@joe-broadhead/messaging-bin-win32-x64 0.4.0 → 0.6.0

package/lib/messagingd.mjs

@@ -6391,7 +6391,8 @@ var init_jelly = __esm(() => {
     jti: string2().regex(/^[\x21-\x7e]{1,128}$/, "printable jti"),
     iss: string2().max(2048).optional(),
     dev: string2().max(200).optional(),
-    cls: string2().max(32).optional()
+    cls: string2().max(32).optional(),
+    mbr: string2().max(200).optional()
   });
   JellySessionClaims = looseObject({
     aud: string2().min(1).max(2048),
@@ -6900,7 +6901,8 @@ var init_envelope = __esm(() => {
     label: MachineLabel,
     sessions: array(SessionInfo).max(LIMITS.presenceSessions),
     features: array(string2().max(64)).max(32).optional(),
-    direct: array(DirectEndpoint).min(1).max(4).optional()
+    direct: array(DirectEndpoint).min(1).max(4).optional(),
+    away: literal(true).optional()
   });
   PAYLOAD_BY_TYPE = {
     message: MessagePayload,
@@ -7102,7 +7104,7 @@ var init_relay = __esm(() => {
 function hostedRelayAuthPayload(args) {
   return { proto: RELAY_PROTOCOL, relay: args.relay, realm: args.realm, person: args.person, device: args.device, nonce: args.nonce, ts: args.ts };
 }
-var Req2, Size, Handle, Email, OrgId, DirBindFrame, HostedHelloFrame, DirAppendFrame, DirKeysFrame, DirSthFrame, DirLookupFrame, DirDeviceFrame, DirResolveFrame, DirSearchFrame, DirWatchFrame, PresenceWatchFrame, DirEraseFrame, DirectoryClientFrame, HostedWelcomeFrame, DirOkFrame, DirSthIsFrame, DirPersonsFrame, ResolvedPerson, DirResolvedFrame, DirChangedFrame, DirUnboundFrame, DirectoryRelayFrame;
+var Req2, Size, Handle, Email, OrgId, DirBindFrame, HostedHelloFrame, DirAppendFrame, DirKeysFrame, DirSthFrame, DirLookupFrame, DirDeviceFrame, DirResolveFrame, DirSearchFrame, DirWatchFrame, PresenceWatchFrame, DirEraseFrame, WAKE_AGENTS = 64, WAKE_AWAITING = 500, WAKE_TICKET_BYTES = 4096, WAKE_TICKET_MAX_S, WakeUrl, WakeArmFrame, WakeDisarmFrame, DirectoryClientFrame, HostedWelcomeFrame, DirOkFrame, DirSthIsFrame, DirPersonsFrame, ResolvedPerson, DirResolvedFrame, DirChangedFrame, DirUnboundFrame, DirectoryRelayFrame;
 var init_directory_frames = __esm(() => {
   init_zod();
   init_common();
@@ -7167,6 +7169,17 @@ var init_directory_frames = __esm(() => {
     entries: array(LogEntry).min(1).max(LIMITS.devicesPerPerson),
     token: Jws
   });
+  WAKE_TICKET_MAX_S = 7 * 24 * 60 * 60;
+  WakeUrl = string2().max(2048).regex(/^https?:\/\/[^/?#@\s]+\/hosts\/hst_[A-Za-z0-9._:-]{1,123}\/wake$/, "a Jelly ID wake URL");
+  WakeArmFrame = object({
+    t: literal("wake.arm"),
+    req: Req2,
+    url: WakeUrl,
+    ticket: Jws.refine((ticket) => ticket.length <= WAKE_TICKET_BYTES, { message: `at most ${WAKE_TICKET_BYTES} bytes` }),
+    agents: array(SessionName).max(WAKE_AGENTS),
+    awaiting: array(Ulid).max(WAKE_AWAITING)
+  });
+  WakeDisarmFrame = object({ t: literal("wake.disarm"), req: Req2 });
   DirectoryClientFrame = discriminatedUnion("t", [
     DirBindFrame,
     HostedHelloFrame,
@@ -7179,7 +7192,9 @@ var init_directory_frames = __esm(() => {
     DirSearchFrame,
     DirWatchFrame,
     PresenceWatchFrame,
-    DirEraseFrame
+    DirEraseFrame,
+    WakeArmFrame,
+    WakeDisarmFrame
   ]);
   HostedWelcomeFrame = object({ t: literal("welcome"), sth: STH });
   DirOkFrame = object({
@@ -7261,14 +7276,14 @@ var init_direct = __esm(() => {
 });
 
 // packages/core/dist/schema/ipc/device.js
-var BindingState, RealmAlarmSummary, DeviceStatus, DeviceListEntry, LinkText, Sas, LinkPreview, KeyFingerprint, LoginUserCode, LoginPurpose, LoginKind, LoginShown, LoginState, DEVICE_METHODS;
+var BindingState, RealmAlarmSummary, DeviceStatus, DeviceChangeView, DeviceListEntry, LinkText, Sas, LinkPreview, KeyFingerprint, LoginUserCode, LoginPurpose, LoginKind, LoginShown, LoginState, DeviceRemoveParams, DeviceApproveParams, IdentityReplaceParams, SignInStep, DirectoryEraseParams, DEVICE_METHODS;
 var init_device = __esm(() => {
   init_zod();
   init_common();
   init_directory();
   init_errors3();
   init_jelly();
-  BindingState = _enum(["none", "bound", "attest-due", "removed"]);
+  BindingState = _enum(["none", "bound", "attest-due", "removed", "replace"]);
   RealmAlarmSummary = object({
     kind: _enum(["directory", "restored"]),
     reason: string2().max(500),
@@ -7283,6 +7298,16 @@ var init_device = __esm(() => {
     sth: object({ size: number2().int().positive(), root: Hash, ts: Millis }).optional(),
     alarm: RealmAlarmSummary.optional()
   });
+  DeviceChangeView = object({
+    change: _enum(["added", "vouched", "removed", "replaced"]),
+    device: MachineId,
+    label: MachineLabel,
+    kind: DeviceKind.optional(),
+    vouch: _enum(["jelly", "device", "admin"]),
+    via: _enum(["host", "browser"]).optional(),
+    approver: MachineLabel.optional(),
+    at: Millis
+  });
   DeviceListEntry = object({
     device: MachineId,
     label: MachineLabel,
@@ -7299,7 +7324,7 @@ var init_device = __esm(() => {
   LinkPreview = object({ device: MachineId, label: MachineLabel, kind: DeviceKind, sas: Sas });
   KeyFingerprint = string2().regex(/^[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}$/, "key fingerprint");
   LoginUserCode = string2().regex(/^[A-HJ-NP-Z2-9]{5}-[A-HJ-NP-Z2-9]{5}$/, "user code");
-  LoginPurpose = _enum(["bind", "remove"]);
+  LoginPurpose = _enum(["bind", "remove", "replace", "erase"]);
   LoginKind = _enum(["laptop", "server", "other"]);
   LoginShown = object({
     verificationUriComplete: string2().url().max(2048),
@@ -7315,6 +7340,16 @@ var init_device = __esm(() => {
     object({ state: literal("failed"), purpose: LoginPurpose, code: ErrorCode, message: string2().max(500) }),
     object({ state: literal("cancelled"), purpose: LoginPurpose })
   ]);
+  DeviceRemoveParams = strictObject({ device: MachineId, reason: _enum(["self", "removed", "lost"]).optional(), token: Jws.optional() });
+  DeviceApproveParams = strictObject({ link: LinkText, sas: Sas });
+  IdentityReplaceParams = strictObject({
+    token: Jws.optional(),
+    label: MachineLabel.optional()
+  });
+  SignInStep = LoginShown.extend({ state: literal("sign-in"), purpose: LoginPurpose, interval: number2().int().positive() });
+  DirectoryEraseParams = strictObject({
+    token: Jws.optional()
+  });
   DEVICE_METHODS = {
     "device.status": { params: strictObject({}), result: DeviceStatus },
     "device.bind": {
@@ -7323,7 +7358,7 @@ var init_device = __esm(() => {
     },
     "device.list": { params: strictObject({}), result: object({ devices: array(DeviceListEntry) }) },
     "device.remove": {
-      params: strictObject({ device: MachineId, reason: _enum(["self", "removed", "lost"]).optional(), token: Jws.optional() }),
+      params: DeviceRemoveParams,
       result: object({ seq: number2().int().nonnegative() })
     },
     "device.link": {
@@ -7340,10 +7375,51 @@ var init_device = __esm(() => {
     },
     "device.login.status": { params: strictObject({ waitMs: number2().int().min(0).max(120000).optional() }), result: LoginState },
     "device.login.cancel": { params: strictObject({}), result: object({ ok: literal(true) }) },
-    "device.approve.preview": { params: strictObject({ link: LinkText }), result: LinkPreview },
+    "device.approve.preview": { params: DeviceApproveParams.partial({ sas: true }), result: LinkPreview },
     "device.approve": {
-      params: strictObject({ link: LinkText, sas: Sas }),
+      params: DeviceApproveParams,
       result: object({ device: MachineId, seq: number2().int().nonnegative() })
+    },
+    "identity.replace": {
+      params: IdentityReplaceParams,
+      result: discriminatedUnion("state", [
+        object({ state: literal("done"), person: PersonId, device: MachineId, predecessor: MachineId, seq: number2().int().nonnegative() }),
+        object({ state: literal("token"), device: MachineId }),
+        SignInStep.extend({ device: MachineId })
+      ])
+    },
+    "identity.replace.preview": {
+      params: IdentityReplaceParams,
+      result: object({
+        predecessor: object({
+          device: MachineId,
+          label: MachineLabel,
+          kind: DeviceKind.optional(),
+          vouch: _enum(["jelly", "device"]),
+          via: _enum(["host", "browser"]).optional(),
+          since: Millis.optional(),
+          current: boolean2()
+        }),
+        alarm: _enum(["keys_missing", "restored"]).nullable(),
+        device: MachineId.optional(),
+        signIns: number2().int().min(0).max(2),
+        sentence: string2().max(600)
+      })
+    },
+    "directory.erase": {
+      params: DirectoryEraseParams,
+      result: discriminatedUnion("state", [object({ state: literal("done"), person: PersonId, devices: number2().int().nonnegative() }), SignInStep])
+    },
+    "directory.erase.preview": {
+      params: DirectoryEraseParams,
+      result: object({
+        person: PersonId,
+        devices: array(object({ device: MachineId, label: MachineLabel, kind: DeviceKind.optional(), self: boolean2() })),
+        signIns: number2().int().min(0).max(1),
+        perDay: number2().int().positive(),
+        lost: array(string2().max(300)).max(10),
+        kept: array(string2().max(300)).max(10)
+      })
     }
   };
 });
@@ -7458,7 +7534,7 @@ var init_shapes = __esm(() => {
 });
 
 // packages/core/dist/schema/ipc/consent.js
-var GrantTarget, Levels, GrantView, GrantReview, GrantSetParams, AskRequest, ContactRequestView, ContactSuggestion, HeldRequest, RequestAnswer, RequestText, PersonReach, CONSENT_METHODS;
+var GrantTarget, Levels, GrantView, GrantReview, GrantSetParams, AskRequest, ContactRequestView, ContactSuggestion, HeldRequest, RequestAnswer, RequestText, PersonReach, RequestAnswerParams, ContactRequestParams, CONSENT_METHODS;
 var init_consent2 = __esm(() => {
   init_zod();
   init_common();
@@ -7524,7 +7600,9 @@ var init_consent2 = __esm(() => {
   HeldRequest = union([AskRequest, ContactRequestView, ContactSuggestion]);
   RequestAnswer = _enum(["once", "always", "accept", "decline", "block"]);
   RequestText = string2().min(1).refine((text) => text.length <= LIMITS.requestChars, { message: `at most ${LIMITS.requestChars} UTF-16 code units` });
-  PersonReach = object({ person: PersonId, can: CardCan, source: _enum(["card", "default"]), at: Millis.optional() });
+  PersonReach = object({ person: PersonId, can: CardCan, source: _enum(["card", "default"]), at: Millis.optional(), devicesChangedAt: Millis.optional() });
+  RequestAnswerParams = strictObject({ id: Ulid, answer: RequestAnswer, all: boolean2().optional() });
+  ContactRequestParams = strictObject({ email: Email, text: RequestText, suggestion: Ulid.optional() });
   CONSENT_METHODS = {
     "grant.list": {
       params: strictObject({ subject: GrantTarget.optional() }),
@@ -7534,14 +7612,25 @@ var init_consent2 = __esm(() => {
     "grant.set.preview": { params: GrantSetParams, result: object({ sentence: string2().max(500) }) },
     "request.list": { params: strictObject({}), result: object({ requests: array(HeldRequest).max(LIMITS.heldTotal * 3) }) },
     "request.answer": {
-      params: strictObject({ id: Ulid, answer: RequestAnswer, all: boolean2().optional() }),
+      params: RequestAnswerParams,
       result: object({ answered: array(Ulid).max(LIMITS.heldTotal) })
     },
+    "request.answer.preview": {
+      params: RequestAnswerParams,
+      result: object({
+        kind: _enum(["message", "task", "contact", "suggestion"]),
+        from: object({ name: string2().max(200), email: string2().max(320).optional(), org: _enum(["same", "other", "none"]) }),
+        agent: SessionName.optional(),
+        to: SessionName.optional(),
+        count: number2().int().positive(),
+        sentence: string2().max(500)
+      })
+    },
     "contact.request": {
-      params: strictObject({ email: Email, text: RequestText, suggestion: Ulid.optional() }),
+      params: ContactRequestParams,
       result: object({ id: Ulid, conversation: RoomRef, person: PersonId })
     },
-    "contact.request.preview": { params: strictObject({ email: Email }), result: object({ found: boolean2() }) },
+    "contact.request.preview": { params: ContactRequestParams.partial({ text: true }), result: object({ found: boolean2() }) },
     "card.get": { params: strictObject({ person: PersonId }), result: object({ sent: boolean2() }) }
   };
 });
@@ -7556,6 +7645,7 @@ var init_surfaces = __esm(() => {
   init_directory_frames();
   init_errors3();
   init_consent2();
+  init_device();
   init_shapes();
   ConversationRef = string2().regex(/^(?:dm:(?:[a-z][a-z0-9-]{0,31}|p_[a-z2-7]{26})|channel:[a-z][a-z0-9-]{0,31}|agent:(?:[a-z][a-z0-9-]{0,31}|p_[a-z2-7]{26})\/[a-z0-9][a-z0-9._-]{0,63})$/, "dm:<person>, channel:<name> or agent:<person>/<agent>");
   ConvPlace = union([ChatSeq, ConvCursor]);
@@ -7660,26 +7750,38 @@ var init_surfaces = __esm(() => {
     },
     "people.get": {
       params: strictObject({ person: PersonId }),
-      result: PersonSummary.extend({ devices: array(object({ device: MachineId, label: MachineLabel, self: boolean2() })) })
+      result: PersonSummary.extend({
+        devices: array(object({ device: MachineId, label: MachineLabel, self: boolean2(), away: literal(true).optional() })),
+        deviceChanges: array(DeviceChangeView).max(10).optional()
+      })
     }
   };
 });
 
