@joe-broadhead/messaging-bin-linux-x64-gnu 0.4.0 → 0.5.0

package/bin/messagingd

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/bin/messagingd
-size: 91797472 bytes
-sha256: 8bf49cd428a461ceb01c87c0e7d49427331cac1773724e59bb164810267d9adb
+size: 91826144 bytes
+sha256: 17c9fef1eef307ffca13a1151dd708eaf6f63dda4e448339ac991162abed1317

package/lib/messagingd.mjs

@@ -6391,7 +6391,8 @@ var init_jelly = __esm(() => {
     jti: string2().regex(/^[\x21-\x7e]{1,128}$/, "printable jti"),
     iss: string2().max(2048).optional(),
     dev: string2().max(200).optional(),
-    cls: string2().max(32).optional()
+    cls: string2().max(32).optional(),
+    mbr: string2().max(200).optional()
   });
   JellySessionClaims = looseObject({
     aud: string2().min(1).max(2048),
@@ -6900,7 +6901,8 @@ var init_envelope = __esm(() => {
     label: MachineLabel,
     sessions: array(SessionInfo).max(LIMITS.presenceSessions),
     features: array(string2().max(64)).max(32).optional(),
-    direct: array(DirectEndpoint).min(1).max(4).optional()
+    direct: array(DirectEndpoint).min(1).max(4).optional(),
+    away: literal(true).optional()
   });
   PAYLOAD_BY_TYPE = {
     message: MessagePayload,
@@ -7102,7 +7104,7 @@ var init_relay = __esm(() => {
 function hostedRelayAuthPayload(args) {
   return { proto: RELAY_PROTOCOL, relay: args.relay, realm: args.realm, person: args.person, device: args.device, nonce: args.nonce, ts: args.ts };
 }
-var Req2, Size, Handle, Email, OrgId, DirBindFrame, HostedHelloFrame, DirAppendFrame, DirKeysFrame, DirSthFrame, DirLookupFrame, DirDeviceFrame, DirResolveFrame, DirSearchFrame, DirWatchFrame, PresenceWatchFrame, DirEraseFrame, DirectoryClientFrame, HostedWelcomeFrame, DirOkFrame, DirSthIsFrame, DirPersonsFrame, ResolvedPerson, DirResolvedFrame, DirChangedFrame, DirUnboundFrame, DirectoryRelayFrame;
+var Req2, Size, Handle, Email, OrgId, DirBindFrame, HostedHelloFrame, DirAppendFrame, DirKeysFrame, DirSthFrame, DirLookupFrame, DirDeviceFrame, DirResolveFrame, DirSearchFrame, DirWatchFrame, PresenceWatchFrame, DirEraseFrame, WAKE_AGENTS = 64, WAKE_AWAITING = 500, WAKE_TICKET_BYTES = 4096, WAKE_TICKET_MAX_S, WakeUrl, WakeArmFrame, WakeDisarmFrame, DirectoryClientFrame, HostedWelcomeFrame, DirOkFrame, DirSthIsFrame, DirPersonsFrame, ResolvedPerson, DirResolvedFrame, DirChangedFrame, DirUnboundFrame, DirectoryRelayFrame;
 var init_directory_frames = __esm(() => {
   init_zod();
   init_common();
@@ -7167,6 +7169,17 @@ var init_directory_frames = __esm(() => {
     entries: array(LogEntry).min(1).max(LIMITS.devicesPerPerson),
     token: Jws
   });
+  WAKE_TICKET_MAX_S = 7 * 24 * 60 * 60;
+  WakeUrl = string2().max(2048).regex(/^https?:\/\/[^/?#@\s]+\/hosts\/hst_[A-Za-z0-9._:-]{1,123}\/wake$/, "a Jelly ID wake URL");
+  WakeArmFrame = object({
+    t: literal("wake.arm"),
+    req: Req2,
+    url: WakeUrl,
+    ticket: Jws.refine((ticket) => ticket.length <= WAKE_TICKET_BYTES, { message: `at most ${WAKE_TICKET_BYTES} bytes` }),
+    agents: array(SessionName).max(WAKE_AGENTS),
+    awaiting: array(Ulid).max(WAKE_AWAITING)
+  });
+  WakeDisarmFrame = object({ t: literal("wake.disarm"), req: Req2 });
   DirectoryClientFrame = discriminatedUnion("t", [
     DirBindFrame,
     HostedHelloFrame,
@@ -7179,7 +7192,9 @@ var init_directory_frames = __esm(() => {
     DirSearchFrame,
     DirWatchFrame,
     PresenceWatchFrame,
-    DirEraseFrame
+    DirEraseFrame,
+    WakeArmFrame,
+    WakeDisarmFrame
   ]);
   HostedWelcomeFrame = object({ t: literal("welcome"), sth: STH });
   DirOkFrame = object({
@@ -7261,7 +7276,7 @@ var init_direct = __esm(() => {
 });
 
 // packages/core/dist/schema/ipc/device.js
-var BindingState, RealmAlarmSummary, DeviceStatus, DeviceListEntry, LinkText, Sas, LinkPreview, KeyFingerprint, LoginUserCode, LoginPurpose, LoginKind, LoginShown, LoginState, DEVICE_METHODS;
+var BindingState, RealmAlarmSummary, DeviceStatus, DeviceListEntry, LinkText, Sas, LinkPreview, KeyFingerprint, LoginUserCode, LoginPurpose, LoginKind, LoginShown, LoginState, DeviceRemoveParams, DeviceApproveParams, DEVICE_METHODS;
 var init_device = __esm(() => {
   init_zod();
   init_common();
@@ -7315,6 +7330,8 @@ var init_device = __esm(() => {
     object({ state: literal("failed"), purpose: LoginPurpose, code: ErrorCode, message: string2().max(500) }),
     object({ state: literal("cancelled"), purpose: LoginPurpose })
   ]);
+  DeviceRemoveParams = strictObject({ device: MachineId, reason: _enum(["self", "removed", "lost"]).optional(), token: Jws.optional() });
+  DeviceApproveParams = strictObject({ link: LinkText, sas: Sas });
   DEVICE_METHODS = {
     "device.status": { params: strictObject({}), result: DeviceStatus },
     "device.bind": {
@@ -7323,7 +7340,7 @@ var init_device = __esm(() => {
     },
     "device.list": { params: strictObject({}), result: object({ devices: array(DeviceListEntry) }) },
     "device.remove": {
-      params: strictObject({ device: MachineId, reason: _enum(["self", "removed", "lost"]).optional(), token: Jws.optional() }),
+      params: DeviceRemoveParams,
       result: object({ seq: number2().int().nonnegative() })
     },
     "device.link": {
@@ -7340,9 +7357,9 @@ var init_device = __esm(() => {
     },
     "device.login.status": { params: strictObject({ waitMs: number2().int().min(0).max(120000).optional() }), result: LoginState },
     "device.login.cancel": { params: strictObject({}), result: object({ ok: literal(true) }) },
-    "device.approve.preview": { params: strictObject({ link: LinkText }), result: LinkPreview },
+    "device.approve.preview": { params: DeviceApproveParams.partial({ sas: true }), result: LinkPreview },
     "device.approve": {
-      params: strictObject({ link: LinkText, sas: Sas }),
+      params: DeviceApproveParams,
       result: object({ device: MachineId, seq: number2().int().nonnegative() })
     }
   };
@@ -7458,7 +7475,7 @@ var init_shapes = __esm(() => {
 });
 
