@joe-broadhead/messaging-bin-win32-x64 0.6.0 → 0.7.0

package/lib/messagingd.mjs

@@ -5129,12 +5129,6 @@ function _ensureDefaultMemoizer() {
 function string2(params) {
   return _string(ZodString, params);
 }
-function ipv42(params) {
-  return _ipv4(ZodIPv4, params);
-}
-function ipv62(params) {
-  return _ipv6(ZodIPv6, params);
-}
 function number2(params) {
   return _number(ZodNumber, params);
 }
@@ -6122,12 +6116,11 @@ var init_common = __esm(() => {
     card: `messaging/1/card
 `,
     seal: "messaging/1/seal",
-    directAuth: `messaging/1/direct-auth
-`,
-    directLink: "messaging/1/direct-link",
     person: `messaging/1/person
 `,
     tombstone: "messaging/1/tombstone",
+    dirRead: `messaging/1/dir-read
+`,
     deviceLog: `messaging/1/device-log
 `,
     deviceKeys: `messaging/1/device-keys
@@ -6163,7 +6156,7 @@ var init_common = __esm(() => {
   Millis = number2().int().nonnegative();
   Address = string2().min(1).max(200);
   SessionAddress = string2().regex(/^(?:[a-z][a-z0-9-]{0,31}|p_[a-z2-7]{26})\/[a-z0-9][a-z0-9._-]{0,63}@[a-z0-9][a-z0-9-]{0,31}$/, "person/session@label");
-  MemberRole = _enum(["admin", "member", "service"]);
+  MemberRole = _enum(["admin", "member"]);
   SessionState = _enum(["idle", "busy"]);
   DeliveryTier = _enum(["push", "pull"]);
   DeliveryStage = _enum([
@@ -6404,7 +6397,7 @@ var init_jelly = __esm(() => {
 });
 
 // packages/core/dist/schema/directory.js
-var MapProof, MapValue, DeviceId, DeviceKind, UnbindReason, Signature, LinkRequest, Authority, LogEntry, KeysStatement, EpochLeaf, EpochProof, STH, KeyRotation, EntryEpoch, PersonView;
+var MapProof, MapValue, DeviceId, DeviceKind, UnbindReason, Signature, LinkRequest, Authority, LogEntry, KeysStatement, EpochLeaf, EpochProof, STH, KeyRotation, EntryEpoch, PersonHead, PersonView;
 var init_directory = __esm(() => {
   init_zod();
   init_common();
@@ -6499,6 +6492,12 @@ var init_directory = __esm(() => {
     value: MapValue,
     mapProof: MapProof
   });
+  PersonHead = strictObject({
+    person: HostedPersonId,
+    mapProof: MapProof,
+    value: MapValue.optional(),
+    tombstone: literal(true).optional()
+  });
   PersonView = strictObject({
     person: HostedPersonId,
     log: array(LogEntry).max(1024),
@@ -6510,7 +6509,7 @@ var init_directory = __esm(() => {
 });
 
 // packages/core/dist/schema/a2a.js
-var Struct, TaskState, TERMINAL_STATES, Role, Part, Message, TaskStatus, Artifact, Task, TaskStatusUpdateEvent, TaskArtifactUpdateEvent, AgentInterface, AgentExtension, AgentCapabilities, AgentSkill, AgentCard, SendMessageConfiguration, SendMessageRequest, SendMessageResponse, StreamResponse, GetTaskRequest, CancelTaskRequest, SubscribeToTaskRequest, ListTasksRequest, ListTasksResponse;
+var Struct, TaskState, TERMINAL_STATES, Role, Part, Message, TaskStatus, Artifact, Task, TaskStatusUpdateEvent, TaskArtifactUpdateEvent;
 var init_a2a = __esm(() => {
   init_zod();
   Struct = record(string2(), unknown());
@@ -6587,92 +6586,6 @@ var init_a2a = __esm(() => {
     lastChunk: boolean2().optional(),
     metadata: Struct.optional()
   });
-  AgentInterface = object({
-    url: string2().min(1),
-    protocolBinding: string2().min(1).describe("JSONRPC | GRPC | HTTP+JSON | a binding URI"),
-    tenant: string2().optional(),
-    protocolVersion: string2().min(1)
-  });
-  AgentExtension = object({
-    uri: string2(),
-    description: string2().optional(),
-    required: boolean2().optional(),
-    params: Struct.optional()
-  });
-  AgentCapabilities = object({
-    streaming: boolean2().optional(),
-    pushNotifications: boolean2().optional(),
-    extensions: array(AgentExtension).optional(),
-    extendedAgentCard: boolean2().optional()
-  });
-  AgentSkill = object({
-    id: string2().min(1),
-    name: string2().min(1),
-    description: string2(),
-    tags: array(string2()),
-    examples: array(string2()).optional(),
-    inputModes: array(string2()).optional(),
-    outputModes: array(string2()).optional(),
-    securityRequirements: array(unknown()).optional()
-  });
-  AgentCard = object({
-    name: string2().min(1),
-    description: string2(),
-    supportedInterfaces: array(AgentInterface).min(1),
-    provider: object({ url: string2(), organization: string2() }).optional(),
-    version: string2(),
-    documentationUrl: string2().optional(),
-    capabilities: AgentCapabilities,
-    securitySchemes: record(string2(), unknown()).optional(),
-    securityRequirements: array(unknown()).optional(),
-    defaultInputModes: array(string2()),
-    defaultOutputModes: array(string2()),
-    skills: array(AgentSkill),
-    signatures: array(object({ protected: string2(), signature: string2(), header: Struct.optional() })).optional(),
-    iconUrl: string2().optional()
-  });
-  SendMessageConfiguration = object({
-    acceptedOutputModes: array(string2()).optional(),
-    taskPushNotificationConfig: unknown().optional(),
-    historyLength: number2().int().nonnegative().optional(),
-    returnImmediately: boolean2().optional()
-  });
-  SendMessageRequest = object({
-    tenant: string2().optional(),
-    message: Message,
-    configuration: SendMessageConfiguration.optional(),
-    metadata: Struct.optional()
-  });
-  SendMessageResponse = union([object({ task: Task }), object({ message: Message })]);
-  StreamResponse = union([
-    object({ task: Task }),
-    object({ message: Message }),
-    object({ statusUpdate: TaskStatusUpdateEvent }),
-    object({ artifactUpdate: TaskArtifactUpdateEvent })
-  ]);
-  GetTaskRequest = object({
-    tenant: string2().optional(),
-    id: string2().min(1),
-    historyLength: number2().int().nonnegative().optional()
-  });
-  CancelTaskRequest = object({ tenant: string2().optional(), id: string2().min(1), metadata: Struct.optional() });
-  SubscribeToTaskRequest = object({ tenant: string2().optional(), id: string2().min(1) });
-  ListTasksRequest = object({
-    tenant: string2().optional(),
-    contextId: string2().optional(),
-    status: TaskState.or(literal("TASK_STATE_UNSPECIFIED")).optional(),
-    pageSize: number2().int().min(1).max(100).optional(),
-    pageToken: string2().optional(),
-    historyLength: number2().int().nonnegative().optional(),
-    statusTimestampAfter: string2().optional(),
-    includeArtifacts: boolean2().optional()
-  });
-  ListTasksResponse = object({
-    tasks: array(Task),
-    nextPageToken: string2(),
-    pageSize: number2().int(),
-    totalSize: number2().int()
-  });
 });
 
 // packages/core/dist/schema/consent.js
@@ -6760,13 +6673,12 @@ var init_consent = __esm(() => {
 });
 
