@joe-broadhead/messaging-bin-win32-x64 0.5.0 → 0.7.0

package/lib/messagingd.mjs

@@ -5129,12 +5129,6 @@ function _ensureDefaultMemoizer() {
 function string2(params) {
   return _string(ZodString, params);
 }
-function ipv42(params) {
-  return _ipv4(ZodIPv4, params);
-}
-function ipv62(params) {
-  return _ipv6(ZodIPv6, params);
-}
 function number2(params) {
   return _number(ZodNumber, params);
 }
@@ -6122,12 +6116,11 @@ var init_common = __esm(() => {
     card: `messaging/1/card
 `,
     seal: "messaging/1/seal",
-    directAuth: `messaging/1/direct-auth
-`,
-    directLink: "messaging/1/direct-link",
     person: `messaging/1/person
 `,
     tombstone: "messaging/1/tombstone",
+    dirRead: `messaging/1/dir-read
+`,
     deviceLog: `messaging/1/device-log
 `,
     deviceKeys: `messaging/1/device-keys
@@ -6163,7 +6156,7 @@ var init_common = __esm(() => {
   Millis = number2().int().nonnegative();
   Address = string2().min(1).max(200);
   SessionAddress = string2().regex(/^(?:[a-z][a-z0-9-]{0,31}|p_[a-z2-7]{26})\/[a-z0-9][a-z0-9._-]{0,63}@[a-z0-9][a-z0-9-]{0,31}$/, "person/session@label");
-  MemberRole = _enum(["admin", "member", "service"]);
+  MemberRole = _enum(["admin", "member"]);
   SessionState = _enum(["idle", "busy"]);
   DeliveryTier = _enum(["push", "pull"]);
   DeliveryStage = _enum([
@@ -6404,7 +6397,7 @@ var init_jelly = __esm(() => {
 });
 
 // packages/core/dist/schema/directory.js
-var MapProof, MapValue, DeviceId, DeviceKind, UnbindReason, Signature, LinkRequest, Authority, LogEntry, KeysStatement, EpochLeaf, EpochProof, STH, KeyRotation, EntryEpoch, PersonView;
+var MapProof, MapValue, DeviceId, DeviceKind, UnbindReason, Signature, LinkRequest, Authority, LogEntry, KeysStatement, EpochLeaf, EpochProof, STH, KeyRotation, EntryEpoch, PersonHead, PersonView;
 var init_directory = __esm(() => {
   init_zod();
   init_common();
@@ -6499,6 +6492,12 @@ var init_directory = __esm(() => {
     value: MapValue,
     mapProof: MapProof
   });
+  PersonHead = strictObject({
+    person: HostedPersonId,
+    mapProof: MapProof,
+    value: MapValue.optional(),
+    tombstone: literal(true).optional()
+  });
   PersonView = strictObject({
     person: HostedPersonId,
     log: array(LogEntry).max(1024),
@@ -6510,7 +6509,7 @@ var init_directory = __esm(() => {
 });
 
 // packages/core/dist/schema/a2a.js
-var Struct, TaskState, TERMINAL_STATES, Role, Part, Message, TaskStatus, Artifact, Task, TaskStatusUpdateEvent, TaskArtifactUpdateEvent, AgentInterface, AgentExtension, AgentCapabilities, AgentSkill, AgentCard, SendMessageConfiguration, SendMessageRequest, SendMessageResponse, StreamResponse, GetTaskRequest, CancelTaskRequest, SubscribeToTaskRequest, ListTasksRequest, ListTasksResponse;
+var Struct, TaskState, TERMINAL_STATES, Role, Part, Message, TaskStatus, Artifact, Task, TaskStatusUpdateEvent, TaskArtifactUpdateEvent;
 var init_a2a = __esm(() => {
   init_zod();
   Struct = record(string2(), unknown());
@@ -6587,92 +6586,6 @@ var init_a2a = __esm(() => {
     lastChunk: boolean2().optional(),
     metadata: Struct.optional()
   });
-  AgentInterface = object({
-    url: string2().min(1),
-    protocolBinding: string2().min(1).describe("JSONRPC | GRPC | HTTP+JSON | a binding URI"),
-    tenant: string2().optional(),
-    protocolVersion: string2().min(1)
-  });
-  AgentExtension = object({
-    uri: string2(),
-    description: string2().optional(),
-    required: boolean2().optional(),
-    params: Struct.optional()
-  });
-  AgentCapabilities = object({
-    streaming: boolean2().optional(),
-    pushNotifications: boolean2().optional(),
-    extensions: array(AgentExtension).optional(),
-    extendedAgentCard: boolean2().optional()
-  });
-  AgentSkill = object({
-    id: string2().min(1),
-    name: string2().min(1),
-    description: string2(),
-    tags: array(string2()),
-    examples: array(string2()).optional(),
-    inputModes: array(string2()).optional(),
-    outputModes: array(string2()).optional(),
-    securityRequirements: array(unknown()).optional()
-  });
-  AgentCard = object({
-    name: string2().min(1),
-    description: string2(),
-    supportedInterfaces: array(AgentInterface).min(1),
-    provider: object({ url: string2(), organization: string2() }).optional(),
-    version: string2(),
-    documentationUrl: string2().optional(),
-    capabilities: AgentCapabilities,
-    securitySchemes: record(string2(), unknown()).optional(),
-    securityRequirements: array(unknown()).optional(),
-    defaultInputModes: array(string2()),
-    defaultOutputModes: array(string2()),
-    skills: array(AgentSkill),
-    signatures: array(object({ protected: string2(), signature: string2(), header: Struct.optional() })).optional(),
-    iconUrl: string2().optional()
-  });
-  SendMessageConfiguration = object({
-    acceptedOutputModes: array(string2()).optional(),
-    taskPushNotificationConfig: unknown().optional(),
-    historyLength: number2().int().nonnegative().optional(),
-    returnImmediately: boolean2().optional()
-  });
-  SendMessageRequest = object({
-    tenant: string2().optional(),
-    message: Message,
-    configuration: SendMessageConfiguration.optional(),
-    metadata: Struct.optional()
-  });
-  SendMessageResponse = union([object({ task: Task }), object({ message: Message })]);
-  StreamResponse = union([
-    object({ task: Task }),
-    object({ message: Message }),
-    object({ statusUpdate: TaskStatusUpdateEvent }),
-    object({ artifactUpdate: TaskArtifactUpdateEvent })
-  ]);
-  GetTaskRequest = object({
-    tenant: string2().optional(),
-    id: string2().min(1),
-    historyLength: number2().int().nonnegative().optional()
-  });
-  CancelTaskRequest = object({ tenant: string2().optional(), id: string2().min(1), metadata: Struct.optional() });
-  SubscribeToTaskRequest = object({ tenant: string2().optional(), id: string2().min(1) });
-  ListTasksRequest = object({
-    tenant: string2().optional(),
-    contextId: string2().optional(),
-    status: TaskState.or(literal("TASK_STATE_UNSPECIFIED")).optional(),
-    pageSize: number2().int().min(1).max(100).optional(),
-    pageToken: string2().optional(),
-    historyLength: number2().int().nonnegative().optional(),
-    statusTimestampAfter: string2().optional(),
-    includeArtifacts: boolean2().optional()
-  });
-  ListTasksResponse = object({
-    tasks: array(Task),
-    nextPageToken: string2(),
-    pageSize: number2().int(),
-    totalSize: number2().int()
-  });
 });
 
 // packages/core/dist/schema/consent.js
@@ -6760,13 +6673,12 @@ var init_consent = __esm(() => {
 });
 
 // packages/core/dist/schema/delegation.js
-var DelegationScope, ExternalPrincipal, DelegationGrant, DelegationChain, DelegationSummary;
+var DelegationScope, DelegationGrant, DelegationChain, DelegationSummary;
 var init_delegation = __esm(() => {
   init_zod();
   init_common();
   init_realm();
   DelegationScope = string2().regex(/^[a-z0-9][a-z0-9._:/-]{0,63}$/, "scope label");
-  ExternalPrincipal = string2().min(1).max(64);
   DelegationGrant = looseObject({
     realm: RealmId,
     task: Ulid,
@@ -6778,7 +6690,6 @@ var init_delegation = __esm(() => {
     maxDepth: number2().int().min(1).max(LIMITS.delegationDepth),
     scope: array(DelegationScope).max(LIMITS.delegationScopes).optional(),
     parent: Hash.optional(),
-    external: looseObject({ principal: ExternalPrincipal }).optional(),
     sig: Base64Url
   });
   DelegationChain = array(DelegationGrant).min(1).max(LIMITS.delegationDepth);
@@ -6787,7 +6698,6 @@ var init_delegation = __esm(() => {
     depth: number2().int().min(1).max(LIMITS.delegationDepth),
     maxDepth: number2().int().min(1).max(LIMITS.delegationDepth),
     scope: array(DelegationScope).max(LIMITS.delegationScopes).optional(),
-    external: object({ principal: ExternalPrincipal, gateway: MachineId }).optional(),
     exp: Millis
   });
 });
@@ -6800,7 +6710,7 @@ function requestMessage(message) {
 function cardMessage(message, what) {
   return bare(message, "data") && (what === "card" ? CardData : CardGetData).safeParse(message.parts[0].data).success;
 }
-var EnvelopeType, SEAL_ALG = "x25519-hkdf-sha256-a256gcm", EnvelopeClass, Party, Sender, Recipient, Envelope, ChannelPersons, ChannelConv, SelfConv, RequestConv, CardConv, Conv, MessagePayload, BARE_MESSAGE, bare = (message, part) => Object.keys(message).every((key) => BARE_MESSAGE.has(key)) && message.parts.length === 1 && Object.keys(message.parts[0]).join() === part, TaskStatusPayload, TaskArtifactPayload, TaskCancelPayload, ReceiptPayload, SessionInfo, DirectEndpoint, PresencePayload, PAYLOAD_BY_TYPE, Provenance;
+var EnvelopeType, SEAL_ALG = "x25519-hkdf-sha256-a256gcm", EnvelopeClass, Party, Sender, Recipient, Envelope, ChannelPersons, ChannelConv, SelfConv, RequestConv, CardConv, Conv, MessagePayload, BARE_MESSAGE, bare = (message, part) => Object.keys(message).every((key) => BARE_MESSAGE.has(key)) && message.parts.length === 1 && Object.keys(message.parts[0]).join() === part, TaskStatusPayload, TaskArtifactPayload, TaskCancelPayload, ReceiptPayload, SessionInfo, PresencePayload, PAYLOAD_BY_TYPE, Provenance;
 var init_envelope = __esm(() => {
   init_zod();
   init_a2a();
@@ -6855,7 +6765,6 @@ var init_envelope = __esm(() => {
     kind: _enum(["message", "task"]),
     message: Message,
     wake: boolean2().optional(),
-    external: object({ principal: string2().min(1).max(64) }).optional(),
     delegation: DelegationChain.optional(),
     conv: Conv.optional()
   }).refine((p) => p.kind === "task" ? p.message.taskId !== undefined : true, { message: "a task message needs message.taskId" }).refine((p) => p.kind === "task" === (p.delegation !== undefined), { message: "a task request carries a delegation chain, and only a task request" }).refine((p) => p.conv?.kind !== "self" || p.message.parts.length === 1 && GrantSync.safeParse(p.message.parts[0].data).success, {
@@ -6892,16 +6801,11 @@ var init_envelope = __esm(() => {
     kept: literal(true).optional(),
     wake: literal(true).optional()
   });
-  DirectEndpoint = object({
-    host: union([ipv42(), ipv62()]),
-    port: number2().int().min(1).max(65535)
-  });
   PresencePayload = object({
     seq: number2().int().nonnegative(),
     label: MachineLabel,
     sessions: array(SessionInfo).max(LIMITS.presenceSessions),
     features: array(string2().max(64)).max(32).optional(),
-    direct: array(DirectEndpoint).min(1).max(4).optional(),
     away: literal(true).optional()
   });
   PAYLOAD_BY_TYPE = {
@@ -6920,8 +6824,7 @@ var init_envelope = __esm(() => {
     device: MachineId,
     label: MachineLabel,
     verified: literal("signature"),
-    receivedAt: Millis,
-    external: object({ principal: string2().max(64), gateway: MachineId }).optional()
+    receivedAt: Millis
   });
 });
 
@@ -6974,7 +6877,6 @@ var init_roster = __esm(() => {
       inviteId: Ulid,
       invitePub: Key32,
       person: PersonName,
-      role: _enum(["member", "service"]),
       expires: Millis
     })
   });
@@ -7011,7 +6913,6 @@ var init_roster = __esm(() => {
     inviteId: Ulid,
     secret: Key32,
     person: PersonName,
-    role: _enum(["member", "service"]),
     expires: Millis
   });
 });
@@ -7096,6 +6997,7 @@ var init_relay = __esm(() => {
     protocolError: 4002,
     removed: 4003,
     replaced: 4004,
+    full: 1013,
     tooLarge: 1009
   };
 });
@@ -7104,7 +7006,10 @@ var init_relay = __esm(() => {
 function hostedRelayAuthPayload(args) {
   return { proto: RELAY_PROTOCOL, relay: args.relay, realm: args.realm, person: args.person, device: args.device, nonce: args.nonce, ts: args.ts };
 }
-var Req2, Size, Handle, Email, OrgId, DirBindFrame, HostedHelloFrame, DirAppendFrame, DirKeysFrame, DirSthFrame, DirLookupFrame, DirDeviceFrame, DirResolveFrame, DirSearchFrame, DirWatchFrame, PresenceWatchFrame, DirEraseFrame, WAKE_AGENTS = 64, WAKE_AWAITING = 500, WAKE_TICKET_BYTES = 4096, WAKE_TICKET_MAX_S, WakeUrl, WakeArmFrame, WakeDisarmFrame, DirectoryClientFrame, HostedWelcomeFrame, DirOkFrame, DirSthIsFrame, DirPersonsFrame, ResolvedPerson, DirResolvedFrame, DirChangedFrame, DirUnboundFrame, DirectoryRelayFrame;
+function dirReadPayload(args) {
+  return { proto: RELAY_PROTOCOL, relay: args.relay, realm: args.realm, device: args.device, nonce: args.nonce };
+}
+var Req2, Size, Handle, Email, OrgId, DirReadProof, DirBindFrame, HostedHelloFrame, DirAppendFrame, DirKeysFrame, DirSthFrame, DirLookupFrame, DirHeadsFrame, DirDeviceFrame, DirResolveFrame, DirSearchFrame, DirWatchFrame, PresenceWatchFrame, DirEraseFrame, WAKE_AGENTS = 64, WAKE_AWAITING = 500, WAKE_TICKET_BYTES = 4096, WAKE_TICKET_MAX_S, WakeUrl, WakeArmFrame, WakeDisarmFrame, DirectoryClientFrame, HostedWelcomeFrame, DirOkFrame, DirSthIsFrame, DirPersonsFrame, DirHeadsAreFrame, ResolvedPerson, DirResolvedFrame, DirChangedFrame, DirUnboundFrame, DirectoryRelayFrame;
 var init_directory_frames = __esm(() => {
   init_zod();
   init_common();
@@ -7117,6 +7022,7 @@ var init_directory_frames = __esm(() => {
   Handle = string2().regex(/^[a-z][a-z0-9-]{0,31}$/, "lowercase handle");
   Email = string2().max(254).regex(/^[^\s@A-Z]{1,64}@(?:[a-z0-9-]+\.)+[a-z0-9-]+$/, "lower-case email address");
   OrgId = string2().min(1).max(200);
+  DirReadProof = strictObject({ device: DeviceId, sig: Base64Url });
   DirBindFrame = object({ t: literal("dir.bind"), req: Req2, entry: LogEntry });
   HostedHelloFrame = object({
     t: literal("hello"),
@@ -7139,6 +7045,13 @@ var init_directory_frames = __esm(() => {
     t: literal("dir.lookup"),
     req: Req2,
     persons: array(object({ person: HostedPersonId, knownSeq: number2().int().nonnegative().optional() })).min(1).max(LIMITS.dirLookupPersons),
+    size: Size.optional(),
+    proof: DirReadProof.optional()
+  });
+  DirHeadsFrame = object({
+    t: literal("dir.heads"),
+    req: Req2,
+    persons: array(HostedPersonId).min(1).max(LIMITS.dirLookupPersons),
     size: Size.optional()
   });
   DirDeviceFrame = object({
@@ -7188,6 +7101,7 @@ var init_directory_frames = __esm(() => {
     DirSthFrame,
     DirLookupFrame,
     DirDeviceFrame,
+    DirHeadsFrame,
     DirResolveFrame,
     DirSearchFrame,
     DirWatchFrame,
@@ -7220,6 +7134,13 @@ var init_directory_frames = __esm(() => {
     head: EpochProof,
     persons: array(PersonView).max(LIMITS.dirLookupPersons)
   });
+  DirHeadsAreFrame = object({
+    t: literal("dir.headsAre"),
+    req: Req2,
+    sth: STH,
+    head: EpochProof,
+    persons: array(PersonHead).max(LIMITS.dirLookupPersons)
+  });
   ResolvedPerson = object({
     person: HostedPersonId,
     handle: Handle,
@@ -7243,47 +7164,22 @@ var init_directory_frames = __esm(() => {
     DirOkFrame,
     DirSthIsFrame,
     DirPersonsFrame,
+    DirHeadsAreFrame,
     DirResolvedFrame,
     DirChangedFrame,
     DirUnboundFrame
   ]);
 });
 
-// packages/core/dist/schema/direct.js
-var DIRECT_PROTOCOL = "messaging-direct/1", DIRECT_HANDSHAKE_BYTES = 4096, DirectHalf, DirectHelloFrame, DirectAcceptFrame, DirectAuthFrame, DirectIdentity, DirectSendRecord, DirectAckRecord, DirectNackRecord, DirectRecord;
-var init_direct = __esm(() => {
-  init_zod();
-  init_common();
-  init_errors3();
-  DirectHalf = object({ epk: Key32, nonce: Key32 });
-  DirectHelloFrame = object({ t: literal("hello"), proto: literal(DIRECT_PROTOCOL), epk: Key32, nonce: Key32 });
-  DirectAcceptFrame = object({ t: literal("accept"), epk: Key32, nonce: Key32, box: Base64Url.max(1024) });
-  DirectAuthFrame = object({ t: literal("auth"), box: Base64Url.max(1024) });
-  DirectIdentity = object({ team: TeamId, machine: MachineId, sig: Base64Url });
-  DirectSendRecord = object({
-    t: literal("send"),
-    env: looseObject({
-      v: string2(),
-      id: Ulid,
-      type: string2(),
-      from: looseObject({ device: MachineId }),
-      to: looseObject({ device: MachineId })
-    })
-  });
-  DirectAckRecord = object({ t: literal("ack"), id: Ulid });
-  DirectNackRecord = object({ t: literal("nack"), id: Ulid, code: ErrorCode });
-  DirectRecord = discriminatedUnion("t", [DirectSendRecord, DirectAckRecord, DirectNackRecord]);
-});
-
 // packages/core/dist/schema/ipc/device.js
-var BindingState, RealmAlarmSummary, DeviceStatus, DeviceListEntry, LinkText, Sas, LinkPreview, KeyFingerprint, LoginUserCode, LoginPurpose, LoginKind, LoginShown, LoginState, DeviceRemoveParams, DeviceApproveParams, DEVICE_METHODS;
+var BindingState, RealmAlarmSummary, DeviceStatus, DeviceChangeView, DeviceListEntry, LinkText, Sas, LinkPreview, KeyFingerprint, LoginUserCode, LoginPurpose, LoginKind, LoginShown, LoginState, DeviceRemoveParams, DeviceApproveParams, IdentityReplaceParams, SignInStep, DirectoryEraseParams, DEVICE_METHODS;
 var init_device = __esm(() => {
   init_zod();
   init_common();
   init_directory();
   init_errors3();
   init_jelly();
-  BindingState = _enum(["none", "bound", "attest-due", "removed"]);
+  BindingState = _enum(["none", "bound", "attest-due", "removed", "replace"]);
   RealmAlarmSummary = object({
     kind: _enum(["directory", "restored"]),
     reason: string2().max(500),
@@ -7298,6 +7194,16 @@ var init_device = __esm(() => {
     sth: object({ size: number2().int().positive(), root: Hash, ts: Millis }).optional(),
     alarm: RealmAlarmSummary.optional()
   });
+  DeviceChangeView = object({
+    change: _enum(["added", "vouched", "removed", "replaced"]),
+    device: MachineId,
+    label: MachineLabel,
+    kind: DeviceKind.optional(),
+    vouch: _enum(["jelly", "device", "admin"]),
+    via: _enum(["host", "browser"]).optional(),
+    approver: MachineLabel.optional(),
+    at: Millis
+  });
   DeviceListEntry = object({
     device: MachineId,
     label: MachineLabel,
@@ -7314,10 +7220,9 @@ var init_device = __esm(() => {
   LinkPreview = object({ device: MachineId, label: MachineLabel, kind: DeviceKind, sas: Sas });
   KeyFingerprint = string2().regex(/^[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}$/, "key fingerprint");
   LoginUserCode = string2().regex(/^[A-HJ-NP-Z2-9]{5}-[A-HJ-NP-Z2-9]{5}$/, "user code");
-  LoginPurpose = _enum(["bind", "remove"]);
+  LoginPurpose = _enum(["bind", "remove", "replace", "erase"]);
   LoginKind = _enum(["laptop", "server", "other"]);
   LoginShown = object({
-    verificationUriComplete: string2().url().max(2048),
     verificationUri: string2().url().max(2048),
     userCode: LoginUserCode,
     fingerprint: KeyFingerprint,
@@ -7332,6 +7237,14 @@ var init_device = __esm(() => {
   ]);
   DeviceRemoveParams = strictObject({ device: MachineId, reason: _enum(["self", "removed", "lost"]).optional(), token: Jws.optional() });
   DeviceApproveParams = strictObject({ link: LinkText, sas: Sas });
+  IdentityReplaceParams = strictObject({
+    token: Jws.optional(),
+    label: MachineLabel.optional()
+  });
+  SignInStep = LoginShown.extend({ state: literal("sign-in"), purpose: LoginPurpose, interval: number2().int().positive() });
+  DirectoryEraseParams = strictObject({
+    token: Jws.optional()
+  });
   DEVICE_METHODS = {
     "device.status": { params: strictObject({}), result: DeviceStatus },
     "device.bind": {
@@ -7361,6 +7274,47 @@ var init_device = __esm(() => {
     "device.approve": {
       params: DeviceApproveParams,
       result: object({ device: MachineId, seq: number2().int().nonnegative() })
+    },
+    "identity.replace": {
+      params: IdentityReplaceParams,
+      result: discriminatedUnion("state", [
+        object({ state: literal("done"), person: PersonId, device: MachineId, predecessor: MachineId, seq: number2().int().nonnegative() }),
+        object({ state: literal("token"), device: MachineId }),
+        SignInStep.extend({ device: MachineId })
+      ])
+    },
+    "identity.replace.preview": {
+      params: IdentityReplaceParams,
+      result: object({
+        predecessor: object({
+          device: MachineId,
+          label: MachineLabel,
+          kind: DeviceKind.optional(),
+          vouch: _enum(["jelly", "device"]),
+          via: _enum(["host", "browser"]).optional(),
+          since: Millis.optional(),
+          current: boolean2()
+        }),
+        alarm: _enum(["keys_missing", "restored"]).nullable(),
+        device: MachineId.optional(),
+        signIns: number2().int().min(0).max(2),
+        sentence: string2().max(600)
+      })
+    },
+    "directory.erase": {
+      params: DirectoryEraseParams,
+      result: discriminatedUnion("state", [object({ state: literal("done"), person: PersonId, devices: number2().int().nonnegative() }), SignInStep])
+    },
+    "directory.erase.preview": {
+      params: DirectoryEraseParams,
+      result: object({
+        person: PersonId,
+        devices: array(object({ device: MachineId, label: MachineLabel, kind: DeviceKind.optional(), self: boolean2() })),
+        signIns: number2().int().min(0).max(1),
+        perDay: number2().int().positive(),
+        lost: array(string2().max(300)).max(10),
+        kept: array(string2().max(300)).max(10)
+      })
     }
   };
 });
@@ -7541,7 +7495,7 @@ var init_consent2 = __esm(() => {
   HeldRequest = union([AskRequest, ContactRequestView, ContactSuggestion]);
   RequestAnswer = _enum(["once", "always", "accept", "decline", "block"]);
   RequestText = string2().min(1).refine((text) => text.length <= LIMITS.requestChars, { message: `at most ${LIMITS.requestChars} UTF-16 code units` });
-  PersonReach = object({ person: PersonId, can: CardCan, source: _enum(["card", "default"]), at: Millis.optional() });
+  PersonReach = object({ person: PersonId, can: CardCan, source: _enum(["card", "default"]), at: Millis.optional(), devicesChangedAt: Millis.optional() });
   RequestAnswerParams = strictObject({ id: Ulid, answer: RequestAnswer, all: boolean2().optional() });
   ContactRequestParams = strictObject({ email: Email, text: RequestText, suggestion: Ulid.optional() });
   CONSENT_METHODS = {
@@ -7586,6 +7540,7 @@ var init_surfaces = __esm(() => {
   init_directory_frames();
   init_errors3();
   init_consent2();
+  init_device();
   init_shapes();
   ConversationRef = string2().regex(/^(?:dm:(?:[a-z][a-z0-9-]{0,31}|p_[a-z2-7]{26})|channel:[a-z][a-z0-9-]{0,31}|agent:(?:[a-z][a-z0-9-]{0,31}|p_[a-z2-7]{26})\/[a-z0-9][a-z0-9._-]{0,63})$/, "dm:<person>, channel:<name> or agent:<person>/<agent>");
   ConvPlace = union([ChatSeq, ConvCursor]);
@@ -7626,7 +7581,6 @@ var init_surfaces = __esm(() => {
         referenceTaskIds: array(Ulid).max(16).optional(),
         wake: boolean2().optional().describe("hint that the recipient may wake an idle session; default true"),
         request: strictObject({ contact: Email }).optional(),
-        external: strictObject({ principal: string2().min(1).max(64) }).optional(),
         onBehalfOf: strictObject({
           taskId: Ulid.describe("a task this session executes"),
           scope: array(DelegationScope).max(LIMITS.delegationScopes).optional().describe("narrow the scope; never wider than the task's"),
@@ -7690,13 +7644,16 @@ var init_surfaces = __esm(() => {
     },
     "people.get": {
       params: strictObject({ person: PersonId }),
-      result: PersonSummary.extend({ devices: array(object({ device: MachineId, label: MachineLabel, self: boolean2(), away: literal(true).optional() })) })
+      result: PersonSummary.extend({
+        devices: array(object({ device: MachineId, label: MachineLabel, self: boolean2(), away: literal(true).optional() })),
+        deviceChanges: array(DeviceChangeView).max(10).optional()
+      })
     }
   };
 });
 