 // packages/core/dist/schema/ipc/consent.js
-var GrantTarget, Levels, GrantView, GrantReview, GrantSetParams, AskRequest, ContactRequestView, ContactSuggestion, HeldRequest, RequestAnswer, RequestText, PersonReach, CONSENT_METHODS;
+var GrantTarget, Levels, GrantView, GrantReview, GrantSetParams, AskRequest, ContactRequestView, ContactSuggestion, HeldRequest, RequestAnswer, RequestText, PersonReach, RequestAnswerParams, ContactRequestParams, CONSENT_METHODS;
 var init_consent2 = __esm(() => {
   init_zod();
   init_common();
@@ -7525,6 +7542,8 @@ var init_consent2 = __esm(() => {
   RequestAnswer = _enum(["once", "always", "accept", "decline", "block"]);
   RequestText = string2().min(1).refine((text) => text.length <= LIMITS.requestChars, { message: `at most ${LIMITS.requestChars} UTF-16 code units` });
   PersonReach = object({ person: PersonId, can: CardCan, source: _enum(["card", "default"]), at: Millis.optional() });
+  RequestAnswerParams = strictObject({ id: Ulid, answer: RequestAnswer, all: boolean2().optional() });
+  ContactRequestParams = strictObject({ email: Email, text: RequestText, suggestion: Ulid.optional() });
   CONSENT_METHODS = {
     "grant.list": {
       params: strictObject({ subject: GrantTarget.optional() }),
@@ -7534,14 +7553,25 @@ var init_consent2 = __esm(() => {
     "grant.set.preview": { params: GrantSetParams, result: object({ sentence: string2().max(500) }) },
     "request.list": { params: strictObject({}), result: object({ requests: array(HeldRequest).max(LIMITS.heldTotal * 3) }) },
     "request.answer": {
-      params: strictObject({ id: Ulid, answer: RequestAnswer, all: boolean2().optional() }),
+      params: RequestAnswerParams,
       result: object({ answered: array(Ulid).max(LIMITS.heldTotal) })
     },
+    "request.answer.preview": {
+      params: RequestAnswerParams,
+      result: object({
+        kind: _enum(["message", "task", "contact", "suggestion"]),
+        from: object({ name: string2().max(200), email: string2().max(320).optional(), org: _enum(["same", "other", "none"]) }),
+        agent: SessionName.optional(),
+        to: SessionName.optional(),
+        count: number2().int().positive(),
+        sentence: string2().max(500)
+      })
+    },
     "contact.request": {
-      params: strictObject({ email: Email, text: RequestText, suggestion: Ulid.optional() }),
+      params: ContactRequestParams,
       result: object({ id: Ulid, conversation: RoomRef, person: PersonId })
     },
-    "contact.request.preview": { params: strictObject({ email: Email }), result: object({ found: boolean2() }) },
+    "contact.request.preview": { params: ContactRequestParams.partial({ text: true }), result: object({ found: boolean2() }) },
     "card.get": { params: strictObject({ person: PersonId }), result: object({ sent: boolean2() }) }
   };
 });
@@ -7660,7 +7690,7 @@ var init_surfaces = __esm(() => {
     },
     "people.get": {
       params: strictObject({ person: PersonId }),
-      result: PersonSummary.extend({ devices: array(object({ device: MachineId, label: MachineLabel, self: boolean2() })) })
+      result: PersonSummary.extend({ devices: array(object({ device: MachineId, label: MachineLabel, self: boolean2(), away: literal(true).optional() })) })
     }
   };
 });
@@ -7670,7 +7700,10 @@ var NoticeId, NOTICE_LINE_CHARS = 120, Notice, NoticeCounts, DaemonHealth, Agent
 var init_jelly2 = __esm(() => {
   init_zod();
   init_common();
+  init_directory_frames();
+  init_jelly();
   init_directory();
+  init_device();
   init_shapes();
   init_surfaces();
   NoticeId = string2().regex(/^[mra]_[0-9A-Za-z]{1,64}$/, "notice id");
@@ -7724,8 +7757,32 @@ var init_jelly2 = __esm(() => {
       result: object({ notices: array(Notice), counts: NoticeCounts })
     },
     "notice.ack": { params: strictObject({ ids: array(NoticeId).min(1).max(200) }), result: object({ ok: literal(true) }) },
+    "daemon.woke": { params: strictObject({}), result: object({ ok: literal(true) }) },
+    "person.attached": { params: strictObject({ attached: boolean2() }), result: object({ ok: literal(true) }) },
+    "wake.arm": {
+      params: strictObject({
+        url: WakeUrl,
+        ticket: Jws.refine((ticket) => ticket.length <= WAKE_TICKET_BYTES, { message: `at most ${WAKE_TICKET_BYTES} bytes` }),
+        agents: array(SessionName).max(WAKE_AGENTS)
+      }),
+      result: object({ relay: _enum(["armed", "pending"]), awaiting: number2().int().nonnegative() })
+    },
+    "wake.disarm": { params: strictObject({}), result: object({ relay: _enum(["disarmed", "pending"]) }) },
+    "daemon.snapshot": {
+      params: strictObject({ done: literal(true).optional() }),
+      result: union([
+        object({
+          folder: string2().max(4096),
+          files: array(object({ name: string2().max(64), bytes: number2().int().nonnegative(), sha256: string2().regex(/^[0-9a-f]{64}$/) })).max(8),
+          storeSchema: number2().int().positive(),
+          at: Millis,
+          until: Millis
+        }),
+        object({ released: boolean2() })
+      ])
+    },
     "device.remove.preview": {
-      params: strictObject({ device: MachineId }),
+      params: DeviceRemoveParams,
       result: object({
         label: MachineLabel,
         kind: DeviceKind.optional(),
@@ -7739,7 +7796,7 @@ var init_jelly2 = __esm(() => {
 });
 
 // packages/core/dist/schema/ipc.js
-var MESSAGING_ERROR_RPC_CODE = -32000, SessionHost, IPC_PROTOCOL = 1, IpcHello, Ok, Empty, DaemonStatus, InviteSummary, IPC_METHODS, AGENT_METHODS, HOST_SCOPE_METHODS, IpcEvent;
+var MESSAGING_ERROR_RPC_CODE = -32000, SessionHost, IPC_PROTOCOL = 1, IpcHello, Ok, Empty, DaemonStatus, InviteSummary, IPC_METHODS, AGENT_METHODS, HUMAN_METHODS, ADMIN_METHODS, HOST_SCOPE_METHODS, IpcEvent;
 var init_ipc = __esm(() => {
   init_zod();
   init_device();
@@ -7980,7 +8037,64 @@ var init_ipc = __esm(() => {
     "task.update",
     "task.cancel"
   ];
-  HOST_SCOPE_METHODS = ["notice.subscribe", "notice.list", "conv.list", "daemon.stop"];
+  HUMAN_METHODS = [
+    "conv.list",
+    "conv.read",
+    "conv.markRead",
+    "conv.subscribe",
+    "person.send",
+    "people.search",
+    "people.get",
+    "grant.list",
+    "grant.set",
+    "grant.set.preview",
+    "request.list",
+    "request.answer",
+    "request.answer.preview",
+    "contact.request",
+    "contact.request.preview",
+    "card.get",
+    "agents.list",
+    "agents.read",
+    "notice.subscribe",
+    "notice.list",
+    "notice.ack",
+    "device.approve.preview",
+    "device.remove.preview",
+    "channel.create",
+    "channel.invite",
+    "channel.leave",
+    "channel.remove"
+  ];
+  ADMIN_METHODS = [
+    "daemon.stop",
+    "daemon.woke",
+    "person.attached",
+    "daemon.snapshot",
+    "wake.arm",
+    "wake.disarm",
+    "device.list",
+    "device.remove",
+    "device.link",
+    "device.login",
+    "device.login.status",
+    "device.login.cancel",
+    "device.approve",
+    "identity.rotateEnc",
+    "team.create",
+    "team.invite",
+    "team.join",
+    "team.members",
+    "team.remove",
+    "team.role",
+    "team.revokeInvite",
+    "team.add",
+    "team.pair",
+    "team.claim",
+    "team.pairCancel",
+    "team.prepare"
+  ];
+  HOST_SCOPE_METHODS = ["notice.subscribe", "notice.list", "conv.list", "daemon.stop", "daemon.woke", "person.attached", "daemon.snapshot", "wake.arm", "wake.disarm"];
   IpcEvent = discriminatedUnion("type", [
     object({ type: literal("inbox"), key: SessionKey, item: InboxItem }),
     object({ type: literal("receipt"), key: SessionKey, envelopeId: Ulid, to: SessionAddress, stage: DeliveryStage, code: ErrorCode.optional() }),
@@ -8047,7 +8161,7 @@ var init_b64u = __esm(() => {
 });
 
 // packages/core/dist/version.js
-var VERSION = "0.4.0";
+var VERSION = "0.5.0";
 
