarantine = options.quarantine ?? options.admission.quarantine;
+  const pipeKey = options.pipeKey;
+  const server = createServer((socket) => {
+    void admitWindowsPipeSocket(socket, options, quarantine, active, sockets, pipeKey, lastSeenRequestBySession);
+  });
+  try {
+    await listen(server, options.endpoint);
+  } catch (error) {
+    await abandonRelayServer(server, sockets);
+    throw await resolveWindowsPipeListenOutcome(options.endpoint, error);
+  }
+  return { endpoint: options.endpoint, close: () => closeServer(server, sockets, options.endpoint) };
+}
+async function admitWindowsPipeSocket(socket, options, quarantine, active, sockets, pipeKey, lastSeenRequestBySession) {
+  let leftover;
+  try {
+    leftover = await conductPipeServerHandshake(socket, pipeKey, RELAY_PIPE_HANDSHAKE_TIMEOUT_MS);
+  } catch {
+    socket.destroy();
+    return;
+  }
+  if (socket.destroyed) return;
+  serveSocket(socket, options, quarantine, active, sockets, leftover, lastSeenRequestBySession);
+}
+var HostRelayAlreadyRunningError = class extends Error {
+  constructor(endpoint) {
+    super(`another Host Relay already serves ${endpoint}; this instance exits without opening a second pipe.`);
+    this.name = "HostRelayAlreadyRunningError";
+  }
+};
+async function resolveWindowsPipeListenOutcome(endpoint, error, probe = windowsPipeHolderIsLive) {
+  if (pipeNameHeldError(error) && await probe(endpoint)) return new HostRelayAlreadyRunningError(endpoint);
+  return mapWindowsPipeListenError(endpoint, error);
+}
+function pipeNameHeldError(error) {
+  const code = errorCode7(error);
+  return code === "EADDRINUSE" || code === "EACCES";
+}
+function windowsPipeHolderIsLive(endpoint) {
+  return new Promise((resolve) => {
+    const timer = setTimeout(() => {
+      probe.destroy();
+      resolve(false);
+    }, RELAY_PIPE_HANDSHAKE_TIMEOUT_MS);
+    const probe = createConnection(endpoint);
+    probe.once("connect", () => {
+      clearTimeout(timer);
+      probe.destroy();
+      resolve(true);
+    });
+    probe.once("error", () => {
+      clearTimeout(timer);
+      probe.destroy();
+      resolve(false);
     });
   });
+}
+function mapWindowsPipeListenError(endpoint, error) {
+  const code = errorCode7(error);
+  if (pipeNameHeldError(error)) {
+    return new HostRelayIpcError("relay_unavailable", `relay pipe name held by another process: the Host Relay pipe name ${endpoint} is already served (error ${code}); stop the process holding it, then restart the Host Relay.`);
+  }
+  return error instanceof Error ? error : new HostRelayIpcError("relay_unavailable", "Host Relay IPC endpoint is unavailable.");
+}
+function serveSocket(socket, options, quarantine, active, sockets, initial = Buffer.alloc(0), lastSeenRequestBySession = /* @__PURE__ */ new Map()) {
+  const state = { buffer: initial, closed: false, tail: Promise.resolve(), abort: new AbortController(), last_seen_request_by_session: lastSeenRequestBySession };
+  sockets.add(socket);
+  socket.on("data", (chunk) => receiveRelaySocketBytes(socket, state, options, quarantine, active, Buffer.from(chunk)));
   socket.once("error", () => closeConnection(socket, state, active, sockets));
   socket.once("close", () => closeConnection(socket, state, active, sockets));
   socket.once("end", () => {
-    if (state.buffer.length > 0 && currentPromptWire(state.buffer)) {
-      writeCurrentPromptResponse(socket, "current_prompt_unavailable");
-      socket.end();
-    } else if (state.buffer.length > 0) void quarantine.retainMalformed(state.buffer, "frame_truncated").finally(() => {
+    if (state.buffer.length > 0) void quarantine.retainMalformed(state.buffer, "frame_truncated").finally(() => {
       writeResponse(socket, errorResponse("frame_truncated"));
       socket.end();
     });
     else socket.end();
   });
+  if (initial.length > 0) receiveRelaySocketBytes(socket, state, options, quarantine, active, Buffer.alloc(0));
 }
-async function drainFrames(socket, state, options, currentPrompts, quarantine, active) {
-  while (!state.closed && state.buffer.length >= HOST_RELAY_IPC_LENGTH_BYTES && await processBufferedRequest(socket, state, options, currentPrompts, quarantine, active)) {
+function receiveRelaySocketBytes(socket, state, options, quarantine, active, chunk) {
+  state.buffer = Buffer.concat([state.buffer, chunk]);
+  state.tail = state.tail.then(() => drainFrames(socket, state, options, quarantine, active)).catch(() => {
+    writeResponse(socket, errorResponse("relay_unavailable"));
+    socket.end();
+  });
+}
+async function drainFrames(socket, state, options, quarantine, active) {
+  while (!state.closed && state.buffer.length >= HOST_RELAY_IPC_LENGTH_BYTES && await processBufferedRequest(socket, state, options, quarantine, active)) {
   }
 }
-async function processBufferedRequest(socket, state, options, currentPrompts, quarantine, active) {
+async function processBufferedRequest(socket, state, options, quarantine, active) {
   const length = state.buffer.readUInt32BE(0);
-  const promptWire = currentPromptWire(state.buffer);
-  const maximum = promptWire ? HOST_CURRENT_PROMPT_MAX_BYTES + 4096 : HOST_PRODUCER_MAX_JSON_BYTES;
+  const maximum = HOST_PRODUCER_MAX_JSON_BYTES;
   if (length === 0 || length > maximum) {
-    await refuseInvalidBufferedRequest(socket, state.buffer, length, promptWire, quarantine);
+    await refuseInvalidBufferedRequest(socket, state.buffer, length, quarantine);
     state.buffer = Buffer.alloc(0);
     socket.end();
     return false;
@@ -3718,41 +3599,20 @@ async function processBufferedRequest(socket, state, options, currentPrompts, qu
   try {
     request2 = decodeIpcRequest(encoded);
   } catch (error) {
-    await refuseMalformedRequest(socket, encoded, promptWire, error, quarantine);
-    return true;
-  }
-  if (request2.schema_version === HOST_RELAY_CURRENT_PROMPT_REGISTER_SCHEMA) {
-    try {
-      currentPrompts.register(request2, request2.current_prompt, request2.context_expires_at);
-      writeCurrentPromptResponse(socket, "registered");
-    } catch {
-      writeCurrentPromptResponse(socket, "current_prompt_unavailable");
-    }
+    await refuseMalformedRequest(socket, encoded, error, quarantine);
     return true;
   }
-  const answered = await processHostQuery(socket, request2, options, currentPrompts, state.abort.signal);
-  if (answered === "closed") {
-    socket.end();
-    return false;
-  }
+  const answered = await processHostQuery(socket, state, options, request2);
   if (answered === "answered") return true;
   await processProducerRequest(socket, state, request2, encoded, options.admission, quarantine, active);
   return true;
 }
-async function refuseInvalidBufferedRequest(socket, rawBuffer, length, promptWire, quarantine) {
-  if (promptWire) {
-    writeCurrentPromptResponse(socket, "current_prompt_unavailable");
-    return;
-  }
+async function refuseInvalidBufferedRequest(socket, rawBuffer, length, quarantine) {
   const code = length === 0 ? "invalid_frame_length" : "frame_too_large";
   await quarantine.retainMalformed(rawBuffer.subarray(0, Math.min(rawBuffer.length, length + HOST_RELAY_IPC_LENGTH_BYTES)), code);
