@joe-broadhead/messaging-bin-win32-x64 0.5.0 → 0.6.0

package/lib/messagingd.mjs

@@ -7276,14 +7276,14 @@ var init_direct = __esm(() => {
 });
 
 // packages/core/dist/schema/ipc/device.js
-var BindingState, RealmAlarmSummary, DeviceStatus, DeviceListEntry, LinkText, Sas, LinkPreview, KeyFingerprint, LoginUserCode, LoginPurpose, LoginKind, LoginShown, LoginState, DeviceRemoveParams, DeviceApproveParams, DEVICE_METHODS;
+var BindingState, RealmAlarmSummary, DeviceStatus, DeviceChangeView, DeviceListEntry, LinkText, Sas, LinkPreview, KeyFingerprint, LoginUserCode, LoginPurpose, LoginKind, LoginShown, LoginState, DeviceRemoveParams, DeviceApproveParams, IdentityReplaceParams, SignInStep, DirectoryEraseParams, DEVICE_METHODS;
 var init_device = __esm(() => {
   init_zod();
   init_common();
   init_directory();
   init_errors3();
   init_jelly();
-  BindingState = _enum(["none", "bound", "attest-due", "removed"]);
+  BindingState = _enum(["none", "bound", "attest-due", "removed", "replace"]);
   RealmAlarmSummary = object({
     kind: _enum(["directory", "restored"]),
     reason: string2().max(500),
@@ -7298,6 +7298,16 @@ var init_device = __esm(() => {
     sth: object({ size: number2().int().positive(), root: Hash, ts: Millis }).optional(),
     alarm: RealmAlarmSummary.optional()
   });
+  DeviceChangeView = object({
+    change: _enum(["added", "vouched", "removed", "replaced"]),
+    device: MachineId,
+    label: MachineLabel,
+    kind: DeviceKind.optional(),
+    vouch: _enum(["jelly", "device", "admin"]),
+    via: _enum(["host", "browser"]).optional(),
+    approver: MachineLabel.optional(),
+    at: Millis
+  });
   DeviceListEntry = object({
     device: MachineId,
     label: MachineLabel,
@@ -7314,7 +7324,7 @@ var init_device = __esm(() => {
   LinkPreview = object({ device: MachineId, label: MachineLabel, kind: DeviceKind, sas: Sas });
   KeyFingerprint = string2().regex(/^[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}$/, "key fingerprint");
   LoginUserCode = string2().regex(/^[A-HJ-NP-Z2-9]{5}-[A-HJ-NP-Z2-9]{5}$/, "user code");
-  LoginPurpose = _enum(["bind", "remove"]);
+  LoginPurpose = _enum(["bind", "remove", "replace", "erase"]);
   LoginKind = _enum(["laptop", "server", "other"]);
   LoginShown = object({
     verificationUriComplete: string2().url().max(2048),
@@ -7332,6 +7342,14 @@ var init_device = __esm(() => {
   ]);
   DeviceRemoveParams = strictObject({ device: MachineId, reason: _enum(["self", "removed", "lost"]).optional(), token: Jws.optional() });
   DeviceApproveParams = strictObject({ link: LinkText, sas: Sas });
+  IdentityReplaceParams = strictObject({
+    token: Jws.optional(),
+    label: MachineLabel.optional()
+  });
+  SignInStep = LoginShown.extend({ state: literal("sign-in"), purpose: LoginPurpose, interval: number2().int().positive() });
+  DirectoryEraseParams = strictObject({
+    token: Jws.optional()
+  });
   DEVICE_METHODS = {
     "device.status": { params: strictObject({}), result: DeviceStatus },
     "device.bind": {
@@ -7361,6 +7379,47 @@ var init_device = __esm(() => {
     "device.approve": {
       params: DeviceApproveParams,
       result: object({ device: MachineId, seq: number2().int().nonnegative() })
+    },
+    "identity.replace": {
+      params: IdentityReplaceParams,
+      result: discriminatedUnion("state", [
+        object({ state: literal("done"), person: PersonId, device: MachineId, predecessor: MachineId, seq: number2().int().nonnegative() }),
+        object({ state: literal("token"), device: MachineId }),
+        SignInStep.extend({ device: MachineId })
+      ])
+    },
+    "identity.replace.preview": {
+      params: IdentityReplaceParams,
+      result: object({
+        predecessor: object({
+          device: MachineId,
+          label: MachineLabel,
+          kind: DeviceKind.optional(),
+          vouch: _enum(["jelly", "device"]),
+          via: _enum(["host", "browser"]).optional(),
+          since: Millis.optional(),
+          current: boolean2()
+        }),
+        alarm: _enum(["keys_missing", "restored"]).nullable(),
+        device: MachineId.optional(),
+        signIns: number2().int().min(0).max(2),
+        sentence: string2().max(600)
+      })
+    },
+    "directory.erase": {
+      params: DirectoryEraseParams,
+      result: discriminatedUnion("state", [object({ state: literal("done"), person: PersonId, devices: number2().int().nonnegative() }), SignInStep])
+    },
+    "directory.erase.preview": {
+      params: DirectoryEraseParams,
+      result: object({
+        person: PersonId,
+        devices: array(object({ device: MachineId, label: MachineLabel, kind: DeviceKind.optional(), self: boolean2() })),
+        signIns: number2().int().min(0).max(1),
+        perDay: number2().int().positive(),
+        lost: array(string2().max(300)).max(10),
+        kept: array(string2().max(300)).max(10)
+      })
     }
   };
 });
@@ -7541,7 +7600,7 @@ var init_consent2 = __esm(() => {
   HeldRequest = union([AskRequest, ContactRequestView, ContactSuggestion]);
   RequestAnswer = _enum(["once", "always", "accept", "decline", "block"]);
   RequestText = string2().min(1).refine((text) => text.length <= LIMITS.requestChars, { message: `at most ${LIMITS.requestChars} UTF-16 code units` });
-  PersonReach = object({ person: PersonId, can: CardCan, source: _enum(["card", "default"]), at: Millis.optional() });
+  PersonReach = object({ person: PersonId, can: CardCan, source: _enum(["card", "default"]), at: Millis.optional(), devicesChangedAt: Millis.optional() });
   RequestAnswerParams = strictObject({ id: Ulid, answer: RequestAnswer, all: boolean2().optional() });
   ContactRequestParams = strictObject({ email: Email, text: RequestText, suggestion: Ulid.optional() });
   CONSENT_METHODS = {
@@ -7586,6 +7645,7 @@ var init_surfaces = __esm(() => {
   init_directory_frames();
   init_errors3();
   init_consent2();
+  init_device();
   init_shapes();
   ConversationRef = string2().regex(/^(?:dm:(?:[a-z][a-z0-9-]{0,31}|p_[a-z2-7]{26})|channel:[a-z][a-z0-9-]{0,31}|agent:(?:[a-z][a-z0-9-]{0,31}|p_[a-z2-7]{26})\/[a-z0-9][a-z0-9._-]{0,63})$/, "dm:<person>, channel:<name> or agent:<person>/<agent>");
   ConvPlace = union([ChatSeq, ConvCursor]);
@@ -7690,13 +7750,16 @@ var init_surfaces = __esm(() => {
     },
     "people.get": {
       params: strictObject({ person: PersonId }),
-      result: PersonSummary.extend({ devices: array(object({ device: MachineId, label: MachineLabel, self: boolean2(), away: literal(true).optional() })) })
+      result: PersonSummary.extend({
+        devices: array(object({ device: MachineId, label: MachineLabel, self: boolean2(), away: literal(true).optional() })),
+        deviceChanges: array(DeviceChangeView).max(10).optional()
+      })
     }
   };
 });
 
 // packages/core/dist/schema/ipc/jelly.js
-var NoticeId, NOTICE_LINE_CHARS = 120, Notice, NoticeCounts, DaemonHealth, AgentSummary, AgentConversation, JELLY_METHODS;
+var NoticeId, NOTICE_LINE_CHARS = 120, NoticeDevice, Notice, NoticeCounts, DaemonHealth, AgentSummary, AgentConversation, JELLY_METHODS;
 var init_jelly2 = __esm(() => {
   init_zod();
   init_common();
@@ -7707,12 +7770,18 @@ var init_jelly2 = __esm(() => {
   init_shapes();
   init_surfaces();
   NoticeId = string2().regex(/^[mra]_[0-9A-Za-z]{1,64}$/, "notice id");
+  NoticeDevice = DeviceChangeView.extend({
+    replaces: object({ device: MachineId, label: MachineLabel }).optional(),
+    current: boolean2(),
+    remove: _enum(["token", "sign-in", "team"]).optional()
+  });
   Notice = object({
     id: NoticeId,
     category: _enum(["message", "request", "alert"]),
     conversation: ConversationRef.optional(),
     from: object({ name: string2().max(200), email: string2().max(320).optional(), org: _enum(["same", "other", "none"]) }).optional(),
     line: string2().max(NOTICE_LINE_CHARS).optional(),
+    device: NoticeDevice.optional(),
     at: Millis
   });
   NoticeCounts = object({ unread: number2().int().nonnegative(), requests: number2().int().nonnegative() });
@@ -8061,6 +8130,8 @@ var init_ipc = __esm(() => {
     "notice.ack",
     "device.approve.preview",
     "device.remove.preview",
+    "identity.replace.preview",
+    "directory.erase.preview",
     "channel.create",
     "channel.invite",
     "channel.leave",
@@ -8081,6 +8152,8 @@ var init_ipc = __esm(() => {
     "device.login.cancel",
     "device.approve",
     "identity.rotateEnc",
+    "identity.replace",
+    "directory.erase",
     "team.create",
     "team.invite",
     "team.join",
@@ -8161,7 +8234,7 @@ var init_b64u = __esm(() => {
 });
 
 // packages/core/dist/version.js
-var VERSION = "0.5.0";
+var VERSION = "0.6.0";
 
 // packages/core/dist/jcs.js
 function hasLoneSurrogate(text) {
@@ -9970,6 +10043,13 @@ class DeviceLog {
   token(seq) {
     return this.#state.tokens.get(seq);
   }
+  spentSignIn(jti) {
+    for (const [seq, token] of this.#state.tokens) {