 // packages/core/dist/schema/ipc/jelly.js
-var NoticeId, NOTICE_LINE_CHARS = 120, Notice, NoticeCounts, DaemonHealth, AgentSummary, AgentConversation, JELLY_METHODS;
+var NoticeId, NOTICE_LINE_CHARS = 120, NoticeDevice, Notice, NoticeCounts, DaemonHealth, AgentSummary, AgentConversation, JELLY_METHODS;
 var init_jelly2 = __esm(() => {
   init_zod();
   init_common();
+  init_directory_frames();
+  init_jelly();
   init_directory();
+  init_device();
   init_shapes();
   init_surfaces();
   NoticeId = string2().regex(/^[mra]_[0-9A-Za-z]{1,64}$/, "notice id");
+  NoticeDevice = DeviceChangeView.extend({
+    replaces: object({ device: MachineId, label: MachineLabel }).optional(),
+    current: boolean2(),
+    remove: _enum(["token", "sign-in", "team"]).optional()
+  });
   Notice = object({
     id: NoticeId,
     category: _enum(["message", "request", "alert"]),
     conversation: ConversationRef.optional(),
     from: object({ name: string2().max(200), email: string2().max(320).optional(), org: _enum(["same", "other", "none"]) }).optional(),
     line: string2().max(NOTICE_LINE_CHARS).optional(),
+    device: NoticeDevice.optional(),
     at: Millis
   });
   NoticeCounts = object({ unread: number2().int().nonnegative(), requests: number2().int().nonnegative() });
@@ -7724,8 +7826,32 @@ var init_jelly2 = __esm(() => {
       result: object({ notices: array(Notice), counts: NoticeCounts })
     },
     "notice.ack": { params: strictObject({ ids: array(NoticeId).min(1).max(200) }), result: object({ ok: literal(true) }) },
+    "daemon.woke": { params: strictObject({}), result: object({ ok: literal(true) }) },
+    "person.attached": { params: strictObject({ attached: boolean2() }), result: object({ ok: literal(true) }) },
+    "wake.arm": {
+      params: strictObject({
+        url: WakeUrl,
+        ticket: Jws.refine((ticket) => ticket.length <= WAKE_TICKET_BYTES, { message: `at most ${WAKE_TICKET_BYTES} bytes` }),
+        agents: array(SessionName).max(WAKE_AGENTS)
+      }),
+      result: object({ relay: _enum(["armed", "pending"]), awaiting: number2().int().nonnegative() })
+    },
+    "wake.disarm": { params: strictObject({}), result: object({ relay: _enum(["disarmed", "pending"]) }) },
+    "daemon.snapshot": {
+      params: strictObject({ done: literal(true).optional() }),
+      result: union([
+        object({
+          folder: string2().max(4096),
+          files: array(object({ name: string2().max(64), bytes: number2().int().nonnegative(), sha256: string2().regex(/^[0-9a-f]{64}$/) })).max(8),
+          storeSchema: number2().int().positive(),
+          at: Millis,
+          until: Millis
+        }),
+        object({ released: boolean2() })
+      ])
+    },
     "device.remove.preview": {
-      params: strictObject({ device: MachineId }),
+      params: DeviceRemoveParams,
       result: object({
         label: MachineLabel,
         kind: DeviceKind.optional(),
@@ -7739,7 +7865,7 @@ var init_jelly2 = __esm(() => {
 });
 
 // packages/core/dist/schema/ipc.js
-var MESSAGING_ERROR_RPC_CODE = -32000, SessionHost, IPC_PROTOCOL = 1, IpcHello, Ok, Empty, DaemonStatus, InviteSummary, IPC_METHODS, AGENT_METHODS, HOST_SCOPE_METHODS, IpcEvent;
+var MESSAGING_ERROR_RPC_CODE = -32000, SessionHost, IPC_PROTOCOL = 1, IpcHello, Ok, Empty, DaemonStatus, InviteSummary, IPC_METHODS, AGENT_METHODS, HUMAN_METHODS, ADMIN_METHODS, HOST_SCOPE_METHODS, IpcEvent;
 var init_ipc = __esm(() => {
   init_zod();
   init_device();
@@ -7980,7 +8106,68 @@ var init_ipc = __esm(() => {
     "task.update",
     "task.cancel"
   ];
-  HOST_SCOPE_METHODS = ["notice.subscribe", "notice.list", "conv.list", "daemon.stop"];
+  HUMAN_METHODS = [
+    "conv.list",
+    "conv.read",
+    "conv.markRead",
+    "conv.subscribe",
+    "person.send",
+    "people.search",
+    "people.get",
+    "grant.list",
+    "grant.set",
+    "grant.set.preview",
+    "request.list",
+    "request.answer",
+    "request.answer.preview",
+    "contact.request",
+    "contact.request.preview",
+    "card.get",
+    "agents.list",
+    "agents.read",
+    "notice.subscribe",
+    "notice.list",
+    "notice.ack",
+    "device.approve.preview",
+    "device.remove.preview",
+    "identity.replace.preview",
+    "directory.erase.preview",
+    "channel.create",
+    "channel.invite",
+    "channel.leave",
+    "channel.remove"
+  ];
+  ADMIN_METHODS = [
+    "daemon.stop",
+    "daemon.woke",
+    "person.attached",
+    "daemon.snapshot",
+    "wake.arm",
+    "wake.disarm",
+    "device.list",
+    "device.remove",
+    "device.link",
+    "device.login",
+    "device.login.status",
+    "device.login.cancel",
+    "device.approve",
+    "identity.rotateEnc",
+    "identity.replace",
+    "directory.erase",
+    "team.create",
+    "team.invite",
+    "team.join",
+    "team.members",
+    "team.remove",
+    "team.role",
+    "team.revokeInvite",
+    "team.add",
+    "team.pair",
+    "team.claim",
+    "team.pairCancel",
+    "team.prepare"
+  ];
+  HOST_SCOPE_METHODS = ["notice.subscribe", "notice.list", "conv.list", "daemon.stop", "daemon.woke", "person.attached", "daemon.snapshot", "wake.arm", "wake.disarm"];
   IpcEvent = discriminatedUnion("type", [
     object({ type: literal("inbox"), key: SessionKey, item: InboxItem }),
     object({ type: literal("receipt"), key: SessionKey, envelopeId: Ulid, to: SessionAddress, stage: DeliveryStage, code: ErrorCode.optional() }),
@@ -8047,7 +8234,7 @@ var init_b64u = __esm(() => {
 });
 
 // packages/core/dist/version.js
-var VERSION = "0.4.0";
+var VERSION = "0.6.0";
 
 // packages/core/dist/jcs.js
 function hasLoneSurrogate(text) {
@@ -9273,6 +9460,9 @@ var init_roster2 = __esm(() => {
 
 // packages/core/dist/jelly-host.js
 import { verify as ed25519Verify2 } from "crypto";
+function actionClass(method) {
+  return Object.hasOwn(ACTION_CLASSES, method) ? ACTION_CLASSES[method] : "local";
+}
 function grantInput(params) {
   return sha256(canonicalize(params ?? {}));
 }
@@ -9342,9 +9532,16 @@ function verifyActGrant(token, check) {
       throw fail("is for other params");
     checkTimes(claims.iat, claims.exp, ACT_GRANT_MAX_S, check.now, fail);
   }
-  if (claims.cls !== undefined && claims.act !== "host" && claims.cls !== (CHAT_CLASS.has(check.method) ? "chat" : "local"))
-    throw fail("names another action class");
-  return { scope: claims.act === "host" ? "host" : "action", jti: claims.jti, exp: claims.exp, dev: claims.dev };
+  if (claims.act === "host") {
+    if (claims.cls !== undefined)
+      throw fail("is host scope, which names no action class");
+  } else {
+    if (claims.cls === undefined)
+      throw fail("names no action class");
+    if (claims.cls !== actionClass(check.method))
+      throw fail(`names action class ${claims.cls}, not ${actionClass(check.method)}`);
+  }
+  return { scope: claims.act === "host" ? "host" : "action", jti: claims.jti, exp: claims.exp, dev: claims.dev, mbr: claims.mbr };
 }
 function verifySessionTicket(token, key, now) {
   const fail = (why) => new MessagingError("ticket_invalid", `the session ticket ${why}`);
@@ -9379,7 +9576,7 @@ function parseActKey(text) {
   }
   return parsed.data;
 }
-var ACT_GRANT_MAX_S = 60, HOST_GRANT_MAX_S = 600, SESSION_TICKET_MAX_S, JELLY_HOST_SKEW_S = 5, CHAT_CLASS;
+var ACT_GRANT_MAX_S = 60, HOST_GRANT_MAX_S = 600, SESSION_TICKET_MAX_S, JELLY_HOST_SKEW_S = 5, CHAT_METHODS, VIEW_METHODS, classOf2 = (method) => CHAT_METHODS.includes(method) ? "chat" : VIEW_METHODS.includes(method) ? "view" : "local", ACTION_CLASSES;
 var init_jelly_host = __esm(() => {
   init_b64u();
   init_hash();
@@ -9388,8 +9585,24 @@ var init_jelly_host = __esm(() => {
   init_wire();
   init_errors3();
   init_jelly();
+  init_ipc();
   SESSION_TICKET_MAX_S = 7 * 24 * 60 * 60;
-  CHAT_CLASS = new Set(["person.send", "conv.markRead"]);
+  CHAT_METHODS = ["person.send", "conv.markRead", "notice.ack"];
+  VIEW_METHODS = [
+    "conv.list",
+    "conv.read",
+    "conv.subscribe",
+    "people.search",
+    "people.get",
+    "grant.list",
+    "request.list",
+    "agents.list",
+    "agents.read",
+    "notice.subscribe",
+    "notice.list",
+    "device.list"
+  ];
+  ACTION_CLASSES = Object.freeze(Object.fromEntries([...HUMAN_METHODS, ...ADMIN_METHODS].map((method) => [method, classOf2(method)])));
 });
 