   writeResponse(socket, errorResponse(code));
 }
-async function refuseMalformedRequest(socket, encoded, promptWire, error, quarantine) {
-  if (promptWire) {
-    writeCurrentPromptResponse(socket, "current_prompt_unavailable");
-    return;
-  }
+async function refuseMalformedRequest(socket, encoded, error, quarantine) {
   const code = error instanceof HostProducerFrameError ? error.code : "invalid_frame_shape";
   await quarantine.retainMalformed(encoded, code);
   writeResponse(socket, errorResponse(code));
@@ -3768,29 +3628,19 @@ async function processProducerRequest(socket, state, request2, encoded, admissio
   }
   writeResponse(socket, admissionResponse(await admission.admit(request2)));
 }
-async function processHostQuery(socket, request2, options, currentPrompts, signal) {
-  if (request2.schema_version === HOST_RELAY_BINDING_QUERY_SCHEMA) {
-    let result2;
-    try {
-      result2 = await options.bindings.query(bindingQueryFromRequest(request2));
-    } catch {
-      return "closed";
-    }
-    writeBindingResponse(socket, result2);
-    return "answered";
-  }
-  if (request2.schema_version === HOST_RELAY_INVOCATION_CONTEXT_QUERY_SCHEMA) {
-    let response2;
-    const resolve = (invocationSignal) => resolveInvocationContext(request2, options.admission, options.bindings, currentPrompts, options.mintInvocationContext, invocationSignal);
-    try {
-      response2 = options.invocationMintTimeoutMs === void 0 && options.scheduleInvocationMintDeadline === void 0 && options.observeInvocationMint === void 0 ? await resolve(signal) : await observeInvocationMint(resolve, signal, options.invocationMintTimeoutMs, options.scheduleInvocationMintDeadline, options.observeInvocationMint);
-    } catch {
-      response2 = { schema_version: HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA, status: "refused", reason: "relay_failed" };
-    }
-    writeInvocationContextResponse(socket, response2);
-    return "answered";
+async function processHostQuery(socket, state, options, request2) {
+  if (request2.schema_version !== HOST_RELAY_INVOCATION_CONTEXT_QUERY_SCHEMA) return "not_a_query";
+  const sessionKey = `${request2.host_binding.host_source_ref}\0${request2.host_binding.host_session_ref}`;
+  const lastSeen = state.last_seen_request_by_session.get(sessionKey);
+  let response2;
+  try {
+    response2 = options.mintInvocationContext === void 0 ? { schema_version: HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA, status: "refused", reason: "gateway_unavailable" } : await options.mintInvocationContext({ ...request2, ...lastSeen === void 0 ? {} : { last_seen_request_ref: lastSeen } }, state.abort.signal);
+  } catch {
+    response2 = { schema_version: HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA, status: "refused", reason: "gateway_unavailable" };
   }
-  return "not_a_query";
+  if (response2.status === "ready") state.last_seen_request_by_session.set(sessionKey, response2.request_ref);
+  writeInvocationContextResponse(socket, response2);
+  return "answered";
 }
 function claimProducer(socket, state, frame, active) {
   const key = producerKey(frame);
@@ -3814,154 +3664,9 @@ function closeConnection(socket, state, active, sockets) {
 function writeResponse(socket, response2) {
   if (!socket.destroyed) socket.write(encodeHostRelayIpcResponse(response2));
 }
-function writeBindingResponse(socket, result2) {
-  const response2 = { schema_version: HOST_RELAY_BINDING_RESULT_SCHEMA, ...result2 };
-  if (!socket.destroyed) socket.write(encodeLengthPrefixed(response2));
-}
 function writeInvocationContextResponse(socket, response2) {
   if (!socket.destroyed) socket.write(encodeLengthPrefixed(response2));
 }
-function writeCurrentPromptResponse(socket, status) {
-  if (!socket.destroyed) socket.write(encodeLengthPrefixed({ schema_version: HOST_RELAY_CURRENT_PROMPT_RESULT_SCHEMA, status }));
-}
-async function resolveInvocationContext(request2, admission, bindings, currentPrompts, mint, signal) {
-  if (mint === void 0) throw new HostRelayIpcError("relay_unavailable");
-  const query = bindingQueryFromRequest(request2);
-  const expectedSequences = pendingAdmissionSequences(await admission.snapshot(), query);
-  const binding = await waitForRequestBinding(query, admission, bindings, signal);
-  if (binding.status !== "ready") return await unboundInvocationContextRefusal(admission, await admission.snapshot(), query, expectedSequences) ?? { schema_version: HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA, status: "no_binding" };
-  const currentPrompt = currentPrompts.take({ producer_id: request2.producer_id, producer_installation_ref: request2.producer_installation_ref, local_session_ref: request2.local_session_ref, local_turn_ref: request2.local_turn_ref, prompt_ref: binding.binding.prompt_ref });
-  let result2;
-  try {
-    result2 = await mint({ client_nonce: request2.client_nonce, context_expires_at: binding.binding.context_expires_at ?? binding.binding.bound_at, request_work_context: relayRequestWorkContextFromBinding(binding.binding), ...currentPrompt === void 0 ? {} : { current_prompt: currentPrompt }, ...request2.visible_output_max_bytes === void 0 ? {} : { visible_output_max_bytes: request2.visible_output_max_bytes } }, signal);
-  } catch (error) {
-    return { schema_version: HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA, status: "refused", reason: error instanceof HostRelayInvocationMintRefusal ? error.reason : "mint_failed" };
-  }
-  return { schema_version: HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA, status: "ready", result: result2 };
-}
-async function unboundInvocationContextRefusal(admission, snapshot, query, expectedSequences) {
-  if (expectedSequences.length > 0) {
-    const refusal = snapshot.installations[`${query.producer_id}\0${query.producer_installation_ref}`]?.last_refusal;
-    if (refusal !== void 0 && expectedSequences.includes(refusal.sequence)) {
-      const reason2 = mintReasonForDeliveryRefusal(refusal.code, refusal.diagnostic);
-      if (reason2 !== void 0) return { schema_version: HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA, status: "refused", reason: reason2 };
-    }
-  }
-  const selector = Object.freeze({
-    producer_id: query.producer_id,
-    producer_installation_ref: query.producer_installation_ref,
-    local_session_ref: query.local_session_ref,
-    local_turn_ref: query.local_turn_ref,
-    local_turn_aliases: Object.freeze([])
-  });
-  const match = await admission.quarantine.findNewestAttributedMatch(selector);
-  if (match === null) return null;
-  const reason = mintReasonForQuarantinedMatch(match);
-  if (reason === void 0) return null;
-  return { schema_version: HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA, status: "refused", reason };
-}
-function mintReasonForDeliveryRefusal(code, diagnostic) {
-  if (code !== "gateway_refused") return void 0;
-  if (diagnostic === void 0) return "gateway_refused";
-  return mintReasonForWireCause(projectCealHostAuthenticationCause(diagnostic));
-}
-function mintReasonForQuarantinedMatch(match) {
-  if (match === null) return void 0;