 // packages/core/dist/jcs.js
 function hasLoneSurrogate(text) {
@@ -9273,6 +9387,9 @@ var init_roster2 = __esm(() => {
 
 // packages/core/dist/jelly-host.js
 import { verify as ed25519Verify2 } from "crypto";
+function actionClass(method) {
+  return Object.hasOwn(ACTION_CLASSES, method) ? ACTION_CLASSES[method] : "local";
+}
 function grantInput(params) {
   return sha256(canonicalize(params ?? {}));
 }
@@ -9342,9 +9459,16 @@ function verifyActGrant(token, check) {
       throw fail("is for other params");
     checkTimes(claims.iat, claims.exp, ACT_GRANT_MAX_S, check.now, fail);
   }
-  if (claims.cls !== undefined && claims.act !== "host" && claims.cls !== (CHAT_CLASS.has(check.method) ? "chat" : "local"))
-    throw fail("names another action class");
-  return { scope: claims.act === "host" ? "host" : "action", jti: claims.jti, exp: claims.exp, dev: claims.dev };
+  if (claims.act === "host") {
+    if (claims.cls !== undefined)
+      throw fail("is host scope, which names no action class");
+  } else {
+    if (claims.cls === undefined)
+      throw fail("names no action class");
+    if (claims.cls !== actionClass(check.method))
+      throw fail(`names action class ${claims.cls}, not ${actionClass(check.method)}`);
+  }
+  return { scope: claims.act === "host" ? "host" : "action", jti: claims.jti, exp: claims.exp, dev: claims.dev, mbr: claims.mbr };
 }
 function verifySessionTicket(token, key, now) {
   const fail = (why) => new MessagingError("ticket_invalid", `the session ticket ${why}`);
@@ -9379,7 +9503,7 @@ function parseActKey(text) {
   }
   return parsed.data;
 }
-var ACT_GRANT_MAX_S = 60, HOST_GRANT_MAX_S = 600, SESSION_TICKET_MAX_S, JELLY_HOST_SKEW_S = 5, CHAT_CLASS;
+var ACT_GRANT_MAX_S = 60, HOST_GRANT_MAX_S = 600, SESSION_TICKET_MAX_S, JELLY_HOST_SKEW_S = 5, CHAT_METHODS, VIEW_METHODS, classOf2 = (method) => CHAT_METHODS.includes(method) ? "chat" : VIEW_METHODS.includes(method) ? "view" : "local", ACTION_CLASSES;
 var init_jelly_host = __esm(() => {
   init_b64u();
   init_hash();
@@ -9388,8 +9512,24 @@ var init_jelly_host = __esm(() => {
   init_wire();
   init_errors3();
   init_jelly();
+  init_ipc();
   SESSION_TICKET_MAX_S = 7 * 24 * 60 * 60;
-  CHAT_CLASS = new Set(["person.send", "conv.markRead"]);
+  CHAT_METHODS = ["person.send", "conv.markRead", "notice.ack"];
+  VIEW_METHODS = [
+    "conv.list",
+    "conv.read",
+    "conv.subscribe",
+    "people.search",
+    "people.get",
+    "grant.list",
+    "request.list",
+    "agents.list",
+    "agents.read",
+    "notice.subscribe",
+    "notice.list",
+    "device.list"
+  ];
+  ACTION_CLASSES = Object.freeze(Object.fromEntries([...HUMAN_METHODS, ...ADMIN_METHODS].map((method) => [method, classOf2(method)])));
 });
 
 // packages/core/dist/directory/person.js
@@ -12634,6 +12774,7 @@ var init_dist = __esm(() => {
   init_contact_card();
   init_delegation2();
   init_task();
+  init_a2a();
   init_direct2();
   init_peer_text();
   init_agent_tools();
@@ -15583,7 +15724,8 @@ function presencePayload(rows, label, seq, extra, policy) {
     label,
     sessions: [],
     features: [...FEATURES, ...extra?.features ?? []],
-    ...extra?.direct ? { direct: extra.direct } : {}
+    ...extra?.direct ? { direct: extra.direct } : {},
+    ...policy.away === true ? { away: true } : {}
   };
   return { ...payload, sessions: fitPresence(sessions, jcsBytes(payload), LIMITS.presenceBytes) };
 }
@@ -17019,6 +17161,12 @@ class DirectoryHome {
     this.#options.log("info", "directory.approved", { seq: done.seq });
     return done;
   }
+  async wake(state) {
+    const link = this.#link;
+    if (!link?.wake)
+      return "pending";
+    return link.wake(state);
+  }
   presenceWatch(persons) {
     this.#link?.presenceWatch(persons).catch((error) => this.#failed("directory.presence.watch", error));
   }
@@ -17033,6 +17181,7 @@ class DirectoryHome {
       },
       send: (env) => home.#link ? home.#link.send(env) : Promise.reject(noLink()),
       presence: (env) => home.#link?.presence(env),
+      retryNow: () => home.#link?.retryNow?.(),
       appendRoster: () => Promise.reject(new MessagingError("invalid_state", "a directory realm has no roster")),
       syncRoster: () => Promise.reject(new MessagingError("invalid_state", "a directory realm has no roster"))
     };
@@ -17147,7 +17296,12 @@ class JellyAuth {
         return refuse(new MessagingError("grant_invalid", "the host-scope grant is bound to another connection"));
       }
     }
-    this.#deps.log("info", "jelly.grant", { method: call.method, scope: grant.scope, ...grant.dev !== undefined ? { dev: grant.dev.slice(0, 200) } : {} });
+    this.#deps.log("info", "jelly.grant", {
+      method: call.method,
+      scope: grant.scope,
+      ...grant.dev !== undefined ? { dev: grant.dev.slice(0, 200) } : {},
+      ...grant.mbr !== undefined ? { mbr: grant.mbr.slice(0, 200) } : {}
+    });
     return { scope: grant.scope, expiresAt: (grant.exp + JELLY_HOST_SKEW_S) * 1000 };
   }
   ticket(p) {
@@ -17185,6 +17339,292 @@ var init_jelly3 = __esm(() => {
   HOST_SCOPE = new Set(HOST_SCOPE_METHODS);
 });
 