 // packages/core/dist/directory/person.js
@@ -9830,6 +10043,13 @@ class DeviceLog {
   token(seq) {
     return this.#state.tokens.get(seq);
   }
+  spentSignIn(jti) {
+    for (const [seq, token] of this.#state.tokens) {
+      if (token.claims.src === JELLY_DEVICE_SOURCE && token.claims.jti === jti && this.#state.entries[seq].op !== "unbind")
+        return true;
+    }
+    return false;
+  }
   bindingDeadline(seq) {
     const token = this.#state.tokens.get(seq);
     return token === undefined ? undefined : token.claims.exp * 1000 + LIMITS.clockSkewMs;
@@ -9882,6 +10102,14 @@ class DeviceLog {
       const { claims } = token;
       if (personId(claims.iss, claims.sub) !== this.person)
         throw refuse("Jelly token names another person");
+      if (claims.src === JELLY_DEVICE_SOURCE) {
+        for (const [seq, used] of state.tokens) {
+          if (used.claims.src !== JELLY_DEVICE_SOURCE || used.claims.jti !== claims.jti)
+            continue;
+          if (parsed.op !== "unbind" || state.entries[seq].op !== "unbind")
+            throw refuse("a sign-in's token vouches for one act: this one was used");
+        }
+      }
       if (parsed.ts < claims.iat * 1000 - LIMITS.clockSkewMs || parsed.ts > claims.exp * 1000 + LIMITS.clockSkewMs)
         throw refuse("log entry is dated outside its Jelly token's life");
       tokens.set(parsed.seq, token);
@@ -9966,6 +10194,7 @@ var init_device_log = __esm(() => {
   init_keys();
   init_sign();
   init_common();
+  init_jelly();
   init_directory();
   init_errors3();
   init_jelly_token();
@@ -12634,6 +12863,7 @@ var init_dist = __esm(() => {
   init_contact_card();
   init_delegation2();
   init_task();
+  init_a2a();
   init_direct2();
   init_peer_text();
   init_agent_tools();
@@ -15583,7 +15813,8 @@ function presencePayload(rows, label, seq, extra, policy) {
     label,
     sessions: [],
     features: [...FEATURES, ...extra?.features ?? []],
-    ...extra?.direct ? { direct: extra.direct } : {}
+    ...extra?.direct ? { direct: extra.direct } : {},
+    ...policy.away === true ? { away: true } : {}
   };
   return { ...payload, sessions: fitPresence(sessions, jcsBytes(payload), LIMITS.presenceBytes) };
 }
@@ -15810,14 +16041,16 @@ class RosterIdentity {
   #machine;
   #catchUp;
   #now;
-  #listeners = { "devices-changed": [], "self-changed": [], alarm: [] };
+  #listeners = { "devices-changed": [], "self-changed": [], "device-log": [], alarm: [] };
   #me;
+  #length;
   constructor(options) {
     this.roster = options.roster;
     this.#machine = options.machine;
     this.#catchUp = options.catchUp;
     this.#now = options.now;
     this.#me = this.#selfRecord();
+    this.#length = options.roster.entries().length;
   }
   get realm() {
     return this.roster.realm;
@@ -15848,6 +16081,31 @@ class RosterIdentity {
   successor(_device) {
     return;
   }
+  deviceChanges(person) {
+    const labels = new Map;
+    const out = [];
+    for (const entry of this.roster.entries()) {
+      const member = entry.kind === "member.add" ? entry.body : entry.kind === "invite.redeem" ? entry.body.member : entry.kind === "genesis" ? entry.body.founder : undefined;
+      if (member) {
+        labels.set(member.machine, member.label);
+        if (member.person === person && entry.kind !== "genesis")
+          out.push({ seq: entry.seq, change: "added", device: member.machine, label: member.label, vouch: "admin", by: entry.by, at: entry.ts });
+      } else if (entry.kind === "member.remove") {
+        const owner = this.#ownerAt(entry.body.machine);
+        if (owner === person)
+          out.push({ seq: entry.seq, change: "removed", device: entry.body.machine, label: labels.get(entry.body.machine) ?? "machine", vouch: "admin", by: entry.by, at: entry.ts });
+      }
+    }
+    return out;
+  }
+  #ownerAt(machine) {
+    for (const entry of this.roster.entries()) {
+      const member = entry.kind === "member.add" ? entry.body : entry.kind === "invite.redeem" ? entry.body.member : entry.kind === "genesis" ? entry.body.founder : undefined;
+      if (member?.machine === machine)
+        return member.person;
+    }
+    return;
+  }
   async devices(person, opts = {}) {
     if (opts.atLeast !== undefined && this.relate(opts.atLeast).relation === "ahead") {
       throw new MessagingError("roster_conflict", "the roster has not reached that anchor");
@@ -15891,6 +16149,20 @@ class RosterIdentity {
     }
     for (const listener of [...this.#listeners["devices-changed"]])
       listener();
+    const entries = this.roster.entries();
+    if (entries.length !== this.#length) {
+      const persons = new Set;
+      for (const entry of entries.slice(this.#length)) {
+        const member = entry.kind === "member.add" ? entry.body : entry.kind === "invite.redeem" ? entry.body.member : undefined;
+        const person = member?.person ?? (entry.kind === "member.remove" ? this.#ownerAt(entry.body.machine) : undefined);
+        if (person !== undefined)
+          persons.add(person);
+      }
+      this.#length = entries.length;
+      if (persons.size > 0)
+        for (const listener of [...this.#listeners["device-log"]])
+          listener([...persons].sort());
+    }
   }
   #selfRecord() {
     const me = this.roster.member(this.#machine);
@@ -16106,16 +16378,18 @@ class DirectoryIdentity {
   #options;
   #cache;
   #keyring;
-  #listeners = { "devices-changed": [], "self-changed": [], alarm: [] };
+  #listeners = { "devices-changed": [], "self-changed": [], "device-log": [], alarm: [] };
   #head;
   #persons = new Map;
   #index = new Map;
   #own;
   #relations = new Map;
   #watching = new Set;
+  #watchRead = Promise.resolve();
   #alarm;
   #selfRecord;
   #monitoredAt = Number.NEGATIVE_INFINITY;
+  #bindAccepted = false;
   #pendingLink;
   constructor(options) {
     this.#options = options;
@@ -16175,7 +16449,10 @@ class DirectoryIdentity {
     const person = this.#own.person;
     if (!person)
       return false;
-    const record = this.#persons.get(person)?.state.log.device(this.#machine());
+    const held = this.#persons.get(person)?.state;
+    if (held?.erased)
+      return true;
+    const record = held?.log.device(this.#machine());
     return record !== undefined && !record.current;
   }
   persons() {
@@ -16196,6 +16473,12 @@ class DirectoryIdentity {
     }
     return;
   }
+  deviceChanges(person) {
+    const held = isHosted(person) ? this.#persons.get(person) : undefined;
+    if (!held || held.state.erased)
+      return [];
+    return deviceChangesOf(held.state.log);
+  }
   async devices(person, opts = {}) {
     if (!isHosted(person))
       return { person, devices: [], anchor: this.anchor(), fetchedAt: this.#options.now() };
@@ -16290,15 +16573,23 @@ class DirectoryIdentity {
     }
   }
   watch(persons) {
-    let grew = false;
+    const added = [];
     for (const person of persons) {
       if (!isHosted(person) || this.#watching.has(person) || this.#watching.size >= LIMITS.watchPersons)
         continue;
       this.#watching.add(person);
-      grew = true;
+      added.push(person);
     }
-    if (grew)
-      this.#call((link) => link.watch([...this.#watching])).catch(() => {});
+    if (added.length === 0)
+      return this.#watchRead;
+    this.#watchRead = this.#call((link) => link.watch([...this.#watching])).then(async () => {
+      const held = added.filter((person) => this.#persons.has(person));
+      if (held.length === 0)
+        return;
+      await this.#latest();
+      await this.#fetch(held);
+    }).catch(() => {});
+    return this.#watchRead;
   }
   on(event, listener) {
     const listeners = this.#listeners[event];
@@ -16309,6 +16600,10 @@ class DirectoryIdentity {
         listeners.splice(at, 1);
     };
   }
+  linkPerson() {
+    const binding = this.binding();
+    return binding.state !== "none" || this.#bindAccepted ? binding.person : undefined;
+  }
   alarm() {
     return this.#alarm;
   }
@@ -16318,6 +16613,8 @@ class DirectoryIdentity {
   binding() {
     const person = this.#own.person;
     const record = person ? this.#persons.get(person)?.state.log.device(this.#machine()) : undefined;
+    if (person && this.#persons.get(person)?.state.erased)
+      return { state: "removed", person };
     if (!person || !record)
       return { state: "none", ...person ? { person } : {} };
     if (!record.current)
@@ -16358,13 +16655,29 @@ class DirectoryIdentity {
         authority: { kind: "jelly", token }
       });
       this.#signed(entry, person);
-      return current ? await this.#call((link) => link.append(entry)) : await this.#call((link) => link.bind(entry));
+      if (current)
+        return await this.#call((link) => link.append(entry));
+      const bound = await this.#call((link) => link.bind(entry));
+      this.#bindAccepted = true;
+      return bound;
     });
     await this.#adoptAnnounced(done.sth);
     await this.#fetch([person]);
     await this.publishKeys();
     return { person, seq: done.seq };
   }
+  async awaitSelf() {
+    const person = this.#own.person;
+    if (!person)
+      throw new MessagingError("no_identity", "this device is not bound to an account");
+    for (let tries = 0;this.self() === undefined || !this.#index.has(this.#machine()); tries++) {
+      if (tries >= LOG_RETRIES)
+        throw unavailable("the directory has not committed this device's binding and keys yet");
+      await new Promise((resolve) => setTimeout(resolve, LOG_RETRY_MS));
+      await this.#latest();
+      await this.#fetch([person]);
+    }
+  }
   async publishKeys() {
     if (this.#alarm?.kind === "restored")
       throw new MessagingError("invalid_state", "this device runs from an older copy of its home; it publishes no keys");
@@ -16415,6 +16728,45 @@ class DirectoryIdentity {
     await this.#fetch([person]);
     return { seq: done.seq };
   }
+  async erase(token) {
+    const identity = this.#options.identity();
+    const person = this.#own.person;
+    if (!person || this.binding().state === "none" || this.removed())
+      throw new MessagingError("no_identity", "this device is not bound to an account");
+    if (this.binding().record?.vouch !== "jelly")
+      throw new MessagingError("forbidden", "a device approved by link erases nothing; erase from a device Jelly ID vouched for");
+    const entries = await this.#extendLog(async () => {
+      await this.#latest();
+      await this.#fetch([person]);
+      const log = this.#persons.get(person).state.log;
+      let head = log.head();
+      const out = [];
+      const devices = log.devices().sort((a, b) => Number(a.device === identity.machine) - Number(b.device === identity.machine));
+      for (const device of devices) {
+        const self = device.device === identity.machine;
+        const entry = signLogEntry(identity, {
+          v: PROTOCOL,
+          realm: this.realm,
+          person,
+          seq: head.seq + 1,
+          prev: head.hash,
+          ts: this.#options.now(),
+          op: "unbind",
+          device: device.device,
+          reason: self ? "self" : "removed",
+          authority: self ? { kind: "self" } : { kind: "jelly", token }
+        });
+        out.push(entry);
+        head = { seq: entry.seq, hash: logEntryHash(entry) };
+      }
+      for (const entry of out)
+        this.#signed(entry, person);
+      await this.#call((link) => link.erase(out, token));
+      return out;
+    });
+    await this.#latest().then(() => this.#fetch([person])).catch(() => {});
+    return { person, devices: entries.length, seq: entries.at(-1).seq };
+  }
   createLink(args) {
     if (this.#own.person !== undefined) {
       throw new MessagingError("invalid_state", this.removed() ? "this device was removed from its account; it cannot be bound again" : "this device is already bound");
@@ -16633,15 +16985,25 @@ class DirectoryIdentity {
       throw new MessagingError("directory_inconsistent", "the directory answered at another tree head");
     const now = this.#options.now();
     const views = new Map(answer.persons.map((view) => [view.person, view]));
+    const grew = [];
     for (const person of persons) {
       const view = views.get(person);
       if (!view)
         continue;
+      const before = this.#persons.get(person)?.state;
       const state = await this.#verify(view, head);
       this.#persons.set(person, { state, size: head.sth.size, fetchedAt: now });
       this.#cache.putPerson({ person, entries: [...state.log.entries()], keys: [...state.keys.values()], erased: state.erased, size: head.sth.size, fetchedAt: now });
+      if (state.log.length !== (before?.log.length ?? 0) || state.erased !== (before?.erased ?? false))
+        grew.push(person);
     }
     this.#changed();
+    if (grew.length > 0)
+      for (const listener of [...this.#listeners["device-log"]])
+        listener(grew);
+    const unwatched = persons.filter((person) => views.has(person) && !this.#watching.has(person));
+    if (unwatched.length > 0)
+      this.watch(unwatched);
   }
   async#verify(view, head) {
     const known = this.#persons.get(view.person)?.state;
@@ -16763,6 +17125,56 @@ ${this.#index.get(me.machine)?.enc ?? ""}`;
     return mine === theirs ? "same" : "other";
   }
 }
+function deviceChangesOf(log) {
+  const vouch = new Map;
+  const record = new Map;
+  const out = [];
+  for (const entry of log.entries()) {
+    const token = log.token(entry.seq);
+    const via = token === undefined ? undefined : token.claims.hst !== undefined ? "host" : "browser";
+    if (entry.op === "bind") {
+      const v = entry.authority.kind === "jelly" ? "jelly" : "device";
+      vouch.set(entry.device, v);
+      record.set(entry.device, { label: entry.label, kind: entry.kind, host: via === "host" });
+      out.push({
+        seq: entry.seq,
+        change: "added",
+        device: entry.device,
+        label: entry.label,
+        kind: entry.kind,
+        vouch: v,
+        ...via ? { via } : {},
+        ...entry.authority.kind === "device" ? { approver: entry.authority.approver } : {},
+        by: entry.by,
+        at: entry.ts
+      });
+    } else if (entry.op === "attest") {
+      const known = record.get(entry.device);
+      const next = { label: entry.label ?? known?.label ?? "device", kind: entry.kind ?? known?.kind ?? "other", host: via === "host" };
+      record.set(entry.device, next);
+      const raised = vouch.get(entry.device) !== "jelly";
+      vouch.set(entry.device, "jelly");
+      if (raised)
+        out.push({ seq: entry.seq, change: "vouched", device: entry.device, label: next.label, kind: next.kind, vouch: "jelly", ...via ? { via } : {}, by: entry.by, at: entry.ts });
+    } else {
+      const known = record.get(entry.device);
+      const v = vouch.get(entry.device) ?? "device";
+      out.push({
+        seq: entry.seq,
+        change: entry.reason === "replaced" ? "replaced" : "removed",
+        device: entry.device,
+        label: known?.label ?? "device",
+        ...known ? { kind: known.kind } : {},
+        vouch: v,
+        ...v === "jelly" && known ? { via: known.host ? "host" : "browser" } : {},
+        by: entry.by,
+        reason: entry.reason,
+        at: entry.ts
+      });
+    }
+  }
+  return out;
+}
 function orgOf(email, domains) {
   if (email === undefined)
     return;
@@ -16847,7 +17259,7 @@ class DirectoryHome {
       url: this.#options.config.url,
       realm: realm.realm,
       identity: this.#options.identity,
-      person: () => realm.binding().person,
+      person: () => realm.linkPerson(),
       pushes: {
         changed: (persons, sth) => void realm.changed(persons, sth).catch((error) => this.#failed("directory.changed", error)),
         unbound: (entry, sth) => void realm.changed([entry.person], sth).catch((error) => this.#failed("directory.unbound", error)),
@@ -16999,7 +17411,27 @@ class DirectoryHome {
     this.#login.cancel();
     return { ok: true };
   }
+  async signIn(purpose, args) {
+    this.#removing = undefined;
+    this.#binding = undefined;
+    const started = await this.#login.start({ purpose, label: args.label, kind: args.kind });
+    return {
+      purpose,
+      verificationUriComplete: started.verificationUriComplete,
+      verificationUri: started.verificationUri,
+      userCode: started.userCode,
+      fingerprint: started.fingerprint,
+      expires: started.expires,
+      interval: started.interval
+    };
+  }
   async#completeLogin(token, purpose) {
+    if (purpose === "replace" || purpose === "erase") {
+      const step = purpose === "replace" ? this.#options.replaceStep : this.#options.eraseStep;
+      if (!step)
+        throw new MessagingError("invalid_state", `this daemon does not ${purpose} through a sign-in`);
+      return step(token);
+    }
     if (purpose === "remove") {
       const removing = this.#removing;
       if (!removing)
@@ -17019,6 +17451,12 @@ class DirectoryHome {
     this.#options.log("info", "directory.approved", { seq: done.seq });
     return done;
   }
+  async wake(state) {
+    const link = this.#link;
+    if (!link?.wake)
+      return "pending";
+    return link.wake(state);
+  }
   presenceWatch(persons) {
     this.#link?.presenceWatch(persons).catch((error) => this.#failed("directory.presence.watch", error));
   }
@@ -17033,6 +17471,7 @@ class DirectoryHome {
       },
       send: (env) => home.#link ? home.#link.send(env) : Promise.reject(noLink()),
       presence: (env) => home.#link?.presence(env),
+      retryNow: () => home.#link?.retryNow?.(),
       appendRoster: () => Promise.reject(new MessagingError("invalid_state", "a directory realm has no roster")),
       syncRoster: () => Promise.reject(new MessagingError("invalid_state", "a directory realm has no roster"))
     };
@@ -17058,6 +17497,28 @@ var init_directory_home = __esm(() => {
   init_directory_identity();
 });
 
+// packages/daemon/dist/realm/directory-cache.js
+function memoryDirectoryCache(from) {
+  let head = from?.head();
+  const persons = new Map((from?.persons() ?? []).map((p) => [p.person, p]));
+  let archive = from?.archive() ?? [];
+  let own = from?.own() ?? { keysSeq: -1, signed: [] };
+  let alarm = from?.alarm();
+  const copy = (value) => structuredClone(value);
+  return {
+    head: () => copy(head),
+    setHead: (value) => void (head = copy(value)),
+    persons: () => [...persons.values()].map(copy),
+    putPerson: (value) => void persons.set(value.person, copy(value)),
+    archive: () => copy(archive),
+    setArchive: (keys) => void (archive = copy(keys)),
+    own: () => copy(own),
+    setOwn: (value) => void (own = copy(value)),
+    alarm: () => copy(alarm),
+    setAlarm: (value) => void (alarm = copy(value))
+  };
+}
+
 // packages/daemon/dist/jelly.js
 import { closeSync as closeSync6, constants as constants6, fstatSync as fstatSync3, readSync } from "fs";
 function jellyLabel(text) {
@@ -17147,7 +17608,12 @@ class JellyAuth {
         return refuse(new MessagingError("grant_invalid", "the host-scope grant is bound to another connection"));
       }
     }
-    this.#deps.log("info", "jelly.grant", { method: call.method, scope: grant.scope, ...grant.dev !== undefined ? { dev: grant.dev.slice(0, 200) } : {} });
+    this.#deps.log("info", "jelly.grant", {
+      method: call.method,
+      scope: grant.scope,
+      ...grant.dev !== undefined ? { dev: grant.dev.slice(0, 200) } : {},
+      ...grant.mbr !== undefined ? { mbr: grant.mbr.slice(0, 200) } : {}
+    });
     return { scope: grant.scope, expiresAt: (grant.exp + JELLY_HOST_SKEW_S) * 1000 };
   }
   ticket(p) {
@@ -17185,6 +17651,292 @@ var init_jelly3 = __esm(() => {
   HOST_SCOPE = new Set(HOST_SCOPE_METHODS);
 });
 