+      if (token.claims.src === JELLY_DEVICE_SOURCE && token.claims.jti === jti && this.#state.entries[seq].op !== "unbind")
+        return true;
+    }
+    return false;
+  }
   bindingDeadline(seq) {
     const token = this.#state.tokens.get(seq);
     return token === undefined ? undefined : token.claims.exp * 1000 + LIMITS.clockSkewMs;
@@ -10022,6 +10102,14 @@ class DeviceLog {
       const { claims } = token;
       if (personId(claims.iss, claims.sub) !== this.person)
         throw refuse("Jelly token names another person");
+      if (claims.src === JELLY_DEVICE_SOURCE) {
+        for (const [seq, used] of state.tokens) {
+          if (used.claims.src !== JELLY_DEVICE_SOURCE || used.claims.jti !== claims.jti)
+            continue;
+          if (parsed.op !== "unbind" || state.entries[seq].op !== "unbind")
+            throw refuse("a sign-in's token vouches for one act: this one was used");
+        }
+      }
       if (parsed.ts < claims.iat * 1000 - LIMITS.clockSkewMs || parsed.ts > claims.exp * 1000 + LIMITS.clockSkewMs)
         throw refuse("log entry is dated outside its Jelly token's life");
       tokens.set(parsed.seq, token);
@@ -10106,6 +10194,7 @@ var init_device_log = __esm(() => {
   init_keys();
   init_sign();
   init_common();
+  init_jelly();
   init_directory();
   init_errors3();
   init_jelly_token();
@@ -15952,14 +16041,16 @@ class RosterIdentity {
   #machine;
   #catchUp;
   #now;
-  #listeners = { "devices-changed": [], "self-changed": [], alarm: [] };
+  #listeners = { "devices-changed": [], "self-changed": [], "device-log": [], alarm: [] };
   #me;
+  #length;
   constructor(options) {
     this.roster = options.roster;
     this.#machine = options.machine;
     this.#catchUp = options.catchUp;
     this.#now = options.now;
     this.#me = this.#selfRecord();
+    this.#length = options.roster.entries().length;
   }
   get realm() {
     return this.roster.realm;
@@ -15990,6 +16081,31 @@ class RosterIdentity {
   successor(_device) {
     return;
   }
+  deviceChanges(person) {
+    const labels = new Map;
+    const out = [];
+    for (const entry of this.roster.entries()) {
+      const member = entry.kind === "member.add" ? entry.body : entry.kind === "invite.redeem" ? entry.body.member : entry.kind === "genesis" ? entry.body.founder : undefined;
+      if (member) {
+        labels.set(member.machine, member.label);
+        if (member.person === person && entry.kind !== "genesis")
+          out.push({ seq: entry.seq, change: "added", device: member.machine, label: member.label, vouch: "admin", by: entry.by, at: entry.ts });
+      } else if (entry.kind === "member.remove") {
+        const owner = this.#ownerAt(entry.body.machine);
+        if (owner === person)
+          out.push({ seq: entry.seq, change: "removed", device: entry.body.machine, label: labels.get(entry.body.machine) ?? "machine", vouch: "admin", by: entry.by, at: entry.ts });
+      }
+    }
+    return out;
+  }
+  #ownerAt(machine) {
+    for (const entry of this.roster.entries()) {
+      const member = entry.kind === "member.add" ? entry.body : entry.kind === "invite.redeem" ? entry.body.member : entry.kind === "genesis" ? entry.body.founder : undefined;
+      if (member?.machine === machine)
+        return member.person;
+    }
+    return;
+  }
   async devices(person, opts = {}) {
     if (opts.atLeast !== undefined && this.relate(opts.atLeast).relation === "ahead") {
       throw new MessagingError("roster_conflict", "the roster has not reached that anchor");
@@ -16033,6 +16149,20 @@ class RosterIdentity {
     }
     for (const listener of [...this.#listeners["devices-changed"]])
       listener();
+    const entries = this.roster.entries();
+    if (entries.length !== this.#length) {
+      const persons = new Set;
+      for (const entry of entries.slice(this.#length)) {
+        const member = entry.kind === "member.add" ? entry.body : entry.kind === "invite.redeem" ? entry.body.member : undefined;
+        const person = member?.person ?? (entry.kind === "member.remove" ? this.#ownerAt(entry.body.machine) : undefined);
+        if (person !== undefined)
+          persons.add(person);
+      }
+      this.#length = entries.length;
+      if (persons.size > 0)
+        for (const listener of [...this.#listeners["device-log"]])
+          listener([...persons].sort());
+    }
   }
   #selfRecord() {
     const me = this.roster.member(this.#machine);
@@ -16248,16 +16378,18 @@ class DirectoryIdentity {
   #options;
   #cache;
   #keyring;
-  #listeners = { "devices-changed": [], "self-changed": [], alarm: [] };
+  #listeners = { "devices-changed": [], "self-changed": [], "device-log": [], alarm: [] };
   #head;
   #persons = new Map;
   #index = new Map;
   #own;
   #relations = new Map;
   #watching = new Set;
+  #watchRead = Promise.resolve();
   #alarm;
   #selfRecord;
   #monitoredAt = Number.NEGATIVE_INFINITY;
+  #bindAccepted = false;
   #pendingLink;
   constructor(options) {
     this.#options = options;
@@ -16317,7 +16449,10 @@ class DirectoryIdentity {
     const person = this.#own.person;
     if (!person)
       return false;
-    const record = this.#persons.get(person)?.state.log.device(this.#machine());
+    const held = this.#persons.get(person)?.state;
+    if (held?.erased)
+      return true;
+    const record = held?.log.device(this.#machine());
     return record !== undefined && !record.current;
   }
   persons() {
@@ -16338,6 +16473,12 @@ class DirectoryIdentity {
     }
     return;
   }
+  deviceChanges(person) {
+    const held = isHosted(person) ? this.#persons.get(person) : undefined;
+    if (!held || held.state.erased)
+      return [];
+    return deviceChangesOf(held.state.log);
+  }
   async devices(person, opts = {}) {
     if (!isHosted(person))
       return { person, devices: [], anchor: this.anchor(), fetchedAt: this.#options.now() };
@@ -16432,15 +16573,23 @@ class DirectoryIdentity {
     }
   }
   watch(persons) {
-    let grew = false;
+    const added = [];
     for (const person of persons) {
       if (!isHosted(person) || this.#watching.has(person) || this.#watching.size >= LIMITS.watchPersons)
         continue;
       this.#watching.add(person);
-      grew = true;
+      added.push(person);
     }
-    if (grew)
-      this.#call((link) => link.watch([...this.#watching])).catch(() => {});
+    if (added.length === 0)
+      return this.#watchRead;
+    this.#watchRead = this.#call((link) => link.watch([...this.#watching])).then(async () => {
+      const held = added.filter((person) => this.#persons.has(person));
+      if (held.length === 0)
+        return;
+      await this.#latest();
+      await this.#fetch(held);
+    }).catch(() => {});
+    return this.#watchRead;
   }
   on(event, listener) {
     const listeners = this.#listeners[event];
@@ -16451,6 +16600,10 @@ class DirectoryIdentity {
         listeners.splice(at, 1);
     };
   }
+  linkPerson() {
+    const binding = this.binding();
+    return binding.state !== "none" || this.#bindAccepted ? binding.person : undefined;
+  }
   alarm() {
     return this.#alarm;
   }
@@ -16460,6 +16613,8 @@ class DirectoryIdentity {
   binding() {
     const person = this.#own.person;
     const record = person ? this.#persons.get(person)?.state.log.device(this.#machine()) : undefined;
+    if (person && this.#persons.get(person)?.state.erased)
+      return { state: "removed", person };
     if (!person || !record)
       return { state: "none", ...person ? { person } : {} };
     if (!record.current)
@@ -16500,13 +16655,29 @@ class DirectoryIdentity {
         authority: { kind: "jelly", token }
       });
       this.#signed(entry, person);
-      return current ? await this.#call((link) => link.append(entry)) : await this.#call((link) => link.bind(entry));
+      if (current)
+        return await this.#call((link) => link.append(entry));
+      const bound = await this.#call((link) => link.bind(entry));
+      this.#bindAccepted = true;
+      return bound;
     });
     await this.#adoptAnnounced(done.sth);
     await this.#fetch([person]);
     await this.publishKeys();
     return { person, seq: done.seq };
   }
+  async awaitSelf() {
+    const person = this.#own.person;
+    if (!person)
+      throw new MessagingError("no_identity", "this device is not bound to an account");
+    for (let tries = 0;this.self() === undefined || !this.#index.has(this.#machine()); tries++) {
+      if (tries >= LOG_RETRIES)
+        throw unavailable("the directory has not committed this device's binding and keys yet");
+      await new Promise((resolve) => setTimeout(resolve, LOG_RETRY_MS));
+      await this.#latest();
+      await this.#fetch([person]);
+    }
+  }
   async publishKeys() {
     if (this.#alarm?.kind === "restored")
       throw new MessagingError("invalid_state", "this device runs from an older copy of its home; it publishes no keys");
@@ -16557,6 +16728,45 @@ class DirectoryIdentity {