+// packages/daemon/dist/jelly-env.js
+import { delimiter, isAbsolute } from "path";
+function jellyEnvNamed(env) {
+  return JELLY_ENV.filter((name) => (env[name] ?? "") !== "");
+}
+function fail2(message) {
+  throw new MessagingError("invalid_request", message);
+}
+function required3(env, name) {
+  const value = env[name] ?? "";
+  if (value === "")
+    fail2(`${name} is not set: a Jelly host sets it with JELLY_ACTION_KEY`);
+  return value;
+}
+function folder(name, value, separator = delimiter) {
+  if (!isAbsolute(value))
+    fail2(`${name} is not an absolute path`);
+  if (value.includes(separator))
+    fail2(`${name} names more than one folder (joined with "${separator}"); the daemon takes one`);
+  return value;
+}
+function relayUrlOf(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return fail2(`JELLY_RESOURCES' ${JELLY_RESOURCE_NAME} url is not a URL`);
+  }
+  const loopback = /^(?:localhost|127\.\d{1,3}\.\d{1,3}\.\d{1,3}|\[::1\])$/.test(parsed.hostname);
+  const scheme = parsed.protocol === "https:" ? "wss:" : parsed.protocol === "http:" && loopback ? "ws:" : undefined;
+  if (scheme === undefined)
+    fail2(`JELLY_RESOURCES' ${JELLY_RESOURCE_NAME} url is not https:// (or http:// to a loopback host)`);
+  if (parsed.username !== "" || parsed.password !== "" || parsed.search !== "" || parsed.hash !== "" || parsed.pathname !== "/" && parsed.pathname !== "") {
+    fail2(`JELLY_RESOURCES' ${JELLY_RESOURCE_NAME} url is not an origin: the relay is derived from its origin alone`);
+  }
+  return `${scheme}//${parsed.host}/v1/connect`;
+}
+function jellyEnvRealm(env) {
+  let raw;
+  try {
+    raw = parseWire(required3(env, "JELLY_RESOURCES"), { maxBytes: 64 * 1024 });
+  } catch (error) {
+    if (error instanceof MessagingError && /JELLY_RESOURCES is not set/.test(error.message))
+      throw error;
+    return fail2("JELLY_RESOURCES is not JSON");
+  }
+  const list = Resources.safeParse(raw);
+  if (!list.success)
+    fail2("JELLY_RESOURCES is not a list of discovery entries");
+  const entries = list.data.map((item) => ResourceEntry.safeParse(item)).filter((parsed) => parsed.success && parsed.data.name === JELLY_RESOURCE_NAME);
+  if (entries.length === 0)
+    fail2(`JELLY_RESOURCES has no ${JELLY_RESOURCE_NAME} entry`);
+  if (entries.length > 1)
+    fail2(`JELLY_RESOURCES has more than one ${JELLY_RESOURCE_NAME} entry`);
+  const entry = entries[0].data;
+  const realm = DirectoryRealmConfig.strict().safeParse({
+    kind: "directory",
+    url: relayUrlOf(entry.url),
+    issuer: required3(env, "JELLY_ID_ISSUER"),
+    resource: entry.resource,
+    key: required3(env, "JELLY_SERVICE_ANCHOR")
+  });
+  if (!realm.success) {
+    const at = realm.error.issues[0]?.path[0];
+    fail2(at === "issuer" ? "JELLY_ID_ISSUER is not an https:// issuer" : at === "key" ? "JELLY_SERVICE_ANCHOR is not an Ed25519 key in base64url" : `JELLY_RESOURCES' ${JELLY_RESOURCE_NAME} entry is invalid at ${String(at)}`);
+  }
+  try {
+    directoryRealmId(realm.data);
+  } catch {
+    fail2("JELLY_SERVICE_ANCHOR is not a usable Ed25519 key");
+  }
+  return realm.data;
+}
+function readJellyEnv(env) {
+  const actKeyPath = required3(env, "JELLY_ACTION_KEY");
+  if (!isAbsolute(actKeyPath))
+    fail2("JELLY_ACTION_KEY is not an absolute path");
+  const home = folder("STATE_DIRECTORY", required3(env, "STATE_DIRECTORY"));
+  const runText = env.RUNTIME_DIRECTORY ?? "";
+  const groupText = env.JELLY_SOCKET_GROUP ?? "";
+  if (groupText !== "" && process.platform === "win32")
+    fail2("JELLY_SOCKET_GROUP is not supported on Windows: a named pipe is not shared with a group");
+  if (groupText !== "" && (!/^\d{1,10}$/.test(groupText) || Number(groupText) > 4294967294))
+    fail2("JELLY_SOCKET_GROUP is not a numeric gid");
+  let label;
+  try {
+    label = jellyLabel(required3(env, "JELLY_DEVICE_LABEL"));
+  } catch (error) {
+    if (error instanceof MessagingError && /is not set/.test(error.message))
+      throw error;
+    return fail2("JELLY_DEVICE_LABEL has no letter or digit to make a device label from");
+  }
+  return {
+    home,
+    ...runText !== "" ? { run: folder("RUNTIME_DIRECTORY", runText) } : {},
+    actKeyPath,
+    label,
+    ...groupText !== "" ? { socketGroup: Number(groupText) } : {},
+    realm: jellyEnvRealm(env)
+  };
+}
+function realmMismatch(pinned, named) {
+  return ["url", "issuer", "resource", "key"].filter((member) => pinned[member] !== named[member]);
+}
+async function pinRealm(realm, get = wellKnownGet) {
+  const origin = new URL(realm.url);
+  const url = `${origin.protocol === "wss:" ? "https:" : "http:"}//${origin.host}/.well-known/messaging.json`;
+  let text;
+  try {
+    text = await get(url);
+  } catch (error) {
+    throw new MessagingError("relay_unavailable", `cannot read the relay's realm document ${url} for the first start (${error instanceof Error ? error.message.slice(0, 200) : "failed"}); the next start tries again`);
+  }
+  let raw;
+  try {
+    raw = parseWire(text, { maxBytes: 16 * 1024 });
+  } catch {
+    return fail2(`the relay's realm document ${url} is not JSON`);
+  }
+  const { realm: _id, ...published } = typeof raw === "object" && raw !== null ? raw : {};
+  const parsed = DirectoryRealmConfig.safeParse(published);
+  if (!parsed.success)
+    fail2(`the relay's realm document ${url} is not a directory realm`);
+  const differs = realmMismatch(parsed.data, realm);
+  if (differs.length > 0)
+    fail2(`the relay's realm document ${url} names another ${differs.join(", ")} than the environment: the home is not pinned`);
+  return parsed.data.orgDomains !== undefined ? { ...realm, orgDomains: parsed.data.orgDomains } : realm;
+}
+var JELLY_ENV, JELLY_RESOURCE_NAME = "messaging", ResourceEntry, Resources, wellKnownGet = async (url) => {
+  const response = await fetch(url, { redirect: "error", signal: AbortSignal.timeout(5000) });
+  if (!response.ok)
+    throw new MessagingError("relay_unavailable", `the relay answered ${response.status}`);
+  const text = await response.text();
+  if (Buffer.byteLength(text) > 16 * 1024)
+    throw new MessagingError("too_large", "the relay's realm document is larger than 16 KiB");
+  return text;
+};
+var init_jelly_env = __esm(() => {
+  init_dist();
+  init_zod();
+  init_jelly3();
+  JELLY_ENV = ["JELLY_ACTION_KEY", "JELLY_ID_ISSUER", "JELLY_RESOURCES", "JELLY_SERVICE_ANCHOR", "JELLY_DEVICE_LABEL", "JELLY_SOCKET_GROUP"];
+  ResourceEntry = looseObject({ name: string2().max(200), resource: string2().min(1).max(2048), url: string2().min(1).max(2048) });
+  Resources = array(unknown()).max(64);
+});
+
+// packages/daemon/dist/consent/answer-preview.js
+function who3(from) {
+  const name = cleanPeerText(from.name, { singleLine: true, maxChars: 80 }) || "someone";
+  const email = from.email === undefined ? undefined : cleanPeerText(from.email, { singleLine: true, maxChars: 100 });
+  return `${name} (${email !== undefined && email !== "" ? `${email}, ` : ""}${ORG[from.org]})`;
+}
+function answersFor(kind) {
+  return kind === "suggestion" ? ["decline"] : kind === "contact" ? ["accept", "decline", "block"] : ["once", "always", "decline", "block"];
+}
+function answerSentence(input) {
+  const { kind, answer } = input;
+  if (answer !== undefined && !answersFor(kind).includes(answer)) {
+    throw new MessagingError("invalid_request", `a ${kind === "message" || kind === "task" ? "request to your agent" : kind === "contact" ? "message request" : "suggestion"} takes ${answersFor(kind).join(", ")}`);
+  }
+  const sender = who3(input.from);
+  const single = input.count <= 1;
+  if (kind === "suggestion") {
+    const email = cleanPeerText(input.email ?? "", { singleLine: true, maxChars: 100 });
+    if (answer === undefined)
+      return `Your agent ${input.agent} suggests you send a message request to ${email}.`;
+    return `Dismiss your agent ${input.agent}'s suggestion to contact ${email}. Nothing is sent.`;
+  }
+  if (kind === "contact") {
+    const thing = single ? "their message request" : `their ${input.count} message requests`;
+    if (answer === undefined)
+      return `${sender} asks to message you.`;
+    if (answer === "accept")
+      return `${sender} may message you from now on: ${single ? "their request becomes their first message" : "their requests become their first messages"}, and they get your card.`;
+    if (answer === "decline")
+      return `Decline ${thing} from ${sender}. They are told it was declined.`;
+    return `Block ${sender}: nothing from them or their agents reaches you, and ${thing} ${single ? "is" : "are"} declined.`;
+  }
+  const thing = single ? `this ${kind}` : `these ${input.count} requests`;
+  const src = single ? `${sender}'s agent ${input.agent}` : `${sender}'s agents`;
+  const dst = single ? `your agent ${input.to}` : "your agents";
+  if (answer === undefined)
+    return `${src} asks to send ${kind === "task" ? "a task" : "a message"} to ${dst}.`;
+  if (answer === "once")
+    return `Deliver ${thing} from ${src} to ${dst} this once, guarded: ${single ? "your agent" : "your agents"} may answer only them.`;
+  if (answer === "always")
+    return `Deliver ${thing} from ${src} to ${dst}, and let their agents ask yours from now on without asking you.`;
+  if (answer === "decline")
+    return `Decline ${thing} from ${src}. They are told it was declined.`;
+  return `Block ${sender}: nothing from them or their agents reaches you, and ${thing} ${single ? "is" : "are"} declined.`;
+}
+var ORG;
+var init_answer_preview = __esm(() => {
+  init_dist();
+  ORG = { same: "your org", other: "another org", none: "no org" };
+});
+
+// packages/daemon/dist/snapshot.js
+import { createHash as createHash10 } from "crypto";
+import { chmodSync as chmodSync4, chownSync as chownSync2, existsSync as existsSync6, lstatSync as lstatSync4, mkdirSync as mkdirSync5, readFileSync as readFileSync8, rmSync as rmSync4, writeFileSync as writeFileSync5 } from "fs";
+import { join as join7 } from "path";
+function sha256File(path) {
+  const data = readFileSync8(path);
+  return { bytes: data.length, sha256: createHash10("sha256").update(data).digest("hex") };
+}
+
+class Snapshots {
+  #deps;
+  #timer;
+  constructor(deps) {
+    this.#deps = deps;
+  }
+  get folder() {
+    return join7(this.#deps.run, "snapshot");
+  }
+  take() {
+    const folder = this.folder;
+    if (existsSync6(folder))
+      throw new MessagingError("invalid_state", "a snapshot is held: release it with daemon.snapshot {done: true} first");
+    const group = this.#deps.group;
+    mkdirSync5(folder, { mode: group === undefined ? 448 : 488 });
+    try {
+      if (!IS_WINDOWS && group !== undefined) {
+        chownSync2(folder, process.geteuid?.() ?? -1, group);
+        chmodSync4(folder, 488);
+      }
+      const fileMode = group === undefined ? 384 : 416;
+      const files = [];
+      const db = join7(folder, "messaging.db");
+      this.#deps.vacuumInto(db);
+      if (existsSync6(this.#deps.config))
+        writeFileSync5(join7(folder, "config.json"), readFileSync8(this.#deps.config), { mode: fileMode });
+      for (const name of ["messaging.db", "config.json"]) {
+        const path = join7(folder, name);
+        if (!existsSync6(path))
+          continue;
+        if (!IS_WINDOWS) {
+          if (group !== undefined)
+            chownSync2(path, process.geteuid?.() ?? -1, group);
+          chmodSync4(path, fileMode);
+        }
+        files.push({ name, ...sha256File(path) });
+      }
+      const at = this.#deps.now();
+      const until = at + SNAPSHOT_HOLD_MS;
+      const manifest = { storeSchema: this.#deps.storeSchema, at, files };
+      writeFileSync5(join7(folder, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
+`, { mode: fileMode });
+      if (!IS_WINDOWS && group !== undefined)
+        chownSync2(join7(folder, "manifest.json"), process.geteuid?.() ?? -1, group);
+      clearTimeout(this.#timer);
+      this.#timer = setTimeout(() => this.release(), SNAPSHOT_HOLD_MS);
+      this.#timer.unref();
+      return { folder, files, storeSchema: this.#deps.storeSchema, at, until };
+    } catch (error) {
+      this.release();
+      if (error instanceof MessagingError)
+        throw error;
+      throw new MessagingError("internal", `the snapshot failed: ${error.code ?? "error"}`);
+    }
+  }
+  release() {
+    clearTimeout(this.#timer);
+    this.#timer = undefined;
+    let present;
+    try {
+      lstatSync4(this.folder);
+      present = true;
+    } catch {
+      present = false;
+    }
+    if (present)
+      rmSync4(this.folder, { recursive: true, force: true });
+    return { released: present };
+  }
+  close() {
+    this.release();
+  }
+}
+var SNAPSHOT_HOLD_MS;
+var init_snapshot = __esm(() => {
+  init_dist();
+  init_dist2();
+  SNAPSHOT_HOLD_MS = 60 * 60000;
+});
+
 // packages/daemon/dist/notices.js
 class Notices {
   #host;
@@ -17861,7 +18301,7 @@ var init_storage_errors = __esm(() => {
 });
 
