@corca-org/ceal-host-linux-arm64 1.0.9 → 1.0.11

package/libexec/ceal-host/relay.mjs

@@ -61,6 +61,46 @@ var client_wire_contract_default = {
     schema_version: "ceal.command_request.v1",
     absolute_transport_max_bytes: 65536
   },
+  command_resolution: {
+    schema_version: "ceal.gateway_command_resolution.v1",
+    authority: {
+      anonymous: {
+        state: "anonymous",
+        fields: [
+          "state"
+        ]
+      },
+      authenticated: {
+        state: "authenticated",
+        fields: [
+          "state",
+          "principal_kind",
+          "organization_ref",
+          "instance_ref",
+          "access_group_ref",
+          "principal_ref",
+          "authority_revision_ref"
+        ]
+      }
+    },
+    semantic_options: {
+      inspection: {
+        values: [
+          "default",
+          "full"
+        ]
+      },
+      cache_mode: {
+        values: [
+          "default",
+          "bypass"
+        ]
+      },
+      compact: {
+        type: "boolean"
+      }
+    }
+  },
   command_response: {
     schema_version: "ceal.command_response.v1",
     descriptor_field: "verified_artifact",
@@ -74,12 +114,15 @@ var client_wire_contract_default = {
     ],
     bare_document_fields: [
       "invocation",
-      "required_action_sequence",
       "entrypoints",
       "common_concepts",
       "operations",
       "catalog_revision"
     ],
+    bare_document_optional_fields: [
+      "required_action_sequence",
+      "withheld"
+    ],
     prompt_field: "prompt",
     prompt_schema_version: "ceal.prompt.v1",
     focused_prompt_document_fields: [
@@ -92,7 +135,7 @@ var client_wire_contract_default = {
       "prompt"
     ],
     discovery_command: "discovery",
-    discovery_manifest_schema_version: "ceal.discovery_manifest.v1",
+    discovery_manifest_schema_version: "ceal.discovery_manifest.v2",
     discovery_manifest_document_fields: [
       "discovery_manifest"
     ],
@@ -100,11 +143,29 @@ var client_wire_contract_default = {
     bare_document_max_bytes: 65536,
     complete_max_bytes: 66019,
     absolute_transport_max_bytes: 4194304
+  },
+  resource_stream: {
+    path: "/api/ceal/v2/resources",
+    request_schema_version: "ceal.resource_stream_request.v1",
+    ref_pattern: "^resource:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$",
+    media_type_pattern: "^[a-z0-9][a-z0-9!#$&^_.+-]{0,63}/[a-z0-9][a-z0-9!#$&^_.+-]{0,63}$",
+    filename_max_bytes: 512,
+    max_bytes: 9007199254740991,
+    deadline_ms: 6e5,
+    fetch_argv: [
+      "resource",
+      "fetch"
+    ],
+    ref_flag: "--ref"
   }
 };
 
 // packages/ceal-client-protocol/src/client-wire-contract.ts
 var CEAL_CLIENT_WIRE_CONTRACT = Object.freeze(client_wire_contract_default);
+var commandResolution = CEAL_CLIENT_WIRE_CONTRACT.command_resolution;
+var commandResolutionAuthority = commandResolution.authority;
+var commandResolutionSemanticOptions = commandResolution.semantic_options;
+var CEAL_GATEWAY_COMMAND_RESOLUTION_SCHEMA_VERSION = commandResolution.schema_version;
 var artifact = CEAL_CLIENT_WIRE_CONTRACT.artifact_descriptor;
 var request = CEAL_CLIENT_WIRE_CONTRACT.command_request;
 var response = CEAL_CLIENT_WIRE_CONTRACT.command_response;
@@ -125,6 +186,7 @@ var CEAL_COMMAND_REQUEST_MAX_BYTES = request.absolute_transport_max_bytes;
 var CEAL_COMMAND_RESPONSE_BARE_DOCUMENT_MAX_BYTES = response.bare_document_max_bytes;
 var CEAL_COMMAND_RESPONSE_PROMPT_FIELD = response.prompt_field;
 var CEAL_COMMAND_RESPONSE_PROMPT_SCHEMA_VERSION = response.prompt_schema_version;
+var CEAL_COMMAND_RESPONSE_BARE_DOCUMENT_OPTIONAL_FIELDS = Object.freeze([...response.bare_document_optional_fields]);
 var CEAL_COMMAND_RESPONSE_PROMPT_DOCUMENT_FIELDS = Object.freeze([...response.bare_document_fields, response.prompt_field]);
 var CEAL_COMMAND_RESPONSE_FOCUSED_PROMPT_DOCUMENT_FIELDS = Object.freeze([...response.focused_prompt_document_fields]);
 var CEAL_COMMAND_RESPONSE_FOCUSED_PROMPT_CONTINUATION_DOCUMENT_FIELDS = Object.freeze([...response.focused_prompt_continuation_document_fields]);
@@ -138,9 +200,50 @@ function vocabulary(words) {
   return Object.freeze(words);
 }
 
+// packages/ceal-client-protocol/src/gateway-response-types.ts
+var CEAL_OPERATION_READINESS_VALUES = vocabulary(["ready", "degraded", "unavailable", "unknown"]);
+var CEAL_TARGET_REQUIREMENTS = vocabulary(["required", "optional", "none"]);
+var CEAL_AUDIT_OUTCOMES = vocabulary(["succeeded", "denied", "failed"]);
+var CEAL_GATEWAY_PROVIDER_STEP_OUTCOMES = vocabulary(["completed", "rejected", "throttled", "failed"]);
+var CEAL_GATEWAY_READ_REUSE_DISPOSITIONS = vocabulary(["response_cache_hit", "corpus_hit", "corpus_hit_after_revalidation", "corpus_partial_provider_supplement", "provider_direct", "provider_continuation", "reuse_unavailable"]);
+var CEAL_GATEWAY_READ_REUSE_UNAVAILABLE_REASONS = vocabulary(["not_reported", "storage_unavailable", "coverage_incomplete", "freshness_refresh_required", "not_reusable", "bypassed"]);
+var CEAL_POLICY_DECISIONS = vocabulary(["allowed", "denied", "not_evaluated"]);
+var CEAL_CONNECTOR_ROUTE_PHASES = vocabulary(["scope_observation", "target_selection", "route_resolution"]);
+var CEAL_CONNECTOR_ROUTE_CAUSES = vocabulary(["provider_throttled", "provider_unavailable", "binding_invalid", "scope_limit_exceeded"]);
+var CEAL_WRITE_SOURCE_KINDS = vocabulary(["authenticated_registered_client", "agent_lease_admission", "provider_authenticated_event"]);
+var CEAL_REFRESH_DELIVERIES = vocabulary(["initial", "recovery", "replay", "terminal_failure", "recovery_unavailable"]);
+var CEAL_CLIENT_OPERATIONS = vocabulary(["handshake", "discover", "call", "readback"]);
+var CEAL_WRITE_IDEMPOTENCY_POSTURES = vocabulary(["required", "optional", "not_required"]);
+var CEAL_WRITE_PROVIDER_READBACK_POSTURES = vocabulary(["required", "best_effort", "not_available"]);
+var CEAL_WRITE_ATTRIBUTIONS = vocabulary(["subject", "requester_event", "connector_integration"]);
+var CEAL_WRITE_RECEIPT_PROVIDER_STATES = vocabulary(["outcome_unknown", "verified", "not_dispatched"]);
+var CEAL_WRITE_RECEIPT_PROVIDER_READBACKS = vocabulary(["outcome_unknown", "verified", "not_applied"]);
+var CEAL_PROTOCOL_VERSION = "1.4.0";
+var CEAL_GATEWAY_ANNOUNCEMENT_SCOPE_STATEMENTS = Object.freeze({
+  github_app_installation_repositories: "Repositories in the installed GitHub App installation.",
+  slack_public_app_member_channels_only: "Public channels where the installed Slack app is a member, plus direct and multi-person direct messages the requester is a member of, as Slack reports that membership; private channels the administrator has not approved are not declared by this connector.",
+  notion_connected_logical_area: "Connected Notion logical area under provider-enforced sharing; descendant inventory is not declared.",
+  google_workspace_calendar_read_only: "Approved Calendar availability and event reads only; Calendar mutation is not declared.",
+  google_workspace_admitted_drive_target_metadata: "Metadata search for files in the shared drives and directly shared files the Connector reaches and the Organization admits as Targets; file-content read and mutation are not declared.",
+  google_workspace_admitted_drive_target_sheet_ranges: "Bounded values reads from Google Sheets in the shared drives and directly shared files the Connector reaches and the Organization admits as Targets; file mutation is not declared.",
+  google_workspace_admitted_drive_target_sheet_tabs: "Bounded tab metadata and grid extents from Google Sheets in the shared drives and directly shared files the Connector reaches and the Organization admits as Targets; cell contents and file mutation are not declared.",
+  google_workspace_admitted_drive_target_editable_sheet_ranges: "Bounded values updates and clears in editable Google Sheets in the shared drives and directly shared files the Connector reaches and the Organization admits as Targets; Docs, Slides, and other Drive file mutation are not declared."
+});
+var CEAL_OPERATION_ACCESS_SCHEMA_VERSION = "ceal.operation_access.v1";
+var CEAL_CONNECTOR_ROUTE_FAILURE_KEYS = vocabulary(["connector_kind", "phase", "schema_version"]);
+var CEAL_CLASSIFIED_CONNECTOR_ROUTE_FAILURE_KEYS = vocabulary(["cause", ...CEAL_CONNECTOR_ROUTE_FAILURE_KEYS]);
+var CEAL_UNCLASSIFIED_CONNECTOR_ROUTE_FAILURE_KEYS = vocabulary(["connector_kind", "error_class", "phase", "schema_version"]);
+var CEAL_GATEWAY_ORGANIZATION_ROUTE_FACT_CALL_KEYS = Object.freeze([
+  "connector_ref",
+  "connector_revision",
+  "policy_decision_revision"
+]);
+
 // packages/ceal-client-protocol/src/operation-contract-types.ts
 var CEAL_JSON_SCHEMA_2020_12 = "https://json-schema.org/draft/2020-12/schema";
 var CEAL_OPERATION_ERROR_SCHEMA_VERSION = "ceal.operation_error.v1";
+var CEAL_OPERATION_WITHHELD_CAUSES = vocabulary(["provider_permission", "access_level", "personal_authorization_required"]);
+var CEAL_RETRY_AFTER_MAX_MS = 60 * 60 * 1e3;
 var CEAL_JSON_SCHEMA_TYPES = vocabulary(["object", "array", "string", "integer", "number", "boolean", "null"]);
 var OBSERVATION_POSTURES = vocabulary(["direct_readback", "approved_no_readback", "operator_mediated", "excluded"]);
 var EFFECT_DOMAINS = vocabulary(["none", "gateway_state", "provider", "external_world"]);
@@ -176,27 +279,6 @@ var CEAL_OPERATION_APPROVAL_DISPOSITIONS = vocabulary([
   "interactive_unavailable"
 ]);
 
-// packages/ceal-client-protocol/src/gateway-response-types.ts
-var CEAL_CAPABILITY_READINESS_VALUES = vocabulary(["ready", "degraded", "unavailable", "unknown"]);
-var CEAL_TARGET_REQUIREMENTS = vocabulary(["required", "optional", "none"]);
-var CEAL_AUDIT_OUTCOMES = vocabulary(["succeeded", "denied", "failed"]);
-var CEAL_GATEWAY_PROVIDER_STEP_OUTCOMES = vocabulary(["completed", "rejected", "throttled", "failed"]);
-var CEAL_GATEWAY_READ_REUSE_DISPOSITIONS = vocabulary(["response_cache_hit", "corpus_hit", "corpus_hit_after_revalidation", "corpus_partial_provider_supplement", "provider_direct", "provider_continuation", "reuse_unavailable"]);
-var CEAL_GATEWAY_READ_REUSE_UNAVAILABLE_REASONS = vocabulary(["not_reported", "storage_unavailable", "coverage_incomplete", "freshness_refresh_required", "not_reusable", "bypassed"]);
-var CEAL_POLICY_DECISIONS = vocabulary(["allowed", "denied", "not_evaluated"]);
-var CEAL_CONNECTOR_ROUTE_PHASES = vocabulary(["scope_observation", "target_selection", "route_resolution"]);
-var CEAL_CONNECTOR_ROUTE_CAUSES = vocabulary(["provider_throttled", "provider_unavailable", "binding_invalid", "scope_limit_exceeded"]);
-var CEAL_WRITE_SOURCE_KINDS = vocabulary(["authenticated_registered_client", "agent_lease_admission", "provider_authenticated_event"]);
-var CEAL_REFRESH_DELIVERIES = vocabulary(["initial", "recovery", "replay", "terminal_failure", "recovery_unavailable"]);
-var CEAL_CLIENT_OPERATIONS = vocabulary(["handshake", "discover", "call", "readback"]);
-var CEAL_WRITE_IDEMPOTENCY_POSTURES = vocabulary(["required", "optional", "not_required"]);
-var CEAL_WRITE_PROVIDER_READBACK_POSTURES = vocabulary(["required", "best_effort", "not_available"]);
-var CEAL_WRITE_ATTRIBUTIONS = vocabulary(["subject", "requester_event", "connector_integration"]);
-var CEAL_PROTOCOL_VERSION = "1.4.0";
-var CEAL_CONNECTOR_ROUTE_FAILURE_KEYS = vocabulary(["connector_kind", "phase", "schema_version"]);
-var CEAL_CLASSIFIED_CONNECTOR_ROUTE_FAILURE_KEYS = vocabulary(["cause", ...CEAL_CONNECTOR_ROUTE_FAILURE_KEYS]);
-var CEAL_UNCLASSIFIED_CONNECTOR_ROUTE_FAILURE_KEYS = vocabulary(["connector_kind", "error_class", "phase", "schema_version"]);
-
 // packages/ceal-client-protocol/src/gateway-validation-primitives.ts
 var CealProtocolValidationError = class extends Error {
   name = "CealProtocolValidationError";
@@ -213,6 +295,7 @@ var SAFE_CONNECTOR_KIND = new RegExp(`^[a-z][a-z0-9-]{0,${MAX_SAFE_TOKEN_LENGTH
 var FORBIDDEN_SECRET_KEY = /^(?:[a-z0-9_]*(?:token|secret|password|credential(?:s)?|private_?key)|api_?key|authorization|bearer|raw_?provider_?payload|provider_?payload)$/iu;
 var FORBIDDEN_AUTHORITY_KEY = /^(?:actor_?ref|owner_?ref|registration_?ref|runner_?ref|auth_?decision|policy_?decision|host_?decision)$/iu;
 var TEXT_ENCODER = new TextEncoder();
+var CEAL_WIRE_SAFE_ARRAY_MAX_ITEMS = 128;
 var CEAL_WIRE_SAFE_TEXT_MAX_BYTES = 8 * 1024;
 function assertSafeJsonValue(value, options, depth = 0, count = { value: 0 }) {
   count.value += 1;
@@ -232,12 +315,12 @@ function assertSafeJsonString(value, options) {
   if (byteLength(value) > CEAL_WIRE_SAFE_TEXT_MAX_BYTES || firstDisallowedControl(value, "multi_line") !== null) invalidByContext(options);
 }
 function assertSafeJsonArray(value, options, depth, count) {
-  if (value.length > 128) invalidByContext(options);
+  if (value.length > CEAL_WIRE_SAFE_ARRAY_MAX_ITEMS) invalidByContext(options);
   for (const item of value) assertSafeJsonValue(item, options, depth + 1, count);
 }
 function assertSafeJsonRecord(record6, options, depth, count) {
   const entries = Object.entries(record6);
-  if (entries.length > 128) invalidByContext(options);
+  if (entries.length > CEAL_WIRE_SAFE_ARRAY_MAX_ITEMS) invalidByContext(options);
   const sourceUrlColumn = options.allowHttpsUrl ? compactSourceUrlColumn(record6.fields) : null;
   for (const [key, child] of entries) {
     if (key === "credential_material_included" && child !== false) invalidByContext(options);
@@ -263,9 +346,9 @@ function compactSourceUrlColumn(fields) {
   return index < 0 ? null : index;
 }
 function assertSafeJsonCompactRows(value, sourceUrlColumn, options, depth, count) {
-  if (!Array.isArray(value) || value.length > 128) invalidByContext(options);
+  if (!Array.isArray(value) || value.length > CEAL_WIRE_SAFE_ARRAY_MAX_ITEMS) invalidByContext(options);
   for (const row of value) {
-    if (!Array.isArray(row) || row.length > 128) invalidByContext(options);
+    if (!Array.isArray(row) || row.length > CEAL_WIRE_SAFE_ARRAY_MAX_ITEMS) invalidByContext(options);
     for (const [index, cell] of row.entries()) {
       if (index === sourceUrlColumn && (cell === null || isSafeExternalHttpsUrl(cell))) continue;
       assertSafeJsonValue(cell, options, depth + 2, count);
@@ -298,6 +381,7 @@ function isSafeResultContent(value, key) {
   const maximum = key === "text" ? 8192 : 1024;
   return typeof value === "string" && byteLength(value) <= maximum && firstDisallowedControl(value, "multi_line") === null;
 }
+var CEAL_PUBLIC_DISPLAY_NAME_MAX_BYTES = 512;
 function normalizeCealSingleLineText(value) {
   return value.split("").map((character) => hasControlCharacter(character) ? " " : character).join("").trim();
 }
@@ -406,6 +490,28 @@ function cut(text) {
   return text.length <= REFUSAL_VALUE_MAX_CHARS ? text : `${text.slice(0, REFUSAL_VALUE_MAX_CHARS)}...(+${text.length - REFUSAL_VALUE_MAX_CHARS} chars)`;
 }
 
+// packages/ceal-client-protocol/src/operation-access-class.ts
+var CEAL_OPERATION_ACCESS_CLASSES = vocabulary(["read", "write"]);
+
+// packages/ceal-client-protocol/src/domain-vocabulary.ts
+var CEAL_INTEGRATION_KINDS = vocabulary(["github", "google-workspace", "notion", "slack"]);
+var CEAL_CONNECTOR_STATUSES = vocabulary(["active", "disabled", "disconnected"]);
+var CEAL_CONNECTOR_CUSTODIES = vocabulary(["organization", "personal"]);
+var CEAL_PROVIDER_BOUNDARY_KINDS = vocabulary([
+  "github_account",
+  "github_organization",
+  "google_workspace_domain",
+  "notion_workspace",
+  "slack_workspace"
+]);
+var CEAL_PROVIDER_BOUNDARY_EVIDENCE = vocabulary(["provider_readback", "operator_stated"]);
+var CEAL_ACCESS_LEVELS = vocabulary(["none", "read", "read_write"]);
+var CEAL_PERSONAL_ACCESS_CEILINGS = vocabulary(["disabled", "read", "read_write"]);
+var CEAL_TARGET_VISIBILITIES = vocabulary(["public", "private"]);
+var CEAL_PRINCIPAL_KINDS = vocabulary(["human", "service", "runtime"]);
+var CEAL_ORGANIZATION_ROLES = vocabulary(["member", "admin"]);
+var LABEL_EXPECTATION = `public-safe display text of at most ${CEAL_PUBLIC_DISPLAY_NAME_MAX_BYTES} bytes`;
+
 // packages/ceal-client-protocol/src/safe-json-budget.ts
 var SAFE_JSON_MIN_BYTES_PER_NODE = 4;
 function safeJsonNodeBudgetForBytes(maxBytes) {
@@ -435,7 +541,9 @@ var CEAL_OPERATION_JSON_SCHEMA_BUDGET = Object.freeze({
 });
 