+// packages/daemon/dist/jelly-env.js
+import { delimiter, isAbsolute } from "path";
+function jellyEnvNamed(env) {
+  return JELLY_ENV.filter((name) => (env[name] ?? "") !== "");
+}
+function fail2(message) {
+  throw new MessagingError("invalid_request", message);
+}
+function required3(env, name) {
+  const value = env[name] ?? "";
+  if (value === "")
+    fail2(`${name} is not set: a Jelly host sets it with JELLY_ACTION_KEY`);
+  return value;
+}
+function folder(name, value, separator = delimiter) {
+  if (!isAbsolute(value))
+    fail2(`${name} is not an absolute path`);
+  if (value.includes(separator))
+    fail2(`${name} names more than one folder (joined with "${separator}"); the daemon takes one`);
+  return value;
+}
+function relayUrlOf(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return fail2(`JELLY_RESOURCES' ${JELLY_RESOURCE_NAME} url is not a URL`);
+  }
+  const loopback = /^(?:localhost|127\.\d{1,3}\.\d{1,3}\.\d{1,3}|\[::1\])$/.test(parsed.hostname);
+  const scheme = parsed.protocol === "https:" ? "wss:" : parsed.protocol === "http:" && loopback ? "ws:" : undefined;
+  if (scheme === undefined)
+    fail2(`JELLY_RESOURCES' ${JELLY_RESOURCE_NAME} url is not https:// (or http:// to a loopback host)`);
+  if (parsed.username !== "" || parsed.password !== "" || parsed.search !== "" || parsed.hash !== "" || parsed.pathname !== "/" && parsed.pathname !== "") {
+    fail2(`JELLY_RESOURCES' ${JELLY_RESOURCE_NAME} url is not an origin: the relay is derived from its origin alone`);
+  }
+  return `${scheme}//${parsed.host}/v1/connect`;
+}
+function jellyEnvRealm(env) {
+  let raw;
+  try {
+    raw = parseWire(required3(env, "JELLY_RESOURCES"), { maxBytes: 64 * 1024 });
+  } catch (error) {
+    if (error instanceof MessagingError && /JELLY_RESOURCES is not set/.test(error.message))
+      throw error;
+    return fail2("JELLY_RESOURCES is not JSON");
+  }
+  const list = Resources.safeParse(raw);
+  if (!list.success)
+    fail2("JELLY_RESOURCES is not a list of discovery entries");
+  const entries = list.data.map((item) => ResourceEntry.safeParse(item)).filter((parsed) => parsed.success && parsed.data.name === JELLY_RESOURCE_NAME);
+  if (entries.length === 0)
+    fail2(`JELLY_RESOURCES has no ${JELLY_RESOURCE_NAME} entry`);
+  if (entries.length > 1)
+    fail2(`JELLY_RESOURCES has more than one ${JELLY_RESOURCE_NAME} entry`);
+  const entry = entries[0].data;
+  const realm = DirectoryRealmConfig.strict().safeParse({
+    kind: "directory",
+    url: relayUrlOf(entry.url),
+    issuer: required3(env, "JELLY_ID_ISSUER"),
+    resource: entry.resource,
+    key: required3(env, "JELLY_SERVICE_ANCHOR")
+  });
+  if (!realm.success) {
+    const at = realm.error.issues[0]?.path[0];
+    fail2(at === "issuer" ? "JELLY_ID_ISSUER is not an https:// issuer" : at === "key" ? "JELLY_SERVICE_ANCHOR is not an Ed25519 key in base64url" : `JELLY_RESOURCES' ${JELLY_RESOURCE_NAME} entry is invalid at ${String(at)}`);
+  }
+  try {
+    directoryRealmId(realm.data);
+  } catch {
+    fail2("JELLY_SERVICE_ANCHOR is not a usable Ed25519 key");
+  }
+  return realm.data;
+}
+function readJellyEnv(env) {
+  const actKeyPath = required3(env, "JELLY_ACTION_KEY");
+  if (!isAbsolute(actKeyPath))
+    fail2("JELLY_ACTION_KEY is not an absolute path");
+  const home = folder("STATE_DIRECTORY", required3(env, "STATE_DIRECTORY"));
+  const runText = env.RUNTIME_DIRECTORY ?? "";
+  const groupText = env.JELLY_SOCKET_GROUP ?? "";
+  if (groupText !== "" && process.platform === "win32")
+    fail2("JELLY_SOCKET_GROUP is not supported on Windows: a named pipe is not shared with a group");
+  if (groupText !== "" && (!/^\d{1,10}$/.test(groupText) || Number(groupText) > 4294967294))
+    fail2("JELLY_SOCKET_GROUP is not a numeric gid");
+  let label;
+  try {
+    label = jellyLabel(required3(env, "JELLY_DEVICE_LABEL"));
+  } catch (error) {
+    if (error instanceof MessagingError && /is not set/.test(error.message))
+      throw error;
+    return fail2("JELLY_DEVICE_LABEL has no letter or digit to make a device label from");
+  }
+  return {
+    home,
+    ...runText !== "" ? { run: folder("RUNTIME_DIRECTORY", runText) } : {},
+    actKeyPath,
+    label,
+    ...groupText !== "" ? { socketGroup: Number(groupText) } : {},
+    realm: jellyEnvRealm(env)
+  };
+}
+function realmMismatch(pinned, named) {
+  return ["url", "issuer", "resource", "key"].filter((member) => pinned[member] !== named[member]);
+}
+async function pinRealm(realm, get = wellKnownGet) {
+  const origin = new URL(realm.url);
+  const url = `${origin.protocol === "wss:" ? "https:" : "http:"}//${origin.host}/.well-known/messaging.json`;
+  let text;
+  try {
+    text = await get(url);
+  } catch (error) {
+    throw new MessagingError("relay_unavailable", `cannot read the relay's realm document ${url} for the first start (${error instanceof Error ? error.message.slice(0, 200) : "failed"}); the next start tries again`);
+  }
+  let raw;
+  try {
+    raw = parseWire(text, { maxBytes: 16 * 1024 });
+  } catch {
+    return fail2(`the relay's realm document ${url} is not JSON`);
+  }
+  const { realm: _id, ...published } = typeof raw === "object" && raw !== null ? raw : {};
+  const parsed = DirectoryRealmConfig.safeParse(published);
+  if (!parsed.success)
+    fail2(`the relay's realm document ${url} is not a directory realm`);
+  const differs = realmMismatch(parsed.data, realm);
+  if (differs.length > 0)
+    fail2(`the relay's realm document ${url} names another ${differs.join(", ")} than the environment: the home is not pinned`);
+  return parsed.data.orgDomains !== undefined ? { ...realm, orgDomains: parsed.data.orgDomains } : realm;
+}
+var JELLY_ENV, JELLY_RESOURCE_NAME = "messaging", ResourceEntry, Resources, wellKnownGet = async (url) => {
+  const response = await fetch(url, { redirect: "error", signal: AbortSignal.timeout(5000) });
+  if (!response.ok)
+    throw new MessagingError("relay_unavailable", `the relay answered ${response.status}`);
+  const text = await response.text();
+  if (Buffer.byteLength(text) > 16 * 1024)
+    throw new MessagingError("too_large", "the relay's realm document is larger than 16 KiB");
+  return text;
+};
+var init_jelly_env = __esm(() => {
+  init_dist();
+  init_zod();
+  init_jelly3();
+  JELLY_ENV = ["JELLY_ACTION_KEY", "JELLY_ID_ISSUER", "JELLY_RESOURCES", "JELLY_SERVICE_ANCHOR", "JELLY_DEVICE_LABEL", "JELLY_SOCKET_GROUP"];
+  ResourceEntry = looseObject({ name: string2().max(200), resource: string2().min(1).max(2048), url: string2().min(1).max(2048) });
+  Resources = array(unknown()).max(64);
+});
+
+// packages/daemon/dist/consent/answer-preview.js
+function who3(from) {
+  const name = cleanPeerText(from.name, { singleLine: true, maxChars: 80 }) || "someone";
+  const email = from.email === undefined ? undefined : cleanPeerText(from.email, { singleLine: true, maxChars: 100 });
+  return `${name} (${email !== undefined && email !== "" ? `${email}, ` : ""}${ORG[from.org]})`;
+}
+function answersFor(kind) {
+  return kind === "suggestion" ? ["decline"] : kind === "contact" ? ["accept", "decline", "block"] : ["once", "always", "decline", "block"];
+}
+function answerSentence(input) {
+  const { kind, answer } = input;
+  if (answer !== undefined && !answersFor(kind).includes(answer)) {
+    throw new MessagingError("invalid_request", `a ${kind === "message" || kind === "task" ? "request to your agent" : kind === "contact" ? "message request" : "suggestion"} takes ${answersFor(kind).join(", ")}`);
+  }
+  const sender = who3(input.from);
+  const single = input.count <= 1;
+  if (kind === "suggestion") {
+    const email = cleanPeerText(input.email ?? "", { singleLine: true, maxChars: 100 });
+    if (answer === undefined)
+      return `Your agent ${input.agent} suggests you send a message request to ${email}.`;
+    return `Dismiss your agent ${input.agent}'s suggestion to contact ${email}. Nothing is sent.`;
+  }
+  if (kind === "contact") {
+    const thing = single ? "their message request" : `their ${input.count} message requests`;
+    if (answer === undefined)
+      return `${sender} asks to message you.`;
+    if (answer === "accept")
+      return `${sender} may message you from now on: ${single ? "their request becomes their first message" : "their requests become their first messages"}, and they get your card.`;
+    if (answer === "decline")
+      return `Decline ${thing} from ${sender}. They are told it was declined.`;
+    return `Block ${sender}: nothing from them or their agents reaches you, and ${thing} ${single ? "is" : "are"} declined.`;
+  }
+  const thing = single ? `this ${kind}` : `these ${input.count} requests`;
+  const src = single ? `${sender}'s agent ${input.agent}` : `${sender}'s agents`;
+  const dst = single ? `your agent ${input.to}` : "your agents";
+  if (answer === undefined)
+    return `${src} asks to send ${kind === "task" ? "a task" : "a message"} to ${dst}.`;
+  if (answer === "once")
+    return `Deliver ${thing} from ${src} to ${dst} this once, guarded: ${single ? "your agent" : "your agents"} may answer only them.`;
+  if (answer === "always")
+    return `Deliver ${thing} from ${src} to ${dst}, and let their agents ask yours from now on without asking you.`;
+  if (answer === "decline")
+    return `Decline ${thing} from ${src}. They are told it was declined.`;
+  return `Block ${sender}: nothing from them or their agents reaches you, and ${thing} ${single ? "is" : "are"} declined.`;
+}
+var ORG;
+var init_answer_preview = __esm(() => {
+  init_dist();
+  ORG = { same: "your org", other: "another org", none: "no org" };
+});
+
+// packages/daemon/dist/snapshot.js
+import { createHash as createHash10 } from "crypto";
+import { chmodSync as chmodSync4, chownSync as chownSync2, existsSync as existsSync6, lstatSync as lstatSync4, mkdirSync as mkdirSync5, readFileSync as readFileSync8, rmSync as rmSync4, writeFileSync as writeFileSync5 } from "fs";
+import { join as join7 } from "path";
+function sha256File(path) {
+  const data = readFileSync8(path);
+  return { bytes: data.length, sha256: createHash10("sha256").update(data).digest("hex") };
+}
+
+class Snapshots {
+  #deps;
+  #timer;
+  constructor(deps) {
+    this.#deps = deps;
+  }
+  get folder() {
+    return join7(this.#deps.run, "snapshot");
+  }
+  take() {
+    const folder = this.folder;
+    if (existsSync6(folder))
+      throw new MessagingError("invalid_state", "a snapshot is held: release it with daemon.snapshot {done: true} first");
+    const group = this.#deps.group;
+    mkdirSync5(folder, { mode: group === undefined ? 448 : 488 });
+    try {
+      if (!IS_WINDOWS && group !== undefined) {
+        chownSync2(folder, process.geteuid?.() ?? -1, group);
+        chmodSync4(folder, 488);
+      }
+      const fileMode = group === undefined ? 384 : 416;
+      const files = [];
+      const db = join7(folder, "messaging.db");
+      this.#deps.vacuumInto(db);
+      if (existsSync6(this.#deps.config))
+        writeFileSync5(join7(folder, "config.json"), readFileSync8(this.#deps.config), { mode: fileMode });
+      for (const name of ["messaging.db", "config.json"]) {
+        const path = join7(folder, name);
+        if (!existsSync6(path))
+          continue;
+        if (!IS_WINDOWS) {
+          if (group !== undefined)
+            chownSync2(path, process.geteuid?.() ?? -1, group);
+          chmodSync4(path, fileMode);
+        }
+        files.push({ name, ...sha256File(path) });
+      }
+      const at = this.#deps.now();
+      const until = at + SNAPSHOT_HOLD_MS;
+      const manifest = { storeSchema: this.#deps.storeSchema, at, files };
+      writeFileSync5(join7(folder, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
+`, { mode: fileMode });
+      if (!IS_WINDOWS && group !== undefined)
+        chownSync2(join7(folder, "manifest.json"), process.geteuid?.() ?? -1, group);
+      clearTimeout(this.#timer);
+      this.#timer = setTimeout(() => this.release(), SNAPSHOT_HOLD_MS);
+      this.#timer.unref();
+      return { folder, files, storeSchema: this.#deps.storeSchema, at, until };
+    } catch (error) {
+      this.release();
+      if (error instanceof MessagingError)
+        throw error;
+      throw new MessagingError("internal", `the snapshot failed: ${error.code ?? "error"}`);
+    }
+  }
+  release() {
+    clearTimeout(this.#timer);
+    this.#timer = undefined;
+    let present;
+    try {
+      lstatSync4(this.folder);
+      present = true;
+    } catch {
+      present = false;
+    }
+    if (present)
+      rmSync4(this.folder, { recursive: true, force: true });
+    return { released: present };
+  }
+  close() {
+    this.release();
+  }
+}
+var SNAPSHOT_HOLD_MS;
+var init_snapshot = __esm(() => {
+  init_dist();
+  init_dist2();
+  SNAPSHOT_HOLD_MS = 60 * 60000;
+});
+
 // packages/daemon/dist/notices.js
 class Notices {
   #host;
@@ -17206,6 +17958,12 @@ class Notices {
   alert(kind, at) {
     this.#file({ id: `a_${kind.replace(/_/g, "")}${at}`, category: "alert", source: kind, at });
   }
+  device(seq, at) {
+    this.#file({ id: `a_dev${seq}`, category: "alert", source: `device:${seq}`, at });
+  }
+  trust(grantId, person, until, at) {
+    this.#file({ id: `a_trust${grantId}`, category: "alert", person, source: `trust:${until}`, at });
+  }
   #file(row) {
     if (!this.#host.store.putNotice(row))
       return;
@@ -17271,7 +18029,15 @@ class Notices {
       const own = row.person === this.#host.me();
       notice.from = profile ? { name: profile.name.slice(0, 200), ...profile.email !== undefined ? { email: profile.email.slice(0, 320) } : {}, org: profile.org } : { name: row.person, org: own ? "same" : "none" };
     }
-    if (row.category === "alert")
+    if (row.category === "alert" && row.source.startsWith("device:")) {
+      const device = this.#host.device?.(Number(row.source.slice("device:".length)));
+      if (device)
+        notice.device = device;
+      notice.line = device ? deviceLine(device) : "A device of your account changed.";
+    } else if (row.category === "alert" && row.source.startsWith("trust:")) {
+      const until = Number(row.source.slice("trust:".length));
+      notice.line = `Trust you gave this person ends on ${Number.isSafeInteger(until) ? new Date(until).toISOString().slice(0, 10) : "a date soon"}; renew it or let it lapse.`;
+    } else if (row.category === "alert")
       notice.line = ALERT_TEXT[row.source] ?? "An alarm was raised on this device.";
     else if (row.category === "message" && lines) {
       const line = this.#host.store.line(row.source);
@@ -17281,6 +18047,18 @@ class Notices {
     return notice;
   }
 }
+function vouchWords2(d) {
+  if (d.vouch === "admin")
+    return "admitted by the team's admin";
+  if (d.vouch === "device")
+    return d.approver !== undefined ? `approved on '${d.approver}'` : "approved by link";
+  return d.via === "browser" ? "signed in through the browser" : "vouched by Jelly ID on a Jelly host";
+}
+function deviceLine(d) {
+  const what = `'${d.label}'${d.kind !== undefined ? ` (${d.kind})` : ""}`;
+  const line = d.change === "added" ? `New device on your account: ${what}, ${vouchWords2(d)}.` : d.change === "vouched" ? `${what} on your account is now vouched by Jelly ID: ${vouchWords2(d)}.` : d.change === "replaced" ? `'${d.replaces?.label ?? "a device"}' was replaced by ${what}, ${vouchWords2(d)}.` : `${what} was removed from your account.`;
+  return line.length <= NOTICE_LINE_CHARS ? line : `${line.slice(0, NOTICE_LINE_CHARS - 1)}\u2026`;
+}
 function firstLine(text) {
   const first = cleanPeerText(text.split(/\r\n|\n|\r/, 1)[0] ?? "", { singleLine: true });
   if (first.length <= NOTICE_LINE_CHARS)
@@ -17861,7 +18639,7 @@ var init_storage_errors = __esm(() => {
 });
 
 // packages/daemon/dist/store.js
-import { chmodSync as chmodSync4, closeSync as closeSync7, openSync as openSync3 } from "fs";
+import { chmodSync as chmodSync5, closeSync as closeSync7, openSync as openSync3 } from "fs";
 import { DatabaseSync } from "node:sqlite";
 function additiveColumn(decl) {
   if (/\b(PRIMARY|UNIQUE|CHECK|REFERENCES|COLLATE|GENERATED|AS)\b/i.test(decl))
@@ -17950,7 +18728,7 @@ class Store {
   constructor(path) {
     if (path !== ":memory:") {
       closeSync7(openSync3(path, "a", 384));
-      chmodSync4(path, 384);
+      chmodSync5(path, 384);
     }
     this.#db = new DatabaseSync(path, { timeout: 5000 });
     this.#db.exec("PRAGMA journal_mode = WAL; PRAGMA synchronous = FULL;");
@@ -17965,6 +18743,11 @@ class Store {
     this.#statements.clear();
     this.#db.close();
   }
+  vacuumInto(path) {
+    if (this.#depth > 0)
+      throw new MessagingError("invalid_state", "a snapshot is not taken inside a transaction");
+    this.#db.exec(`VACUUM INTO '${path.replaceAll("'", "''")}'`);
+  }
   tx(fn) {
     if (this.#depth > 0) {
       const name = `sp${this.#depth}`;
@@ -18602,6 +19385,14 @@ class Store {
          SELECT substr(peer_address, 1, instr(peer_address || '@', '@') - 1), 0, created_at FROM tasks WHERE key = ?
        ) GROUP BY peer ORDER BY MAX(at) DESC, peer LIMIT ?`, key, key, key, limit).map((row) => ({ peer: String(row.peer), unread: Number(row.unread), lastAt: Number(row.at) }));
   }
+  awaitedRequests(sessions, terminal, limit) {
+    if (sessions.length === 0)
+      return [];
+    const rows = this.#all(`SELECT request FROM tasks WHERE role = 'requester' AND request IS NOT NULL
+         AND session IN (${sessions.map(() => "?").join(", ")}) AND state NOT IN (${terminal.map(() => "?").join(", ")})
+       ORDER BY updated_at DESC, task_id DESC LIMIT ?`, ...sessions, ...terminal, limit);
+    return rows.map((row) => String(row.request));
+  }
   task(taskId, role) {
     const row = this.#get(`SELECT * FROM ${TASKS} WHERE task_id = ? AND role = ?`, taskId, role);
     return row && taskRow2(row);
@@ -19173,14 +19964,14 @@ var init_version = __esm(() => {
 });
 