 // packages/daemon/dist/store.js
-import { chmodSync as chmodSync4, closeSync as closeSync7, openSync as openSync3 } from "fs";
+import { chmodSync as chmodSync5, closeSync as closeSync7, openSync as openSync3 } from "fs";
 import { DatabaseSync } from "node:sqlite";
 function additiveColumn(decl) {
   if (/\b(PRIMARY|UNIQUE|CHECK|REFERENCES|COLLATE|GENERATED|AS)\b/i.test(decl))
@@ -17950,7 +18390,7 @@ class Store {
   constructor(path) {
     if (path !== ":memory:") {
       closeSync7(openSync3(path, "a", 384));
-      chmodSync4(path, 384);
+      chmodSync5(path, 384);
     }
     this.#db = new DatabaseSync(path, { timeout: 5000 });
     this.#db.exec("PRAGMA journal_mode = WAL; PRAGMA synchronous = FULL;");
@@ -17965,6 +18405,11 @@ class Store {
     this.#statements.clear();
     this.#db.close();
   }
+  vacuumInto(path) {
+    if (this.#depth > 0)
+      throw new MessagingError("invalid_state", "a snapshot is not taken inside a transaction");
+    this.#db.exec(`VACUUM INTO '${path.replaceAll("'", "''")}'`);
+  }
   tx(fn) {
     if (this.#depth > 0) {
       const name = `sp${this.#depth}`;
@@ -18602,6 +19047,14 @@ class Store {
          SELECT substr(peer_address, 1, instr(peer_address || '@', '@') - 1), 0, created_at FROM tasks WHERE key = ?
        ) GROUP BY peer ORDER BY MAX(at) DESC, peer LIMIT ?`, key, key, key, limit).map((row) => ({ peer: String(row.peer), unread: Number(row.unread), lastAt: Number(row.at) }));
   }
+  awaitedRequests(sessions, terminal, limit) {
+    if (sessions.length === 0)
+      return [];
+    const rows = this.#all(`SELECT request FROM tasks WHERE role = 'requester' AND request IS NOT NULL
+         AND session IN (${sessions.map(() => "?").join(", ")}) AND state NOT IN (${terminal.map(() => "?").join(", ")})
+       ORDER BY updated_at DESC, task_id DESC LIMIT ?`, ...sessions, ...terminal, limit);
+    return rows.map((row) => String(row.request));
+  }
   task(taskId, role) {
     const row = this.#get(`SELECT * FROM ${TASKS} WHERE task_id = ? AND role = ?`, taskId, role);
     return row && taskRow2(row);
@@ -19173,14 +19626,14 @@ var init_version = __esm(() => {
 });
 