 // packages/core/dist/schema/ipc/jelly.js
-var NoticeId, NOTICE_LINE_CHARS = 120, Notice, NoticeCounts, DaemonHealth, AgentSummary, AgentConversation, JELLY_METHODS;
+var NoticeId, NOTICE_LINE_CHARS = 120, NoticeDevice, Notice, NoticeCounts, DaemonHealth, AgentSummary, AgentConversation, JELLY_METHODS;
 var init_jelly2 = __esm(() => {
   init_zod();
   init_common();
@@ -7707,12 +7664,18 @@ var init_jelly2 = __esm(() => {
   init_shapes();
   init_surfaces();
   NoticeId = string2().regex(/^[mra]_[0-9A-Za-z]{1,64}$/, "notice id");
+  NoticeDevice = DeviceChangeView.extend({
+    replaces: object({ device: MachineId, label: MachineLabel }).optional(),
+    current: boolean2(),
+    remove: _enum(["token", "sign-in", "team"]).optional()
+  });
   Notice = object({
     id: NoticeId,
     category: _enum(["message", "request", "alert"]),
     conversation: ConversationRef.optional(),
     from: object({ name: string2().max(200), email: string2().max(320).optional(), org: _enum(["same", "other", "none"]) }).optional(),
     line: string2().max(NOTICE_LINE_CHARS).optional(),
+    device: NoticeDevice.optional(),
     at: Millis
   });
   NoticeCounts = object({ unread: number2().int().nonnegative(), requests: number2().int().nonnegative() });
@@ -7852,7 +7815,6 @@ var init_ipc = __esm(() => {
   InviteSummary = object({
     inviteId: Ulid,
     person: PersonName,
-    role: _enum(["member", "service"]),
     expires: Millis,
     state: _enum(["open", "redeemed", "revoked", "expired"])
   });
@@ -7863,7 +7825,7 @@ var init_ipc = __esm(() => {
     "session.register": {
       params: strictObject({
         key: SessionKey,
-        agent: AgentKind.describe('client kind, e.g. "opencode", "claude-code", "a2a-gateway"'),
+        agent: AgentKind.describe('client kind, e.g. "opencode", "claude-code"'),
         name: SessionName.optional().describe("requested name; the daemon may suffix it to keep it unique"),
         cwd: string2().max(1024).optional(),
         repo: string2().max(200).optional(),
@@ -7943,7 +7905,7 @@ var init_ipc = __esm(() => {
       result: object({ team: TeamId, name: TeamName, machine: MachineId })
     },
     "team.invite": {
-      params: strictObject({ person: PersonName, role: _enum(["member", "service"]).optional(), ttlMs: number2().int().min(60000).max(LIMITS.ttlMs).optional() }),
+      params: strictObject({ person: PersonName, ttlMs: number2().int().min(60000).max(LIMITS.ttlMs).optional() }),
       result: object({ ticket: string2(), inviteId: Ulid, expires: Millis })
     },
     "team.join": {
@@ -7967,8 +7929,7 @@ var init_ipc = __esm(() => {
         machine: MachineId,
         enc: EncKey,
         person: PersonName,
-        label: MachineLabel,
-        role: _enum(["member", "service"]).optional()
+        label: MachineLabel
       }),
       result: Ok
     },
@@ -8061,6 +8022,8 @@ var init_ipc = __esm(() => {
     "notice.ack",
     "device.approve.preview",
     "device.remove.preview",
+    "identity.replace.preview",
+    "directory.erase.preview",
     "channel.create",
     "channel.invite",
     "channel.leave",
@@ -8081,6 +8044,8 @@ var init_ipc = __esm(() => {
     "device.login.cancel",
     "device.approve",
     "identity.rotateEnc",
+    "identity.replace",
+    "directory.erase",
     "team.create",
     "team.invite",
     "team.join",
@@ -8130,7 +8095,6 @@ var init_schema = __esm(() => {
   init_roster();
   init_relay();
   init_directory_frames();
-  init_direct();
   init_ipc();
   init_device();
   init_consent2();
@@ -8161,7 +8125,7 @@ var init_b64u = __esm(() => {
 });
 
 // packages/core/dist/version.js
-var VERSION = "0.5.0";
+var VERSION = "0.7.0";
 
 // packages/core/dist/jcs.js
 function hasLoneSurrogate(text) {
@@ -8880,7 +8844,7 @@ function assertMeaning(type, from, to, klass, payload) {
     throw new MessagingError("invalid_request", "a self sync goes between devices of one person");
   if (p.conv?.kind === "card" && (from?.person === to.person || from?.agent !== undefined))
     throw new MessagingError("invalid_request", "a card goes from a person to another person");
-  const line = p.kind === "message" && p.external === undefined && p.message.taskId === undefined && Ulid.safeParse(p.message.messageId).success && (p.message.contextId === undefined || Ulid.safeParse(p.message.contextId).success);
+  const line = p.kind === "message" && p.message.taskId === undefined && Ulid.safeParse(p.message.messageId).success && (p.message.contextId === undefined || Ulid.safeParse(p.message.contextId).success);
   if (!line)
     throw new MessagingError("invalid_request", "a chat line is kind message, outside any task, with ULID messageId and contextId");
 }
@@ -9192,7 +9156,7 @@ class Roster {
         if (!verify(invite.invitePub, DOMAIN.invite, redeemClaim(this.team, inviteId, member), proof)) {
           throw new MessagingError("invite_invalid", "invite proof does not verify for this member");
         }
-        if (member.person !== invite.person || member.role !== invite.role) {
+        if (member.person !== invite.person || member.role !== "member") {
           throw new MessagingError("invite_invalid", "member does not match the invite");
         }
         this.#requireNew(member);
@@ -9328,14 +9292,12 @@ function createInvite(roster, identity, args) {
     inviteId,
     secret,
     person: args.person,
-    role: args.role,
     expires
   });
   const entry = createEntry(roster, identity, "invite.create", {
     inviteId,
     invitePub: rawPublicKey(seedKey(secret)),
     person: args.person,
-    role: args.role,
     expires
   }, now);
   return { entry, ticket, secret };
@@ -9357,7 +9319,7 @@ function decodeTicket(text) {
 function createRedeem(roster, ticket, identity, args) {
   if (ticket.team !== roster.team)
     throw new MessagingError("invite_invalid", "ticket is for another team");
-  const member = { machine: identity.machine, enc: identity.enc, person: ticket.person, role: ticket.role, label: args.label };
+  const member = { machine: identity.machine, enc: identity.enc, person: ticket.person, role: "member", label: args.label };
   const proof = signWith(seedKey(ticket.secret), DOMAIN.invite, redeemClaim(roster.team, ticket.inviteId, member));
   return createEntry(roster, identity, "invite.redeem", { inviteId: ticket.inviteId, proof, member }, args.now);
 }
@@ -9970,6 +9932,13 @@ class DeviceLog {
   token(seq) {
     return this.#state.tokens.get(seq);
   }
+  spentSignIn(jti) {
+    for (const [seq, token] of this.#state.tokens) {
+      if (token.claims.src === JELLY_DEVICE_SOURCE && token.claims.jti === jti && this.#state.entries[seq].op !== "unbind")
+        return true;
+    }
+    return false;
+  }
   bindingDeadline(seq) {
     const token = this.#state.tokens.get(seq);
     return token === undefined ? undefined : token.claims.exp * 1000 + LIMITS.clockSkewMs;
@@ -10022,6 +9991,14 @@ class DeviceLog {
       const { claims } = token;
       if (personId(claims.iss, claims.sub) !== this.person)
         throw refuse("Jelly token names another person");
+      if (claims.src === JELLY_DEVICE_SOURCE) {
+        for (const [seq, used] of state.tokens) {
+          if (used.claims.src !== JELLY_DEVICE_SOURCE || used.claims.jti !== claims.jti)
+            continue;
+          if (parsed.op !== "unbind" || state.entries[seq].op !== "unbind")
+            throw refuse("a sign-in's token vouches for one act: this one was used");
+        }
+      }
       if (parsed.ts < claims.iat * 1000 - LIMITS.clockSkewMs || parsed.ts > claims.exp * 1000 + LIMITS.clockSkewMs)
         throw refuse("log entry is dated outside its Jelly token's life");
       tokens.set(parsed.seq, token);
@@ -10106,6 +10083,7 @@ var init_device_log = __esm(() => {
   init_keys();
   init_sign();
   init_common();
+  init_jelly();
   init_directory();
   init_errors3();
   init_jelly_token();
@@ -10167,6 +10145,8 @@ function page(url, issuer) {
   }
   if (at.origin !== new URL(issuer).origin)
     throw new MessagingError("jelly_unavailable", "Jelly ID's sign-in page is not on its own origin");
+  if (at.search !== "" || at.hash !== "" || at.username !== "" || at.password !== "")
+    throw new MessagingError("jelly_unavailable", "Jelly ID's sign-in page carries a query or credentials");
   return at.href;
 }
 function readDeviceCodeAnswer(status, text, issuer) {
@@ -10175,9 +10155,7 @@ function readDeviceCodeAnswer(status, text, issuer) {
     if (!parsed.success)
       throw new MessagingError("jelly_unavailable", "Jelly ID's sign-in code could not be read");
     const a = parsed.data;
-    const complete = page(a.verification_uri_complete, issuer);
-    const plain = page(a.verification_uri, issuer);
-    return { deviceCode: a.device_code, userCode: a.user_code, verificationUri: plain, verificationUriComplete: complete, expiresInS: a.expires_in, intervalS: a.interval ?? LOGIN_INTERVAL_DEFAULT_S };
+    return { deviceCode: a.device_code, userCode: a.user_code, verificationUri: page(a.verification_uri, issuer), expiresInS: a.expires_in, intervalS: a.interval };
   }
   const answer = errorOf(text);
   switch (answer?.error) {
@@ -10217,8 +10195,6 @@ function readDevicePoll(status, text) {
     case "invalid_client":
     case "unsupported_grant_type":
       throw unsupported("it refused this device client");
-    case "invalid_request":
-      throw new MessagingError("invalid_request", "Jelly ID refused the poll as malformed");
     default:
       return { kind: "retry" };
   }
@@ -10236,7 +10212,7 @@ function deviceCodeForm(args) {
 function devicePollForm(args) {
   return new URLSearchParams({ grant_type: DEVICE_GRANT_TYPE, device_code: args.deviceCode, client_id: args.clientId });
 }
-var DEVICE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code", LOGIN_SLOW_DOWN_S = 5, LOGIN_INTERVAL_DEFAULT_S = 5, LOGIN_INTERVAL_MAX_S = 60, JELLY_ANSWER_BYTES = 65536, ResourceName, Metadata, unsupported = (why) => new MessagingError("login_unsupported", `Jelly ID does not offer device sign-in yet: ${why}`), CodeAnswer, ErrorAnswer, TokenAnswer;
+var DEVICE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code", LOGIN_SLOW_DOWN_S = 5, LOGIN_INTERVAL_MAX_S = 60, JELLY_ANSWER_BYTES = 65536, ResourceName, Metadata, unsupported = (why) => new MessagingError("login_unsupported", `Jelly ID does not offer device sign-in yet: ${why}`), CodeAnswer, ErrorAnswer, TokenAnswer;
 var init_jelly_device = __esm(() => {
   init_b64u();
   init_keys();
@@ -10251,12 +10227,11 @@ var init_jelly_device = __esm(() => {
     jelly_resource_device_token_endpoint: string2().max(2048).optional()
   });
   CodeAnswer = looseObject({
-    device_code: string2().min(1).max(512),
+    device_code: string2().min(22).max(256),
     user_code: string2().regex(/^[A-HJ-NP-Z2-9]{5}-[A-HJ-NP-Z2-9]{5}$/),
     verification_uri: string2().max(2048),
-    verification_uri_complete: string2().max(2048),
     expires_in: number2().int().positive().max(3600),
-    interval: number2().int().positive().max(LOGIN_INTERVAL_MAX_S).optional()
+    interval: number2().int().positive().max(LOGIN_INTERVAL_MAX_S)
   });
   ErrorAnswer = looseObject({ error: string2().max(64), detail: string2().max(64).optional() });
   TokenAnswer = looseObject({ access_token: string2().min(1).max(8192), token_type: string2().max(32) });
@@ -10655,6 +10630,31 @@ function verifyPersonView(view, context) {
     throw asMessagingError(error, "person view");
   }
 }
+function checkPersonSuccession(earlier, later) {
+  if (earlier.person !== later.person)
+    throw new MessagingError("invalid_request", "the two states are of two persons");
+  if (earlier.erased || later.erased)
+    return;
+  const ours = earlier.log.entries();
+  const theirs = later.log.entries();
+  if (theirs.length < ours.length)
+    throw new DirectoryInconsistency("a later tree head serves a shorter log", { kind: "rollback", what: "log", ours: ours.length, theirs: theirs.length });
+  for (let seq = 0;seq < ours.length; seq++) {
+    if (logEntryHash(ours[seq]) !== logEntryHash(theirs[seq]))
+      throw new DirectoryInconsistency("the log differs from the one held", { kind: "fork", seq, ours: ours[seq], theirs: theirs[seq] });
+  }
+  for (const [device, statement] of earlier.keys) {
+    if (!later.log.device(device)?.current)
+      continue;
+    const next = later.keys.get(device);
+    if (!next)
+      throw new DirectoryInconsistency("a held keys statement is withheld", { kind: "rollback", what: "keys", ours: statement.seq, theirs: -1 });
+    if (next.seq < statement.seq)
+      throw new DirectoryInconsistency("a keys statement is older than the one held", { kind: "rollback", what: "keys", ours: statement.seq, theirs: next.seq });
+    if (next.seq === statement.seq && keysStatementHash(next) !== keysStatementHash(statement))
+      throw fail("two keys statements share a device and seq");
+  }
+}
 function checkWitness(witness, seq, deadline, log, person, sth) {
   const epoch = verifyEpochProof(sth, witness.epoch);
   const committed = witness.value.log;
@@ -10665,6 +10665,33 @@ function checkWitness(witness, seq, deadline, log, person, sth) {
   if (epoch.leaf.ts > deadline)
     throw new MessagingError("binding_invalid", "a Jelly binding first appeared after its token's life");
 }
+function verifyPersonHead(view, context) {
+  try {
+    const parsed = parseWith(PersonHead, view, "person head");
+    const { sth } = context;
+    const head = verifyEpochProof(sth, context.head);
+    if (head.index !== sth.size - 1)
+      throw fail("the head epoch is not the tree head's last");
+    const mapRoot = head.leaf.mapRoot;
+    if (parsed.tombstone) {
+      if (parsed.value)
+        throw new MessagingError("invalid_request", "an erased person has no head");
+      if (!verifyMapProof(mapRoot, parsed.person, TOMBSTONE, parsed.mapProof))
+        throw new DirectoryInconsistency("the map does not hold the tombstone", { kind: "map", sth, head });
+      return { person: parsed.person, state: "erased" };
+    }
+    if (!parsed.value) {
+      if (!verifyMapProof(mapRoot, parsed.person, undefined, parsed.mapProof))
+        throw new DirectoryInconsistency("the map holds a person served as absent", { kind: "map", sth, head });
+      return { person: parsed.person, state: "absent" };
+    }
+    if (!verifyMapProof(mapRoot, parsed.person, mapValue(parsed.value), parsed.mapProof))
+      throw new DirectoryInconsistency("the map does not commit to the head served", { kind: "map", sth, head });
+    return { person: parsed.person, state: "live", log: parsed.value.log, keys: parsed.value.keys };
+  } catch (error) {
+    throw asMessagingError(error, "person head");
+  }
+}
 var DirectoryInconsistency, fail = (what) => new MessagingError("directory_inconsistent", what);
 var init_person_view = __esm(() => {
   init_check();
@@ -11016,8 +11043,6 @@ function grant(identity, args) {
   const raw = args.parent;
   const parent = raw === undefined ? undefined : parseWith(DelegationGrant, raw, "parent grant");
   if (parent !== undefined) {
-    if (args.external !== undefined)
-      throw new MessagingError("invalid_request", "only a root grant names an external principal");
     if (parent.to !== args.from)
       throw new MessagingError("invalid_request", "a grant extends the grant to its delegating session");
   }
@@ -11042,8 +11067,7 @@ function grant(identity, args) {
     exp,
     maxDepth,
     ...scope !== undefined ? { scope: [...scope] } : {},
-    ...raw !== undefined ? { parent: grantHash(raw) } : {},
-    ...args.external !== undefined ? { external: { principal: args.external.principal } } : {}
+    ...raw !== undefined ? { parent: grantHash(raw) } : {}
   };
   parseWith(DelegationGrant.omit({ sig: true }), unsigned, "delegation grant");
   return { ...unsigned, sig: sign(identity, DOMAIN.delegation, unsigned) };
@@ -11065,7 +11089,7 @@ function check2(raw, ctx) {
     throw new MessagingError("too_large", `a delegation chain is limited to ${LIMITS.delegationBytes} bytes`);
   let maxDepth = LIMITS.delegationDepth;
   let previous;
-  for (const [index, grant] of grants.entries()) {
+  for (const grant of grants) {
     const { sig, ...unsigned } = grant;
     const input = signingInput(DOMAIN.delegation, unsigned);
     if (grant.realm !== realm.realm)
@@ -11087,9 +11111,6 @@ function check2(raw, ctx) {
     }
     if (!verifyInput(grant.by, input, sig))
       throw new MessagingError("bad_signature", "a grant signature is invalid");
-    if (grant.external !== undefined && (index > 0 || signer.role !== "service")) {
-      throw new MessagingError("forbidden", "only a service member's root grant names an external principal");
-    }
     if (previous === undefined) {
       if (grant.parent !== undefined)
         throw new MessagingError("invalid_request", "a root grant has no parent");
@@ -11118,9 +11139,6 @@ function check2(raw, ctx) {
   if (last.by !== hop.by || last.from !== hop.from || last.to !== hop.to || last.task !== hop.task) {
     throw new MessagingError("forbidden", "the chain does not authorize this request");
   }
-  const external = grants.length === 1 ? root.external?.principal : undefined;
-  if (external !== hop.external)
-    throw new MessagingError("forbidden", "the chain's external principal does not match the request");
   return {
     grants: structuredClone(grants),
     summary: {
@@ -11128,7 +11146,6 @@ function check2(raw, ctx) {
       depth: grants.length,
       maxDepth,
       ...last.scope !== undefined ? { scope: [...last.scope] } : {},
-      ...root.external !== undefined ? { external: { principal: root.external.principal, gateway: root.by } } : {},
       exp: Math.min(...grants.map((grant) => grant.exp))
     }
   };
@@ -11190,103 +11207,8 @@ var init_task = __esm(() => {
   };
 });
 
-// packages/core/dist/direct.js
-import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, createHash as createHash7, diffieHellman as diffieHellman2, generateKeyPairSync as generateKeyPairSync3, hkdfSync as hkdfSync2, randomBytes as randomBytes4 } from "crypto";
-function directEphemeral() {
-  const key = generateKeyPairSync3("x25519").privateKey;
-  return { key, half: { epk: rawPublicKey(key), nonce: b64u.encode(randomBytes4(32)) } };
-}
-function directTranscript(initiator, responder) {
-  return { proto: DIRECT_PROTOCOL, initiator: { epk: initiator.epk, nonce: initiator.nonce }, responder: { epk: responder.epk, nonce: responder.nonce } };
-}
-function directAuthPayload(args) {
-  const { transcript, team, role, machine, peer } = args;
-  if (role === "initiator" !== (peer !== undefined))
-    throw new MessagingError("invalid_request", "only the initiator names its peer");
-  return { ...transcript, team, role, machine, ...peer === undefined ? {} : { peer } };
-}
-function directKeys(own, peerEpk, transcript) {
-  let shared;
-  try {
-    shared = diffieHellman2({ privateKey: own, publicKey: publicKeyFromRaw("x25519", peerEpk) });
-  } catch {
-    throw new MessagingError("bad_signature", "the peer's handshake key is not usable");
-  }
-  if (shared.every((byte) => byte === 0))
-    throw new MessagingError("bad_signature", "the peer's handshake key is not usable");
-  const salt = createHash7("sha256").update(canonicalize(transcript)).digest();
-  const okm = new Uint8Array(hkdfSync2("sha256", shared, salt, DOMAIN.directLink, 128));
-  return {
-    box: { responder: okm.slice(0, 32), initiator: okm.slice(32, 64) },
-    record: { initiator: okm.slice(64, 96), responder: okm.slice(96, 128) }
-  };
-}
-function sealDirectBox(key, transcript, identity) {
-  const cipher = createCipheriv2("aes-256-gcm", key, ZERO_NONCE, { authTagLength: TAG_BYTES2 });
-  cipher.setAAD(utf8(canonicalize(transcript)));
-  return b64u.encode(Buffer.concat([cipher.update(utf8(canonicalize(identity))), cipher.final(), cipher.getAuthTag()]));
-}
-function openDirectBox(key, transcript, box) {
-  let plaintext;
-  try {
-    const bytes = b64u.decode(box);
-    if (bytes.length <= TAG_BYTES2)
-      throw new Error("short");
-    const decipher = createDecipheriv2("aes-256-gcm", key, ZERO_NONCE, { authTagLength: TAG_BYTES2 });
-    decipher.setAAD(utf8(canonicalize(transcript)));
-    decipher.setAuthTag(bytes.subarray(bytes.length - TAG_BYTES2));
-    plaintext = Buffer.concat([decipher.update(bytes.subarray(0, bytes.length - TAG_BYTES2)), decipher.final()]);
-  } catch {
-    throw new MessagingError("bad_signature", "the handshake box does not open");
-  }
-  return parseWire(plaintext.toString("utf8"), { maxBytes: DIRECT_HANDSHAKE_BYTES });
-}
-
-class DirectCipher {
-  #key;
-  #counter = 0;
-  constructor(key) {
-    if (key.length !== 32)
-      throw new MessagingError("invalid_request", "a record key is 32 bytes");
-    this.#key = key;
-  }
-  seal(plaintext) {
-    const cipher = createCipheriv2("aes-256-gcm", this.#key, this.#nonce(), { authTagLength: TAG_BYTES2 });
-    return Buffer.concat([cipher.update(plaintext), cipher.final(), cipher.getAuthTag()]);
-  }
-  open(record) {
-    try {
-      if (record.length < TAG_BYTES2)
-        throw new Error("short");
-      const decipher = createDecipheriv2("aes-256-gcm", this.#key, this.#nonce(), { authTagLength: TAG_BYTES2 });
-      decipher.setAuthTag(record.subarray(record.length - TAG_BYTES2));
-      return Buffer.concat([decipher.update(record.subarray(0, record.length - TAG_BYTES2)), decipher.final()]);
-    } catch {
-      throw new MessagingError("bad_signature", "a direct record does not open");
-    }
-  }
-  #nonce() {
-    if (this.#counter >= Number.MAX_SAFE_INTEGER)
-      throw new MessagingError("internal", "record counter exhausted");
-    const nonce = Buffer.alloc(NONCE_BYTES2);
-    nonce.writeBigUInt64BE(BigInt(this.#counter++), 4);
-    return nonce;
-  }
-}
-var NONCE_BYTES2 = 12, TAG_BYTES2 = 16, ZERO_NONCE;
-var init_direct2 = __esm(() => {
-  init_b64u();
-  init_jcs();
-  init_keys();
-  init_common();
-  init_direct();
-  init_errors3();
-  init_wire();
-  ZERO_NONCE = new Uint8Array(NONCE_BYTES2);
-});
-
 // packages/core/dist/peer-text.js
-import { randomBytes as randomBytes5 } from "crypto";
+import { randomBytes as randomBytes4 } from "crypto";
 function addReading(code, letters) {
   const c = String.fromCodePoint(code);
   READINGS.set(c, (READINGS.get(c) ?? "") + letters);
@@ -11523,7 +11445,7 @@ function createFence(options) {
   if (!TAG.test(tag))
     throw new Error("fence tag must be lowercase words joined by hyphens");
   const stem = tag.split("-")[0];
-  const random = options.random ?? randomBytes5;
+  const random = options.random ?? randomBytes4;
   const opened = new RegExp(`<${tag}-[${NONCE_ALPHABET}]{${NONCE_LENGTH}}[ >]`);
   const neutralize = (text, clean = {}) => render(text, { singleLine: clean.singleLine === true, maxChars: clean.maxChars, terminal: false, attribute: false, stem });
   function fence(body, attributes = {}, clean = {}, block) {
@@ -12645,7 +12567,6 @@ var init_agent_tools = __esm(() => {
       at: iso,
       parts: array(Part2),
       verified: _enum(["signature", "none"]).optional().describe("signature: the daemon checked the sender's signature"),
-      external: fenced("An outside A2A principal it came from, through the gateway").optional(),
       replyTo: string2().optional(),
       chain: Chain.optional(),
       task: Task2.optional(),
@@ -12775,7 +12696,6 @@ var init_dist = __esm(() => {
   init_delegation2();
   init_task();
   init_a2a();
-  init_direct2();
   init_peer_text();
   init_agent_tools();
   init_operations();
@@ -12903,13 +12823,13 @@ var init_paths = __esm(() => {
 });
 
 // packages/ipc/dist/pipes.js
-import { randomBytes as randomBytes6 } from "crypto";
+import { randomBytes as randomBytes5 } from "crypto";
 import { readFileSync, renameSync, rmSync, writeFileSync } from "fs";
 function newPipeName(tier) {
-  return `\\\\.\\pipe\\messaging-${randomBytes6(16).toString("hex")}-${tier}`;
+  return `\\\\.\\pipe\\messaging-${randomBytes5(16).toString("hex")}-${tier}`;
 }
 function writePointer(path, pointer) {
-  const temp = `${path}.${process.pid}.${randomBytes6(4).toString("hex")}.tmp`;
+  const temp = `${path}.${process.pid}.${randomBytes5(4).toString("hex")}.tmp`;
   try {
     writeFileSync(temp, `${JSON.stringify(pointer)}
 `, { flag: "wx" });
@@ -12965,7 +12885,7 @@ var init_rpc = __esm(() => {
 