 // packages/core/dist/schema/delegation.js
-var DelegationScope, ExternalPrincipal, DelegationGrant, DelegationChain, DelegationSummary;
+var DelegationScope, DelegationGrant, DelegationChain, DelegationSummary;
 var init_delegation = __esm(() => {
   init_zod();
   init_common();
   init_realm();
   DelegationScope = string2().regex(/^[a-z0-9][a-z0-9._:/-]{0,63}$/, "scope label");
-  ExternalPrincipal = string2().min(1).max(64);
   DelegationGrant = looseObject({
     realm: RealmId,
     task: Ulid,
@@ -6778,7 +6690,6 @@ var init_delegation = __esm(() => {
     maxDepth: number2().int().min(1).max(LIMITS.delegationDepth),
     scope: array(DelegationScope).max(LIMITS.delegationScopes).optional(),
     parent: Hash.optional(),
-    external: looseObject({ principal: ExternalPrincipal }).optional(),
     sig: Base64Url
   });
   DelegationChain = array(DelegationGrant).min(1).max(LIMITS.delegationDepth);
@@ -6787,7 +6698,6 @@ var init_delegation = __esm(() => {
     depth: number2().int().min(1).max(LIMITS.delegationDepth),
     maxDepth: number2().int().min(1).max(LIMITS.delegationDepth),
     scope: array(DelegationScope).max(LIMITS.delegationScopes).optional(),
-    external: object({ principal: ExternalPrincipal, gateway: MachineId }).optional(),
     exp: Millis
   });
 });
@@ -6800,7 +6710,7 @@ function requestMessage(message) {
 function cardMessage(message, what) {
   return bare(message, "data") && (what === "card" ? CardData : CardGetData).safeParse(message.parts[0].data).success;
 }
-var EnvelopeType, SEAL_ALG = "x25519-hkdf-sha256-a256gcm", EnvelopeClass, Party, Sender, Recipient, Envelope, ChannelPersons, ChannelConv, SelfConv, RequestConv, CardConv, Conv, MessagePayload, BARE_MESSAGE, bare = (message, part) => Object.keys(message).every((key) => BARE_MESSAGE.has(key)) && message.parts.length === 1 && Object.keys(message.parts[0]).join() === part, TaskStatusPayload, TaskArtifactPayload, TaskCancelPayload, ReceiptPayload, SessionInfo, DirectEndpoint, PresencePayload, PAYLOAD_BY_TYPE, Provenance;
+var EnvelopeType, SEAL_ALG = "x25519-hkdf-sha256-a256gcm", EnvelopeClass, Party, Sender, Recipient, Envelope, ChannelPersons, ChannelConv, SelfConv, RequestConv, CardConv, Conv, MessagePayload, BARE_MESSAGE, bare = (message, part) => Object.keys(message).every((key) => BARE_MESSAGE.has(key)) && message.parts.length === 1 && Object.keys(message.parts[0]).join() === part, TaskStatusPayload, TaskArtifactPayload, TaskCancelPayload, ReceiptPayload, SessionInfo, PresencePayload, PAYLOAD_BY_TYPE, Provenance;
 var init_envelope = __esm(() => {
   init_zod();
   init_a2a();
@@ -6855,7 +6765,6 @@ var init_envelope = __esm(() => {
     kind: _enum(["message", "task"]),
     message: Message,
     wake: boolean2().optional(),
-    external: object({ principal: string2().min(1).max(64) }).optional(),
     delegation: DelegationChain.optional(),
     conv: Conv.optional()
   }).refine((p) => p.kind === "task" ? p.message.taskId !== undefined : true, { message: "a task message needs message.taskId" }).refine((p) => p.kind === "task" === (p.delegation !== undefined), { message: "a task request carries a delegation chain, and only a task request" }).refine((p) => p.conv?.kind !== "self" || p.message.parts.length === 1 && GrantSync.safeParse(p.message.parts[0].data).success, {
@@ -6892,16 +6801,11 @@ var init_envelope = __esm(() => {
     kept: literal(true).optional(),
     wake: literal(true).optional()
   });
-  DirectEndpoint = object({
-    host: union([ipv42(), ipv62()]),
-    port: number2().int().min(1).max(65535)
-  });
   PresencePayload = object({
     seq: number2().int().nonnegative(),
     label: MachineLabel,
     sessions: array(SessionInfo).max(LIMITS.presenceSessions),
     features: array(string2().max(64)).max(32).optional(),
-    direct: array(DirectEndpoint).min(1).max(4).optional(),
     away: literal(true).optional()
   });
   PAYLOAD_BY_TYPE = {
@@ -6920,8 +6824,7 @@ var init_envelope = __esm(() => {
     device: MachineId,
     label: MachineLabel,
     verified: literal("signature"),
-    receivedAt: Millis,
-    external: object({ principal: string2().max(64), gateway: MachineId }).optional()
+    receivedAt: Millis
   });
 });
 
@@ -6974,7 +6877,6 @@ var init_roster = __esm(() => {
       inviteId: Ulid,
       invitePub: Key32,
       person: PersonName,
-      role: _enum(["member", "service"]),
       expires: Millis
     })
   });
@@ -7011,7 +6913,6 @@ var init_roster = __esm(() => {
     inviteId: Ulid,
     secret: Key32,
     person: PersonName,
-    role: _enum(["member", "service"]),
     expires: Millis
   });
 });
@@ -7096,6 +6997,7 @@ var init_relay = __esm(() => {
     protocolError: 4002,
     removed: 4003,
     replaced: 4004,
+    full: 1013,
     tooLarge: 1009
   };
 });
@@ -7104,7 +7006,10 @@ var init_relay = __esm(() => {
 function hostedRelayAuthPayload(args) {
   return { proto: RELAY_PROTOCOL, relay: args.relay, realm: args.realm, person: args.person, device: args.device, nonce: args.nonce, ts: args.ts };
 }
-var Req2, Size, Handle, Email, OrgId, DirBindFrame, HostedHelloFrame, DirAppendFrame, DirKeysFrame, DirSthFrame, DirLookupFrame, DirDeviceFrame, DirResolveFrame, DirSearchFrame, DirWatchFrame, PresenceWatchFrame, DirEraseFrame, WAKE_AGENTS = 64, WAKE_AWAITING = 500, WAKE_TICKET_BYTES = 4096, WAKE_TICKET_MAX_S, WakeUrl, WakeArmFrame, WakeDisarmFrame, DirectoryClientFrame, HostedWelcomeFrame, DirOkFrame, DirSthIsFrame, DirPersonsFrame, ResolvedPerson, DirResolvedFrame, DirChangedFrame, DirUnboundFrame, DirectoryRelayFrame;
+function dirReadPayload(args) {
+  return { proto: RELAY_PROTOCOL, relay: args.relay, realm: args.realm, device: args.device, nonce: args.nonce };
+}
+var Req2, Size, Handle, Email, OrgId, DirReadProof, DirBindFrame, HostedHelloFrame, DirAppendFrame, DirKeysFrame, DirSthFrame, DirLookupFrame, DirHeadsFrame, DirDeviceFrame, DirResolveFrame, DirSearchFrame, DirWatchFrame, PresenceWatchFrame, DirEraseFrame, WAKE_AGENTS = 64, WAKE_AWAITING = 500, WAKE_TICKET_BYTES = 4096, WAKE_TICKET_MAX_S, WakeUrl, WakeArmFrame, WakeDisarmFrame, DirectoryClientFrame, HostedWelcomeFrame, DirOkFrame, DirSthIsFrame, DirPersonsFrame, DirHeadsAreFrame, ResolvedPerson, DirResolvedFrame, DirChangedFrame, DirUnboundFrame, DirectoryRelayFrame;
 var init_directory_frames = __esm(() => {
   init_zod();
   init_common();
@@ -7117,6 +7022,7 @@ var init_directory_frames = __esm(() => {
   Handle = string2().regex(/^[a-z][a-z0-9-]{0,31}$/, "lowercase handle");
   Email = string2().max(254).regex(/^[^\s@A-Z]{1,64}@(?:[a-z0-9-]+\.)+[a-z0-9-]+$/, "lower-case email address");
   OrgId = string2().min(1).max(200);
+  DirReadProof = strictObject({ device: DeviceId, sig: Base64Url });
   DirBindFrame = object({ t: literal("dir.bind"), req: Req2, entry: LogEntry });
   HostedHelloFrame = object({
     t: literal("hello"),
@@ -7139,6 +7045,13 @@ var init_directory_frames = __esm(() => {
     t: literal("dir.lookup"),
     req: Req2,
     persons: array(object({ person: HostedPersonId, knownSeq: number2().int().nonnegative().optional() })).min(1).max(LIMITS.dirLookupPersons),
+    size: Size.optional(),
+    proof: DirReadProof.optional()
+  });
+  DirHeadsFrame = object({
+    t: literal("dir.heads"),
+    req: Req2,
+    persons: array(HostedPersonId).min(1).max(LIMITS.dirLookupPersons),
     size: Size.optional()
   });
   DirDeviceFrame = object({
@@ -7188,6 +7101,7 @@ var init_directory_frames = __esm(() => {
     DirSthFrame,
     DirLookupFrame,
     DirDeviceFrame,
+    DirHeadsFrame,
     DirResolveFrame,
     DirSearchFrame,
     DirWatchFrame,
@@ -7220,6 +7134,13 @@ var init_directory_frames = __esm(() => {
     head: EpochProof,
     persons: array(PersonView).max(LIMITS.dirLookupPersons)
   });
+  DirHeadsAreFrame = object({
+    t: literal("dir.headsAre"),
+    req: Req2,
+    sth: STH,
+    head: EpochProof,
+    persons: array(PersonHead).max(LIMITS.dirLookupPersons)
+  });
   ResolvedPerson = object({
     person: HostedPersonId,
     handle: Handle,
@@ -7243,38 +7164,13 @@ var init_directory_frames = __esm(() => {
     DirOkFrame,
     DirSthIsFrame,
     DirPersonsFrame,
+    DirHeadsAreFrame,
     DirResolvedFrame,
     DirChangedFrame,
     DirUnboundFrame
   ]);
 });
 