 // packages/daemon/dist/wake-bridge.js
-import { closeSync as closeSync8, constants as constants7, fstatSync as fstatSync4, lstatSync as lstatSync4, openSync as openSync4, readSync as readSync2 } from "fs";
+import { closeSync as closeSync8, constants as constants7, fstatSync as fstatSync4, lstatSync as lstatSync5, openSync as openSync4, readSync as readSync2 } from "fs";
 import { request } from "http";
 import { homedir as homedir2 } from "os";
-import { isAbsolute, join as join7 } from "path";
+import { isAbsolute as isAbsolute2, join as join8 } from "path";
 function serviceFile(env = process.env, windows = IS_WINDOWS) {
   const home = (windows ? env.USERPROFILE : env.HOME) || homedir2();
-  const state = env.XDG_STATE_HOME && isAbsolute(env.XDG_STATE_HOME) ? env.XDG_STATE_HOME : join7(home, ".local", "state");
-  return join7(state, "opencode", "service.json");
+  const state = env.XDG_STATE_HOME && isAbsolute2(env.XDG_STATE_HOME) ? env.XDG_STATE_HOME : join8(home, ".local", "state");
+  return join8(state, "opencode", "service.json");
 }
 function loopbackOrigin(url) {
   let parsed;
@@ -19199,7 +19990,7 @@ function loopbackOrigin(url) {
 function readService(file) {
   if (IS_WINDOWS) {
     try {
-      const stats = lstatSync4(file);
+      const stats = lstatSync5(file);
       if (stats.isSymbolicLink() || !stats.isFile() || aclProblem(file, { pinnedOwner: false }) !== undefined)
         return "service_unsafe";
     } catch (error) {
@@ -19492,6 +20283,16 @@ class Grants {
   hasGrant(person) {
     return this.#current(grantSubjectKey({ person })) !== undefined;
   }
+  expiringTrust(withinMs) {
+    const now = this.#host.now();
+    const current = this.#currentDevice();
+    return this.#all().flatMap(({ grant }) => {
+      const until = grant.trustedUntil;
+      if (!("person" in grant.subject) || until === undefined || until <= now || until > now + withinMs || !current(grant.by))
+        return [];
+      return [{ id: grant.id, person: grant.subject.person, until }];
+    });
+  }
   list(p) {
     const only = p.subject === undefined ? undefined : this.#subjectKey(p.subject, false);
     const grants = this.#all().filter(({ subject }) => only === undefined || subject === only).map(({ grant }) => this.#view(grant)).sort((a, b) => b.ts - a.ts || (a.id < b.id ? 1 : -1));
@@ -19566,6 +20367,25 @@ class Grants {
     this.#host.log("grant.sync", { id: env.id, what: conv.what, merged });
     this.sweep();
   }
+  resignFrom(predecessor) {
+    const { identity } = this.#host.joined();
+    const now = this.#host.now();
+    const resigned = [];
+    for (const { subject, grant } of this.#all()) {
+      if (grant.by !== predecessor)
+        continue;
+      const copy = resignGrant(identity, grant, { now, keep: "all" });
+      this.#store.putGrant(subject, copy);
+      resigned.push(copy);
+      if ("person" in copy.subject)
+        this.#host.changed?.(copy.subject.person);
+    }
+    if (resigned.length > 0) {
+      this.#sync("grant", resigned);
+      this.#host.log("grant.resigned", { grants: resigned.length });
+    }
+    return resigned.length;
+  }
   sweep() {
     const { identity, realm } = this.#host.joined();
     if (realm.removed())
@@ -20211,6 +21031,8 @@ class Daemon {
   #closed = false;
   #online = new Set;
   #holders = new Map;
+  #ticketEnds = new Map;
+  #lapsed = new Map;
   #policy = {
     rate: inboundRateLimiter(),
     presence: responseRateLimiter(),
@@ -20230,6 +21052,9 @@ class Daemon {
   #requests;
   #notices;
   #jellyHost;
+  #attached = false;
+  #wakeArmed = false;
+  #snapshots;
   #jellyAuth;
   #state = "starting";
   #sync;
@@ -20340,6 +21165,14 @@ class Daemon {
       address: (sender, session) => peerRef(sender, session).address,
       held: (row) => this.#notices.held(row)
     });
+    this.#snapshots = new Snapshots({
+      run: paths.run,
+      config: paths.config,
+      vacuumInto: (path) => this.#store.vacuumInto(path),
+      storeSchema: STORE_SCHEMA,
+      group: options.jellyHost?.socketGroup,
+      now: this.#now
+    });
     this.#notices = new Notices({
       store,
       now: this.#now,
@@ -20348,6 +21181,7 @@ class Daemon {
         const realm = this.#realm ?? this.#directory?.realm;
         return realm ? await realm.profile(person) : undefined;
       },
+      device: (seq) => this.#noticeDevice(seq),
       emit: (event) => this.#emit(event)
     });
     this.#keyring = new Keyring({
@@ -20379,6 +21213,10 @@ class Daemon {
   static async start(options) {
     const paths = homePaths(options.home, options.jellyHost?.run);
     ensureHome(paths);
+    const jelly = options.jellyHost;
+    if (jelly?.realm !== undefined && readConfig(paths.config).realm === undefined) {
+      options = { ...options, jellyHost: { ...jelly, realm: await pinRealm(jelly.realm, options.wellKnown) } };
+    }
     jellyConfig(paths.config, options.jellyHost);
     const lock = acquireLock(paths.lock);
     let store;
@@ -20417,6 +21255,7 @@ class Daemon {
     }
     this.#sync.load();
     this.#store.keepAllLive(this.#now(), CLI_AGENT);
+    this.#snapshots.release();
     const handlers = this.#handlers();
     const jelly = this.#jellyHost;
     if (jelly)
@@ -20448,6 +21287,7 @@ class Daemon {
     }
     this.#log("info", "daemon.started", { pid: process.pid, version: VERSION, joined: identity !== undefined, store: identityStore?.kind, ...jelly ? { deployment: "jelly" } : {} });
     this.#state = "running";
+    this.#deviceNotices(true);
     this.#startTransport();
     this.#sweepTimer = setInterval(() => this.sweep(), this.#tuning.sweepMs);
     this.#sweepTimer.unref();
@@ -20487,7 +21327,12 @@ class Daemon {
           this.#alerts();
       },
       onDeliver: (raw) => this.#onDeliver(raw),
-      state: (connected) => this.#onHostedState(connected)
+      state: (connected) => this.#onHostedState(connected),
+      replaceStep: (token) => this.#replaceWith(token),
+      eraseStep: async (token) => {
+        const done = await this.#eraseWith(token);
+        return { person: done.person, device: this.#identity.machine, seq: done.seq };
+      }
     });
     this.#directory = home;
     const realm = home.realm;
@@ -20505,6 +21350,7 @@ class Daemon {
       else
         this.#presenceSoon();
     });
+    realm.on("device-log", (persons) => this.#deviceLogGrew(persons));
     this.#removed = realm.removed();
     this.#transport = home.transport();
     home.start();
@@ -20541,6 +21387,7 @@ class Daemon {
         await server.close().catch(() => {});
       await Promise.race([this.#flushing, new Promise((resolve) => setTimeout(resolve, 2000).unref())]);
       this.#store.close();
+      this.#snapshots.close();
     } finally {
       this.#lock.release();
       this.#log("info", "daemon.stopped", { pid: process.pid });
@@ -20604,7 +21451,11 @@ class Daemon {
     return {
       "daemon.status": () => this.status(),
       "device.status": () => this.#deviceStatus(),
-      "device.bind": (p) => this.#homeDirectory("device.bind").bind(this.#jellyHost ? { ...p, label: this.#jellyHost.label, kind: this.#jellyHost.kind } : p),
+      "device.bind": async (p) => {
+        if (this.#store.getKv(PREDECESSOR_KEY) !== undefined && this.#directory)
+          return this.#replaceWith(p.token, p.label);
+        return this.#homeDirectory("device.bind").bind(this.#jellyHost ? { ...p, label: this.#jellyHost.label, kind: this.#jellyHost.kind } : p);
+      },
       "device.list": () => this.#directory?.list() ?? this.#rosterDevices(),
       "device.remove": (p) => this.#homeDirectory("device.remove").remove(p),
       "device.link": (p) => this.#homeDirectory("device.link").link(p),
@@ -20617,6 +21468,10 @@ class Daemon {
       "device.login.cancel": () => this.#homeDirectory("device.login.cancel").loginCancel(),
       "device.approve.preview": (p) => this.#homeDirectory("device.approve.preview").approvePreview(p),
       "device.approve": (p) => this.#homeDirectory("device.approve").approve(p),
+      "identity.replace": (p) => this.#replace(p),
+      "identity.replace.preview": (p) => this.#replacePreview(p),
+      "directory.erase": (p) => this.#erase(p),
+      "directory.erase.preview": (p) => this.#erasePreview(p),
       "daemon.stop": () => this.#stop(),
       "session.register": (p, ctx) => this.#register(p, ctx),
       "session.update": (p, ctx) => this.#updateSession(this.#bound(p, ctx)),
@@ -20689,6 +21544,7 @@ class Daemon {
       },
       "request.list": async () => ({ requests: [...this.#holds.list().requests, ...await this.#requests.list()] }),
       "request.answer": (p) => this.#requests.holds(p.id) ? this.#requests.answer(p) : this.#holds.answer(p),
+      "request.answer.preview": (p) => this.#answerPreview(p),
       "contact.request": (p) => this.#requests.request(p),
       "contact.request.preview": (p) => this.#requests.preview(p),
       "card.get": async (p) => {
@@ -20697,6 +21553,11 @@ class Daemon {
         return { sent: await this.#cards.get(p.person) };
       },
       "daemon.health": () => this.#health(),
+      "daemon.woke": () => this.#woke(),
+      "wake.arm": (p) => this.#wakeArm(p),
+      "wake.disarm": () => this.#wakeDisarm(),
+      "daemon.snapshot": (p) => p.done ? this.#snapshots.release() : this.#snapshots.take(),
+      "person.attached": (p) => this.#personAttached(p.attached),
       "agents.list": () => this.#agentsList(),
       "agents.read": (p) => this.#agentsRead(p),
       "notice.subscribe": (p, ctx, authority) => this.#notices.subscribe(ctx, p, authority?.scope === "host" ? authority.expiresAt : undefined),
@@ -20711,10 +21572,30 @@ class Daemon {
     const out = [];
     for (const person of all) {
       const org = realm.kind === "roster" ? "same" : await realm.profile(person).then((profile) => profile.org, () => "none");
-      out.push(this.#cards.reach(person, org === "same"));
+      const reach = this.#cards.reach(person, org === "same");
+      const changedAt = this.#recentDeviceChanges(realm, person).at(0)?.at;
+      out.push(changedAt === undefined ? reach : { ...reach, devicesChangedAt: changedAt });
     }
     return out;
   }
+  #recentDeviceChanges(realm, person) {
+    const since = this.#now() - DEVICES_CHANGED_MS;
+    const changes = realm.deviceChanges(person);
+    const labelOf = (device) => changes.filter((c) => c.device === device).at(-1)?.label;
+    return changes.filter((change) => change.change !== "vouched" && change.at > since).reverse().slice(0, 10).map((change) => {
+      const approver = change.approver !== undefined ? labelOf(change.approver) : undefined;
+      return {
+        change: change.change,
+        device: change.device,
+        label: MachineLabel.safeParse(change.label).success ? change.label : "device",
+        ...change.kind !== undefined ? { kind: change.kind } : {},
+        vouch: change.vouch === "service" ? "device" : change.vouch,
+        ...change.via !== undefined ? { via: change.via } : {},
+        ...approver !== undefined && MachineLabel.safeParse(approver).success ? { approver } : {},
+        at: change.at
+      };
+    });
+  }
   async#grantSubject(p) {
     const { realm } = this.#joined();
     if ("person" in p.subject)
@@ -20815,6 +21696,7 @@ class Daemon {
       now: this.#now
     });
     realm.on("devices-changed", () => this.#realmChanged());
+    realm.on("device-log", (persons) => this.#deviceLogGrew(persons));
     return realm;
   }
   #admin() {
@@ -20893,14 +21775,39 @@ class Daemon {
     if (!holders)
       this.#holders.set(p.key, holders = new Set);
     holders.add(ctx.id);
+    if (ticket) {
+      this.#ticketEnds.set(p.key, Math.max(this.#ticketEnds.get(p.key) ?? 0, ticket.exp * 1000));
+      for (const id of this.#lapsed.get(p.key) ?? [])
+        holders.add(id);
+      this.#lapsed.delete(p.key);
+    }
     this.#sessionsChanged();
     return { session: name, address: formatAddress(me.person, name, me.label) };
   }
   #bound(p, ctx) {
+    const ends = this.#ticketEnds.get(p.key);
+    const held = this.#holders.get(p.key)?.has(ctx.id) === true || this.#lapsed.get(p.key)?.has(ctx.id) === true;
+    if (ends !== undefined && ends <= this.#now() && held) {
+      throw new MessagingError("ticket_invalid", "the session ticket this session registered with has expired: register again with a fresh ticket from the host");
+    }
     if (!this.#holders.get(p.key)?.has(ctx.id))
       throw new MessagingError("not_found", "this session key is not registered on this connection");
     return p;
   }
+  #expireTickets(now) {
+    let changed = false;
+    for (const [key, ends] of this.#ticketEnds) {
+      if (ends > now || !this.#holders.has(key))
+        continue;
+      this.#lapsed.set(key, this.#holders.get(key));
+      this.#holders.delete(key);
+      this.#log("info", "session.ticket.expired", {});
+      if (this.#store.keepSession(key, now))
+        changed = true;
+    }
+    if (changed)
+      this.#sessionsChanged();
+  }
   #sessionOf(key) {
     const session = this.#store.sessionByKey(key);
     if (!session)
@@ -20923,6 +21830,8 @@ class Daemon {
   }
   #unregister(p) {
     this.#holders.delete(p.key);
+    this.#ticketEnds.delete(p.key);
+    this.#lapsed.delete(p.key);
     if (this.#store.keepSession(p.key, this.#now()))
       this.#sessionsChanged();
     return { ok: true };
@@ -20933,10 +21842,14 @@ class Daemon {
     this.#chats.disconnected(ctx);
     this.#notices.disconnected(ctx.id);
     let changed = false;
+    for (const [key, lapsed] of [...this.#lapsed])
+      if (lapsed.delete(ctx.id) && lapsed.size === 0)
+        this.#lapsed.delete(key);
     for (const [key, holders] of [...this.#holders]) {
       if (!holders.delete(ctx.id) || holders.size > 0)
         continue;
       this.#holders.delete(key);
+      this.#ticketEnds.delete(key);
       if (this.#store.sessionByKey(key)?.agent === CLI_AGENT)
         continue;
       if (this.#store.keepSession(key, this.#now()))
@@ -20984,7 +21897,8 @@ class Daemon {
         to: { team: true },
         payload: presencePayload(final ? this.#store.sessions().map((s) => ({ ...s, unregisteredAt: s.unregisteredAt ?? this.#now() })) : this.#store.sessions(), me.label, this.#store.next("presence"), this.#transport?.advertise?.(), {
           wake: (s) => this.#wakes(s),
-          share: new Set(this.#currentConfig().presence?.share ?? [])
+          share: new Set(this.#currentConfig().presence?.share ?? []),
+          away: this.#away()
         }),
         now: this.#now()
       });
@@ -21267,8 +22181,22 @@ class Daemon {
   async#peopleGet(p) {
     const { realm, identity } = this.#joined();
     const profile = await realm.profile(p.person);
-    const devices = realm.known(p.person).devices.map((device) => ({ device: device.machine, label: device.label, self: device.machine === identity.machine }));
-    return { person: p.person, ...profile, devices };
+    const fresh = this.#now() - (realm.kind === "directory" ? this.#tuning.presenceOnlineMs : this.#tuning.presenceMaxMs * 2);
+    const away = (machine) => {
+      if (machine === identity.machine)
+        return this.#away();
+      const row = this.#store.directoryRow(machine);
+      return row !== undefined && row.receivedAt >= fresh && row.presence.away === true;
+    };
+    const devices = realm.known(p.person).devices.map((device) => ({
+      device: device.machine,
+      label: device.label,
+      self: device.machine === identity.machine,
+      ...away(device.machine) ? { away: true } : {}
+    }));
+    const own = p.person === this.#ownPerson();
+    const deviceChanges = own ? [] : this.#recentDeviceChanges(realm, p.person);
+    return { person: p.person, ...profile, devices, ...deviceChanges.length > 0 ? { deviceChanges } : {} };
   }
   #seal(type, toMachine, session, payload, extra = {}) {
     const { identity, realm, me } = this.#joined();
@@ -22143,6 +23071,7 @@ ${row.receipt ? "receipt" : "envelope"}`;
       return;
     this.#directory?.sweep();
     const now = this.#now();
+    this.#expireTickets(now);
     let sessions = 0;
     try {
       this.#tx(() => {
@@ -22404,8 +23333,14 @@ ${row.receipt ? "receipt" : "envelope"}`;
     await transport?.stop().catch(() => {});
   }
   #deviceStatus() {
-    if (this.#directory)
-      return this.#directory.status();
+    if (this.#directory) {
+      const status = this.#directory.status();
+      return this.#store.getKv(PREDECESSOR_KEY) !== undefined && status.binding !== "removed" ? { ...status, binding: "replace" } : status;
+    }
+    if (this.#config.realm) {
+      const person = this.#store.directoryCache().own().person;
+      return { realm: "directory", binding: "none", ...person ? { person } : {} };
+    }
     const identity = this.#identity;
     const me = identity ? this.#realm?.device(identity.machine) : undefined;
     const binding = this.#removed ? "removed" : me ? "bound" : "none";
@@ -22416,6 +23351,86 @@ ${row.receipt ? "receipt" : "envelope"}`;
     const devices = realm.known(me.person).devices.map((d) => ({ device: d.machine, label: d.label, vouched: "admin", current: true, self: d.machine === identity.machine }));
     return { devices };
   }
+  #away() {
+    return this.#jellyHost !== undefined && !this.#attached;
+  }
+  #personAttached(attached) {
+    if (attached !== this.#attached) {
+      this.#attached = attached;
+      this.#log("info", "person.attached", { attached });
+      this.#presenceSoon();
+    }
+    return { ok: true };
+  }
+  #woke() {
+    this.#log("info", "daemon.woke", {});
+    this.#transport?.retryNow?.();
+    this.sweep();
+    this.#presenceSoon();
+    this.#wokeHook();
+    return { ok: true };
+  }
+  #wokeHook() {
+    if (!this.#wakeArmed)
+      return;
+    this.#wakeDisarm().catch((error) => this.#log("warn", "wake.disarm.failed", { code: codeOf(error) }));
+  }
+  async#wakeArm(p) {
+    const home = this.#directory;
+    if (!home)
+      throw new MessagingError("invalid_state", "wake tickets are for a directory realm");
+    if (home.person() === undefined)
+      throw new MessagingError("invalid_state", "this device is not bound yet");
+    const issuer = this.#config.realm?.issuer;
+    if (issuer === undefined || new URL(p.url).origin !== new URL(issuer).origin)
+      throw new MessagingError("invalid_request", "the wake URL is not on the realm's Jelly ID");
+    const agents = [...new Set(p.agents)];
+    const awaiting = this.#store.awaitedRequests(agents, TERMINAL_STATES, WAKE_AWAITING);
+    const sent = await home.wake({ url: p.url, ticket: p.ticket, agents, awaiting });
+    this.#wakeArmed = true;
+    this.#log("info", "wake.arm", { relay: sent === "sent" ? "armed" : "pending", agents: agents.length, awaiting: awaiting.length });
+    return { relay: sent === "sent" ? "armed" : "pending", awaiting: awaiting.length };
+  }
+  async#wakeDisarm() {
+    const home = this.#directory;
+    if (!home)
+      throw new MessagingError("invalid_state", "wake tickets are for a directory realm");
+    const sent = await home.wake("disarm");
+    this.#wakeArmed = false;
+    this.#log("info", "wake.disarm", { relay: sent === "sent" ? "disarmed" : "pending" });
+    return { relay: sent === "sent" ? "disarmed" : "pending" };
+  }
+  async#answerPreview(p) {
+    const { realm, me } = this.#joined();
+    const now = this.#now();
+    const profile = async (person) => {
+      const found = await realm.profile(person).catch(() => {
+        return;
+      });
+      return found ? { name: found.name.slice(0, 200), ...found.email !== undefined ? { email: found.email.slice(0, 320) } : {}, org: found.org } : { name: String(person).slice(0, 200), org: "none" };
+    };
+    const answer = p.answer;
+    const ask = this.#store.held(p.id);
+    if (ask && ask.exp > now) {
+      const kind = ask.payload.kind;
+      const count = p.all ? this.#store.helds(ask.person).filter((row) => row.exp > now).length : 1;
+      const from = await profile(ask.person);
+      const agent = ask.envelope.from.agent ?? "";
+      return { kind, from, ...agent !== "" ? { agent } : {}, to: ask.session, count, sentence: answerSentence({ kind, from, agent, to: ask.session, answer, count }) };
+    }
+    const request = this.#store.contactRequest(p.id);
+    if (request && request.exp > now) {
+      const count = p.all ? this.#store.contactRequests(request.person).filter((row) => row.exp > now).length : 1;
+      const from = await profile(request.person);
+      return { kind: "contact", from, count, sentence: answerSentence({ kind: "contact", from, answer, count }) };
+    }
+    const suggestion = this.#store.contactSuggestion(p.id);
+    if (suggestion) {