-  if (match.reason !== "gateway_refused") return "producer_frame_invalid";
-  const diagnostic = match.attribution?.diagnostic;
-  if (diagnostic === void 0) return void 0;
-  return mintReasonForWireCause(projectCealHostAuthenticationCause(diagnostic));
-}
-function mintReasonForWireCause(cause) {
-  if (isDirectWireCause(cause)) return cause;
-  if (cause === "relay_failed" || cause === "relay_unavailable" || cause === "options_invalid") return "relay_failed";
-  return "mint_failed";
-}
-function isDirectWireCause(cause) {
-  return isVocabularyWord(HOST_RELAY_DIRECT_WIRE_MINT_REASONS, cause);
-}
-function pendingAdmissionSequences(snapshot, query) {
-  const sequences = [];
-  for (const entry2 of snapshot.entries) {
-    const selector = extractHostBindingSelector(entry2.frame);
-    if (selector === null || !relayRequestBindingMatchesQuery(query, selector)) continue;
-    sequences.push(entry2.sequence);
-  }
-  return sequences;
-}
-async function waitForRequestBinding(query, admission, bindings, signal) {
-  let binding = await bindings.query(query);
-  if (binding.status === "ready") return binding;
-  while (await admission.hasPendingRequestBinding(query)) {
-    const cycle = new AbortController();
-    const cancelCycle = () => cycle.abort(signal.reason);
-    if (signal.aborted) cancelCycle();
-    else signal.addEventListener("abort", cancelCycle, { once: true });
-    try {
-      const changed = Promise.race([
-        bindings.waitForBinding(query, cycle.signal).then((result3) => ({ kind: "bound", result: result3 })),
-        admission.waitForDrainChange(cycle.signal).then(() => ({ kind: "drained" }))
-      ]).then((result3) => result3, (error) => ({ kind: "cancelled", error }));
-      binding = await bindings.query(query);
-      if (binding.status === "ready") return binding;
-      if (!await admission.hasPendingRequestBinding(query)) return await bindings.query(query);
-      const result2 = await changed;
-      if (result2.kind === "cancelled") throw result2.error;
-    } finally {
-      signal.removeEventListener("abort", cancelCycle);
-      cycle.abort("wait_cycle_complete");
-    }
-    binding = await bindings.query(query);
-    if (binding.status === "ready") return binding;
-  }
-  return await bindings.query(query);
-}
-async function observeInvocationMint(resolve, callerSignal, timeoutMs, scheduleDeadline, observe) {
-  const started = process.hrtime.bigint();
-  const controller2 = new AbortController();
-  let cancellation = null;
-  let outcome = "failed";
-  let reason;
-  const cancel = (cause) => {
-    if (cancellation === null) {
-      cancellation = cause;
-      controller2.abort(cause);
-    }
-  };
-  const callerCancelled = () => cancel("caller_cancelled");
-  const cancelled = new Promise((_resolve, reject) => controller2.signal.addEventListener("abort", () => reject(new Error("invocation mint cancelled")), { once: true }));
-  const clearDeadline = timeoutMs === void 0 ? () => void 0 : (scheduleDeadline ?? scheduleInvocationMintDeadline)(() => cancel("deadline"), timeoutMs);
-  if (callerSignal.aborted) callerCancelled();
-  else callerSignal.addEventListener("abort", callerCancelled, { once: true });
-  try {
-    const response2 = await Promise.race([resolve(controller2.signal), cancelled]);
-    ({ outcome, reason } = invocationMintObservationForResponse(response2));
-    return response2;
-  } catch {
-    ({ outcome, reason } = invocationMintObservationForCancellation(cancellation));
-    return { schema_version: HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA, status: "refused", reason: reason ?? "relay_failed" };
-  } finally {
-    clearDeadline();
-    callerSignal.removeEventListener("abort", callerCancelled);
-    observe?.({ outcome, elapsed_ms: Number((process.hrtime.bigint() - started) / 1000000n), ...reason === void 0 ? {} : { reason } });
-  }
-}
-function invocationMintObservationForResponse(response2) {
-  if (response2.status === "no_binding") return { outcome: "no_binding" };
-  if (response2.status === "ready") return { outcome: "completed" };
-  if (response2.reason === "deadline") return { outcome: "deadline", reason: "deadline" };
-  if (response2.reason === "cancelled") return { outcome: "caller_cancelled", reason: "cancelled" };
-  return { outcome: "failed", reason: response2.reason };
-}
-function invocationMintObservationForCancellation(cancellation) {
-  if (cancellation === "deadline") return { outcome: "deadline", reason: "deadline" };
-  if (cancellation === "caller_cancelled") return { outcome: "caller_cancelled", reason: "cancelled" };
-  return { outcome: "failed", reason: "relay_failed" };
-}
-function scheduleInvocationMintDeadline(expire, milliseconds) {
-  const timeout = setTimeout(expire, milliseconds);
-  return () => clearTimeout(timeout);
-}
 function admissionResponse(result2) {
   return { schema_version: HOST_RELAY_IPC_RESPONSE_SCHEMA, ...result2 };
 }
@@ -3971,45 +3676,45 @@ function errorResponse(code) {
 function producerKey(frame) {
   return `${frame.producer_id}\0${frame.producer_installation_ref}`;
 }
-function record4(value) {
+function record3(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function decodeIpcRequest(input) {
-  const value = decodeLengthPrefixedJson(input, Math.max(HOST_PRODUCER_MAX_JSON_BYTES, HOST_CURRENT_PROMPT_MAX_BYTES + 4096));
+  const value = decodeLengthPrefixedJson(input, HOST_PRODUCER_MAX_JSON_BYTES);
   const local = decodeLocalRequest(value);
   if (local !== void 0) return local;
   return decodeHostProducerFrame(input);
 }
 function decodeLocalRequest(value) {
-  if (!record4(value)) return void 0;
-  if (value.schema_version === HOST_RELAY_CURRENT_PROMPT_REGISTER_SCHEMA) {
-    if (!validCurrentPromptRegisterRequest(value)) throw new HostProducerFrameError("invalid_frame_shape");
-    return value;
-  }
-  if (value.schema_version === HOST_RELAY_BINDING_QUERY_SCHEMA) {
-    if (!validBindingQueryRequest(value)) throw new HostProducerFrameError("invalid_frame_shape");
-    return value;
-  }
+  if (!record3(value)) return void 0;
   if (value.schema_version === HOST_RELAY_INVOCATION_CONTEXT_QUERY_SCHEMA) {
     if (!validInvocationContextQueryRequest(value)) throw new HostProducerFrameError("invalid_frame_shape");
     return value;
   }
   return void 0;
 }
-function validCurrentPromptRegisterRequest(value) {
-  return validQueryIdentity(value, HOST_RELAY_CURRENT_PROMPT_REGISTER_SCHEMA) && exactKeys4(value, ["schema_version", "producer_id", "producer_installation_ref", "local_session_ref", "local_turn_ref", "prompt_ref", "current_prompt", "context_expires_at"]) && safeRef3(value.prompt_ref) && typeof value.current_prompt === "string" && Buffer.byteLength(value.current_prompt, "utf8") > 0 && Buffer.byteLength(value.current_prompt, "utf8") <= HOST_CURRENT_PROMPT_MAX_BYTES && validTimestamp2(value.context_expires_at);
-}
-function validBindingQueryRequest(value) {
-  return validQueryIdentity(value, HOST_RELAY_BINDING_QUERY_SCHEMA) && exactKeys4(value, ["schema_version", "producer_id", "producer_installation_ref", "local_session_ref", "local_turn_ref"]);
-}
-function bindingQueryFromRequest(value) {