-// packages/core/dist/schema/direct.js
-var DIRECT_PROTOCOL = "messaging-direct/1", DIRECT_HANDSHAKE_BYTES = 4096, DirectHalf, DirectHelloFrame, DirectAcceptFrame, DirectAuthFrame, DirectIdentity, DirectSendRecord, DirectAckRecord, DirectNackRecord, DirectRecord;
-var init_direct = __esm(() => {
-  init_zod();
-  init_common();
-  init_errors3();
-  DirectHalf = object({ epk: Key32, nonce: Key32 });
-  DirectHelloFrame = object({ t: literal("hello"), proto: literal(DIRECT_PROTOCOL), epk: Key32, nonce: Key32 });
-  DirectAcceptFrame = object({ t: literal("accept"), epk: Key32, nonce: Key32, box: Base64Url.max(1024) });
-  DirectAuthFrame = object({ t: literal("auth"), box: Base64Url.max(1024) });
-  DirectIdentity = object({ team: TeamId, machine: MachineId, sig: Base64Url });
-  DirectSendRecord = object({
-    t: literal("send"),
-    env: looseObject({
-      v: string2(),
-      id: Ulid,
-      type: string2(),
-      from: looseObject({ device: MachineId }),
-      to: looseObject({ device: MachineId })
-    })
-  });
-  DirectAckRecord = object({ t: literal("ack"), id: Ulid });
-  DirectNackRecord = object({ t: literal("nack"), id: Ulid, code: ErrorCode });
-  DirectRecord = discriminatedUnion("t", [DirectSendRecord, DirectAckRecord, DirectNackRecord]);
-});
-
 // packages/core/dist/schema/ipc/device.js
 var BindingState, RealmAlarmSummary, DeviceStatus, DeviceChangeView, DeviceListEntry, LinkText, Sas, LinkPreview, KeyFingerprint, LoginUserCode, LoginPurpose, LoginKind, LoginShown, LoginState, DeviceRemoveParams, DeviceApproveParams, IdentityReplaceParams, SignInStep, DirectoryEraseParams, DEVICE_METHODS;
 var init_device = __esm(() => {
@@ -7327,7 +7223,6 @@ var init_device = __esm(() => {
   LoginPurpose = _enum(["bind", "remove", "replace", "erase"]);
   LoginKind = _enum(["laptop", "server", "other"]);
   LoginShown = object({
-    verificationUriComplete: string2().url().max(2048),
     verificationUri: string2().url().max(2048),
     userCode: LoginUserCode,
     fingerprint: KeyFingerprint,
@@ -7686,7 +7581,6 @@ var init_surfaces = __esm(() => {
         referenceTaskIds: array(Ulid).max(16).optional(),
         wake: boolean2().optional().describe("hint that the recipient may wake an idle session; default true"),
         request: strictObject({ contact: Email }).optional(),
-        external: strictObject({ principal: string2().min(1).max(64) }).optional(),
         onBehalfOf: strictObject({
           taskId: Ulid.describe("a task this session executes"),
           scope: array(DelegationScope).max(LIMITS.delegationScopes).optional().describe("narrow the scope; never wider than the task's"),
@@ -7921,7 +7815,6 @@ var init_ipc = __esm(() => {
   InviteSummary = object({
     inviteId: Ulid,
     person: PersonName,
-    role: _enum(["member", "service"]),
     expires: Millis,
     state: _enum(["open", "redeemed", "revoked", "expired"])
   });
@@ -7932,7 +7825,7 @@ var init_ipc = __esm(() => {
     "session.register": {
       params: strictObject({
         key: SessionKey,
-        agent: AgentKind.describe('client kind, e.g. "opencode", "claude-code", "a2a-gateway"'),
+        agent: AgentKind.describe('client kind, e.g. "opencode", "claude-code"'),
         name: SessionName.optional().describe("requested name; the daemon may suffix it to keep it unique"),
         cwd: string2().max(1024).optional(),
         repo: string2().max(200).optional(),
@@ -8012,7 +7905,7 @@ var init_ipc = __esm(() => {
       result: object({ team: TeamId, name: TeamName, machine: MachineId })
     },
     "team.invite": {
-      params: strictObject({ person: PersonName, role: _enum(["member", "service"]).optional(), ttlMs: number2().int().min(60000).max(LIMITS.ttlMs).optional() }),
+      params: strictObject({ person: PersonName, ttlMs: number2().int().min(60000).max(LIMITS.ttlMs).optional() }),
       result: object({ ticket: string2(), inviteId: Ulid, expires: Millis })
     },
     "team.join": {
@@ -8036,8 +7929,7 @@ var init_ipc = __esm(() => {
         machine: MachineId,
         enc: EncKey,
         person: PersonName,
-        label: MachineLabel,
-        role: _enum(["member", "service"]).optional()
+        label: MachineLabel
       }),
       result: Ok
     },
@@ -8203,7 +8095,6 @@ var init_schema = __esm(() => {
   init_roster();
   init_relay();
   init_directory_frames();
-  init_direct();
   init_ipc();
   init_device();
   init_consent2();
@@ -8234,7 +8125,7 @@ var init_b64u = __esm(() => {
 });
 
 // packages/core/dist/version.js
-var VERSION = "0.6.0";
+var VERSION = "0.7.0";
 