     await this.#fetch([person]);
     return { seq: done.seq };
   }
+  async erase(token) {
+    const identity = this.#options.identity();
+    const person = this.#own.person;
+    if (!person || this.binding().state === "none" || this.removed())
+      throw new MessagingError("no_identity", "this device is not bound to an account");
+    if (this.binding().record?.vouch !== "jelly")
+      throw new MessagingError("forbidden", "a device approved by link erases nothing; erase from a device Jelly ID vouched for");
+    const entries = await this.#extendLog(async () => {
+      await this.#latest();
+      await this.#fetch([person]);
+      const log = this.#persons.get(person).state.log;
+      let head = log.head();
+      const out = [];
+      const devices = log.devices().sort((a, b) => Number(a.device === identity.machine) - Number(b.device === identity.machine));
+      for (const device of devices) {
+        const self = device.device === identity.machine;
+        const entry = signLogEntry(identity, {
+          v: PROTOCOL,
+          realm: this.realm,
+          person,
+          seq: head.seq + 1,
+          prev: head.hash,
+          ts: this.#options.now(),
+          op: "unbind",
+          device: device.device,
+          reason: self ? "self" : "removed",
+          authority: self ? { kind: "self" } : { kind: "jelly", token }
+        });
+        out.push(entry);
+        head = { seq: entry.seq, hash: logEntryHash(entry) };
+      }
+      for (const entry of out)
+        this.#signed(entry, person);
+      await this.#call((link) => link.erase(out, token));
+      return out;
+    });
+    await this.#latest().then(() => this.#fetch([person])).catch(() => {});
+    return { person, devices: entries.length, seq: entries.at(-1).seq };
+  }
   createLink(args) {
     if (this.#own.person !== undefined) {
       throw new MessagingError("invalid_state", this.removed() ? "this device was removed from its account; it cannot be bound again" : "this device is already bound");
@@ -16775,15 +16985,25 @@ class DirectoryIdentity {
       throw new MessagingError("directory_inconsistent", "the directory answered at another tree head");
     const now = this.#options.now();
     const views = new Map(answer.persons.map((view) => [view.person, view]));
+    const grew = [];
     for (const person of persons) {
       const view = views.get(person);
       if (!view)
         continue;
+      const before = this.#persons.get(person)?.state;
       const state = await this.#verify(view, head);
       this.#persons.set(person, { state, size: head.sth.size, fetchedAt: now });
       this.#cache.putPerson({ person, entries: [...state.log.entries()], keys: [...state.keys.values()], erased: state.erased, size: head.sth.size, fetchedAt: now });
+      if (state.log.length !== (before?.log.length ?? 0) || state.erased !== (before?.erased ?? false))
+        grew.push(person);
     }
     this.#changed();
+    if (grew.length > 0)
+      for (const listener of [...this.#listeners["device-log"]])
+        listener(grew);
+    const unwatched = persons.filter((person) => views.has(person) && !this.#watching.has(person));
+    if (unwatched.length > 0)
+      this.watch(unwatched);
   }
   async#verify(view, head) {
     const known = this.#persons.get(view.person)?.state;
@@ -16905,6 +17125,56 @@ ${this.#index.get(me.machine)?.enc ?? ""}`;
     return mine === theirs ? "same" : "other";
   }
 }
+function deviceChangesOf(log) {
+  const vouch = new Map;
+  const record = new Map;
+  const out = [];
+  for (const entry of log.entries()) {
+    const token = log.token(entry.seq);
+    const via = token === undefined ? undefined : token.claims.hst !== undefined ? "host" : "browser";
+    if (entry.op === "bind") {
+      const v = entry.authority.kind === "jelly" ? "jelly" : "device";
+      vouch.set(entry.device, v);
+      record.set(entry.device, { label: entry.label, kind: entry.kind, host: via === "host" });
+      out.push({
+        seq: entry.seq,
+        change: "added",
+        device: entry.device,
+        label: entry.label,
+        kind: entry.kind,
+        vouch: v,
+        ...via ? { via } : {},
+        ...entry.authority.kind === "device" ? { approver: entry.authority.approver } : {},
+        by: entry.by,
+        at: entry.ts
+      });
+    } else if (entry.op === "attest") {
+      const known = record.get(entry.device);
+      const next = { label: entry.label ?? known?.label ?? "device", kind: entry.kind ?? known?.kind ?? "other", host: via === "host" };
+      record.set(entry.device, next);
+      const raised = vouch.get(entry.device) !== "jelly";
+      vouch.set(entry.device, "jelly");
+      if (raised)
+        out.push({ seq: entry.seq, change: "vouched", device: entry.device, label: next.label, kind: next.kind, vouch: "jelly", ...via ? { via } : {}, by: entry.by, at: entry.ts });
+    } else {
+      const known = record.get(entry.device);
+      const v = vouch.get(entry.device) ?? "device";
+      out.push({
+        seq: entry.seq,
+        change: entry.reason === "replaced" ? "replaced" : "removed",
+        device: entry.device,
+        label: known?.label ?? "device",
+        ...known ? { kind: known.kind } : {},
+        vouch: v,
+        ...v === "jelly" && known ? { via: known.host ? "host" : "browser" } : {},
+        by: entry.by,
+        reason: entry.reason,
+        at: entry.ts
+      });
+    }
+  }
+  return out;
+}
 function orgOf(email, domains) {
   if (email === undefined)
     return;
@@ -16989,7 +17259,7 @@ class DirectoryHome {
       url: this.#options.config.url,
       realm: realm.realm,
       identity: this.#options.identity,
-      person: () => realm.binding().person,
+      person: () => realm.linkPerson(),
       pushes: {
         changed: (persons, sth) => void realm.changed(persons, sth).catch((error) => this.#failed("directory.changed", error)),
         unbound: (entry, sth) => void realm.changed([entry.person], sth).catch((error) => this.#failed("directory.unbound", error)),
@@ -17141,7 +17411,27 @@ class DirectoryHome {
     this.#login.cancel();
     return { ok: true };
   }
+  async signIn(purpose, args) {
+    this.#removing = undefined;
+    this.#binding = undefined;
+    const started = await this.#login.start({ purpose, label: args.label, kind: args.kind });
+    return {
+      purpose,
+      verificationUriComplete: started.verificationUriComplete,
+      verificationUri: started.verificationUri,
+      userCode: started.userCode,
+      fingerprint: started.fingerprint,
+      expires: started.expires,
+      interval: started.interval
+    };
+  }
   async#completeLogin(token, purpose) {
+    if (purpose === "replace" || purpose === "erase") {
+      const step = purpose === "replace" ? this.#options.replaceStep : this.#options.eraseStep;
+      if (!step)
+        throw new MessagingError("invalid_state", `this daemon does not ${purpose} through a sign-in`);
+      return step(token);
+    }
     if (purpose === "remove") {
       const removing = this.#removing;
       if (!removing)
@@ -17207,6 +17497,28 @@ var init_directory_home = __esm(() => {
   init_directory_identity();
 });
 
+// packages/daemon/dist/realm/directory-cache.js
+function memoryDirectoryCache(from) {
+  let head = from?.head();
+  const persons = new Map((from?.persons() ?? []).map((p) => [p.person, p]));
+  let archive = from?.archive() ?? [];
+  let own = from?.own() ?? { keysSeq: -1, signed: [] };
+  let alarm = from?.alarm();
+  const copy = (value) => structuredClone(value);
+  return {
+    head: () => copy(head),
+    setHead: (value) => void (head = copy(value)),
+    persons: () => [...persons.values()].map(copy),
+    putPerson: (value) => void persons.set(value.person, copy(value)),
+    archive: () => copy(archive),
+    setArchive: (keys) => void (archive = copy(keys)),
+    own: () => copy(own),
+    setOwn: (value) => void (own = copy(value)),
+    alarm: () => copy(alarm),
+    setAlarm: (value) => void (alarm = copy(value))
+  };
+}
+
 // packages/daemon/dist/jelly.js
 import { closeSync as closeSync6, constants as constants6, fstatSync as fstatSync3, readSync } from "fs";
 function jellyLabel(text) {
@@ -17646,6 +17958,12 @@ class Notices {
   alert(kind, at) {
     this.#file({ id: `a_${kind.replace(/_/g, "")}${at}`, category: "alert", source: kind, at });
   }
+  device(seq, at) {
+    this.#file({ id: `a_dev${seq}`, category: "alert", source: `device:${seq}`, at });
+  }
+  trust(grantId, person, until, at) {
+    this.#file({ id: `a_trust${grantId}`, category: "alert", person, source: `trust:${until}`, at });
+  }
   #file(row) {
     if (!this.#host.store.putNotice(row))
       return;
@@ -17711,7 +18029,15 @@ class Notices {
       const own = row.person === this.#host.me();