 // packages/ceal-client-protocol/src/operation-validation-primitives.ts
-var ISO_TIMESTAMP = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/u;
+var ISO_TIMESTAMP = /^(\d{4})-(\d{2})-(\d{2})[Tt](\d{2}):(\d{2}):(\d{2})(?:\.(\d{1,9}))?([Zz]|([+-])(\d{2}):(\d{2}))$/u;
+var CEAL_CALENDAR_DATE_PATTERN_SOURCE = "^\\d{4}-\\d{2}-\\d{2}$";
+var CEAL_CALENDAR_DATE = new RegExp(CEAL_CALENDAR_DATE_PATTERN_SOURCE, "u");
 function isOperationRecord(value) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
   const prototype = Object.getPrototypeOf(value);
@@ -447,8 +555,56 @@ function requireOperationRecord(value, message) {
 function requireClosedValue(value, members, message) {
   if (typeof value !== "string" || !members.includes(value)) throw new TypeError(message);
 }
+function isCealIsoTimestamp(value) {
+  return typeof value === "string" && parseCealIsoTimestamp(value) !== null;
+}
+function parseCealIsoTimestamp(value) {
+  const fields = parseCealIsoTimestampFields(value);
+  if (fields === null || !validCalendarDate(fields) || !validClockTime(fields) || !validUtcOffset(fields)) return null;
+  const epochMilliseconds = cealFieldsEpochMilliseconds(fields);
+  if (!Number.isFinite(epochMilliseconds)) return null;
+  return {
+    epochNanoseconds: BigInt(epochMilliseconds) * 1000000n + BigInt(fields.fraction.padEnd(9, "0") || "0")
+  };
+}
+function parseCealIsoTimestampFields(value) {
+  const match = ISO_TIMESTAMP.exec(value);
+  if (match === null) return null;
+  return {
+    year: Number(match[1]),
+    month: Number(match[2]),
+    day: Number(match[3]),
+    hour: Number(match[4]),
+    minute: Number(match[5]),
+    second: Number(match[6]),
+    fraction: match[7] ?? "",
+    offsetSign: match[9] === void 0 ? 0 : match[9] === "+" ? 1 : -1,
+    offsetHour: Number(match[10] ?? 0),
+    offsetMinute: Number(match[11] ?? 0)
+  };
+}
+function validCalendarDate({ year, month, day }) {
+  return month >= 1 && month <= 12 && day >= 1 && day <= daysInMonth(year, month);
+}
+function validClockTime({ hour, minute, second }) {
+  return hour <= 23 && minute <= 59 && second <= 59;
+}
+function validUtcOffset({ offsetHour, offsetMinute }) {
+  return offsetHour <= 23 && offsetMinute <= 59;
+}
+function cealFieldsEpochMilliseconds(fields) {
+  const shiftedYear = fields.year < 100 ? fields.year + 400 : fields.year;
+  const cycleMilliseconds = fields.year < 100 ? (400 * 365 + 97) * 24 * 60 * 60 * 1e3 : 0;
+  const localMilliseconds = Date.UTC(shiftedYear, fields.month - 1, fields.day, fields.hour, fields.minute, fields.second, 0) - cycleMilliseconds;
+  const offsetMilliseconds = fields.offsetSign * (fields.offsetHour * 60 + fields.offsetMinute) * 6e4;
+  return localMilliseconds - offsetMilliseconds;
+}
+function daysInMonth(year, month) {
+  const leap = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+  return [31, leap ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31][month - 1] ?? 0;
+}
 function requireIsoTimestamp(value, message) {
-  if (typeof value !== "string" || !ISO_TIMESTAMP.test(value) || !Number.isFinite(Date.parse(value))) throw new TypeError(message);
+  if (!isCealIsoTimestamp(value)) throw new TypeError(message);
 }
 
 // packages/ceal-client-protocol/src/operation-json-schema.ts
@@ -470,7 +626,7 @@ var CLIENT_AUDIENCE_SET = new Set(CLIENT_AUDIENCES);
 // packages/ceal-client-protocol/src/schema-literals.ts
 var CEAL_SCHEMA_LITERALS = [
   "ceal.activation_transport.v1",
-  "ceal.capability_access.v1",
+  CEAL_OPERATION_ACCESS_SCHEMA_VERSION,
   CEAL_OPERATION_CATALOG_SCHEMA_VERSION,
   "ceal.client_refresh_request.v2",
   "ceal.client_refresh_result.v2",
@@ -493,7 +649,6 @@ var CEAL_SCHEMA_LITERALS = [
   "ceal.enrollment_exchange.v1",
   "ceal.enrollment_result.v1",
   "ceal.first_activation_causal_join.v1",
-  "ceal.gateway_aggregate_authorization_snapshot.v2",
   "ceal.gateway_announcement_policy.v1",
   "ceal.gateway_audit_call_detail.v1",
   "ceal.gateway_audit_event.v1",
@@ -501,7 +656,7 @@ var CEAL_SCHEMA_LITERALS = [
   "ceal.gateway_authorization_snapshot.v1",
   "ceal.gateway_cache_origin.v1",
   "ceal.gateway_call_result.v1",
-  "ceal.gateway_command_resolution.v1",
+  CEAL_GATEWAY_COMMAND_RESOLUTION_SCHEMA_VERSION,
   "ceal.gateway_connector_route_failure.v1",
   "ceal.gateway_discovery.v3",
   "ceal.gateway_handshake.v1",
@@ -536,7 +691,7 @@ var CEAL_SCHEMA_LITERALS = [
   "ceal.operation_receipt.v1",
   "ceal.operation_result.v1",
   "ceal.operation_result.compact.v1",
-  "ceal.local_result_materialization.v1",
+  "ceal.local_result_materialization.v2",
   "ceal.local_result_root.v1",
   "ceal.owner_bootstrap_exchange_request.v1",
   "ceal.owner_bootstrap_exchange_result.v1",
@@ -546,7 +701,8 @@ var CEAL_SCHEMA_LITERALS = [
   "ceal.request_cancellation.v1",
   "ceal.request_graph_revision.v1",
   "ceal.request_occurrence_correlation.v1",
-  "ceal.request_projection.v1"
+  "ceal.request_projection.v1",
+  "ceal.write_safety_finding.v1"
 ];
 var CEAL_SCHEMA_LITERAL_SET = new Set(CEAL_SCHEMA_LITERALS);
 
@@ -561,21 +717,14 @@ var CEAL_BOUNDED_SERIES_CATALOG = Object.freeze({
   thread_run_events: (root) => join(root, "run-events.jsonl"),
   bounded_store_sidecar: (root) => `${root}.jsonl`,
   gateway_audit_archive: (root) => `${root}.jsonl`,
-  gateway_capability_audit: (root) => join(root, "capability-audit.jsonl"),
-  gateway_retrieval_waste_partition: (root) => `${root}.jsonl`,
-  gateway_access_policy_publication: (root) => join(root, "access-policy-publications.jsonl"),
   gateway_access_group_connector_control_audit: (root) => `${root}.audit.jsonl`,
   gateway_access_group_connector_scope_audit: (root) => join(root, "profile-connector-scope-audit.jsonl"),
   gateway_access_group_connector_activity_scope_audit: (root) => join(root, "profile-connector-activity-scope-audit.jsonl"),
+  gateway_access_group_connector_calendar_scope_audit: (root) => join(root, "profile-connector-calendar-scope-audit.jsonl"),
   gateway_access_group_connector_readiness_audit: (root) => join(root, "profile-connector-readiness.audit.jsonl"),
   gateway_organization_audit_ledger: (root) => join(root, "organization-ledger.jsonl"),
   gateway_personal_client_audit: (root) => join(root, "audit.jsonl"),
-  gateway_personal_client_access_audit: (root) => join(root, "access-audit.jsonl"),
-  gateway_admin_enrollment: (root) => join(root, "enrollments.jsonl"),
-  gateway_admin_login: (root) => join(root, "logins.jsonl"),
-  gateway_admin_family: (root) => join(root, "families.jsonl"),
-  gateway_admin_refresh_token: (root) => join(root, "refresh-tokens.jsonl"),
-  gateway_admin_access_token: (root) => join(root, "access-tokens.jsonl")
+  gateway_personal_client_access_audit: (root) => join(root, "access-audit.jsonl")
 });
 
 // packages/ceal-client-protocol/src/gateway-installation-activation.ts
@@ -583,8 +732,21 @@ var CEAL_GATEWAY_INSTALLATION_ACTIVATION_CODE_DATA_CHARACTERS = 32;
 var CEAL_GATEWAY_INSTALLATION_ACTIVATION_CODE_CHECK_CHARACTERS = 8;
 var CEAL_GATEWAY_INSTALLATION_ACTIVATION_CODE_COMPACT_CHARACTERS = CEAL_GATEWAY_INSTALLATION_ACTIVATION_CODE_DATA_CHARACTERS + CEAL_GATEWAY_INSTALLATION_ACTIVATION_CODE_CHECK_CHARACTERS;
 
+// packages/ceal-client-protocol/src/gateway-entrypoint-commands.ts
+var GATEWAY_ENTRYPOINT_COMMANDS = Object.freeze([
+  Object.freeze({ id: "controlPlane", path: Object.freeze(["control-plane"]) }),
+  Object.freeze({ id: "originShow", path: Object.freeze(["origin", "show"]) }),
+  Object.freeze({ id: "credentialsImport", path: Object.freeze(["credentials", "import"]) }),
+  Object.freeze({ id: "initialize", path: Object.freeze(["init"]) })
+]);
+
 // packages/ceal-client-protocol/src/host-registration.ts
 var CEAL_HOST_REGISTRATION_RESULT_KEYS = Object.freeze(["credential_generation", "host_access_token", "host_installation_ref", "host_source_ref", "ok", "registration_attempt_ref", "schema_version", "status"]);
+var CEAL_LOWERCASE_UUID_PATTERN = "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}";
+var CEAL_HOST_REGISTRATION_ATTEMPT_REF_PATTERN = new RegExp(`^host-registration-attempt:${CEAL_LOWERCASE_UUID_PATTERN}$`, "u");
+var CEAL_HOST_INSTALLATION_REF_PATTERN = new RegExp(`^host-installation:${CEAL_LOWERCASE_UUID_PATTERN}$`, "u");
+var CEAL_HOST_SOURCE_REF_PATTERN = new RegExp(`^host-source:${CEAL_LOWERCASE_UUID_PATTERN}$`, "u");
+var CEAL_HOST_ACCESS_TOKEN_PATTERN = /^ceal_host_[A-Za-z0-9_-]{43}$/u;
 
 // packages/ceal-client-protocol/src/agent-session-handoff.ts
 var CEAL_AGENT_ADMISSION_PHASES = vocabulary([
@@ -616,12 +778,19 @@ var CEAL_AGENT_SERVICE_SESSION_RECORD_KEYS = vocabulary([
 var CEAL_AGENT_SESSION_COMMIT_KEYS = vocabulary(["attempt_ref", "expected_session_revision", "session_revision"]);
 
 // packages/ceal-client-protocol/src/operation-next-actions.ts
+var CEAL_REPEAT_REQUEST_NEXT_ACTION = "repeat_request";
+var CEAL_INSPECT_RECEIPT_NEXT_ACTION = "inspect_receipt";
 var CALLER_RECOVERABLE_NEXT_ACTION_VALUES = [
   "select_did_you_mean",
   "choose_new_output_path",
   "choose_new_idempotency_key",
   "restart_search",
   "repeat_original_arguments",
+  // The occurrence this call addressed is settled and cannot move again -- a
+  // denied effect approval, an expired continuation -- so the caller runs the
+  // same call again as a new request. The refusal names the re-request; this
+  // word is the re-request.
+  CEAL_REPEAT_REQUEST_NEXT_ACTION,
   "choose_new_request_identity",
   // A refusal that names the argument (invalid_argument with `property`) tells the caller exactly what to change.
   "correct_argument",
@@ -640,10 +809,35 @@ var CALLER_RECOVERABLE_NEXT_ACTION_VALUES = [
   "use_original_input",
   // The same mismatch on the Request binding rather than the input: the
   // occurrence was admitted under one binding and the replay presents another.
-  "use_original_request_binding"
+  "use_original_request_binding",
+  // The client's own filesystem write was refused -- EACCES, EPERM, or a
+  // read-only mount -- which is how an agent sandbox fences writes outside its
+  // workspace. The caller reruns the same command with unsandboxed or escalated
+  // execution; re-adopting the session cannot help, because the sandbox refuses
+  // that write too.
+  "rerun_outside_agent_sandbox",
+  // The refusal names the one Operation to read next in `describe_command`:
+  // an absent Operation id with a sole catalog-ranked candidate, or a known
+  // Operation invoked without its input. Describing only reads the verified
+  // contract and dispatches nothing, and the caller then retries with the
+  // named Operation or input, so it is guidance the scorer counts.
+  "describe_operation",
+  // The refusal names the caller's own personal connect Operation in
+  // `required_action_sequence`: the Operation asked for, or the credential
+  // the call ran on, needs a personal connection the caller does not hold
+  // (never connected, revoked, or expired). The caller runs that exact
+  // Operation, completes the consent it hands back, and retries the same call.
+  "connect_personal_account",
+  // The provider or Gateway named a bounded wait; the caller waits that long
+  // and submits the same read again.
+  "retry_after"
 ];
 var CEAL_CALLER_RECOVERABLE_NEXT_ACTIONS = Object.freeze(CALLER_RECOVERABLE_NEXT_ACTION_VALUES);
 var NON_REMEDY_NEXT_ACTION_VALUES = [
+  // Only an administrator can take the named step -- approving a place for an
+  // Operation, granting a withheld capability -- so a non-administrator asks
+  // one. The refusal names the administrator step; this word is the ask.
+  "ask_admin",
   "await_pending_approval",
   "check_gateway",
   "inspect_context_store",
@@ -658,9 +852,13 @@ var NON_REMEDY_NEXT_ACTION_VALUES = [
   "inspect_local_command",
   "inspect_local_output",
   "inspect_local_route",
-  "inspect_receipt",
+  CEAL_INSPECT_RECEIPT_NEXT_ACTION,
   "inspect_request",
   "none",
+  // The provider refused because of its own configuration -- an API not
+  // enabled, an app scope missing -- which an operator changes in that
+  // provider's console. No caller edit and no retry fixes it.
+  "operator_action",
   "recover",
   "reconcile",
   // Reconciliation of one named occurrence, not of the deployment: a legacy
@@ -668,6 +866,10 @@ var NON_REMEDY_NEXT_ACTION_VALUES = [
   // no edit to the call changes that. `reconcile` is the deployment-wide word.
   "reconcile_occurrence",
   "reduce_request_size",
+  // The Host's invocation context for this turn is stale or expired at the
+  // Gateway. The Host's next turn rebinds it and the same call then succeeds;
+  // nothing in the call changes, so it is not a remedy the scorer may count.
+  "refresh_host_invocation_context",
   "repair_or_adopt_session",
   "retry",
   // The owner -- a correlation hook, an approval hook -- is not serving right
@@ -681,10 +883,23 @@ var NON_REMEDY_NEXT_ACTION_VALUES = [
 var CEAL_NON_REMEDY_NEXT_ACTIONS = Object.freeze(NON_REMEDY_NEXT_ACTION_VALUES);
 var DECLARED = /* @__PURE__ */ new Set([...CEAL_CALLER_RECOVERABLE_NEXT_ACTIONS, ...CEAL_NON_REMEDY_NEXT_ACTIONS]);
 var RECOVERABLE = new Set(CEAL_CALLER_RECOVERABLE_NEXT_ACTIONS);
+var CEAL_OPERATION_WITHHELD_NEXT_ACTIONS = Object.freeze({
+  provider_permission: "ask_admin",
+  access_level: "ask_admin",
+  personal_authorization_required: "connect_personal_account"
+});
 
 // packages/ceal-client-protocol/src/operation-contract-artifact.ts
 var CATALOG_REVISION = new RegExp(CEAL_VERIFIED_ARTIFACT_CATALOG_REVISION_PATTERN, "u");
 var SHA256 = new RegExp(CEAL_VERIFIED_ARTIFACT_DIGEST_PATTERN, "u");
+var CEAL_OPERATION_INVOKE_COMMAND = "invoke";
+var CEAL_OPERATION_INPUT_FLAG = "--input";
+var CEAL_OPERATION_ID_PLACEHOLDER = "<operation-id>";
+var CEAL_OPERATION_INPUT_PLACEHOLDER = "<json-object>";
+var CEAL_MODEL_INVOCATION_ARGUMENTS = [CEAL_OPERATION_INVOKE_COMMAND, CEAL_OPERATION_ID_PLACEHOLDER, CEAL_OPERATION_INPUT_FLAG, shellSingleQuoted(CEAL_OPERATION_INPUT_PLACEHOLDER)].join(" ");
+function shellSingleQuoted(value) {
+  return `'${value.replaceAll("'", "'\\''")}'`;
+}
 var CEAL_OPERATION_CONTRACT_REQUIRED_FIELDS = Object.freeze(["input_schema", "result_schema"]);
 var CEAL_OPERATION_CONTRACT_OPTIONAL_FIELDS = Object.freeze(["summary", "input_resolution"]);
 var CEAL_VERIFIED_ARTIFACT_DESCRIPTOR_JSON_SCHEMA = Object.freeze({
@@ -713,9 +928,178 @@ var CEAL_VERIFIED_ARTIFACT_DESCRIPTOR_JSON_SCHEMA = Object.freeze({
   }
 });
 