 // packages/core/dist/jcs.js
 function hasLoneSurrogate(text) {
@@ -8953,7 +8844,7 @@ function assertMeaning(type, from, to, klass, payload) {
     throw new MessagingError("invalid_request", "a self sync goes between devices of one person");
   if (p.conv?.kind === "card" && (from?.person === to.person || from?.agent !== undefined))
     throw new MessagingError("invalid_request", "a card goes from a person to another person");
-  const line = p.kind === "message" && p.external === undefined && p.message.taskId === undefined && Ulid.safeParse(p.message.messageId).success && (p.message.contextId === undefined || Ulid.safeParse(p.message.contextId).success);
+  const line = p.kind === "message" && p.message.taskId === undefined && Ulid.safeParse(p.message.messageId).success && (p.message.contextId === undefined || Ulid.safeParse(p.message.contextId).success);
   if (!line)
     throw new MessagingError("invalid_request", "a chat line is kind message, outside any task, with ULID messageId and contextId");
 }
@@ -9265,7 +9156,7 @@ class Roster {
         if (!verify(invite.invitePub, DOMAIN.invite, redeemClaim(this.team, inviteId, member), proof)) {
           throw new MessagingError("invite_invalid", "invite proof does not verify for this member");
         }
-        if (member.person !== invite.person || member.role !== invite.role) {
+        if (member.person !== invite.person || member.role !== "member") {
           throw new MessagingError("invite_invalid", "member does not match the invite");
         }
         this.#requireNew(member);
@@ -9401,14 +9292,12 @@ function createInvite(roster, identity, args) {
     inviteId,
     secret,
     person: args.person,
-    role: args.role,
     expires
   });
   const entry = createEntry(roster, identity, "invite.create", {
     inviteId,
     invitePub: rawPublicKey(seedKey(secret)),
     person: args.person,
-    role: args.role,
     expires
   }, now);
   return { entry, ticket, secret };
@@ -9430,7 +9319,7 @@ function decodeTicket(text) {
 function createRedeem(roster, ticket, identity, args) {
   if (ticket.team !== roster.team)
     throw new MessagingError("invite_invalid", "ticket is for another team");
-  const member = { machine: identity.machine, enc: identity.enc, person: ticket.person, role: ticket.role, label: args.label };
+  const member = { machine: identity.machine, enc: identity.enc, person: ticket.person, role: "member", label: args.label };
   const proof = signWith(seedKey(ticket.secret), DOMAIN.invite, redeemClaim(roster.team, ticket.inviteId, member));
   return createEntry(roster, identity, "invite.redeem", { inviteId: ticket.inviteId, proof, member }, args.now);
 }
@@ -10256,6 +10145,8 @@ function page(url, issuer) {
   }
   if (at.origin !== new URL(issuer).origin)
     throw new MessagingError("jelly_unavailable", "Jelly ID's sign-in page is not on its own origin");
+  if (at.search !== "" || at.hash !== "" || at.username !== "" || at.password !== "")
+    throw new MessagingError("jelly_unavailable", "Jelly ID's sign-in page carries a query or credentials");
   return at.href;
 }
 function readDeviceCodeAnswer(status, text, issuer) {
@@ -10264,9 +10155,7 @@ function readDeviceCodeAnswer(status, text, issuer) {
     if (!parsed.success)
       throw new MessagingError("jelly_unavailable", "Jelly ID's sign-in code could not be read");
     const a = parsed.data;
-    const complete = page(a.verification_uri_complete, issuer);
-    const plain = page(a.verification_uri, issuer);
-    return { deviceCode: a.device_code, userCode: a.user_code, verificationUri: plain, verificationUriComplete: complete, expiresInS: a.expires_in, intervalS: a.interval ?? LOGIN_INTERVAL_DEFAULT_S };
+    return { deviceCode: a.device_code, userCode: a.user_code, verificationUri: page(a.verification_uri, issuer), expiresInS: a.expires_in, intervalS: a.interval };
   }
   const answer = errorOf(text);
   switch (answer?.error) {
@@ -10306,8 +10195,6 @@ function readDevicePoll(status, text) {
     case "invalid_client":
     case "unsupported_grant_type":
       throw unsupported("it refused this device client");
-    case "invalid_request":
-      throw new MessagingError("invalid_request", "Jelly ID refused the poll as malformed");
     default:
       return { kind: "retry" };
   }
@@ -10325,7 +10212,7 @@ function deviceCodeForm(args) {
 function devicePollForm(args) {
   return new URLSearchParams({ grant_type: DEVICE_GRANT_TYPE, device_code: args.deviceCode, client_id: args.clientId });
 }
-var DEVICE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code", LOGIN_SLOW_DOWN_S = 5, LOGIN_INTERVAL_DEFAULT_S = 5, LOGIN_INTERVAL_MAX_S = 60, JELLY_ANSWER_BYTES = 65536, ResourceName, Metadata, unsupported = (why) => new MessagingError("login_unsupported", `Jelly ID does not offer device sign-in yet: ${why}`), CodeAnswer, ErrorAnswer, TokenAnswer;
+var DEVICE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code", LOGIN_SLOW_DOWN_S = 5, LOGIN_INTERVAL_MAX_S = 60, JELLY_ANSWER_BYTES = 65536, ResourceName, Metadata, unsupported = (why) => new MessagingError("login_unsupported", `Jelly ID does not offer device sign-in yet: ${why}`), CodeAnswer, ErrorAnswer, TokenAnswer;
 var init_jelly_device = __esm(() => {
   init_b64u();
   init_keys();
@@ -10340,12 +10227,11 @@ var init_jelly_device = __esm(() => {
     jelly_resource_device_token_endpoint: string2().max(2048).optional()
   });
   CodeAnswer = looseObject({
-    device_code: string2().min(1).max(512),
+    device_code: string2().min(22).max(256),
     user_code: string2().regex(/^[A-HJ-NP-Z2-9]{5}-[A-HJ-NP-Z2-9]{5}$/),
     verification_uri: string2().max(2048),
-    verification_uri_complete: string2().max(2048),
     expires_in: number2().int().positive().max(3600),
-    interval: number2().int().positive().max(LOGIN_INTERVAL_MAX_S).optional()
+    interval: number2().int().positive().max(LOGIN_INTERVAL_MAX_S)
   });
   ErrorAnswer = looseObject({ error: string2().max(64), detail: string2().max(64).optional() });
   TokenAnswer = looseObject({ access_token: string2().min(1).max(8192), token_type: string2().max(32) });
@@ -10744,6 +10630,31 @@ function verifyPersonView(view, context) {
     throw asMessagingError(error, "person view");
   }
 }
+function checkPersonSuccession(earlier, later) {
+  if (earlier.person !== later.person)
+    throw new MessagingError("invalid_request", "the two states are of two persons");
+  if (earlier.erased || later.erased)
+    return;
+  const ours = earlier.log.entries();
+  const theirs = later.log.entries();
+  if (theirs.length < ours.length)
+    throw new DirectoryInconsistency("a later tree head serves a shorter log", { kind: "rollback", what: "log", ours: ours.length, theirs: theirs.length });
+  for (let seq = 0;seq < ours.length; seq++) {
+    if (logEntryHash(ours[seq]) !== logEntryHash(theirs[seq]))
+      throw new DirectoryInconsistency("the log differs from the one held", { kind: "fork", seq, ours: ours[seq], theirs: theirs[seq] });
+  }
+  for (const [device, statement] of earlier.keys) {
+    if (!later.log.device(device)?.current)
+      continue;
+    const next = later.keys.get(device);
+    if (!next)
+      throw new DirectoryInconsistency("a held keys statement is withheld", { kind: "rollback", what: "keys", ours: statement.seq, theirs: -1 });
+    if (next.seq < statement.seq)
+      throw new DirectoryInconsistency("a keys statement is older than the one held", { kind: "rollback", what: "keys", ours: statement.seq, theirs: next.seq });
+    if (next.seq === statement.seq && keysStatementHash(next) !== keysStatementHash(statement))
+      throw fail("two keys statements share a device and seq");
+  }
+}
 function checkWitness(witness, seq, deadline, log, person, sth) {
   const epoch = verifyEpochProof(sth, witness.epoch);
   const committed = witness.value.log;
@@ -10754,6 +10665,33 @@ function checkWitness(witness, seq, deadline, log, person, sth) {
   if (epoch.leaf.ts > deadline)
     throw new MessagingError("binding_invalid", "a Jelly binding first appeared after its token's life");
 }
+function verifyPersonHead(view, context) {
+  try {
+    const parsed = parseWith(PersonHead, view, "person head");
+    const { sth } = context;
+    const head = verifyEpochProof(sth, context.head);
+    if (head.index !== sth.size - 1)
+      throw fail("the head epoch is not the tree head's last");
+    const mapRoot = head.leaf.mapRoot;
+    if (parsed.tombstone) {
+      if (parsed.value)
+        throw new MessagingError("invalid_request", "an erased person has no head");
+      if (!verifyMapProof(mapRoot, parsed.person, TOMBSTONE, parsed.mapProof))
+        throw new DirectoryInconsistency("the map does not hold the tombstone", { kind: "map", sth, head });
+      return { person: parsed.person, state: "erased" };
+    }
+    if (!parsed.value) {
+      if (!verifyMapProof(mapRoot, parsed.person, undefined, parsed.mapProof))
+        throw new DirectoryInconsistency("the map holds a person served as absent", { kind: "map", sth, head });
+      return { person: parsed.person, state: "absent" };
+    }
+    if (!verifyMapProof(mapRoot, parsed.person, mapValue(parsed.value), parsed.mapProof))
+      throw new DirectoryInconsistency("the map does not commit to the head served", { kind: "map", sth, head });
+    return { person: parsed.person, state: "live", log: parsed.value.log, keys: parsed.value.keys };
+  } catch (error) {
+    throw asMessagingError(error, "person head");
+  }
+}
 var DirectoryInconsistency, fail = (what) => new MessagingError("directory_inconsistent", what);
 var init_person_view = __esm(() => {
   init_check();
@@ -11105,8 +11043,6 @@ function grant(identity, args) {
   const raw = args.parent;
   const parent = raw === undefined ? undefined : parseWith(DelegationGrant, raw, "parent grant");
   if (parent !== undefined) {
-    if (args.external !== undefined)
-      throw new MessagingError("invalid_request", "only a root grant names an external principal");
     if (parent.to !== args.from)
       throw new MessagingError("invalid_request", "a grant extends the grant to its delegating session");
   }
@@ -11131,8 +11067,7 @@ function grant(identity, args) {
     exp,
     maxDepth,
     ...scope !== undefined ? { scope: [...scope] } : {},
-    ...raw !== undefined ? { parent: grantHash(raw) } : {},
-    ...args.external !== undefined ? { external: { principal: args.external.principal } } : {}
+    ...raw !== undefined ? { parent: grantHash(raw) } : {}
   };
   parseWith(DelegationGrant.omit({ sig: true }), unsigned, "delegation grant");
   return { ...unsigned, sig: sign(identity, DOMAIN.delegation, unsigned) };
@@ -11154,7 +11089,7 @@ function check2(raw, ctx) {
     throw new MessagingError("too_large", `a delegation chain is limited to ${LIMITS.delegationBytes} bytes`);
   let maxDepth = LIMITS.delegationDepth;
   let previous;
-  for (const [index, grant] of grants.entries()) {
+  for (const grant of grants) {
     const { sig, ...unsigned } = grant;
     const input = signingInput(DOMAIN.delegation, unsigned);
     if (grant.realm !== realm.realm)
@@ -11176,9 +11111,6 @@ function check2(raw, ctx) {
     }
     if (!verifyInput(grant.by, input, sig))
       throw new MessagingError("bad_signature", "a grant signature is invalid");
-    if (grant.external !== undefined && (index > 0 || signer.role !== "service")) {
-      throw new MessagingError("forbidden", "only a service member's root grant names an external principal");
-    }
     if (previous === undefined) {
       if (grant.parent !== undefined)
         throw new MessagingError("invalid_request", "a root grant has no parent");
@@ -11207,9 +11139,6 @@ function check2(raw, ctx) {
   if (last.by !== hop.by || last.from !== hop.from || last.to !== hop.to || last.task !== hop.task) {
     throw new MessagingError("forbidden", "the chain does not authorize this request");
   }
-  const external = grants.length === 1 ? root.external?.principal : undefined;
-  if (external !== hop.external)
-    throw new MessagingError("forbidden", "the chain's external principal does not match the request");
   return {
     grants: structuredClone(grants),
     summary: {
@@ -11217,7 +11146,6 @@ function check2(raw, ctx) {
       depth: grants.length,
       maxDepth,
       ...last.scope !== undefined ? { scope: [...last.scope] } : {},
-      ...root.external !== undefined ? { external: { principal: root.external.principal, gateway: root.by } } : {},
       exp: Math.min(...grants.map((grant) => grant.exp))
     }
   };
@@ -11279,103 +11207,8 @@ var init_task = __esm(() => {
   };
 });
 