       notice.from = profile ? { name: profile.name.slice(0, 200), ...profile.email !== undefined ? { email: profile.email.slice(0, 320) } : {}, org: profile.org } : { name: row.person, org: own ? "same" : "none" };
     }
-    if (row.category === "alert")
+    if (row.category === "alert" && row.source.startsWith("device:")) {
+      const device = this.#host.device?.(Number(row.source.slice("device:".length)));
+      if (device)
+        notice.device = device;
+      notice.line = device ? deviceLine(device) : "A device of your account changed.";
+    } else if (row.category === "alert" && row.source.startsWith("trust:")) {
+      const until = Number(row.source.slice("trust:".length));
+      notice.line = `Trust you gave this person ends on ${Number.isSafeInteger(until) ? new Date(until).toISOString().slice(0, 10) : "a date soon"}; renew it or let it lapse.`;
+    } else if (row.category === "alert")
       notice.line = ALERT_TEXT[row.source] ?? "An alarm was raised on this device.";
     else if (row.category === "message" && lines) {
       const line = this.#host.store.line(row.source);
@@ -17721,6 +18047,18 @@ class Notices {
     return notice;
   }
 }
+function vouchWords2(d) {
+  if (d.vouch === "admin")
+    return "admitted by the team's admin";
+  if (d.vouch === "device")
+    return d.approver !== undefined ? `approved on '${d.approver}'` : "approved by link";
+  return d.via === "browser" ? "signed in through the browser" : "vouched by Jelly ID on a Jelly host";
+}
+function deviceLine(d) {
+  const what = `'${d.label}'${d.kind !== undefined ? ` (${d.kind})` : ""}`;
+  const line = d.change === "added" ? `New device on your account: ${what}, ${vouchWords2(d)}.` : d.change === "vouched" ? `${what} on your account is now vouched by Jelly ID: ${vouchWords2(d)}.` : d.change === "replaced" ? `'${d.replaces?.label ?? "a device"}' was replaced by ${what}, ${vouchWords2(d)}.` : `${what} was removed from your account.`;
+  return line.length <= NOTICE_LINE_CHARS ? line : `${line.slice(0, NOTICE_LINE_CHARS - 1)}\u2026`;
+}
 function firstLine(text) {
   const first = cleanPeerText(text.split(/\r\n|\n|\r/, 1)[0] ?? "", { singleLine: true });
   if (first.length <= NOTICE_LINE_CHARS)
@@ -19945,6 +20283,16 @@ class Grants {
   hasGrant(person) {
     return this.#current(grantSubjectKey({ person })) !== undefined;
   }
+  expiringTrust(withinMs) {
+    const now = this.#host.now();
+    const current = this.#currentDevice();
+    return this.#all().flatMap(({ grant }) => {
+      const until = grant.trustedUntil;
+      if (!("person" in grant.subject) || until === undefined || until <= now || until > now + withinMs || !current(grant.by))
+        return [];
+      return [{ id: grant.id, person: grant.subject.person, until }];
+    });
+  }
   list(p) {
     const only = p.subject === undefined ? undefined : this.#subjectKey(p.subject, false);
     const grants = this.#all().filter(({ subject }) => only === undefined || subject === only).map(({ grant }) => this.#view(grant)).sort((a, b) => b.ts - a.ts || (a.id < b.id ? 1 : -1));
@@ -20019,6 +20367,25 @@ class Grants {
     this.#host.log("grant.sync", { id: env.id, what: conv.what, merged });
     this.sweep();
   }
+  resignFrom(predecessor) {
+    const { identity } = this.#host.joined();
+    const now = this.#host.now();
+    const resigned = [];
+    for (const { subject, grant } of this.#all()) {
+      if (grant.by !== predecessor)
+        continue;
+      const copy = resignGrant(identity, grant, { now, keep: "all" });
+      this.#store.putGrant(subject, copy);
+      resigned.push(copy);
+      if ("person" in copy.subject)
+        this.#host.changed?.(copy.subject.person);
+    }
+    if (resigned.length > 0) {
+      this.#sync("grant", resigned);
+      this.#host.log("grant.resigned", { grants: resigned.length });
+    }
+    return resigned.length;
+  }
   sweep() {
     const { identity, realm } = this.#host.joined();
     if (realm.removed())
@@ -20814,6 +21181,7 @@ class Daemon {
         const realm = this.#realm ?? this.#directory?.realm;
         return realm ? await realm.profile(person) : undefined;
       },
+      device: (seq) => this.#noticeDevice(seq),
       emit: (event) => this.#emit(event)
     });
     this.#keyring = new Keyring({
@@ -20919,6 +21287,7 @@ class Daemon {
     }
     this.#log("info", "daemon.started", { pid: process.pid, version: VERSION, joined: identity !== undefined, store: identityStore?.kind, ...jelly ? { deployment: "jelly" } : {} });
     this.#state = "running";
+    this.#deviceNotices(true);
     this.#startTransport();
     this.#sweepTimer = setInterval(() => this.sweep(), this.#tuning.sweepMs);
     this.#sweepTimer.unref();
@@ -20958,7 +21327,12 @@ class Daemon {
           this.#alerts();
       },
       onDeliver: (raw) => this.#onDeliver(raw),
-      state: (connected) => this.#onHostedState(connected)
+      state: (connected) => this.#onHostedState(connected),
+      replaceStep: (token) => this.#replaceWith(token),
+      eraseStep: async (token) => {
+        const done = await this.#eraseWith(token);
+        return { person: done.person, device: this.#identity.machine, seq: done.seq };
+      }
     });
     this.#directory = home;
     const realm = home.realm;
@@ -20976,6 +21350,7 @@ class Daemon {
       else
         this.#presenceSoon();
     });
+    realm.on("device-log", (persons) => this.#deviceLogGrew(persons));
     this.#removed = realm.removed();
     this.#transport = home.transport();
     home.start();
@@ -21076,7 +21451,11 @@ class Daemon {
     return {
       "daemon.status": () => this.status(),
       "device.status": () => this.#deviceStatus(),
-      "device.bind": (p) => this.#homeDirectory("device.bind").bind(this.#jellyHost ? { ...p, label: this.#jellyHost.label, kind: this.#jellyHost.kind } : p),
+      "device.bind": async (p) => {
+        if (this.#store.getKv(PREDECESSOR_KEY) !== undefined && this.#directory)
+          return this.#replaceWith(p.token, p.label);
+        return this.#homeDirectory("device.bind").bind(this.#jellyHost ? { ...p, label: this.#jellyHost.label, kind: this.#jellyHost.kind } : p);
+      },
       "device.list": () => this.#directory?.list() ?? this.#rosterDevices(),
       "device.remove": (p) => this.#homeDirectory("device.remove").remove(p),
       "device.link": (p) => this.#homeDirectory("device.link").link(p),
@@ -21089,6 +21468,10 @@ class Daemon {
       "device.login.cancel": () => this.#homeDirectory("device.login.cancel").loginCancel(),
       "device.approve.preview": (p) => this.#homeDirectory("device.approve.preview").approvePreview(p),
       "device.approve": (p) => this.#homeDirectory("device.approve").approve(p),
+      "identity.replace": (p) => this.#replace(p),
+      "identity.replace.preview": (p) => this.#replacePreview(p),
+      "directory.erase": (p) => this.#erase(p),
+      "directory.erase.preview": (p) => this.#erasePreview(p),
       "daemon.stop": () => this.#stop(),
       "session.register": (p, ctx) => this.#register(p, ctx),
       "session.update": (p, ctx) => this.#updateSession(this.#bound(p, ctx)),
@@ -21189,10 +21572,30 @@ class Daemon {
     const out = [];
     for (const person of all) {
       const org = realm.kind === "roster" ? "same" : await realm.profile(person).then((profile) => profile.org, () => "none");
-      out.push(this.#cards.reach(person, org === "same"));
+      const reach = this.#cards.reach(person, org === "same");
+      const changedAt = this.#recentDeviceChanges(realm, person).at(0)?.at;
+      out.push(changedAt === undefined ? reach : { ...reach, devicesChangedAt: changedAt });
     }
     return out;
   }
+  #recentDeviceChanges(realm, person) {
+    const since = this.#now() - DEVICES_CHANGED_MS;
+    const changes = realm.deviceChanges(person);
+    const labelOf = (device) => changes.filter((c) => c.device === device).at(-1)?.label;
+    return changes.filter((change) => change.change !== "vouched" && change.at > since).reverse().slice(0, 10).map((change) => {
+      const approver = change.approver !== undefined ? labelOf(change.approver) : undefined;
+      return {
+        change: change.change,
+        device: change.device,
+        label: MachineLabel.safeParse(change.label).success ? change.label : "device",
+        ...change.kind !== undefined ? { kind: change.kind } : {},
+        vouch: change.vouch === "service" ? "device" : change.vouch,
+        ...change.via !== undefined ? { via: change.via } : {},
+        ...approver !== undefined && MachineLabel.safeParse(approver).success ? { approver } : {},
+        at: change.at
+      };
+    });
+  }
   async#grantSubject(p) {
     const { realm } = this.#joined();
     if ("person" in p.subject)
@@ -21293,6 +21696,7 @@ class Daemon {
       now: this.#now
     });
     realm.on("devices-changed", () => this.#realmChanged());
+    realm.on("device-log", (persons) => this.#deviceLogGrew(persons));
     return realm;
   }
   #admin() {
@@ -21790,7 +22194,9 @@ class Daemon {