 // packages/ipc/dist/windows-acl.js
 import { spawnSync } from "child_process";
-import { randomBytes as randomBytes7 } from "crypto";
+import { randomBytes as randomBytes6 } from "crypto";
 import { existsSync, readFileSync as readFileSync2, rmSync as rmSync2 } from "fs";
 import { tmpdir } from "os";
 import { join as join2 } from "path";
@@ -13080,7 +13000,7 @@ function currentUserSid() {
   return sid;
 }
 function readDacl(path) {
-  const out = join2(tmpdir(), `messaging-acl-${process.pid}-${randomBytes7(8).toString("hex")}.txt`);
+  const out = join2(tmpdir(), `messaging-acl-${process.pid}-${randomBytes6(8).toString("hex")}.txt`);
   try {
     run("icacls.exe", [path, "/save", out, "/q"]);
     return parseSddlDacl(sddlLine(readFileSync2(out)));
@@ -13859,85 +13779,6 @@ var init_dist2 = __esm(() => {
   init_windows_acl();
 });
 
-// packages/daemon/dist/direct-config.js
-import { BlockList, isIP } from "net";
-function parseHostPort(text) {
-  const match = /^\[([0-9A-Fa-f:.]+)\](?::(\d{1,5}))?$/.exec(text) ?? /^([0-9.]+)(?::(\d{1,5}))?$/.exec(text);
-  if (!match)
-    return;
-  const host = match[1];
-  const family = isIP(host);
-  if (family === 0 || family === 6 !== text.startsWith("["))
-    return;
-  const port = match[2] === undefined ? undefined : Number(match[2]);
-  if (port !== undefined && port > 65535)
-    return;
-  return { host, port };
-}
-function family(host) {
-  const f = isIP(host);
-  return f === 4 ? "ipv4" : f === 6 ? "ipv6" : undefined;
-}
-function isLoopback(host) {
-  const f = family(host);
-  return f !== undefined && LOOPBACK.check(host, f);
-}
-function isWildcard(host) {
-  return host === "0.0.0.0" || host === "::";
-}
-function isDirectHost(host) {
-  const f = family(host);
-  return f !== undefined && (LOOPBACK.check(host, f) || LAN.check(host, f));
-}
-function mayDial(endpoint, ownListenerOnLoopback) {
-  if (!isDirectHost(endpoint.host))
-    return false;
-  return !isLoopback(endpoint.host) || ownListenerOnLoopback;
-}
-function advertisedEndpoints(config, bound) {
-  if (config.advertise === undefined)
-    return isWildcard(bound.host) ? [] : [{ host: bound.host, port: bound.port }];
-  return config.advertise.map((text) => {
-    const parsed = parseHostPort(text);
-    return { host: parsed.host, port: parsed.port ?? bound.port };
-  });
-}
-var DEFAULT_DIRECT_LISTEN = "127.0.0.1:0", LOOPBACK, LAN, ListenAddress, AdvertiseAddress, DirectConfig;
-var init_direct_config = __esm(() => {
-  init_zod();
-  LOOPBACK = new BlockList;
-  LOOPBACK.addSubnet("127.0.0.0", 8, "ipv4");
-  LOOPBACK.addAddress("::1", "ipv6");
-  LAN = new BlockList;
-  for (const [net, prefix] of [
-    ["10.0.0.0", 8],
-    ["172.16.0.0", 12],
-    ["192.168.0.0", 16],
-    ["100.64.0.0", 10],
-    ["169.254.0.0", 16]
-  ]) {
-    LAN.addSubnet(net, prefix, "ipv4");
-  }
-  LAN.addSubnet("fe80::", 10, "ipv6");
-  LAN.addSubnet("fc00::", 7, "ipv6");
-  ListenAddress = string2().refine((text) => {
-    const parsed = parseHostPort(text);
-    return parsed?.port !== undefined && (isWildcard(parsed.host) || isDirectHost(parsed.host));
-  }, "listen must be ip:port (IPv6 in brackets) on loopback, a private or link-local address, or all interfaces");
-  AdvertiseAddress = string2().refine((text) => {
-    const parsed = parseHostPort(text);
-    return parsed !== undefined && parsed.port !== 0 && isDirectHost(parsed.host);
-  }, "advertise entries must be ip or ip:port (IPv6 in brackets) on loopback or a private or link-local address");
-  DirectConfig = object({
-    enabled: boolean2().optional(),
-    listen: ListenAddress.optional(),
-    advertise: array(AdvertiseAddress).min(1).max(4).optional()
-  }).strict().refine((c) => c.enabled !== true || c.advertise !== undefined || !isWildcard(parseHostPort(c.listen ?? DEFAULT_DIRECT_LISTEN).host), {
-    message: "advertise is required when listening on all interfaces",
-    path: ["advertise"]
-  });
-});
-
 // packages/daemon/dist/identity/record.js
 import { createPrivateKey as createPrivateKey2 } from "crypto";
 import { closeSync as closeSync2, constants as constants3, existsSync as existsSync3, fstatSync, fsyncSync, linkSync, readFileSync as readFileSync4, renameSync as renameSync2, rmSync as rmSync3, statSync, unlinkSync, writeSync } from "fs";
@@ -14214,7 +14055,6 @@ var init_home = __esm(() => {
   init_zod();
   init_dist();
   init_dist2();
-  init_direct_config();
   init_record();
   PRESENCE_FIELDS = ["repo", "branch", "doing"];
   PresenceField = _enum(PRESENCE_FIELDS);
@@ -14225,8 +14065,6 @@ var init_home = __esm(() => {
     label: MachineLabel.optional(),
     realm: DirectoryRealmConfig.strict().optional(),
     inbound: object({
-      refuse: array(PersonName).max(0, { error: 'inbound.refuse was replaced by block grants (spec \xA76.9): remove it, and block each person with grant.set {subject: {person}, chat: "blocked"}' }).optional(),
-      wake: literal("team", { error: "inbound.wake was removed: a push-tier session may be woken for what consent delivers to it; register sessions with tier pull to never wake them (spec \xA78.3)" }).optional(),
       quota: object({ items: number2().int().min(1), bytes: number2().int().min(1) }).partial().strict().optional()
     }).strict().optional(),
     presence: object({ share: array(PresenceField).max(PRESENCE_FIELDS.length) }).strict().optional(),
@@ -14240,7 +14078,6 @@ var init_home = __esm(() => {
       transcriptDays: number2().int().min(1).max(36500)
     }).partial().strict().optional(),
     ipc: object({ agentGroup: number2().int().min(0).max(4294967294) }).partial().strict().optional(),
-    transport: object({ direct: DirectConfig.optional() }).strict().optional(),
     identity: object({
       store: _enum(["auto", "file", "keychain"]),
       prompt: boolean2(),
@@ -14828,8 +14665,6 @@ function machineLoopGuard() {
 function inboundPolicy(facts, state, now) {
   if (!facts.recipient)
     return "unknown_session";
-  if (facts.recipient.agent === GATEWAY_AGENT)
-    return "refused";
   if (facts.task && facts.recipient.agent === CLI_AGENT)
     return "refused";
   const agents = facts.sender.agent !== CLI_AGENT && facts.recipient.agent !== CLI_AGENT;
@@ -14840,8 +14675,6 @@ ${facts.recipient.session}`, now))
   if (agents && !state.machineLoop.take(`${facts.sender.machine}
 ${facts.recipient.session}`, now))
     return "loop_guard";
-  if (facts.external && facts.sender.role !== "service")
-    return "forbidden";
   return;
 }
 function isFinalStage(stage) {
@@ -14857,7 +14690,7 @@ function canAdvance(from, to) {
 function inboxAdvances(from, to) {
   return INBOX_RANK[to] > INBOX_RANK[from];
 }
-var RESPONSE_RATE_FACTOR = 4, CHAT_SEND_PER_MACHINE_PER_MINUTE, DEFER_MARGIN_MS = 60000, RESPONSE_TYPES, LOOP_MACHINE_FACTOR = 2, GATEWAY_AGENT = "a2a-gateway", STAGE_RANK, INBOX_RANK;
+var RESPONSE_RATE_FACTOR = 4, CHAT_SEND_PER_MACHINE_PER_MINUTE, DEFER_MARGIN_MS = 60000, RESPONSE_TYPES, LOOP_MACHINE_FACTOR = 2, STAGE_RANK, INBOX_RANK;
 var init_policy = __esm(() => {
   init_dist();
   CHAT_SEND_PER_MACHINE_PER_MINUTE = LIMITS.inboundPerMachinePerMinute - 10;
@@ -14877,7 +14710,7 @@ var init_policy = __esm(() => {
 });
 
 // packages/daemon/dist/chat.js
-import { createHash as createHash8 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 
 class Chats {
   #host;
@@ -14952,7 +14785,7 @@ class Chats {
   }
   send(p, session, scope = "") {
     const room = p.conversation;
-    const digest = p.clientId === undefined ? undefined : createHash8("sha256").update(JSON.stringify([room, p.thread ?? "", p.text])).digest("base64url");
+    const digest = p.clientId === undefined ? undefined : createHash7("sha256").update(JSON.stringify([room, p.thread ?? "", p.text])).digest("base64url");
     if (p.clientId !== undefined) {
       const earlier = this.#store.chatSend(scope, p.clientId);
       if (earlier) {
@@ -15349,7 +15182,7 @@ var init_chat = __esm(() => {
 });
 
 // packages/daemon/dist/log.js
-import { closeSync as closeSync5, constants as constants5, lstatSync as lstatSync3, renameSync as renameSync6, writeSync as writeSync2 } from "fs";
+import { closeSync as closeSync5, constants as constants5, lstatSync as lstatSync3, renameSync as renameSync6, writeSync as writeSync3 } from "fs";
 function formatLine(level, event, fields = {}) {
   const record = { t: new Date().toISOString(), level, event };
   for (const [name, value] of Object.entries(fields))
@@ -15378,7 +15211,7 @@ function createLogger(options) {
         }
         const fd = openNoFollow(file, constants5.O_WRONLY | constants5.O_APPEND | constants5.O_CREAT, 384);
         try {
-          writeSync2(fd, line);
+          writeSync3(fd, line);
         } finally {
           closeSync5(fd);
         }
@@ -15445,9 +15278,9 @@ var init_log = __esm(() => {
 });
 
 // packages/daemon/dist/keyring.js
-import { createHash as createHash9, generateKeyPairSync as generateKeyPairSync4 } from "crypto";
+import { createHash as createHash8, generateKeyPairSync as generateKeyPairSync3 } from "crypto";
 function rotationOffset(machine) {
-  return createHash9("sha256").update(machine).digest().readUInt32BE(0) % ROTATION_SPREAD_MS;
+  return createHash8("sha256").update(machine).digest().readUInt32BE(0) % ROTATION_SPREAD_MS;
 }
 function rotationDue(now, rotatedAt, days, machine) {
   return days > 0 && now >= rotatedAt + days * DAY_MS + rotationOffset(machine);
@@ -15666,7 +15499,7 @@ class Keyring {
     if (kept.length >= MAX_RETAINED) {
       throw new MessagingError("invalid_state", "too many retained encryption keys; wait until the oldest expires, then rotate again");
     }
-    const next = withEncKey(identity, generateKeyPairSync4("x25519").privateKey);
+    const next = withEncKey(identity, generateKeyPairSync3("x25519").privateKey);
     const pending = { identity: next, retained: [{ key: identity.encKey }, ...kept] };
     store.save(pending);
     this.#keys = pending;
@@ -15701,7 +15534,7 @@ var init_keyring = __esm(() => {
 });
 
 // packages/daemon/dist/directory.js
-function presencePayload(rows, label, seq, extra, policy) {
+function presencePayload(rows, label, seq, policy) {
   const { share } = policy;
   const sessions = rows.slice(0, LIMITS.presenceSessions).map((s) => {
     const live = s.unregisteredAt === undefined;
@@ -15723,8 +15556,7 @@ function presencePayload(rows, label, seq, extra, policy) {
     seq,
     label,
     sessions: [],
-    features: [...FEATURES, ...extra?.features ?? []],
-    ...extra?.direct ? { direct: extra.direct } : {},
+    features: [...FEATURES],
     ...policy.away === true ? { away: true } : {}
   };
   return { ...payload, sessions: fitPresence(sessions, jcsBytes(payload), LIMITS.presenceBytes) };
@@ -15898,10 +15730,9 @@ function signHop(args) {
     now,
     ...last !== undefined ? { parent: last } : {},
     ...scope !== undefined ? { scope } : {},
-    ...maxDepth !== undefined ? { maxDepth } : {},
-    ...request.external !== undefined ? { external: { principal: request.external.principal } } : {}
+    ...maxDepth !== undefined ? { maxDepth } : {}
   });
-  const hop = { by: identity.machine, from, to: args.to, task: args.task, ...request.external !== undefined ? { external: request.external.principal } : {} };
+  const hop = { by: identity.machine, from, to: args.to, task: args.task };
   return verifyChain([...args.parent ?? [], grant], { realm, now, hop });
 }
 function inboundChain(raw, ctx) {
@@ -15909,8 +15740,7 @@ function inboundChain(raw, ctx) {
     by: ctx.sender.machine,
     from: formatAddress(ctx.sender.person, ctx.fromSession, ctx.sender.label),
     to: formatAddress(ctx.me.person, ctx.toSession, ctx.me.label),
-    task: ctx.task,
-    ...ctx.external !== undefined ? { external: ctx.external.principal } : {}
+    task: ctx.task
   };
   return verifyChain(raw, { realm: ctx.realm, now: ctx.now, hop });
 }
@@ -15952,14 +15782,16 @@ class RosterIdentity {
   #machine;
   #catchUp;
   #now;
-  #listeners = { "devices-changed": [], "self-changed": [], alarm: [] };
+  #listeners = { "devices-changed": [], "self-changed": [], "device-log": [], alarm: [] };
   #me;
+  #length;
   constructor(options) {
     this.roster = options.roster;
     this.#machine = options.machine;
     this.#catchUp = options.catchUp;
     this.#now = options.now;
     this.#me = this.#selfRecord();
+    this.#length = options.roster.entries().length;
   }
   get realm() {
     return this.roster.realm;
@@ -15990,6 +15822,31 @@ class RosterIdentity {
   successor(_device) {
     return;
   }
+  deviceChanges(person) {
+    const labels = new Map;
+    const out = [];
+    for (const entry of this.roster.entries()) {
+      const member = entry.kind === "member.add" ? entry.body : entry.kind === "invite.redeem" ? entry.body.member : entry.kind === "genesis" ? entry.body.founder : undefined;
+      if (member) {
+        labels.set(member.machine, member.label);
+        if (member.person === person && entry.kind !== "genesis")
+          out.push({ seq: entry.seq, change: "added", device: member.machine, label: member.label, vouch: "admin", by: entry.by, at: entry.ts });
+      } else if (entry.kind === "member.remove") {
+        const owner = this.#ownerAt(entry.body.machine);
+        if (owner === person)
+          out.push({ seq: entry.seq, change: "removed", device: entry.body.machine, label: labels.get(entry.body.machine) ?? "machine", vouch: "admin", by: entry.by, at: entry.ts });
+      }
+    }
+    return out;
+  }
+  #ownerAt(machine) {
+    for (const entry of this.roster.entries()) {
+      const member = entry.kind === "member.add" ? entry.body : entry.kind === "invite.redeem" ? entry.body.member : entry.kind === "genesis" ? entry.body.founder : undefined;
+      if (member?.machine === machine)
+        return member.person;
+    }
+    return;
+  }
   async devices(person, opts = {}) {
     if (opts.atLeast !== undefined && this.relate(opts.atLeast).relation === "ahead") {
       throw new MessagingError("roster_conflict", "the roster has not reached that anchor");
@@ -16033,6 +15890,20 @@ class RosterIdentity {
     }
     for (const listener of [...this.#listeners["devices-changed"]])
       listener();
+    const entries = this.roster.entries();
+    if (entries.length !== this.#length) {
+      const persons = new Set;
+      for (const entry of entries.slice(this.#length)) {
+        const member = entry.kind === "member.add" ? entry.body : entry.kind === "invite.redeem" ? entry.body.member : undefined;
+        const person = member?.person ?? (entry.kind === "member.remove" ? this.#ownerAt(entry.body.machine) : undefined);
+        if (person !== undefined)
+          persons.add(person);
+      }
+      this.#length = entries.length;
+      if (persons.size > 0)
+        for (const listener of [...this.#listeners["device-log"]])
+          listener([...persons].sort());
+    }
   }
   #selfRecord() {
     const me = this.roster.member(this.#machine);
@@ -16134,7 +16005,6 @@ class DeviceLogin {
     const pending = {
       state: "pending",
       purpose: args.purpose,
-      verificationUriComplete: code.verificationUriComplete,
       verificationUri: code.verificationUri,
       userCode: code.userCode,
       fingerprint: jellyKeyFingerprint(device),
@@ -16239,7 +16109,7 @@ var init_device_login = __esm(() => {
 });
 
 // packages/daemon/dist/realm/directory-identity.js
-import { randomBytes as randomBytes8 } from "crypto";
+import { randomBytes as randomBytes7 } from "crypto";
 
 class DirectoryIdentity {
   kind = "directory";
@@ -16248,16 +16118,18 @@ class DirectoryIdentity {
   #options;
   #cache;
   #keyring;
-  #listeners = { "devices-changed": [], "self-changed": [], alarm: [] };
+  #listeners = { "devices-changed": [], "self-changed": [], "device-log": [], alarm: [] };
   #head;
   #persons = new Map;
   #index = new Map;
   #own;
   #relations = new Map;
   #watching = new Set;
+  #watchRead = Promise.resolve();
   #alarm;
   #selfRecord;
   #monitoredAt = Number.NEGATIVE_INFINITY;
+  #bindAccepted = false;
   #pendingLink;
   constructor(options) {
     this.#options = options;
@@ -16317,7 +16189,10 @@ class DirectoryIdentity {
     const person = this.#own.person;
     if (!person)
       return false;
-    const record = this.#persons.get(person)?.state.log.device(this.#machine());
+    const held = this.#persons.get(person)?.state;
+    if (held?.erased)
+      return true;
+    const record = held?.log.device(this.#machine());
     return record !== undefined && !record.current;
   }
   persons() {
@@ -16338,6 +16213,12 @@ class DirectoryIdentity {
     }
     return;
   }
+  deviceChanges(person) {
+    const held = isHosted(person) ? this.#persons.get(person) : undefined;
+    if (!held || held.state.erased)
+      return [];
+    return deviceChangesOf(held.state.log);
+  }
   async devices(person, opts = {}) {
     if (!isHosted(person))
       return { person, devices: [], anchor: this.anchor(), fetchedAt: this.#options.now() };
@@ -16432,15 +16313,23 @@ class DirectoryIdentity {
     }
   }
   watch(persons) {
-    let grew = false;
+    const added = [];
     for (const person of persons) {
       if (!isHosted(person) || this.#watching.has(person) || this.#watching.size >= LIMITS.watchPersons)
         continue;
       this.#watching.add(person);
-      grew = true;
+      added.push(person);
     }
-    if (grew)
-      this.#call((link) => link.watch([...this.#watching])).catch(() => {});
+    if (added.length === 0)
+      return this.#watchRead;
+    this.#watchRead = this.#call((link) => link.watch([...this.#watching])).then(async () => {
+      const held = added.filter((person) => this.#persons.has(person));
+      if (held.length === 0)
+        return;
+      await this.#latest();
+      await this.#fetch(held);
+    }).catch(() => {});
+    return this.#watchRead;
   }
   on(event, listener) {
     const listeners = this.#listeners[event];
@@ -16451,6 +16340,10 @@ class DirectoryIdentity {
         listeners.splice(at, 1);
     };
   }
+  linkPerson() {
+    const binding = this.binding();
+    return binding.state !== "none" || this.#bindAccepted ? binding.person : undefined;
+  }
   alarm() {
     return this.#alarm;
   }
@@ -16460,6 +16353,8 @@ class DirectoryIdentity {
   binding() {
     const person = this.#own.person;
     const record = person ? this.#persons.get(person)?.state.log.device(this.#machine()) : undefined;
+    if (person && this.#persons.get(person)?.state.erased)
+      return { state: "removed", person };
     if (!person || !record)
       return { state: "none", ...person ? { person } : {} };
     if (!record.current)
@@ -16481,12 +16376,21 @@ class DirectoryIdentity {
       throw new MessagingError("binding_invalid", "this device was removed from its account; it cannot be bound again");
     const done = await this.#extendLog(async () => {
       await this.#latest();
-      await this.#fetch([person]);
-      const log = this.#persons.get(person)?.state.log;
-      const current = log?.device(identity.machine);
-      if (current && !current.current)
-        throw new MessagingError("binding_invalid", "this device was removed from its account; it cannot be bound again");
-      const head = log?.head();
+      let current;
+      let head;
+      if (this.#own.person === person && this.binding().state !== "none") {
+        await this.#fetch([person]);
+        const log = this.#persons.get(person)?.state.log;
+        current = log?.device(identity.machine);
+        if (current && !current.current)
+          throw new MessagingError("binding_invalid", "this device was removed from its account; it cannot be bound again");
+        head = log?.head();
+      } else {
+        const verified = await this.#headOf(person);
+        if (verified.state === "erased")
+          throw new MessagingError("binding_invalid", "the account was erased");
+        head = verified.state === "live" ? verified.log : undefined;
+      }
       const entry = signLogEntry(identity, {
         v: PROTOCOL,
         realm: this.realm,
@@ -16500,13 +16404,29 @@ class DirectoryIdentity {
         authority: { kind: "jelly", token }
       });
       this.#signed(entry, person);
-      return current ? await this.#call((link) => link.append(entry)) : await this.#call((link) => link.bind(entry));
+      if (current)
+        return await this.#call((link) => link.append(entry));
+      const bound = await this.#call((link) => link.bind(entry));
+      this.#bindAccepted = true;
+      return bound;
     });
     await this.#adoptAnnounced(done.sth);
     await this.#fetch([person]);
     await this.publishKeys();
     return { person, seq: done.seq };
   }
+  async awaitSelf() {
+    const person = this.#own.person;
+    if (!person)
+      throw new MessagingError("no_identity", "this device is not bound to an account");
+    for (let tries = 0;this.self() === undefined || !this.#index.has(this.#machine()); tries++) {
+      if (tries >= LOG_RETRIES)
+        throw unavailable("the directory has not committed this device's binding and keys yet");
+      await new Promise((resolve) => setTimeout(resolve, LOG_RETRY_MS));
+      await this.#latest();
+      await this.#fetch([person]);
+    }
+  }
   async publishKeys() {
     if (this.#alarm?.kind === "restored")
       throw new MessagingError("invalid_state", "this device runs from an older copy of its home; it publishes no keys");
@@ -16557,11 +16477,50 @@ class DirectoryIdentity {
     await this.#fetch([person]);
     return { seq: done.seq };
   }
+  async erase(token) {
+    const identity = this.#options.identity();
+    const person = this.#own.person;
+    if (!person || this.binding().state === "none" || this.removed())
+      throw new MessagingError("no_identity", "this device is not bound to an account");
+    if (this.binding().record?.vouch !== "jelly")
+      throw new MessagingError("forbidden", "a device approved by link erases nothing; erase from a device Jelly ID vouched for");
+    const entries = await this.#extendLog(async () => {
+      await this.#latest();
+      await this.#fetch([person]);
+      const log = this.#persons.get(person).state.log;
+      let head = log.head();
+      const out = [];
+      const devices = log.devices().sort((a, b) => Number(a.device === identity.machine) - Number(b.device === identity.machine));
+      for (const device of devices) {
+        const self = device.device === identity.machine;
+        const entry = signLogEntry(identity, {
+          v: PROTOCOL,
+          realm: this.realm,
+          person,
+          seq: head.seq + 1,
+          prev: head.hash,
+          ts: this.#options.now(),
+          op: "unbind",
+          device: device.device,
+          reason: self ? "self" : "removed",
+          authority: self ? { kind: "self" } : { kind: "jelly", token }
+        });
+        out.push(entry);
+        head = { seq: entry.seq, hash: logEntryHash(entry) };
+      }
+      for (const entry of out)
+        this.#signed(entry, person);
+      await this.#call((link) => link.erase(out, token));
+      return out;
+    });
+    await this.#latest().then(() => this.#fetch([person])).catch(() => {});
+    return { person, devices: entries.length, seq: entries.at(-1).seq };
+  }
   createLink(args) {
     if (this.#own.person !== undefined) {
       throw new MessagingError("invalid_state", this.removed() ? "this device was removed from its account; it cannot be bound again" : "this device is already bound");
     }
-    const link = createLinkRequest(this.#options.identity(), { realm: this.realm, label: args.label, kind: args.kind, nonce: randomBytes8(16), ts: this.#options.now() });
+    const link = createLinkRequest(this.#options.identity(), { realm: this.realm, label: args.label, kind: args.kind, nonce: randomBytes7(16), ts: this.#options.now() });
     this.#pendingLink = link;
     return { link: encodeLink(link), sas: linkSas(link), expires: link.ts + LIMITS.linkTtlMs };
   }
@@ -16755,8 +16714,9 @@ class DirectoryIdentity {
   async#fetch(persons) {
     if (!this.#head)
       await this.#latest();
+    const basis = new Map(persons.map((person) => [person, this.#persons.get(person)]));
     const ask = persons.map((person) => {
-      const held = this.#persons.get(person);
+      const held = basis.get(person);
       const length = held?.state.erased ? 0 : held?.state.log.length ?? 0;
       return length > 0 ? { person, knownSeq: length - 1 } : { person };
     });
@@ -16775,32 +16735,84 @@ class DirectoryIdentity {
       throw new MessagingError("directory_inconsistent", "the directory answered at another tree head");
     const now = this.#options.now();
     const views = new Map(answer.persons.map((view) => [view.person, view]));
+    const grew = [];
     for (const person of persons) {
       const view = views.get(person);
       if (!view)
         continue;
-      const state = await this.#verify(view, head);
+      const state = await this.#verify(view, head, basis.get(person)?.state);
+      const current = this.#persons.get(person);
+      if (current && current !== basis.get(person)) {
+        this.#succession(current.size > head.sth.size ? state : current.state, current.size > head.sth.size ? current.state : state);
+        if (current.size > head.sth.size)
+          continue;
+      }
+      const before = current?.state;
       this.#persons.set(person, { state, size: head.sth.size, fetchedAt: now });
       this.#cache.putPerson({ person, entries: [...state.log.entries()], keys: [...state.keys.values()], erased: state.erased, size: head.sth.size, fetchedAt: now });
+      if (state.log.length !== (before?.log.length ?? 0) || state.erased !== (before?.erased ?? false))
+        grew.push(person);
     }
     this.#changed();
+    if (grew.length > 0)
+      for (const listener of [...this.#listeners["device-log"]])
+        listener(grew);
+    const unwatched = persons.filter((person) => views.has(person) && !this.#watching.has(person));
+    if (unwatched.length > 0)
+      this.watch(unwatched);
+  }
+  async#headOf(person) {
+    if (!this.#head)
+      await this.#latest();
+    let head = this.#head;
+    let answer;
+    try {
+      answer = await this.#call((link) => link.heads([person], head.sth.size));
+    } catch (error) {
+      if (!(error instanceof MessagingError) || error.code !== "invalid_request")
+        throw error;
+      await this.#latest();
+      head = this.#head;
+      answer = await this.#call((link) => link.heads([person], head.sth.size));
+    }
+    if (answer.sth.size !== head.sth.size || answer.sth.root !== head.sth.root)
+      throw new MessagingError("directory_inconsistent", "the directory answered at another tree head");
+    const view = answer.persons.find((p) => p.person === person);
+    if (!view)
+      throw new MessagingError("directory_inconsistent", "the directory left out the person asked");
+    try {
+      return verifyPersonHead(view, { sth: head.sth, head: head.head });
+    } catch (error) {
+      this.#inconsistent(error);
+      throw error;
+    }
   }
-  async#verify(view, head) {
-    const known = this.#persons.get(view.person)?.state;
+  async#verify(view, head, known) {
     const tokens = view.log.flatMap((entry) => entry.authority.kind === "jelly" ? [entry.authority.token] : []);
     const keys = await this.#keyring.prepare(tokens, this.#options.now());
     this.#saveArchive();
     try {
       return verifyPersonView(view, { ...this.#context(view.person, keys), sth: head.sth, head: head.head, ...known && !known.erased ? { known } : {} });
     } catch (error) {
-      if (error instanceof DirectoryInconsistency) {
-        this.#raise({ kind: "directory", reason: error.message, at: this.#options.now(), evidence: error.evidence });
-      } else if (error instanceof MessagingError && error.code === "directory_inconsistent") {
-        this.#raise({ kind: "directory", reason: error.message, at: this.#options.now() });
-      }
+      this.#inconsistent(error);
+      throw error;
+    }
+  }
+  #succession(earlier, later) {
+    try {
+      checkPersonSuccession(earlier, later);
+    } catch (error) {
+      this.#inconsistent(error);
       throw error;
     }
   }
+  #inconsistent(error) {
+    if (error instanceof DirectoryInconsistency) {
+      this.#raise({ kind: "directory", reason: error.message, at: this.#options.now(), evidence: error.evidence });
+    } else if (error instanceof MessagingError && error.code === "directory_inconsistent") {
+      this.#raise({ kind: "directory", reason: error.message, at: this.#options.now() });
+    }
+  }
   #saveArchive() {
     this.#cache.setArchive(this.#keyring.archive());
   }
@@ -16905,6 +16917,56 @@ ${this.#index.get(me.machine)?.enc ?? ""}`;
     return mine === theirs ? "same" : "other";
   }
 }
+function deviceChangesOf(log) {
+  const vouch = new Map;
+  const record = new Map;
+  const out = [];
+  for (const entry of log.entries()) {
+    const token = log.token(entry.seq);
+    const via = token === undefined ? undefined : token.claims.hst !== undefined ? "host" : "browser";
+    if (entry.op === "bind") {
+      const v = entry.authority.kind === "jelly" ? "jelly" : "device";
+      vouch.set(entry.device, v);
+      record.set(entry.device, { label: entry.label, kind: entry.kind, host: via === "host" });
+      out.push({
+        seq: entry.seq,
+        change: "added",
+        device: entry.device,
+        label: entry.label,
+        kind: entry.kind,
+        vouch: v,
+        ...via ? { via } : {},
+        ...entry.authority.kind === "device" ? { approver: entry.authority.approver } : {},
+        by: entry.by,
+        at: entry.ts
+      });
+    } else if (entry.op === "attest") {
+      const known = record.get(entry.device);
+      const next = { label: entry.label ?? known?.label ?? "device", kind: entry.kind ?? known?.kind ?? "other", host: via === "host" };
+      record.set(entry.device, next);
+      const raised = vouch.get(entry.device) !== "jelly";
+      vouch.set(entry.device, "jelly");
+      if (raised)
+        out.push({ seq: entry.seq, change: "vouched", device: entry.device, label: next.label, kind: next.kind, vouch: "jelly", ...via ? { via } : {}, by: entry.by, at: entry.ts });
+    } else {
+      const known = record.get(entry.device);
+      const v = vouch.get(entry.device) ?? "device";
+      out.push({
+        seq: entry.seq,
+        change: entry.reason === "replaced" ? "replaced" : "removed",
+        device: entry.device,
+        label: known?.label ?? "device",
+        ...known ? { kind: known.kind } : {},
+        vouch: v,
+        ...v === "jelly" && known ? { via: known.host ? "host" : "browser" } : {},
+        by: entry.by,
+        reason: entry.reason,
+        at: entry.ts
+      });
+    }
+  }
+  return out;
+}
 function orgOf(email, domains) {
   if (email === undefined)
     return;
@@ -16989,7 +17051,7 @@ class DirectoryHome {
       url: this.#options.config.url,
       realm: realm.realm,
       identity: this.#options.identity,
-      person: () => realm.binding().person,
+      person: () => realm.linkPerson(),
       pushes: {
         changed: (persons, sth) => void realm.changed(persons, sth).catch((error) => this.#failed("directory.changed", error)),
         unbound: (entry, sth) => void realm.changed([entry.person], sth).catch((error) => this.#failed("directory.unbound", error)),
@@ -17123,7 +17185,6 @@ class DirectoryHome {
     const started = await this.#login.start({ purpose, label, kind });
     return {
       purpose,
-      verificationUriComplete: started.verificationUriComplete,
       verificationUri: started.verificationUri,
       userCode: started.userCode,
       fingerprint: started.fingerprint,
@@ -17141,7 +17202,26 @@ class DirectoryHome {
     this.#login.cancel();
     return { ok: true };
   }
+  async signIn(purpose, args) {
+    this.#removing = undefined;
+    this.#binding = undefined;
+    const started = await this.#login.start({ purpose, label: args.label, kind: args.kind });
+    return {
+      purpose,
+      verificationUri: started.verificationUri,
+      userCode: started.userCode,
+      fingerprint: started.fingerprint,
+      expires: started.expires,
+      interval: started.interval
+    };
+  }
   async#completeLogin(token, purpose) {
+    if (purpose === "replace" || purpose === "erase") {
+      const step = purpose === "replace" ? this.#options.replaceStep : this.#options.eraseStep;
+      if (!step)
+        throw new MessagingError("invalid_state", `this daemon does not ${purpose} through a sign-in`);
+      return step(token);
+    }
     if (purpose === "remove") {
       const removing = this.#removing;
       if (!removing)
@@ -17207,6 +17287,28 @@ var init_directory_home = __esm(() => {
   init_directory_identity();
 });
 