-// packages/core/dist/direct.js
-import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, createHash as createHash7, diffieHellman as diffieHellman2, generateKeyPairSync as generateKeyPairSync3, hkdfSync as hkdfSync2, randomBytes as randomBytes4 } from "crypto";
-function directEphemeral() {
-  const key = generateKeyPairSync3("x25519").privateKey;
-  return { key, half: { epk: rawPublicKey(key), nonce: b64u.encode(randomBytes4(32)) } };
-}
-function directTranscript(initiator, responder) {
-  return { proto: DIRECT_PROTOCOL, initiator: { epk: initiator.epk, nonce: initiator.nonce }, responder: { epk: responder.epk, nonce: responder.nonce } };
-}
-function directAuthPayload(args) {
-  const { transcript, team, role, machine, peer } = args;
-  if (role === "initiator" !== (peer !== undefined))
-    throw new MessagingError("invalid_request", "only the initiator names its peer");
-  return { ...transcript, team, role, machine, ...peer === undefined ? {} : { peer } };
-}
-function directKeys(own, peerEpk, transcript) {
-  let shared;
-  try {
-    shared = diffieHellman2({ privateKey: own, publicKey: publicKeyFromRaw("x25519", peerEpk) });
-  } catch {
-    throw new MessagingError("bad_signature", "the peer's handshake key is not usable");
-  }
-  if (shared.every((byte) => byte === 0))
-    throw new MessagingError("bad_signature", "the peer's handshake key is not usable");
-  const salt = createHash7("sha256").update(canonicalize(transcript)).digest();
-  const okm = new Uint8Array(hkdfSync2("sha256", shared, salt, DOMAIN.directLink, 128));
-  return {
-    box: { responder: okm.slice(0, 32), initiator: okm.slice(32, 64) },
-    record: { initiator: okm.slice(64, 96), responder: okm.slice(96, 128) }
-  };
-}
-function sealDirectBox(key, transcript, identity) {
-  const cipher = createCipheriv2("aes-256-gcm", key, ZERO_NONCE, { authTagLength: TAG_BYTES2 });
-  cipher.setAAD(utf8(canonicalize(transcript)));
-  return b64u.encode(Buffer.concat([cipher.update(utf8(canonicalize(identity))), cipher.final(), cipher.getAuthTag()]));
-}
-function openDirectBox(key, transcript, box) {
-  let plaintext;
-  try {
-    const bytes = b64u.decode(box);
-    if (bytes.length <= TAG_BYTES2)
-      throw new Error("short");
-    const decipher = createDecipheriv2("aes-256-gcm", key, ZERO_NONCE, { authTagLength: TAG_BYTES2 });
-    decipher.setAAD(utf8(canonicalize(transcript)));
-    decipher.setAuthTag(bytes.subarray(bytes.length - TAG_BYTES2));
-    plaintext = Buffer.concat([decipher.update(bytes.subarray(0, bytes.length - TAG_BYTES2)), decipher.final()]);
-  } catch {
-    throw new MessagingError("bad_signature", "the handshake box does not open");
-  }
-  return parseWire(plaintext.toString("utf8"), { maxBytes: DIRECT_HANDSHAKE_BYTES });
-}
-
-class DirectCipher {
-  #key;
-  #counter = 0;
-  constructor(key) {
-    if (key.length !== 32)
-      throw new MessagingError("invalid_request", "a record key is 32 bytes");
-    this.#key = key;
-  }
-  seal(plaintext) {
-    const cipher = createCipheriv2("aes-256-gcm", this.#key, this.#nonce(), { authTagLength: TAG_BYTES2 });
-    return Buffer.concat([cipher.update(plaintext), cipher.final(), cipher.getAuthTag()]);
-  }
-  open(record) {
-    try {
-      if (record.length < TAG_BYTES2)
-        throw new Error("short");
-      const decipher = createDecipheriv2("aes-256-gcm", this.#key, this.#nonce(), { authTagLength: TAG_BYTES2 });
-      decipher.setAuthTag(record.subarray(record.length - TAG_BYTES2));
-      return Buffer.concat([decipher.update(record.subarray(0, record.length - TAG_BYTES2)), decipher.final()]);
-    } catch {
-      throw new MessagingError("bad_signature", "a direct record does not open");
-    }
-  }
-  #nonce() {
-    if (this.#counter >= Number.MAX_SAFE_INTEGER)
-      throw new MessagingError("internal", "record counter exhausted");
-    const nonce = Buffer.alloc(NONCE_BYTES2);
-    nonce.writeBigUInt64BE(BigInt(this.#counter++), 4);
-    return nonce;
-  }
-}
-var NONCE_BYTES2 = 12, TAG_BYTES2 = 16, ZERO_NONCE;
-var init_direct2 = __esm(() => {
-  init_b64u();
-  init_jcs();
-  init_keys();
-  init_common();
-  init_direct();
-  init_errors3();
-  init_wire();
-  ZERO_NONCE = new Uint8Array(NONCE_BYTES2);
-});
-
 // packages/core/dist/peer-text.js
-import { randomBytes as randomBytes5 } from "crypto";
+import { randomBytes as randomBytes4 } from "crypto";
 function addReading(code, letters) {
   const c = String.fromCodePoint(code);
   READINGS.set(c, (READINGS.get(c) ?? "") + letters);
@@ -11612,7 +11445,7 @@ function createFence(options) {
   if (!TAG.test(tag))
     throw new Error("fence tag must be lowercase words joined by hyphens");
   const stem = tag.split("-")[0];
-  const random = options.random ?? randomBytes5;
+  const random = options.random ?? randomBytes4;
   const opened = new RegExp(`<${tag}-[${NONCE_ALPHABET}]{${NONCE_LENGTH}}[ >]`);
   const neutralize = (text, clean = {}) => render(text, { singleLine: clean.singleLine === true, maxChars: clean.maxChars, terminal: false, attribute: false, stem });
   function fence(body, attributes = {}, clean = {}, block) {
@@ -12734,7 +12567,6 @@ var init_agent_tools = __esm(() => {
       at: iso,
       parts: array(Part2),
       verified: _enum(["signature", "none"]).optional().describe("signature: the daemon checked the sender's signature"),
-      external: fenced("An outside A2A principal it came from, through the gateway").optional(),
       replyTo: string2().optional(),
       chain: Chain.optional(),
       task: Task2.optional(),
@@ -12864,7 +12696,6 @@ var init_dist = __esm(() => {
   init_delegation2();
   init_task();
   init_a2a();
-  init_direct2();
   init_peer_text();
   init_agent_tools();
   init_operations();
@@ -12992,13 +12823,13 @@ var init_paths = __esm(() => {
 });
 