-  return { producer_id: value.producer_id, producer_installation_ref: value.producer_installation_ref, local_session_ref: value.local_session_ref, local_turn_ref: value.local_turn_ref };
-}
 function validInvocationContextQueryRequest(value) {
-  return validQueryIdentity(value, HOST_RELAY_INVOCATION_CONTEXT_QUERY_SCHEMA) && exactKeys4(value, ["schema_version", "producer_id", "producer_installation_ref", "local_session_ref", "local_turn_ref", "client_nonce"], ["visible_output_max_bytes"]) && typeof value.client_nonce === "string" && CEAL_HOST_CLIENT_NONCE_PATTERN.test(value.client_nonce) && (value.visible_output_max_bytes === void 0 || validVisibleOutputBudget(value.visible_output_max_bytes));
+  if (!validQueryEnvelope(value)) return false;
+  try {
+    decodeCealHostInvocationContextRequest({
+      schema_version: CEAL_HOST_INVOCATION_CONTEXT_REQUEST_SCHEMA,
+      client_nonce: value.client_nonce,
+      context_expires_at: value.context_expires_at,
+      host_binding: value.host_binding,
+      human_message_window: value.human_message_window,
+      ...value.visible_output_max_bytes === void 0 ? {} : { visible_output_max_bytes: value.visible_output_max_bytes }
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function validQueryEnvelope(value) {
+  if (!validQueryIdentity(value, HOST_RELAY_INVOCATION_CONTEXT_QUERY_SCHEMA) || !exactKeys3(value, ["schema_version", "producer_id", "producer_installation_ref", "client_nonce", "context_expires_at", "host_binding", "human_message_window"], ["visible_output_max_bytes"])) return false;
+  return typeof value.client_nonce === "string" && CEAL_HOST_CLIENT_NONCE_PATTERN.test(value.client_nonce) && typeof value.context_expires_at === "string" && (value.visible_output_max_bytes === void 0 || validVisibleOutputBudget(value.visible_output_max_bytes));
 }
 function validQueryIdentity(value, schema) {
-  return record4(value) && value.schema_version === schema && (value.producer_id === "codex" || value.producer_id === "claude") && safeRef3(value.producer_installation_ref) && safeRef3(value.local_session_ref) && safeRef3(value.local_turn_ref);
+  return record3(value) && value.schema_version === schema && (value.producer_id === "codex" || value.producer_id === "claude") && safeRef2(value.producer_installation_ref);
 }
 function validVisibleOutputBudget(value) {
   return typeof value === "number" && Number.isSafeInteger(value) && value > 0 && value <= CEAL_CANONICAL_HTTP_MAX_RESPONSE_BYTES;
@@ -4033,27 +3738,13 @@ function encodeLengthPrefixed(value) {
   body.copy(output, HOST_RELAY_IPC_LENGTH_BYTES);
   return output;
 }
-function currentPromptWire(value) {
-  return value.subarray(HOST_RELAY_IPC_LENGTH_BYTES, Math.min(value.length, HOST_RELAY_IPC_LENGTH_BYTES + 128)).includes(Buffer.from(`"schema_version":"${HOST_RELAY_CURRENT_PROMPT_REGISTER_SCHEMA}"`, "utf8"));
-}
-function exactKeys4(value, required, optional = []) {
+function exactKeys3(value, required, optional = []) {
   const keys = Object.keys(value);
   return required.every((key) => Object.hasOwn(value, key)) && keys.every((key) => required.includes(key) || optional.includes(key));
 }
-function safeRef3(value) {
+function safeRef2(value) {
   return typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u.test(value);
 }
-function validTimestamp2(value) {
-  return typeof value === "string" && Number.isFinite(Date.parse(value));
-}
-async function assertEndpointVacant(endpoint) {
-  try {
-    await lstat3(endpoint);
-    throw new HostRelayIpcError("relay_unavailable", "Host Relay IPC endpoint is already present.");
-  } catch (error) {
-    if (errorCode8(error) !== "ENOENT") throw error;
-  }
-}
 function listen(server, endpoint) {
   return new Promise((resolve, reject) => {
     server.once("error", reject);
@@ -4066,7 +3757,7 @@ function listen(server, endpoint) {
 async function closeServer(server, sockets, endpoint) {
   for (const socket of sockets) socket.destroy();
   await new Promise((resolve) => server.close(() => resolve()));
-  if (process.platform !== "win32") await unlink2(endpoint).catch(() => void 0);
+  if (process.platform !== "win32") await unlink3(endpoint).catch(() => void 0);
 }
 var relayEndpointLocks = /* @__PURE__ */ new Map();
 function withRelayEndpointLock(endpoint, run) {
@@ -4086,7 +3777,7 @@ function currentUid(fallback) {
   return typeof process.geteuid === "function" ? process.geteuid() : fallback;
 }
 async function assertTrustedEndpointParent(endpoint) {
-  const parent = dirname3(endpoint);
+  const parent = dirname5(endpoint);
   let stats;
   try {
     stats = await lstat3(parent);
@@ -4111,7 +3802,7 @@ function probeRelayEndpoint(endpoint) {
     timer.unref?.();
     socket.once("connect", () => finish("live"));
     socket.once("error", (error) => {
-      const code = errorCode8(error);
+      const code = errorCode7(error);
       if (code === "ECONNREFUSED") finish("stale");
       else if (code === "ENOENT") finish("missing");
       else finish("ambiguous");
@@ -4146,7 +3837,7 @@ async function readEndpointStats(endpoint) {
   try {
     return await lstat3(endpoint);
   } catch (error) {
-    if (errorCode8(error) === "ENOENT") return null;
+    if (errorCode7(error) === "ENOENT") return null;
     throw new HostRelayIpcError("relay_unavailable", "Host Relay IPC endpoint identity is ambiguous; leaving it untouched.");
   }
 }
@@ -4155,17 +3846,17 @@ function requireSameEndpointIdentity(current, owned, message) {
 }
 async function unlinkRelayEndpoint(endpoint) {
   try {
-    await unlink2(endpoint);
+    await unlink3(endpoint);
   } catch (error) {
-    if (errorCode8(error) !== "ENOENT") throw error;
+    if (errorCode7(error) !== "ENOENT") throw error;
   }
 }
 var relayStagingSequence = 0;
 function stagingRelayEndpoint(canonical) {
-  const parent = dirname3(canonical);
+  const parent = dirname5(canonical);
   const pid = process.pid.toString(36);
   const sequence = (relayStagingSequence++ % (36 * 36)).toString(36);
-  return join6(parent, `.r${pid}${sequence}`);
+  return join5(parent, `.r${pid}${sequence}`);
 }
 async function readStagingRelayEndpointIdentity(staging) {
   let created;
@@ -4222,8 +3913,121 @@ async function abandonRelayServer(server, sockets) {
     server.close(() => resolve());
   });
 }
-function errorCode8(error) {
-  return record4(error) && typeof error.code === "string" ? error.code : null;
+function errorCode7(error) {
+  return record3(error) && typeof error.code === "string" ? error.code : null;
+}
+// host/relay/src/host-registration-state.ts
+import { constants as constants3 } from "node:fs";
+import { dirname as dirname6 } from "node:path";
+var HOST_REGISTRATION_STATE_SCHEMA = "ceal.host_registration_state.v1";
+var HOST_REGISTRATION_STATE_KEYS = Object.freeze([
+  "credential_generation",
+  "gateway_request_origin",
+  "host_access_token",
+  "host_installation_ref",
+  "host_source_ref",
+  "registration_attempt_ref",
+  "schema_version",
+  "status"
+]);
+var HOST_REGISTRATION_STATE_MAX_BYTES = 65536;
+var HostRegistrationStateError = class extends Error {
+  name = "HostRegistrationStateError";
+  code = "credential";
+};