+// packages/ceal-client-protocol/src/bare-document.ts
+var REQUIRED_FIELDS = CEAL_CLIENT_WIRE_CONTRACT.command_response.bare_document_fields;
+var OPTIONAL_FIELDS = CEAL_CLIENT_WIRE_CONTRACT.command_response.bare_document_optional_fields;
+
+// packages/ceal-client-protocol/src/leased-consumer-vocabulary.ts
+var CEAL_TERMINAL_DISPOSITIONS = vocabulary(["completed", "failed", "cancelled"]);
+var CEAL_LEASE_DISPOSITIONS = vocabulary([...CEAL_TERMINAL_DISPOSITIONS, "deferred"]);
+var CEAL_AUTOMATIC_FEEDBACK_INTENTS = vocabulary(["initial"]);
+var CEAL_LEASED_MESSAGE_DELIVERY_OPERATION_IDS = vocabulary(["message.send", "message.update", "message.delete"]);
+var CEAL_REPOSITORY_VISIBILITIES = vocabulary(["public", "private", "internal"]);
+var CEAL_RESULT_DELIVERY_OFFERS = vocabulary(["pending", "offered", "transport_lost"]);
+var CEAL_RESULT_DELIVERY_STATES = vocabulary(["unavailable", ...CEAL_RESULT_DELIVERY_OFFERS]);
+var CEAL_PROVIDER_OUTCOMES = vocabulary(["not_attempted", "outcome_unknown", "verified"]);
+var CEAL_ACTIVITY_GAP_CODES = vocabulary([
+  "provider_page_budget",
+  "call_deadline",
+  "related_item_budget",
+  "provider_cursor_unavailable",
+  "malformed_provider_page",
+  "visibility_incomplete",
+  "unsupported_event_kind"
+]);
+var CEAL_ACTIVITY_CONNECTOR_KINDS = vocabulary(["slack", "github", "google-calendar", "google-drive", "notion"]);
+var CEAL_ACTIVITY_COVERAGE_STATUSES = vocabulary(["complete_for_target", "continuation_required", "blocked"]);
+var CEAL_ACTIVITY_EVENT_KINDS = vocabulary([
+  "slack.message",
+  "slack.reply",
+  "slack.direct_message",
+  "github.commit.authored",
+  "github.issue.opened",
+  "github.pull_request.opened",
+  "github.review.submitted",
+  "github.issue_comment.created",
+  "github.review_comment.created",
+  "calendar.organized",
+  "calendar.accepted_invite",
+  "calendar.recorded",
+  "drive.file.created",
+  "drive.file.modified",
+  "drive.file.viewed",
+  "notion.page.created",
+  "notion.page.edited"
+]);
+var CEAL_ACTIVITY_TIMESTAMP_BASES = vocabulary([
+  "message_created",
+  "commit_authored",
+  "resource_created",
+  "review_submitted",
+  "comment_created",
+  "event_start",
+  "all_day_start",
+  "file_created",
+  "file_modified",
+  "file_modified_by_me",
+  "file_viewed_by_me",
+  "page_created",
+  "page_last_edited",
+  "resource_modified"
+]);
+var CEAL_ACTIVITY_V3_KINDS = vocabulary(["authored", "edited", "messaged", "responded"]);
+var CEAL_RESOURCE_TIME_BASES = vocabulary(["created", "modified", "viewed"]);
+var CEAL_RESOURCE_SEARCH_ORDERS = vocabulary(["relevance", "modified", "viewed", "created"]);
+var CEAL_RESOURCE_SEARCH_DIRECTIONS = vocabulary(["ascending", "descending"]);
+var CEAL_RESOURCE_SEARCH_FILTERS = vocabulary(["query", "modified_since", "kinds", "container_ref", "addressed_to_me", "unread"]);
+var CEAL_ARTIFACT_STAGE_TERMINALS = vocabulary(["chunk_accepted", "artifact_ready", "idempotency_replayed"]);
+var CEAL_READ_ITEM_KINDS = vocabulary(["conversation", "identity", "usergroup", "message", "file", "document"]);
+var CEAL_LEASED_MESSAGE_SEARCH_COMPLETENESS = vocabulary(["complete", "continuation_available", "truncated"]);
+var CEAL_OPAQUE_HANDLE_KINDS = vocabulary(["target", "message", "thread", "artifact", "document", "object"]);
+var CEAL_WRITE_OBJECT_KINDS = vocabulary(["document", "comment", "cell_range"]);
+var CEAL_CONVERSATION_KINDS = vocabulary(["channel", "dm", "group"]);
+var CEAL_FILE_TYPE_FAMILIES = vocabulary(["all", "image", "pdf"]);
+var CEAL_GITHUB_ISSUE_STATES = vocabulary(["open", "closed", "all"]);
+var CEAL_NOTION_UPDATABLE_BLOCK_TYPES = vocabulary([
+  "paragraph",
+  "heading_1",
+  "heading_2",
+  "heading_3",
+  "bulleted_list_item",
+  "numbered_list_item",
+  "to_do",
+  "code"
+]);
+var CEAL_NOTION_NEUTRAL_TYPES = vocabulary([
+  "text",
+  "number",
+  "boolean",
+  "date",
+  "select",
+  "multi_select",
+  "people",
+  "url",
+  "email",
+  "phone",
+  "unsupported"
+]);
+var CEAL_NOTION_IDENTITY_GAP_REASONS = vocabulary([
+  "identity_unavailable",
+  "identity_stale",
+  "identity_ambiguous",
+  "identity_revoked",
+  "identity_unlinked"
+]);
+var CEAL_NOTION_STRING_VALUE_TYPES = vocabulary(["text", "select", "url", "email", "phone"]);
+var CEAL_UNREAD_REASONS = vocabulary(["blocked", "unavailable", "too_large", "unsupported", "download_failed", "permission_denied"]);
+var CEAL_PLAN_ITEM_STATUSES = vocabulary(["pending", "active", "completed"]);
+var CEAL_FINAL_PRESENTATION_INTENTS = vocabulary(["final", "stop", "transient_notice"]);
+var CEAL_PRESENTATION_INTENTS = vocabulary(["progress", ...CEAL_FINAL_PRESENTATION_INTENTS]);
+
+// packages/ceal-client-protocol/src/resource-row.ts
+var RESOURCE_ROW_KEY_RULES = Object.freeze({
+  schema_version: { required: true, timestamp: false },
+  ref: { required: true, timestamp: false },
+  next: { required: true, timestamp: false },
+  kind: { required: true, timestamp: false },
+  title: { required: true, timestamp: false },
+  container_label: { required: true, timestamp: false },
+  container_ref: { required: false, timestamp: false },
+  source: { required: true, timestamp: false },
+  owner: { required: false, timestamp: false },
+  counterparts: { required: false, timestamp: false },
+  created_at: { required: false, timestamp: true },
+  created_at_local: { required: false, timestamp: true },
+  modified_at: { required: false, timestamp: true },
+  modified_at_local: { required: false, timestamp: true },
+  viewed_by_me_at: { required: false, timestamp: true },
+  visibility: { required: false, timestamp: false },
+  start: { required: false, timestamp: false },
+  end: { required: false, timestamp: false },
+  status: { required: false, timestamp: false },
+  snippet: { required: false, timestamp: false },
+  state: { required: true, timestamp: false },
+  timestamp_basis: { required: true, timestamp: false }
+});
+var RESOURCE_ROW_REQUIRED_KEYS = Object.entries(RESOURCE_ROW_KEY_RULES).flatMap(([key, rule]) => rule.required ? [key] : []);
+var RESOURCE_ROW_KEYS = new Set(Object.keys(RESOURCE_ROW_KEY_RULES));
+var RESOURCE_ROW_TIMESTAMP_KEYS = Object.entries(RESOURCE_ROW_KEY_RULES).flatMap(([key, rule]) => rule.timestamp ? [key] : []);
+
+// packages/ceal-client-protocol/src/resource-read-result.ts
+var CEAL_RESOURCE_GET_COVERAGE_NEXT_ACTIONS = vocabulary(["reduce_request_size", "read_resource_again"]);
+
+// packages/ceal-client-protocol/src/excluded-target-coverage-contract.ts
+var CEAL_EXCLUDED_TARGET_REASONS = vocabulary(["audience_narrower_than_place", "visibility_unknown"]);
+
+// packages/ceal-client-protocol/src/excluded-target-coverage.ts
+var CEAL_EXCLUDED_TARGET_COVERAGE_MAX_ENTRIES = 64;
+function cealExcludedTargetCoverageJsonSchema() {
+  const target = {
+    target_ref: { type: "string", minLength: 8, maxLength: 134, pattern: "^target:[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$" },
+    connector_kind: { type: "string", minLength: 1, maxLength: 64, pattern: "^[a-z][a-z0-9-]{0,63}$" },
+    label: { type: "string", minLength: 1, maxLength: CEAL_PUBLIC_DISPLAY_NAME_MAX_BYTES },
+    reason: { type: "string", enum: [...CEAL_EXCLUDED_TARGET_REASONS] }
+  };
+  return {
+    type: "array",
+    minItems: 1,
+    maxItems: CEAL_EXCLUDED_TARGET_COVERAGE_MAX_ENTRIES,
+    items: { type: "object", additionalProperties: false, maxProperties: 4, properties: target, required: ["target_ref", "reason"] }
+  };
+}
+
+// packages/ceal-client-protocol/src/write-safety-finding.ts
+var CEAL_WRITE_SAFETY_FINDING_STATUSES = vocabulary(["warning", "unchecked"]);
+var CEAL_WRITE_SAFETY_AUDIENCES = vocabulary(["workspace", "person", "members", "unknown"]);
+var CEAL_WRITE_SAFETY_REFERENCE_REASONS = vocabulary(["not_published_to_audience", "audience_access_unknown"]);
+var CEAL_WRITE_SAFETY_UNCHECKED_REASONS = vocabulary(["authority_unavailable"]);
+
 // packages/ceal-client-protocol/src/operation-occurrence.ts
 var MAX_RECEIPT_REVISION = Number.MAX_SAFE_INTEGER - 1;
 
+// packages/ceal-client-protocol/src/leased-artifact-contract.ts
+var CEAL_LEASED_CONSUMER_ARTIFACT_CHUNK_MAX_BYTES = 12 * 1024;
+
 // packages/ceal-client-protocol/src/leased-resource-stream.ts
 var CEAL_LEASED_CONSUMER_ATTACHMENT_STREAM_MAGIC = new Uint8Array([67, 69, 65, 76, 82, 83, 50, 0]);
 var CEAL_LEASED_CONSUMER_ATTACHMENT_STREAM_RECORD_PREFIX_BYTES = 8;
@@ -727,6 +1111,7 @@ var CEAL_ATTACHMENT_UNREAD_REASONS = vocabulary(["blocked", "unavailable", "too_
 // packages/ceal-client-protocol/src/request-validation-primitives.ts
 import { createHash } from "node:crypto";
 var DIGEST = /^[a-f0-9]{64}$/u;
+var CEAL_SHA256_DIGEST_PATTERN = DIGEST.source;
 function isCealDigest(value) {
   return typeof value === "string" && DIGEST.test(value);
 }
@@ -753,7 +1138,7 @@ var CANCELLATION_STATES = vocabulary(["requested", "cancelled"]);
 var CEAL_REQUEST_KEYS = Object.freeze(["schema_version", "ceal_request_ref", "created_at", "authority", "prompt_ref", "host_session_ref", "host_turn_ref", "host_source_ref"]);
 var CEAL_REQUEST_JSON_SCHEMA = {
   type: "object",
-  maxProperties: 9,
+  maxProperties: 10,
   additionalProperties: false,
   properties: {
     schema_version: { type: "string", const: CEAL_REQUEST_SCHEMA_VERSION, maxLength: 32 },
@@ -776,7 +1161,8 @@ var CEAL_REQUEST_JSON_SCHEMA = {
     host_session_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
     host_turn_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
     host_input_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
-    host_source_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source }
+    host_source_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
+    requester_timezone: { type: "string", minLength: 1, maxLength: 128, description: "IANA timezone observed for the requester on this Request." }
   },
   required: CEAL_REQUEST_KEYS
 };
@@ -826,21 +1212,26 @@ var REQUEST_NODE_STANDING_OCCURRENCE_SCHEMA = {
   },
   required: ["schema_version", "node_ref", "operation_id", "correlation_ref", "occurrence_ref", "graph_revision", "graph_revision_digest", "admitted_input_sha256", "reason"]
 };
+var REQUEST_EXECUTION_PREPARE_REFUSAL_PROPERTIES = {
+  schema_version: { type: "string", const: CEAL_OPERATION_ERROR_SCHEMA_VERSION, maxLength: 64 },
+  code: REQUEST_ACTION_SAFE_REF_SCHEMA,
+  message: { type: "string", minLength: 1, maxLength: 2048 },
+  property: { type: "string", minLength: 1, maxLength: 256 },
+  next_action: REQUEST_ACTION_SAFE_REF_SCHEMA,
+  retryable: { type: "boolean" },
+  source: { type: "string", enum: ["provider", "gateway"] },
+  retry_after_ms: { type: "integer", minimum: 0, maximum: CEAL_RETRY_AFTER_MAX_MS },
+  excluded_targets: cealExcludedTargetCoverageJsonSchema(),
+  repaired_input: {},
+  unrepaired_pointers: { type: "array", maxItems: 128, items: { type: "string", minLength: 1, maxLength: 256 } },
+  provider_handoff: { type: "string", const: "not_offered", maxLength: 32 },
+  cause: { type: "string", enum: [...CEAL_OPERATION_WITHHELD_CAUSES] }
+};
 var REQUEST_EXECUTION_PREPARE_REFUSAL_SCHEMA = {
   type: "object",
   additionalProperties: false,
-  maxProperties: 9,
-  properties: {
-    schema_version: { type: "string", const: CEAL_OPERATION_ERROR_SCHEMA_VERSION, maxLength: 64 },
-    code: REQUEST_ACTION_SAFE_REF_SCHEMA,
-    message: { type: "string", minLength: 1, maxLength: 2048 },
-    property: { type: "string", minLength: 1, maxLength: 256 },
-    next_action: REQUEST_ACTION_SAFE_REF_SCHEMA,
-    retryable: { type: "boolean" },
-    repaired_input: {},
-    unrepaired_pointers: { type: "array", maxItems: 128, items: { type: "string", minLength: 1, maxLength: 256 } },
-    provider_handoff: { type: "string", const: "not_offered", maxLength: 32 }
-  },
+  maxProperties: Object.keys(REQUEST_EXECUTION_PREPARE_REFUSAL_PROPERTIES).length,
+  properties: REQUEST_EXECUTION_PREPARE_REFUSAL_PROPERTIES,
   required: ["schema_version", "code", "message", "next_action", "retryable"]
 };
 var CEAL_REQUEST_EXECUTION_ORDERS = vocabulary(["graph_dependency", "caller"]);
@@ -1023,6 +1414,7 @@ var CEAL_REQUEST_GRAPH_NODE_PREPARE_READINESS_JSON_SCHEMA = {
 // packages/ceal-client-protocol/src/host-invocation-authentication.ts
 var CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_SCHEMA = "ceal.host_invocation_authentication_result.v1";
 var CEAL_HOST_INVOCATION_CONTEXT_PATH = "/api/ceal/v2/host-invocation-context";
+var CEAL_HOST_INGRESS_PATH = "/api/ceal/v2/host-ingress";
 var CEAL_HOST_CLIENT_NONCE_PATTERN = /^[A-Za-z0-9_-]{43}$/u;
 var CEAL_HOST_CONTEXT_TOKEN_PATTERN = /^ceal_context_[A-Za-z0-9_-]{43}$/u;
 function decodeCealHostInvocationAuthenticationResult(value, now = /* @__PURE__ */ new Date()) {
@@ -1041,16 +1433,14 @@ function exactKeys(value, expected) {
 }
 
 // packages/ceal-client-protocol/src/client-result-materialization.ts
-var REQUIRED_FIELDS = Object.freeze(["schema_version", "operation_id", "local_path", "content_json_pointer", "size_bytes", "sha256", "read_argv"]);
-var FIELDS = /* @__PURE__ */ new Set([...REQUIRED_FIELDS, "local_result_root", "model_disclosure"]);
+var CEAL_MODEL_VISIBLE_COMMAND_OUTPUT_MAX_BYTES = 32 * 1024;
+var REQUIRED_FIELDS2 = Object.freeze(["schema_version", "operation_id", "read_argv"]);
+var FIELDS = /* @__PURE__ */ new Set([...REQUIRED_FIELDS2, "local_result_root"]);
 
 // packages/ceal-client-protocol/src/session-start-affordance.ts
 var CEAL_SESSION_ENTRY_INVOCATION = "ceal";
 var CEAL_LINK_RESOURCE_PRECEDENCE = `When the user asks to use Ceal or provides a link to information that may be available through installed organizational capabilities, run bare \`${CEAL_SESSION_ENTRY_INVOCATION}\`. The Host supplies the current user prompt without exposing it to the client command, and the Gateway returns the applicable entry in that one response. Treat a supplied link as a candidate Ceal resource rather than a public web-search target. Reach for a generic web fetch or web search only when the Gateway offered nothing.`;
 
-// packages/ceal-client-protocol/src/discovery-manifest.ts
-var CEAL_DISCOVERY_MANIFEST_CONNECTOR_KINDS = vocabulary(["github", "google-workspace", "notion", "slack"]);
-
 // packages/ceal-client-protocol/src/conversation-contracts.ts
 var CEAL_APPROVAL_POLICY_KINDS = vocabulary(["requester_only", "named_users", "role_based"]);
 var CEAL_APPROVAL_TARGET_KINDS = vocabulary([
@@ -1093,38 +1483,18 @@ var CEAL_GATEWAY_ANNOUNCEMENT_POLICY_NON_CLAIMS = vocabulary([
 
 // packages/ceal-client-protocol/src/gateway-discovery-response-validation.ts
 var ANNOUNCEMENT_POLICY_CAPABILITY_BINDINGS = Object.freeze({
-  "github.repository.get": [{ effect: "read", scopeStatementKind: "github_app_installation_repositories", providerAuthorityKind: "github_app" }],
-  "collection.search": [{ effect: "read", scopeStatementKind: "github_app_installation_repositories", providerAuthorityKind: "github_app" }],
-  "github.issue.get": [{ effect: "read", scopeStatementKind: "github_app_installation_repositories", providerAuthorityKind: "github_app" }],
-  "github.pull_request.get": [{ effect: "read", scopeStatementKind: "github_app_installation_repositories", providerAuthorityKind: "github_app" }],
+  "repository.get": [{ effect: "read", scopeStatementKind: "github_app_installation_repositories", providerAuthorityKind: "github_app" }],
+  "resource.search": [{ effect: "read", scopeStatementKind: "github_app_installation_repositories", providerAuthorityKind: "github_app" }],
   "github.workflow_run.get": [{ effect: "read", scopeStatementKind: "github_app_installation_repositories", providerAuthorityKind: "github_app" }],
   "message.search": [{ effect: "read", scopeStatementKind: "slack_public_app_member_channels_only", providerAuthorityKind: "slack_app" }],
-  "message.get": [{ effect: "read", scopeStatementKind: "slack_public_app_member_channels_only", providerAuthorityKind: "slack_app" }],
-  "resource.resolve": [
-    { effect: "read", scopeStatementKind: "slack_public_app_member_channels_only", providerAuthorityKind: "slack_app" },
-    { effect: "read", scopeStatementKind: "notion_connected_logical_area", providerAuthorityKind: "notion_integration" }
-  ],
-  "conversation.thread.get": [{ effect: "read", scopeStatementKind: "slack_public_app_member_channels_only", providerAuthorityKind: "slack_app" }],
   "notion.search": [{ effect: "read", scopeStatementKind: "notion_connected_logical_area", providerAuthorityKind: "notion_integration" }],
-  "notion.page.get": [{ effect: "read", scopeStatementKind: "notion_connected_logical_area", providerAuthorityKind: "notion_integration" }],
-  "calendar.availability": [{ effect: "read", scopeStatementKind: "google_workspace_calendar_read_only", providerAuthorityKind: "google_service_account" }],
-  "calendar.event.search": [{ effect: "read", scopeStatementKind: "google_workspace_calendar_read_only", providerAuthorityKind: "google_service_account" }],
-  "calendar.event.get": [{ effect: "read", scopeStatementKind: "google_workspace_calendar_read_only", providerAuthorityKind: "google_service_account" }],
-  "file.search": [{ effect: "read", scopeStatementKind: "google_workspace_ceal_drive_or_direct_share_metadata", providerAuthorityKind: "google_service_account" }],
-  "sheets.values.read": [{ effect: "read", scopeStatementKind: "google_workspace_ceal_drive_or_direct_share_sheet_ranges", providerAuthorityKind: "google_service_account" }],
-  "sheets.tabs.list": [{ effect: "read", scopeStatementKind: "google_workspace_ceal_drive_or_direct_share_sheet_tabs", providerAuthorityKind: "google_service_account" }],
-  "sheets.values.update": [{ effect: "write", scopeStatementKind: "google_workspace_ceal_drive_or_direct_share_editable_sheet_ranges", providerAuthorityKind: "google_service_account" }],
-  "sheets.values.clear": [{ effect: "write", scopeStatementKind: "google_workspace_ceal_drive_or_direct_share_editable_sheet_clear_ranges", providerAuthorityKind: "google_service_account" }]
-});
-var ANNOUNCEMENT_SCOPE_STATEMENTS = Object.freeze({
-  github_app_installation_repositories: "Repositories in the installed GitHub App installation.",
-  slack_public_app_member_channels_only: "Public channels where the installed Slack app is a member; private channels, direct messages, multi-person direct messages, and requester membership are not declared by this connector.",
-  notion_connected_logical_area: "Connected Notion logical area under provider-enforced sharing; descendant inventory is not declared.",
-  google_workspace_calendar_read_only: "Approved Calendar availability and event reads only; Calendar mutation is not declared.",
-  google_workspace_ceal_drive_or_direct_share_metadata: "Metadata search for files in the organization shared drive named Ceal Drive and files directly shared with the provider application; file-content read and mutation are not declared.",
-  google_workspace_ceal_drive_or_direct_share_sheet_ranges: "Bounded values reads from governed Google Sheets in the organization shared drive named Ceal Drive and directly shared files; file mutation is not declared.",
-  google_workspace_ceal_drive_or_direct_share_editable_sheet_ranges: "Bounded values updates in governed editable Google Sheets in the organization shared drive named Ceal Drive and directly shared files; Docs, Slides, and other Drive file mutation are not declared.",
-  google_workspace_ceal_drive_or_direct_share_editable_sheet_clear_ranges: "Bounded values clears in governed editable Google Sheets in the organization shared drive named Ceal Drive and directly shared files; Docs, Slides, and other Drive file mutation are not declared."
+  "resource.get": [{ effect: "read", scopeStatementKind: "notion_connected_logical_area", providerAuthorityKind: "notion_integration" }],
+  "availability.get": [{ effect: "read", scopeStatementKind: "google_workspace_calendar_read_only", providerAuthorityKind: "google_service_account" }],
+  "event.search": [{ effect: "read", scopeStatementKind: "google_workspace_calendar_read_only", providerAuthorityKind: "google_service_account" }],
+  "file.search": [{ effect: "read", scopeStatementKind: "google_workspace_admitted_drive_target_metadata", providerAuthorityKind: "google_service_account" }],
+  "cell_range.get": [{ effect: "read", scopeStatementKind: "google_workspace_admitted_drive_target_sheet_ranges", providerAuthorityKind: "google_service_account" }],
+  "sheet.list": [{ effect: "read", scopeStatementKind: "google_workspace_admitted_drive_target_sheet_tabs", providerAuthorityKind: "google_service_account" }],
+  "cell_range.update": [{ effect: "write", scopeStatementKind: "google_workspace_admitted_drive_target_editable_sheet_ranges", providerAuthorityKind: "google_service_account" }]
 });
 