 // packages/ipc/dist/pipes.js
-import { randomBytes as randomBytes6 } from "crypto";
+import { randomBytes as randomBytes5 } from "crypto";
 import { readFileSync, renameSync, rmSync, writeFileSync } from "fs";
 function newPipeName(tier) {
-  return `\\\\.\\pipe\\messaging-${randomBytes6(16).toString("hex")}-${tier}`;
+  return `\\\\.\\pipe\\messaging-${randomBytes5(16).toString("hex")}-${tier}`;
 }
 function writePointer(path, pointer) {
-  const temp = `${path}.${process.pid}.${randomBytes6(4).toString("hex")}.tmp`;
+  const temp = `${path}.${process.pid}.${randomBytes5(4).toString("hex")}.tmp`;
   try {
     writeFileSync(temp, `${JSON.stringify(pointer)}
 `, { flag: "wx" });
@@ -13054,7 +12885,7 @@ var init_rpc = __esm(() => {
 
 // packages/ipc/dist/windows-acl.js
 import { spawnSync } from "child_process";
-import { randomBytes as randomBytes7 } from "crypto";
+import { randomBytes as randomBytes6 } from "crypto";
 import { existsSync, readFileSync as readFileSync2, rmSync as rmSync2 } from "fs";
 import { tmpdir } from "os";
 import { join as join2 } from "path";
@@ -13169,7 +13000,7 @@ function currentUserSid() {
   return sid;
 }
 function readDacl(path) {
-  const out = join2(tmpdir(), `messaging-acl-${process.pid}-${randomBytes7(8).toString("hex")}.txt`);
+  const out = join2(tmpdir(), `messaging-acl-${process.pid}-${randomBytes6(8).toString("hex")}.txt`);
   try {
     run("icacls.exe", [path, "/save", out, "/q"]);
     return parseSddlDacl(sddlLine(readFileSync2(out)));
@@ -13948,85 +13779,6 @@ var init_dist2 = __esm(() => {
   init_windows_acl();
 });
 