+// packages/daemon/dist/realm/directory-cache.js
+function memoryDirectoryCache(from) {
+  let head = from?.head();
+  const persons = new Map((from?.persons() ?? []).map((p) => [p.person, p]));
+  let archive = from?.archive() ?? [];
+  let own = from?.own() ?? { keysSeq: -1, signed: [] };
+  let alarm = from?.alarm();
+  const copy = (value) => structuredClone(value);
+  return {
+    head: () => copy(head),
+    setHead: (value) => void (head = copy(value)),
+    persons: () => [...persons.values()].map(copy),
+    putPerson: (value) => void persons.set(value.person, copy(value)),
+    archive: () => copy(archive),
+    setArchive: (keys) => void (archive = copy(keys)),
+    own: () => copy(own),
+    setOwn: (value) => void (own = copy(value)),
+    alarm: () => copy(alarm),
+    setAlarm: (value) => void (alarm = copy(value))
+  };
+}
+
 // packages/daemon/dist/jelly.js
 import { closeSync as closeSync6, constants as constants6, fstatSync as fstatSync3, readSync } from "fs";
 function jellyLabel(text) {
@@ -17537,12 +17639,12 @@ var init_answer_preview = __esm(() => {
 });
 
 // packages/daemon/dist/snapshot.js
-import { createHash as createHash10 } from "crypto";
+import { createHash as createHash9 } from "crypto";
 import { chmodSync as chmodSync4, chownSync as chownSync2, existsSync as existsSync6, lstatSync as lstatSync4, mkdirSync as mkdirSync5, readFileSync as readFileSync8, rmSync as rmSync4, writeFileSync as writeFileSync5 } from "fs";
 import { join as join7 } from "path";
 function sha256File(path) {
   const data = readFileSync8(path);
-  return { bytes: data.length, sha256: createHash10("sha256").update(data).digest("hex") };
+  return { bytes: data.length, sha256: createHash9("sha256").update(data).digest("hex") };
 }
 
 class Snapshots {
@@ -17646,6 +17748,12 @@ class Notices {
   alert(kind, at) {
     this.#file({ id: `a_${kind.replace(/_/g, "")}${at}`, category: "alert", source: kind, at });
   }
+  device(seq, at) {
+    this.#file({ id: `a_dev${seq}`, category: "alert", source: `device:${seq}`, at });
+  }
+  trust(grantId, person, until, at) {
+    this.#file({ id: `a_trust${grantId}`, category: "alert", person, source: `trust:${until}`, at });
+  }
   #file(row) {
     if (!this.#host.store.putNotice(row))
       return;
@@ -17711,7 +17819,15 @@ class Notices {
       const own = row.person === this.#host.me();
       notice.from = profile ? { name: profile.name.slice(0, 200), ...profile.email !== undefined ? { email: profile.email.slice(0, 320) } : {}, org: profile.org } : { name: row.person, org: own ? "same" : "none" };
     }
-    if (row.category === "alert")
+    if (row.category === "alert" && row.source.startsWith("device:")) {
+      const device = this.#host.device?.(Number(row.source.slice("device:".length)));
+      if (device)
+        notice.device = device;
+      notice.line = device ? deviceLine(device) : "A device of your account changed.";
+    } else if (row.category === "alert" && row.source.startsWith("trust:")) {
+      const until = Number(row.source.slice("trust:".length));
+      notice.line = `Trust you gave this person ends on ${Number.isSafeInteger(until) ? new Date(until).toISOString().slice(0, 10) : "a date soon"}; renew it or let it lapse.`;
+    } else if (row.category === "alert")
       notice.line = ALERT_TEXT[row.source] ?? "An alarm was raised on this device.";
     else if (row.category === "message" && lines) {
       const line = this.#host.store.line(row.source);
@@ -17721,6 +17837,18 @@ class Notices {
     return notice;
   }
 }
+function vouchWords2(d) {
+  if (d.vouch === "admin")
+    return "admitted by the team's admin";
+  if (d.vouch === "device")
+    return d.approver !== undefined ? `approved on '${d.approver}'` : "approved by link";
+  return d.via === "browser" ? "signed in through the browser" : "vouched by Jelly ID on a Jelly host";
+}
+function deviceLine(d) {
+  const what = `'${d.label}'${d.kind !== undefined ? ` (${d.kind})` : ""}`;
+  const line = d.change === "added" ? `New device on your account: ${what}, ${vouchWords2(d)}.` : d.change === "vouched" ? `${what} on your account is now vouched by Jelly ID: ${vouchWords2(d)}.` : d.change === "replaced" ? `'${d.replaces?.label ?? "a device"}' was replaced by ${what}, ${vouchWords2(d)}.` : `${what} was removed from your account.`;
+  return line.length <= NOTICE_LINE_CHARS ? line : `${line.slice(0, NOTICE_LINE_CHARS - 1)}\u2026`;
+}
 function firstLine(text) {
   const first = cleanPeerText(text.split(/\r\n|\n|\r/, 1)[0] ?? "", { singleLine: true });
   if (first.length <= NOTICE_LINE_CHARS)
@@ -18301,46 +18429,44 @@ var init_storage_errors = __esm(() => {
 });
 
 // packages/daemon/dist/store.js
-import { chmodSync as chmodSync5, closeSync as closeSync7, openSync as openSync3 } from "fs";
+import { chmodSync as chmodSync5, closeSync as closeSync7, existsSync as existsSync7, openSync as openSync3 } from "fs";
 import { DatabaseSync } from "node:sqlite";
-function additiveColumn(decl) {
-  if (/\b(PRIMARY|UNIQUE|CHECK|REFERENCES|COLLATE|GENERATED|AS)\b/i.test(decl))
-    return false;
-  return !/\bNOT\s+NULL\b/i.test(decl) || /\bDEFAULT\b/i.test(decl);
+function checkStore(db, path) {
+  if (db.prepare("SELECT 1 FROM sqlite_master LIMIT 1").get() === undefined)
+    return true;
+  const hasKv = db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'kv'").get() !== undefined;
+  const raw = hasKv ? kvGet(db, "generation") : undefined;
+  if (raw === undefined) {
+    throw new Error(`${path} was written before the store reset (it records no store generation), and this messagingd does not read it. ${RESET_HINT}`);
+  }
+  if (storeNumber(raw) !== STORE_GENERATION) {
+    throw new Error(`${path} is of store generation ${raw.slice(0, 16)}; this messagingd reads generation ${STORE_GENERATION}. ${RESET_HINT}`);
+  }
+  const minReader = kvGet(db, "min_reader") ?? "";
+  if ((storeNumber(minReader) ?? Number.POSITIVE_INFINITY) > STORE_SCHEMA) {
+    throw new Error(`${path} needs a messagingd that reads store schema ${minReader.slice(0, 16) || "(unrecorded)"} or later; this one reads up to ${STORE_SCHEMA}. Run a newer messagingd`);
+  }
+  return false;
+}
+function checkStoreFile(path) {
+  if (!existsSync7(path))
+    return;
+  const db = new DatabaseSync(path, { readOnly: true, timeout: 5000 });
+  try {
+    checkStore(db, path);
+  } finally {
+    db.close();
+  }
 }
-function upgradeStore(db, migrations) {
+function openStore(db, path) {
   db.exec("BEGIN IMMEDIATE");
   try {
-    db.exec("CREATE TABLE IF NOT EXISTS kv (k TEXT PRIMARY KEY, v TEXT NOT NULL) STRICT;");
-    const raw = kvGet(db, "schema");
-    const stored = schemaNumber(raw);
-    const minReader = schemaNumber(kvGet(db, "min_reader")) ?? STORE_MIN_READER;
-    const top = migrations.reduce((max, m) => Math.max(max, m.schema), STORE_SCHEMA);
-    if (raw !== undefined && (stored === undefined || stored < STORE_MIN_READER)) {
-      throw new Error(`messaging.db has schema ${raw.slice(0, 16)}, from before the first released store (schema ${STORE_MIN_READER}); move the Messaging home aside and set it up again`);
-    }
-    if (minReader !== undefined && minReader > top) {
-      throw new Error(`messaging.db needs a messagingd that reads store schema ${minReader} or later; this one reads up to ${top}. Run a newer messagingd`);
-    }
-    db.exec(BASELINE);
-    for (const migration of migrations) {
-      if (migration.ddl) {
-        if (/\b(DROP|RENAME|ALTER)\b|\bCREATE\s+UNIQUE\b/i.test(migration.ddl))
-          throw new Error(`store migration ${migration.schema} is not additive`);
-        db.exec(migration.ddl);
-      }
-      for (const { table, column, decl } of migration.columns ?? []) {
-        if (!/^[a-z_][a-z0-9_]*$/.test(table) || !/^[a-z_][a-z0-9_]*$/.test(column) || !additiveColumn(decl)) {
-          throw new Error(`store migration ${migration.schema} is not additive (${table}.${column})`);
-        }
-        const has = db.prepare(`SELECT name FROM pragma_table_info('${table}')`).all().some((c) => c.name === column);
-        if (!has)
-          db.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${decl}`);
-      }
-    }
-    kvSet(db, "schema", String(Math.max(stored ?? 0, top)));
-    if (kvGet(db, "min_reader") === undefined)
+    if (checkStore(db, path)) {
+      db.exec(BASELINE);
+      kvSet(db, "generation", String(STORE_GENERATION));
+      kvSet(db, "schema", String(STORE_SCHEMA));
       kvSet(db, "min_reader", String(STORE_MIN_READER));
+    }
     db.exec("COMMIT");
   } catch (error) {
     db.exec("ROLLBACK");
@@ -18395,7 +18521,7 @@ class Store {
     this.#db = new DatabaseSync(path, { timeout: 5000 });
     this.#db.exec("PRAGMA journal_mode = WAL; PRAGMA synchronous = FULL;");
     try {
-      upgradeStore(this.#db, MIGRATIONS);
+      openStore(this.#db, path);
     } catch (error) {
       this.#db.close();
       throw error;
@@ -18583,7 +18709,7 @@ class Store {
   }
   insertInbox(row) {
     const { key, stage, ...item } = row.item;
-    this.#run("INSERT INTO inbox (id, key, session, sender, item, message, stage, received_at, bytes) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)", item.id, key, row.session, row.sender, JSON.stringify({ ...item, from: storedPeer(item.from) }), JSON.stringify(storedMessage(row.message)), stage, item.receivedAt, item.bytes);
+    this.#run("INSERT INTO inbox (id, key, session, sender, item, message, stage, received_at, bytes) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)", item.id, key, row.session, row.sender, JSON.stringify(item), JSON.stringify(row.message), stage, item.receivedAt, item.bytes);
   }
   inbox(key, unreadOnly, limit) {
     const sql = `SELECT * FROM inbox WHERE key = ?${unreadOnly ? " AND stage <> 'read'" : ""} ORDER BY received_at DESC, rowid DESC LIMIT ?`;
@@ -18984,7 +19110,7 @@ class Store {
     const prefix = `${peer}@`;
     const take = limit + 1;
     const [inboxBound, inboxArgs] = bound("received_at", "id");
-    const mail = this.#all(`SELECT * FROM inbox WHERE key = ? AND json_extract(item, '$.kind') = 'message' AND json_extract(item, '$.from.person') = ? AND json_extract(item, '$.from.session') = ?${inboxBound} ORDER BY received_at ${order}, id ${order} LIMIT ?`, key, person, session, ...inboxArgs, take).map((r) => ({ source: "inbox", at: Number(r.received_at), id: String(r.id), inbox: inboxRow2(r) }));
+    const mail = this.#all(`SELECT * FROM inbox WHERE key = ? AND json_extract(item, '$.kind') = 'message' AND json_extract(item, '$.from.person') = ? AND json_extract(item, '$.from.agent') = ?${inboxBound} ORDER BY received_at ${order}, id ${order} LIMIT ?`, key, person, session, ...inboxArgs, take).map((r) => ({ source: "inbox", at: Number(r.received_at), id: String(r.id), inbox: inboxRow2(r) }));
     const [sentBound, sentArgs] = bound("created_at", "id");
     const sent = this.#all(`SELECT * FROM sent WHERE key = ? AND kind = 'message' AND substr(to_addr, 1, ?) = ?${sentBound} ORDER BY created_at ${order}, id ${order} LIMIT ?`, key, prefix.length, prefix, ...sentArgs, take).map((r) => ({ source: "sent", at: Number(r.created_at), id: String(r.id), sent: sentRow(r) }));
     const [taskBound, taskArgs] = bound("created_at", "task_id");
@@ -19039,7 +19165,7 @@ class Store {
   }
   agentPeers(key, limit) {
     return this.#all(`SELECT peer, SUM(unread) AS unread, MAX(at) AS at FROM (
-         SELECT json_extract(item, '$.from.person') || '/' || json_extract(item, '$.from.session') AS peer, stage <> 'read' AS unread, received_at AS at
+         SELECT json_extract(item, '$.from.person') || '/' || json_extract(item, '$.from.agent') AS peer, stage <> 'read' AS unread, received_at AS at
            FROM inbox WHERE key = ? AND json_extract(item, '$.kind') = 'message'
          UNION ALL
          SELECT substr(to_addr, 1, instr(to_addr || '@', '@') - 1), 0, created_at FROM sent WHERE key = ? AND kind = 'message'
@@ -19066,7 +19192,7 @@ class Store {
        ON CONFLICT (task_id, role) DO UPDATE SET key = excluded.key, session = excluded.session, peer = excluded.peer,
          peer_machine = excluded.peer_machine, peer_address = excluded.peer_address, state = excluded.state,
          context_id = excluded.context_id, task = excluded.task, updated_at = excluded.updated_at,
-         request = COALESCE(excluded.request, tasks.request)`, r.task.id, r.role, r.key, row.session, JSON.stringify(storedPeer(r.peer)), r.peer.device, r.peer.address, r.task.status.state, opt(r.task.contextId), JSON.stringify(taskMessages(r.task, storedMessage)), r.createdAt, r.updatedAt, opt(row.request));
+         request = COALESCE(excluded.request, tasks.request)`, r.task.id, r.role, r.key, row.session, JSON.stringify(r.peer), r.peer.device, r.peer.address, r.task.status.state, opt(r.task.contextId), JSON.stringify(r.task), r.createdAt, r.updatedAt, opt(row.request));
     if (r.chain !== undefined) {
       this.#run("INSERT OR IGNORE INTO delegations (task_id, role, grants, chain) VALUES (?, ?, ?, ?)", r.task.id, r.role, JSON.stringify(row.grants), JSON.stringify(r.chain));
     }
@@ -19169,35 +19295,12 @@ function directoryRow(r) {
 function inboxRow2(r) {
   const item = json(r.item);
   return {
-    item: { ...item, from: peerOf(item.from), key: String(r.key), stage: String(r.stage) },
+    item: { ...item, key: String(r.key), stage: String(r.stage) },
     session: String(r.session),
     sender: String(r.sender),
-    message: messageOf2(json(r.message))
-  };
-}
-function storedPeer(peer) {
-  const { agent, device, ...rest } = peer;
-  return { ...rest, ...agent !== undefined ? { session: agent } : {}, machine: device };
-}
-function peerOf(stored) {
-  const { session, machine, ...rest } = stored;
-  return { ...rest, ...session !== undefined ? { agent: session } : {}, device: machine };
-}
-function storedMessage(message) {
-  const provenance = message.metadata?.[URI.provenance];
-  return provenance === undefined ? message : { ...message, metadata: { ...message.metadata, [URI.provenance]: storedPeer(provenance) } };
-}
-function taskMessages(task, convert) {
-  return {
-    ...task,
-    status: task.status.message !== undefined ? { ...task.status, message: convert(task.status.message) } : task.status,
-    ...task.history !== undefined ? { history: task.history.map(convert) } : {}
+    message: json(r.message)
   };
 }
-function messageOf2(message) {
-  const provenance = message.metadata?.[URI.provenance];
-  return provenance === undefined ? message : { ...message, metadata: { ...message.metadata, [URI.provenance]: peerOf(provenance) } };
-}
 function outboxRow(r) {
   return {
     id: String(r.id),
@@ -19274,10 +19377,10 @@ function matchQuery(query) {
 function taskRow2(r) {
   const row = {
     record: {
-      task: taskMessages(json(r.task), messageOf2),
+      task: json(r.task),
       role: String(r.role),
       key: String(r.key),
-      peer: peerOf(json(r.peer)),
+      peer: json(r.peer),
       createdAt: Number(r.created_at),
       updatedAt: Number(r.updated_at)
     },
@@ -19293,7 +19396,7 @@ function taskRow2(r) {
   }
   return row;
 }
-var CHAT_COUNTER = "chat", STORE_SCHEMA = 9, STORE_MIN_READER = 3, MIGRATIONS, BASELINE = `
+var CHAT_COUNTER = "chat", STORE_GENERATION = 2, STORE_SCHEMA = 1, STORE_MIN_READER = 1, BASELINE = `
 CREATE TABLE IF NOT EXISTS kv (k TEXT PRIMARY KEY, v TEXT NOT NULL) STRICT;
 CREATE TABLE IF NOT EXISTS counters (name TEXT PRIMARY KEY, value INTEGER NOT NULL) STRICT;
 CREATE TABLE IF NOT EXISTS roster (seq INTEGER PRIMARY KEY, hash TEXT NOT NULL, entry TEXT NOT NULL) STRICT;
@@ -19399,7 +19502,8 @@ CREATE TABLE IF NOT EXISTS chat_sent (
   person TEXT NOT NULL,
   stage TEXT NOT NULL,
   code TEXT,
-  exp INTEGER NOT NULL
+  exp INTEGER NOT NULL,
+  held_at INTEGER
 ) STRICT;
 CREATE INDEX IF NOT EXISTS chat_sent_by_line ON chat_sent (line, person);
 CREATE INDEX IF NOT EXISTS chat_sent_pending ON chat_sent (exp) WHERE stage = 'sent';
@@ -19442,6 +19546,7 @@ CREATE TABLE IF NOT EXISTS tasks (
   task TEXT NOT NULL,
   created_at INTEGER NOT NULL,
   updated_at INTEGER NOT NULL,
+  request TEXT,
   PRIMARY KEY (task_id, role)
 ) STRICT;
 CREATE INDEX IF NOT EXISTS tasks_by_key ON tasks (key, updated_at DESC, task_id DESC, role DESC);
@@ -19470,37 +19575,20 @@ CREATE TABLE IF NOT EXISTS idempotency (
   created_at INTEGER NOT NULL,
   PRIMARY KEY (key, ikey)
 ) STRICT;
-`, kvGet = (db, k) => {
-  const row = db.prepare("SELECT v FROM kv WHERE k = ?").get(k);
-  return row?.v === undefined || row.v === null ? undefined : String(row.v);
-}, kvSet = (db, k, v) => {
-  db.prepare("INSERT INTO kv (k, v) VALUES (?, ?) ON CONFLICT (k) DO UPDATE SET v = excluded.v").run(k, v);
-}, schemaNumber = (value) => value !== undefined && /^[1-9][0-9]{0,8}$/.test(value) ? Number(value) : undefined, TASKS = "tasks LEFT JOIN delegations USING (task_id, role)", text2 = (v) => v === null || v === undefined ? undefined : String(v), num = (v) => v === null || v === undefined ? undefined : Number(v), json = (v) => JSON.parse(String(v)), opt = (v) => v === undefined ? null : v, UNSPACED;
-var init_store2 = __esm(() => {
-  init_dist();
-  MIGRATIONS = [
-    { schema: 4, columns: [{ table: "tasks", column: "request", decl: "TEXT" }] },
-    {
-      schema: 5,
-      ddl: `CREATE TABLE IF NOT EXISTS dir_persons (
+-- A directory realm's cache of verified persons (spec \xA715.9); its tree head, Jelly key archive, own record and alarm
+-- are kv rows (dir.*).
+CREATE TABLE IF NOT EXISTS dir_persons (
   person TEXT PRIMARY KEY,
   entries TEXT NOT NULL,
   keys TEXT NOT NULL,
   erased INTEGER NOT NULL DEFAULT 0,
   size INTEGER NOT NULL,
   fetched_at INTEGER NOT NULL
-) STRICT;`
-    },
-    {
-      schema: 6,
-      ddl: `
+) STRICT;
+-- This person's grants, one per subject, as signed; and the widening levels that lapsed with their signer (spec \xA76.9).
 CREATE TABLE IF NOT EXISTS grants (subject TEXT PRIMARY KEY, grant TEXT NOT NULL) STRICT;
 CREATE TABLE IF NOT EXISTS grant_reviews (subject TEXT PRIMARY KEY, id TEXT NOT NULL, levels TEXT NOT NULL, at INTEGER NOT NULL) STRICT;
-`
-    },
-    {
-      schema: 7,
-      ddl: `
+-- Requests held for this person to answer (spec \xA76.9, "Holds"): the envelope as received and its opened payload.
 CREATE TABLE IF NOT EXISTS held (
   id TEXT PRIMARY KEY,
   person TEXT NOT NULL,
@@ -19513,11 +19601,8 @@ CREATE TABLE IF NOT EXISTS held (
 ) STRICT;
 CREATE INDEX IF NOT EXISTS held_person ON held (person);
 CREATE INDEX IF NOT EXISTS held_exp ON held (exp);
-`
-    },
-    {
-      schema: 8,
-      ddl: `
+-- Deployment "jelly" (spec \xA78.11): spent action-grant ids until their expiry, and the Jelly agent each session key
+-- was registered for. Notices (spec \xA78.2, "Notices") name their source (a line, a held request, an alarm).
 CREATE TABLE IF NOT EXISTS act_jti (jti TEXT PRIMARY KEY, exp INTEGER NOT NULL) STRICT;
 CREATE INDEX IF NOT EXISTS act_jti_exp ON act_jti (exp);
 CREATE TABLE IF NOT EXISTS session_agents (key TEXT PRIMARY KEY, agt TEXT NOT NULL) STRICT;
@@ -19532,11 +19617,8 @@ CREATE TABLE IF NOT EXISTS notices (
   acked_at INTEGER
 ) STRICT;
 CREATE INDEX IF NOT EXISTS notices_at ON notices (at);
-`
-    },
-    {
-      schema: 9,
-      ddl: `
+-- Contact cards and message requests (spec \xA76.9): the latest card each other person sent this one; message requests
+-- held for the person to accept, as received and opened; and the contacts this person's agents suggested.
 CREATE TABLE IF NOT EXISTS contact_cards (person TEXT PRIMARY KEY, card TEXT NOT NULL, seq INTEGER NOT NULL, at INTEGER NOT NULL) STRICT;
 CREATE TABLE IF NOT EXISTS contact_requests (
   id TEXT PRIMARY KEY,
@@ -19549,10 +19631,14 @@ CREATE TABLE IF NOT EXISTS contact_requests (
 ) STRICT;
 CREATE INDEX IF NOT EXISTS contact_requests_person ON contact_requests (person);
 CREATE TABLE IF NOT EXISTS contact_suggestions (id TEXT PRIMARY KEY, session TEXT NOT NULL, email TEXT NOT NULL, at INTEGER NOT NULL) STRICT;
-`,
-      columns: [{ table: "chat_sent", column: "held_at", decl: "INTEGER" }]
-    }
-  ];
+`, kvGet = (db, k) => {
+  const row = db.prepare("SELECT v FROM kv WHERE k = ?").get(k);
+  return row?.v === undefined || row.v === null ? undefined : String(row.v);
+}, kvSet = (db, k, v) => {
+  db.prepare("INSERT INTO kv (k, v) VALUES (?, ?) ON CONFLICT (k) DO UPDATE SET v = excluded.v").run(k, v);
+}, storeNumber = (value) => value !== undefined && /^[1-9][0-9]{0,8}$/.test(value) ? Number(value) : undefined, RESET_HINT = "Nothing was changed. To start over, stop messagingd, move the whole Messaging home aside (it keeps the old messages, and the messagingd that wrote it still opens it), then set the home up again: messaging login, or messaging team create or team join for a self-hosted team", TASKS = "tasks LEFT JOIN delegations USING (task_id, role)", text2 = (v) => v === null || v === undefined ? undefined : String(v), num = (v) => v === null || v === undefined ? undefined : Number(v), json = (v) => JSON.parse(String(v)), opt = (v) => v === undefined ? null : v, UNSPACED;
+var init_store2 = __esm(() => {
+  init_dist();
   UNSPACED = /([\p{Script=Han}\p{Script=Hiragana}\p{Script=Katakana}\p{Script=Hangul}\p{Script=Thai}])/gu;
 });
 