 // packages/daemon/dist/wake-bridge.js
-import { closeSync as closeSync8, constants as constants7, fstatSync as fstatSync4, lstatSync as lstatSync4, openSync as openSync4, readSync as readSync2 } from "fs";
+import { closeSync as closeSync8, constants as constants7, fstatSync as fstatSync4, lstatSync as lstatSync5, openSync as openSync4, readSync as readSync2 } from "fs";
 import { request } from "http";
 import { homedir as homedir2 } from "os";
-import { isAbsolute, join as join7 } from "path";
+import { isAbsolute as isAbsolute2, join as join8 } from "path";
 function serviceFile(env = process.env, windows = IS_WINDOWS) {
   const home = (windows ? env.USERPROFILE : env.HOME) || homedir2();
-  const state = env.XDG_STATE_HOME && isAbsolute(env.XDG_STATE_HOME) ? env.XDG_STATE_HOME : join7(home, ".local", "state");
-  return join7(state, "opencode", "service.json");
+  const state = env.XDG_STATE_HOME && isAbsolute2(env.XDG_STATE_HOME) ? env.XDG_STATE_HOME : join8(home, ".local", "state");
+  return join8(state, "opencode", "service.json");
 }
 function loopbackOrigin(url) {
   let parsed;
@@ -19199,7 +19652,7 @@ function loopbackOrigin(url) {
 function readService(file) {
   if (IS_WINDOWS) {
     try {
-      const stats = lstatSync4(file);
+      const stats = lstatSync5(file);
       if (stats.isSymbolicLink() || !stats.isFile() || aclProblem(file, { pinnedOwner: false }) !== undefined)
         return "service_unsafe";
     } catch (error) {
@@ -20211,6 +20664,8 @@ class Daemon {
   #closed = false;
   #online = new Set;
   #holders = new Map;
+  #ticketEnds = new Map;
+  #lapsed = new Map;
   #policy = {
     rate: inboundRateLimiter(),
     presence: responseRateLimiter(),
@@ -20230,6 +20685,9 @@ class Daemon {
   #requests;
   #notices;
   #jellyHost;
+  #attached = false;
+  #wakeArmed = false;
+  #snapshots;
   #jellyAuth;
   #state = "starting";
   #sync;
@@ -20340,6 +20798,14 @@ class Daemon {
       address: (sender, session) => peerRef(sender, session).address,
       held: (row) => this.#notices.held(row)
     });
+    this.#snapshots = new Snapshots({
+      run: paths.run,
+      config: paths.config,
+      vacuumInto: (path) => this.#store.vacuumInto(path),
+      storeSchema: STORE_SCHEMA,
+      group: options.jellyHost?.socketGroup,
+      now: this.#now
+    });
     this.#notices = new Notices({
       store,
       now: this.#now,
@@ -20379,6 +20845,10 @@ class Daemon {
   static async start(options) {
     const paths = homePaths(options.home, options.jellyHost?.run);
     ensureHome(paths);
+    const jelly = options.jellyHost;
+    if (jelly?.realm !== undefined && readConfig(paths.config).realm === undefined) {
+      options = { ...options, jellyHost: { ...jelly, realm: await pinRealm(jelly.realm, options.wellKnown) } };
+    }
     jellyConfig(paths.config, options.jellyHost);
     const lock = acquireLock(paths.lock);
     let store;
@@ -20417,6 +20887,7 @@ class Daemon {
     }
     this.#sync.load();
     this.#store.keepAllLive(this.#now(), CLI_AGENT);
+    this.#snapshots.release();
     const handlers = this.#handlers();
     const jelly = this.#jellyHost;
     if (jelly)
@@ -20541,6 +21012,7 @@ class Daemon {
         await server.close().catch(() => {});
       await Promise.race([this.#flushing, new Promise((resolve) => setTimeout(resolve, 2000).unref())]);
       this.#store.close();
+      this.#snapshots.close();
     } finally {
       this.#lock.release();
       this.#log("info", "daemon.stopped", { pid: process.pid });
@@ -20689,6 +21161,7 @@ class Daemon {
       },
       "request.list": async () => ({ requests: [...this.#holds.list().requests, ...await this.#requests.list()] }),
       "request.answer": (p) => this.#requests.holds(p.id) ? this.#requests.answer(p) : this.#holds.answer(p),
+      "request.answer.preview": (p) => this.#answerPreview(p),
       "contact.request": (p) => this.#requests.request(p),
       "contact.request.preview": (p) => this.#requests.preview(p),
       "card.get": async (p) => {
@@ -20697,6 +21170,11 @@ class Daemon {
         return { sent: await this.#cards.get(p.person) };
       },
       "daemon.health": () => this.#health(),
+      "daemon.woke": () => this.#woke(),
+      "wake.arm": (p) => this.#wakeArm(p),
+      "wake.disarm": () => this.#wakeDisarm(),
+      "daemon.snapshot": (p) => p.done ? this.#snapshots.release() : this.#snapshots.take(),
+      "person.attached": (p) => this.#personAttached(p.attached),
       "agents.list": () => this.#agentsList(),
       "agents.read": (p) => this.#agentsRead(p),
       "notice.subscribe": (p, ctx, authority) => this.#notices.subscribe(ctx, p, authority?.scope === "host" ? authority.expiresAt : undefined),
@@ -20893,14 +21371,39 @@ class Daemon {
     if (!holders)
       this.#holders.set(p.key, holders = new Set);
     holders.add(ctx.id);
+    if (ticket) {
+      this.#ticketEnds.set(p.key, Math.max(this.#ticketEnds.get(p.key) ?? 0, ticket.exp * 1000));
+      for (const id of this.#lapsed.get(p.key) ?? [])
+        holders.add(id);
+      this.#lapsed.delete(p.key);
+    }
     this.#sessionsChanged();
     return { session: name, address: formatAddress(me.person, name, me.label) };
   }
   #bound(p, ctx) {
+    const ends = this.#ticketEnds.get(p.key);
+    const held = this.#holders.get(p.key)?.has(ctx.id) === true || this.#lapsed.get(p.key)?.has(ctx.id) === true;
+    if (ends !== undefined && ends <= this.#now() && held) {
+      throw new MessagingError("ticket_invalid", "the session ticket this session registered with has expired: register again with a fresh ticket from the host");
+    }
     if (!this.#holders.get(p.key)?.has(ctx.id))
       throw new MessagingError("not_found", "this session key is not registered on this connection");
     return p;
   }
+  #expireTickets(now) {
+    let changed = false;
+    for (const [key, ends] of this.#ticketEnds) {
+      if (ends > now || !this.#holders.has(key))
+        continue;
+      this.#lapsed.set(key, this.#holders.get(key));
+      this.#holders.delete(key);
+      this.#log("info", "session.ticket.expired", {});
+      if (this.#store.keepSession(key, now))
+        changed = true;
+    }
+    if (changed)
+      this.#sessionsChanged();
+  }
   #sessionOf(key) {
     const session = this.#store.sessionByKey(key);
     if (!session)
@@ -20923,6 +21426,8 @@ class Daemon {
   }
   #unregister(p) {
     this.#holders.delete(p.key);
+    this.#ticketEnds.delete(p.key);
+    this.#lapsed.delete(p.key);
     if (this.#store.keepSession(p.key, this.#now()))
       this.#sessionsChanged();
     return { ok: true };
@@ -20933,10 +21438,14 @@ class Daemon {
     this.#chats.disconnected(ctx);
     this.#notices.disconnected(ctx.id);
     let changed = false;
+    for (const [key, lapsed] of [...this.#lapsed])
+      if (lapsed.delete(ctx.id) && lapsed.size === 0)
+        this.#lapsed.delete(key);
     for (const [key, holders] of [...this.#holders]) {
       if (!holders.delete(ctx.id) || holders.size > 0)
         continue;
       this.#holders.delete(key);
+      this.#ticketEnds.delete(key);
       if (this.#store.sessionByKey(key)?.agent === CLI_AGENT)
         continue;
       if (this.#store.keepSession(key, this.#now()))
@@ -20984,7 +21493,8 @@ class Daemon {
         to: { team: true },
         payload: presencePayload(final ? this.#store.sessions().map((s) => ({ ...s, unregisteredAt: s.unregisteredAt ?? this.#now() })) : this.#store.sessions(), me.label, this.#store.next("presence"), this.#transport?.advertise?.(), {
           wake: (s) => this.#wakes(s),
-          share: new Set(this.#currentConfig().presence?.share ?? [])
+          share: new Set(this.#currentConfig().presence?.share ?? []),
+          away: this.#away()
         }),
         now: this.#now()
       });
@@ -21267,7 +21777,19 @@ class Daemon {
   async#peopleGet(p) {
     const { realm, identity } = this.#joined();
     const profile = await realm.profile(p.person);
-    const devices = realm.known(p.person).devices.map((device) => ({ device: device.machine, label: device.label, self: device.machine === identity.machine }));
+    const fresh = this.#now() - (realm.kind === "directory" ? this.#tuning.presenceOnlineMs : this.#tuning.presenceMaxMs * 2);
+    const away = (machine) => {
+      if (machine === identity.machine)
+        return this.#away();
+      const row = this.#store.directoryRow(machine);
+      return row !== undefined && row.receivedAt >= fresh && row.presence.away === true;
+    };
+    const devices = realm.known(p.person).devices.map((device) => ({
+      device: device.machine,
+      label: device.label,
+      self: device.machine === identity.machine,
+      ...away(device.machine) ? { away: true } : {}
+    }));
     return { person: p.person, ...profile, devices };
   }
   #seal(type, toMachine, session, payload, extra = {}) {
@@ -22143,6 +22665,7 @@ ${row.receipt ? "receipt" : "envelope"}`;
       return;
     this.#directory?.sweep();
     const now = this.#now();
+    this.#expireTickets(now);
     let sessions = 0;
     try {
       this.#tx(() => {
@@ -22416,6 +22939,86 @@ ${row.receipt ? "receipt" : "envelope"}`;
     const devices = realm.known(me.person).devices.map((d) => ({ device: d.machine, label: d.label, vouched: "admin", current: true, self: d.machine === identity.machine }));
     return { devices };
   }
+  #away() {
+    return this.#jellyHost !== undefined && !this.#attached;
+  }
+  #personAttached(attached) {
+    if (attached !== this.#attached) {
+      this.#attached = attached;
+      this.#log("info", "person.attached", { attached });
+      this.#presenceSoon();
+    }
+    return { ok: true };
+  }
+  #woke() {
+    this.#log("info", "daemon.woke", {});
+    this.#transport?.retryNow?.();
+    this.sweep();
+    this.#presenceSoon();
+    this.#wokeHook();
+    return { ok: true };
+  }
+  #wokeHook() {
+    if (!this.#wakeArmed)
+      return;
+    this.#wakeDisarm().catch((error) => this.#log("warn", "wake.disarm.failed", { code: codeOf(error) }));
+  }
+  async#wakeArm(p) {
+    const home = this.#directory;
+    if (!home)
+      throw new MessagingError("invalid_state", "wake tickets are for a directory realm");
+    if (home.person() === undefined)
+      throw new MessagingError("invalid_state", "this device is not bound yet");
+    const issuer = this.#config.realm?.issuer;
+    if (issuer === undefined || new URL(p.url).origin !== new URL(issuer).origin)
+      throw new MessagingError("invalid_request", "the wake URL is not on the realm's Jelly ID");
+    const agents = [...new Set(p.agents)];
+    const awaiting = this.#store.awaitedRequests(agents, TERMINAL_STATES, WAKE_AWAITING);
+    const sent = await home.wake({ url: p.url, ticket: p.ticket, agents, awaiting });
+    this.#wakeArmed = true;
+    this.#log("info", "wake.arm", { relay: sent === "sent" ? "armed" : "pending", agents: agents.length, awaiting: awaiting.length });
+    return { relay: sent === "sent" ? "armed" : "pending", awaiting: awaiting.length };
+  }
+  async#wakeDisarm() {
+    const home = this.#directory;
+    if (!home)
+      throw new MessagingError("invalid_state", "wake tickets are for a directory realm");
+    const sent = await home.wake("disarm");
+    this.#wakeArmed = false;
+    this.#log("info", "wake.disarm", { relay: sent === "sent" ? "disarmed" : "pending" });
+    return { relay: sent === "sent" ? "disarmed" : "pending" };
+  }
+  async#answerPreview(p) {
+    const { realm, me } = this.#joined();
+    const now = this.#now();
+    const profile = async (person) => {
+      const found = await realm.profile(person).catch(() => {
+        return;
+      });
+      return found ? { name: found.name.slice(0, 200), ...found.email !== undefined ? { email: found.email.slice(0, 320) } : {}, org: found.org } : { name: String(person).slice(0, 200), org: "none" };
+    };
+    const answer = p.answer;
+    const ask = this.#store.held(p.id);
+    if (ask && ask.exp > now) {
+      const kind = ask.payload.kind;
+      const count = p.all ? this.#store.helds(ask.person).filter((row) => row.exp > now).length : 1;
+      const from = await profile(ask.person);
+      const agent = ask.envelope.from.agent ?? "";
+      return { kind, from, ...agent !== "" ? { agent } : {}, to: ask.session, count, sentence: answerSentence({ kind, from, agent, to: ask.session, answer, count }) };
+    }
+    const request = this.#store.contactRequest(p.id);
+    if (request && request.exp > now) {
+      const count = p.all ? this.#store.contactRequests(request.person).filter((row) => row.exp > now).length : 1;
+      const from = await profile(request.person);
+      return { kind: "contact", from, count, sentence: answerSentence({ kind: "contact", from, answer, count }) };
+    }
+    const suggestion = this.#store.contactSuggestion(p.id);
+    if (suggestion) {
+      const from = await profile(me.person);
+      return { kind: "suggestion", from, agent: suggestion.session, count: 1, sentence: answerSentence({ kind: "suggestion", from, agent: suggestion.session, email: suggestion.email, answer, count: 1 }) };
+    }
+    throw new MessagingError("not_found", "no request with that id is held here");
+  }
   #me() {
     return (this.#realm ?? this.#directory?.realm)?.self()?.person;
   }
@@ -22834,6 +23437,22 @@ function jellyConfig(path, jelly) {
     }
     return;
   }
+  if (jelly.realm !== undefined) {
+    if (config.realm === undefined) {
+      if (config.relay !== undefined || config.person !== undefined) {
+        throw new MessagingError("invalid_request", `${path} is a roster home (relay, person): a Jelly host's home is pinned to a directory realm; give the service a new STATE_DIRECTORY`);
+      }
+      if (config.ipc?.agentGroup !== undefined)
+        throw new MessagingError("invalid_request", "deployment jelly shares its sockets with --socket-group, not ipc.agentGroup");
+      writeConfig(path, { ...config, realm: jelly.realm, deployment: "jelly" });
+      return;
+    }
+    const differs = realmMismatch(config.realm, jelly.realm);
+    if (differs.length > 0) {
+      const which = differs.map((member) => `${member} ${JSON.stringify(config.realm[member])} (the environment: ${JSON.stringify(jelly.realm[member])})`).join(", ");
+      throw new MessagingError("invalid_request", `${path} pins another realm: ${which}. A home never changes realm, and the daemon does not rewrite it; restore the variables the home was made with, or give the service a new STATE_DIRECTORY`);
+    }
+  }
   if (config.realm === undefined)
     throw new MessagingError("invalid_request", "deployment jelly needs a directory realm: config.json has no realm (a Jelly host supervises no roster realm)");
   if (config.ipc?.agentGroup !== undefined)
@@ -22862,6 +23481,9 @@ var init_daemon = __esm(() => {
   init_roster_identity();
   init_directory_home();
   init_jelly3();
+  init_jelly_env();
+  init_answer_preview();
+  init_snapshot();
   init_notices();
   init_resolve();
   init_secrets();
@@ -23483,6 +24105,9 @@ class DirectTransport {
   presence(env) {
     this.#relay.presence(env);
   }
+  retryNow() {
+    this.#relay.retryNow?.();
+  }
   appendRoster(entry) {
     return this.#relay.appendRoster(entry);
   }
@@ -23584,6 +24209,11 @@ var init_pacing = __esm(() => {
   PAIR_WINDOW_MS = 30 * DAY_MS5;
 });
 