-// packages/daemon/dist/direct-config.js
-import { BlockList, isIP } from "net";
-function parseHostPort(text) {
-  const match = /^\[([0-9A-Fa-f:.]+)\](?::(\d{1,5}))?$/.exec(text) ?? /^([0-9.]+)(?::(\d{1,5}))?$/.exec(text);
-  if (!match)
-    return;
-  const host = match[1];
-  const family = isIP(host);
-  if (family === 0 || family === 6 !== text.startsWith("["))
-    return;
-  const port = match[2] === undefined ? undefined : Number(match[2]);
-  if (port !== undefined && port > 65535)
-    return;
-  return { host, port };
-}
-function family(host) {
-  const f = isIP(host);
-  return f === 4 ? "ipv4" : f === 6 ? "ipv6" : undefined;
-}
-function isLoopback(host) {
-  const f = family(host);
-  return f !== undefined && LOOPBACK.check(host, f);
-}
-function isWildcard(host) {
-  return host === "0.0.0.0" || host === "::";
-}
-function isDirectHost(host) {
-  const f = family(host);
-  return f !== undefined && (LOOPBACK.check(host, f) || LAN.check(host, f));
-}
-function mayDial(endpoint, ownListenerOnLoopback) {
-  if (!isDirectHost(endpoint.host))
-    return false;
-  return !isLoopback(endpoint.host) || ownListenerOnLoopback;
-}
-function advertisedEndpoints(config, bound) {
-  if (config.advertise === undefined)
-    return isWildcard(bound.host) ? [] : [{ host: bound.host, port: bound.port }];
-  return config.advertise.map((text) => {
-    const parsed = parseHostPort(text);
-    return { host: parsed.host, port: parsed.port ?? bound.port };
-  });
-}
-var DEFAULT_DIRECT_LISTEN = "127.0.0.1:0", LOOPBACK, LAN, ListenAddress, AdvertiseAddress, DirectConfig;
-var init_direct_config = __esm(() => {
-  init_zod();
-  LOOPBACK = new BlockList;
-  LOOPBACK.addSubnet("127.0.0.0", 8, "ipv4");
-  LOOPBACK.addAddress("::1", "ipv6");
-  LAN = new BlockList;
-  for (const [net, prefix] of [
-    ["10.0.0.0", 8],
-    ["172.16.0.0", 12],
-    ["192.168.0.0", 16],
-    ["100.64.0.0", 10],
-    ["169.254.0.0", 16]
-  ]) {
-    LAN.addSubnet(net, prefix, "ipv4");
-  }
-  LAN.addSubnet("fe80::", 10, "ipv6");
-  LAN.addSubnet("fc00::", 7, "ipv6");
-  ListenAddress = string2().refine((text) => {
-    const parsed = parseHostPort(text);
-    return parsed?.port !== undefined && (isWildcard(parsed.host) || isDirectHost(parsed.host));
-  }, "listen must be ip:port (IPv6 in brackets) on loopback, a private or link-local address, or all interfaces");
-  AdvertiseAddress = string2().refine((text) => {
-    const parsed = parseHostPort(text);
-    return parsed !== undefined && parsed.port !== 0 && isDirectHost(parsed.host);
-  }, "advertise entries must be ip or ip:port (IPv6 in brackets) on loopback or a private or link-local address");
-  DirectConfig = object({
-    enabled: boolean2().optional(),
-    listen: ListenAddress.optional(),
-    advertise: array(AdvertiseAddress).min(1).max(4).optional()
-  }).strict().refine((c) => c.enabled !== true || c.advertise !== undefined || !isWildcard(parseHostPort(c.listen ?? DEFAULT_DIRECT_LISTEN).host), {
-    message: "advertise is required when listening on all interfaces",
-    path: ["advertise"]
-  });
-});
-
 // packages/daemon/dist/identity/record.js
 import { createPrivateKey as createPrivateKey2 } from "crypto";
 import { closeSync as closeSync2, constants as constants3, existsSync as existsSync3, fstatSync, fsyncSync, linkSync, readFileSync as readFileSync4, renameSync as renameSync2, rmSync as rmSync3, statSync, unlinkSync, writeSync } from "fs";
@@ -14303,7 +14055,6 @@ var init_home = __esm(() => {
   init_zod();
   init_dist();
   init_dist2();
-  init_direct_config();
   init_record();
   PRESENCE_FIELDS = ["repo", "branch", "doing"];
   PresenceField = _enum(PRESENCE_FIELDS);
@@ -14314,8 +14065,6 @@ var init_home = __esm(() => {
     label: MachineLabel.optional(),
     realm: DirectoryRealmConfig.strict().optional(),
     inbound: object({
-      refuse: array(PersonName).max(0, { error: 'inbound.refuse was replaced by block grants (spec \xA76.9): remove it, and block each person with grant.set {subject: {person}, chat: "blocked"}' }).optional(),
-      wake: literal("team", { error: "inbound.wake was removed: a push-tier session may be woken for what consent delivers to it; register sessions with tier pull to never wake them (spec \xA78.3)" }).optional(),
       quota: object({ items: number2().int().min(1), bytes: number2().int().min(1) }).partial().strict().optional()
     }).strict().optional(),
     presence: object({ share: array(PresenceField).max(PRESENCE_FIELDS.length) }).strict().optional(),
@@ -14329,7 +14078,6 @@ var init_home = __esm(() => {
       transcriptDays: number2().int().min(1).max(36500)
     }).partial().strict().optional(),
     ipc: object({ agentGroup: number2().int().min(0).max(4294967294) }).partial().strict().optional(),
-    transport: object({ direct: DirectConfig.optional() }).strict().optional(),
     identity: object({
       store: _enum(["auto", "file", "keychain"]),
       prompt: boolean2(),
@@ -14917,8 +14665,6 @@ function machineLoopGuard() {
 function inboundPolicy(facts, state, now) {
   if (!facts.recipient)
     return "unknown_session";
-  if (facts.recipient.agent === GATEWAY_AGENT)
-    return "refused";
   if (facts.task && facts.recipient.agent === CLI_AGENT)
     return "refused";
   const agents = facts.sender.agent !== CLI_AGENT && facts.recipient.agent !== CLI_AGENT;
@@ -14929,8 +14675,6 @@ ${facts.recipient.session}`, now))
   if (agents && !state.machineLoop.take(`${facts.sender.machine}
 ${facts.recipient.session}`, now))
     return "loop_guard";
-  if (facts.external && facts.sender.role !== "service")
-    return "forbidden";
   return;
 }
 function isFinalStage(stage) {
@@ -14946,7 +14690,7 @@ function canAdvance(from, to) {
 function inboxAdvances(from, to) {
   return INBOX_RANK[to] > INBOX_RANK[from];
 }
-var RESPONSE_RATE_FACTOR = 4, CHAT_SEND_PER_MACHINE_PER_MINUTE, DEFER_MARGIN_MS = 60000, RESPONSE_TYPES, LOOP_MACHINE_FACTOR = 2, GATEWAY_AGENT = "a2a-gateway", STAGE_RANK, INBOX_RANK;
+var RESPONSE_RATE_FACTOR = 4, CHAT_SEND_PER_MACHINE_PER_MINUTE, DEFER_MARGIN_MS = 60000, RESPONSE_TYPES, LOOP_MACHINE_FACTOR = 2, STAGE_RANK, INBOX_RANK;
 var init_policy = __esm(() => {
   init_dist();
   CHAT_SEND_PER_MACHINE_PER_MINUTE = LIMITS.inboundPerMachinePerMinute - 10;
@@ -14966,7 +14710,7 @@ var init_policy = __esm(() => {
 });
 
 // packages/daemon/dist/chat.js
-import { createHash as createHash8 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 
 class Chats {
   #host;
@@ -15041,7 +14785,7 @@ class Chats {
   }
   send(p, session, scope = "") {
     const room = p.conversation;
-    const digest = p.clientId === undefined ? undefined : createHash8("sha256").update(JSON.stringify([room, p.thread ?? "", p.text])).digest("base64url");
+    const digest = p.clientId === undefined ? undefined : createHash7("sha256").update(JSON.stringify([room, p.thread ?? "", p.text])).digest("base64url");
     if (p.clientId !== undefined) {
       const earlier = this.#store.chatSend(scope, p.clientId);
       if (earlier) {
@@ -15438,7 +15182,7 @@ var init_chat = __esm(() => {
 });
 
 // packages/daemon/dist/log.js
-import { closeSync as closeSync5, constants as constants5, lstatSync as lstatSync3, renameSync as renameSync6, writeSync as writeSync2 } from "fs";
+import { closeSync as closeSync5, constants as constants5, lstatSync as lstatSync3, renameSync as renameSync6, writeSync as writeSync3 } from "fs";
 function formatLine(level, event, fields = {}) {
   const record = { t: new Date().toISOString(), level, event };
   for (const [name, value] of Object.entries(fields))
@@ -15467,7 +15211,7 @@ function createLogger(options) {
         }
         const fd = openNoFollow(file, constants5.O_WRONLY | constants5.O_APPEND | constants5.O_CREAT, 384);
         try {
-          writeSync2(fd, line);
+          writeSync3(fd, line);
         } finally {
           closeSync5(fd);
         }
@@ -15534,9 +15278,9 @@ var init_log = __esm(() => {
 });
 
 // packages/daemon/dist/keyring.js
-import { createHash as createHash9, generateKeyPairSync as generateKeyPairSync4 } from "crypto";
+import { createHash as createHash8, generateKeyPairSync as generateKeyPairSync3 } from "crypto";
 function rotationOffset(machine) {
-  return createHash9("sha256").update(machine).digest().readUInt32BE(0) % ROTATION_SPREAD_MS;
+  return createHash8("sha256").update(machine).digest().readUInt32BE(0) % ROTATION_SPREAD_MS;
 }
 function rotationDue(now, rotatedAt, days, machine) {
   return days > 0 && now >= rotatedAt + days * DAY_MS + rotationOffset(machine);
@@ -15755,7 +15499,7 @@ class Keyring {
     if (kept.length >= MAX_RETAINED) {
       throw new MessagingError("invalid_state", "too many retained encryption keys; wait until the oldest expires, then rotate again");
     }
-    const next = withEncKey(identity, generateKeyPairSync4("x25519").privateKey);
+    const next = withEncKey(identity, generateKeyPairSync3("x25519").privateKey);
     const pending = { identity: next, retained: [{ key: identity.encKey }, ...kept] };
     store.save(pending);
     this.#keys = pending;
@@ -15790,7 +15534,7 @@ var init_keyring = __esm(() => {
 });
 