@@ -19945,6 +20031,16 @@ class Grants {
   hasGrant(person) {
     return this.#current(grantSubjectKey({ person })) !== undefined;
   }
+  expiringTrust(withinMs) {
+    const now = this.#host.now();
+    const current = this.#currentDevice();
+    return this.#all().flatMap(({ grant }) => {
+      const until = grant.trustedUntil;
+      if (!("person" in grant.subject) || until === undefined || until <= now || until > now + withinMs || !current(grant.by))
+        return [];
+      return [{ id: grant.id, person: grant.subject.person, until }];
+    });
+  }
   list(p) {
     const only = p.subject === undefined ? undefined : this.#subjectKey(p.subject, false);
     const grants = this.#all().filter(({ subject }) => only === undefined || subject === only).map(({ grant }) => this.#view(grant)).sort((a, b) => b.ts - a.ts || (a.id < b.id ? 1 : -1));
@@ -20019,6 +20115,25 @@ class Grants {
     this.#host.log("grant.sync", { id: env.id, what: conv.what, merged });
     this.sweep();
   }
+  resignFrom(predecessor) {
+    const { identity } = this.#host.joined();
+    const now = this.#host.now();
+    const resigned = [];
+    for (const { subject, grant } of this.#all()) {
+      if (grant.by !== predecessor)
+        continue;
+      const copy = resignGrant(identity, grant, { now, keep: "all" });
+      this.#store.putGrant(subject, copy);
+      resigned.push(copy);
+      if ("person" in copy.subject)
+        this.#host.changed?.(copy.subject.person);
+    }
+    if (resigned.length > 0) {
+      this.#sync("grant", resigned);
+      this.#host.log("grant.resigned", { grants: resigned.length });
+    }
+    return resigned.length;
+  }
   sweep() {
     const { identity, realm } = this.#host.joined();
     if (realm.removed())
@@ -20814,6 +20929,7 @@ class Daemon {
         const realm = this.#realm ?? this.#directory?.realm;
         return realm ? await realm.profile(person) : undefined;
       },
+      device: (seq) => this.#noticeDevice(seq),
       emit: (event) => this.#emit(event)
     });
     this.#keyring = new Keyring({
@@ -20845,6 +20961,7 @@ class Daemon {
   static async start(options) {
     const paths = homePaths(options.home, options.jellyHost?.run);
     ensureHome(paths);
+    checkStoreFile(paths.db);
     const jelly = options.jellyHost;
     if (jelly?.realm !== undefined && readConfig(paths.config).realm === undefined) {
       options = { ...options, jellyHost: { ...jelly, realm: await pinRealm(jelly.realm, options.wellKnown) } };
@@ -20919,6 +21036,7 @@ class Daemon {
     }
     this.#log("info", "daemon.started", { pid: process.pid, version: VERSION, joined: identity !== undefined, store: identityStore?.kind, ...jelly ? { deployment: "jelly" } : {} });
     this.#state = "running";
+    this.#deviceNotices(true);
     this.#startTransport();
     this.#sweepTimer = setInterval(() => this.sweep(), this.#tuning.sweepMs);
     this.#sweepTimer.unref();
@@ -20958,7 +21076,12 @@ class Daemon {
           this.#alerts();
       },
       onDeliver: (raw) => this.#onDeliver(raw),
-      state: (connected) => this.#onHostedState(connected)
+      state: (connected) => this.#onHostedState(connected),
+      replaceStep: (token) => this.#replaceWith(token),
+      eraseStep: async (token) => {
+        const done = await this.#eraseWith(token);
+        return { person: done.person, device: this.#identity.machine, seq: done.seq };
+      }
     });
     this.#directory = home;
     const realm = home.realm;
@@ -20976,6 +21099,7 @@ class Daemon {
       else
         this.#presenceSoon();
     });
+    realm.on("device-log", (persons) => this.#deviceLogGrew(persons));
     this.#removed = realm.removed();
     this.#transport = home.transport();
     home.start();
@@ -21076,7 +21200,11 @@ class Daemon {
     return {
       "daemon.status": () => this.status(),
       "device.status": () => this.#deviceStatus(),
-      "device.bind": (p) => this.#homeDirectory("device.bind").bind(this.#jellyHost ? { ...p, label: this.#jellyHost.label, kind: this.#jellyHost.kind } : p),
+      "device.bind": async (p) => {
+        if (this.#store.getKv(PREDECESSOR_KEY) !== undefined && this.#directory)
+          return this.#replaceWith(p.token, p.label);
+        return this.#homeDirectory("device.bind").bind(this.#jellyHost ? { ...p, label: this.#jellyHost.label, kind: this.#jellyHost.kind } : p);
+      },
       "device.list": () => this.#directory?.list() ?? this.#rosterDevices(),
       "device.remove": (p) => this.#homeDirectory("device.remove").remove(p),
       "device.link": (p) => this.#homeDirectory("device.link").link(p),
@@ -21089,6 +21217,10 @@ class Daemon {
       "device.login.cancel": () => this.#homeDirectory("device.login.cancel").loginCancel(),
       "device.approve.preview": (p) => this.#homeDirectory("device.approve.preview").approvePreview(p),
       "device.approve": (p) => this.#homeDirectory("device.approve").approve(p),
+      "identity.replace": (p) => this.#replace(p),
+      "identity.replace.preview": (p) => this.#replacePreview(p),
+      "directory.erase": (p) => this.#erase(p),
+      "directory.erase.preview": (p) => this.#erasePreview(p),
       "daemon.stop": () => this.#stop(),
       "session.register": (p, ctx) => this.#register(p, ctx),
       "session.update": (p, ctx) => this.#updateSession(this.#bound(p, ctx)),
@@ -21189,10 +21321,30 @@ class Daemon {
     const out = [];
     for (const person of all) {
       const org = realm.kind === "roster" ? "same" : await realm.profile(person).then((profile) => profile.org, () => "none");
-      out.push(this.#cards.reach(person, org === "same"));
+      const reach = this.#cards.reach(person, org === "same");
+      const changedAt = this.#recentDeviceChanges(realm, person).at(0)?.at;
+      out.push(changedAt === undefined ? reach : { ...reach, devicesChangedAt: changedAt });
     }
     return out;
   }
+  #recentDeviceChanges(realm, person) {
+    const since = this.#now() - DEVICES_CHANGED_MS;
+    const changes = realm.deviceChanges(person);
+    const labelOf = (device) => changes.filter((c) => c.device === device).at(-1)?.label;
+    return changes.filter((change) => change.change !== "vouched" && change.at > since).reverse().slice(0, 10).map((change) => {
+      const approver = change.approver !== undefined ? labelOf(change.approver) : undefined;
+      return {
+        change: change.change,
+        device: change.device,
+        label: MachineLabel.safeParse(change.label).success ? change.label : "device",
+        ...change.kind !== undefined ? { kind: change.kind } : {},
+        vouch: change.vouch === "service" ? "device" : change.vouch,
+        ...change.via !== undefined ? { via: change.via } : {},
+        ...approver !== undefined && MachineLabel.safeParse(approver).success ? { approver } : {},
+        at: change.at
+      };
+    });
+  }
   async#grantSubject(p) {
     const { realm } = this.#joined();
     if ("person" in p.subject)
@@ -21293,6 +21445,7 @@ class Daemon {
       now: this.#now
     });
     realm.on("devices-changed", () => this.#realmChanged());
+    realm.on("device-log", (persons) => this.#deviceLogGrew(persons));
     return realm;
   }
   #admin() {
@@ -21491,7 +21644,7 @@ class Daemon {
         type: "presence",
         from: { person: me.person, device: identity.machine },
         to: { team: true },
-        payload: presencePayload(final ? this.#store.sessions().map((s) => ({ ...s, unregisteredAt: s.unregisteredAt ?? this.#now() })) : this.#store.sessions(), me.label, this.#store.next("presence"), this.#transport?.advertise?.(), {
+        payload: presencePayload(final ? this.#store.sessions().map((s) => ({ ...s, unregisteredAt: s.unregisteredAt ?? this.#now() })) : this.#store.sessions(), me.label, this.#store.next("presence"), {
           wake: (s) => this.#wakes(s),
           share: new Set(this.#currentConfig().presence?.share ?? []),
           away: this.#away()
@@ -21641,7 +21794,6 @@ class Daemon {
           kind: p.kind,
           message,
           wake: p.wake ?? true,
-          ...p.external !== undefined ? { external: p.external } : {},
           ...chain !== undefined ? { delegation: chain.grants } : {}
         };
         const replyTo = p.replyTo ?? follow?.request;
@@ -21717,7 +21869,7 @@ class Daemon {
   }
   async#sendLine(p) {
     const session = this.#sessionOf(p.key);
-    const extra = ["contextId", "taskId", "messageId", "metadata", "extensions", "referenceTaskIds", "external", "onBehalfOf", "wake"].filter((name) => p[name] !== undefined);
+    const extra = ["contextId", "taskId", "messageId", "metadata", "extensions", "referenceTaskIds", "onBehalfOf", "wake"].filter((name) => p[name] !== undefined);
     if (p.kind !== "message")
       throw new MessagingError("invalid_request", "a task goes to an agent, person/agent");
     if (extra.length > 0)
@@ -21790,7 +21942,9 @@ class Daemon {
       self: device.machine === identity.machine,
       ...away(device.machine) ? { away: true } : {}
     }));
-    return { person: p.person, ...profile, devices };
+    const own = p.person === this.#ownPerson();
+    const deviceChanges = own ? [] : this.#recentDeviceChanges(realm, p.person);
+    return { person: p.person, ...profile, devices, ...deviceChanges.length > 0 ? { deviceChanges } : {} };
   }
   #seal(type, toMachine, session, payload, extra = {}) {
     const { identity, realm, me } = this.#joined();
@@ -22306,7 +22460,7 @@ ${row.receipt ? "receipt" : "envelope"}`;
       if (payload.kind === "task") {
         const { realm, me } = this.#joined();
         try {
-          inboundChain(payload.delegation, { realm, now, sender, fromSession, me, toSession, task: payload.message.taskId, external: payload.external });
+          inboundChain(payload.delegation, { realm, now, sender, fromSession, me, toSession, task: payload.message.taskId });
         } catch (error) {
           return reject(codeOf(error));
         }
@@ -22336,10 +22490,9 @@ ${row.receipt ? "receipt" : "envelope"}`;
     const recipient = this.#store.sessionByName(toSession);
     const config = this.#currentConfig();
     const code = inboundPolicy({
-      sender: { machine: sender.machine, person: sender.person, role: sender.role, session: fromSession, agent: this.#agentOf(sender.machine, fromSession) },
+      sender: { machine: sender.machine, session: fromSession, agent: this.#agentOf(sender.machine, fromSession) },
       ...recipient ? { recipient: { session: recipient.name, agent: recipient.agent } } : {},
-      task: payload.kind === "task",
-      external: payload.external !== undefined
+      task: payload.kind === "task"
     }, this.#policy, now);
     if (code !== undefined || !recipient)
       return reject(code ?? "unknown_session");
@@ -22357,7 +22510,7 @@ ${row.receipt ? "receipt" : "envelope"}`;
         return reject("invalid_request");
       const { realm, me } = this.#joined();
       try {
-        chain = inboundChain(payload.delegation, { realm, now, sender, fromSession, me, toSession: recipient.name, task: taskId, external: payload.external });
+        chain = inboundChain(payload.delegation, { realm, now, sender, fromSession, me, toSession: recipient.name, task: taskId });
       } catch (error) {
         return reject(codeOf(error));
       }
@@ -22374,7 +22527,7 @@ ${row.receipt ? "receipt" : "envelope"}`;
         return reject("too_large");
     }
     const from = peerRef(sender, fromSession);
-    const message = withProvenance(payload.message, provenanceOf3(env, sender, now, payload.external));
+    const message = withProvenance(payload.message, provenanceOf3(env, sender, now));
     const item = {
       id: env.id,
       key: recipient.key,
@@ -22439,7 +22592,7 @@ ${row.receipt ? "receipt" : "envelope"}`;
       this.#dropped("not_found", env.id);
       return;
     }
-    if (row.request !== undefined && env.replyTo !== row.request) {
+    if (env.replyTo !== row.request) {
       this.#dropped("invalid_request", env.id);
       return;
     }
@@ -22746,9 +22899,6 @@ ${row.receipt ? "receipt" : "envelope"}`;
       onPeer: (machine, online) => this.#onPeer(machine, online),
       onState: (state) => this.#onState(state),
       ...this.#tuning.reconnect ? { reconnect: this.#tuning.reconnect } : {},
-      ...this.#config.transport?.direct ? { direct: this.#config.transport.direct } : {},
-      member: (machine) => this.#removed ? undefined : this.#realm?.device(machine),
-      presence: (machine) => this.#store.directoryRow(machine)?.presence,
       log: this.#log
     });
     this.#transport = transport;
@@ -22881,7 +23031,6 @@ ${row.receipt ? "receipt" : "envelope"}`;
       this.#stopRemoved();
       return;
     }
-    this.#transport?.rosterChanged?.();
     this.#sealedTo.clear();
     const gone = hosted ? "unknown_device" : "not_member";
     this.#tx(() => {
@@ -22927,8 +23076,14 @@ ${row.receipt ? "receipt" : "envelope"}`;
     await transport?.stop().catch(() => {});
   }
   #deviceStatus() {
-    if (this.#directory)
-      return this.#directory.status();
+    if (this.#directory) {
+      const status = this.#directory.status();
+      return this.#store.getKv(PREDECESSOR_KEY) !== undefined && status.binding !== "removed" ? { ...status, binding: "replace" } : status;
+    }
+    if (this.#config.realm) {
+      const person = this.#store.directoryCache().own().person;
+      return { realm: "directory", binding: "none", ...person ? { person } : {} };
+    }
     const identity = this.#identity;
     const me = identity ? this.#realm?.device(identity.machine) : undefined;
     const binding = this.#removed ? "removed" : me ? "bound" : "none";
@@ -23065,6 +23220,232 @@ ${row.receipt ? "receipt" : "envelope"}`;
     const { rows, more } = this.#store.conversation(session.key, p.conversation.slice("agent:".length), { before: p.before }, p.limit ?? 30);
     return { kind: "entries", conversation: p.conversation, entries: rows.map(convEntry), more };
   }
+  #heldRealm(config) {
+    if (this.#directory)
+      return this.#directory.realm;
+    const throwaway = generateIdentity();
+    return new DirectoryIdentity({ config, identity: () => throwaway, link: () => {
+      return;
+    }, cache: memoryDirectoryCache(this.#store.directoryCache()), jelly: this.#jelly ?? jellyFromIssuer(config.issuer), now: this.#now });
+  }
+  #predecessor() {
+    return this.#store.getKv(PREDECESSOR_KEY) ?? this.#store.getKv(MACHINE_KEY) ?? this.#identity?.machine;
+  }
+  async#replacePreview(p) {
+    const config = this.#config.realm;
+    if (!config)
+      throw new MessagingError("invalid_state", "identity.replace is for a directory realm; a roster realm replaces a machine with team.remove and a new invite");
+    const person = this.#store.directoryCache().own().person;
+    if (!person)
+      throw new MessagingError("no_identity", "this home was never bound to an account: bind it instead (device.bind or messaging login)");
+    const realm = this.#heldRealm(config);
+    const pred = this.#predecessor();
+    const record = realm.ownDevices().find((d) => d.device === pred);
+    if (!record)
+      throw new MessagingError("not_found", "this home's device is not in its account's log");
+    const pending = this.#store.getKv(PREDECESSOR_KEY) !== undefined && this.#identity !== undefined && this.#identity.machine !== pred;
+    const bound = pending && realm.binding().state !== "none";
+    const signIns = !pending ? 2 : !bound ? 2 : record.current ? 1 : 0;
+    const alarm = this.#keysMissing ? "keys_missing" : realm.alarm()?.kind === "restored" ? "restored" : null;
+    const label = record.label;
+    const why = alarm === "keys_missing" ? " (its key files are missing)" : alarm === "restored" ? " (it runs from an older copy of its home)" : "";
+    const sentence = `This device gets a new key and replaces '${label}'${why} on your account. Your conversations, grants and history stay here, and tasks continue; ` + `mail still queued at the relay for '${label}' is lost.` + (signIns === 2 ? " Through the browser you approve two sign-ins at Jelly ID: one binds the new key, one removes the old." : signIns === 1 ? ` You approve one sign-in at Jelly ID, to remove '${label}'.` : "");
+    return {
+      predecessor: {
+        device: pred,
+        label,
+        kind: record.kind,
+        vouch: record.vouch,
+        ...record.vouch === "jelly" ? { via: record.host !== undefined ? "host" : "browser" } : {},
+        since: record.since,
+        current: record.current
+      },
+      alarm,
+      ...pending ? { device: this.#identity.machine } : {},
+      signIns,
+      sentence: sentence.slice(0, 600)
+    };
+  }
+  async#replace(p) {
+    const config = this.#config.realm;
+    if (!config)
+      throw new MessagingError("invalid_state", "identity.replace is for a directory realm; a roster realm replaces a machine with team.remove and a new invite");
+    if (this.#removed || this.#directory?.realm.removed())
+      throw new MessagingError("invalid_state", "this device was removed from its account; it cannot replace anything");
+    const person = this.#store.directoryCache().own().person;
+    if (!person)
+      throw new MessagingError("no_identity", "this home was never bound to an account: bind it instead (device.bind or messaging login)");
+    const pred = this.#predecessor();
+    if (!pred)
+      throw new MessagingError("no_identity", "this home names no device to replace");
+    const record = this.#heldRealm(config).ownDevices().find((d) => d.device === pred);
+    if (!record)
+      throw new MessagingError("not_found", "this home's device is not in its account's log");
+    if (this.#store.getKv(PREDECESSOR_KEY) === undefined || this.#identity === undefined || this.#identity.machine === pred) {
+      if (!record.current)
+        throw new MessagingError("invalid_state", "this home's device was removed from its account; it cannot be replaced");
+      await this.#newKeys(pred, config);
+    }
+    return this.#replaceNext(p);
+  }
+  async#replaceNext(p) {
+    const home = this.#directory;
+    const me = this.#identity.machine;
+    if (p.token !== undefined) {
+      const done = await this.#replaceWith(p.token, p.label);
+      if (this.#store.getKv(PREDECESSOR_KEY) === undefined)
+        return { state: "done", person: done.person, device: me, predecessor: done.predecessor, seq: done.seq };
+    } else if (this.#replaceFinished()) {
+      return this.#replaceDone();
+    }
+    if (this.#store.getKv(PREDECESSOR_KEY) === undefined)
+      return this.#replaceDone();
+    if (this.#jellyHost || p.token !== undefined)
+      return { state: "token", device: me };
+    const pred = this.#store.getKv(PREDECESSOR_KEY);
+    const record = home.realm.ownDevices().find((d) => d.device === pred);
+    const label = p.label ?? this.#store.getKv(REPLACE_LABEL_KEY) ?? record?.label ?? "device";
+    const kind = record && record.kind !== "jelly-host" ? record.kind : "laptop";
+    const started = await home.signIn("replace", { label, kind });
+    return { state: "sign-in", device: me, ...started };
+  }
+  #replaceFinished() {
+    const pred = this.#store.getKv(PREDECESSOR_KEY);
+    if (pred === undefined)
+      return true;
+    const realm = this.#directory?.realm;
+    if (!realm || realm.binding().state === "none")
+      return false;
+    return realm.ownDevices().find((d) => d.device === pred)?.current !== true;
+  }
+  #replaceDone() {
+    const realm = this.#directory.realm;
+    const pred = this.#store.getKv(PREDECESSOR_KEY) ?? this.#store.getKv(REPLACED_KEY);
+    this.#store.deleteKv(PREDECESSOR_KEY);
+    const me = this.#identity.machine;
+    const binding = realm.binding();
+    const record = pred !== undefined ? realm.ownDevices().find((d) => d.device === pred) : undefined;
+    return { state: "done", person: binding.person, device: me, predecessor: pred ?? me, seq: record?.unbound ? realm.deviceChanges(binding.person).find((c) => c.device === pred && c.change === "replaced")?.seq ?? 0 : 0 };
+  }
+  async#replaceWith(token, label) {
+    const home = this.#directory;
+    const pred = this.#store.getKv(PREDECESSOR_KEY);
+    if (!home || pred === undefined)
+      throw new MessagingError("invalid_state", "no replacement is pending: start one with identity.replace");
+    const realm = home.realm;
+    const me = this.#identity.machine;
+    const record = realm.ownDevices().find((d) => d.device === pred);
+    let seq = 0;
+    let spent = false;
+    if (realm.binding().state === "none") {
+      const kind = this.#jellyHost?.kind ?? (record && record.kind !== "jelly-host" ? record.kind : "laptop");
+      const done = await home.bind({ token, label: this.#jellyHost?.label ?? label ?? this.#store.getKv(REPLACE_LABEL_KEY) ?? record?.label ?? "device", kind });
+      seq = done.seq;
+      spent = signInToken(token);
+      this.#log("info", "identity.replace.bound", { seq });
+    }
+    await realm.awaitSelf();
+    this.#tx(() => this.#grants.resignFrom(pred));
+    let unbound = false;
+    if (!spent && realm.ownDevices().find((d) => d.device === pred)?.current) {
+      const done = await realm.unbind(pred, { reason: "replaced", token });
+      seq = done.seq;
+      unbound = true;
+      this.#log("info", "identity.replace.done", { seq });
+    }
+    if (unbound || this.#replaceFinished()) {
+      this.#store.setKv(REPLACED_KEY, pred);
+      this.#store.deleteKv(PREDECESSOR_KEY);
+      this.#store.deleteKv(REPLACE_LABEL_KEY);
+      this.#emit({ type: "contacts" });
+    }
+    return { person: realm.binding().person, device: me, predecessor: pred, seq };
+  }
+  async#newKeys(pred, config) {
+    const label = this.#heldRealm(config).ownDevices().find((d) => d.device === pred)?.label;
+    this.#store.setKv(PREDECESSOR_KEY, pred);
+    if (label !== undefined)
+      this.#store.setKv(REPLACE_LABEL_KEY, label);
+    const keys = { identity: generateIdentity(), retained: [] };
+    let identityStore = this.#keyring.store;
+    if (identityStore)
+      identityStore.save(keys);
+    else
+      identityStore = saveNewIdentity(this.paths.identity, keys, identitySettings(this.#config), this.#storeDeps());
+    this.#store.setKv(MACHINE_KEY, keys.identity.machine);
+    this.#log("info", "identity.replace.keys", { store: identityStore.kind });
+    const old = this.#directory;
+    this.#directory = undefined;
+    this.#realm = undefined;
+    this.#transport = undefined;
+    if (old) {
+      await old.stop();
+      this.#onHostedState(false);
+    }
+    const cache = this.#store.directoryCache();
+    if (cache.alarm()?.kind === "restored")
+      cache.setAlarm(undefined);
+    for (const row of this.#store.outbox())
+      if (row.env.from.device === pred)
+        this.#store.deleteOutbox(row.id);
+    this.#keysMissing = false;
+    this.#keyring.adopt(keys, identityStore);
+    this.#openDirectory(config, keys, identityStore);
+  }
+  #erasePreview(_p) {
+    const home = this.#homeDirectory("directory.erase.preview");
+    const binding = home.realm.binding();
+    if (!binding.person || binding.state === "none" || binding.state === "removed")
+      throw new MessagingError("no_identity", "this device is not bound to an account");
+    const devices = home.realm.ownDevices().filter((d) => d.current);
+    const me = this.#identity.machine;
+    return {
+      person: binding.person,
+      devices: devices.map((d) => ({ device: d.device, label: d.label, kind: d.kind, self: d.device === me })),
+      signIns: this.#jellyHost || binding.record?.host !== undefined ? 0 : 1,
+      perDay: ERASURES_PER_DAY,
+      lost: [
+        `Every device of your account (${devices.length}, this one included) is removed from Messaging, and none can be bound again.`,
+        "Your Jelly account can never be bound to Messaging again: the erasure is for good, and a new sign-in is refused.",
+        "The directory deletes your name, email and handle, and every device record and key statement it held for you.",
+        "Messages still queued at the relay for your devices are deleted.",
+        "Your contacts see a deleted account, and drop the grants and cards they hold for you."
+      ],
+      kept: ["Each device keeps its own history (conversations, transcripts, grants) on its disk until you delete its home.", "Your Jelly account itself is not deleted: only its Messaging account is."]
+    };
+  }
+  async#erase(p) {
+    const home = this.#homeDirectory("directory.erase");
+    const binding = home.realm.binding();
+    if (!binding.person || binding.state === "none" || binding.state === "removed")
+      throw new MessagingError("no_identity", "this device is not bound to an account");
+    if (binding.record?.vouch !== "jelly")
+      throw new MessagingError("forbidden", "a device approved by link erases nothing; erase from a device Jelly ID vouched for");
+    if (p.token !== undefined) {
+      const done = await this.#eraseWith(p.token);
+      return { state: "done", person: done.person, devices: done.devices };
+    }
+    if (this.#jellyHost)
+      throw new MessagingError("invalid_request", "under a Jelly host, directory.erase needs a fresh token for this device from its host (token)");
+    const record = binding.record;
+    const started = await home.signIn("erase", { label: record.label, kind: record.kind !== "jelly-host" ? record.kind : "laptop" });
+    return { state: "sign-in", ...started };
+  }
+  async#eraseWith(token) {
+    const home = this.#homeDirectory("directory.erase");
+    let done;
+    try {
+      done = await home.realm.erase(token);
+    } catch (error) {
+      if (!(error instanceof MessagingError) || error.code !== "rate_limited")
+        throw error;
+      const wait = error.retryAfterMs;
+      const when = typeof wait === "number" && wait > 0 ? `; try again in about ${Math.max(1, Math.ceil(wait / 60000))} min` : "; try again tomorrow";
+      throw new MessagingError("rate_limited", `the directory allows ${ERASURES_PER_DAY} erasures per person a day${when}`);
+    }
+    this.#log("warn", "directory.erased", { devices: done.devices });
+    return done;
+  }
   #removePreview(p) {
     const entry = this.#homeDirectory("device.remove.preview").list().devices.find((d) => d.device === p.device);
     if (!entry)
@@ -23078,6 +23459,95 @@ ${row.receipt ? "receipt" : "envelope"}`;
       ...entry.since !== undefined ? { since: entry.since } : {}
     };
   }
+  #deviceLogGrew(persons) {
+    try {
+      this.#deviceNotices();
+    } catch (error) {
+      this.#log("error", "notice.device.failed", { code: codeOf(error) });
+    }
+    if (persons.some((person) => person !== this.#me()))
+      this.#emit({ type: "contacts" });
+  }
+  #ownPerson() {
+    return this.#directory?.person() ?? this.#me();
+  }
+  #deviceNotices(start = false) {
+    const realm = this.#realm ?? this.#directory?.realm;
+    const person = this.#ownPerson();
+    const me = this.#identity?.machine;
+    if (!realm || !person || !me)
+      return;
+    const changes = realm.deviceChanges(person);
+    const head = changes.at(-1)?.seq ?? -1;
+    let last = this.#store.getKv(DEVICE_NOTICES_KEY);
+    if (last === undefined) {
+      const admitted = changes.find((change) => change.device === me && change.change === "added");
+      if (!start && changes.length === 0)
+        return;
+      if (start || admitted === undefined) {
+        this.#store.setKv(DEVICE_NOTICES_KEY, String(head));
+        return;
+      }
+      last = String(admitted.seq);
+    }
+    const fresh = changes.filter((change) => change.seq > Number(last));
+    if (fresh.length === 0)
+      return;
+    const replacers = new Set(fresh.filter((change) => change.change === "replaced").map((change) => change.by));
+    for (const change of fresh) {
+      if (change.device === me || change.by === me)
+        continue;
+      if (change.change === "added" && replacers.has(change.device))
+        continue;
+      this.#notices.device(change.seq, change.at);
+    }
+    this.#store.setKv(DEVICE_NOTICES_KEY, String(Math.max(head, Number(last))));
+  }
+  #noticeDevice(seq) {
+    const realm = this.#realm ?? this.#directory?.realm;
+    const person = this.#ownPerson();
+    if (!realm || !person)
+      return;
+    const changes = realm.deviceChanges(person);
+    const change = changes.find((c) => c.seq === seq);
+    if (!change)
+      return;
+    const labelOf = (device) => changes.filter((c) => c.device === device).at(-1)?.label;
+    const gone = (device) => changes.some((c) => c.device === device && (c.change === "removed" || c.change === "replaced"));
+    const subject = change.change === "replaced" ? change.by : change.device;
+    const latest = change.change === "replaced" ? changes.filter((c) => c.device === subject && c.change !== "removed" && c.change !== "replaced").at(-1) : change;
+    const label = latest?.label ?? labelOf(subject) ?? "device";
+    const current = !gone(subject);
+    const view = {
+      change: change.change,
+      device: subject,
+      label: MachineLabel.safeParse(label).success ? label : "device",
+      ...latest?.kind !== undefined ? { kind: latest.kind } : {},
+      vouch: ((v) => v === "service" ? "device" : v)(latest?.vouch ?? change.vouch),
+      ...(latest?.via ?? change.via) !== undefined ? { via: latest?.via ?? change.via } : {},
+      ...change.approver !== undefined && labelOf(change.approver) !== undefined ? { approver: labelOf(change.approver) } : {},
+      ...change.change === "replaced" ? { replaces: { device: change.device, label: change.label } } : {},
+      current,
+      at: change.at
+    };
+    const remove = current ? this.#removeWith() : undefined;
+    if (remove)
+      view.remove = remove;
+    return view;
+  }
+  #removeWith() {
+    const home = this.#directory;
+    if (!home)
+      return this.#roster?.isAdmin(this.#identity?.machine ?? "") ? "team" : undefined;
+    const self = home.list().devices.find((device) => device.self && device.current);
+    if (!self || self.vouched !== "jelly")
+      return;
+    return self.via === "browser" ? "sign-in" : "token";
+  }
+  #trustNotices() {
+    for (const grant of this.#grants.expiringTrust(TRUST_NOTICE_MS))
+      this.#notices.trust(grant.id, grant.person, grant.until, this.#now());
+  }
   #alerts() {
     const realmAlarm = this.#directory?.status().alarm;
     const roster = this.#keysMissing ? "keys_missing" : this.#keyring.restored() ? "restored" : undefined;
@@ -23095,6 +23565,16 @@ ${row.receipt ? "receipt" : "envelope"}`;
     }
     if (realmAlarm)
       this.#notices.alert(realmAlarm.kind, realmAlarm.at);
+    this.#deviceNotices();
+    if (this.#joinedOrUndefined())
+      this.#trustNotices();
+  }
+  #joinedOrUndefined() {
+    try {
+      return this.#joined();
+    } catch {
+      return;
+    }
   }
   #homeDirectory(method) {
     if (this.#directory)
@@ -23203,7 +23683,7 @@ ${row.receipt ? "receipt" : "envelope"}`;
       throw new MessagingError("relay_unavailable", "config.json has no relay url");
     let result;
     await this.#append((roster) => {
-      const made = createInvite(roster, identity, { person: p.person, role: p.role ?? "member", ttlMs: p.ttlMs ?? DEFAULT_INVITE_TTL_MS, relay, now: this.#now() });
+      const made = createInvite(roster, identity, { person: p.person, ttlMs: p.ttlMs ?? DEFAULT_INVITE_TTL_MS, relay, now: this.#now() });
       result = { ticket: made.ticket, inviteId: made.entry.body.inviteId, expires: made.entry.body.expires };
       return made.entry;
     });
@@ -23223,8 +23703,8 @@ ${row.receipt ? "receipt" : "envelope"}`;
     const invites = roster.entries().flatMap((entry) => {
       if (entry.kind !== "invite.create")
         return [];
-      const { inviteId, person, role, expires } = entry.body;
-      return [{ inviteId, person, role, expires, state: roster.invite(inviteId, now)?.state ?? "expired" }];
+      const { inviteId, person, expires } = entry.body;
+      return [{ inviteId, person, expires, state: roster.invite(inviteId, now)?.state ?? "expired" }];
     });
     return { team: { id: roster.team, name: roster.name }, members, invites };
   }
@@ -23247,7 +23727,7 @@ ${row.receipt ? "receipt" : "envelope"}`;
   }
   async#teamAdd(p) {
     const { identity } = this.#admin();
-    await this.#append((roster) => createEntry(roster, identity, "member.add", { machine: p.machine, enc: p.enc, person: p.person, role: p.role ?? "member", label: p.label }, this.#now()));
+    await this.#append((roster) => createEntry(roster, identity, "member.add", { machine: p.machine, enc: p.enc, person: p.person, role: "member", label: p.label }, this.#now()));
     this.#log("info", "team.added", { machine: p.machine, person: p.person });
     return { ok: true };
   }
@@ -23364,7 +23844,7 @@ function chainPersons(sender, payload) {
 function peerRef(member, session) {
   return { address: formatAddress(member.person, session, member.label), person: member.person, agent: session, device: member.machine, label: member.label };
 }
-function provenanceOf3(env, sender, now, external) {
+function provenanceOf3(env, sender, now) {
   const session = env.from.agent;
   return {
     envelopeId: env.id,
@@ -23374,8 +23854,7 @@ function provenanceOf3(env, sender, now, external) {
     device: sender.machine,
     label: sender.label,
     verified: "signature",
-    receivedAt: now,
-    ...external !== undefined ? { external: { principal: external.principal, gateway: sender.machine } } : {}
+    receivedAt: now
   };
 }
 function withProvenance(message, provenance) {
@@ -23391,7 +23870,7 @@ function plaintextBytes(env) {
 }
 function requestOf(row) {
   if (row.request === undefined)
-    throw new MessagingError("invalid_state", "this task began before this version of messagingd; its updates cannot be sent");
+    throw new MessagingError("invalid_state", "this task has no request to answer");
   return row.request;
 }
 function recipientSession(env) {
@@ -23463,7 +23942,15 @@ function jellyConfig(path, jelly) {
 function isLineTarget(to) {
   return to.startsWith("#") || !to.includes("/");
 }
-var DAY3 = 86400000, KEYCHAIN_LEFTOVERS_KEY = "keychain.stale", DEFAULT_TUNING, KEPT_MS, INPUT_TIMEOUT_MS, TASK_BYTES = 1048576, MACHINE_KEY = "identity.machine", DEFAULT_INVITE_TTL_MS, LIST_BYTES = 1572864;
+function signInToken(token) {
+  try {
+    const claims = parseWire(Buffer.from(token.split(".")[1] ?? "", "base64url").toString("utf8"));
+    return typeof claims === "object" && claims !== null && claims.src === "device";
+  } catch {
+    return false;
+  }
+}
+var DAY3 = 86400000, KEYCHAIN_LEFTOVERS_KEY = "keychain.stale", DEFAULT_TUNING, KEPT_MS, INPUT_TIMEOUT_MS, TASK_BYTES = 1048576, PREDECESSOR_KEY = "identity.predecessor", REPLACE_LABEL_KEY = "identity.replace.label", REPLACED_KEY = "identity.replaced", ERASURES_PER_DAY = 10, DEVICE_NOTICES_KEY = "notice.devices.seq", TRUST_NOTICE_MS, DEVICES_CHANGED_MS, MACHINE_KEY = "identity.machine", DEFAULT_INVITE_TTL_MS, LIST_BYTES = 1572864;
 var init_daemon = __esm(() => {
   init_dist();
   init_dist2();
@@ -23480,6 +23967,7 @@ var init_daemon = __esm(() => {
   init_policy();
   init_roster_identity();
   init_directory_home();
+  init_directory_identity();
   init_jelly3();
   init_jelly_env();
   init_answer_preview();
@@ -23509,644 +23997,11 @@ var init_daemon = __esm(() => {
   };
   KEPT_MS = DAY3;
   INPUT_TIMEOUT_MS = DAY3;
+  TRUST_NOTICE_MS = 7 * DAY3;
+  DEVICES_CHANGED_MS = 7 * DAY3;
   DEFAULT_INVITE_TTL_MS = DAY3;
 });
 