+async function readHostRegistrationAuthority(path, expectedHostSourceRef, platform = process.platform, custody = {}) {
+  let raw;
+  try {
+    await assertPrivateRegistrationDirectory(dirname6(path), platform, custody);
+    raw = platform === "win32" ? await readWindowsRegistration(path, custody) : await readPosixRegistration(path, platform, custody);
+  } catch (error) {
+    throw registrationReadError(error);
+  }
+  if (Buffer.byteLength(raw, "utf8") > HOST_REGISTRATION_STATE_MAX_BYTES) throw new HostRegistrationStateError(`Host registration state is invalid: ${refusalFact("registration_state_bytes", Buffer.byteLength(raw, "utf8"), `at most ${HOST_REGISTRATION_STATE_MAX_BYTES}`)}.`);
+  let value;
+  try {
+    value = JSON.parse(raw);
+  } catch {
+    throw new HostRegistrationStateError("Host registration state is invalid.");
+  }
+  return decodeHostRegistrationAuthority(value, expectedHostSourceRef);
+}
+async function readWindowsRegistration(path, custody) {
+  const bytes2 = await readPrivateFileWithSecurefs(path, HOST_REGISTRATION_STATE_MAX_BYTES, custody);
+  try {
+    return new TextDecoder("utf-8", { fatal: true }).decode(bytes2);
+  } catch {
+    throw new HostRegistrationStateError("Host registration state is invalid.");
+  }
+}
+async function readPosixRegistration(path, platform, custody) {
+  const handle = await openNoFollow(path, constants3.O_RDONLY, void 0, platform, custody);
+  try {
+    const stats = await handle.stat();
+    if (!stats.isFile() || !isSelfOwned(stats.uid, platform, handle) || !isPrivateFileMode(stats.mode, platform, handle)) throw new HostRegistrationStateError("Host registration file is not private to its owner.");
+    return await handle.readFile("utf8");
+  } finally {
+    await handle.close();
+  }
+}
+function registrationReadError(error) {
+  if (error instanceof HostRegistrationStateError) return error;
+  if (error instanceof SecureFileCustodyError && error.reason === "not_private") return new HostRegistrationStateError("Host registration file is not private to its owner.");
+  return new HostRegistrationStateError("Host registration file is unavailable.");
+}
+function decodeHostRegistrationAuthority(value, expectedHostSourceRef) {
+  const keys = HOST_REGISTRATION_STATE_KEYS;
+  const fieldCount = record4(value) ? Object.keys(value).length : 0;
+  const missing = record4(value) ? keys.filter((key) => !Object.hasOwn(value, key)).length : keys.length;
+  if (!record4(value) || fieldCount !== keys.length || missing !== 0) throw new HostRegistrationStateError(`Host registration state is invalid or does not match this Relay: ${refusalFacts([{ name: "registration_field_count", value: fieldCount, expected: `exactly ${keys.length}` }, { name: "missing_registration_field_count", value: missing, expected: "0" }])}.`);
+  if (!validRegistrationIdentity(value, expectedHostSourceRef)) throw new HostRegistrationStateError(`Host registration state is invalid or does not match this Relay: ${refusalFacts([{ name: "schema_version", value: value.schema_version, expected: HOST_REGISTRATION_STATE_SCHEMA }, { name: "status", value: value.status, expected: "active" }, { name: "host_source_ref", value: value.host_source_ref, expected: expectedHostSourceRef }, { name: "registration_attempt_ref", value: value.registration_attempt_ref, expected: "host-registration-attempt:<uuid>" }, { name: "host_installation_ref", value: value.host_installation_ref, expected: "host-installation:<uuid>" }])}.`);
+  if (!validRegistrationCredential(value)) throw new HostRegistrationStateError(`Host registration state is invalid or does not match this Relay: ${refusalFacts([{ name: "credential_generation", value: value.credential_generation, expected: "a positive safe integer" }, { name: "host_access_token_matches_registered_shape", value: validHostAccessToken(value.host_access_token), expected: "true" }])}.`);
+  if (!validGatewayOrigin(value.gateway_request_origin)) throw new HostRegistrationStateError(`Host registration state is invalid or does not match this Relay: ${refusalFact("gateway_request_origin", value.gateway_request_origin, "an HTTPS origin or explicit-port loopback HTTP origin")}.`);
+  return { gateway_request_origin: value.gateway_request_origin, host_access_token: value.host_access_token };
+}
+function validRegistrationIdentity(value, expectedHostSourceRef) {
+  return value.schema_version === HOST_REGISTRATION_STATE_SCHEMA && value.status === "active" && value.host_source_ref === expectedHostSourceRef && typeof value.registration_attempt_ref === "string" && CEAL_HOST_REGISTRATION_ATTEMPT_REF_PATTERN.test(value.registration_attempt_ref) && typeof value.host_installation_ref === "string" && CEAL_HOST_INSTALLATION_REF_PATTERN.test(value.host_installation_ref) && typeof value.host_source_ref === "string" && hostSourceUuid(value.host_source_ref) !== null;
+}
+function validRegistrationCredential(value) {
+  return Number.isSafeInteger(value.credential_generation) && Number(value.credential_generation) > 0 && validHostAccessToken(value.host_access_token);
+}
+function validHostAccessToken(value) {
+  return typeof value === "string" && CEAL_HOST_ACCESS_TOKEN_PATTERN.test(value);
+}
+function validGatewayOrigin(value) {
+  try {
+    if (typeof value !== "string" || /\s|\0/u.test(value)) return false;
+    const parsed = new URL(value);
+    const hostname = parsed.hostname.toLowerCase().replace(/\.+$/u, "");
+    return hostname !== "" && validGatewayPort(parsed.port) && (loopbackHttpOrigin(parsed, hostname) || parsed.protocol === "https:") && cleanOriginPath(parsed) && bareOriginSuffix(value);
+  } catch {
+    return false;
+  }
+}
+function loopbackHttpOrigin(parsed, hostname) {
+  return parsed.protocol === "http:" && parsed.port !== "" && (hostname === "127.0.0.1" || hostname === "[::1]");
+}
+function validGatewayPort(port) {
+  if (port === "") return true;
+  const numeric = Number(port);
+  return Number.isInteger(numeric) && numeric >= 1 && numeric <= 65535;
+}
+function cleanOriginPath(parsed) {
+  return parsed.username === "" && parsed.password === "" && parsed.pathname === "/" && parsed.search === "" && parsed.hash === "";
+}
+function bareOriginSuffix(value) {
+  const schemeEnd = value.indexOf("://");
+  const authority = schemeEnd < 0 ? "" : value.slice(schemeEnd + 3);
+  const suffixOffset = authority.search(/[\\/?#]/u);
+  const rawSuffix = suffixOffset < 0 ? "" : authority.slice(suffixOffset);
+  return rawSuffix === "" || rawSuffix === "/";
+}
+async function assertPrivateRegistrationDirectory(path, platform, custody) {
+  if (!await isPrivateDirectory(path, platform, custody)) throw new HostRegistrationStateError("Host registration directory is not private to its owner.");
+}
+function record4(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 // host/relay/src/host-relay-runtime.ts
@@ -4239,16 +4043,24 @@ var HostRelayConfigError = class extends Error {
     this.code = code;
   }
 };
-async function readHostRelayConfig(path) {
+async function readHostRelayConfig(path, platform = process.platform, custody = {}) {
   if (!isAbsoluteNormalizedNonRootPath(path, process.platform, true)) throw new HostRelayConfigError("invalid_config_path", `invalid_config_path: Host Relay config path is invalid: ${refusalFact("config_path", path, "absolute, normalized, and non-root")}.`);