+// packages/relay/dist/directory/wakes.js
+var init_wakes = __esm(() => {
+  init_dist();
+});
+
 // packages/relay/dist/directory/module.js
 var DAY4, DIRECTORY_FRAMES;
 var init_module = __esm(() => {
@@ -23592,9 +24222,30 @@ var init_module = __esm(() => {
   init_feed();
   init_jelly4();
   init_pacing();
+  init_wakes();
   DAY4 = 24 * 60;
-  DIRECTORY_FRAMES = new Set(["dir.bind", "dir.append", "dir.keys", "dir.sth", "dir.lookup", "dir.device", "dir.resolve", "dir.search", "dir.watch", "presence.watch", "dir.erase"]);
+  DIRECTORY_FRAMES = new Set([
+    "dir.bind",
+    "dir.append",
+    "dir.keys",
+    "dir.sth",
+    "dir.lookup",
+    "dir.device",
+    "dir.resolve",
+    "dir.search",
+    "dir.watch",
+    "presence.watch",
+    "dir.erase",
+    "wake.arm",
+    "wake.disarm"
+  ]);
+});
+
+// packages/relay/dist/directory/store.js
+var init_store4 = __esm(() => {
+  init_dist();
 });
+
 // packages/relay/dist/server.js
 var HIGH_WATER, MAX_BUFFERED;
 var init_server2 = __esm(() => {
@@ -23605,6 +24256,7 @@ var init_server2 = __esm(() => {
   init_pages();
   init_store3();
   init_module();
+  init_store4();
   HIGH_WATER = 1024 * 1024;
   MAX_BUFFERED = 16 * 1024 * 1024;
 });
@@ -23657,6 +24309,14 @@ class RelayClient {
     if (!this.#ws && !this.#retryTimer)
       this.#open();
   }
+  retryNow() {
+    if (!this.#running || this.#ws || !this.#retryTimer)
+      return;
+    clearTimeout(this.#retryTimer);
+    this.#retryTimer = undefined;
+    this.#attempt = 0;
+    this.#open();
+  }
   async stop() {
     this.#running = false;
     clearTimeout(this.#retryTimer);
@@ -23733,6 +24393,12 @@ class RelayClient {
   presenceWatch(persons) {
     return this.#dir("dir.ok", { t: "presence.watch", persons });
   }
+  wakeArm(arm) {
+    return this.#dir("dir.ok", { t: "wake.arm", url: arm.url, ticket: arm.ticket, agents: arm.agents, awaiting: arm.awaiting });
+  }
+  wakeDisarm() {
+    return this.#dir("dir.ok", { t: "wake.disarm" });
+  }
   dirErase(entries, token) {
     return this.#dir("dir.ok", { t: "dir.erase", entries, token });
   }
@@ -24310,6 +24976,7 @@ class RelayDirectoryLink {
   #running = false;
   #watched = [];
   #presence = [];
+  #wake;
   #opening = new Set;
   constructor(options) {
     this.#options = options;
@@ -24351,6 +25018,8 @@ class RelayDirectoryLink {
           client.dirWatch(this.#watched).catch(() => {});
         if (this.#presence.length > 0)
           client.presenceWatch(this.#presence).catch(() => {});
+        if (this.#wake !== undefined)
+          this.#sendWake(client, this.#wake).catch(() => {});
         const sth = "sth" in state ? STH.safeParse(state.sth) : undefined;
         pushes.state(true, sth?.success ? sth.data : undefined);
       },
@@ -24458,6 +25127,34 @@ class RelayDirectoryLink {
   presence(env) {
     this.#client?.presence(env);
   }
+  retryNow() {
+    this.#client?.retryNow();
+  }
+  async wake(state) {
+    this.#wake = state;
+    const client = this.#connect();
+    if (!client?.connected)
+      return "pending";
+    try {
+      await this.#sendWake(client, state);
+      return "sent";
+    } catch (error) {
+      if (isMessagingError(error) && error.code === "relay_unavailable")
+        return "pending";
+      throw error;
+    }
+  }
+  async#sendWake(client, state) {
+    try {
+      parse5(DirOkFrame, await (state === "disarm" ? client.wakeDisarm() : client.wakeArm(state)));
+    } catch (error) {
+      if (!(isMessagingError(error) && error.code === "relay_unavailable") && this.#wake === state)
+        this.#wake = undefined;
+      throw error;
+    }
+    if (this.#wake === state)
+      this.#wake = undefined;
+  }
   async presenceWatch(persons) {
     this.#presence = [...persons];
     const client = this.#connect();
@@ -24516,6 +25213,7 @@ var init_dist4 = __esm(() => {
   init_log();
   init_version();
   init_jelly3();
+  init_jelly_env();
   init_store2();
   init_dist();
 });
@@ -27276,7 +27974,13 @@ Runs the Messaging daemon in the foreground for one MESSAGING_HOME (default ~/.m
   --version             print the version, the store schema and the protocol (--json: as JSON); needs no home
   --help                print this help
 