       self: device.machine === identity.machine,
       ...away(device.machine) ? { away: true } : {}
     }));
-    return { person: p.person, ...profile, devices };
+    const own = p.person === this.#ownPerson();
+    const deviceChanges = own ? [] : this.#recentDeviceChanges(realm, p.person);
+    return { person: p.person, ...profile, devices, ...deviceChanges.length > 0 ? { deviceChanges } : {} };
   }
   #seal(type, toMachine, session, payload, extra = {}) {
     const { identity, realm, me } = this.#joined();
@@ -22927,8 +23333,14 @@ ${row.receipt ? "receipt" : "envelope"}`;
     await transport?.stop().catch(() => {});
   }
   #deviceStatus() {
-    if (this.#directory)
-      return this.#directory.status();
+    if (this.#directory) {
+      const status = this.#directory.status();
+      return this.#store.getKv(PREDECESSOR_KEY) !== undefined && status.binding !== "removed" ? { ...status, binding: "replace" } : status;
+    }
+    if (this.#config.realm) {
+      const person = this.#store.directoryCache().own().person;
+      return { realm: "directory", binding: "none", ...person ? { person } : {} };
+    }
     const identity = this.#identity;
     const me = identity ? this.#realm?.device(identity.machine) : undefined;
     const binding = this.#removed ? "removed" : me ? "bound" : "none";
@@ -23065,6 +23477,232 @@ ${row.receipt ? "receipt" : "envelope"}`;
     const { rows, more } = this.#store.conversation(session.key, p.conversation.slice("agent:".length), { before: p.before }, p.limit ?? 30);
     return { kind: "entries", conversation: p.conversation, entries: rows.map(convEntry), more };
   }
+  #heldRealm(config) {
+    if (this.#directory)
+      return this.#directory.realm;
+    const throwaway = generateIdentity();
+    return new DirectoryIdentity({ config, identity: () => throwaway, link: () => {
+      return;
+    }, cache: memoryDirectoryCache(this.#store.directoryCache()), jelly: this.#jelly ?? jellyFromIssuer(config.issuer), now: this.#now });
+  }
+  #predecessor() {
+    return this.#store.getKv(PREDECESSOR_KEY) ?? this.#store.getKv(MACHINE_KEY) ?? this.#identity?.machine;
+  }
+  async#replacePreview(p) {
+    const config = this.#config.realm;
+    if (!config)
+      throw new MessagingError("invalid_state", "identity.replace is for a directory realm; a roster realm replaces a machine with team.remove and a new invite");
+    const person = this.#store.directoryCache().own().person;
+    if (!person)
+      throw new MessagingError("no_identity", "this home was never bound to an account: bind it instead (device.bind or messaging login)");
+    const realm = this.#heldRealm(config);
+    const pred = this.#predecessor();
+    const record = realm.ownDevices().find((d) => d.device === pred);
+    if (!record)
+      throw new MessagingError("not_found", "this home's device is not in its account's log");
+    const pending = this.#store.getKv(PREDECESSOR_KEY) !== undefined && this.#identity !== undefined && this.#identity.machine !== pred;
+    const bound = pending && realm.binding().state !== "none";
+    const signIns = !pending ? 2 : !bound ? 2 : record.current ? 1 : 0;
+    const alarm = this.#keysMissing ? "keys_missing" : realm.alarm()?.kind === "restored" ? "restored" : null;
+    const label = record.label;
+    const why = alarm === "keys_missing" ? " (its key files are missing)" : alarm === "restored" ? " (it runs from an older copy of its home)" : "";
+    const sentence = `This device gets a new key and replaces '${label}'${why} on your account. Your conversations, grants and history stay here, and tasks continue; ` + `mail still queued at the relay for '${label}' is lost.` + (signIns === 2 ? " Through the browser you approve two sign-ins at Jelly ID: one binds the new key, one removes the old." : signIns === 1 ? ` You approve one sign-in at Jelly ID, to remove '${label}'.` : "");
+    return {
+      predecessor: {
+        device: pred,
+        label,
+        kind: record.kind,
+        vouch: record.vouch,
+        ...record.vouch === "jelly" ? { via: record.host !== undefined ? "host" : "browser" } : {},
+        since: record.since,
+        current: record.current
+      },
+      alarm,
+      ...pending ? { device: this.#identity.machine } : {},
+      signIns,
+      sentence: sentence.slice(0, 600)
+    };
+  }
+  async#replace(p) {
+    const config = this.#config.realm;
+    if (!config)
+      throw new MessagingError("invalid_state", "identity.replace is for a directory realm; a roster realm replaces a machine with team.remove and a new invite");
+    if (this.#removed || this.#directory?.realm.removed())
+      throw new MessagingError("invalid_state", "this device was removed from its account; it cannot replace anything");
+    const person = this.#store.directoryCache().own().person;
+    if (!person)
+      throw new MessagingError("no_identity", "this home was never bound to an account: bind it instead (device.bind or messaging login)");
+    const pred = this.#predecessor();
+    if (!pred)
+      throw new MessagingError("no_identity", "this home names no device to replace");
+    const record = this.#heldRealm(config).ownDevices().find((d) => d.device === pred);
+    if (!record)
+      throw new MessagingError("not_found", "this home's device is not in its account's log");
+    if (this.#store.getKv(PREDECESSOR_KEY) === undefined || this.#identity === undefined || this.#identity.machine === pred) {
+      if (!record.current)
+        throw new MessagingError("invalid_state", "this home's device was removed from its account; it cannot be replaced");
+      await this.#newKeys(pred, config);
+    }
+    return this.#replaceNext(p);
+  }
+  async#replaceNext(p) {
+    const home = this.#directory;
+    const me = this.#identity.machine;
+    if (p.token !== undefined) {
+      const done = await this.#replaceWith(p.token, p.label);
+      if (this.#store.getKv(PREDECESSOR_KEY) === undefined)
+        return { state: "done", person: done.person, device: me, predecessor: done.predecessor, seq: done.seq };
+    } else if (this.#replaceFinished()) {
+      return this.#replaceDone();
+    }
+    if (this.#store.getKv(PREDECESSOR_KEY) === undefined)
+      return this.#replaceDone();
+    if (this.#jellyHost || p.token !== undefined)
+      return { state: "token", device: me };
+    const pred = this.#store.getKv(PREDECESSOR_KEY);
+    const record = home.realm.ownDevices().find((d) => d.device === pred);
+    const label = p.label ?? this.#store.getKv(REPLACE_LABEL_KEY) ?? record?.label ?? "device";
+    const kind = record && record.kind !== "jelly-host" ? record.kind : "laptop";
+    const started = await home.signIn("replace", { label, kind });
+    return { state: "sign-in", device: me, ...started };
+  }
+  #replaceFinished() {
+    const pred = this.#store.getKv(PREDECESSOR_KEY);
+    if (pred === undefined)
+      return true;
+    const realm = this.#directory?.realm;
+    if (!realm || realm.binding().state === "none")
+      return false;
+    return realm.ownDevices().find((d) => d.device === pred)?.current !== true;
+  }
+  #replaceDone() {
+    const realm = this.#directory.realm;
+    const pred = this.#store.getKv(PREDECESSOR_KEY) ?? this.#store.getKv(REPLACED_KEY);
+    this.#store.deleteKv(PREDECESSOR_KEY);
+    const me = this.#identity.machine;
+    const binding = realm.binding();
+    const record = pred !== undefined ? realm.ownDevices().find((d) => d.device === pred) : undefined;
+    return { state: "done", person: binding.person, device: me, predecessor: pred ?? me, seq: record?.unbound ? realm.deviceChanges(binding.person).find((c) => c.device === pred && c.change === "replaced")?.seq ?? 0 : 0 };
+  }
+  async#replaceWith(token, label) {
+    const home = this.#directory;
+    const pred = this.#store.getKv(PREDECESSOR_KEY);
+    if (!home || pred === undefined)
+      throw new MessagingError("invalid_state", "no replacement is pending: start one with identity.replace");
+    const realm = home.realm;
+    const me = this.#identity.machine;
+    const record = realm.ownDevices().find((d) => d.device === pred);
+    let seq = 0;
+    let spent = false;
+    if (realm.binding().state === "none") {
+      const kind = this.#jellyHost?.kind ?? (record && record.kind !== "jelly-host" ? record.kind : "laptop");
+      const done = await home.bind({ token, label: this.#jellyHost?.label ?? label ?? this.#store.getKv(REPLACE_LABEL_KEY) ?? record?.label ?? "device", kind });
+      seq = done.seq;
+      spent = signInToken(token);
+      this.#log("info", "identity.replace.bound", { seq });
+    }
+    await realm.awaitSelf();
+    this.#tx(() => this.#grants.resignFrom(pred));
+    let unbound = false;
+    if (!spent && realm.ownDevices().find((d) => d.device === pred)?.current) {
+      const done = await realm.unbind(pred, { reason: "replaced", token });
+      seq = done.seq;
+      unbound = true;