 // packages/ceal-client-protocol/src/gateway-write-identity.ts
@@ -1181,112 +1551,29 @@ var ADMIN_LINEAGE_NODE_KINDS = vocabulary(["source_read", "synthesis_preview", "
 // packages/ceal-client-protocol/src/actor-kind.ts
 var CEAL_ACTOR_KINDS = vocabulary(["human", "bot", "app", "unknown"]);
 
-// packages/ceal-client-protocol/src/leased-consumer-vocabulary.ts
-var CEAL_TERMINAL_DISPOSITIONS = vocabulary(["completed", "failed", "cancelled"]);
-var CEAL_LEASE_DISPOSITIONS = vocabulary([...CEAL_TERMINAL_DISPOSITIONS, "deferred"]);
-var CEAL_AUTOMATIC_FEEDBACK_INTENTS = vocabulary(["initial"]);
-var CEAL_LEASED_MESSAGE_DELIVERY_CAPABILITY_IDS = vocabulary(["message.create", "message.update", "message.delete"]);
-var CEAL_REPOSITORY_VISIBILITIES = vocabulary(["public", "private", "internal"]);
-var CEAL_RESULT_DELIVERY_OFFERS = vocabulary(["pending", "offered", "transport_lost"]);
-var CEAL_RESULT_DELIVERY_STATES = vocabulary(["unavailable", ...CEAL_RESULT_DELIVERY_OFFERS]);
-var CEAL_PROVIDER_OUTCOMES = vocabulary(["not_attempted", "outcome_unknown", "verified"]);
-var CEAL_ACTIVITY_GAP_CODES = vocabulary([
-  "provider_page_budget",
-  "related_item_budget",
-  "provider_cursor_unavailable",
-  "malformed_provider_page",
-  "visibility_incomplete",
-  "unsupported_event_kind"
-]);
-var CEAL_ACTIVITY_COVERAGE_STATUSES = vocabulary(["complete_for_target", "continuation_required", "blocked"]);
-var CEAL_ACTIVITY_EVENT_KINDS = vocabulary([
-  "slack.message",
-  "slack.reply",
-  "github.commit.authored",
-  "github.issue.opened",
-  "github.pull_request.opened",
-  "github.review.submitted",
-  "github.issue_comment.created",
-  "github.review_comment.created",
-  "calendar.organized",
-  "calendar.accepted_invite",
-  "calendar.recorded"
-]);
-var CEAL_ACTIVITY_TIMESTAMP_BASES = vocabulary([
-  "message_created",
-  "commit_authored",
-  "resource_created",
-  "review_submitted",
-  "comment_created",
-  "event_start",
-  "all_day_start"
+// packages/ceal-client-protocol/src/personal-client-vocabulary.ts
+var CEAL_PERSONAL_CLIENT_BINDING_KEYS = vocabulary([
+  "access_group_ref",
+  "membership_ref",
+  "registration_ref",
+  "client_ref",
+  "subject_ref",
+  "instance_ref"
 ]);
-var CEAL_ARTIFACT_STAGE_TERMINALS = vocabulary(["chunk_accepted", "artifact_ready", "idempotency_replayed"]);
-var CEAL_READ_ITEM_KINDS = vocabulary(["conversation", "identity", "usergroup", "message", "file", "document"]);
-var CEAL_RESOURCE_RESOLVE_KINDS = vocabulary(["conversation", "identity", "usergroup", "permalink"]);
-var CEAL_OPAQUE_HANDLE_KINDS = vocabulary(["target", "message", "thread", "artifact", "document", "object"]);
-var CEAL_WRITE_OBJECT_KINDS = vocabulary(["document", "comment", "cell_range"]);
-var CEAL_CONVERSATION_KINDS = vocabulary(["channel", "dm", "group"]);
-var CEAL_FILE_TYPE_FAMILIES = vocabulary(["all", "image", "pdf"]);
-var CEAL_GITHUB_ISSUE_STATES = vocabulary(["open", "closed", "all"]);
-var CEAL_NOTION_UPDATABLE_BLOCK_TYPES = vocabulary([
-  "paragraph",
-  "heading_1",
-  "heading_2",
-  "heading_3",
-  "bulleted_list_item",
-  "numbered_list_item",
-  "to_do",
-  "code"
-]);
-var CEAL_NOTION_NEUTRAL_TYPES = vocabulary([
-  "text",
-  "number",
-  "boolean",
-  "date",
-  "select",
-  "multi_select",
-  "people",
-  "url",
-  "email",
-  "phone",
-  "unsupported"
-]);
-var CEAL_NOTION_IDENTITY_GAP_REASONS = vocabulary([
-  "identity_unavailable",
-  "identity_stale",
-  "identity_ambiguous",
-  "identity_revoked",
-  "identity_unlinked"
-]);
-var CEAL_NOTION_STRING_VALUE_TYPES = vocabulary(["text", "select", "url", "email", "phone"]);
-var CEAL_UNREAD_REASONS = vocabulary(["blocked", "unavailable", "too_large", "unsupported", "download_failed", "permission_denied"]);
-var CEAL_PLAN_ITEM_STATUSES = vocabulary(["pending", "active", "completed"]);
-var CEAL_FINAL_PRESENTATION_INTENTS = vocabulary(["final", "stop", "transient_notice"]);
-var CEAL_PRESENTATION_INTENTS = vocabulary(["progress", ...CEAL_FINAL_PRESENTATION_INTENTS]);
-
-// packages/ceal-client-protocol/src/personal-client-vocabulary.ts
-var CEAL_PERSONAL_CLIENT_BINDING_KEYS = vocabulary([
-  "access_group_ref",
-  "membership_ref",
-  "registration_ref",
-  "client_ref",
-  "subject_ref",
-  "instance_ref"
-]);
-var CEAL_ENROLLMENT_FAILURE_CODES = vocabulary(["enrollment_invalid", "enrollment_expired", "enrollment_used"]);
-var CEAL_REFRESH_FAILURE_CODES = vocabulary([
-  "refresh_invalid",
-  "refresh_expired",
-  "refresh_inactive",
-  "refresh_replayed",
-  "refresh_revoked",
-  "authority_replaced",
-  "refresh_recovery_unavailable"
+var CEAL_ENROLLMENT_FAILURE_CODES = vocabulary(["enrollment_invalid", "enrollment_expired", "enrollment_used"]);
+var CEAL_REFRESH_FAILURE_CODES = vocabulary([
+  "refresh_invalid",
+  "refresh_expired",
+  "refresh_inactive",
+  "refresh_replayed",
+  "refresh_revoked",
+  "authority_replaced",
+  "refresh_recovery_unavailable",
+  "refresh_recovery_expired"
 ]);
 
 // packages/ceal-client-protocol/src/device-enrollment.ts
-var CEAL_DEVICE_ENROLLMENT_POLL_FAILURE_CODES = Object.freeze(["unsupported_feature", "recovery_required", "expired"]);
+var CEAL_DEVICE_ENROLLMENT_POLL_FAILURE_CODES = Object.freeze(["unsupported_feature", "recovery_required", "expired", "denied"]);
 var POLL_RESULT_KEYS = Object.freeze(["retry_after_ms", "schema_version", "status"]);
 
 // packages/ceal-client-protocol/src/personal-client-session.ts
@@ -1298,7 +1585,6 @@ var MAX_ARGUMENT_BYTES = 16 * 1024;
 var HANDSHAKE_IDENTITY_KEYS = Object.freeze(["membership_ref", "registration_ref", "client_ref", "subject_ref", "instance_ref"]);
 var AUDIT_IDENTITY_KEYS = Object.freeze(["event_ref", "membership_ref", "registration_ref", "client_ref", "subject_ref", "instance_ref"]);
 var FAILURE_RESPONSE_KEYS = Object.freeze(["error", "ok", "proof_ref_or_unavailable", "protocol_version", "request_id"]);
-var MAX_RECOVERY_RETRY_AFTER_MS = 60 * 60 * 1e3;
 
 // host/invocation-authentication-client-command.ts
 var MAX_DETAIL_CHARACTERS = 240;
@@ -1309,8 +1595,8 @@ function hostTerminalFailure(error, component) {
   if (code === "ENOENT") return { code: "host_dependency_unavailable", message: `A command or file the ${component} Host needs is unavailable: ${detail}`, next_action: "Install the missing dependency or restore the missing file, then rerun this command." };
   if (code === "EACCES" || code === "EPERM") return { code: "host_permission_denied", message: `The ${component} Host was refused access to a local path: ${detail}`, next_action: "Repair the ownership or mode of the named path, then rerun this command." };
   if (code === "ENOSPC") return { code: "host_storage_unavailable", message: `The ${component} Host could not write local state: ${detail}`, next_action: "Free local disk space, then rerun this command." };
-  if (code !== null && HOST_OWNED_CODE.test(code)) return { code, message: `The ${component} Host command failed: ${detail}`, next_action: `Resolve the named failure above; run \`ceal-host doctor --json\` only if it reports installed ${component} Host drift.` };
-  return { code: "host_failure_unclassified", message: `The ${component} Host command failed for a cause it cannot classify: ${detail}`, next_action: `Run \`ceal-host doctor --json\`; if it reports no drift then the ${component} Host configuration is not the cause, and the message above is the only evidence of what is.` };
+  if (code !== null && HOST_OWNED_CODE.test(code)) return { code, message: `The ${component} Host command failed: ${detail}`, next_action: `Resolve the named failure above; run \`ceal-host doctor\` only if it reports installed ${component} Host drift.` };
+  return { code: "host_failure_unclassified", message: `The ${component} Host command failed for a cause it cannot classify: ${detail}`, next_action: `Run \`ceal-host doctor\`; if it reports no drift then the ${component} Host configuration is not the cause, and the message above is the only evidence of what is.` };
 }
 var DOCTOR_FLAGS = Object.freeze({
   "--expected-sha256": "expected_sha256",
@@ -1326,10 +1612,56 @@ function errorCode(error) {
   return typeof error === "object" && error !== null && "code" in error && typeof error.code === "string" ? error.code : null;
 }
 
-// host/relay/src/host-relay-runtime.ts
-import { O_NOFOLLOW as O_NOFOLLOW3, O_RDONLY as O_RDONLY4 } from "node:constants";
-import { lstat as lstat4, open as open4 } from "node:fs/promises";
-import { dirname as dirname3, join as join6 } from "node:path";
+// host/service-log.ts
+import { copyFile, open, stat, truncate } from "node:fs/promises";
+import { isAbsolute } from "node:path";
+var HOST_SERVICE_LOG_ENVIRONMENT = "CEAL_HOST_SERVICE_LOG";
+var HOST_SERVICE_LOG_MAX_BYTES = 1024 * 1024;
+var HOST_SERVICE_LOG_CHECK_INTERVAL_MS = 6e4;
+function hostServiceLogPreviousPath(path) {
+  return `${path}.1`;
+}
+async function rotateHostServiceLog(path, maxBytes = HOST_SERVICE_LOG_MAX_BYTES) {
+  let size;
+  try {
+    size = (await stat(path)).size;
+  } catch (error) {
+    if (isNotFound(error)) return false;
+    throw error;
+  }
+  if (size <= maxBytes) return false;
+  await copyFile(path, hostServiceLogPreviousPath(path));
+  await truncate(path, 0);
+  return true;
+}
+function boundHostServiceLog(environment = process.env) {
+  const path = environment[HOST_SERVICE_LOG_ENVIRONMENT];
+  if (path === void 0 || !isAbsolute(path)) return () => void 0;
+  let reported = false;
+  const check = () => {
+    rotateHostServiceLog(path).catch((error) => {
+      if (reported) return;
+      reported = true;
+      process.stderr.write(`[host-service-log] rotation_failed code=${errorCode2(error)}
+`);
+    });
+  };
+  check();
+  const timer = setInterval(check, HOST_SERVICE_LOG_CHECK_INTERVAL_MS);
+  timer.unref();
+  return () => clearInterval(timer);
+}
+var HOST_SERVICE_LOG_TAIL_BYTES = 64 * 1024;
+function isNotFound(error) {
+  return errorCode2(error) === "ENOENT";
+}
+function errorCode2(error) {
+  return typeof error === "object" && error !== null && "code" in error && typeof error.code === "string" ? error.code : "unknown";
+}
+
+// host/runtime-source-paths.ts
+import { createHash as createHash2 } from "node:crypto";
+import { posix as posix2, win32 as win322 } from "node:path";
 
 // host/absolute-path.ts
 import { posix, win32 } from "node:path";
@@ -1338,6 +1670,37 @@ function isAbsoluteNormalizedNonRootPath(value, flavor = process.platform, allow
   return typeof value === "string" && value.length <= 4096 && !value.includes("\0") && pathApi.isAbsolute(value) && pathApi.normalize(value) === value && (allowRoot || pathApi.parse(value).root !== value);
 }
 
+// host/runtime-source-paths.ts
+var HOST_SOURCE_ID = /^host-source:([0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12})$/u;
+function hostSourceUuid(sourceRef) {
+  return HOST_SOURCE_ID.exec(sourceRef)?.[1] ?? null;
+}
+function hostRuntimeSourcePaths(stateRoot, sourceRef, platform = process.platform) {
+  const sourceId = hostSourceUuid(sourceRef);
+  if (!isAbsoluteNormalizedNonRootPath(stateRoot, platform) || sourceId === null) throw new TypeError("Host runtime source identity is invalid.");
+  const path = platform === "win32" ? win322 : posix2;
+  const sourcesRoot = path.join(stateRoot, "sources");
+  const sourceRoot = path.join(sourcesRoot, sourceId);
+  const runtimeRoot = path.join(stateRoot, "run");
+  const endpoint = platform === "win32" ? `\\\\.\\pipe\\ceal-host-${createHash2("sha256").update(`${stateRoot}\0${sourceRef}`).digest("hex").slice(0, 24)}` : path.join(runtimeRoot, `${sourceId}.sock`);
+  assertHostRuntimeIpcLength(endpoint, platform);
+  return { sourceId, sourcesRoot, sourceRoot, relayRoot: path.join(sourceRoot, "relay"), codexOutbox: path.join(sourceRoot, "producers", "codex", "outbox"), claudeOutbox: path.join(sourceRoot, "producers", "claude", "outbox"), endpoint, runtimeRoot };
+}
+function assertHostRuntimeIpcLength(endpoint, platform) {
+  if (platform === "win32") return;
+  const maximum = platform === "linux" ? 107 : 103;
+  if (Buffer.byteLength(endpoint, "utf8") > maximum) throw Object.assign(new TypeError(`ipc_endpoint_too_long: Host IPC path exceeds ${maximum} bytes; use a shorter Host state root.`), { code: "ipc_endpoint_too_long" });
+}
+function assertHostRelaySourcePaths(stateRoot, config, platform = process.platform) {
+  const paths = hostRuntimeSourcePaths(stateRoot, config.host_source_ref, platform);
+  if (config.state_root !== paths.relayRoot || config.ipc_endpoint !== paths.endpoint) throw new TypeError("Host Relay state and IPC must belong to its configured source.");
+}
+
+// host/relay/src/host-relay-runtime.ts
+import { O_NOFOLLOW as O_NOFOLLOW3, O_RDONLY as O_RDONLY4 } from "node:constants";
+import { lstat as lstat4, open as open5 } from "node:fs/promises";
+import { dirname as dirname3, join as join6 } from "node:path";
+
 // host/abortable-wait.ts
 function waitForAbort(signal, milliseconds) {
   if (signal.aborted) return Promise.resolve();
@@ -1422,7 +1785,7 @@ function skipWhitespace(text, start) {
 }
 
 // host/relay/src/producer-frame.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 var HOST_PRODUCER_FRAME_SCHEMA = "ceal.host_producer_frame.v1";
 var HOST_PRODUCER_MAX_JSON_BYTES = 262144;
 var HOST_PRODUCER_FRAME_LENGTH_BYTES = Uint32Array.BYTES_PER_ELEMENT;
@@ -1468,7 +1831,7 @@ function decodeHostProducerFrame(input) {
   return value;
 }
 function hostProducerFrameHash(frame) {
-  return createHash2("sha256").update(JSON.stringify(frame), "utf8").digest("hex");
+  return createHash3("sha256").update(JSON.stringify(frame), "utf8").digest("hex");
 }
 function hostProducerIdentityRefs(hostSourceRef, frame, localSessionRef, localTurnRef, localInputRef) {
   if (!opaqueHostSourceRef(hostSourceRef)) throw new TypeError("Gateway host source reference is invalid.");
@@ -1589,20 +1952,20 @@ function exactOptional(value, required, optional) {
 
 // host/relay/src/relay-admission-store.ts
 import { readFile as readFile2 } from "node:fs/promises";
-import { join as join3 } from "node:path";
+import { join as join4 } from "node:path";
 
 // host/relay/src/durable-atomic-replacement.ts
 import { O_RDONLY } from "node:constants";
-import { lstat, mkdir, open, rename, unlink } from "node:fs/promises";
+import { lstat, mkdir, open as open2, rename, unlink } from "node:fs/promises";
 import { dirname } from "node:path";
 var DEFAULT_PORT = {
   platform: process.platform,
   mkdir: (path, options) => mkdir(path, options),
   lstat: (path) => lstat(path),
-  open_file: (path) => open(path, "wx", 384),
+  open_file: (path) => open2(path, "wx", 384),
   rename,
   unlink,
-  open_directory: (path) => open(path, O_RDONLY),
+  open_directory: (path) => open2(path, O_RDONLY),
   unique_ref: () => `${process.pid}.${crypto.randomUUID()}`
 };
 async function durableAtomicReplace(target, data, port = DEFAULT_PORT) {
@@ -1662,7 +2025,7 @@ async function removeTemporary(path, port, failures) {
   try {
     await port.unlink(path);
   } catch (error) {
-    if (errorCode2(error) !== "ENOENT") failures.push(error);
+    if (errorCode3(error) !== "ENOENT") failures.push(error);
   }
 }
 function throwFailures(failures) {
@@ -1670,16 +2033,255 @@ function throwFailures(failures) {
   if (failures.length > 1) throw new AggregateError(failures, "Host Relay durable replacement and cleanup failed.");
 }
 function directorySyncUnsupported(error) {
-  return ["EINVAL", "ENOSYS", "ENOTSUP"].includes(errorCode2(error) ?? "");
+  return ["EINVAL", "ENOSYS", "ENOTSUP"].includes(errorCode3(error) ?? "");
 }
-function errorCode2(error) {
+function errorCode3(error) {
   return typeof error === "object" && error !== null && "code" in error ? String(error.code) : null;
 }
 