+      const from = await profile(me.person);
+      return { kind: "suggestion", from, agent: suggestion.session, count: 1, sentence: answerSentence({ kind: "suggestion", from, agent: suggestion.session, email: suggestion.email, answer, count: 1 }) };
+    }
+    throw new MessagingError("not_found", "no request with that id is held here");
+  }
   #me() {
     return (this.#realm ?? this.#directory?.realm)?.self()?.person;
   }
@@ -22462,6 +23477,232 @@ ${row.receipt ? "receipt" : "envelope"}`;
     const { rows, more } = this.#store.conversation(session.key, p.conversation.slice("agent:".length), { before: p.before }, p.limit ?? 30);
     return { kind: "entries", conversation: p.conversation, entries: rows.map(convEntry), more };
   }
+  #heldRealm(config) {
+    if (this.#directory)
+      return this.#directory.realm;
+    const throwaway = generateIdentity();
+    return new DirectoryIdentity({ config, identity: () => throwaway, link: () => {
+      return;
+    }, cache: memoryDirectoryCache(this.#store.directoryCache()), jelly: this.#jelly ?? jellyFromIssuer(config.issuer), now: this.#now });
+  }
+  #predecessor() {
+    return this.#store.getKv(PREDECESSOR_KEY) ?? this.#store.getKv(MACHINE_KEY) ?? this.#identity?.machine;
+  }
+  async#replacePreview(p) {
+    const config = this.#config.realm;
+    if (!config)
+      throw new MessagingError("invalid_state", "identity.replace is for a directory realm; a roster realm replaces a machine with team.remove and a new invite");
+    const person = this.#store.directoryCache().own().person;
+    if (!person)
+      throw new MessagingError("no_identity", "this home was never bound to an account: bind it instead (device.bind or messaging login)");
+    const realm = this.#heldRealm(config);
+    const pred = this.#predecessor();
+    const record = realm.ownDevices().find((d) => d.device === pred);
+    if (!record)
+      throw new MessagingError("not_found", "this home's device is not in its account's log");
+    const pending = this.#store.getKv(PREDECESSOR_KEY) !== undefined && this.#identity !== undefined && this.#identity.machine !== pred;
+    const bound = pending && realm.binding().state !== "none";
+    const signIns = !pending ? 2 : !bound ? 2 : record.current ? 1 : 0;
+    const alarm = this.#keysMissing ? "keys_missing" : realm.alarm()?.kind === "restored" ? "restored" : null;
+    const label = record.label;
+    const why = alarm === "keys_missing" ? " (its key files are missing)" : alarm === "restored" ? " (it runs from an older copy of its home)" : "";
+    const sentence = `This device gets a new key and replaces '${label}'${why} on your account. Your conversations, grants and history stay here, and tasks continue; ` + `mail still queued at the relay for '${label}' is lost.` + (signIns === 2 ? " Through the browser you approve two sign-ins at Jelly ID: one binds the new key, one removes the old." : signIns === 1 ? ` You approve one sign-in at Jelly ID, to remove '${label}'.` : "");
+    return {
+      predecessor: {
+        device: pred,
+        label,
+        kind: record.kind,
+        vouch: record.vouch,
+        ...record.vouch === "jelly" ? { via: record.host !== undefined ? "host" : "browser" } : {},
+        since: record.since,
+        current: record.current
+      },
+      alarm,
+      ...pending ? { device: this.#identity.machine } : {},
+      signIns,
+      sentence: sentence.slice(0, 600)
+    };
+  }
+  async#replace(p) {
+    const config = this.#config.realm;
+    if (!config)
+      throw new MessagingError("invalid_state", "identity.replace is for a directory realm; a roster realm replaces a machine with team.remove and a new invite");
+    if (this.#removed || this.#directory?.realm.removed())
+      throw new MessagingError("invalid_state", "this device was removed from its account; it cannot replace anything");
+    const person = this.#store.directoryCache().own().person;
+    if (!person)
+      throw new MessagingError("no_identity", "this home was never bound to an account: bind it instead (device.bind or messaging login)");
+    const pred = this.#predecessor();
+    if (!pred)
+      throw new MessagingError("no_identity", "this home names no device to replace");
+    const record = this.#heldRealm(config).ownDevices().find((d) => d.device === pred);
+    if (!record)
+      throw new MessagingError("not_found", "this home's device is not in its account's log");
+    if (this.#store.getKv(PREDECESSOR_KEY) === undefined || this.#identity === undefined || this.#identity.machine === pred) {
+      if (!record.current)
+        throw new MessagingError("invalid_state", "this home's device was removed from its account; it cannot be replaced");
+      await this.#newKeys(pred, config);
+    }
+    return this.#replaceNext(p);
+  }
+  async#replaceNext(p) {
+    const home = this.#directory;
+    const me = this.#identity.machine;
+    if (p.token !== undefined) {
+      const done = await this.#replaceWith(p.token, p.label);
+      if (this.#store.getKv(PREDECESSOR_KEY) === undefined)
+        return { state: "done", person: done.person, device: me, predecessor: done.predecessor, seq: done.seq };
+    } else if (this.#replaceFinished()) {
+      return this.#replaceDone();
+    }
+    if (this.#store.getKv(PREDECESSOR_KEY) === undefined)
+      return this.#replaceDone();
+    if (this.#jellyHost || p.token !== undefined)
+      return { state: "token", device: me };
+    const pred = this.#store.getKv(PREDECESSOR_KEY);
+    const record = home.realm.ownDevices().find((d) => d.device === pred);
+    const label = p.label ?? this.#store.getKv(REPLACE_LABEL_KEY) ?? record?.label ?? "device";
+    const kind = record && record.kind !== "jelly-host" ? record.kind : "laptop";
+    const started = await home.signIn("replace", { label, kind });
+    return { state: "sign-in", device: me, ...started };
+  }
+  #replaceFinished() {
+    const pred = this.#store.getKv(PREDECESSOR_KEY);
+    if (pred === undefined)
+      return true;
+    const realm = this.#directory?.realm;
+    if (!realm || realm.binding().state === "none")
+      return false;
+    return realm.ownDevices().find((d) => d.device === pred)?.current !== true;
+  }
+  #replaceDone() {
+    const realm = this.#directory.realm;
+    const pred = this.#store.getKv(PREDECESSOR_KEY) ?? this.#store.getKv(REPLACED_KEY);
+    this.#store.deleteKv(PREDECESSOR_KEY);
+    const me = this.#identity.machine;
+    const binding = realm.binding();
+    const record = pred !== undefined ? realm.ownDevices().find((d) => d.device === pred) : undefined;
+    return { state: "done", person: binding.person, device: me, predecessor: pred ?? me, seq: record?.unbound ? realm.deviceChanges(binding.person).find((c) => c.device === pred && c.change === "replaced")?.seq ?? 0 : 0 };
+  }
+  async#replaceWith(token, label) {
+    const home = this.#directory;
+    const pred = this.#store.getKv(PREDECESSOR_KEY);
+    if (!home || pred === undefined)
+      throw new MessagingError("invalid_state", "no replacement is pending: start one with identity.replace");
+    const realm = home.realm;
+    const me = this.#identity.machine;
+    const record = realm.ownDevices().find((d) => d.device === pred);
+    let seq = 0;
+    let spent = false;
+    if (realm.binding().state === "none") {
+      const kind = this.#jellyHost?.kind ?? (record && record.kind !== "jelly-host" ? record.kind : "laptop");
+      const done = await home.bind({ token, label: this.#jellyHost?.label ?? label ?? this.#store.getKv(REPLACE_LABEL_KEY) ?? record?.label ?? "device", kind });
+      seq = done.seq;
+      spent = signInToken(token);
+      this.#log("info", "identity.replace.bound", { seq });
+    }
+    await realm.awaitSelf();
+    this.#tx(() => this.#grants.resignFrom(pred));
+    let unbound = false;
+    if (!spent && realm.ownDevices().find((d) => d.device === pred)?.current) {
+      const done = await realm.unbind(pred, { reason: "replaced", token });
+      seq = done.seq;
+      unbound = true;
+      this.#log("info", "identity.replace.done", { seq });
+    }
+    if (unbound || this.#replaceFinished()) {
+      this.#store.setKv(REPLACED_KEY, pred);
+      this.#store.deleteKv(PREDECESSOR_KEY);
+      this.#store.deleteKv(REPLACE_LABEL_KEY);
+      this.#emit({ type: "contacts" });
+    }
+    return { person: realm.binding().person, device: me, predecessor: pred, seq };
+  }
+  async#newKeys(pred, config) {
+    const label = this.#heldRealm(config).ownDevices().find((d) => d.device === pred)?.label;
+    this.#store.setKv(PREDECESSOR_KEY, pred);
+    if (label !== undefined)
+      this.#store.setKv(REPLACE_LABEL_KEY, label);
+    const keys = { identity: generateIdentity(), retained: [] };
+    let identityStore = this.#keyring.store;
+    if (identityStore)
+      identityStore.save(keys);
+    else
+      identityStore = saveNewIdentity(this.paths.identity, keys, identitySettings(this.#config), this.#storeDeps());
+    this.#store.setKv(MACHINE_KEY, keys.identity.machine);
+    this.#log("info", "identity.replace.keys", { store: identityStore.kind });
+    const old = this.#directory;
+    this.#directory = undefined;
+    this.#realm = undefined;
+    this.#transport = undefined;
+    if (old) {
+      await old.stop();
+      this.#onHostedState(false);
+    }
+    const cache = this.#store.directoryCache();
+    if (cache.alarm()?.kind === "restored")
+      cache.setAlarm(undefined);
+    for (const row of this.#store.outbox())
+      if (row.env.from.device === pred)
+        this.#store.deleteOutbox(row.id);
+    this.#keysMissing = false;
+    this.#keyring.adopt(keys, identityStore);
+    this.#openDirectory(config, keys, identityStore);
+  }
+  #erasePreview(_p) {
+    const home = this.#homeDirectory("directory.erase.preview");
+    const binding = home.realm.binding();
+    if (!binding.person || binding.state === "none" || binding.state === "removed")
+      throw new MessagingError("no_identity", "this device is not bound to an account");
+    const devices = home.realm.ownDevices().filter((d) => d.current);
+    const me = this.#identity.machine;
+    return {
+      person: binding.person,
+      devices: devices.map((d) => ({ device: d.device, label: d.label, kind: d.kind, self: d.device === me })),
+      signIns: this.#jellyHost || binding.record?.host !== undefined ? 0 : 1,
+      perDay: ERASURES_PER_DAY,
+      lost: [
+        `Every device of your account (${devices.length}, this one included) is removed from Messaging, and none can be bound again.`,
+        "Your Jelly account can never be bound to Messaging again: the erasure is for good, and a new sign-in is refused.",
+        "The directory deletes your name, email and handle, and every device record and key statement it held for you.",
+        "Messages still queued at the relay for your devices are deleted.",
+        "Your contacts see a deleted account, and drop the grants and cards they hold for you."
+      ],
+      kept: ["Each device keeps its own history (conversations, transcripts, grants) on its disk until you delete its home.", "Your Jelly account itself is not deleted: only its Messaging account is."]
+    };
+  }
+  async#erase(p) {
+    const home = this.#homeDirectory("directory.erase");
+    const binding = home.realm.binding();
+    if (!binding.person || binding.state === "none" || binding.state === "removed")
+      throw new MessagingError("no_identity", "this device is not bound to an account");
+    if (binding.record?.vouch !== "jelly")
+      throw new MessagingError("forbidden", "a device approved by link erases nothing; erase from a device Jelly ID vouched for");
+    if (p.token !== undefined) {
+      const done = await this.#eraseWith(p.token);
+      return { state: "done", person: done.person, devices: done.devices };
+    }
+    if (this.#jellyHost)
+      throw new MessagingError("invalid_request", "under a Jelly host, directory.erase needs a fresh token for this device from its host (token)");
+    const record = binding.record;
+    const started = await home.signIn("erase", { label: record.label, kind: record.kind !== "jelly-host" ? record.kind : "laptop" });
+    return { state: "sign-in", ...started };
+  }
+  async#eraseWith(token) {
+    const home = this.#homeDirectory("directory.erase");
+    let done;
+    try {
+      done = await home.realm.erase(token);
+    } catch (error) {
+      if (!(error instanceof MessagingError) || error.code !== "rate_limited")
+        throw error;
+      const wait = error.retryAfterMs;
+      const when = typeof wait === "number" && wait > 0 ? `; try again in about ${Math.max(1, Math.ceil(wait / 60000))} min` : "; try again tomorrow";
+      throw new MessagingError("rate_limited", `the directory allows ${ERASURES_PER_DAY} erasures per person a day${when}`);
+    }
+    this.#log("warn", "directory.erased", { devices: done.devices });
+    return done;
+  }
   #removePreview(p) {
     const entry = this.#homeDirectory("device.remove.preview").list().devices.find((d) => d.device === p.device);
     if (!entry)
@@ -22475,6 +23716,93 @@ ${row.receipt ? "receipt" : "envelope"}`;
       ...entry.since !== undefined ? { since: entry.since } : {}
     };
   }
+  #deviceLogGrew(persons) {
+    try {
+      this.#deviceNotices();
+    } catch (error) {
+      this.#log("error", "notice.device.failed", { code: codeOf(error) });
+    }
+    if (persons.some((person) => person !== this.#me()))
+      this.#emit({ type: "contacts" });
+  }
+  #ownPerson() {
+    return this.#directory?.person() ?? this.#me();
+  }
+  #deviceNotices(start = false) {
+    const realm = this.#realm ?? this.#directory?.realm;
+    const person = this.#ownPerson();
+    const me = this.#identity?.machine;
+    if (!realm || !person || !me)
+      return;
+    const changes = realm.deviceChanges(person);
+    const head = changes.at(-1)?.seq ?? -1;
+    let last = this.#store.getKv(DEVICE_NOTICES_KEY);
+    if (last === undefined) {
+      const admitted = changes.find((change) => change.device === me && change.change === "added");
+      if (start || admitted === undefined) {
+        this.#store.setKv(DEVICE_NOTICES_KEY, String(head));
+        return;
+      }
+      last = String(admitted.seq);
+    }
+    const fresh = changes.filter((change) => change.seq > Number(last));
+    if (fresh.length === 0)
+      return;
+    const replacers = new Set(fresh.filter((change) => change.change === "replaced").map((change) => change.by));
+    for (const change of fresh) {
+      if (change.device === me || change.by === me)
+        continue;
+      if (change.change === "added" && replacers.has(change.device))
+        continue;
+      this.#notices.device(change.seq, change.at);
+    }
+    this.#store.setKv(DEVICE_NOTICES_KEY, String(Math.max(head, Number(last))));
+  }
+  #noticeDevice(seq) {
+    const realm = this.#realm ?? this.#directory?.realm;
+    const person = this.#ownPerson();
+    if (!realm || !person)
+      return;
+    const changes = realm.deviceChanges(person);
+    const change = changes.find((c) => c.seq === seq);
+    if (!change)
+      return;
+    const labelOf = (device) => changes.filter((c) => c.device === device).at(-1)?.label;
+    const gone = (device) => changes.some((c) => c.device === device && (c.change === "removed" || c.change === "replaced"));
+    const subject = change.change === "replaced" ? change.by : change.device;
+    const latest = change.change === "replaced" ? changes.filter((c) => c.device === subject && c.change !== "removed" && c.change !== "replaced").at(-1) : change;
+    const label = latest?.label ?? labelOf(subject) ?? "device";
+    const current = !gone(subject);
+    const view = {
+      change: change.change,
+      device: subject,
+      label: MachineLabel.safeParse(label).success ? label : "device",
+      ...latest?.kind !== undefined ? { kind: latest.kind } : {},
+      vouch: ((v) => v === "service" ? "device" : v)(latest?.vouch ?? change.vouch),
+      ...(latest?.via ?? change.via) !== undefined ? { via: latest?.via ?? change.via } : {},
+      ...change.approver !== undefined && labelOf(change.approver) !== undefined ? { approver: labelOf(change.approver) } : {},
+      ...change.change === "replaced" ? { replaces: { device: change.device, label: change.label } } : {},
+      current,
+      at: change.at
+    };
+    const remove = current ? this.#removeWith() : undefined;
+    if (remove)
+      view.remove = remove;
+    return view;
+  }
+  #removeWith() {
+    const home = this.#directory;
+    if (!home)
+      return this.#roster?.isAdmin(this.#identity?.machine ?? "") ? "team" : undefined;
+    const self = home.list().devices.find((device) => device.self && device.current);
+    if (!self || self.vouched !== "jelly")
+      return;
+    return self.via === "browser" ? "sign-in" : "token";
+  }
+  #trustNotices() {
+    for (const grant of this.#grants.expiringTrust(TRUST_NOTICE_MS))
+      this.#notices.trust(grant.id, grant.person, grant.until, this.#now());
+  }
   #alerts() {
     const realmAlarm = this.#directory?.status().alarm;
     const roster = this.#keysMissing ? "keys_missing" : this.#keyring.restored() ? "restored" : undefined;
@@ -22492,6 +23820,16 @@ ${row.receipt ? "receipt" : "envelope"}`;
     }
     if (realmAlarm)
       this.#notices.alert(realmAlarm.kind, realmAlarm.at);
+    this.#deviceNotices();
+    if (this.#joinedOrUndefined())
+      this.#trustNotices();
+  }
+  #joinedOrUndefined() {
+    try {
+      return this.#joined();
+    } catch {
+      return;
+    }
   }
   #homeDirectory(method) {
     if (this.#directory)
@@ -22834,6 +24172,22 @@ function jellyConfig(path, jelly) {
     }
     return;
   }
+  if (jelly.realm !== undefined) {
+    if (config.realm === undefined) {
+      if (config.relay !== undefined || config.person !== undefined) {
+        throw new MessagingError("invalid_request", `${path} is a roster home (relay, person): a Jelly host's home is pinned to a directory realm; give the service a new STATE_DIRECTORY`);
+      }
+      if (config.ipc?.agentGroup !== undefined)
+        throw new MessagingError("invalid_request", "deployment jelly shares its sockets with --socket-group, not ipc.agentGroup");
+      writeConfig(path, { ...config, realm: jelly.realm, deployment: "jelly" });
+      return;
+    }
+    const differs = realmMismatch(config.realm, jelly.realm);
+    if (differs.length > 0) {
+      const which = differs.map((member) => `${member} ${JSON.stringify(config.realm[member])} (the environment: ${JSON.stringify(jelly.realm[member])})`).join(", ");
+      throw new MessagingError("invalid_request", `${path} pins another realm: ${which}. A home never changes realm, and the daemon does not rewrite it; restore the variables the home was made with, or give the service a new STATE_DIRECTORY`);
+    }
+  }
   if (config.realm === undefined)
     throw new MessagingError("invalid_request", "deployment jelly needs a directory realm: config.json has no realm (a Jelly host supervises no roster realm)");
   if (config.ipc?.agentGroup !== undefined)
@@ -22844,7 +24198,15 @@ function jellyConfig(path, jelly) {
 function isLineTarget(to) {
   return to.startsWith("#") || !to.includes("/");
 }
-var DAY3 = 86400000, KEYCHAIN_LEFTOVERS_KEY = "keychain.stale", DEFAULT_TUNING, KEPT_MS, INPUT_TIMEOUT_MS, TASK_BYTES = 1048576, MACHINE_KEY = "identity.machine", DEFAULT_INVITE_TTL_MS, LIST_BYTES = 1572864;
+function signInToken(token) {
+  try {
+    const claims = parseWire(Buffer.from(token.split(".")[1] ?? "", "base64url").toString("utf8"));
+    return typeof claims === "object" && claims !== null && claims.src === "device";
+  } catch {
+    return false;
+  }
+}
+var DAY3 = 86400000, KEYCHAIN_LEFTOVERS_KEY = "keychain.stale", DEFAULT_TUNING, KEPT_MS, INPUT_TIMEOUT_MS, TASK_BYTES = 1048576, PREDECESSOR_KEY = "identity.predecessor", REPLACE_LABEL_KEY = "identity.replace.label", REPLACED_KEY = "identity.replaced", ERASURES_PER_DAY = 10, DEVICE_NOTICES_KEY = "notice.devices.seq", TRUST_NOTICE_MS, DEVICES_CHANGED_MS, MACHINE_KEY = "identity.machine", DEFAULT_INVITE_TTL_MS, LIST_BYTES = 1572864;
 var init_daemon = __esm(() => {
   init_dist();
   init_dist2();
@@ -22861,7 +24223,11 @@ var init_daemon = __esm(() => {
   init_policy();
   init_roster_identity();
   init_directory_home();
+  init_directory_identity();
   init_jelly3();
+  init_jelly_env();
+  init_answer_preview();
+  init_snapshot();
   init_notices();
   init_resolve();
   init_secrets();
@@ -22887,6 +24253,8 @@ var init_daemon = __esm(() => {
   };
   KEPT_MS = DAY3;
   INPUT_TIMEOUT_MS = DAY3;
+  TRUST_NOTICE_MS = 7 * DAY3;
+  DEVICES_CHANGED_MS = 7 * DAY3;
   DEFAULT_INVITE_TTL_MS = DAY3;
 });
 