   let handle;
   try {
-    await assertOwnerPrivateDirectory2(dirname4(path));
-    handle = await open5(path, O_RDONLY4 | O_NOFOLLOW3);
-    const stats = await handle.stat();
-    if (!stats.isFile() || !ownerPrivate4(stats)) throw new HostRelayConfigError("config_not_private", "Host Relay config file is not owner-private.");
-    if (stats.size < HOST_RELAY_CONFIG_MIN_BYTES || stats.size > HOST_RELAY_CONFIG_MAX_BYTES) throw new HostRelayConfigError("invalid_config", `invalid_config: Host Relay config size is invalid: ${refusalFact("config_bytes", stats.size, `between ${HOST_RELAY_CONFIG_MIN_BYTES} and ${HOST_RELAY_CONFIG_MAX_BYTES}`)}.`);
-    const text = await handle.readFile("utf8");
+    await assertPrivateRelayConfigDirectory(dirname7(path), platform, custody);
+    let text;
+    if (platform === "win32") {
+      const bytes2 = await readPrivateFileWithSecurefs(path, HOST_RELAY_CONFIG_MAX_BYTES, custody);
+      if (bytes2.byteLength < HOST_RELAY_CONFIG_MIN_BYTES) throw new HostRelayConfigError("invalid_config", `invalid_config: Host Relay config size is invalid: ${refusalFact("config_bytes", bytes2.byteLength, `between ${HOST_RELAY_CONFIG_MIN_BYTES} and ${HOST_RELAY_CONFIG_MAX_BYTES}`)}.`);
+      try {
+        text = new TextDecoder("utf-8", { fatal: true }).decode(bytes2);
+      } catch {
+        throw new HostRelayConfigError("invalid_json", "Host Relay config is not valid UTF-8 JSON.");
+      }
+    } else {
+      handle = await openPrivateRelayConfigFile(path, platform, custody);
+      text = await handle.readFile("utf8");
+    }
     assertNoDuplicateJsonKeys(text);
     let value;
     try {
@@ -4256,114 +4068,236 @@ async function readHostRelayConfig(path) {
     } catch {
       throw new HostRelayConfigError("invalid_json", "Host Relay config is not JSON.");
     }
-    const config = decodeHostRelayConfig(value);
+    const decoded = decodeHostRelayConfig(value);
+    const config = resolveRelayIpcEndpoint(decoded);
     validateHostRelaySourcePaths(config);
     return config;
   } catch (error) {
-    if (error instanceof HostRelayConfigError) throw error;
-    throw new HostRelayConfigError("config_unavailable", "Host Relay config is unavailable.");
+    throw relayConfigReadError(error);
   } finally {
     await handle?.close();
   }
 }
+async function openPrivateRelayConfigFile(path, platform, custody) {
+  const handle = await openNoFollow(path, constants4.O_RDONLY, void 0, platform, custody);
+  try {
+    const stats = await handle.stat();
+    if (!stats.isFile() || !isSelfOwned(stats.uid, platform, handle) || !isPrivateFileMode(stats.mode, platform, handle)) throw new HostRelayConfigError("config_not_private", "Host Relay config file is not private to its owner.");
+    if (stats.size < HOST_RELAY_CONFIG_MIN_BYTES || stats.size > HOST_RELAY_CONFIG_MAX_BYTES) throw new HostRelayConfigError("invalid_config", `invalid_config: Host Relay config size is invalid: ${refusalFact("config_bytes", stats.size, `between ${HOST_RELAY_CONFIG_MIN_BYTES} and ${HOST_RELAY_CONFIG_MAX_BYTES}`)}.`);
+    return handle;
+  } catch (error) {
+    await handle.close();
+    throw error;
+  }
+}
+function relayConfigReadError(error) {
+  if (error instanceof HostRelayConfigError) return error;
+  if (error instanceof SecureFileCustodyError && error.reason === "not_private") return new HostRelayConfigError("config_not_private", "Host Relay config file is not private to its owner.");
+  if (error instanceof SecureFileCustodyError && error.reason === "too_large") return new HostRelayConfigError("invalid_config", `invalid_config: Host Relay config exceeds ${HOST_RELAY_CONFIG_MAX_BYTES} bytes.`);
+  return new HostRelayConfigError("config_unavailable", "Host Relay config is unavailable.");
+}
+async function assertPrivateRelayConfigDirectory(path, platform, custody) {
+  try {
+    if (!await isPrivateDirectory(path, platform, custody)) throw new HostRelayConfigError("config_not_private", "Host Relay config directory is not private to its owner.");
+  } catch (error) {
+    if (error instanceof HostRelayConfigError) throw error;
+    throw new HostRelayConfigError("config_unavailable", "Host Relay config directory is unavailable.");
+  }
+}
+function resolveRelayIpcEndpoint(decoded) {
+  if (process.platform !== "win32") return decoded;
+  const endpoint = assertHostRelaySourcePaths(dirname7(decoded.registration_state_file), decoded);
+  return endpoint === decoded.ipc_endpoint ? decoded : { ...decoded, ipc_endpoint: endpoint };
+}
 function validateHostRelaySourcePaths(config) {
   try {
-    assertHostRelaySourcePaths(dirname4(config.registration_state_file), config);
+    assertHostRelaySourcePaths(dirname7(config.registration_state_file), config);
   } catch (error) {
     throw new HostRelayConfigError("invalid_config", error instanceof Error ? error.message : "Host Relay source tuple is invalid.");
   }
 }
-function decodeHostRelayConfig(value) {
-  const required = ["schema_version", "registration_state_file", "host_source_ref", "state_root", "ipc_endpoint"];
-  const optional = ["drain_interval_ms", "gateway_timeout_ms"];
-  if (!record5(value) || !exactOptionalKeys2(value, required, optional) || !validConfigIdentity(value) || !validConfigRuntime(value)) {
-    throw new HostRelayConfigError("invalid_config", "Host Relay config shape is invalid.");
+function decodeHostRelayConfig(value, platform = process.platform) {
+  const ignoreEndpoint = platform === "win32";
+  const required = ignoreEndpoint ? ["schema_version", "registration_state_file", "host_source_ref", "state_root"] : ["schema_version", "registration_state_file", "host_source_ref", "state_root", "ipc_endpoint"];
+  const optional = ignoreEndpoint ? ["ipc_endpoint", "drain_interval_ms"] : ["drain_interval_ms"];
+  if (!record5(value) || !exactOptionalKeys2(value, required, optional) || !validConfigIdentity(value, platform) || !validConfigRuntime(value, platform)) {
+    throw new HostRelayConfigError("invalid_config", `Host Relay config shape is invalid: ${refusalFacts(relayShapeFacts(value, required, optional, platform))}.`);
   }
   return {
     schema_version: HOST_RELAY_CONFIG_SCHEMA,
     registration_state_file: value.registration_state_file,
     host_source_ref: value.host_source_ref,
     state_root: value.state_root,
-    ipc_endpoint: value.ipc_endpoint,
-    drain_interval_ms: value.drain_interval_ms ?? 250,
-    gateway_timeout_ms: value.gateway_timeout_ms ?? 5e3
+    ipc_endpoint: typeof value.ipc_endpoint === "string" ? value.ipc_endpoint : "",
+    drain_interval_ms: value.drain_interval_ms ?? 250
   };
 }
-function validConfigIdentity(value) {
-  return value.schema_version === HOST_RELAY_CONFIG_SCHEMA && isAbsoluteNormalizedNonRootPath(value.registration_state_file, process.platform, true) && opaqueHostSourceRef(value.host_source_ref);
+function validConfigIdentity(value, platform) {
+  return value.schema_version === HOST_RELAY_CONFIG_SCHEMA && isAbsoluteNormalizedNonRootPath(value.registration_state_file, platform, true) && opaqueHostSourceRef(value.host_source_ref);