-// packages/daemon/dist/direct-link.js
-import { createServer } from "http";
-import { WebSocket, WebSocketServer } from "ws";
-function unavailable2(message) {
-  return new MessagingError("relay_unavailable", message);
-}
-
-class Bucket {
-  capacity;
-  #tokens;
-  #at = Date.now();
-  constructor(capacity) {
-    this.capacity = capacity;
-    this.#tokens = capacity;
-  }
-  take(amount = 1) {
-    const now = Date.now();
-    this.#tokens = Math.min(this.capacity, this.#tokens + (now - this.#at) * this.capacity / 60000);
-    this.#at = now;
-    if (this.#tokens < amount)
-      return false;
-    this.#tokens -= amount;
-    return true;
-  }
-}
-
-class Link {
-  peer;
-  role;
-  #ws;
-  #tx;
-  #rx;
-  #owner;
-  #pending = new Map;
-  #deliveries = Promise.resolve();
-  #closed = false;
-  constructor(peer, role, ws, keys, owner) {
-    this.peer = peer;
-    this.role = role;
-    this.#ws = ws;
-    this.#owner = owner;
-    const other = role === "initiator" ? "responder" : "initiator";
-    this.#tx = new DirectCipher(keys.record[role]);
-    this.#rx = new DirectCipher(keys.record[other]);
-    ws.removeAllListeners("message");
-    ws.on("message", (data, isBinary) => {
-      try {
-        this.#onMessage(data, isBinary);
-      } catch {
-        this.close(DIRECT_CLOSE.protocolError);
-      }
-    });
-    ws.on("close", () => this.#onClose());
-  }
-  get open() {
-    return !this.#closed && this.#ws.readyState === WebSocket.OPEN;
-  }
-  send(env, ackMs) {
-    const existing = this.#pending.get(env.id);
-    if (existing)
-      return existing.promise;
-    if (!this.open)
-      return Promise.reject(unavailable2("direct link closed"));
-    const text = JSON.stringify({ t: "send", env });
-    if (Buffer.byteLength(text) > LIMITS.frameBytes)
-      return Promise.reject(new MessagingError("too_large", "envelope exceeds the frame limit"));
-    let entry;
-    const promise = new Promise((resolve, reject) => {
-      const timer = setTimeout(() => this.#settle(env.id, unavailable2("direct peer did not answer in time")), ackMs);
-      timer.unref();
-      entry = { resolve, reject, timer, promise: undefined };
-    });
-    entry.promise = promise;
-    this.#pending.set(env.id, entry);
-    this.#write({ t: "send", env }, text);
-    return promise;
-  }
-  close(code) {
-    if (this.#closed)
-      return;
-    this.#closed = true;
-    this.#failAll();
-    this.#ws.close(code);
-    setTimeout(() => this.#ws.terminate(), 2000).unref();
-  }
-  #onClose() {
-    this.#closed = true;
-    this.#failAll();
-    this.#owner.forget(this);
-  }
-  #failAll() {
-    for (const id of [...this.#pending.keys()])
-      this.#settle(id, unavailable2("direct link closed"));
-  }
-  #settle(id, error) {
-    const entry = this.#pending.get(id);
-    if (!entry)
-      return;
-    this.#pending.delete(id);
-    clearTimeout(entry.timer);
-    if (error)
-      entry.reject(error);
-    else
-      entry.resolve();
-  }
-  #write(record, text = JSON.stringify(record)) {
-    if (this.open)
-      this.#ws.send(this.#tx.seal(Buffer.from(text, "utf8")));
-  }
-  #onMessage(data, isBinary) {
-    if (this.#closed)
-      return;
-    if (!isBinary)
-      return this.close(DIRECT_CLOSE.protocolError);
-    if (!this.#owner.isMember(this.peer))
-      return this.close(DIRECT_CLOSE.notMember);
-    const bytes = bufferOf(data);
-    let raw;
-    try {
-      raw = parseWire(this.#rx.open(bytes).toString("utf8"), { maxBytes: LIMITS.frameBytes });
-    } catch {
-      return this.close(DIRECT_CLOSE.protocolError);
-    }
-    const within = this.#owner.withinRate(this.peer, bytes.length);
-    const parsed = DirectRecord.safeParse(raw);
-    if (!parsed.success) {
-      const id = raw?.env?.id;
-      if (raw?.t === "send" && Ulid.safeParse(id).success)
-        this.#write({ t: "nack", id, code: within ? "invalid_request" : "rate_limited" });
-      return;
-    }
-    const record = parsed.data;
-    if (record.t === "send")
-      return this.#onSend(raw.env, record.env, within);
-    if (!within)
-      return;
-    if (record.t === "ack")
-      this.#settle(record.id);
-    else
-      this.#settle(record.id, new MessagingError(record.code, "refused by the direct peer"));
-  }
-  #onSend(raw, env, within) {
-    const nack = (code) => this.#write({ t: "nack", id: env.id, code });
-    if (!within)
-      return nack("rate_limited");
-    if (env.from.device !== this.peer || env.to.device !== this.#owner.self || env.type === "presence")
-      return nack("invalid_request");
-    this.#deliveries = this.#deliveries.then(async () => {
-      try {
-        await this.#owner.deliver(raw);
-      } catch (error) {
-        return nack(error instanceof MessagingError ? error.code : "internal");
-      }
-      this.#write({ t: "ack", id: env.id });
-    });
-  }
-}
-
-class DirectLinks {
-  #options;
-  #limits;
-  #in = new Map;
-  #out = new Map;
-  #dials = new Map;
-  #rates = new Map;
-  #pendingByAddress = new Map;
-  #handshakes;
-  #sockets = new Set;
-  #dialing = new Set;
-  #pending = 0;
-  #server;
-  #wss;
-  #closed = false;
-  stats = { inbound: 0, outbound: 0, refused: 0, dialFailed: 0, delivered: 0 };
-  constructor(options) {
-    this.#options = options;
-    this.#limits = { ...DEFAULT_DIRECT_LIMITS, ...options.limits };
-    this.#handshakes = new Bucket(this.#limits.handshakesPerMinute);
-  }
-  get self() {
-    return this.#options.identity.machine;
-  }
-  isMember(machine) {
-    return machine !== this.self && this.#options.member(machine) !== undefined;
-  }
-  listen(host, port) {
-    if (this.#server)
-      return Promise.reject(new MessagingError("invalid_state", "already listening"));
-    const server = createServer((_req, res) => {
-      res.writeHead(426, { connection: "close" });
-      res.end();
-    });
-    server.headersTimeout = this.#limits.handshakeMs;
-    server.requestTimeout = this.#limits.handshakeMs;
-    server.maxConnections = this.#limits.pending + 256;
-    const wss = new WebSocketServer({ noServer: true, clientTracking: false, ...SOCKET_OPTIONS });
-    server.on("connection", (socket) => {
-      this.#sockets.add(socket);
-      socket.once("close", () => this.#sockets.delete(socket));
-    });
-    server.on("upgrade", (req, socket, head) => this.#upgrade(wss, req, socket, head));
-    this.#server = server;
-    this.#wss = wss;
-    return new Promise((resolve, reject) => {
-      server.once("error", reject);
-      server.listen({ host, port, exclusive: true }, () => {
-        server.off("error", reject);
-        server.on("error", () => {});
-        const bound = server.address();
-        if (bound === null || typeof bound === "string")
-          return reject(new MessagingError("internal", "listener has no address"));
-        resolve({ host: bound.address, port: bound.port });
-      });
-    });
-  }
-  async close() {
-    this.#closed = true;
-    for (const link of [...this.#in.values(), ...this.#out.values()])
-      link.close(1001);
-    for (const ws of this.#dialing)
-      ws.terminate();
-    this.#in.clear();
-    this.#out.clear();
-    const server = this.#server;
-    this.#server = undefined;
-    this.#wss?.close();
-    if (!server)
-      return;
-    await new Promise((resolve) => {
-      server.close(() => resolve());
-      for (const socket of this.#sockets)
-        socket.destroy();
-    });
-  }
-  hasLink(peer) {
-    return this.#linkTo(peer) !== undefined;
-  }
-  async send(peer, endpoints, env) {
-    if (this.#closed)
-      throw unavailable2("direct links are closed");
-    if (!this.isMember(peer))
-      throw new MessagingError("not_member", "not a current member");
-    let link = this.#linkTo(peer);
-    if (!link) {
-      if (endpoints.length === 0)
-        throw unavailable2("no direct link to this machine");
-      link = await this.#dialOnce(peer, endpoints);
-    }
-    await link.send(env, this.#limits.ackMs);
-  }
-  prune() {
-    for (const link of [...this.#in.values(), ...this.#out.values()])
-      if (!this.isMember(link.peer))
-        link.close(DIRECT_CLOSE.notMember);
-  }
-  forget(link) {
-    if (this.#in.get(link.peer) === link)
-      this.#in.delete(link.peer);
-    if (this.#out.get(link.peer) === link)
-      this.#out.delete(link.peer);
-  }
-  withinRate(peer, bytes) {
-    let rate = this.#rates.get(peer);
-    if (!rate) {
-      rate = { frames: new Bucket(this.#limits.framesPerMinute), bytes: new Bucket(this.#limits.bytesPerMinute) };
-      this.#rates.set(peer, rate);
-    }
-    return rate.frames.take() && rate.bytes.take(bytes);
-  }
-  async deliver(raw) {
-    await this.#options.onDeliver(raw);
-    this.stats.delivered++;
-  }
-  #linkTo(peer) {
-    for (const link of [this.#out.get(peer), this.#in.get(peer)])
-      if (link?.open)
-        return link;
-    return;
-  }
-  #upgrade(wss, req, socket, head) {
-    const address = req.socket.remoteAddress ?? "?";
-    const fromAddress = this.#pendingByAddress.get(address) ?? 0;
-    const path = new URL(req.url ?? "/", "http://direct").pathname;
-    if (this.#closed || path !== DIRECT_PATH || this.#pending >= this.#limits.pending || fromAddress >= this.#limits.pendingPerAddress || !this.#handshakes.take()) {
-      this.stats.refused++;
-      socket.destroy();
-      return;
-    }
-    this.#pending++;
-    this.#pendingByAddress.set(address, fromAddress + 1);
-    let released = false;
-    const release = () => {
-      if (released)
-        return;
-      released = true;
-      this.#pending--;
-      const left = (this.#pendingByAddress.get(address) ?? 1) - 1;
-      if (left > 0)
-        this.#pendingByAddress.set(address, left);
-      else
-        this.#pendingByAddress.delete(address);
-    };
-    const timer = setTimeout(() => {
-      release();
-      socket.destroy();
-    }, this.#limits.handshakeMs);
-    timer.unref();
-    socket.once("close", () => {
-      clearTimeout(timer);
-      release();
-    });
-    wss.handleUpgrade(req, socket, head, (ws) => this.#respond(ws, () => {
-      clearTimeout(timer);
-      release();
-    }));
-  }
-  #respond(ws, done) {
-    const { identity, team } = this.#options;
-    let state = { step: "hello" };
-    const refuse = () => {
-      state = { step: "done" };
-      this.stats.refused++;
-      done();
-      ws.close(DIRECT_CLOSE.authFailed);
-      setTimeout(() => ws.terminate(), 2000).unref();
-    };
-    ws.on("error", () => {});
-    ws.on("message", (data, isBinary) => {
-      try {
-        step(data, isBinary);
-      } catch {
-        if (state.step !== "done")
-          refuse();
-      }
-    });
-    ws.on("close", () => done());
-    const step = (data, isBinary) => {
-      if (state.step === "done")
-        return;
-      if (state.step === "hello") {
-        const hello = handshakeFrame(DirectHelloFrame, data, isBinary);
-        if (!hello)
-          return refuse();
-        const own = directEphemeral();
-        const transcript = directTranscript(hello, own.half);
-        let keys;
-        try {
-          keys = directKeys(own.key, hello.epk, transcript);
-        } catch {
-          return refuse();
-        }
-        const sig = sign(identity, DOMAIN.directAuth, directAuthPayload({ transcript, team, role: "responder", machine: identity.machine }));
-        state = { step: "auth", transcript, keys };
-        ws.send(JSON.stringify({ t: "accept", ...own.half, box: sealDirectBox(keys.box.responder, transcript, { team, machine: identity.machine, sig }) }));
-        return;
-      }
-      const { transcript, keys } = state;
-      const auth = handshakeFrame(DirectAuthFrame, data, isBinary);
-      const peer = auth && openIdentity(keys.box.initiator, transcript, auth.box);
-      if (!peer || peer.team !== team || !this.isMember(peer.machine))
-        return refuse();
-      const signed = directAuthPayload({ transcript, team, role: "initiator", machine: peer.machine, peer: identity.machine });
-      if (!verify(peer.machine, DOMAIN.directAuth, signed, peer.sig))
-        return refuse();
-      state = { step: "done" };
-      done();
-      if (this.#closed)
-        return void ws.close(1001);
-      const link = new Link(peer.machine, "responder", ws, keys, this);
-      this.#in.get(peer.machine)?.close(DIRECT_CLOSE.replaced);
-      this.#in.set(peer.machine, link);
-      this.stats.inbound++;
-    };
-  }
-  #dialOnce(peer, endpoints) {
-    let dial = this.#dials.get(peer);
-    if (!dial) {
-      dial = this.#dialAny(peer, endpoints).finally(() => this.#dials.delete(peer));
-      this.#dials.set(peer, dial);
-    }
-    return dial;
-  }
-  async#dialAny(peer, endpoints) {
-    let last;
-    for (const endpoint of endpoints) {
-      try {
-        const link = await this.#dial(peer, endpoint);
-        if (this.#closed) {
-          link.close(1001);
-          break;
-        }
-        this.#out.get(peer)?.close(1000);
-        this.#out.set(peer, link);
-        this.stats.outbound++;
-        return link;
-      } catch (error) {
-        last = error;
-      }
-    }
-    this.stats.dialFailed++;
-    throw last instanceof MessagingError ? last : unavailable2("could not reach the direct peer");
-  }
-  #dial(peer, endpoint) {
-    const { identity, team } = this.#options;
-    const host = endpoint.host.includes(":") ? `[${endpoint.host}]` : endpoint.host;
-    return new Promise((resolve, reject) => {
-      const ws = new WebSocket(`ws://${host}:${endpoint.port}${DIRECT_PATH}`, { ...SOCKET_OPTIONS, handshakeTimeout: this.#limits.dialMs, followRedirects: false });
-      this.#dialing.add(ws);
-      let settled = false;
-      const fail = (message) => {
-        if (settled)
-          return;
-        settled = true;
-        clearTimeout(timer);
-        this.#dialing.delete(ws);
-        ws.removeAllListeners("message");
-        if (ws.readyState === WebSocket.OPEN)
-          ws.close(DIRECT_CLOSE.authFailed);
-        else
-          ws.terminate();
-        reject(unavailable2(message));
-      };
-      const timer = setTimeout(() => fail("direct handshake timed out"), this.#limits.dialMs);
-      timer.unref();
-      const own = directEphemeral();
-      ws.on("error", () => fail("cannot reach the direct peer"));
-      ws.on("close", () => fail("the direct peer closed the link"));
-      ws.on("unexpected-response", () => fail("the direct peer refused the upgrade"));
-      ws.on("open", () => ws.send(JSON.stringify({ t: "hello", proto: DIRECT_PROTOCOL, ...own.half })));
-      ws.on("message", (data, isBinary) => {
-        try {
-          onAccept(data, isBinary);
-        } catch {
-          fail("bad handshake");
-        }
-      });
-      const onAccept = (data, isBinary) => {
-        if (settled)
-          return;
-        const accept = handshakeFrame(DirectAcceptFrame, data, isBinary);
-        if (!accept)
-          return fail("bad handshake frame");
-        const transcript = directTranscript(own.half, accept);
-        let keys;
-        try {
-          keys = directKeys(own.key, accept.epk, transcript);
-        } catch {
-          return fail("unusable handshake key");
-        }
-        const them = openIdentity(keys.box.responder, transcript, accept.box);
-        if (!them || them.team !== team || them.machine !== peer || !this.isMember(peer))
-          return fail("the direct peer is not the expected member");
-        if (!verify(peer, DOMAIN.directAuth, directAuthPayload({ transcript, team, role: "responder", machine: peer }), them.sig))
-          return fail("bad handshake signature");
-        const sig = sign(identity, DOMAIN.directAuth, directAuthPayload({ transcript, team, role: "initiator", machine: identity.machine, peer }));
-        ws.send(JSON.stringify({ t: "auth", box: sealDirectBox(keys.box.initiator, transcript, { team, machine: identity.machine, sig }) }));
-        settled = true;
-        clearTimeout(timer);
-        this.#dialing.delete(ws);
-        ws.removeAllListeners("close");
-        resolve(new Link(peer, "initiator", ws, keys, this));
-      };
-    });
-  }
-}
-function handshakeFrame(schema, data, isBinary) {
-  if (isBinary)
-    return;
-  const bytes = bufferOf(data);
-  if (bytes.length > DIRECT_HANDSHAKE_BYTES)
-    return;
-  try {
-    const parsed = schema.safeParse(parseWire(bytes.toString("utf8"), { maxBytes: DIRECT_HANDSHAKE_BYTES }));
-    return parsed.success ? parsed.data : undefined;
-  } catch {
-    return;
-  }
-}
-function openIdentity(key, transcript, box) {
-  try {
-    const parsed = DirectIdentity.safeParse(openDirectBox(key, transcript, box));
-    return parsed.success ? parsed.data : undefined;
-  } catch {
-    return;
-  }
-}
-function bufferOf(data) {
-  if (Buffer.isBuffer(data))
-    return data;
-  if (Array.isArray(data))
-    return Buffer.concat(data);
-  return Buffer.from(data);
-}
-var DIRECT_PATH = "/v1/direct", DIRECT_CLOSE, DEFAULT_DIRECT_LIMITS, RECORD_BYTES, SOCKET_OPTIONS;
-var init_direct_link = __esm(() => {
-  init_dist();
-  DIRECT_CLOSE = { authFailed: 4001, protocolError: 4002, notMember: 4003, replaced: 4004 };
-  DEFAULT_DIRECT_LIMITS = {
-    pending: 16,
-    pendingPerAddress: 4,
-    handshakeMs: 5000,
-    handshakesPerMinute: 120,
-    dialMs: 2000,
-    ackMs: 5000,
-    framesPerMinute: LIMITS.relayFramesPerMinute,
-    bytesPerMinute: LIMITS.relayBytesPerMinute
-  };
-  RECORD_BYTES = LIMITS.frameBytes + 16;
-  SOCKET_OPTIONS = { maxPayload: RECORD_BYTES, perMessageDeflate: false };
-});
-
-// packages/daemon/dist/direct-transport.js
-function withDirect(relay, tuning = {}) {
-  return (options) => options.direct?.enabled === true && options.team !== undefined ? new DirectTransport(relay, options, options.direct, tuning) : relay(options);
-}
-
-class DirectTransport {
-  #relay;
-  #links;
-  #options;
-  #config;
-  #listen;
-  #backoffMs;
-  #maxBackoffMs;
-  #backoff = new Map;
-  #advertised;
-  #running = false;
-  #counts = { direct: 0, relay: 0, fallback: 0 };
-  constructor(relay, options, config, tuning = {}) {
-    this.#options = options;
-    this.#config = config;
-    const listen = parseHostPort(config.listen ?? DEFAULT_DIRECT_LISTEN);
-    this.#listen = { host: listen.host, port: listen.port ?? 0 };
-    this.#backoffMs = tuning.backoffMs ?? 30000;
-    this.#maxBackoffMs = tuning.maxBackoffMs ?? 600000;
-    this.#links = new DirectLinks({
-      identity: options.identity,
-      team: options.team,
-      member: (machine) => options.member?.(machine),
-      onDeliver: (raw) => options.onDeliver(raw),
-      ...tuning.limits ? { limits: tuning.limits } : {}
-    });
-    this.#relay = relay(options);
-  }
-  start() {
-    if (this.#running)
-      return;
-    this.#running = true;
-    this.#links.listen(this.#listen.host, this.#listen.port).then((bound) => {
-      if (!this.#running)
-        return;
-      this.#advertised = advertisedEndpoints(this.#config, bound);
-      this.#options.log?.("info", "direct.listening", { host: bound.host, port: bound.port, advertised: this.#advertised.length });
-    }).catch((error) => this.#options.log?.("warn", "direct.listen.failed", { code: codeOf(error) })).finally(() => {
-      if (this.#running)
-        this.#relay.start();
-    });
-  }
-  async stop() {
-    this.#running = false;
-    this.#advertised = undefined;
-    await this.#links.close();
-    await this.#relay.stop();
-  }
-  get connected() {
-    return this.#relay.connected;
-  }
-  get stats() {
-    return { ...this.#links.stats, ...this.#counts };
-  }
-  async send(env) {
-    const to = this.#running && env.type !== "presence" && "device" in env.to ? env.to.device : undefined;
-    if (to !== undefined) {
-      const endpoints = this.#dialable(to);
-      if (endpoints.length > 0 || this.#links.hasLink(to)) {
-        try {
-          await this.#links.send(to, endpoints, env);
-          this.#backoff.delete(to);
-          this.#counts.direct++;
-          return;
-        } catch (error) {
-          this.#counts.fallback++;
-          this.#fail(to);
-          this.#options.log?.("info", "direct.fallback", { id: env.id, code: codeOf(error) });
-        }
-      }
-    }
-    await this.#relay.send(env);
-    this.#counts.relay++;
-  }
-  presence(env) {
-    this.#relay.presence(env);
-  }
-  retryNow() {
-    this.#relay.retryNow?.();
-  }
-  appendRoster(entry) {
-    return this.#relay.appendRoster(entry);
-  }
-  syncRoster(after) {
-    return this.#relay.syncRoster(after);
-  }
-  rosterChanged() {
-    this.#links.prune();
-  }
-  hasLink(machine) {
-    return this.#links.hasLink(machine);
-  }
-  advertise() {
-    const direct = this.#advertised;
-    return direct && direct.length > 0 ? { features: ["direct"], direct } : undefined;
-  }
-  #dialable(machine) {
-    const backoff = this.#backoff.get(machine);
-    if (backoff && Date.now() < backoff.until)
-      return [];
-    if (!this.#options.member?.(machine))
-      return [];
-    const presence = this.#options.presence?.(machine);
-    if (!presence?.features?.includes("direct") || !presence.direct)
-      return [];
-    return presence.direct.filter((endpoint) => mayDial(endpoint, isLoopback(this.#listen.host)));
-  }
-  #fail(machine) {
-    const prior = this.#backoff.get(machine);
-    const ms = prior ? Math.min(prior.ms * 2, this.#maxBackoffMs) : this.#backoffMs;
-    this.#backoff.set(machine, { until: Date.now() + ms, ms });
-  }
-}
-var init_direct_transport = __esm(() => {
-  init_direct_config();
-  init_direct_link();
-  init_log();
-});
-
 // packages/relay/dist/frames.js
 function text3(data) {
   if (Buffer.isBuffer(data))
@@ -24176,21 +24031,37 @@ var init_pages = __esm(() => {
   ROSTER_PAGE_BYTES = LIMITS.frameBytes - 4096;
   PAGE_CACHE_BYTES = 8 * MIB;
 });
+// packages/relay/dist/metrics.js
+var init_metrics = () => {};
+
 // packages/relay/dist/store.js
 var init_store3 = __esm(() => {
   init_dist();
+  init_metrics();
 });
 