+// host/relay/src/relay-request-binding-store.ts
+import { O_NOFOLLOW, O_RDONLY as O_RDONLY2 } from "node:constants";
+import { open as open3 } from "node:fs/promises";
+import { join as join2 } from "node:path";
+var HOST_RELAY_REQUEST_BINDING_SCHEMA = "ceal.host_relay_request_binding.v1";
+var STATE_SCHEMA = "ceal.host_relay_request_binding_state.v1";
+var SAFE_REF3 = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
+var MAX_BINDINGS = 8192;
+var MAX_STATE_BYTES = 8 * 1024 * 1024;
+var HostRelayBindingError = class extends TypeError {
+  name = "HostRelayBindingError";
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+};
+var RelayRequestBindingStore = class {
+  tail = Promise.resolve();
+  bindingWaiters = /* @__PURE__ */ new Set();
+  root;
+  constructor(root) {
+    if (typeof root !== "string" || root.length === 0) throw new TypeError("Host Relay binding root is invalid.");
+    this.root = root;
+  }
+  bind(input, now = /* @__PURE__ */ new Date()) {
+    const run = this.tail.then(() => this.bindLocked(input, now));
+    this.tail = run.then(() => void 0, () => void 0);
+    return run;
+  }
+  query(input) {
+    const run = this.tail.then(() => this.queryLocked(input));
+    this.tail = run.then(() => void 0, () => void 0);
+    return run;
+  }
+  waitForBinding(input, signal) {
+    validateQuery(input);
+    if (signal.aborted) return Promise.reject(new Error("Host Relay binding wait cancelled."));
+    return new Promise((resolve, reject) => {
+      let settled = false;
+      const finish = (result2, error) => {
+        if (settled) return;
+        settled = true;
+        this.bindingWaiters.delete(waiter);
+        signal.removeEventListener("abort", waiter.abort);
+        if (error !== void 0) reject(error);
+        else if (result2?.status === "ready") resolve(result2);
+      };
+      const abort = () => finish(void 0, new Error("Host Relay binding wait cancelled."));
+      const waiter = { query: input, resolve: (result2) => finish(result2), abort };
+      this.bindingWaiters.add(waiter);
+      signal.addEventListener("abort", abort, { once: true });
+      void this.query(input).then((result2) => {
+        if (result2.status === "ready") finish(result2);
+      }, (error) => finish(void 0, error));
+    });
+  }
+  async bindLocked(input, now) {
+    const candidate = bindingFromGateway(input, now);
+    const state = await this.read();
+    const existing = state.bindings.find((item) => sameCanonicalIdentity(item, candidate));
+    if (existing !== void 0) {
+      if (!sameBinding(existing, candidate)) throw new HostRelayBindingError("canonical_turn_rebound", `Host Relay canonical turn is already bound to another Request: ${refusalFacts([{ name: "candidate_request_ref", value: candidate.request_ref, expected: existing.request_ref }, { name: "candidate_prompt_ref", value: candidate.prompt_ref, expected: existing.prompt_ref }, { name: "candidate_context_expires_at", value: candidate.context_expires_at, expected: String(existing.context_expires_at) }, { name: "candidate_local_turn_aliases", value: candidate.local_turn_aliases, expected: JSON.stringify(existing.local_turn_aliases) }])}.`);
+      return existing;
+    }
+    if (state.bindings.length >= MAX_BINDINGS) throw new HostRelayBindingError("binding_capacity_exhausted", `Host Relay request binding capacity is exhausted: ${refusalFact("binding_count", state.bindings.length, `below ${MAX_BINDINGS}`)}.`);
+    const next = { schema_version: STATE_SCHEMA, bindings: [...state.bindings, candidate] };
+    await this.write(next);
+    this.resolveBindingWaiters(candidate);
+    return structuredClone(candidate);
+  }
+  resolveBindingWaiters(binding) {
+    for (const waiter of this.bindingWaiters) {
+      if (relayRequestBindingMatchesQuery(waiter.query, binding)) waiter.resolve({ status: "ready", binding: structuredClone(binding) });
+    }
+  }
+  async queryLocked(input) {
+    validateQuery(input);
+    const state = await this.read();
+    const matches = state.bindings.filter((binding2) => relayRequestBindingMatchesQuery(input, binding2));
+    if (matches.length === 0) return { status: "no_binding" };
+    const binding = matches[0];
+    if (binding === void 0) throw new TypeError("Host Relay binding query result is invalid.");
+    return { status: "ready", binding: structuredClone(binding) };
+  }
+  async read() {
+    let handle;
+    try {
+      handle = await open3(join2(this.root, "request-bindings.json"), O_RDONLY2 | O_NOFOLLOW);
+      const stats = await handle.stat();
+      if (!stats.isFile() || !ownerPrivate2(stats)) throw new TypeError(`Host Relay binding state is unsafe: ${refusalFacts([{ name: "state_is_file", value: stats.isFile(), expected: "true" }, { name: "state_uid", value: stats.uid, expected: String(process.geteuid?.() ?? stats.uid) }, { name: "state_mode", value: (stats.mode & 511).toString(8), expected: "no group or other permission bits" }])}.`);
+      if (stats.size > MAX_STATE_BYTES) throw new TypeError(`Host Relay binding state is unsafe: ${refusalFact("state_bytes", stats.size, `at most ${MAX_STATE_BYTES}`)}.`);
+      return decodeState(JSON.parse(await handle.readFile("utf8")));
+    } catch (error) {
+      if (errorCode4(error) === "ENOENT") return { schema_version: STATE_SCHEMA, bindings: [] };
+      throw error;
+    } finally {
+      await handle?.close();
+    }
+  }
+  async write(state) {
+    const encoded = JSON.stringify(state);
+    if (Buffer.byteLength(encoded, "utf8") > MAX_STATE_BYTES) throw new TypeError(`Host Relay binding state is too large: ${refusalFact("state_bytes", Buffer.byteLength(encoded, "utf8"), `at most ${MAX_STATE_BYTES}`)}.`);
+    await durableAtomicReplace(join2(this.root, "request-bindings.json"), encoded);
+  }
+};
+function relayRequestWorkContextFromBinding(binding) {
+  return createRelayRequestWorkContext({ request_ref: binding.request_ref, host_binding: {
+    host_source_ref: binding.host_source_ref,
+    host_session_ref: binding.host_session_ref,
+    host_turn_ref: binding.host_turn_ref,
+    host_input_ref: binding.host_input_ref,
+    prompt_ref: binding.prompt_ref
+  } });
+}
+function createRelayRequestWorkContext(input) {
+  if (!record2(input) || !exactKeys3(input, ["request_ref", "host_binding"]) || !safeRef2(input.request_ref) || !record2(input.host_binding)) {
+    throw new HostRelayBindingError("context_identity_missing", "Host Relay work context does not contain the complete acknowledged Host tuple.");
+  }
+  const hostBinding = input.host_binding;
+  if (!exactKeys3(hostBinding, ["host_source_ref", "host_session_ref", "host_turn_ref", "host_input_ref", "prompt_ref"]) || ![hostBinding.host_source_ref, hostBinding.host_session_ref, hostBinding.host_turn_ref, hostBinding.host_input_ref, hostBinding.prompt_ref].every(safeRef2)) {
+    throw new HostRelayBindingError("context_identity_missing", "Host Relay work context does not contain the complete acknowledged Host tuple.");
+  }
+  const hostSourceRef = requiredRef(hostBinding.host_source_ref);
+  const hostSessionRef = requiredRef(hostBinding.host_session_ref);
+  const hostTurnRef = requiredRef(hostBinding.host_turn_ref);
+  const hostInputRef = requiredRef(hostBinding.host_input_ref);
+  const promptRef = requiredRef(hostBinding.prompt_ref);
+  return Object.freeze({ request_ref: input.request_ref, host_binding: Object.freeze({
+    host_source_ref: hostSourceRef,
+    host_session_ref: hostSessionRef,
+    host_turn_ref: hostTurnRef,
+    host_input_ref: hostInputRef,
+    prompt_ref: promptRef
+  }) });
+}
+function bindingFromGateway(input, now) {
+  const payload = input.frame.payload;
+  const candidate = {
+    schema_version: HOST_RELAY_REQUEST_BINDING_SCHEMA,
+    producer_id: input.frame.producer_id,
+    producer_installation_ref: input.frame.producer_installation_ref,
+    local_session_ref: requiredRef(payload.local_session_ref),
+    local_turn_ref: requiredRef(payload.local_turn_ref),
+    local_turn_aliases: optionalRefs2(payload.local_turn_aliases),
+    prompt_ref: requiredRef(input.prompt_ref),
+    request_ref: requiredRef(input.request_ref),
+    bound_at: timestamp2(now.toISOString()),
+    ...payload.context_expires_at === void 0 ? {} : { context_expires_at: timestamp2(payload.context_expires_at) },
+    host_source_ref: requiredRef(input.host_binding.host_source_ref),
+    host_session_ref: requiredRef(input.host_binding.host_session_ref),
+    host_turn_ref: requiredRef(input.host_binding.host_turn_ref),
+    host_input_ref: requiredRef(input.host_binding.host_input_ref)
+  };
+  if (input.host_binding.prompt_ref !== input.prompt_ref) throw new HostRelayBindingError("context_identity_mismatch", "Host Relay binding prompt reference does not match the acknowledged submission.");
+  validateBinding(candidate);
+  return candidate;
+}
+function decodeState(value) {
+  if (!record2(value) || !exactKeys3(value, ["schema_version", "bindings"])) throw new TypeError(`Host Relay binding state is invalid: ${refusalFact("state_keys", record2(value) ? Object.keys(value) : [], "exactly schema_version and bindings")}.`);
+  if (value.schema_version !== STATE_SCHEMA) throw new TypeError(`Host Relay binding state is invalid: ${refusalFact("schema_version", value.schema_version, STATE_SCHEMA)}.`);
+  if (!Array.isArray(value.bindings)) throw new TypeError(`Host Relay binding state is invalid: ${refusalFact("bindings", value.bindings, "an array")}.`);
+  const bindings = value.bindings.map((item) => {
+    validateBinding(item);
+    return item;
+  });
+  const keys = bindings.map(bindingKey);
+  if (new Set(keys).size !== keys.length) throw new TypeError("Host Relay binding state contains duplicate canonical turns.");
+  return { schema_version: STATE_SCHEMA, bindings };
+}
+function validateBinding(value) {
+  if (!record2(value) || !exactOptionalKeys(value, ["schema_version", "producer_id", "producer_installation_ref", "local_session_ref", "local_turn_ref", "local_turn_aliases", "prompt_ref", "request_ref", "bound_at", "host_source_ref", "host_session_ref", "host_turn_ref", "host_input_ref"], ["context_expires_at"]) || !validBindingIdentity(value) || !validBindingRequest(value)) throw new TypeError("Host Relay request binding is invalid.");
+}
+function validBindingIdentity(value) {
+  return value.schema_version === HOST_RELAY_REQUEST_BINDING_SCHEMA && producer(value.producer_id) && [value.producer_installation_ref, value.local_session_ref, value.local_turn_ref].every(safeRef2) && refList(value.local_turn_aliases);
+}
+function validBindingRequest(value) {
+  const tuple = [value.host_source_ref, value.host_session_ref, value.host_turn_ref, value.host_input_ref];
+  return safeRef2(value.prompt_ref) && safeRef2(value.request_ref) && validTimestamp(value.bound_at) && (value.context_expires_at === void 0 || validTimestamp(value.context_expires_at)) && tuple.every(safeRef2);
+}
+function validateQuery(value) {
+  if (!record2(value) || !exactKeys3(value, ["producer_id", "producer_installation_ref", "local_session_ref", "local_turn_ref"]) || !producer(value.producer_id) || !safeRef2(value.producer_installation_ref) || !safeRef2(value.local_session_ref) || !safeRef2(value.local_turn_ref)) throw new TypeError("Host Relay binding query is invalid.");
+}
+function relayRequestBindingMatchesQuery(query, binding) {
+  return query.producer_id === binding.producer_id && query.local_session_ref === binding.local_session_ref && (query.local_turn_ref === binding.local_turn_ref || binding.local_turn_aliases.includes(query.local_turn_ref)) && query.producer_installation_ref === binding.producer_installation_ref;
+}
+function sameCanonicalIdentity(left, right) {
+  return bindingKey(left) === bindingKey(right);
+}
+function sameBinding(left, right) {
+  return left.request_ref === right.request_ref && left.prompt_ref === right.prompt_ref && left.context_expires_at === right.context_expires_at && left.host_source_ref === right.host_source_ref && left.host_session_ref === right.host_session_ref && left.host_turn_ref === right.host_turn_ref && left.host_input_ref === right.host_input_ref && JSON.stringify(left.local_turn_aliases) === JSON.stringify(right.local_turn_aliases);
+}
+function bindingKey(value) {
+  return `${value.producer_id}\0${value.producer_installation_ref}\0${value.local_session_ref}\0${value.local_turn_ref}`;
+}
+function requiredRef(value) {
+  if (!safeRef2(value)) throw new TypeError("Host Relay binding reference is invalid.");
+  return value;
+}
+function optionalRefs2(value) {
+  if (value === void 0) return [];
+  if (!refList(value)) throw new TypeError("Host Relay binding aliases are invalid.");
+  return [...value];
+}
+function timestamp2(value) {
+  if (!validTimestamp(value)) throw new TypeError("Host Relay binding timestamp is invalid.");
+  return value;
+}
+function producer(value) {
+  return value === "codex" || value === "claude";
+}
+function safeRef2(value) {
+  return typeof value === "string" && SAFE_REF3.test(value);
+}
+function refList(value) {
+  return Array.isArray(value) && value.length <= 16 && value.every(safeRef2) && new Set(value).size === value.length;
+}
+function validTimestamp(value) {
+  return typeof value === "string" && Number.isFinite(Date.parse(value));
+}
+function record2(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function exactKeys3(value, keys) {
+  return Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+}
+function exactOptionalKeys(value, required, optional) {
+  const keys = Object.keys(value);
+  return required.every((key) => Object.hasOwn(value, key)) && keys.every((key) => required.includes(key) || optional.includes(key));
+}
+function errorCode4(error) {
+  return record2(error) && typeof error.code === "string" ? error.code : null;
+}
+function ownerPrivate2(stats) {
+  if (process.platform === "win32") return true;
+  const uid = typeof process.geteuid === "function" ? process.geteuid() : stats.uid;
+  return stats.uid === uid && (stats.mode & 63) === 0;
+}
+
 // host/relay/src/relay-quarantine-store.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 import { readFile } from "node:fs/promises";
-import { join as join2 } from "node:path";
+import { join as join3 } from "node:path";
 var RELAY_QUARANTINE_SCHEMA = "ceal.host_relay_quarantine_state.v1";
 var RELAY_QUARANTINE_MAX_RECORDS = 512;
 var RELAY_QUARANTINE_MAX_BYTES = 16 * 1024 * 1024;
@@ -1720,27 +2322,27 @@ var RelayQuarantineStore = class {
       const raw = Buffer.from(rawFrame).subarray(0, MAX_CAPTURE_BYTES);
       const state = await this.readState();
       const record6 = {
-        quarantine_ref: `quarantine:${createHash3("sha256").update(`${producerId}\0${reason}\0${capturedAt}\0`).update(raw).digest("hex")}`,
+        quarantine_ref: `quarantine:${createHash4("sha256").update(`${producerId}\0${reason}\0${capturedAt}\0`).update(raw).digest("hex")}`,
         producer_id: producerId,
         reason,
         captured_at: capturedAt,
-        frame_sha256: createHash3("sha256").update(raw).digest("hex"),
+        frame_sha256: createHash4("sha256").update(raw).digest("hex"),
         charged_bytes: raw.byteLength,
         raw_frame_base64: raw.toString("base64")
       };
       const records = state.producers[producerId];
       records.push(record6);
       while (records.length > this.maxRecords || totalBytes(records) > this.maxBytes) records.shift();
-      await durableAtomicReplace(join2(this.root, "quarantine.json"), JSON.stringify(state));
+      await durableAtomicReplace(join3(this.root, "quarantine.json"), JSON.stringify(state));
     });
     this.tail = run.then(() => void 0, () => void 0);
     await run;
   }
   async readState() {
     try {
-      return decodeState(JSON.parse(await readFile(join2(this.root, "quarantine.json"), "utf8")));
+      return decodeState2(JSON.parse(await readFile(join3(this.root, "quarantine.json"), "utf8")));
     } catch (error) {
-      if (errorCode3(error) === "ENOENT") return emptyState();
+      if (errorCode5(error) === "ENOENT") return emptyState();
       throw error;
     }
   }
@@ -1751,9 +2353,9 @@ function emptyState() {
 function totalBytes(records) {
   return records.reduce((total, record6) => total + record6.charged_bytes, 0);
 }
-function decodeState(value) {
-  if (!record2(value) || value.schema_version !== RELAY_QUARANTINE_SCHEMA) throw new TypeError(`Host Relay quarantine state is invalid: ${refusalFact("schema_version", record2(value) ? value.schema_version : void 0, RELAY_QUARANTINE_SCHEMA)}.`);
-  if (!record2(value.producers)) throw new TypeError(`Host Relay quarantine state is invalid: ${refusalFact("producer_ids", record2(value.producers) ? Object.keys(value.producers) : [], `the ${PRODUCERS2.length} quarantine producer buckets`)}.`);
+function decodeState2(value) {
+  if (!record3(value) || value.schema_version !== RELAY_QUARANTINE_SCHEMA) throw new TypeError(`Host Relay quarantine state is invalid: ${refusalFact("schema_version", record3(value) ? value.schema_version : void 0, RELAY_QUARANTINE_SCHEMA)}.`);
+  if (!record3(value.producers)) throw new TypeError(`Host Relay quarantine state is invalid: ${refusalFact("producer_ids", record3(value.producers) ? Object.keys(value.producers) : [], `the ${PRODUCERS2.length} quarantine producer buckets`)}.`);
   const state = emptyState();
   for (const producerId of PRODUCERS2) {
     const records = value.producers[producerId];
@@ -1763,7 +2365,7 @@ function decodeState(value) {
   return state;
 }
 function validRecord(value) {
-  if (!record2(value) || typeof value.quarantine_ref !== "string" || !quarantineProducer(value.producer_id) || typeof value.reason !== "string" || !Number.isFinite(Date.parse(String(value.captured_at))) || typeof value.frame_sha256 !== "string" || typeof value.charged_bytes !== "number" || !Number.isSafeInteger(value.charged_bytes) || value.charged_bytes < 0 || typeof value.raw_frame_base64 !== "string") return false;
+  if (!record3(value) || typeof value.quarantine_ref !== "string" || !quarantineProducer(value.producer_id) || typeof value.reason !== "string" || !Number.isFinite(Date.parse(String(value.captured_at))) || typeof value.frame_sha256 !== "string" || typeof value.charged_bytes !== "number" || !Number.isSafeInteger(value.charged_bytes) || value.charged_bytes < 0 || typeof value.raw_frame_base64 !== "string") return false;
   return true;
 }
 function quarantineProducer(value) {
@@ -1772,16 +2374,16 @@ function quarantineProducer(value) {
 function inferProducer(rawFrame) {
   try {
     const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(Buffer.from(rawFrame).subarray(4)));
-    return record2(value) && (value.producer_id === "codex" || value.producer_id === "claude") ? value.producer_id : "unknown";
+    return record3(value) && (value.producer_id === "codex" || value.producer_id === "claude") ? value.producer_id : "unknown";
   } catch {
     return "unknown";
   }
 }
-function record2(value) {
+function record3(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function errorCode3(error) {
-  return record2(error) && typeof error.code === "string" ? error.code : null;
+function errorCode5(error) {
+  return record3(error) && typeof error.code === "string" ? error.code : null;
 }
 