+}
+function relayShapeFacts(value, required, optional, platform) {
+  if (!record5(value)) return [{ name: "config", value: "wrong_type", expected: "a record" }];
+  const facts = [
+    ...Object.keys(value).filter((key) => !required.includes(key) && !optional.includes(key)).map((key) => ({ name: key, value: "unknown", expected: `one of ${[...required, ...optional].join(", ")}` })),
+    ...required.filter((key) => !Object.hasOwn(value, key)).map((key) => ({ name: key, value: "missing", expected: "present" }))
+  ];
+  if (Object.hasOwn(value, "schema_version") && value.schema_version !== HOST_RELAY_CONFIG_SCHEMA) facts.push({ name: "schema_version", value: "wrong_type", expected: HOST_RELAY_CONFIG_SCHEMA });
+  for (const fact of relayValueFacts(value, platform)) facts.push(fact);
+  return facts;
+}
+function relayValueFacts(value, platform) {
+  const facts = [];
+  for (const key of platform === "win32" ? ["registration_state_file", "state_root"] : ["registration_state_file", "state_root", "ipc_endpoint"]) {
+    if (Object.hasOwn(value, key) && !isAbsoluteNormalizedNonRootPath(value[key], platform, true)) facts.push({ name: key, value: "wrong_type", expected: "an absolute normalized non-root path" });
+  }
+  if (Object.hasOwn(value, "host_source_ref") && !opaqueHostSourceRef(value.host_source_ref)) facts.push({ name: "host_source_ref", value: "wrong_type", expected: "a host source reference" });
+  if (Object.hasOwn(value, "drain_interval_ms") && !boundedInteger(value.drain_interval_ms, 50, 3e4, true)) facts.push({ name: "drain_interval_ms", value: "wrong_type", expected: "between 50 and 30000" });
+  return facts;
 }
-function validConfigRuntime(value) {
-  return isAbsoluteNormalizedNonRootPath(value.state_root, process.platform, true) && isAbsoluteNormalizedNonRootPath(value.ipc_endpoint, process.platform, true) && boundedInteger(value.drain_interval_ms, 50, 3e4, true) && boundedInteger(value.gateway_timeout_ms, 100, 6e4, true);
+function validConfigRuntime(value, platform) {
+  return isAbsoluteNormalizedNonRootPath(value.state_root, platform, true) && (platform === "win32" || isAbsoluteNormalizedNonRootPath(value.ipc_endpoint, platform, true)) && boundedInteger(value.drain_interval_ms, 50, 3e4, true);
 }
 var HOST_RELAY_INVOCATION_MINT_LOG_TAG = "[host-relay-invocation-mint]";
-var HOST_RELAY_INVOCATION_MINT_LINE = new RegExp(`^${HOST_RELAY_INVOCATION_MINT_LOG_TAG.replace(/[[\]]/gu, "\\$&")} outcome=([a-z_]+)(?: reason=([a-z][a-z0-9_]{0,63}))? elapsed_ms=[0-9]+$`, "u");
+function formatHostRelayInvocationMintLine(result2) {
+  return `${HOST_RELAY_INVOCATION_MINT_LOG_TAG} outcome=${result2.status === "ready" ? "completed" : "failed"}${result2.status === "refused" ? ` reason=${result2.reason}` : ""}`;
+}
+function reportInvocationMintLine(line) {
+  try {
+    process.stderr.write(line);
+  } catch {
+  }
+  writeHostServiceLogLine(line);
+}
 async function serveHostRelay(config, signal, dependencies = {}) {
-  const admission = new RelayAdmissionStore(join7(config.state_root, "admission"));
-  const bindings = new RelayRequestBindingStore(join7(config.state_root, "bindings"));
-  const gateway = (dependencies.createGateway ?? createHostRelayGatewayHttpPort)({ registration_state_file: config.registration_state_file, host_source_ref: config.host_source_ref });
-  const bridge = new RelayGatewayBridge({ state_root: join7(config.state_root, "gateway"), host_source_ref: config.host_source_ref, gateway, timeout_ms: config.gateway_timeout_ms, on_request_bound: async (binding) => {
-    await bindings.bind(binding);
-  } });
+  const admission = new RelayAdmissionStore(join6(config.state_root, "admission"));
   let server;
   try {
-    server = await startHostRelayRuntimeIpc(config, admission, bindings, gateway, dependencies);
-    while (!signal.aborted) {
-      const round = await admission.drainRound((input) => bridge.deliver(input), { now_ms: (dependencies.now ?? Date.now)(), host_source_ref: config.host_source_ref });
-      if (round.delivered.length === 0 && round.refused.length === 0) await (dependencies.wait ?? ((milliseconds, waitSignal) => waitForAbort(waitSignal, milliseconds)))(config.drain_interval_ms, signal);
-    }
+    const pipeKey = process.platform === "win32" ? await loadRelayPipeKey(config.state_root) : void 0;
+    server = await startHostRelayRuntimeIpc(config, admission, dependencies, pipeKey);
+    await waitForRelayShutdown(config, signal, dependencies);
+  } catch (error) {
+    if (error instanceof HostRelayAlreadyRunningError) return;
+    throw error;
   } finally {
     await server?.close();
   }
 }
-async function startHostRelayRuntimeIpc(config, admission, bindings, gateway, dependencies) {
+async function waitForRelayShutdown(config, signal, dependencies) {
+  while (!signal.aborted) await (dependencies.wait ?? ((milliseconds, waitSignal) => waitForAbort(waitSignal, milliseconds)))(config.drain_interval_ms, signal);
+}
+async function startHostRelayRuntimeIpc(config, admission, dependencies, pipeKey) {
   return (dependencies.startIpc ?? startHostRelayIpcServer)({
     endpoint: config.ipc_endpoint,
     admission,
-    bindings,
-    mintInvocationContext: (input, invocationSignal) => mintInvocationContext(gateway, input, invocationSignal),
-    invocationMintTimeoutMs: config.gateway_timeout_ms,
-    scheduleInvocationMintDeadline: dependencies.scheduleInvocationMintDeadline ?? scheduleInvocationMintDeadline2,
-    observeInvocationMint: dependencies.observeInvocationMint ?? reportInvocationMint
+    ...pipeKey === void 0 ? {} : { pipeKey },
+    mintInvocationContext: async (input, signal) => {
+      let result2;
+      try {
+        result2 = await mintInvocationContextAtGateway(config, input, signal, dependencies.fetch ?? fetch);
+      } catch (error) {
+        const refused = { schema_version: "ceal.host_relay_invocation_context_result.v2", status: "refused", reason: "gateway_unavailable" };
+        (dependencies.logInvocationMint ?? reportInvocationMintLine)(`${formatHostRelayInvocationMintLine(refused)}
+`);
+        throw error;
+      }
+      (dependencies.logInvocationMint ?? reportInvocationMintLine)(`${formatHostRelayInvocationMintLine(result2)}
+`);
+      return result2;
+    }
   });
 }
-async function mintInvocationContext(gateway, input, signal) {
+async function mintInvocationContextAtGateway(config, input, signal, fetchGateway) {
   try {
-    return await gateway.mintInvocationContext(input, signal);
+    const registration = await readHostRegistrationAuthority(config.registration_state_file, config.host_source_ref);
+    return gatewayMintPost(registration, input, signal, fetchGateway);
   } catch (error) {
-    const cancellation = signal.reason === "deadline" ? "deadline" : signal.reason === "caller_cancelled" ? "caller_cancelled" : null;
-    throw new HostRelayInvocationMintRefusal(invocationMintRefusalReason(error, cancellation));
+    return gatewayMintFailure(signal, error);
   }
 }
-function invocationMintRefusalReason(error, cancellation) {
-  if (cancellation === "deadline") return "deadline";