+      this.#log("info", "identity.replace.done", { seq });
+    }
+    if (unbound || this.#replaceFinished()) {
+      this.#store.setKv(REPLACED_KEY, pred);
+      this.#store.deleteKv(PREDECESSOR_KEY);
+      this.#store.deleteKv(REPLACE_LABEL_KEY);
+      this.#emit({ type: "contacts" });
+    }
+    return { person: realm.binding().person, device: me, predecessor: pred, seq };
+  }
+  async#newKeys(pred, config) {
+    const label = this.#heldRealm(config).ownDevices().find((d) => d.device === pred)?.label;
+    this.#store.setKv(PREDECESSOR_KEY, pred);
+    if (label !== undefined)
+      this.#store.setKv(REPLACE_LABEL_KEY, label);
+    const keys = { identity: generateIdentity(), retained: [] };
+    let identityStore = this.#keyring.store;
+    if (identityStore)
+      identityStore.save(keys);
+    else
+      identityStore = saveNewIdentity(this.paths.identity, keys, identitySettings(this.#config), this.#storeDeps());
+    this.#store.setKv(MACHINE_KEY, keys.identity.machine);
+    this.#log("info", "identity.replace.keys", { store: identityStore.kind });
+    const old = this.#directory;
+    this.#directory = undefined;
+    this.#realm = undefined;
+    this.#transport = undefined;
+    if (old) {
+      await old.stop();
+      this.#onHostedState(false);
+    }
+    const cache = this.#store.directoryCache();
+    if (cache.alarm()?.kind === "restored")
+      cache.setAlarm(undefined);
+    for (const row of this.#store.outbox())
+      if (row.env.from.device === pred)
+        this.#store.deleteOutbox(row.id);
+    this.#keysMissing = false;
+    this.#keyring.adopt(keys, identityStore);
+    this.#openDirectory(config, keys, identityStore);
+  }
+  #erasePreview(_p) {
+    const home = this.#homeDirectory("directory.erase.preview");
+    const binding = home.realm.binding();
+    if (!binding.person || binding.state === "none" || binding.state === "removed")
+      throw new MessagingError("no_identity", "this device is not bound to an account");
+    const devices = home.realm.ownDevices().filter((d) => d.current);
+    const me = this.#identity.machine;
+    return {
+      person: binding.person,
+      devices: devices.map((d) => ({ device: d.device, label: d.label, kind: d.kind, self: d.device === me })),
+      signIns: this.#jellyHost || binding.record?.host !== undefined ? 0 : 1,
+      perDay: ERASURES_PER_DAY,
+      lost: [
+        `Every device of your account (${devices.length}, this one included) is removed from Messaging, and none can be bound again.`,
+        "Your Jelly account can never be bound to Messaging again: the erasure is for good, and a new sign-in is refused.",
+        "The directory deletes your name, email and handle, and every device record and key statement it held for you.",
+        "Messages still queued at the relay for your devices are deleted.",
+        "Your contacts see a deleted account, and drop the grants and cards they hold for you."
+      ],
+      kept: ["Each device keeps its own history (conversations, transcripts, grants) on its disk until you delete its home.", "Your Jelly account itself is not deleted: only its Messaging account is."]
+    };
+  }
+  async#erase(p) {
+    const home = this.#homeDirectory("directory.erase");
+    const binding = home.realm.binding();
+    if (!binding.person || binding.state === "none" || binding.state === "removed")
+      throw new MessagingError("no_identity", "this device is not bound to an account");
+    if (binding.record?.vouch !== "jelly")
+      throw new MessagingError("forbidden", "a device approved by link erases nothing; erase from a device Jelly ID vouched for");
+    if (p.token !== undefined) {
+      const done = await this.#eraseWith(p.token);
+      return { state: "done", person: done.person, devices: done.devices };
+    }
+    if (this.#jellyHost)
+      throw new MessagingError("invalid_request", "under a Jelly host, directory.erase needs a fresh token for this device from its host (token)");
+    const record = binding.record;
+    const started = await home.signIn("erase", { label: record.label, kind: record.kind !== "jelly-host" ? record.kind : "laptop" });
+    return { state: "sign-in", ...started };
+  }
+  async#eraseWith(token) {
+    const home = this.#homeDirectory("directory.erase");
+    let done;
+    try {
+      done = await home.realm.erase(token);
+    } catch (error) {
+      if (!(error instanceof MessagingError) || error.code !== "rate_limited")
+        throw error;
+      const wait = error.retryAfterMs;
+      const when = typeof wait === "number" && wait > 0 ? `; try again in about ${Math.max(1, Math.ceil(wait / 60000))} min` : "; try again tomorrow";
+      throw new MessagingError("rate_limited", `the directory allows ${ERASURES_PER_DAY} erasures per person a day${when}`);
+    }
+    this.#log("warn", "directory.erased", { devices: done.devices });
+    return done;
+  }
   #removePreview(p) {
     const entry = this.#homeDirectory("device.remove.preview").list().devices.find((d) => d.device === p.device);
     if (!entry)
@@ -23078,6 +23716,93 @@ ${row.receipt ? "receipt" : "envelope"}`;
       ...entry.since !== undefined ? { since: entry.since } : {}
     };
   }
+  #deviceLogGrew(persons) {
+    try {
+      this.#deviceNotices();
+    } catch (error) {
+      this.#log("error", "notice.device.failed", { code: codeOf(error) });
+    }
+    if (persons.some((person) => person !== this.#me()))
+      this.#emit({ type: "contacts" });
+  }
+  #ownPerson() {
+    return this.#directory?.person() ?? this.#me();
+  }
+  #deviceNotices(start = false) {
+    const realm = this.#realm ?? this.#directory?.realm;
+    const person = this.#ownPerson();
+    const me = this.#identity?.machine;
+    if (!realm || !person || !me)
+      return;
+    const changes = realm.deviceChanges(person);
+    const head = changes.at(-1)?.seq ?? -1;
+    let last = this.#store.getKv(DEVICE_NOTICES_KEY);
+    if (last === undefined) {
+      const admitted = changes.find((change) => change.device === me && change.change === "added");
+      if (start || admitted === undefined) {
+        this.#store.setKv(DEVICE_NOTICES_KEY, String(head));
+        return;
+      }
+      last = String(admitted.seq);
+    }
+    const fresh = changes.filter((change) => change.seq > Number(last));
+    if (fresh.length === 0)
+      return;
+    const replacers = new Set(fresh.filter((change) => change.change === "replaced").map((change) => change.by));
+    for (const change of fresh) {
+      if (change.device === me || change.by === me)
+        continue;
+      if (change.change === "added" && replacers.has(change.device))
+        continue;
+      this.#notices.device(change.seq, change.at);
+    }
+    this.#store.setKv(DEVICE_NOTICES_KEY, String(Math.max(head, Number(last))));
+  }
+  #noticeDevice(seq) {
+    const realm = this.#realm ?? this.#directory?.realm;
+    const person = this.#ownPerson();
+    if (!realm || !person)
+      return;
+    const changes = realm.deviceChanges(person);
+    const change = changes.find((c) => c.seq === seq);
+    if (!change)
+      return;
+    const labelOf = (device) => changes.filter((c) => c.device === device).at(-1)?.label;
+    const gone = (device) => changes.some((c) => c.device === device && (c.change === "removed" || c.change === "replaced"));
+    const subject = change.change === "replaced" ? change.by : change.device;
+    const latest = change.change === "replaced" ? changes.filter((c) => c.device === subject && c.change !== "removed" && c.change !== "replaced").at(-1) : change;
+    const label = latest?.label ?? labelOf(subject) ?? "device";
+    const current = !gone(subject);
+    const view = {
+      change: change.change,
+      device: subject,
+      label: MachineLabel.safeParse(label).success ? label : "device",
+      ...latest?.kind !== undefined ? { kind: latest.kind } : {},
+      vouch: ((v) => v === "service" ? "device" : v)(latest?.vouch ?? change.vouch),
+      ...(latest?.via ?? change.via) !== undefined ? { via: latest?.via ?? change.via } : {},
+      ...change.approver !== undefined && labelOf(change.approver) !== undefined ? { approver: labelOf(change.approver) } : {},
+      ...change.change === "replaced" ? { replaces: { device: change.device, label: change.label } } : {},
+      current,
+      at: change.at
+    };
+    const remove = current ? this.#removeWith() : undefined;
+    if (remove)
+      view.remove = remove;
+    return view;
+  }
+  #removeWith() {
+    const home = this.#directory;
+    if (!home)
+      return this.#roster?.isAdmin(this.#identity?.machine ?? "") ? "team" : undefined;
+    const self = home.list().devices.find((device) => device.self && device.current);
+    if (!self || self.vouched !== "jelly")
+      return;
+    return self.via === "browser" ? "sign-in" : "token";
+  }
+  #trustNotices() {
+    for (const grant of this.#grants.expiringTrust(TRUST_NOTICE_MS))