 // host/relay/src/relay-admission-store.ts
@@ -1791,11 +2393,12 @@ var RETRY_SECONDS = [1, 2, 4, 8, 16, 32, 60];
 var MAX_RETRYABLE_ATTEMPTS = RETRY_SECONDS.length + 10;
 var RelayAdmissionStore = class {
   tail = Promise.resolve();
+  drainWaiters = /* @__PURE__ */ new Set();
   root;
   quarantine;
   limits;
   faultHooks;
-  constructor(root, limits = DEFAULT_LIMITS, faultHooks = {}, quarantine = new RelayQuarantineStore(join3(root, "quarantine"))) {
+  constructor(root, limits = DEFAULT_LIMITS, faultHooks = {}, quarantine = new RelayQuarantineStore(join4(root, "quarantine"))) {
     this.root = root;
     this.quarantine = quarantine;
     this.limits = limits;
@@ -1810,10 +2413,36 @@ var RelayAdmissionStore = class {
     await this.tail;
     return this.read();
   }
+  async hasPendingRequestBinding(query) {
+    const state = await this.read();
+    return state.entries.some((entry2) => pendingFrameMatchesBindingQuery(entry2, query));
+  }
   async drainRound(deliver, options) {
     const run = this.tail.then(() => this.drainLocked(deliver, options));
     this.tail = run.then(() => void 0, () => void 0);
-    return run;
+    const result2 = await run;
+    if (result2.delivered.length > 0 || result2.refused.length > 0 || result2.retained.length > 0) this.resolveDrainWaiters();
+    return result2;
+  }
+  waitForDrainChange(signal) {
+    if (signal.aborted) return Promise.reject(new Error("Host Relay admission wait cancelled."));
+    return new Promise((resolve, reject) => {
+      let settled = false;
+      const finish = (error) => {
+        if (settled) return;
+        settled = true;
+        this.drainWaiters.delete(waiter);
+        signal.removeEventListener("abort", waiter.abort);
+        if (error !== void 0) reject(error);
+        else resolve();
+      };
+      const waiter = { resolve: () => finish(), abort: () => finish(new Error("Host Relay admission wait cancelled.")) };
+      this.drainWaiters.add(waiter);
+      signal.addEventListener("abort", waiter.abort, { once: true });
+    });
+  }
+  resolveDrainWaiters() {
+    for (const waiter of this.drainWaiters) waiter.resolve();
   }
   async admitLocked(frame) {
     const state = await this.read();
@@ -1870,308 +2499,109 @@ var RelayAdmissionStore = class {
       if (!installation2) throw new TypeError("Host Relay delivery installation is unavailable.");
       if (outcome.status === "refused" || exhausted) {
         await this.quarantine.retainFrame(head.frame, "gateway_refused");
-        installation2.last_refusal = { sequence: head.sequence, submission_ref: input.submission_ref, ...refusalCause(outcome, head), refused_at_ms: options.now_ms };
-        refused.push(input.submission_ref);
-      } else {
-        await options.after_gateway_accept_before_delivery_fsync?.({ fault_point: "after_gateway_accept_before_delivery_fsync", delivery: structuredClone(input) });
-        delivered.push(input.submission_ref);
-      }
-      state.entries.splice(state.entries.indexOf(head), 1);
-      installation2.delivered_through_sequence = Math.max(installation2.delivered_through_sequence, head.sequence);
-      await this.write(state);
-    }
-    return { delivered, retained, refused };
-  }
-  async read() {
-    try {
-      return decodeState2(JSON.parse(await readFile2(join3(this.root, "admission.json"), "utf8")));
-    } catch (error) {
-      if (errorCode4(error) === "ENOENT") return { schema_version: "ceal.host_relay_admission_state.v1", installations: {}, entries: [] };
-      throw error;
-    }
-  }
-  async write(state) {
-    await durableAtomicReplace(join3(this.root, "admission.json"), JSON.stringify(state));
-  }
-};
-function installationKey(frame) {
-  return `${frame.producer_id}\0${frame.producer_installation_ref}`;
-}
-function replayCode(existing, hash, sequence, installation2) {
-  if (existing !== void 0) return existing.hash === hash ? "already_admitted" : "frame_identity_conflict";
-  return sequence <= installation2.delivered_through_sequence ? "already_admitted" : null;
-}
-function bytes(entries) {
-  return entries.reduce((total, entry2) => total + entry2.charged_bytes, 0);
-}
-function retryExhausted(outcome, entry2) {
-  return outcome.status === "retryable" && entry2.retry_attempts >= MAX_RETRYABLE_ATTEMPTS;
-}
-function refusalCause(outcome, entry2) {
-  if (outcome.status === "refused") return { code: outcome.code, message: outcome.message };
-  const reason = outcome.status === "retryable" ? outcome.reason ?? "no reason reported" : "no reason reported";
-  return { code: "retry_exhausted", message: `Gateway delivery stayed retryable through ${entry2.retry_attempts} attempts: ${reason}` };
-}
-function scheduleRetry(entry2, nowMs, reason) {
-  if (reason === void 0) delete entry2.retry_reason;
-  else entry2.retry_reason = reason;
-  entry2.retry_attempts += 1;
-  entry2.retry_at_ms = nowMs + 1e3 * (RETRY_SECONDS[Math.min(entry2.retry_attempts - 1, RETRY_SECONDS.length - 1)] ?? 60);
-}
-function result(code, state) {
-  return { code, admitted_through_sequence: state.admitted_through_sequence, delivered_through_sequence: state.delivered_through_sequence };
-}
-function errorCode4(error) {
-  return typeof error === "object" && error !== null && "code" in error ? String(error.code) : null;
-}
-function decodeState2(value) {
-  if (!stateRecord(value)) throw new TypeError("Host Relay admission state is invalid.");
-  const installations = {};
-  for (const [key, item] of Object.entries(value.installations)) {
-    if (!installation(item)) throw new TypeError("Host Relay installation state is invalid.");
-    installations[key] = item;
-  }
-  const entries = [];
-  for (const item of value.entries) {
-    if (!entry(item)) throw new TypeError("Host Relay entry state is invalid.");
-    entries.push(item);
-  }
-  return { schema_version: "ceal.host_relay_admission_state.v1", installations, entries };
-}
-function stateRecord(value) {
-  return object(value) && value.schema_version === "ceal.host_relay_admission_state.v1" && object(value.installations) && Array.isArray(value.entries);
-}
-function installation(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value) && "epoch" in value && "admitted_through_sequence" in value && "delivered_through_sequence" in value && [value.epoch, value.admitted_through_sequence, value.delivered_through_sequence].every(Number.isSafeInteger) && (!("last_refusal" in value) || refusalRecord(value.last_refusal));
-}
-function refusalRecord(value) {
-  return object(value) && Number.isSafeInteger(value.sequence) && typeof value.submission_ref === "string" && typeof value.code === "string" && typeof value.message === "string" && Number.isSafeInteger(value.refused_at_ms);
-}
-function entry(value) {
-  return object(value) && producer(value.producer_id) && typeof value.producer_installation_ref === "string" && Number.isSafeInteger(value.sequence) && typeof value.hash === "string" && Number.isSafeInteger(value.charged_bytes) && object(value.frame) && Number.isSafeInteger(value.retry_attempts) && Number.isSafeInteger(value.retry_at_ms);
-}
-function producer(value) {
-  return value === "codex" || value === "claude";
-}
-function object(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
-// host/relay/src/relay-gateway-bridge.ts
-import { readFile as readFile3 } from "node:fs/promises";
-import { join as join5 } from "node:path";
-
-// host/relay/src/relay-request-binding-store.ts
-import { O_NOFOLLOW, O_RDONLY as O_RDONLY2 } from "node:constants";
-import { open as open2 } from "node:fs/promises";
-import { join as join4 } from "node:path";
-var HOST_RELAY_REQUEST_BINDING_SCHEMA = "ceal.host_relay_request_binding.v1";
-var STATE_SCHEMA = "ceal.host_relay_request_binding_state.v1";
-var SAFE_REF3 = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
-var MAX_BINDINGS = 8192;
-var MAX_STATE_BYTES = 8 * 1024 * 1024;
-var HostRelayBindingError = class extends TypeError {
-  name = "HostRelayBindingError";
-  code;
-  constructor(code, message) {
-    super(message);
-    this.code = code;
-  }
-};
-var RelayRequestBindingStore = class {
-  tail = Promise.resolve();
-  root;
-  constructor(root) {
-    if (typeof root !== "string" || root.length === 0) throw new TypeError("Host Relay binding root is invalid.");
-    this.root = root;
-  }
-  bind(input, now = /* @__PURE__ */ new Date()) {
-    const run = this.tail.then(() => this.bindLocked(input, now));
-    this.tail = run.then(() => void 0, () => void 0);
-    return run;
-  }
-  query(input) {
-    const run = this.tail.then(() => this.queryLocked(input));
-    this.tail = run.then(() => void 0, () => void 0);
-    return run;
-  }
-  async bindLocked(input, now) {
-    const candidate = bindingFromGateway(input, now);
-    const state = await this.read();
-    const existing = state.bindings.find((item) => sameCanonicalIdentity(item, candidate));
-    if (existing !== void 0) {
-      if (!sameBinding(existing, candidate)) throw new HostRelayBindingError("canonical_turn_rebound", `Host Relay canonical turn is already bound to another Request: ${refusalFacts([{ name: "candidate_request_ref", value: candidate.request_ref, expected: existing.request_ref }, { name: "candidate_prompt_ref", value: candidate.prompt_ref, expected: existing.prompt_ref }, { name: "candidate_context_expires_at", value: candidate.context_expires_at, expected: String(existing.context_expires_at) }, { name: "candidate_local_turn_aliases", value: candidate.local_turn_aliases, expected: JSON.stringify(existing.local_turn_aliases) }])}.`);
-      return existing;
-    }
-    if (state.bindings.length >= MAX_BINDINGS) throw new HostRelayBindingError("binding_capacity_exhausted", `Host Relay request binding capacity is exhausted: ${refusalFact("binding_count", state.bindings.length, `below ${MAX_BINDINGS}`)}.`);
-    const next = { schema_version: STATE_SCHEMA, bindings: [...state.bindings, candidate] };
-    await this.write(next);
-    return structuredClone(candidate);
-  }
-  async queryLocked(input) {
-    validateQuery(input);
-    const state = await this.read();
-    const matches = state.bindings.filter((binding2) => queryMatches(input, binding2));
-    if (matches.length === 0) return { status: "no_binding" };
-    const binding = matches[0];
-    if (binding === void 0) throw new TypeError("Host Relay binding query result is invalid.");
-    return { status: "ready", binding: structuredClone(binding) };
+        installation2.last_refusal = { sequence: head.sequence, submission_ref: input.submission_ref, ...refusalCause(outcome, head), refused_at_ms: options.now_ms };
+        refused.push(input.submission_ref);
+      } else {
+        await options.after_gateway_accept_before_delivery_fsync?.({ fault_point: "after_gateway_accept_before_delivery_fsync", delivery: structuredClone(input) });
+        delivered.push(input.submission_ref);
+      }
+      state.entries.splice(state.entries.indexOf(head), 1);
+      installation2.delivered_through_sequence = Math.max(installation2.delivered_through_sequence, head.sequence);
+      await this.write(state);
+    }
+    return { delivered, retained, refused };
   }
   async read() {
-    let handle;
     try {
-      handle = await open2(join4(this.root, "request-bindings.json"), O_RDONLY2 | O_NOFOLLOW);
-      const stats = await handle.stat();
-      if (!stats.isFile() || !ownerPrivate2(stats)) throw new TypeError(`Host Relay binding state is unsafe: ${refusalFacts([{ name: "state_is_file", value: stats.isFile(), expected: "true" }, { name: "state_uid", value: stats.uid, expected: String(process.geteuid?.() ?? stats.uid) }, { name: "state_mode", value: (stats.mode & 511).toString(8), expected: "no group or other permission bits" }])}.`);
-      if (stats.size > MAX_STATE_BYTES) throw new TypeError(`Host Relay binding state is unsafe: ${refusalFact("state_bytes", stats.size, `at most ${MAX_STATE_BYTES}`)}.`);
-      return decodeState3(JSON.parse(await handle.readFile("utf8")));
+      return decodeState3(JSON.parse(await readFile2(join4(this.root, "admission.json"), "utf8")));
     } catch (error) {
-      if (errorCode5(error) === "ENOENT") return { schema_version: STATE_SCHEMA, bindings: [] };
+      if (errorCode6(error) === "ENOENT") return { schema_version: "ceal.host_relay_admission_state.v1", installations: {}, entries: [] };
       throw error;
-    } finally {
-      await handle?.close();
     }
   }
   async write(state) {
-    const encoded = JSON.stringify(state);
-    if (Buffer.byteLength(encoded, "utf8") > MAX_STATE_BYTES) throw new TypeError(`Host Relay binding state is too large: ${refusalFact("state_bytes", Buffer.byteLength(encoded, "utf8"), `at most ${MAX_STATE_BYTES}`)}.`);
-    await durableAtomicReplace(join4(this.root, "request-bindings.json"), encoded);
+    await durableAtomicReplace(join4(this.root, "admission.json"), JSON.stringify(state));
   }
 };
-function relayRequestWorkContextFromBinding(binding) {
-  return createRelayRequestWorkContext({ request_ref: binding.request_ref, host_binding: {
-    host_source_ref: binding.host_source_ref,
-    host_session_ref: binding.host_session_ref,
-    host_turn_ref: binding.host_turn_ref,
-    host_input_ref: binding.host_input_ref,
-    prompt_ref: binding.prompt_ref
-  } });
-}
-function createRelayRequestWorkContext(input) {
-  if (!record3(input) || !exactKeys3(input, ["request_ref", "host_binding"]) || !safeRef2(input.request_ref) || !record3(input.host_binding)) {
-    throw new HostRelayBindingError("context_identity_missing", "Host Relay work context does not contain the complete acknowledged Host tuple.");
-  }
-  const hostBinding = input.host_binding;
-  if (!exactKeys3(hostBinding, ["host_source_ref", "host_session_ref", "host_turn_ref", "host_input_ref", "prompt_ref"]) || ![hostBinding.host_source_ref, hostBinding.host_session_ref, hostBinding.host_turn_ref, hostBinding.host_input_ref, hostBinding.prompt_ref].every(safeRef2)) {
-    throw new HostRelayBindingError("context_identity_missing", "Host Relay work context does not contain the complete acknowledged Host tuple.");
-  }
-  const hostSourceRef = requiredRef(hostBinding.host_source_ref);
-  const hostSessionRef = requiredRef(hostBinding.host_session_ref);
-  const hostTurnRef = requiredRef(hostBinding.host_turn_ref);
-  const hostInputRef = requiredRef(hostBinding.host_input_ref);
-  const promptRef = requiredRef(hostBinding.prompt_ref);
-  return Object.freeze({ request_ref: input.request_ref, host_binding: Object.freeze({
-    host_source_ref: hostSourceRef,
-    host_session_ref: hostSessionRef,
-    host_turn_ref: hostTurnRef,
-    host_input_ref: hostInputRef,
-    prompt_ref: promptRef
-  }) });
-}
-function bindingFromGateway(input, now) {
-  const payload = input.frame.payload;
-  const candidate = {
-    schema_version: HOST_RELAY_REQUEST_BINDING_SCHEMA,
-    producer_id: input.frame.producer_id,
-    producer_installation_ref: input.frame.producer_installation_ref,
-    local_session_ref: requiredRef(payload.local_session_ref),
-    local_turn_ref: requiredRef(payload.local_turn_ref),
-    local_turn_aliases: optionalRefs2(payload.local_turn_aliases),
-    prompt_ref: requiredRef(input.prompt_ref),
-    request_ref: requiredRef(input.request_ref),
-    bound_at: timestamp2(now.toISOString()),
-    ...payload.context_expires_at === void 0 ? {} : { context_expires_at: timestamp2(payload.context_expires_at) },
-    host_source_ref: requiredRef(input.host_binding.host_source_ref),
-    host_session_ref: requiredRef(input.host_binding.host_session_ref),
-    host_turn_ref: requiredRef(input.host_binding.host_turn_ref),
-    host_input_ref: requiredRef(input.host_binding.host_input_ref)
-  };
-  if (input.host_binding.prompt_ref !== input.prompt_ref) throw new HostRelayBindingError("context_identity_mismatch", "Host Relay binding prompt reference does not match the acknowledged submission.");
-  validateBinding(candidate);
-  return candidate;
+function installationKey(frame) {
+  return `${frame.producer_id}\0${frame.producer_installation_ref}`;
 }
-function decodeState3(value) {
-  if (!record3(value) || !exactKeys3(value, ["schema_version", "bindings"])) throw new TypeError(`Host Relay binding state is invalid: ${refusalFact("state_keys", record3(value) ? Object.keys(value) : [], "exactly schema_version and bindings")}.`);
-  if (value.schema_version !== STATE_SCHEMA) throw new TypeError(`Host Relay binding state is invalid: ${refusalFact("schema_version", value.schema_version, STATE_SCHEMA)}.`);
-  if (!Array.isArray(value.bindings)) throw new TypeError(`Host Relay binding state is invalid: ${refusalFact("bindings", value.bindings, "an array")}.`);
-  const bindings = value.bindings.map((item) => {
-    validateBinding(item);
-    return item;
+function pendingFrameMatchesBindingQuery(entry2, query) {
+  if (entry2.frame.frame_kind !== "user_input") return false;
+  const payload = entry2.frame.payload;
+  if (typeof payload.local_session_ref !== "string" || typeof payload.local_turn_ref !== "string") return false;
+  const aliases = Array.isArray(payload.local_turn_aliases) ? payload.local_turn_aliases.filter((value) => typeof value === "string") : [];
+  return relayRequestBindingMatchesQuery(query, {
+    producer_id: entry2.frame.producer_id,
+    producer_installation_ref: entry2.frame.producer_installation_ref,
+    local_session_ref: payload.local_session_ref,
+    local_turn_ref: payload.local_turn_ref,
+    local_turn_aliases: aliases
   });
-  const keys = bindings.map(bindingKey);
-  if (new Set(keys).size !== keys.length) throw new TypeError("Host Relay binding state contains duplicate canonical turns.");
-  return { schema_version: STATE_SCHEMA, bindings };
 }
-function validateBinding(value) {
-  if (!record3(value) || !exactOptionalKeys(value, ["schema_version", "producer_id", "producer_installation_ref", "local_session_ref", "local_turn_ref", "local_turn_aliases", "prompt_ref", "request_ref", "bound_at", "host_source_ref", "host_session_ref", "host_turn_ref", "host_input_ref"], ["context_expires_at"]) || !validBindingIdentity(value) || !validBindingRequest(value)) throw new TypeError("Host Relay request binding is invalid.");
+function replayCode(existing, hash, sequence, installation2) {
+  if (existing !== void 0) return existing.hash === hash ? "already_admitted" : "frame_identity_conflict";
+  return sequence <= installation2.delivered_through_sequence ? "already_admitted" : null;
 }
-function validBindingIdentity(value) {
-  return value.schema_version === HOST_RELAY_REQUEST_BINDING_SCHEMA && producer2(value.producer_id) && [value.producer_installation_ref, value.local_session_ref, value.local_turn_ref].every(safeRef2) && refList(value.local_turn_aliases);
+function bytes(entries) {
+  return entries.reduce((total, entry2) => total + entry2.charged_bytes, 0);
 }
-function validBindingRequest(value) {
-  const tuple = [value.host_source_ref, value.host_session_ref, value.host_turn_ref, value.host_input_ref];
-  return safeRef2(value.prompt_ref) && safeRef2(value.request_ref) && validTimestamp(value.bound_at) && (value.context_expires_at === void 0 || validTimestamp(value.context_expires_at)) && tuple.every(safeRef2);
+function retryExhausted(outcome, entry2) {
+  return outcome.status === "retryable" && entry2.retry_attempts >= MAX_RETRYABLE_ATTEMPTS;
 }
-function validateQuery(value) {
-  if (!record3(value) || !exactKeys3(value, ["producer_id", "producer_installation_ref", "local_session_ref", "local_turn_ref"]) || !producer2(value.producer_id) || !safeRef2(value.producer_installation_ref) || !safeRef2(value.local_session_ref) || !safeRef2(value.local_turn_ref)) throw new TypeError("Host Relay binding query is invalid.");
+function refusalCause(outcome, entry2) {
+  if (outcome.status === "refused") return { code: outcome.code, message: outcome.message };
+  const reason = outcome.status === "retryable" ? outcome.reason ?? "no reason reported" : "no reason reported";
+  return { code: "retry_exhausted", message: `Gateway delivery stayed retryable through ${entry2.retry_attempts} attempts: ${reason}` };
 }
-function queryMatches(query, binding) {
-  return query.producer_id === binding.producer_id && query.local_session_ref === binding.local_session_ref && (query.local_turn_ref === binding.local_turn_ref || binding.local_turn_aliases.includes(query.local_turn_ref)) && query.producer_installation_ref === binding.producer_installation_ref;
+function scheduleRetry(entry2, nowMs, reason) {
+  if (reason === void 0) delete entry2.retry_reason;
+  else entry2.retry_reason = reason;
+  entry2.retry_attempts += 1;
+  entry2.retry_at_ms = nowMs + 1e3 * (RETRY_SECONDS[Math.min(entry2.retry_attempts - 1, RETRY_SECONDS.length - 1)] ?? 60);
 }
-function sameCanonicalIdentity(left, right) {
-  return bindingKey(left) === bindingKey(right);
+function result(code, state) {
+  return { code, admitted_through_sequence: state.admitted_through_sequence, delivered_through_sequence: state.delivered_through_sequence };
 }
-function sameBinding(left, right) {
-  return left.request_ref === right.request_ref && left.prompt_ref === right.prompt_ref && left.context_expires_at === right.context_expires_at && left.host_source_ref === right.host_source_ref && left.host_session_ref === right.host_session_ref && left.host_turn_ref === right.host_turn_ref && left.host_input_ref === right.host_input_ref && JSON.stringify(left.local_turn_aliases) === JSON.stringify(right.local_turn_aliases);
+function errorCode6(error) {
+  return typeof error === "object" && error !== null && "code" in error ? String(error.code) : null;
 }
-function bindingKey(value) {
-  return `${value.producer_id}\0${value.producer_installation_ref}\0${value.local_session_ref}\0${value.local_turn_ref}`;
+function decodeState3(value) {
+  if (!stateRecord(value)) throw new TypeError("Host Relay admission state is invalid.");
+  const installations = {};
+  for (const [key, item] of Object.entries(value.installations)) {
+    if (!installation(item)) throw new TypeError("Host Relay installation state is invalid.");
+    installations[key] = item;
+  }
+  const entries = [];
+  for (const item of value.entries) {
+    if (!entry(item)) throw new TypeError("Host Relay entry state is invalid.");
+    entries.push(item);
+  }
+  return { schema_version: "ceal.host_relay_admission_state.v1", installations, entries };
 }
-function requiredRef(value) {
-  if (!safeRef2(value)) throw new TypeError("Host Relay binding reference is invalid.");
-  return value;
+function stateRecord(value) {
+  return object(value) && value.schema_version === "ceal.host_relay_admission_state.v1" && object(value.installations) && Array.isArray(value.entries);
 }
-function optionalRefs2(value) {
-  if (value === void 0) return [];
-  if (!refList(value)) throw new TypeError("Host Relay binding aliases are invalid.");
-  return [...value];
+function installation(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) && "epoch" in value && "admitted_through_sequence" in value && "delivered_through_sequence" in value && [value.epoch, value.admitted_through_sequence, value.delivered_through_sequence].every(Number.isSafeInteger) && (!("last_refusal" in value) || refusalRecord(value.last_refusal));
 }
-function timestamp2(value) {
-  if (!validTimestamp(value)) throw new TypeError("Host Relay binding timestamp is invalid.");
-  return value;
+function refusalRecord(value) {
+  return object(value) && Number.isSafeInteger(value.sequence) && typeof value.submission_ref === "string" && typeof value.code === "string" && typeof value.message === "string" && Number.isSafeInteger(value.refused_at_ms);
+}
+function entry(value) {
+  return object(value) && producer2(value.producer_id) && typeof value.producer_installation_ref === "string" && Number.isSafeInteger(value.sequence) && typeof value.hash === "string" && Number.isSafeInteger(value.charged_bytes) && object(value.frame) && Number.isSafeInteger(value.retry_attempts) && Number.isSafeInteger(value.retry_at_ms);
 }
 function producer2(value) {
   return value === "codex" || value === "claude";
 }
-function safeRef2(value) {
-  return typeof value === "string" && SAFE_REF3.test(value);
-}
-function refList(value) {
-  return Array.isArray(value) && value.length <= 16 && value.every(safeRef2) && new Set(value).size === value.length;
-}
-function validTimestamp(value) {
-  return typeof value === "string" && Number.isFinite(Date.parse(value));
-}
-function record3(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function exactKeys3(value, keys) {
-  return Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
-}
-function exactOptionalKeys(value, required, optional) {
-  const keys = Object.keys(value);
-  return required.every((key) => Object.hasOwn(value, key)) && keys.every((key) => required.includes(key) || optional.includes(key));
-}
-function errorCode5(error) {
-  return record3(error) && typeof error.code === "string" ? error.code : null;
-}
-function ownerPrivate2(stats) {
-  if (process.platform === "win32") return true;
-  const uid = typeof process.geteuid === "function" ? process.geteuid() : stats.uid;
-  return stats.uid === uid && (stats.mode & 63) === 0;
+function object(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
 // host/relay/src/relay-gateway-bridge.ts
+import { readFile as readFile3 } from "node:fs/promises";
+import { join as join5 } from "node:path";
 var STATE_SCHEMA2 = "ceal.host_relay_gateway_state.v1";
 var SAFE_REF4 = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
 var HOST_GATEWAY_ACKNOWLEDGEMENT_DISPOSITIONS = ["created", "adopted", "replayed", "approval_approved", "approval_denied", "approval_replayed"];
@@ -2291,7 +2721,7 @@ var RelayGatewayBridge = class {
       if (state.host_source_ref !== this.hostSourceRef) throw new TypeError(`Host Relay Gateway source binding changed: ${refusalFacts([{ name: "stored_host_source_ref", value: state.host_source_ref }, { name: "configured_host_source_ref", value: this.hostSourceRef }])}.`);
       return state;
     } catch (error) {
-      if (errorCode6(error) === "ENOENT") return { schema_version: STATE_SCHEMA2, host_source_ref: this.hostSourceRef, sessions: {}, turns: {} };
+      if (errorCode7(error) === "ENOENT") return { schema_version: STATE_SCHEMA2, host_source_ref: this.hostSourceRef, sessions: {}, turns: {} };
       throw error;
     }
   }
@@ -2302,7 +2732,7 @@ var RelayGatewayBridge = class {
 var RETRYABLE_HTTP_STATUSES = /* @__PURE__ */ new Set([401, 403, 408, 429]);
 function submissionRefusal(error) {
   const status = isRecord(error) && typeof error.status === "number" ? error.status : void 0;
-  const code = errorCode6(error) ?? "gateway_unavailable";
+  const code = errorCode7(error) ?? "gateway_unavailable";
   const definitive = code === "payload_rejected" || status !== void 0 && status >= 400 && status < 500 && !RETRYABLE_HTTP_STATUSES.has(status);
   return { code, message: errorMessage(error), definitive };
 }
@@ -2383,7 +2813,7 @@ function isRecord(value) {
 function validOptionalTimeout(value) {
   return value === void 0 || Number.isSafeInteger(value) && Number(value) >= 1 && Number(value) <= 6e4;
 }
-function errorCode6(error) {
+function errorCode7(error) {
   return isRecord(error) && typeof error.code === "string" ? error.code : null;
 }
 function decodeState4(value) {
@@ -2427,7 +2857,7 @@ function isInputRefusal(value) {
 