-Under a Jelly host (spec \xA78.11):
+Under a Jelly host (spec \xA78.11), with no arguments: the environment start contract. JELLY_ACTION_KEY (the path of
+the host's public action key) starts it; STATE_DIRECTORY is the home, RUNTIME_DIRECTORY the socket folder,
+JELLY_DEVICE_LABEL the label, JELLY_SOCKET_GROUP the group, and JELLY_ID_ISSUER, JELLY_RESOURCES (the messaging entry)
+and JELLY_SERVICE_ANCHOR the realm, which the first start writes to config.json. Flags win: a start with
+--deployment jelly reads none of these; any other start with JELLY_* variables set is refused.
+
+Or by flags:
   --deployment jelly    every human and admin call needs the host's action grant
   --act-key <path>      the host's public action key (an Ed25519 JWK); required
   --label <label>       this device's label, from the host; required
@@ -27336,7 +28040,20 @@ function versionText(json, info) {
   return `messagingd ${info.version} (store schema ${info.storeSchema}, protocol ${info.protocol})
 `;
 }
-async function daemonMain(argv) {
+function startSource(values, env, named) {
+  const flags = Object.keys(values).length > 0;
+  if (flags) {
+    if (values["--deployment"] === "jelly" || named.length === 0)
+      return "flags";
+    return `${named[0]} is set, so the environment starts a Jelly host, but the flags start a self-host daemon; use one or the other`;
+  }
+  if ((env.JELLY_ACTION_KEY ?? "") !== "")
+    return "environment";
+  if (named.length > 0)
+    return `${named[0]} is set without JELLY_ACTION_KEY: a Jelly start needs the host's action key`;
+  return "self";
+}
+async function daemonMain(argv, env = process.env) {
   const args = parseArgs2(argv);
   if (typeof args === "string") {
     process.stderr.write(`messagingd: ${args}
@@ -27354,7 +28071,23 @@ ${USAGE}`);
     return 0;
   }
   const { values } = args;
-  const home = values["--home"] ? resolve4(values["--home"]) : messagingHome();
+  const source = startSource(values, env, jellyEnvNamed(env));
+  if (source !== "flags" && source !== "environment" && source !== "self") {
+    process.stderr.write(`messagingd: ${source}
+`);
+    return 2;
+  }
+  let fromEnv;
+  if (source === "environment") {
+    try {
+      fromEnv = readJellyEnv(env);
+    } catch (error) {
+      process.stderr.write(`messagingd: ${error instanceof Error ? error.message : "the Jelly environment is invalid"}
+`);
+      return 1;
+    }
+  }
+  const home = fromEnv ? resolve4(fromEnv.home) : values["--home"] ? resolve4(values["--home"]) : messagingHome();
   const level = process.env.MESSAGING_LOG_LEVEL;
   const log = createLogger({
     file: homePaths(home).log,
@@ -27363,7 +28096,14 @@ ${USAGE}`);
   });
   let daemon;
   try {
-    const jellyHost = values["--deployment"] === "jelly" ? {
+    const jellyHost = fromEnv ? {
+      actKey: readActKey(fromEnv.actKeyPath),
+      label: fromEnv.label,
+      kind: "jelly-host",
+      realm: fromEnv.realm,
+      ...fromEnv.socketGroup !== undefined ? { socketGroup: fromEnv.socketGroup } : {},
+      ...fromEnv.run !== undefined ? { run: resolve4(fromEnv.run) } : {}
+    } : values["--deployment"] === "jelly" ? {
       actKey: readActKey(resolve4(values["--act-key"])),
       label: jellyLabel(values["--label"]),
       kind: "jelly-host",
@@ -27371,6 +28111,8 @@ ${USAGE}`);
       ...values["--run"] !== undefined ? { run: resolve4(values["--run"]) } : {}
     } : undefined;
     daemon = await startDaemon2({ home, log, ...jellyHost ? { jellyHost } : {} });
+    if (jellyHost)
+      log("info", "daemon.start", { deployment: "jelly", source });
   } catch (error) {
     process.stderr.write(`messagingd: ${error instanceof Error ? error.message : "failed to start"}
 `);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@joe-broadhead/messaging-bin-linux-x64-gnu",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "The self-contained messagingd executable for one platform: the Messaging daemon and its CLI (`messagingd cli …`, or invoked as `messaging`), with no Node.js, npm install or install script on the machine",
   "license": "MIT",
   "author": "Joe Broadhead",