+      this.#notices.trust(grant.id, grant.person, grant.until, this.#now());
+  }
   #alerts() {
     const realmAlarm = this.#directory?.status().alarm;
     const roster = this.#keysMissing ? "keys_missing" : this.#keyring.restored() ? "restored" : undefined;
@@ -23095,6 +23820,16 @@ ${row.receipt ? "receipt" : "envelope"}`;
     }
     if (realmAlarm)
       this.#notices.alert(realmAlarm.kind, realmAlarm.at);
+    this.#deviceNotices();
+    if (this.#joinedOrUndefined())
+      this.#trustNotices();
+  }
+  #joinedOrUndefined() {
+    try {
+      return this.#joined();
+    } catch {
+      return;
+    }
   }
   #homeDirectory(method) {
     if (this.#directory)
@@ -23463,7 +24198,15 @@ function jellyConfig(path, jelly) {
 function isLineTarget(to) {
   return to.startsWith("#") || !to.includes("/");
 }
-var DAY3 = 86400000, KEYCHAIN_LEFTOVERS_KEY = "keychain.stale", DEFAULT_TUNING, KEPT_MS, INPUT_TIMEOUT_MS, TASK_BYTES = 1048576, MACHINE_KEY = "identity.machine", DEFAULT_INVITE_TTL_MS, LIST_BYTES = 1572864;
+function signInToken(token) {
+  try {
+    const claims = parseWire(Buffer.from(token.split(".")[1] ?? "", "base64url").toString("utf8"));
+    return typeof claims === "object" && claims !== null && claims.src === "device";
+  } catch {
+    return false;
+  }
+}
+var DAY3 = 86400000, KEYCHAIN_LEFTOVERS_KEY = "keychain.stale", DEFAULT_TUNING, KEPT_MS, INPUT_TIMEOUT_MS, TASK_BYTES = 1048576, PREDECESSOR_KEY = "identity.predecessor", REPLACE_LABEL_KEY = "identity.replace.label", REPLACED_KEY = "identity.replaced", ERASURES_PER_DAY = 10, DEVICE_NOTICES_KEY = "notice.devices.seq", TRUST_NOTICE_MS, DEVICES_CHANGED_MS, MACHINE_KEY = "identity.machine", DEFAULT_INVITE_TTL_MS, LIST_BYTES = 1572864;
 var init_daemon = __esm(() => {
   init_dist();
   init_dist2();
@@ -23480,6 +24223,7 @@ var init_daemon = __esm(() => {
   init_policy();
   init_roster_identity();
   init_directory_home();
+  init_directory_identity();
   init_jelly3();
   init_jelly_env();
   init_answer_preview();
@@ -23509,6 +24253,8 @@ var init_daemon = __esm(() => {
   };
   KEPT_MS = DAY3;
   INPUT_TIMEOUT_MS = DAY3;
+  TRUST_NOTICE_MS = 7 * DAY3;
+  DEVICES_CHANGED_MS = 7 * DAY3;
   DEFAULT_INVITE_TTL_MS = DAY3;
 });
 
@@ -25072,6 +25818,9 @@ class RelayDirectoryLink {
       throw shape();
     return { seq: reply.seq, sth: reply.sth };
   }
+  async erase(entries, token) {
+    parse5(DirOkFrame, await link((await this.#authed()).dirErase(entries, token)));
+  }
   async keys(statement) {
     const reply = parse5(DirOkFrame, await link((await this.#authed()).dirKeys(statement)));
     if (reply.sth === undefined)
@@ -26454,6 +27203,12 @@ var people = {
       }
       ctx.out.line(`${ctx.out.style.bold(inline(person.name, 64))}  handle ${inline(person.handle, 64)}  org ${person.org}  vouched ${person.vouched}`);
       ctx.out.lines(table(["DEVICE", "LABEL", ""], person.devices.map((d) => [d.device, inline(d.label, 32), d.self ? "this device" : ""]), ctx.out.style));
+      if (person.deviceChanges !== undefined) {
+        const now = ctx.now();
+        ctx.out.line(`${ctx.out.style.yellow(`${inline(person.name, 64)}'s devices changed:`)}`);
+        for (const change of person.deviceChanges)
+          ctx.out.line(`  ${change.change} '${inline(change.label, 32)}' (${vouchWords(change)})  ${ago(change.at, now)}`);
+      }
       return;
     }
     if (ctx.json) {
@@ -26570,8 +27325,9 @@ var notices = {
   usage: "[--lines] [--ack]",
   details: [
     "Each line is a message for you (a DM or channel line from someone else, or your own agent's line to you),",
-    "a request held for you to answer (`messaging requests`), or an alert about this device. --lines adds a",
-    "message's first line (peer text). --ack marks every notice shown as seen."
+    "a request held for you to answer (`messaging requests`), or an alert: about this device, a device added to or",
+    "removed from your account (with how to remove one that is not yours), or trust you gave that ends within 7 days.",
+    "--lines adds a message's first line (peer text). --ack marks every notice shown as seen."
   ].join(`
 `),
   options: {
@@ -26598,13 +27354,25 @@ var notices = {
       ago(n.at, now),
       n.category,
       n.from ? inline(n.from.name, 40) : "",
-      n.conversation !== undefined ? inline(n.conversation, 60) : "",
+      n.conversation !== undefined ? inline(n.conversation, 60) : n.device !== undefined ? `device ${n.device.device}` : "",
       n.line !== undefined ? inline(n.line, 120) : ""
     ]), ctx.out.style));
+    const removable = list.flatMap((n) => n.device?.remove !== undefined && n.device.current ? [n.device] : []);
+    for (const d of removable) {
+      const how = d.remove === "sign-in" ? `messaging login --remove ${d.device}` : d.remove === "team" ? `messaging team remove ${d.device}` : "Remove it from the Jelly app on this device";
+      ctx.out.note(`Not yours? '${inline(d.label, 32)}': ${how}`);
+    }
     if (values.ack === true)
       ctx.out.line(ctx.out.style.dim(`${list.length} marked seen`));
   }
 };
+function vouchWords(d) {
+  if (d.vouch === "admin")
+    return "admitted by the team's admin";
+  if (d.vouch === "device")
+    return d.approver !== undefined ? `approved on '${inline(d.approver, 32)}'` : "approved by link";
+  return d.via === "browser" ? "signed in through the browser" : "vouched by Jelly ID";
+}
 var DIRECTORY_COMMANDS = [status, who2, people, devices, notices];
 
 // packages/daemon/dist/cli/commands/identity.js
@@ -26874,6 +27642,55 @@ function aborted2(signal) {
     signal.addEventListener("abort", () => resolve(), { once: true });
   });
 }
+async function showSignIn(ctx, started, open) {
+  if (!ctx.json) {
+    const { bold } = ctx.out.style;
+    const lead = started.purpose === "remove" ? "To remove that device, sign in at Jelly ID:" : started.purpose === "replace" ? "To replace your old device, sign in at Jelly ID with this one:" : started.purpose === "erase" ? "To erase your account, sign in at Jelly ID:" : "To sign this device in, open:";
+    ctx.out.line(lead);
+    ctx.out.line(`  ${started.verificationUriComplete}`);
+    ctx.out.line(`and check that the page shows the code ${bold(started.userCode)} and the key ${bold(started.fingerprint)}.`);
+    ctx.out.line(`(Or open ${started.verificationUri} and type the code.)`);
+  }
+  if (open) {
+    const opened = await (ctx.io.openUrl ?? openInBrowser)(started.verificationUriComplete);
+    if (!opened)
+      ctx.out.note("Could not open a browser here; open the link on any device.");
+  } else if (!ctx.json && (ctx.io.env.SSH_CONNECTION !== undefined || ctx.io.env.SSH_TTY !== undefined)) {
+    ctx.out.note("Over SSH: open the link on your laptop or phone; the code ties it to this machine.");
+  }
+}
+async function waitSignIn(ctx, client, started) {
+  const minutes = Math.max(1, Math.round((started.expires - ctx.now()) / 60000));
+  if (!ctx.json)
+    ctx.out.note(`Waiting for your approval (the code expires in ${minutes} min; Ctrl-C cancels)...`);
+  const interrupted = aborted2(ctx.io.signal);
+  let state = { ...started, state: "pending" };
+  while (state.state === "pending") {
+    const asked = client.call("device.login.status", { waitMs: STATUS_WAIT_MS }, { timeoutMs: STATUS_WAIT_MS + 15000 });
+    const next = await Promise.race([asked, interrupted.then(() => {
+      return;
+    })]);
+    if (next === undefined) {
+      asked.catch(() => {});
+      await client.call("device.login.cancel", {}).catch(() => {});
+      ctx.out.note("Cancelled.");
+      return;
+    }
+    state = next;
+  }
+  if (state.state === "failed")
+    throw new MessagingError(state.code, state.message);
+  return state;
+}
+async function confirmed(ctx, yes, question, word = "y") {
+  if (yes)
+    return true;
+  if (ctx.json)
+    throw new UsageError("with --json there is no prompt: confirm with --yes");
+  ctx.out.prompt(`${question} Type ${word} to confirm: `);
+  const answer = (await readLine(ctx.io.stdin) ?? "").trim().toLowerCase();
+  return word === "y" ? /^y(es)?$/.test(answer) : answer === word;
+}
 var login = {
   name: "login",
   summary: "Sign this device in to your account through the browser (hosted realm)",
@@ -26917,45 +27734,15 @@ var login = {
       ctx.out.json(started);
       return;
     }
-    if (!ctx.json) {
-      const { bold } = ctx.out.style;
-      ctx.out.line(started.purpose === "remove" ? "To remove that device, sign in at Jelly ID:" : "To sign this device in, open:");
-      ctx.out.line(`  ${started.verificationUriComplete}`);
-      ctx.out.line(`and check that the page shows the code ${bold(started.userCode)} and the key ${bold(started.fingerprint)}.`);
-      ctx.out.line(`(Or open ${started.verificationUri} and type the code.)`);
-    }
-    if (values.open === true) {
-      const opened = await (ctx.io.openUrl ?? openInBrowser)(started.verificationUriComplete);