@@ -23483,6 +24851,9 @@ class DirectTransport {
   presence(env) {
     this.#relay.presence(env);
   }
+  retryNow() {
+    this.#relay.retryNow?.();
+  }
   appendRoster(entry) {
     return this.#relay.appendRoster(entry);
   }
@@ -23584,6 +24955,11 @@ var init_pacing = __esm(() => {
   PAIR_WINDOW_MS = 30 * DAY_MS5;
 });
 
+// packages/relay/dist/directory/wakes.js
+var init_wakes = __esm(() => {
+  init_dist();
+});
+
 // packages/relay/dist/directory/module.js
 var DAY4, DIRECTORY_FRAMES;
 var init_module = __esm(() => {
@@ -23592,9 +24968,30 @@ var init_module = __esm(() => {
   init_feed();
   init_jelly4();
   init_pacing();
+  init_wakes();
   DAY4 = 24 * 60;
-  DIRECTORY_FRAMES = new Set(["dir.bind", "dir.append", "dir.keys", "dir.sth", "dir.lookup", "dir.device", "dir.resolve", "dir.search", "dir.watch", "presence.watch", "dir.erase"]);
+  DIRECTORY_FRAMES = new Set([
+    "dir.bind",
+    "dir.append",
+    "dir.keys",
+    "dir.sth",
+    "dir.lookup",
+    "dir.device",
+    "dir.resolve",
+    "dir.search",
+    "dir.watch",
+    "presence.watch",
+    "dir.erase",
+    "wake.arm",
+    "wake.disarm"
+  ]);
 });
+
+// packages/relay/dist/directory/store.js
+var init_store4 = __esm(() => {
+  init_dist();
+});
+
 // packages/relay/dist/server.js
 var HIGH_WATER, MAX_BUFFERED;
 var init_server2 = __esm(() => {
@@ -23605,6 +25002,7 @@ var init_server2 = __esm(() => {
   init_pages();
   init_store3();
   init_module();
+  init_store4();
   HIGH_WATER = 1024 * 1024;
   MAX_BUFFERED = 16 * 1024 * 1024;
 });
@@ -23657,6 +25055,14 @@ class RelayClient {
     if (!this.#ws && !this.#retryTimer)
       this.#open();
   }
+  retryNow() {
+    if (!this.#running || this.#ws || !this.#retryTimer)
+      return;
+    clearTimeout(this.#retryTimer);
+    this.#retryTimer = undefined;
+    this.#attempt = 0;
+    this.#open();
+  }
   async stop() {
     this.#running = false;
     clearTimeout(this.#retryTimer);
@@ -23733,6 +25139,12 @@ class RelayClient {
   presenceWatch(persons) {
     return this.#dir("dir.ok", { t: "presence.watch", persons });
   }
+  wakeArm(arm) {
+    return this.#dir("dir.ok", { t: "wake.arm", url: arm.url, ticket: arm.ticket, agents: arm.agents, awaiting: arm.awaiting });
+  }
+  wakeDisarm() {
+    return this.#dir("dir.ok", { t: "wake.disarm" });
+  }
   dirErase(entries, token) {
     return this.#dir("dir.ok", { t: "dir.erase", entries, token });
   }
@@ -24310,6 +25722,7 @@ class RelayDirectoryLink {
   #running = false;
   #watched = [];
   #presence = [];
+  #wake;
   #opening = new Set;
   constructor(options) {
     this.#options = options;
@@ -24351,6 +25764,8 @@ class RelayDirectoryLink {
           client.dirWatch(this.#watched).catch(() => {});
         if (this.#presence.length > 0)
           client.presenceWatch(this.#presence).catch(() => {});
+        if (this.#wake !== undefined)
+          this.#sendWake(client, this.#wake).catch(() => {});
         const sth = "sth" in state ? STH.safeParse(state.sth) : undefined;
         pushes.state(true, sth?.success ? sth.data : undefined);
       },
@@ -24403,6 +25818,9 @@ class RelayDirectoryLink {
       throw shape();
     return { seq: reply.seq, sth: reply.sth };
   }
+  async erase(entries, token) {
+    parse5(DirOkFrame, await link((await this.#authed()).dirErase(entries, token)));
+  }
   async keys(statement) {
     const reply = parse5(DirOkFrame, await link((await this.#authed()).dirKeys(statement)));
     if (reply.sth === undefined)
@@ -24458,6 +25876,34 @@ class RelayDirectoryLink {
   presence(env) {
     this.#client?.presence(env);
   }
+  retryNow() {
+    this.#client?.retryNow();
+  }
+  async wake(state) {
+    this.#wake = state;
+    const client = this.#connect();
+    if (!client?.connected)
+      return "pending";
+    try {
+      await this.#sendWake(client, state);
+      return "sent";
+    } catch (error) {
+      if (isMessagingError(error) && error.code === "relay_unavailable")
+        return "pending";
+      throw error;
+    }
+  }
+  async#sendWake(client, state) {
+    try {
+      parse5(DirOkFrame, await (state === "disarm" ? client.wakeDisarm() : client.wakeArm(state)));
+    } catch (error) {
+      if (!(isMessagingError(error) && error.code === "relay_unavailable") && this.#wake === state)
+        this.#wake = undefined;
+      throw error;
+    }
+    if (this.#wake === state)
+      this.#wake = undefined;
+  }
   async presenceWatch(persons) {
     this.#presence = [...persons];
     const client = this.#connect();
@@ -24516,6 +25962,7 @@ var init_dist4 = __esm(() => {
   init_log();
   init_version();
   init_jelly3();
+  init_jelly_env();
   init_store2();
   init_dist();
 });
@@ -25756,6 +27203,12 @@ var people = {
       }
       ctx.out.line(`${ctx.out.style.bold(inline(person.name, 64))}  handle ${inline(person.handle, 64)}  org ${person.org}  vouched ${person.vouched}`);
       ctx.out.lines(table(["DEVICE", "LABEL", ""], person.devices.map((d) => [d.device, inline(d.label, 32), d.self ? "this device" : ""]), ctx.out.style));
+      if (person.deviceChanges !== undefined) {
+        const now = ctx.now();
+        ctx.out.line(`${ctx.out.style.yellow(`${inline(person.name, 64)}'s devices changed:`)}`);
+        for (const change of person.deviceChanges)
+          ctx.out.line(`  ${change.change} '${inline(change.label, 32)}' (${vouchWords(change)})  ${ago(change.at, now)}`);
+      }
       return;
     }
     if (ctx.json) {
@@ -25872,8 +27325,9 @@ var notices = {
   usage: "[--lines] [--ack]",
   details: [
     "Each line is a message for you (a DM or channel line from someone else, or your own agent's line to you),",
-    "a request held for you to answer (`messaging requests`), or an alert about this device. --lines adds a",
-    "message's first line (peer text). --ack marks every notice shown as seen."
+    "a request held for you to answer (`messaging requests`), or an alert: about this device, a device added to or",
+    "removed from your account (with how to remove one that is not yours), or trust you gave that ends within 7 days.",
+    "--lines adds a message's first line (peer text). --ack marks every notice shown as seen."
   ].join(`
 `),
   options: {
@@ -25900,13 +27354,25 @@ var notices = {
       ago(n.at, now),
       n.category,
       n.from ? inline(n.from.name, 40) : "",
-      n.conversation !== undefined ? inline(n.conversation, 60) : "",
+      n.conversation !== undefined ? inline(n.conversation, 60) : n.device !== undefined ? `device ${n.device.device}` : "",
       n.line !== undefined ? inline(n.line, 120) : ""
     ]), ctx.out.style));
+    const removable = list.flatMap((n) => n.device?.remove !== undefined && n.device.current ? [n.device] : []);
+    for (const d of removable) {
+      const how = d.remove === "sign-in" ? `messaging login --remove ${d.device}` : d.remove === "team" ? `messaging team remove ${d.device}` : "Remove it from the Jelly app on this device";
+      ctx.out.note(`Not yours? '${inline(d.label, 32)}': ${how}`);
+    }
     if (values.ack === true)
       ctx.out.line(ctx.out.style.dim(`${list.length} marked seen`));
   }
 };
+function vouchWords(d) {
+  if (d.vouch === "admin")
+    return "admitted by the team's admin";
+  if (d.vouch === "device")
+    return d.approver !== undefined ? `approved on '${inline(d.approver, 32)}'` : "approved by link";
+  return d.via === "browser" ? "signed in through the browser" : "vouched by Jelly ID";
+}
 var DIRECTORY_COMMANDS = [status, who2, people, devices, notices];
 