 // host/relay/src/relay-gateway-http.ts
 import { O_NOFOLLOW as O_NOFOLLOW2, O_RDONLY as O_RDONLY3 } from "node:constants";
-import { lstat as lstat2, open as open3 } from "node:fs/promises";
+import { lstat as lstat2, open as open4 } from "node:fs/promises";
 import { dirname as dirname2 } from "node:path";
 
 // host/gateway-http.ts
@@ -2477,6 +2907,7 @@ async function submitHostIngress(options) {
 }
 
 // host/relay/src/relay-gateway-http.ts
+var HOST_REGISTRATION_STATE_SCHEMA = "ceal.host_registration_state.v1";
 var HOST_REGISTRATION_STATE_KEYS = Object.freeze([
   "credential_generation",
   "gateway_request_origin",
@@ -2487,19 +2918,30 @@ var HOST_REGISTRATION_STATE_KEYS = Object.freeze([
   "schema_version",
   "status"
 ]);
-var HOST_INGRESS_PATH = "/api/ceal/v2/host-ingress";
 var HOST_REGISTRATION_STATE_MAX_BYTES = 65536;
 var HostRelayGatewayError = class extends Error {
   name = "HostRelayGatewayError";
   code;
   /** HTTP status of a Gateway refusal, when one answered. */
   status;
-  constructor(code, message, status) {
+  /** The Gateway's own refusal word, when it named one; a bounded token, never its message. */
+  error_code;
+  constructor(code, message, status, errorCode9) {
     super(message);
     this.code = code;
     if (status !== void 0) this.status = status;
+    if (errorCode9 !== void 0) this.error_code = errorCode9;
   }
 };
+var GATEWAY_REFUSAL_CODE_PATTERN = /^[a-z][a-z0-9_]{0,63}$/u;
+async function gatewayRefusalCode(response2) {
+  try {
+    const body = await response2.json();
+    return isCealJsonRecord(body) && typeof body.error_code === "string" && GATEWAY_REFUSAL_CODE_PATTERN.test(body.error_code) ? body.error_code : void 0;
+  } catch {
+    return void 0;
+  }
+}
 function refusalMessage(status, body) {
   const record6 = isCealJsonRecord(body) ? body : {};
   const code = typeof record6.error_code === "string" ? record6.error_code : "unknown";
@@ -2545,7 +2987,7 @@ function createHostRelayGatewayHttpPort(options) {
       } catch {
         throw new HostRelayGatewayError("gateway_unavailable", "Gateway Host invocation context is unavailable.");
       }
-      if (!response2.ok) throw new HostRelayGatewayError(response2.status === 401 ? "credential" : "gateway_refused", `Gateway Host invocation context was refused (${response2.status}).`, response2.status);
+      if (!response2.ok) throw new HostRelayGatewayError(response2.status === 401 ? "credential" : "gateway_refused", `Gateway Host invocation context was refused (${response2.status}).`, response2.status, await gatewayRefusalCode(response2));
       let value;
       try {
         value = await response2.json();
@@ -2561,7 +3003,7 @@ function createHostRelayGatewayHttpPort(options) {
   });
 }
 function hostRelayGatewayEndpoint(value) {
-  return hostRelayGatewayRoute(value, HOST_INGRESS_PATH);
+  return hostRelayGatewayRoute(value, CEAL_HOST_INGRESS_PATH);
 }
 function hostRelayGatewayRoute(value, path) {
   let parsed;
@@ -2601,7 +3043,7 @@ async function readHostRegistrationAuthority(path, expectedHostSourceRef) {
   let handle;
   try {
     await assertOwnerPrivateDirectory(dirname2(path));
-    handle = await open3(path, O_RDONLY3 | O_NOFOLLOW2);
+    handle = await open4(path, O_RDONLY3 | O_NOFOLLOW2);
     const stats = await handle.stat();
     if (!stats.isFile() || !ownerPrivate3(stats)) throw new HostRelayGatewayError("credential", "Host Relay credential file is not owner-private.");
     const raw = await handle.readFile("utf8");
@@ -2631,13 +3073,13 @@ function decodeHostRegistrationAuthority(value, expectedHostSourceRef) {
   return { gateway_request_origin: value.gateway_request_origin, host_access_token: value.host_access_token };
 }
 function validRegistrationIdentity(value, expectedHostSourceRef) {
-  return value.schema_version === "ceal.host_registration_state.v1" && value.status === "active" && value.host_source_ref === expectedHostSourceRef && typeof value.registration_attempt_ref === "string" && /^host-registration-attempt:[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/u.test(value.registration_attempt_ref) && typeof value.host_installation_ref === "string" && /^host-installation:[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/u.test(value.host_installation_ref) && typeof value.host_source_ref === "string" && /^host-source:[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/u.test(value.host_source_ref);
+  return value.schema_version === HOST_REGISTRATION_STATE_SCHEMA && value.status === "active" && value.host_source_ref === expectedHostSourceRef && typeof value.registration_attempt_ref === "string" && CEAL_HOST_REGISTRATION_ATTEMPT_REF_PATTERN.test(value.registration_attempt_ref) && typeof value.host_installation_ref === "string" && CEAL_HOST_INSTALLATION_REF_PATTERN.test(value.host_installation_ref) && typeof value.host_source_ref === "string" && hostSourceUuid(value.host_source_ref) !== null;
 }
 function validRegistrationCredential(value) {
   return Number.isSafeInteger(value.credential_generation) && Number(value.credential_generation) > 0 && validHostAccessToken(value.host_access_token);
 }
 function validHostAccessToken(value) {
-  return typeof value === "string" && /^ceal_host_[A-Za-z0-9_-]{43}$/u.test(value);
+  return typeof value === "string" && CEAL_HOST_ACCESS_TOKEN_PATTERN.test(value);
 }
 function validGatewayOrigin(value) {
   try {
@@ -2670,7 +3112,7 @@ import { chmod, lstat as lstat3, unlink as unlink2 } from "node:fs/promises";
 import { createConnection, createServer } from "node:net";
 