-      if (!opened)
-        ctx.out.note("Could not open a browser here; open the link on any device.");
-    } else if (!ctx.json && (ctx.io.env.SSH_CONNECTION !== undefined || ctx.io.env.SSH_TTY !== undefined)) {
-      ctx.out.note("Over SSH: open the link on your laptop or phone; the code ties it to this machine.");
-    }
+    await showSignIn(ctx, started, values.open === true);
     const minutes = Math.max(1, Math.round((started.expires - ctx.now()) / 60000));
     if (!wait) {
       ctx.out.note(`The daemon waits ${minutes} min for your approval. See it with: messaging devices`);
       return;
     }
-    if (!ctx.json)
-      ctx.out.note(`Waiting for your approval (the code expires in ${minutes} min; Ctrl-C cancels)...`);
-    const signal = ctx.io.signal;
-    const interrupted = aborted2(signal);
-    let state = { ...started, state: "pending" };
-    while (state.state === "pending") {
-      const asked = client.call("device.login.status", { waitMs: STATUS_WAIT_MS }, { timeoutMs: STATUS_WAIT_MS + 15000 });
-      const next = await Promise.race([asked, interrupted.then(() => {
-        return;
-      })]);
-      if (next === undefined) {
-        asked.catch(() => {});
-        await client.call("device.login.cancel", {}).catch(() => {});
-        ctx.out.note("Cancelled.");
-        return 130;
-      }
-      state = next;
-    }
-    if (state.state === "failed")
-      throw new MessagingError(state.code, state.message);
+    const state = await waitSignIn(ctx, client, started);
+    if (state === undefined)
+      return 130;
     if (ctx.json) {
       ctx.out.json(state);
       return state.state === "done" ? undefined : 1;
@@ -26972,7 +27759,128 @@ var login = {
     }
   }
 };
-var LOGIN_COMMANDS = [login];
+var replace = {
+  name: "identity replace",
+  summary: "Replace this home's device with new keys after a restore (hosted realm)",
+  usage: "[--label <label>] [--open] [--yes]",
+  details: [
+    "For a home restored from a backup or a snapshot (alarm keys_missing or restored), or for a fresh key on purpose.",
+    "This device gets a new key, binds it to your account and removes the old device (reason replaced): your",
+    "conversations, grants and history stay, and tasks continue. Mail still queued at the relay for the old device is",
+    "lost. Through the browser you approve two sign-ins at Jelly ID: one binds the new key, one removes the old."
+  ].join(`
+`),
+  options: {
+    label: { type: "string", value: "<label>", description: "The new device's label (default: the old one's)" },
+    open: { type: "boolean", description: "Open each link in this machine's browser" },
+    yes: { type: "boolean", short: "y", description: "Do not ask for confirmation" }
+  },
+  args: { min: 0, max: 0 },
+  async run(ctx, _positionals, values) {
+    const label = stringValue(values, "label");
+    const client = await ctx.client();
+    const preview = await client.call("identity.replace.preview", {});
+    if (!ctx.json)
+      ctx.out.line(inline(preview.sentence, 600));
+    if (!await confirmed(ctx, values.yes === true, `Replace '${inline(preview.predecessor.label, 32)}' (device ${preview.predecessor.device}) with this device?`)) {
+      ctx.out.note("Not replaced.");
+      return 1;
+    }
+    const params = label !== undefined ? { label: parseWith2(MachineLabel, label, "--label must be a lowercase label, e.g. desk") } : {};
+    for (let step = 0;step < 3; step++) {
+      const result = await client.call("identity.replace", params);
+      if (result.state === "done") {
+        if (ctx.json)
+          ctx.out.json(result);
+        else
+          ctx.out.line(`Replaced: this device (${result.device}) replaces ${result.predecessor} on ${inline(result.person, 64)}.`);
+        return;
+      }
+      if (result.state === "token") {
+        if (ctx.json)
+          ctx.out.json(result);
+        else
+          ctx.out.note(`This device (${result.device}) waits for its Jelly host to bind the new key; the host's app finishes the replacement.`);
+        return;
+      }
+      await showSignIn(ctx, result, values.open === true);
+      const state = await waitSignIn(ctx, client, result);
+      if (state === undefined)
+        return 130;
+      if (state.state !== "done") {
+        ctx.out.note("The sign-in was cancelled (another sign-in started, or the daemon stopped).");
+        return 1;
+      }
+      if ((await client.call("device.status", {})).binding !== "replace") {
+        const done = { state: "done", person: state.person, device: result.device, predecessor: preview.predecessor.device, seq: state.seq };
+        if (ctx.json)
+          ctx.out.json(done);
+        else
+          ctx.out.line(`Replaced: this device (${result.device}) replaces ${preview.predecessor.device} on ${inline(state.person, 64)}.`);
+        return;
+      }
+      if (!ctx.json)
+        ctx.out.note("The new key is bound. One more sign-in removes the old device.");
+    }
+    throw new MessagingError("internal", "the replacement did not finish; run messaging identity replace again");
+  }
+};
+var erase = {
+  name: "erase",
+  summary: "Erase your account from Messaging, for good (hosted realm)",
+  usage: "[--open] [--yes]",
+  details: [
+    "Removes every device of your account and deletes what the directory holds about you. Your Jelly account can",
+    "never be bound to Messaging again. The directory allows 10 erasures per person a day. Shows what is lost and",
+    "asks you to type erase, unless --yes. A device approved by link cannot erase; one signed in through the browser",
+    "approves one more sign-in at Jelly ID."
+  ].join(`
+`),
+  options: {
+    open: { type: "boolean", description: "Open the link in this machine's browser" },
+    yes: { type: "boolean", short: "y", description: "Do not ask for confirmation" }
+  },
+  args: { min: 0, max: 0 },
+  async run(ctx, _positionals, values) {
+    const client = await ctx.client();
+    const preview = await client.call("directory.erase.preview", {});
+    if (!ctx.json) {
+      ctx.out.line(`Erasing ${inline(preview.person, 64)} from Messaging. What is lost:`);
+      for (const line of preview.lost)
+        ctx.out.line(`  - ${inline(line, 300)}`);
+      ctx.out.line(`Devices removed: ${preview.devices.map((d) => `'${inline(d.label, 32)}'${d.self ? " (this one)" : ""}`).join(", ")}`);
+      ctx.out.line("What stays:");
+      for (const line of preview.kept)
+        ctx.out.line(`  - ${inline(line, 300)}`);
+      ctx.out.note(`The directory allows ${preview.perDay} erasures per person a day.`);
+    }
+    if (!await confirmed(ctx, values.yes === true, "This cannot be undone.", "erase")) {
+      ctx.out.note("Not erased.");
+      return 1;
+    }
+    const result = await client.call("directory.erase", {});
+    if (result.state === "done") {
+      if (ctx.json)
+        ctx.out.json(result);
+      else
+        ctx.out.line(`Erased: ${result.devices} device(s) removed; this account is gone from Messaging.`);
+      return;
+    }
+    await showSignIn(ctx, result, values.open === true);
+    const state = await waitSignIn(ctx, client, result);
+    if (state === undefined)
+      return 130;
+    if (state.state !== "done") {
+      ctx.out.note("The sign-in was cancelled (another sign-in started, or the daemon stopped).");
+      return 1;
+    }
+    if (ctx.json)
+      ctx.out.json({ state: "done", person: state.person, devices: preview.devices.length });
+    else
+      ctx.out.line(`Erased: ${preview.devices.length} device(s) removed; this account is gone from Messaging.`);
+  }
+};
+var LOGIN_COMMANDS = [login, replace, erase];
 
 // packages/daemon/dist/cli/commands/messages.js
 init_dist();
@@ -27724,13 +28632,13 @@ var HANDLES_INTERRUPT = new Set(["listen", "login"]);
 var GROUPS = {
   daemon: "Run the local daemon, messagingd",
   team: "Manage the team: create, invite, join, members, roles (only the CLI may do this)",
-  identity: "Show, move or rotate this machine's keys (only the CLI may do this)",
+  identity: "Show, move, rotate or replace this machine's keys (only the CLI may do this)",
   chat: "Your DMs and channels: list, read, post, search"
 };
 var SECTIONS = [
   ["Daemon", ["daemon start", "daemon stop", "status"]],
   ["Team", ["team prepare", "team create", "team card", "team invite", "team join", "team pair", "team add", "team claim", "team pair-cancel", "team members", "team remove", "team role", "team revoke-invite"]],
-  ["Identity", ["identity show", "identity migrate", "identity rotate-enc"]],
+  ["Identity", ["identity show", "identity migrate", "identity rotate-enc", "identity replace", "erase"]],
   ["People", ["login", "people", "devices", "grants", "grant", "requests", "contact", "card", "notices"]],
   ["Messages", ["who", "send", "inbox", "read", "message-status"]],
   ["Chats", ["chat list", "chat read", "chat post", "chat search"]],