 // packages/daemon/dist/cli/commands/identity.js
@@ -26176,6 +27642,55 @@ function aborted2(signal) {
     signal.addEventListener("abort", () => resolve(), { once: true });
   });
 }
+async function showSignIn(ctx, started, open) {
+  if (!ctx.json) {
+    const { bold } = ctx.out.style;
+    const lead = started.purpose === "remove" ? "To remove that device, sign in at Jelly ID:" : started.purpose === "replace" ? "To replace your old device, sign in at Jelly ID with this one:" : started.purpose === "erase" ? "To erase your account, sign in at Jelly ID:" : "To sign this device in, open:";
+    ctx.out.line(lead);
+    ctx.out.line(`  ${started.verificationUriComplete}`);
+    ctx.out.line(`and check that the page shows the code ${bold(started.userCode)} and the key ${bold(started.fingerprint)}.`);
+    ctx.out.line(`(Or open ${started.verificationUri} and type the code.)`);
+  }
+  if (open) {
+    const opened = await (ctx.io.openUrl ?? openInBrowser)(started.verificationUriComplete);
+    if (!opened)
+      ctx.out.note("Could not open a browser here; open the link on any device.");
+  } else if (!ctx.json && (ctx.io.env.SSH_CONNECTION !== undefined || ctx.io.env.SSH_TTY !== undefined)) {
+    ctx.out.note("Over SSH: open the link on your laptop or phone; the code ties it to this machine.");
+  }
+}
+async function waitSignIn(ctx, client, started) {
+  const minutes = Math.max(1, Math.round((started.expires - ctx.now()) / 60000));
+  if (!ctx.json)
+    ctx.out.note(`Waiting for your approval (the code expires in ${minutes} min; Ctrl-C cancels)...`);
+  const interrupted = aborted2(ctx.io.signal);
+  let state = { ...started, state: "pending" };
+  while (state.state === "pending") {
+    const asked = client.call("device.login.status", { waitMs: STATUS_WAIT_MS }, { timeoutMs: STATUS_WAIT_MS + 15000 });
+    const next = await Promise.race([asked, interrupted.then(() => {
+      return;
+    })]);
+    if (next === undefined) {
+      asked.catch(() => {});
+      await client.call("device.login.cancel", {}).catch(() => {});
+      ctx.out.note("Cancelled.");
+      return;
+    }
+    state = next;
+  }
+  if (state.state === "failed")
+    throw new MessagingError(state.code, state.message);
+  return state;
+}
+async function confirmed(ctx, yes, question, word = "y") {
+  if (yes)
+    return true;
+  if (ctx.json)
+    throw new UsageError("with --json there is no prompt: confirm with --yes");
+  ctx.out.prompt(`${question} Type ${word} to confirm: `);
+  const answer = (await readLine(ctx.io.stdin) ?? "").trim().toLowerCase();
+  return word === "y" ? /^y(es)?$/.test(answer) : answer === word;
+}
 var login = {
   name: "login",
   summary: "Sign this device in to your account through the browser (hosted realm)",
@@ -26219,45 +27734,15 @@ var login = {
       ctx.out.json(started);
       return;
     }
-    if (!ctx.json) {
-      const { bold } = ctx.out.style;
-      ctx.out.line(started.purpose === "remove" ? "To remove that device, sign in at Jelly ID:" : "To sign this device in, open:");
-      ctx.out.line(`  ${started.verificationUriComplete}`);
-      ctx.out.line(`and check that the page shows the code ${bold(started.userCode)} and the key ${bold(started.fingerprint)}.`);
-      ctx.out.line(`(Or open ${started.verificationUri} and type the code.)`);
-    }
-    if (values.open === true) {
-      const opened = await (ctx.io.openUrl ?? openInBrowser)(started.verificationUriComplete);
-      if (!opened)
-        ctx.out.note("Could not open a browser here; open the link on any device.");
-    } else if (!ctx.json && (ctx.io.env.SSH_CONNECTION !== undefined || ctx.io.env.SSH_TTY !== undefined)) {
-      ctx.out.note("Over SSH: open the link on your laptop or phone; the code ties it to this machine.");
-    }
+    await showSignIn(ctx, started, values.open === true);
     const minutes = Math.max(1, Math.round((started.expires - ctx.now()) / 60000));
     if (!wait) {
       ctx.out.note(`The daemon waits ${minutes} min for your approval. See it with: messaging devices`);
       return;
     }
-    if (!ctx.json)
-      ctx.out.note(`Waiting for your approval (the code expires in ${minutes} min; Ctrl-C cancels)...`);
-    const signal = ctx.io.signal;
-    const interrupted = aborted2(signal);
-    let state = { ...started, state: "pending" };
-    while (state.state === "pending") {
-      const asked = client.call("device.login.status", { waitMs: STATUS_WAIT_MS }, { timeoutMs: STATUS_WAIT_MS + 15000 });
-      const next = await Promise.race([asked, interrupted.then(() => {
-        return;
-      })]);
-      if (next === undefined) {
-        asked.catch(() => {});
-        await client.call("device.login.cancel", {}).catch(() => {});
-        ctx.out.note("Cancelled.");
-        return 130;
-      }
-      state = next;
-    }
-    if (state.state === "failed")
-      throw new MessagingError(state.code, state.message);
+    const state = await waitSignIn(ctx, client, started);
+    if (state === undefined)
+      return 130;
     if (ctx.json) {
       ctx.out.json(state);
       return state.state === "done" ? undefined : 1;
@@ -26274,7 +27759,128 @@ var login = {
     }
   }
 };
-var LOGIN_COMMANDS = [login];
+var replace = {
+  name: "identity replace",
+  summary: "Replace this home's device with new keys after a restore (hosted realm)",
+  usage: "[--label <label>] [--open] [--yes]",
+  details: [
+    "For a home restored from a backup or a snapshot (alarm keys_missing or restored), or for a fresh key on purpose.",
+    "This device gets a new key, binds it to your account and removes the old device (reason replaced): your",
+    "conversations, grants and history stay, and tasks continue. Mail still queued at the relay for the old device is",
+    "lost. Through the browser you approve two sign-ins at Jelly ID: one binds the new key, one removes the old."
+  ].join(`
+`),
+  options: {
+    label: { type: "string", value: "<label>", description: "The new device's label (default: the old one's)" },
+    open: { type: "boolean", description: "Open each link in this machine's browser" },
+    yes: { type: "boolean", short: "y", description: "Do not ask for confirmation" }
+  },
+  args: { min: 0, max: 0 },
+  async run(ctx, _positionals, values) {
+    const label = stringValue(values, "label");
+    const client = await ctx.client();
+    const preview = await client.call("identity.replace.preview", {});
+    if (!ctx.json)
+      ctx.out.line(inline(preview.sentence, 600));
+    if (!await confirmed(ctx, values.yes === true, `Replace '${inline(preview.predecessor.label, 32)}' (device ${preview.predecessor.device}) with this device?`)) {
+      ctx.out.note("Not replaced.");
+      return 1;
+    }
+    const params = label !== undefined ? { label: parseWith2(MachineLabel, label, "--label must be a lowercase label, e.g. desk") } : {};
+    for (let step = 0;step < 3; step++) {
+      const result = await client.call("identity.replace", params);
+      if (result.state === "done") {
+        if (ctx.json)
+          ctx.out.json(result);
+        else
+          ctx.out.line(`Replaced: this device (${result.device}) replaces ${result.predecessor} on ${inline(result.person, 64)}.`);
+        return;
+      }
+      if (result.state === "token") {
+        if (ctx.json)
+          ctx.out.json(result);
+        else
+          ctx.out.note(`This device (${result.device}) waits for its Jelly host to bind the new key; the host's app finishes the replacement.`);
+        return;
+      }
+      await showSignIn(ctx, result, values.open === true);
+      const state = await waitSignIn(ctx, client, result);
+      if (state === undefined)
+        return 130;
+      if (state.state !== "done") {
+        ctx.out.note("The sign-in was cancelled (another sign-in started, or the daemon stopped).");
+        return 1;
+      }
+      if ((await client.call("device.status", {})).binding !== "replace") {
+        const done = { state: "done", person: state.person, device: result.device, predecessor: preview.predecessor.device, seq: state.seq };
+        if (ctx.json)
+          ctx.out.json(done);
+        else
+          ctx.out.line(`Replaced: this device (${result.device}) replaces ${preview.predecessor.device} on ${inline(state.person, 64)}.`);
+        return;
+      }
+      if (!ctx.json)
+        ctx.out.note("The new key is bound. One more sign-in removes the old device.");
+    }
+    throw new MessagingError("internal", "the replacement did not finish; run messaging identity replace again");
+  }
+};
+var erase = {
+  name: "erase",
+  summary: "Erase your account from Messaging, for good (hosted realm)",
+  usage: "[--open] [--yes]",
+  details: [
+    "Removes every device of your account and deletes what the directory holds about you. Your Jelly account can",
+    "never be bound to Messaging again. The directory allows 10 erasures per person a day. Shows what is lost and",
+    "asks you to type erase, unless --yes. A device approved by link cannot erase; one signed in through the browser",
+    "approves one more sign-in at Jelly ID."
+  ].join(`
+`),
+  options: {
+    open: { type: "boolean", description: "Open the link in this machine's browser" },
+    yes: { type: "boolean", short: "y", description: "Do not ask for confirmation" }
+  },
+  args: { min: 0, max: 0 },
+  async run(ctx, _positionals, values) {
+    const client = await ctx.client();
+    const preview = await client.call("directory.erase.preview", {});
+    if (!ctx.json) {
+      ctx.out.line(`Erasing ${inline(preview.person, 64)} from Messaging. What is lost:`);
+      for (const line of preview.lost)
+        ctx.out.line(`  - ${inline(line, 300)}`);
+      ctx.out.line(`Devices removed: ${preview.devices.map((d) => `'${inline(d.label, 32)}'${d.self ? " (this one)" : ""}`).join(", ")}`);
+      ctx.out.line("What stays:");
+      for (const line of preview.kept)
+        ctx.out.line(`  - ${inline(line, 300)}`);
+      ctx.out.note(`The directory allows ${preview.perDay} erasures per person a day.`);
+    }
+    if (!await confirmed(ctx, values.yes === true, "This cannot be undone.", "erase")) {
+      ctx.out.note("Not erased.");
+      return 1;
+    }
+    const result = await client.call("directory.erase", {});
+    if (result.state === "done") {
+      if (ctx.json)
+        ctx.out.json(result);
+      else
+        ctx.out.line(`Erased: ${result.devices} device(s) removed; this account is gone from Messaging.`);
+      return;
+    }
+    await showSignIn(ctx, result, values.open === true);
+    const state = await waitSignIn(ctx, client, result);
+    if (state === undefined)
+      return 130;
+    if (state.state !== "done") {
+      ctx.out.note("The sign-in was cancelled (another sign-in started, or the daemon stopped).");
+      return 1;
+    }
+    if (ctx.json)
+      ctx.out.json({ state: "done", person: state.person, devices: preview.devices.length });
+    else
+      ctx.out.line(`Erased: ${preview.devices.length} device(s) removed; this account is gone from Messaging.`);
+  }
+};
+var LOGIN_COMMANDS = [login, replace, erase];
 
 // packages/daemon/dist/cli/commands/messages.js
 init_dist();
@@ -27026,13 +28632,13 @@ var HANDLES_INTERRUPT = new Set(["listen", "login"]);
 var GROUPS = {
   daemon: "Run the local daemon, messagingd",
   team: "Manage the team: create, invite, join, members, roles (only the CLI may do this)",
-  identity: "Show, move or rotate this machine's keys (only the CLI may do this)",
+  identity: "Show, move, rotate or replace this machine's keys (only the CLI may do this)",
   chat: "Your DMs and channels: list, read, post, search"
 };
 var SECTIONS = [
   ["Daemon", ["daemon start", "daemon stop", "status"]],
   ["Team", ["team prepare", "team create", "team card", "team invite", "team join", "team pair", "team add", "team claim", "team pair-cancel", "team members", "team remove", "team role", "team revoke-invite"]],
-  ["Identity", ["identity show", "identity migrate", "identity rotate-enc"]],
+  ["Identity", ["identity show", "identity migrate", "identity rotate-enc", "identity replace", "erase"]],
   ["People", ["login", "people", "devices", "grants", "grant", "requests", "contact", "card", "notices"]],
   ["Messages", ["who", "send", "inbox", "read", "message-status"]],
   ["Chats", ["chat list", "chat read", "chat post", "chat search"]],
@@ -27276,7 +28882,13 @@ Runs the Messaging daemon in the foreground for one MESSAGING_HOME (default ~/.m
   --version             print the version, the store schema and the protocol (--json: as JSON); needs no home
   --help                print this help
 
-Under a Jelly host (spec \xA78.11):
+Under a Jelly host (spec \xA78.11), with no arguments: the environment start contract. JELLY_ACTION_KEY (the path of
+the host's public action key) starts it; STATE_DIRECTORY is the home, RUNTIME_DIRECTORY the socket folder,
+JELLY_DEVICE_LABEL the label, JELLY_SOCKET_GROUP the group, and JELLY_ID_ISSUER, JELLY_RESOURCES (the messaging entry)
+and JELLY_SERVICE_ANCHOR the realm, which the first start writes to config.json. Flags win: a start with
+--deployment jelly reads none of these; any other start with JELLY_* variables set is refused.
+
+Or by flags:
   --deployment jelly    every human and admin call needs the host's action grant
   --act-key <path>      the host's public action key (an Ed25519 JWK); required
   --label <label>       this device's label, from the host; required
@@ -27336,7 +28948,20 @@ function versionText(json, info) {
   return `messagingd ${info.version} (store schema ${info.storeSchema}, protocol ${info.protocol})
 `;
 }
-async function daemonMain(argv) {
+function startSource(values, env, named) {
+  const flags = Object.keys(values).length > 0;
+  if (flags) {
+    if (values["--deployment"] === "jelly" || named.length === 0)
+      return "flags";
+    return `${named[0]} is set, so the environment starts a Jelly host, but the flags start a self-host daemon; use one or the other`;
+  }
+  if ((env.JELLY_ACTION_KEY ?? "") !== "")
+    return "environment";
+  if (named.length > 0)
+    return `${named[0]} is set without JELLY_ACTION_KEY: a Jelly start needs the host's action key`;
+  return "self";
+}
+async function daemonMain(argv, env = process.env) {
   const args = parseArgs2(argv);
   if (typeof args === "string") {
     process.stderr.write(`messagingd: ${args}
@@ -27354,7 +28979,23 @@ ${USAGE}`);
     return 0;
   }
   const { values } = args;
-  const home = values["--home"] ? resolve4(values["--home"]) : messagingHome();
+  const source = startSource(values, env, jellyEnvNamed(env));
+  if (source !== "flags" && source !== "environment" && source !== "self") {
+    process.stderr.write(`messagingd: ${source}
+`);
+    return 2;
+  }
+  let fromEnv;
+  if (source === "environment") {
+    try {
+      fromEnv = readJellyEnv(env);
+    } catch (error) {
+      process.stderr.write(`messagingd: ${error instanceof Error ? error.message : "the Jelly environment is invalid"}
+`);
+      return 1;
+    }
+  }
+  const home = fromEnv ? resolve4(fromEnv.home) : values["--home"] ? resolve4(values["--home"]) : messagingHome();
   const level = process.env.MESSAGING_LOG_LEVEL;
   const log = createLogger({
     file: homePaths(home).log,
@@ -27363,7 +29004,14 @@ ${USAGE}`);
   });
   let daemon;
   try {
-    const jellyHost = values["--deployment"] === "jelly" ? {
+    const jellyHost = fromEnv ? {
+      actKey: readActKey(fromEnv.actKeyPath),
+      label: fromEnv.label,
+      kind: "jelly-host",
+      realm: fromEnv.realm,
+      ...fromEnv.socketGroup !== undefined ? { socketGroup: fromEnv.socketGroup } : {},
+      ...fromEnv.run !== undefined ? { run: resolve4(fromEnv.run) } : {}
+    } : values["--deployment"] === "jelly" ? {
       actKey: readActKey(resolve4(values["--act-key"])),
       label: jellyLabel(values["--label"]),
       kind: "jelly-host",
@@ -27371,6 +29019,8 @@ ${USAGE}`);
       ...values["--run"] !== undefined ? { run: resolve4(values["--run"]) } : {}
     } : undefined;
     daemon = await startDaemon2({ home, log, ...jellyHost ? { jellyHost } : {} });
+    if (jellyHost)
+      log("info", "daemon.start", { deployment: "jelly", source });
   } catch (error) {
     process.stderr.write(`messagingd: ${error instanceof Error ? error.message : "failed to start"}
 `);