 // host/relay/src/current-prompt-custody.ts
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 var HOST_CURRENT_PROMPT_MAX_BYTES = 256 * 1024;
 var MAX_CURRENT_PROMPTS = 1024;
 var HostCurrentPromptCustody = class {
@@ -2684,7 +3126,7 @@ var HostCurrentPromptCustody = class {
     const bytes2 = Buffer.byteLength(prompt, "utf8");
     const expiry = Date.parse(expiresAt);
     if (bytes2 === 0 || bytes2 > HOST_CURRENT_PROMPT_MAX_BYTES || !Number.isFinite(expiry) || expiry <= this.#now()) throw new TypeError("current_prompt_unavailable");
-    if (hostProducerPromptRef(createHash4("sha256").update(prompt, "utf8").digest("hex")) !== identity.prompt_ref) throw new TypeError("current_prompt_unavailable");
+    if (hostProducerPromptRef(createHash5("sha256").update(prompt, "utf8").digest("hex")) !== identity.prompt_ref) throw new TypeError("current_prompt_unavailable");
     this.#purge();
     const key = promptKey(identity);
     if (this.#consumed.has(key)) return;
@@ -2737,11 +3179,46 @@ var HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA = "ceal.host_relay_invocation_co
 var HOST_RELAY_CURRENT_PROMPT_REGISTER_SCHEMA = "ceal.host_relay_current_prompt_register.v1";
 var HOST_RELAY_CURRENT_PROMPT_RESULT_SCHEMA = "ceal.host_relay_current_prompt_result.v1";
 var HOST_RELAY_IPC_LENGTH_BYTES = Uint32Array.BYTES_PER_ELEMENT;
+var HOST_RELAY_INVOCATION_MINT_REFUSAL_REASONS = vocabulary([
+  "context_stale",
+  "context_expired",
+  "host_source_refused",
+  "host_credential_refused",
+  "gateway_unavailable",
+  "gateway_refused",
+  "gateway_response_invalid",
+  "deadline",
+  "cancelled",
+  "mint_failed",
+  "relay_failed"
+]);
+var HostRelayInvocationMintRefusal = class extends Error {
+  reason;
+  constructor(reason) {
+    super(reason);
+    this.name = "HostRelayInvocationMintRefusal";
+    this.reason = reason;
+  }
+};
+var HOST_RELAY_INVOCATION_MINT_OUTCOMES = vocabulary(["completed", "caller_cancelled", "deadline", "failed", "no_binding"]);
+var HOST_RELAY_EXCHANGE_FAILURES = vocabulary([
+  "permission_denied",
+  "socket_missing",
+  "connection_refused",
+  "closed_early",
+  "response_invalid",
+  "timed_out",
+  "cancelled",
+  "unavailable"
+]);
 var HostRelayIpcError = class extends Error {
   code;
-  constructor(code, message = code) {
+  /** Set only when the client-side socket exchange itself failed. */
+  failure;
+  constructor(code, message = code, failure) {
     super(message);
     this.code = code;
+    this.failure = failure;
   }
 };
 async function startHostRelayIpcServer(options) {
@@ -2750,7 +3227,7 @@ async function startHostRelayIpcServer(options) {
   const sockets = /* @__PURE__ */ new Set();
   const quarantine = options.quarantine ?? options.admission.quarantine;
   const currentPrompts = options.currentPrompts ?? new HostCurrentPromptCustody();
-  const server = createServer((socket) => serveSocket(socket, options.admission, options.bindings, currentPrompts, options.mintInvocationContext, quarantine, active, sockets));
+  const server = createServer((socket) => serveSocket(socket, options, currentPrompts, quarantine, active, sockets));
   await listen(server, options.endpoint);
   if (process.platform !== "win32") await chmod(options.endpoint, 384);
   return { endpoint: options.endpoint, close: () => closeServer(server, sockets, options.endpoint) };
@@ -2762,12 +3239,12 @@ function encodeHostRelayIpcResponse(response2) {
   body.copy(result2, HOST_RELAY_IPC_LENGTH_BYTES);
   return result2;
 }
-function serveSocket(socket, admission, bindings, currentPrompts, mintInvocationContext2, quarantine, active, sockets) {
+function serveSocket(socket, options, currentPrompts, quarantine, active, sockets) {
   const state = { buffer: Buffer.alloc(0), closed: false, tail: Promise.resolve(), abort: new AbortController() };
   sockets.add(socket);
   socket.on("data", (chunk) => {
     state.buffer = Buffer.concat([state.buffer, Buffer.from(chunk)]);
-    state.tail = state.tail.then(() => drainFrames(socket, state, admission, bindings, currentPrompts, mintInvocationContext2, quarantine, active)).catch(() => {
+    state.tail = state.tail.then(() => drainFrames(socket, state, options, currentPrompts, quarantine, active)).catch(() => {
       writeResponse(socket, errorResponse("relay_unavailable"));
       socket.end();
     });
@@ -2785,11 +3262,11 @@ function serveSocket(socket, admission, bindings, currentPrompts, mintInvocation
     else socket.end();
   });
 }
-async function drainFrames(socket, state, admission, bindings, currentPrompts, mintInvocationContext2, quarantine, active) {
-  while (!state.closed && state.buffer.length >= HOST_RELAY_IPC_LENGTH_BYTES && await processBufferedRequest(socket, state, admission, bindings, currentPrompts, mintInvocationContext2, quarantine, active)) {
+async function drainFrames(socket, state, options, currentPrompts, quarantine, active) {
+  while (!state.closed && state.buffer.length >= HOST_RELAY_IPC_LENGTH_BYTES && await processBufferedRequest(socket, state, options, currentPrompts, quarantine, active)) {
   }
 }
-async function processBufferedRequest(socket, state, admission, bindings, currentPrompts, mintInvocationContext2, quarantine, active) {
+async function processBufferedRequest(socket, state, options, currentPrompts, quarantine, active) {
   const length = state.buffer.readUInt32BE(0);
   const promptWire = currentPromptWire(state.buffer);
   const maximum = promptWire ? HOST_CURRENT_PROMPT_MAX_BYTES + 4096 : HOST_PRODUCER_MAX_JSON_BYTES;
@@ -2818,8 +3295,13 @@ async function processBufferedRequest(socket, state, admission, bindings, curren
     }
     return true;
   }
-  if (await processHostQuery(socket, request2, bindings, currentPrompts, mintInvocationContext2, state.abort.signal)) return true;
-  await processProducerRequest(socket, state, request2, encoded, admission, quarantine, active);
+  const answered = await processHostQuery(socket, request2, options, currentPrompts, state.abort.signal);
+  if (answered === "closed") {
+    socket.end();
+    return false;
+  }
+  if (answered === "answered") return true;
+  await processProducerRequest(socket, state, request2, encoded, options.admission, quarantine, active);
   return true;
 }
 async function refuseInvalidBufferedRequest(socket, rawBuffer, length, promptWire, quarantine) {
@@ -2851,16 +3333,29 @@ async function processProducerRequest(socket, state, request2, encoded, admissio
   }
   writeResponse(socket, admissionResponse(await admission.admit(request2)));
 }
-async function processHostQuery(socket, request2, bindings, currentPrompts, mint, signal) {
+async function processHostQuery(socket, request2, options, currentPrompts, signal) {
   if (request2.schema_version === HOST_RELAY_BINDING_QUERY_SCHEMA) {
-    writeBindingResponse(socket, await bindings.query(bindingQueryFromRequest(request2)));
-    return true;
+    let result2;
+    try {
+      result2 = await options.bindings.query(bindingQueryFromRequest(request2));
+    } catch {
+      return "closed";
+    }
+    writeBindingResponse(socket, result2);
+    return "answered";
   }
   if (request2.schema_version === HOST_RELAY_INVOCATION_CONTEXT_QUERY_SCHEMA) {
-    writeInvocationContextResponse(socket, await resolveInvocationContext(request2, bindings, currentPrompts, mint, signal));
-    return true;
+    let response2;
+    const resolve = (invocationSignal) => resolveInvocationContext(request2, options.admission, options.bindings, currentPrompts, options.mintInvocationContext, invocationSignal);
+    try {
+      response2 = options.invocationMintTimeoutMs === void 0 && options.scheduleInvocationMintDeadline === void 0 && options.observeInvocationMint === void 0 ? await resolve(signal) : await observeInvocationMint(resolve, signal, options.invocationMintTimeoutMs, options.scheduleInvocationMintDeadline, options.observeInvocationMint);
+    } catch {
+      response2 = { schema_version: HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA, status: "refused", reason: "relay_failed" };
+    }
+    writeInvocationContextResponse(socket, response2);
+    return "answered";
   }
-  return false;
+  return "not_a_query";
 }
 function claimProducer(socket, state, frame, active) {
   const key = producerKey(frame);
@@ -2894,14 +3389,93 @@ function writeInvocationContextResponse(socket, response2) {
 function writeCurrentPromptResponse(socket, status) {
   if (!socket.destroyed) socket.write(encodeLengthPrefixed({ schema_version: HOST_RELAY_CURRENT_PROMPT_RESULT_SCHEMA, status }));
 }
-async function resolveInvocationContext(request2, bindings, currentPrompts, mint, signal) {
+async function resolveInvocationContext(request2, admission, bindings, currentPrompts, mint, signal) {
   if (mint === void 0) throw new HostRelayIpcError("relay_unavailable");
-  const binding = await bindings.query(bindingQueryFromRequest(request2));
-  if (binding.status !== "ready") return { schema_version: HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA, ...binding };
+  const query = bindingQueryFromRequest(request2);
+  const binding = await waitForRequestBinding(query, admission, bindings, signal);
+  if (binding.status !== "ready") return { schema_version: HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA, status: "no_binding" };
   const currentPrompt = currentPrompts.take({ producer_id: request2.producer_id, producer_installation_ref: request2.producer_installation_ref, local_session_ref: request2.local_session_ref, local_turn_ref: request2.local_turn_ref, prompt_ref: binding.binding.prompt_ref });
-  const result2 = await mint({ client_nonce: request2.client_nonce, context_expires_at: binding.binding.context_expires_at ?? binding.binding.bound_at, request_work_context: relayRequestWorkContextFromBinding(binding.binding), ...currentPrompt === void 0 ? {} : { current_prompt: currentPrompt } }, signal);
+  let result2;
+  try {
+    result2 = await mint({ client_nonce: request2.client_nonce, context_expires_at: binding.binding.context_expires_at ?? binding.binding.bound_at, request_work_context: relayRequestWorkContextFromBinding(binding.binding), ...currentPrompt === void 0 ? {} : { current_prompt: currentPrompt } }, signal);
+  } catch (error) {
+    return { schema_version: HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA, status: "refused", reason: error instanceof HostRelayInvocationMintRefusal ? error.reason : "mint_failed" };
+  }
   return { schema_version: HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA, status: "ready", result: result2 };
 }
+async function waitForRequestBinding(query, admission, bindings, signal) {
+  let binding = await bindings.query(query);
+  if (binding.status === "ready") return binding;
+  while (await admission.hasPendingRequestBinding(query)) {
+    const cycle = new AbortController();
+    const cancelCycle = () => cycle.abort(signal.reason);
+    if (signal.aborted) cancelCycle();
+    else signal.addEventListener("abort", cancelCycle, { once: true });
+    try {
+      const changed = Promise.race([
+        bindings.waitForBinding(query, cycle.signal).then((result3) => ({ kind: "bound", result: result3 })),
+        admission.waitForDrainChange(cycle.signal).then(() => ({ kind: "drained" }))
+      ]).then((result3) => result3, (error) => ({ kind: "cancelled", error }));
+      binding = await bindings.query(query);
+      if (binding.status === "ready") return binding;
+      if (!await admission.hasPendingRequestBinding(query)) return await bindings.query(query);
+      const result2 = await changed;
+      if (result2.kind === "cancelled") throw result2.error;
+    } finally {
+      signal.removeEventListener("abort", cancelCycle);
+      cycle.abort("wait_cycle_complete");
+    }
+    binding = await bindings.query(query);
+    if (binding.status === "ready") return binding;
+  }
+  return await bindings.query(query);
+}
+async function observeInvocationMint(resolve, callerSignal, timeoutMs, scheduleDeadline, observe) {
+  const started = process.hrtime.bigint();
+  const controller2 = new AbortController();
+  let cancellation = null;
+  let outcome = "failed";
+  let reason;
+  const cancel = (cause) => {
+    if (cancellation === null) {
+      cancellation = cause;
+      controller2.abort(cause);
+    }
+  };
+  const callerCancelled = () => cancel("caller_cancelled");
+  const cancelled = new Promise((_resolve, reject) => controller2.signal.addEventListener("abort", () => reject(new Error("invocation mint cancelled")), { once: true }));
+  const clearDeadline = timeoutMs === void 0 ? () => void 0 : (scheduleDeadline ?? scheduleInvocationMintDeadline)(() => cancel("deadline"), timeoutMs);
+  if (callerSignal.aborted) callerCancelled();
+  else callerSignal.addEventListener("abort", callerCancelled, { once: true });
+  try {
+    const response2 = await Promise.race([resolve(controller2.signal), cancelled]);
+    ({ outcome, reason } = invocationMintObservationForResponse(response2));
+    return response2;
+  } catch {
+    ({ outcome, reason } = invocationMintObservationForCancellation(cancellation));
+    return { schema_version: HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA, status: "refused", reason: reason ?? "relay_failed" };
+  } finally {
+    clearDeadline();
+    callerSignal.removeEventListener("abort", callerCancelled);
+    observe?.({ outcome, elapsed_ms: Number((process.hrtime.bigint() - started) / 1000000n), ...reason === void 0 ? {} : { reason } });
+  }
+}
+function invocationMintObservationForResponse(response2) {
+  if (response2.status === "no_binding") return { outcome: "no_binding" };
+  if (response2.status === "ready") return { outcome: "completed" };
+  if (response2.reason === "deadline") return { outcome: "deadline", reason: "deadline" };
+  if (response2.reason === "cancelled") return { outcome: "caller_cancelled", reason: "cancelled" };
+  return { outcome: "failed", reason: response2.reason };
+}
+function invocationMintObservationForCancellation(cancellation) {
+  if (cancellation === "deadline") return { outcome: "deadline", reason: "deadline" };
+  if (cancellation === "caller_cancelled") return { outcome: "caller_cancelled", reason: "cancelled" };
+  return { outcome: "failed", reason: "relay_failed" };
+}
+function scheduleInvocationMintDeadline(expire, milliseconds) {
+  const timeout = setTimeout(expire, milliseconds);
+  return () => clearTimeout(timeout);
+}
 function admissionResponse(result2) {
   return { schema_version: HOST_RELAY_IPC_RESPONSE_SCHEMA, ...result2 };
 }
@@ -2987,7 +3561,7 @@ async function assertEndpointVacant(endpoint) {
     await lstat3(endpoint);
     throw new HostRelayIpcError("relay_unavailable", "Host Relay IPC endpoint is already present.");
   } catch (error) {
-    if (errorCode7(error) !== "ENOENT") throw error;
+    if (errorCode8(error) !== "ENOENT") throw error;
   }
 }
 function listen(server, endpoint) {
@@ -3004,7 +3578,7 @@ async function closeServer(server, sockets, endpoint) {
   await new Promise((resolve) => server.close(() => resolve()));
   if (process.platform !== "win32") await unlink2(endpoint).catch(() => void 0);
 }
-function errorCode7(error) {
+function errorCode8(error) {
   return record4(error) && typeof error.code === "string" ? error.code : null;
 }
 
@@ -3026,7 +3600,7 @@ async function readHostRelayConfig(path) {
   let handle;
   try {
     await assertOwnerPrivateDirectory2(dirname3(path));
-    handle = await open4(path, O_RDONLY4 | O_NOFOLLOW3);
+    handle = await open5(path, O_RDONLY4 | O_NOFOLLOW3);
     const stats = await handle.stat();
     if (!stats.isFile() || !ownerPrivate4(stats)) throw new HostRelayConfigError("config_not_private", "Host Relay config file is not owner-private.");
     if (stats.size < HOST_RELAY_CONFIG_MIN_BYTES || stats.size > HOST_RELAY_CONFIG_MAX_BYTES) throw new HostRelayConfigError("invalid_config", `invalid_config: Host Relay config size is invalid: ${refusalFact("config_bytes", stats.size, `between ${HOST_RELAY_CONFIG_MIN_BYTES} and ${HOST_RELAY_CONFIG_MAX_BYTES}`)}.`);
@@ -3038,7 +3612,9 @@ async function readHostRelayConfig(path) {
     } catch {
       throw new HostRelayConfigError("invalid_json", "Host Relay config is not JSON.");
     }
-    return decodeHostRelayConfig(value);
+    const config = decodeHostRelayConfig(value);
+    validateHostRelaySourcePaths(config);
+    return config;
   } catch (error) {
     if (error instanceof HostRelayConfigError) throw error;
     throw new HostRelayConfigError("config_unavailable", "Host Relay config is unavailable.");
@@ -3046,6 +3622,13 @@ async function readHostRelayConfig(path) {
     await handle?.close();
   }
 }
+function validateHostRelaySourcePaths(config) {
+  try {
+    assertHostRelaySourcePaths(dirname3(config.registration_state_file), config);
+  } catch (error) {
+    throw new HostRelayConfigError("invalid_config", error instanceof Error ? error.message : "Host Relay source tuple is invalid.");
+  }
+}
 function decodeHostRelayConfig(value) {
   const required = ["schema_version", "registration_state_file", "host_source_ref", "state_root", "ipc_endpoint"];
   const optional = ["drain_interval_ms", "gateway_timeout_ms"];
@@ -3068,6 +3651,8 @@ function validConfigIdentity(value) {
 function validConfigRuntime(value) {
   return isAbsoluteNormalizedNonRootPath(value.state_root, process.platform, true) && isAbsoluteNormalizedNonRootPath(value.ipc_endpoint, process.platform, true) && boundedInteger(value.drain_interval_ms, 50, 3e4, true) && boundedInteger(value.gateway_timeout_ms, 100, 6e4, true);
 }
+var HOST_RELAY_INVOCATION_MINT_LOG_TAG = "[host-relay-invocation-mint]";
+var HOST_RELAY_INVOCATION_MINT_LINE = new RegExp(`^${HOST_RELAY_INVOCATION_MINT_LOG_TAG.replace(/[[\]]/gu, "\\$&")} outcome=([a-z_]+)(?: reason=([a-z][a-z0-9_]{0,63}))? elapsed_ms=[0-9]+$`, "u");
 async function serveHostRelay(config, signal, dependencies = {}) {
   const admission = new RelayAdmissionStore(join6(config.state_root, "admission"));
   const bindings = new RelayRequestBindingStore(join6(config.state_root, "bindings"));
@@ -3077,7 +3662,7 @@ async function serveHostRelay(config, signal, dependencies = {}) {
   } });
   let server;
   try {
-    server = await (dependencies.startIpc ?? startHostRelayIpcServer)({ endpoint: config.ipc_endpoint, admission, bindings, mintInvocationContext: (input, invocationSignal) => mintInvocationContext(gateway, input, invocationSignal, config.gateway_timeout_ms, dependencies.observeInvocationMint ?? reportInvocationMint, dependencies.scheduleInvocationMintDeadline ?? scheduleInvocationMintDeadline) });
+    server = await startHostRelayRuntimeIpc(config, admission, bindings, gateway, dependencies);
     while (!signal.aborted) {
       const round = await admission.drainRound((input) => bridge.deliver(input), { now_ms: (dependencies.now ?? Date.now)(), host_source_ref: config.host_source_ref });
       if (round.delivered.length === 0 && round.refused.length === 0) await (dependencies.wait ?? ((milliseconds, waitSignal) => waitForAbort(waitSignal, milliseconds)))(config.drain_interval_ms, signal);
@@ -3086,41 +3671,52 @@ async function serveHostRelay(config, signal, dependencies = {}) {
     await server?.close();
   }
 }
-async function mintInvocationContext(gateway, input, callerSignal, timeoutMs, observe, scheduleDeadline) {
-  const controller2 = new AbortController();
-  const started = process.hrtime.bigint();
-  let cancellation = null;
-  let outcome = "failed";
-  const cancel = (cause) => {
-    if (cancellation === null) cancellation = cause;
-    controller2.abort();
-  };
-  const callerCancelled = () => cancel("caller_cancelled");
-  const clearDeadline = scheduleDeadline(() => cancel("deadline"), timeoutMs);
-  if (callerSignal.aborted) callerCancelled();
-  else callerSignal.addEventListener("abort", callerCancelled, { once: true });
-  const cancelled = new Promise((_resolve, reject) => controller2.signal.addEventListener("abort", () => reject(new Error("invocation mint cancelled")), { once: true }));
+async function startHostRelayRuntimeIpc(config, admission, bindings, gateway, dependencies) {
+  return (dependencies.startIpc ?? startHostRelayIpcServer)({
+    endpoint: config.ipc_endpoint,
+    admission,
+    bindings,
+    mintInvocationContext: (input, invocationSignal) => mintInvocationContext(gateway, input, invocationSignal),
+    invocationMintTimeoutMs: config.gateway_timeout_ms,
+    scheduleInvocationMintDeadline: dependencies.scheduleInvocationMintDeadline ?? scheduleInvocationMintDeadline2,
+    observeInvocationMint: dependencies.observeInvocationMint ?? reportInvocationMint
+  });
+}
+async function mintInvocationContext(gateway, input, signal) {
   try {
-    const result2 = await Promise.race([gateway.mintInvocationContext(input, controller2.signal), cancelled]);
-    outcome = "completed";
-    return result2;
+    return await gateway.mintInvocationContext(input, signal);
   } catch (error) {
-    outcome = cancellation ?? "failed";
-    throw error;
-  } finally {
-    clearDeadline();
-    callerSignal.removeEventListener("abort", callerCancelled);
-    observe({ outcome, elapsed_ms: Number((process.hrtime.bigint() - started) / 1000000n) });
-  }
-}
-function scheduleInvocationMintDeadline(expire, milliseconds) {
+    const cancellation = signal.reason === "deadline" ? "deadline" : signal.reason === "caller_cancelled" ? "caller_cancelled" : null;
+    throw new HostRelayInvocationMintRefusal(invocationMintRefusalReason(error, cancellation));
+  }
+}
+function invocationMintRefusalReason(error, cancellation) {
+  if (cancellation === "deadline") return "deadline";
+  if (cancellation === "caller_cancelled") return "cancelled";
+  if (!(error instanceof HostRelayGatewayError)) return "mint_failed";
+  if (error.code === "credential") return "host_credential_refused";
+  if (error.code === "gateway_unavailable") return "gateway_unavailable";
+  if (error.code === "invalid_response") return "gateway_response_invalid";
+  if (error.code !== "gateway_refused") return "mint_failed";
+  return (error.error_code === void 0 ? void 0 : GATEWAY_MINT_REFUSAL_REASONS.get(error.error_code)) ?? "gateway_refused";
+}
+var GATEWAY_MINT_REFUSAL_REASONS = /* @__PURE__ */ new Map([
+  ["request_context_refused", "context_stale"],
+  ["context_expired", "context_expired"],
+  ["host_source_refused", "host_source_refused"],
+  ["host_invocation_context_unavailable", "gateway_unavailable"]
+]);
+function scheduleInvocationMintDeadline2(expire, milliseconds) {
   const timeout = setTimeout(expire, milliseconds);
   return () => clearTimeout(timeout);
 }
 function reportInvocationMint(observation) {
-  process.stderr.write(`[host-relay-invocation-mint] outcome=${observation.outcome} elapsed_ms=${observation.elapsed_ms}
+  process.stderr.write(`${formatHostRelayInvocationMintLine(observation)}
 `);
 }
+function formatHostRelayInvocationMintLine(observation) {
+  return `${HOST_RELAY_INVOCATION_MINT_LOG_TAG} outcome=${observation.outcome}${observation.reason === void 0 ? "" : ` reason=${observation.reason}`} elapsed_ms=${observation.elapsed_ms}`;
+}
 async function runHostRelayCli(args, signal, dependencies = {}) {
   try {
     const configPath = parseServeArgs(args);
@@ -3174,6 +3770,7 @@ var controller = new AbortController();
 var stop = () => controller.abort();
 process.once("SIGINT", stop);
 process.once("SIGTERM", stop);
+var stopLogBound = boundHostServiceLog();
 void runHostRelayCli(process.argv.slice(2), controller.signal).then((result2) => {
   process.stdout.write(`${JSON.stringify({ schema_version: "ceal.host_relay_command.v1", ...result2 })}
 `);
@@ -3183,6 +3780,7 @@ void runHostRelayCli(process.argv.slice(2), controller.signal).then((result2) =>
 `);
   process.exitCode = 1;
 }).finally(() => {
+  stopLogBound();
   process.removeListener("SIGINT", stop);
   process.removeListener("SIGTERM", stop);
 });