+// packages/relay/dist/backoff.js
+function backoffDelay(attempt, minMs, maxMs, random = Math.random) {
+  const ceiling = Math.min(maxMs, minMs * 2 ** Math.min(attempt, 30));
+  return Math.round(ceiling / 2 + random() * (ceiling / 2));
+}
+
 // packages/relay/dist/directory/jelly.js
 var init_jelly4 = __esm(() => {
   init_dist();
 });
 
+// packages/relay/dist/directory/witness.js
+var init_witness = __esm(() => {
+  init_dist();
+});
+
 // packages/relay/dist/directory/directory.js
 var WARM_MAX_MS;
 var init_directory3 = __esm(() => {
   init_dist();
   init_jelly4();
+  init_witness();
   WARM_MAX_MS = 5 * 60000;
 });
 
@@ -24199,6 +24070,7 @@ var DAY_MS4 = 86400000, FEED_RETENTION_MS;
 var init_feed = __esm(() => {
   init_dist();
   init_jelly4();
+  init_store3();
   FEED_RETENTION_MS = 90 * DAY_MS4;
 });
 
@@ -24231,6 +24103,7 @@ var init_module = __esm(() => {
     "dir.sth",
     "dir.lookup",
     "dir.device",
+    "dir.heads",
     "dir.resolve",
     "dir.search",
     "dir.watch",
@@ -24247,7 +24120,7 @@ var init_store4 = __esm(() => {
 });
 
 // packages/relay/dist/server.js
-var HIGH_WATER, MAX_BUFFERED;
+var FRAME_TYPES, HIGH_WATER, MAX_BUFFERED;
 var init_server2 = __esm(() => {
   init_dist();
   init_frames();
@@ -24255,20 +24128,43 @@ var init_server2 = __esm(() => {
   init_limits();
   init_pages();
   init_store3();
+  init_metrics();
   init_module();
   init_store4();
+  FRAME_TYPES = new Set([
+    "challenge",
+    "hello",
+    "welcome",
+    "ping",
+    "pong",
+    "join",
+    "roster.append",
+    "roster.sync",
+    "roster",
+    "roster.ok",
+    "peer",
+    "send",
+    "presence",
+    "recv.ack",
+    "deliver",
+    "ack",
+    "nack",
+    "error",
+    "dir.ok",
+    "dir.persons",
+    "dir.headsAre",
+    "dir.sthIs",
+    "dir.resolved",
+    "dir.changed",
+    "dir.unbound",
+    ...DIRECTORY_FRAMES
+  ]);
   HIGH_WATER = 1024 * 1024;
   MAX_BUFFERED = 16 * 1024 * 1024;
 });
 
-// packages/relay/dist/backoff.js
-function backoffDelay(attempt, minMs, maxMs, random = Math.random) {
-  const ceiling = Math.min(maxMs, minMs * 2 ** Math.min(attempt, 30));
-  return Math.round(ceiling / 2 + random() * (ceiling / 2));
-}
-
 // packages/relay/dist/client.js
-import { WebSocket as WebSocket2 } from "ws";
+import { WebSocket } from "ws";
 
 class RelayClient {
   #options;
@@ -24325,7 +24221,7 @@ class RelayClient {
     if (!ws)
       return;
     await new Promise((resolve) => {
-      if (ws.readyState === WebSocket2.CLOSED)
+      if (ws.readyState === WebSocket.CLOSED)
         return resolve();
       const force = setTimeout(() => ws.terminate(), 2000);
       ws.once("close", () => {
@@ -24347,7 +24243,7 @@ class RelayClient {
       return existing.promise;
     const ws = this.#socket();
     if (!ws)
-      return Promise.reject(unavailable3("not connected to the relay"));
+      return Promise.reject(unavailable2("not connected to the relay"));
     const text = frameText({ t: "send", env });
     if (text instanceof MessagingError)
       return Promise.reject(text);
@@ -24378,6 +24274,9 @@ class RelayClient {
   dirSth(args = {}) {
     return this.#dir("dir.sthIs", { t: "dir.sth", ...args });
   }
+  dirHeads(persons, size) {
+    return this.#dir("dir.headsAre", { t: "dir.heads", persons, ...size !== undefined ? { size } : {} });
+  }
   dirLookup(persons, size) {
     return this.#dir("dir.persons", { t: "dir.lookup", persons, ...size !== undefined ? { size } : {} });
   }
@@ -24407,7 +24306,7 @@ class RelayClient {
       return Promise.reject(new MessagingError("invalid_request", "this relay link is not to a directory relay"));
     const ws = this.#socket();
     if (!ws)
-      return Promise.reject(unavailable3("not connected to the relay"));
+      return Promise.reject(unavailable2("not connected to the relay"));
     const req = `r${++this.#req}`;
     const text = frameText({ ...frame, req });
     if (text instanceof MessagingError)
@@ -24415,7 +24314,7 @@ class RelayClient {
     const timer = setTimeout(() => {
       const request = this.#dirRequests.get(req);
       this.#dirRequests.delete(req);
-      request?.pending.reject(unavailable3("relay did not answer in time"));
+      request?.pending.reject(unavailable2("relay did not answer in time"));
     }, REQUEST_MS);
     timer.unref();
     const pending = deferred();
@@ -24447,7 +24346,7 @@ class RelayClient {
     this.#helloSent = false;
     this.#error = undefined;
     this.#lastSeen = Date.now();
-    const ws = new WebSocket2(this.#options.url, SOCKET_OPTIONS2);
+    const ws = new WebSocket(this.#options.url, SOCKET_OPTIONS);
     this.#ws = ws;
     this.#welcomeTimer = setTimeout(() => {
       if (this.#ws !== ws || this.#connected)
@@ -24469,7 +24368,7 @@ class RelayClient {
     clearInterval(this.#pingTimer);
     clearTimeout(this.#welcomeTimer);
     this.#connected = false;
-    const lost = unavailable3("relay connection closed");
+    const lost = unavailable2("relay connection closed");
     for (const pending of this.#sends.values())
       pending.reject(lost);
     for (const request of [...this.#requests.values(), ...this.#dirRequests.values()]) {
@@ -24658,12 +24557,12 @@ ${id}`;
   #request(expect, frame) {
     const ws = this.#socket();
     if (!ws)
-      return Promise.reject(unavailable3("not connected to the relay"));
+      return Promise.reject(unavailable2("not connected to the relay"));
     const req = `r${++this.#req}`;
     const text = frameText({ ...frame, req });
     if (text instanceof MessagingError)
       return Promise.reject(text);
-    const timer = setTimeout(() => this.#take(req)?.pending.reject(unavailable3("relay did not answer in time")), REQUEST_MS);
+    const timer = setTimeout(() => this.#take(req)?.pending.reject(unavailable2("relay did not answer in time")), REQUEST_MS);
     timer.unref();
     const request = expect === "roster" ? { expect, pending: deferred(), timer } : { expect, pending: deferred(), timer };
     this.#requests.set(req, request);
@@ -24671,7 +24570,7 @@ ${id}`;
     return request.pending.promise;
   }
   #socket() {
-    return this.#connected && this.#ws?.readyState === WebSocket2.OPEN ? this.#ws : undefined;
+    return this.#connected && this.#ws?.readyState === WebSocket.OPEN ? this.#ws : undefined;
   }
 }
 function createTeamOnRelay(url, genesis) {
@@ -24698,7 +24597,7 @@ function directoryOneShot(url, frame, expect) {
     }
     let settled = false;
     let sent = false;
-    const ws = new WebSocket2(url, SOCKET_OPTIONS2);
+    const ws = new WebSocket(url, SOCKET_OPTIONS);
     const finish = (error, value) => {
       if (settled)
         return;
@@ -24710,7 +24609,7 @@ function directoryOneShot(url, frame, expect) {
       else
         resolve(value);
     };
-    const timer = setTimeout(() => finish(unavailable3("relay did not answer")), ONE_SHOT_MS);
+    const timer = setTimeout(() => finish(unavailable2("relay did not answer")), ONE_SHOT_MS);
     ws.on("message", (data, isBinary) => {
       if (isBinary)
         return;
@@ -24722,7 +24621,10 @@ function directoryOneShot(url, frame, expect) {
       }
       if (raw?.t === "challenge" && !sent) {
         sent = true;
-        const outgoing = frameText({ ...frame, req: "r1" }, LIMITS.preAuthFrameBytes);
+        if (typeof frame === "function" && raw.relay !== relayOrigin(url))
+          return finish(unavailable2("relay id does not match the relay URL origin"));
+        const body = typeof frame === "function" ? frame({ relay: String(raw.relay), nonce: String(raw.nonce) }) : frame;
+        const outgoing = frameText({ ...body, req: "r1" }, LIMITS.preAuthFrameBytes);
         if (outgoing instanceof MessagingError)
           return finish(outgoing);
         ws.send(outgoing);
@@ -24735,18 +24637,26 @@ function directoryOneShot(url, frame, expect) {
         }
       }
     });
-    ws.on("error", (error) => finish(unavailable3(`cannot reach the relay: ${error.message}`)));
-    ws.on("close", () => finish(unavailable3("relay closed the connection")));
+    ws.on("error", (error) => finish(unavailable2(`cannot reach the relay: ${error.message}`)));
+    ws.on("close", () => finish(unavailable2("relay closed the connection")));
   });
 }
 function sthOnRelay(url, args = {}) {
   return directoryOneShot(url, { t: "dir.sth", ...args }, "dir.sthIs");
 }
-function lookupOnRelay(url, persons, size) {
-  return directoryOneShot(url, { t: "dir.lookup", persons, ...size !== undefined ? { size } : {} }, "dir.persons");
+function lookupOnRelay(url, persons, size, identity, realm) {
+  return directoryOneShot(url, (challenge) => ({
+    t: "dir.lookup",
+    persons,
+    ...size !== undefined ? { size } : {},
+    proof: { device: identity.machine, sig: sign(identity, DOMAIN.dirRead, dirReadPayload({ relay: challenge.relay, realm, device: identity.machine, nonce: challenge.nonce })) }
+  }), "dir.persons");
+}
+function headsOnRelay(url, persons, size) {
+  return directoryOneShot(url, { t: "dir.heads", persons, ...size !== undefined ? { size } : {} }, "dir.headsAre");
 }
 function deviceOnRelay(url, device) {
-  return directoryOneShot(url, { t: "dir.device", device }, "dir.persons");
+  return directoryOneShot(url, { t: "dir.device", device }, "dir.headsAre");
 }
 function redeemOnRelay(url, entry) {
   return oneShot(url, { t: "roster.append", entry }, "roster.ok");
@@ -24764,7 +24674,7 @@ function fetchRosterAsMember(url, team, identity) {
     let welcomed = false;
     let req = 0;
     let page;
-    const ws = new WebSocket2(url, SOCKET_OPTIONS2);
+    const ws = new WebSocket(url, SOCKET_OPTIONS);
     const finish = (error, value) => {
       if (settled)
         return;
@@ -24780,7 +24690,7 @@ function fetchRosterAsMember(url, team, identity) {
       page?.pending.reject(error);
       finish(error);
     };
-    const timer = setTimeout(() => fail(unavailable3("relay did not answer")), ONE_SHOT_MS);
+    const timer = setTimeout(() => fail(unavailable2("relay did not answer")), ONE_SHOT_MS);
     const fetchPage = (after) => {
       const pending = deferred();
       const outgoing = frameText({ t: "roster.sync", req: `r${++req}`, after });
@@ -24829,8 +24739,8 @@ function fetchRosterAsMember(url, team, identity) {
         fail(new MessagingError(reply.code, reply.message));
       }
     });
-    ws.on("error", (error) => fail(unavailable3(`cannot reach the relay: ${error.message}`)));
-    ws.on("close", () => fail(unavailable3("relay closed the connection")));
+    ws.on("error", (error) => fail(unavailable2(`cannot reach the relay: ${error.message}`)));
+    ws.on("close", () => fail(unavailable2("relay closed the connection")));
   });
 }
 function oneShot(url, frame, expect) {
@@ -24844,7 +24754,7 @@ function oneShot(url, frame, expect) {
     const req = "r1";
     let settled = false;
     let sent = false;
-    const ws = new WebSocket2(url, SOCKET_OPTIONS2);
+    const ws = new WebSocket(url, SOCKET_OPTIONS);
     const finish = (error, value) => {
       if (settled)
         return;
@@ -24856,7 +24766,7 @@ function oneShot(url, frame, expect) {
       else
         resolve(value);
     };
-    const timer = setTimeout(() => finish(unavailable3("relay did not answer")), ONE_SHOT_MS);
+    const timer = setTimeout(() => finish(unavailable2("relay did not answer")), ONE_SHOT_MS);
     ws.on("message", (data, isBinary) => {
       if (isBinary)
         return;
@@ -24893,8 +24803,8 @@ function oneShot(url, frame, expect) {
         finish(new MessagingError(reply.code, reply.message));
       }
     });
-    ws.on("error", (error) => finish(unavailable3(`cannot reach the relay: ${error.message}`)));
-    ws.on("close", () => finish(unavailable3("relay closed the connection")));
+    ws.on("error", (error) => finish(unavailable2(`cannot reach the relay: ${error.message}`)));
+    ws.on("close", () => finish(unavailable2("relay closed the connection")));
   });
 }
 async function collectPages(after, pages, fetch2) {
@@ -24930,7 +24840,7 @@ function frameText(frame, limit = LIMITS.frameBytes) {
     return new MessagingError("too_large", `frame exceeds the relay's ${limit}-byte limit`);
   return json;
 }
-function unavailable3(message) {
+function unavailable2(message) {
   return new MessagingError("relay_unavailable", message);
 }
 function deferred() {
@@ -24948,12 +24858,12 @@ function callback(fn) {
     fn();
   } catch {}
 }
-var PING_MS = 20000, DEAD_MS, HANDSHAKE_MS = 1e4, WELCOME_MS = 15000, ONE_SHOT_MS = 15000, REQUEST_MS = 15000, MAX_PAGES = 256, SOCKET_OPTIONS2, RelayRefusal;
+var PING_MS = 20000, DEAD_MS, HANDSHAKE_MS = 1e4, WELCOME_MS = 15000, ONE_SHOT_MS = 15000, REQUEST_MS = 15000, MAX_PAGES = 256, SOCKET_OPTIONS, RelayRefusal;
 var init_client2 = __esm(() => {
   init_dist();
   init_frames();
   DEAD_MS = 2 * PING_MS + 5000;
-  SOCKET_OPTIONS2 = { maxPayload: LIMITS.frameBytes, perMessageDeflate: false, handshakeTimeout: HANDSHAKE_MS };
+  SOCKET_OPTIONS = { maxPayload: LIMITS.frameBytes, perMessageDeflate: false, handshakeTimeout: HANDSHAKE_MS };
   RelayRefusal = class RelayRefusal extends MessagingError {
     retryAfterMs;
     constructor(code, message, retryAfterMs) {
@@ -25072,6 +24982,9 @@ class RelayDirectoryLink {
       throw shape();
     return { seq: reply.seq, sth: reply.sth };
   }
+  async erase(entries, token) {
+    parse5(DirOkFrame, await link((await this.#authed()).dirErase(entries, token)));
+  }
   async keys(statement) {
     const reply = parse5(DirOkFrame, await link((await this.#authed()).dirKeys(statement)));
     if (reply.sth === undefined)
@@ -25090,11 +25003,21 @@ class RelayDirectoryLink {
   }
   async lookup(persons, size) {
     const asks = persons.map((p) => ({ person: p.person, ...p.knownSeq !== undefined ? { knownSeq: p.knownSeq } : {} }));
-    const reply = parse5(DirPersonsFrame, await this.#read((client) => client.dirLookup(asks, size), () => lookupOnRelay(this.#options.url, asks, size)));
+    const { url, identity, realm } = this.#options;
+    const own = this.#options.person();
+    const reply = parse5(DirPersonsFrame, await this.#read((client) => client.dirLookup(asks, size), () => lookupOnRelay(url, asks, size, identity, realm), asks.some((ask) => ask.person !== own)));
     return { sth: reply.sth, persons: reply.persons };
   }
-  async#read(authed, preAuth) {
-    const client = this.#connect();
+  async heads(persons, size) {
+    const reply = parse5(DirHeadsAreFrame, await this.#read((client) => client.dirHeads([...persons], size), () => headsOnRelay(this.#options.url, [...persons], size)));
+    return { sth: reply.sth, head: reply.head, persons: reply.persons };
+  }
+  async#read(authed, preAuth, wait = false) {
+    let client = this.#connect();
+    if (wait && client && !client.connected)
+      client = await this.#authed().catch(() => {
+        return;
+      });
     if (client?.connected) {
       try {
         return await authed(client);
@@ -25106,7 +25029,7 @@ class RelayDirectoryLink {
     return link(preAuth());
   }
   async device(device) {
-    const reply = parse5(DirPersonsFrame, await link(deviceOnRelay(this.#options.url, device)));
+    const reply = parse5(DirHeadsAreFrame, await link(deviceOnRelay(this.#options.url, device)));
     return { sth: reply.sth, persons: reply.persons };
   }
   async resolve(query) {
@@ -25196,18 +25119,15 @@ var init_relay_transport = __esm(() => {
 function startDaemon2(options) {
   return startDaemon({
     ...options,
-    transportFactory: options.transportFactory ?? withDirect(relayTransport),
+    transportFactory: options.transportFactory ?? relayTransport,
     relayOps: options.relayOps ?? relayOps,
     directoryLinkFactory: options.directoryLinkFactory ?? relayDirectoryLink
   });
 }
 var init_dist4 = __esm(() => {
   init_daemon();
-  init_direct_transport();
   init_relay_transport();
   init_relay_transport();
-  init_direct_transport();
-  init_direct_config();
   init_home();
   init_lock();
   init_log();
@@ -26454,6 +26374,12 @@ var people = {
       }
       ctx.out.line(`${ctx.out.style.bold(inline(person.name, 64))}  handle ${inline(person.handle, 64)}  org ${person.org}  vouched ${person.vouched}`);
       ctx.out.lines(table(["DEVICE", "LABEL", ""], person.devices.map((d) => [d.device, inline(d.label, 32), d.self ? "this device" : ""]), ctx.out.style));
+      if (person.deviceChanges !== undefined) {
+        const now = ctx.now();
+        ctx.out.line(`${ctx.out.style.yellow(`${inline(person.name, 64)}'s devices changed:`)}`);
+        for (const change of person.deviceChanges)
+          ctx.out.line(`  ${change.change} '${inline(change.label, 32)}' (${vouchWords(change)})  ${ago(change.at, now)}`);
+      }
       return;
     }
     if (ctx.json) {
@@ -26518,7 +26444,7 @@ var devices = {
     "directory, removed ones last.",
     "link: on a new device Jelly does not enrol, shows its link request and a six-digit code (design \xA72.5).",
     "approve: on a device of yours that Jelly bound, shows what the link asks for, then approves it once you type",
-    "the code the new device shows. A device approved by link approves none. Removing devices is not in this CLI."
+    "the code the new device shows. A device approved by link approves none. To remove a device: messaging login --remove <device>."
   ].join(`
 `),
   options: {
@@ -26570,8 +26496,9 @@ var notices = {
   usage: "[--lines] [--ack]",
   details: [
     "Each line is a message for you (a DM or channel line from someone else, or your own agent's line to you),",
-    "a request held for you to answer (`messaging requests`), or an alert about this device. --lines adds a",
-    "message's first line (peer text). --ack marks every notice shown as seen."
+    "a request held for you to answer (`messaging requests`), or an alert: about this device, a device added to or",
+    "removed from your account (with how to remove one that is not yours), or trust you gave that ends within 7 days.",
+    "--lines adds a message's first line (peer text). --ack marks every notice shown as seen."
   ].join(`
 `),
   options: {
@@ -26598,13 +26525,25 @@ var notices = {
       ago(n.at, now),
       n.category,
       n.from ? inline(n.from.name, 40) : "",
-      n.conversation !== undefined ? inline(n.conversation, 60) : "",
+      n.conversation !== undefined ? inline(n.conversation, 60) : n.device !== undefined ? `device ${n.device.device}` : "",
       n.line !== undefined ? inline(n.line, 120) : ""
     ]), ctx.out.style));
+    const removable = list.flatMap((n) => n.device?.remove !== undefined && n.device.current ? [n.device] : []);
+    for (const d of removable) {
+      const how = d.remove === "sign-in" ? `messaging login --remove ${d.device}` : d.remove === "team" ? `messaging team remove ${d.device}` : "Remove it from the Jelly app on this device";
+      ctx.out.note(`Not yours? '${inline(d.label, 32)}': ${how}`);
+    }
     if (values.ack === true)
       ctx.out.line(ctx.out.style.dim(`${list.length} marked seen`));
   }
 };
+function vouchWords(d) {
+  if (d.vouch === "admin")
+    return "admitted by the team's admin";
+  if (d.vouch === "device")
+    return d.approver !== undefined ? `approved on '${inline(d.approver, 32)}'` : "approved by link";
+  return d.via === "browser" ? "signed in through the browser" : "vouched by Jelly ID";
+}
 var DIRECTORY_COMMANDS = [status, who2, people, devices, notices];
 