-  if (cancellation === "caller_cancelled") return "cancelled";
-  if (!(error instanceof HostRelayGatewayError)) return "mint_failed";
-  if (error.code === "credential") return "host_credential_refused";
-  if (error.code === "gateway_unavailable") return "gateway_unavailable";
-  if (error.code === "invalid_response") return "gateway_response_invalid";
-  if (error.code !== "gateway_refused") return "mint_failed";
-  return gatewayMintRefusalReason(error);
-}
-function gatewayMintRefusalReason(error) {
-  if (error.error_code === "request_context_refused" && isVocabularyWord(CEAL_HOST_MINT_REQUEST_CONTEXT_REFUSAL_REASONS, error.refusal_reason)) return error.refusal_reason;
-  return GATEWAY_MINT_REFUSAL_REASONS.get(error.error_code ?? "") ?? "gateway_refused";
-}
-var GATEWAY_MINT_REFUSAL_REASONS = /* @__PURE__ */ new Map([
-  ["request_context_refused", "context_stale"],
-  ["context_expired", "context_expired"],
-  ["host_source_refused", "host_source_refused"],
-  ["host_invocation_context_unavailable", "gateway_unavailable"]
-]);
-function scheduleInvocationMintDeadline2(expire, milliseconds) {
-  const timeout = setTimeout(expire, milliseconds);
-  return () => clearTimeout(timeout);
+async function gatewayMintPost(registration, input, signal, fetchGateway) {
+  const serialized = JSON.stringify(gatewayMintBody(input));
+  if (Buffer.byteLength(serialized, "utf8") > CEAL_HOST_INVOCATION_CONTEXT_REQUEST_MAX_BYTES) return mintRefusal("producer_frame_invalid");
+  const response2 = await fetchGateway(`${registration.gateway_request_origin}${CEAL_HOST_INVOCATION_CONTEXT_PATH}`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${registration.host_access_token}`, "content-type": "application/json" },
+    body: serialized,
+    signal
+  });
+  const raw = await readBoundedResponseText(response2, 8192);
+  return decodeGatewayMintResponse(response2, raw);
 }
-function reportInvocationMint(observation) {
-  process.stderr.write(`${formatHostRelayInvocationMintLine(observation)}
-`);
+function gatewayMintBody(input) {
+  return {
+    schema_version: CEAL_HOST_INVOCATION_CONTEXT_REQUEST_SCHEMA,
+    client_nonce: input.client_nonce,
+    context_expires_at: input.context_expires_at,
+    host_binding: input.host_binding,
+    human_message_window: input.human_message_window,
+    ...input.last_seen_request_ref === void 0 ? {} : { last_seen_request_ref: input.last_seen_request_ref },
+    ...input.visible_output_max_bytes === void 0 ? {} : { visible_output_max_bytes: input.visible_output_max_bytes }
+  };
+}
+function decodeGatewayMintResponse(response2, raw) {
+  if (raw === null) return mintRefusal("gateway_response_invalid");
+  let value;
+  try {
+    value = JSON.parse(raw);
+  } catch {
+    value = null;
+  }
+  if (!response2.ok) return mintRefusal(gatewayMintRefusal(response2.status, value));
+  if (!isMintResult(value)) return mintRefusal("gateway_response_invalid");
+  const requestRef = response2.headers.get("ceal-request-ref");
+  if (requestRef === null || !/^ceal-request:[a-f0-9-]{36}$/u.test(requestRef)) return mintRefusal("gateway_response_invalid");
+  const result2 = decodeCealHostInvocationAuthenticationResult(value, /* @__PURE__ */ new Date());
+  return { schema_version: "ceal.host_relay_invocation_context_result.v2", status: "ready", request_ref: requestRef, result: result2 };
+}
+function gatewayMintFailure(signal, _error) {
+  return mintRefusal(signal.aborted ? "transient_retryable" : "gateway_unavailable");
+}
+function mintRefusal(reason) {
+  return { schema_version: "ceal.host_relay_invocation_context_result.v2", status: "refused", reason };
+}
+async function readBoundedResponseText(response2, maximumBytes) {
+  if (response2.body === null) return null;
+  const reader = response2.body.getReader();
+  const chunks = [];
+  let total = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      total += value.byteLength;
+      if (total > maximumBytes) {
+        await reader.cancel();
+        return null;
+      }
+      chunks.push(value);
+    }
+    const output = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+      output.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
+    return new TextDecoder("utf-8", { fatal: true }).decode(output);
+  } catch {
+    return null;
+  }
 }
-function formatHostRelayInvocationMintLine(observation) {
-  return `${HOST_RELAY_INVOCATION_MINT_LOG_TAG} outcome=${observation.outcome}${observation.reason === void 0 ? "" : ` reason=${observation.reason}`} elapsed_ms=${observation.elapsed_ms}`;
+function isMintResult(value) {
+  return record5(value) && Object.keys(value).length === 3 && value.schema_version === CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_SCHEMA && typeof value.context_token === "string" && typeof value.expires_at === "string";
+}
+function gatewayMintRefusal(status, value) {
+  if (status === 401) return "host_credential_refused";
+  if (status === 403 && record5(value)) {
+    if (value.error_code === "host_source_refused") return "host_source_refused";
+    if (value.error_code === "context_expired") return "context_expired";
+    if (value.error_code === "request_context_refused") return "context_stale";
+  }
+  if (status === 429) return "gateway_rate_limited";
+  if (status >= 500) return "gateway_unavailable";
+  return "gateway_refused";
 }
 async function runHostRelayCli(args, signal, dependencies = {}) {
   try {
@@ -4382,20 +4316,6 @@ function parseServeArgs(args) {
   }
   return args[2];
 }
-async function assertOwnerPrivateDirectory2(path) {
-  try {
-    const stats = await lstat4(path);
-    if (!stats.isDirectory() || stats.isSymbolicLink() || !ownerPrivate4(stats)) throw new HostRelayConfigError("config_not_private", "Host Relay config directory is not owner-private.");
-  } catch (error) {
-    if (error instanceof HostRelayConfigError) throw error;
-    throw new HostRelayConfigError("config_unavailable", "Host Relay config directory is unavailable.");
-  }
-}
-function ownerPrivate4(stats) {
-  if (process.platform === "win32") return true;
-  const uid = typeof process.geteuid === "function" ? process.geteuid() : stats.uid;
-  return stats.uid === uid && (stats.mode & 63) === 0;
-}
 function assertNoDuplicateJsonKeys(text) {
   rejectDuplicateJsonKeys(text, {
     invalid: () => new HostRelayConfigError("invalid_json", "Host Relay config is not JSON."),
@@ -4414,12 +4334,14 @@ function exactOptionalKeys2(value, required, optional) {
 }
 // host/relay/bin/ceal-host-relay.ts
+var serviceArguments = consumeHostServiceLogArgument(process.argv.slice(2));
+if (serviceArguments.path !== void 0) process.env[HOST_SERVICE_LOG_ENVIRONMENT] = serviceArguments.path;
 var controller = new AbortController();
 var stop = () => controller.abort();
 process.once("SIGINT", stop);
 process.once("SIGTERM", stop);
 var stopLogBound = boundHostServiceLog();
-void runHostRelayCli(process.argv.slice(2), controller.signal).then((result2) => {
+void runHostRelayCli(serviceArguments.args, controller.signal).then((result2) => {
   process.stdout.write(`${JSON.stringify({ schema_version: "ceal.host_relay_command.v1", ...result2 })}
 `);
   process.exitCode = result2.ok ? 0 : 1;