 // packages/daemon/dist/cli/commands/identity.js
@@ -26874,14 +26813,62 @@ function aborted2(signal) {
     signal.addEventListener("abort", () => resolve(), { once: true });
   });
 }
+async function showSignIn(ctx, started, open) {
+  if (!ctx.json) {
+    const { bold } = ctx.out.style;
+    const lead = started.purpose === "remove" ? "To remove that device, sign in at Jelly ID:" : started.purpose === "replace" ? "To replace your old device, sign in at Jelly ID with this one:" : started.purpose === "erase" ? "To erase your account, sign in at Jelly ID:" : "To sign this device in, open:";
+    ctx.out.line(lead);
+    ctx.out.line(`  ${started.verificationUri}`);
+    ctx.out.line(`and type the code ${bold(started.userCode)} there. Approve only if the page shows this device's key ${bold(started.fingerprint)}.`);
+  }
+  if (open) {
+    const opened = await (ctx.io.openUrl ?? openInBrowser)(started.verificationUri);
+    if (!opened)
+      ctx.out.note("Could not open a browser here; open the page on any device and type the code.");
+  } else if (!ctx.json && (ctx.io.env.SSH_CONNECTION !== undefined || ctx.io.env.SSH_TTY !== undefined)) {
+    ctx.out.note("Over SSH: open the page on your laptop or phone and type the code; the code ties it to this machine.");
+  }
+}
+async function waitSignIn(ctx, client, started) {
+  const minutes = Math.max(1, Math.round((started.expires - ctx.now()) / 60000));
+  if (!ctx.json)
+    ctx.out.note(`Waiting for your approval (the code expires in ${minutes} min; Ctrl-C cancels)...`);
+  const interrupted = aborted2(ctx.io.signal);
+  let state = { ...started, state: "pending" };
+  while (state.state === "pending") {
+    const asked = client.call("device.login.status", { waitMs: STATUS_WAIT_MS }, { timeoutMs: STATUS_WAIT_MS + 15000 });
+    const next = await Promise.race([asked, interrupted.then(() => {
+      return;
+    })]);
+    if (next === undefined) {
+      asked.catch(() => {});
+      await client.call("device.login.cancel", {}).catch(() => {});
+      ctx.out.note("Cancelled.");
+      return;
+    }
+    state = next;
+  }
+  if (state.state === "failed")
+    throw new MessagingError(state.code, state.message);
+  return state;
+}
+async function confirmed(ctx, yes, question, word = "y") {
+  if (yes)
+    return true;
+  if (ctx.json)
+    throw new UsageError("with --json there is no prompt: confirm with --yes");
+  ctx.out.prompt(`${question} Type ${word} to confirm: `);
+  const answer = (await readLine(ctx.io.stdin) ?? "").trim().toLowerCase();
+  return word === "y" ? /^y(es)?$/.test(answer) : answer === word;
+}
 var login = {
   name: "login",
   summary: "Sign this device in to your account through the browser (hosted realm)",
   usage: "[--label <label>] [--kind laptop|server|other] [--open] [--no-wait] [--remove <device> [--reason removed|lost]]",
   details: [
-    "Prints a link to Jelly ID and a code. Open the link on any device (with --open, this machine's browser opens it),",
-    "check that the page shows the same code and key, and approve. This device then binds to your account: the first",
-    "device of your account, or one more. Over SSH, open the link on your laptop or phone.",
+    "Prints Jelly ID's page and a code. Open the page on any device (with --open, this machine's browser opens it),",
+    "type the code, check that the page shows the same key, and approve. This device then binds to your account: the",
+    "first device of your account, or one more. Over SSH, open the page on your laptop or phone.",
     "With --remove, the sign-in removes another device of yours instead (a lost one, with --reason lost).",
     "Needs Jelly ID's device sign-in; until Jelly ID offers it, this says so and does nothing."
   ].join(`
@@ -26889,8 +26876,8 @@ var login = {
   options: {
     label: { type: "string", value: "<label>", description: "This device's label (default: its current one, else device)" },
     kind: { type: "string", value: "<kind>", description: "laptop (default), server or other" },
-    open: { type: "boolean", description: "Open the link in this machine's browser" },
-    "no-wait": { type: "boolean", description: "Print the link and code, and leave the daemon waiting" },
+    open: { type: "boolean", description: "Open Jelly ID's page in this machine's browser" },
+    "no-wait": { type: "boolean", description: "Print the page and code, and leave the daemon waiting" },
     remove: { type: "string", value: "<device>", description: "Remove that device of yours with this sign-in" },
     reason: { type: "string", value: "<reason>", description: "--remove: removed (default) or lost" }
   },
@@ -26917,45 +26904,15 @@ var login = {
       ctx.out.json(started);
       return;
     }
-    if (!ctx.json) {
-      const { bold } = ctx.out.style;
-      ctx.out.line(started.purpose === "remove" ? "To remove that device, sign in at Jelly ID:" : "To sign this device in, open:");
-      ctx.out.line(`  ${started.verificationUriComplete}`);
-      ctx.out.line(`and check that the page shows the code ${bold(started.userCode)} and the key ${bold(started.fingerprint)}.`);
-      ctx.out.line(`(Or open ${started.verificationUri} and type the code.)`);
-    }
-    if (values.open === true) {
-      const opened = await (ctx.io.openUrl ?? openInBrowser)(started.verificationUriComplete);
-      if (!opened)
-        ctx.out.note("Could not open a browser here; open the link on any device.");
-    } else if (!ctx.json && (ctx.io.env.SSH_CONNECTION !== undefined || ctx.io.env.SSH_TTY !== undefined)) {
-      ctx.out.note("Over SSH: open the link on your laptop or phone; the code ties it to this machine.");
-    }
+    await showSignIn(ctx, started, values.open === true);
     const minutes = Math.max(1, Math.round((started.expires - ctx.now()) / 60000));
     if (!wait) {
       ctx.out.note(`The daemon waits ${minutes} min for your approval. See it with: messaging devices`);
       return;
     }
-    if (!ctx.json)
-      ctx.out.note(`Waiting for your approval (the code expires in ${minutes} min; Ctrl-C cancels)...`);
-    const signal = ctx.io.signal;
-    const interrupted = aborted2(signal);
-    let state = { ...started, state: "pending" };
-    while (state.state === "pending") {
-      const asked = client.call("device.login.status", { waitMs: STATUS_WAIT_MS }, { timeoutMs: STATUS_WAIT_MS + 15000 });
-      const next = await Promise.race([asked, interrupted.then(() => {
-        return;
-      })]);
-      if (next === undefined) {
-        asked.catch(() => {});
-        await client.call("device.login.cancel", {}).catch(() => {});
-        ctx.out.note("Cancelled.");
-        return 130;
-      }
-      state = next;
-    }
-    if (state.state === "failed")
-      throw new MessagingError(state.code, state.message);
+    const state = await waitSignIn(ctx, client, started);
+    if (state === undefined)
+      return 130;
     if (ctx.json) {
       ctx.out.json(state);
       return state.state === "done" ? undefined : 1;
@@ -26972,7 +26929,128 @@ var login = {
     }
   }
 };
-var LOGIN_COMMANDS = [login];
+var replace = {
+  name: "identity replace",
+  summary: "Replace this home's device with new keys after a restore (hosted realm)",
+  usage: "[--label <label>] [--open] [--yes]",
+  details: [
+    "For a home restored from a backup or a snapshot (alarm keys_missing or restored), or for a fresh key on purpose.",
+    "This device gets a new key, binds it to your account and removes the old device (reason replaced): your",
+    "conversations, grants and history stay, and tasks continue. Mail still queued at the relay for the old device is",
+    "lost. Through the browser you approve two sign-ins at Jelly ID: one binds the new key, one removes the old."
+  ].join(`
+`),
+  options: {
+    label: { type: "string", value: "<label>", description: "The new device's label (default: the old one's)" },
+    open: { type: "boolean", description: "Open Jelly ID's page in this machine's browser for each sign-in" },
+    yes: { type: "boolean", short: "y", description: "Do not ask for confirmation" }
+  },
+  args: { min: 0, max: 0 },
+  async run(ctx, _positionals, values) {
+    const label = stringValue(values, "label");
+    const client = await ctx.client();
+    const preview = await client.call("identity.replace.preview", {});
+    if (!ctx.json)
+      ctx.out.line(inline(preview.sentence, 600));
+    if (!await confirmed(ctx, values.yes === true, `Replace '${inline(preview.predecessor.label, 32)}' (device ${preview.predecessor.device}) with this device?`)) {
+      ctx.out.note("Not replaced.");
+      return 1;
+    }
+    const params = label !== undefined ? { label: parseWith2(MachineLabel, label, "--label must be a lowercase label, e.g. desk") } : {};
+    for (let step = 0;step < 3; step++) {
+      const result = await client.call("identity.replace", params);
+      if (result.state === "done") {
+        if (ctx.json)
+          ctx.out.json(result);
+        else
+          ctx.out.line(`Replaced: this device (${result.device}) replaces ${result.predecessor} on ${inline(result.person, 64)}.`);
+        return;
+      }
+      if (result.state === "token") {
+        if (ctx.json)
+          ctx.out.json(result);
+        else
+          ctx.out.note(`This device (${result.device}) waits for its Jelly host to bind the new key; the host's app finishes the replacement.`);
+        return;
+      }
+      await showSignIn(ctx, result, values.open === true);
+      const state = await waitSignIn(ctx, client, result);
+      if (state === undefined)
+        return 130;
+      if (state.state !== "done") {
+        ctx.out.note("The sign-in was cancelled (another sign-in started, or the daemon stopped).");
+        return 1;
+      }
+      if ((await client.call("device.status", {})).binding !== "replace") {
+        const done = { state: "done", person: state.person, device: result.device, predecessor: preview.predecessor.device, seq: state.seq };
+        if (ctx.json)
+          ctx.out.json(done);
+        else
+          ctx.out.line(`Replaced: this device (${result.device}) replaces ${preview.predecessor.device} on ${inline(state.person, 64)}.`);
+        return;
+      }
+      if (!ctx.json)
+        ctx.out.note("The new key is bound. One more sign-in removes the old device.");
+    }
+    throw new MessagingError("internal", "the replacement did not finish; run messaging identity replace again");
+  }
+};
+var erase = {
+  name: "erase",
+  summary: "Erase your account from Messaging, for good (hosted realm)",
+  usage: "[--open] [--yes]",
+  details: [
+    "Removes every device of your account and deletes what the directory holds about you. Your Jelly account can",
+    "never be bound to Messaging again. The directory allows 10 erasures per person a day. Shows what is lost and",
+    "asks you to type erase, unless --yes. A device approved by link cannot erase; one signed in through the browser",
+    "approves one more sign-in at Jelly ID."
+  ].join(`
+`),
+  options: {
+    open: { type: "boolean", description: "Open Jelly ID's page in this machine's browser" },
+    yes: { type: "boolean", short: "y", description: "Do not ask for confirmation" }
+  },
+  args: { min: 0, max: 0 },
+  async run(ctx, _positionals, values) {
+    const client = await ctx.client();
+    const preview = await client.call("directory.erase.preview", {});
+    if (!ctx.json) {
+      ctx.out.line(`Erasing ${inline(preview.person, 64)} from Messaging. What is lost:`);
+      for (const line of preview.lost)
+        ctx.out.line(`  - ${inline(line, 300)}`);
+      ctx.out.line(`Devices removed: ${preview.devices.map((d) => `'${inline(d.label, 32)}'${d.self ? " (this one)" : ""}`).join(", ")}`);
+      ctx.out.line("What stays:");
+      for (const line of preview.kept)
+        ctx.out.line(`  - ${inline(line, 300)}`);
+      ctx.out.note(`The directory allows ${preview.perDay} erasures per person a day.`);
+    }
+    if (!await confirmed(ctx, values.yes === true, "This cannot be undone.", "erase")) {
+      ctx.out.note("Not erased.");
+      return 1;
+    }
+    const result = await client.call("directory.erase", {});
+    if (result.state === "done") {
+      if (ctx.json)
+        ctx.out.json(result);
+      else
+        ctx.out.line(`Erased: ${result.devices} device(s) removed; this account is gone from Messaging.`);
+      return;
+    }
+    await showSignIn(ctx, result, values.open === true);
+    const state = await waitSignIn(ctx, client, result);
+    if (state === undefined)
+      return 130;
+    if (state.state !== "done") {
+      ctx.out.note("The sign-in was cancelled (another sign-in started, or the daemon stopped).");
+      return 1;
+    }
+    if (ctx.json)
+      ctx.out.json({ state: "done", person: state.person, devices: preview.devices.length });
+    else
+      ctx.out.line(`Erased: ${preview.devices.length} device(s) removed; this account is gone from Messaging.`);
+  }
+};
+var LOGIN_COMMANDS = [login, replace, erase];
 
 // packages/daemon/dist/cli/commands/messages.js
 init_dist();
@@ -27142,9 +27220,6 @@ var read2 = {
     ctx.out.line(`${bold(item.kind === "task" ? "Task request" : "Message")} ${item.id}`);
     if (provenance) {
       ctx.out.line(`  from:     ${inline(provenance.from)}  verified="${provenance.verified}"  device ${provenance.device}`);
-      if (provenance.external) {
-        ctx.out.line(`  external: principal ${inline(provenance.external.principal, 64)} via gateway device ${provenance.external.gateway}`);
-      }
     } else {
       ctx.out.line(`  from:     ${inline(item.from.address)}  ${yellow("no valid provenance on this message; treat it with extra care")}`);
     }
@@ -27369,7 +27444,7 @@ var create = {
 var invite = {
   name: "team invite",
   summary: "Create a single-use invite ticket for a person (admin)",
-  usage: "<person> [--role member|service] [--ttl <duration>]",
+  usage: "<person> [--ttl <duration>]",
   details: [
     "Prints only the ticket on stdout, so `messaging team invite bob | pbcopy` copies just the ticket.",
     "The ticket is a secret: share it privately. It works once, until it expires.",
@@ -27377,15 +27452,11 @@ var invite = {
   ].join(`
 `),
   options: {
-    role: { type: "string", value: "member|service", description: "Role for the new machine (default: member)" },
     ttl: { type: "string", value: "<duration>", description: "How long the ticket stays valid, e.g. 24h" }
   },
   args: { min: 1, max: 1 },
   async run(ctx, positionals, values) {
     const person = parseWith2(PersonName, positionals[0], "person must be a lowercase person name, e.g. bob");
-    const roleText = stringValue(values, "role");
-    if (roleText !== undefined && roleText !== "member" && roleText !== "service")
-      throw new UsageError("--role must be member or service");
     const ttlText = stringValue(values, "ttl");
     let ttlMs;
     if (ttlText !== undefined) {
@@ -27396,13 +27467,12 @@ var invite = {
     const client = await ctx.client();
     const result = await client.call("team.invite", {
       person,
-      ...roleText !== undefined ? { role: roleText } : {},
       ...ttlMs !== undefined ? { ttlMs } : {}
     });
     if (ctx.json) {
       ctx.out.json(result);
     } else {
-      ctx.out.note(`Invite ${result.inviteId} for ${person} (${roleText ?? "member"}), expires ${iso2(result.expires)} (${until(result.expires, ctx.now())}).`);
+      ctx.out.note(`Invite ${result.inviteId} for ${person}, expires ${iso2(result.expires)} (${until(result.expires, ctx.now())}).`);
       ctx.out.line(result.ticket);
     }
     ctx.out.warn(`this ticket is a secret. Share it privately with ${person}, never in a public channel or a shared log.`);
@@ -27461,7 +27531,7 @@ var members2 = {
       const now = ctx.now();
       ctx.out.line();
       ctx.out.line(`Invites (${result.invites.length})`);
-      ctx.out.lines(table(["INVITE", "PERSON", "ROLE", "STATE", "EXPIRES"], result.invites.map((i) => [i.inviteId, i.person, i.role, i.state, i.state === "open" ? until(i.expires, now) : iso2(i.expires)]), style));
+      ctx.out.lines(table(["INVITE", "PERSON", "STATE", "EXPIRES"], result.invites.map((i) => [i.inviteId, i.person, i.state, i.state === "open" ? until(i.expires, now) : iso2(i.expires)]), style));
     }
   }
 };
@@ -27523,10 +27593,10 @@ var remove = {
 var role = {
   name: "team role",
   summary: "Change a member's role (admin)",
-  usage: "<machine|person/label> <admin|member|service>",
+  usage: "<machine|person/label> <admin|member>",
   args: { min: 2, max: 2 },
   async run(ctx, positionals) {
-    const newRole = parseWith2(MemberRole, positionals[1], "role must be admin, member or service");
+    const newRole = parseWith2(MemberRole, positionals[1], "role must be admin or member");
     const { member } = await resolveMember(ctx, positionals[0]);
     const client = await ctx.client();
     const result = await client.call("team.role", { machine: member.machine, role: newRole });
@@ -27574,17 +27644,13 @@ var card2 = {
 var add = {
   name: "team add",
   summary: "Admit a machine by its public admit card (admin)",
-  usage: "<card|-> [--role member|service] [--yes]",
+  usage: "<card|-> [--yes]",
   details: "Pass `-` to read the card from stdin (then pass --yes). The card has public keys only. You are admitting that exact machine. Asks for confirmation unless --yes.",
   options: {
-    role: { type: "string", value: "member|service", description: "Role for the new machine (default: member)" },
     yes: { type: "boolean", short: "y", description: "Do not ask for confirmation" }
   },
   args: { min: 1, max: 1 },
   async run(ctx, positionals, values) {
-    const roleText = stringValue(values, "role");
-    if (roleText !== undefined && roleText !== "member" && roleText !== "service")
-      throw new UsageError("--role must be member or service");
     const fromStdin = positionals[0] === "-";
     const text = (fromStdin ? await readAll(ctx.io.stdin, 8192) : positionals[0]).trim();
     const card = decodeAdmitCard(text);
@@ -27601,8 +27667,7 @@ var add = {
       machine: card.machine,
       enc: card.enc,
       person: card.person,
-      label: card.label,
-      ...roleText !== undefined ? { role: roleText } : {}
+      label: card.label
     });
     if (ctx.json)
       ctx.out.json({ ok: true, person: card.person, label: card.label, machine: card.machine });
@@ -27724,13 +27789,13 @@ var HANDLES_INTERRUPT = new Set(["listen", "login"]);
 var GROUPS = {
   daemon: "Run the local daemon, messagingd",
   team: "Manage the team: create, invite, join, members, roles (only the CLI may do this)",
-  identity: "Show, move or rotate this machine's keys (only the CLI may do this)",
+  identity: "Show, move, rotate or replace this machine's keys (only the CLI may do this)",
   chat: "Your DMs and channels: list, read, post, search"
 };
 var SECTIONS = [
   ["Daemon", ["daemon start", "daemon stop", "status"]],
   ["Team", ["team prepare", "team create", "team card", "team invite", "team join", "team pair", "team add", "team claim", "team pair-cancel", "team members", "team remove", "team role", "team revoke-invite"]],
-  ["Identity", ["identity show", "identity migrate", "identity rotate-enc"]],
+  ["Identity", ["identity show", "identity migrate", "identity rotate-enc", "identity replace", "erase"]],
   ["People", ["login", "people", "devices", "grants", "grant", "requests", "contact", "card", "notices"]],
   ["Messages", ["who", "send", "inbox", "read", "message-status"]],
   ["Chats", ["chat list", "chat read", "chat post", "chat search"]],
@@ -27964,6 +28029,37 @@ function cliMain(argv, start) {
 // packages/daemon/dist/bin/daemon-main.js
 init_dist2();
 import { resolve as resolve4 } from "path";
+
+// packages/daemon/dist/bin/fatal.js
+import { writeSync as writeSync2 } from "fs";
+var sink;
+function setFatalLog(log) {
+  sink = log;
+}
+function installFatalPolicy(name) {
+  const fatal = (origin) => (error) => {
+    const fields = { origin, error: error instanceof Error ? error.name : typeof error, ...frameOf(error) };
+    try {
+      sink?.("error", "daemon.fatal", fields);
+    } catch {}
+    const frames = error instanceof Error ? error.stack?.split(`
+`).slice(1).join(`
+`) ?? "" : "";
+    writeSync2(2, `${name}: fatal ${fields.origin}: ${fields.error}
+${frames}
+`);
+    process.exit(70);
+  };
+  process.on("uncaughtException", fatal("uncaughtException"));
+  process.on("unhandledRejection", fatal("unhandledRejection"));
+}
+function frameOf(error) {
+  const frame = error instanceof Error ? error.stack?.split(`
+`).find((line) => line.trimStart().startsWith("at ")) : undefined;
+  return frame ? { at: frame.trim().slice(3, 240) } : {};
+}
+
+// packages/daemon/dist/bin/daemon-main.js
 var USAGE = `usage: messagingd [--home <dir>]
        messagingd --deployment jelly --home <dir> --act-key <path> --label <label>
                   [--kind jelly-host] [--run <dir>] [--socket-group <gid>]
@@ -28094,6 +28190,7 @@ ${USAGE}`);
     stderr: process.stderr.isTTY === true,
     level: level === "debug" || level === "warn" || level === "error" ? level : "info"
   });
+  setFatalLog(log);
   let daemon;
   try {
     const jellyHost = fromEnv ? {
@@ -28164,6 +28261,8 @@ function filterSqliteWarning() {
 // packages/daemon/dist/bin/standalone.js
 filterSqliteWarning();
 var { mode, args } = dispatch(process.argv0, process.argv.slice(2));
+if (mode !== "cli")
+  installFatalPolicy("messagingd");
 var done = mode === "cli" ? cliMain(args, { daemonCommand: [process.execPath] }) : daemonMain(args);
 done.then((code) => {
   process.exitCode = code;