 // packages/daemon/dist/directory.js
-function presencePayload(rows, label, seq, extra, policy) {
+function presencePayload(rows, label, seq, policy) {
   const { share } = policy;
   const sessions = rows.slice(0, LIMITS.presenceSessions).map((s) => {
     const live = s.unregisteredAt === undefined;
@@ -15812,8 +15556,7 @@ function presencePayload(rows, label, seq, extra, policy) {
     seq,
     label,
     sessions: [],
-    features: [...FEATURES, ...extra?.features ?? []],
-    ...extra?.direct ? { direct: extra.direct } : {},
+    features: [...FEATURES],
     ...policy.away === true ? { away: true } : {}
   };
   return { ...payload, sessions: fitPresence(sessions, jcsBytes(payload), LIMITS.presenceBytes) };
@@ -15987,10 +15730,9 @@ function signHop(args) {
     now,
     ...last !== undefined ? { parent: last } : {},
     ...scope !== undefined ? { scope } : {},
-    ...maxDepth !== undefined ? { maxDepth } : {},
-    ...request.external !== undefined ? { external: { principal: request.external.principal } } : {}
+    ...maxDepth !== undefined ? { maxDepth } : {}
   });
-  const hop = { by: identity.machine, from, to: args.to, task: args.task, ...request.external !== undefined ? { external: request.external.principal } : {} };
+  const hop = { by: identity.machine, from, to: args.to, task: args.task };
   return verifyChain([...args.parent ?? [], grant], { realm, now, hop });
 }
 function inboundChain(raw, ctx) {
@@ -15998,8 +15740,7 @@ function inboundChain(raw, ctx) {
     by: ctx.sender.machine,
     from: formatAddress(ctx.sender.person, ctx.fromSession, ctx.sender.label),
     to: formatAddress(ctx.me.person, ctx.toSession, ctx.me.label),
-    task: ctx.task,
-    ...ctx.external !== undefined ? { external: ctx.external.principal } : {}
+    task: ctx.task
   };
   return verifyChain(raw, { realm: ctx.realm, now: ctx.now, hop });
 }
@@ -16264,7 +16005,6 @@ class DeviceLogin {
     const pending = {
       state: "pending",
       purpose: args.purpose,
-      verificationUriComplete: code.verificationUriComplete,
       verificationUri: code.verificationUri,
       userCode: code.userCode,
       fingerprint: jellyKeyFingerprint(device),
@@ -16369,7 +16109,7 @@ var init_device_login = __esm(() => {
 });
 
 // packages/daemon/dist/realm/directory-identity.js
-import { randomBytes as randomBytes8 } from "crypto";
+import { randomBytes as randomBytes7 } from "crypto";
 
 class DirectoryIdentity {
   kind = "directory";
@@ -16636,12 +16376,21 @@ class DirectoryIdentity {
       throw new MessagingError("binding_invalid", "this device was removed from its account; it cannot be bound again");
     const done = await this.#extendLog(async () => {
       await this.#latest();
-      await this.#fetch([person]);
-      const log = this.#persons.get(person)?.state.log;
-      const current = log?.device(identity.machine);
-      if (current && !current.current)
-        throw new MessagingError("binding_invalid", "this device was removed from its account; it cannot be bound again");
-      const head = log?.head();
+      let current;
+      let head;
+      if (this.#own.person === person && this.binding().state !== "none") {
+        await this.#fetch([person]);
+        const log = this.#persons.get(person)?.state.log;
+        current = log?.device(identity.machine);
+        if (current && !current.current)
+          throw new MessagingError("binding_invalid", "this device was removed from its account; it cannot be bound again");
+        head = log?.head();
+      } else {
+        const verified = await this.#headOf(person);
+        if (verified.state === "erased")
+          throw new MessagingError("binding_invalid", "the account was erased");
+        head = verified.state === "live" ? verified.log : undefined;
+      }
       const entry = signLogEntry(identity, {
         v: PROTOCOL,
         realm: this.realm,
@@ -16771,7 +16520,7 @@ class DirectoryIdentity {
     if (this.#own.person !== undefined) {
       throw new MessagingError("invalid_state", this.removed() ? "this device was removed from its account; it cannot be bound again" : "this device is already bound");
     }
-    const link = createLinkRequest(this.#options.identity(), { realm: this.realm, label: args.label, kind: args.kind, nonce: randomBytes8(16), ts: this.#options.now() });
+    const link = createLinkRequest(this.#options.identity(), { realm: this.realm, label: args.label, kind: args.kind, nonce: randomBytes7(16), ts: this.#options.now() });
     this.#pendingLink = link;
     return { link: encodeLink(link), sas: linkSas(link), expires: link.ts + LIMITS.linkTtlMs };
   }
@@ -16965,8 +16714,9 @@ class DirectoryIdentity {
   async#fetch(persons) {
     if (!this.#head)
       await this.#latest();
+    const basis = new Map(persons.map((person) => [person, this.#persons.get(person)]));
     const ask = persons.map((person) => {
-      const held = this.#persons.get(person);
+      const held = basis.get(person);
       const length = held?.state.erased ? 0 : held?.state.log.length ?? 0;
       return length > 0 ? { person, knownSeq: length - 1 } : { person };
     });
@@ -16990,8 +16740,14 @@ class DirectoryIdentity {
       const view = views.get(person);
       if (!view)
         continue;
-      const before = this.#persons.get(person)?.state;
-      const state = await this.#verify(view, head);
+      const state = await this.#verify(view, head, basis.get(person)?.state);
+      const current = this.#persons.get(person);
+      if (current && current !== basis.get(person)) {
+        this.#succession(current.size > head.sth.size ? state : current.state, current.size > head.sth.size ? current.state : state);
+        if (current.size > head.sth.size)
+          continue;
+      }
+      const before = current?.state;
       this.#persons.set(person, { state, size: head.sth.size, fetchedAt: now });
       this.#cache.putPerson({ person, entries: [...state.log.entries()], keys: [...state.keys.values()], erased: state.erased, size: head.sth.size, fetchedAt: now });
       if (state.log.length !== (before?.log.length ?? 0) || state.erased !== (before?.erased ?? false))
@@ -17005,22 +16761,58 @@ class DirectoryIdentity {
     if (unwatched.length > 0)
       this.watch(unwatched);
   }
-  async#verify(view, head) {
-    const known = this.#persons.get(view.person)?.state;
+  async#headOf(person) {
+    if (!this.#head)
+      await this.#latest();
+    let head = this.#head;
+    let answer;
+    try {
+      answer = await this.#call((link) => link.heads([person], head.sth.size));
+    } catch (error) {
+      if (!(error instanceof MessagingError) || error.code !== "invalid_request")
+        throw error;
+      await this.#latest();
+      head = this.#head;
+      answer = await this.#call((link) => link.heads([person], head.sth.size));
+    }
+    if (answer.sth.size !== head.sth.size || answer.sth.root !== head.sth.root)
+      throw new MessagingError("directory_inconsistent", "the directory answered at another tree head");
+    const view = answer.persons.find((p) => p.person === person);
+    if (!view)
+      throw new MessagingError("directory_inconsistent", "the directory left out the person asked");
+    try {
+      return verifyPersonHead(view, { sth: head.sth, head: head.head });
+    } catch (error) {
+      this.#inconsistent(error);
+      throw error;
+    }
+  }
+  async#verify(view, head, known) {
     const tokens = view.log.flatMap((entry) => entry.authority.kind === "jelly" ? [entry.authority.token] : []);
     const keys = await this.#keyring.prepare(tokens, this.#options.now());
     this.#saveArchive();
     try {
       return verifyPersonView(view, { ...this.#context(view.person, keys), sth: head.sth, head: head.head, ...known && !known.erased ? { known } : {} });
     } catch (error) {
-      if (error instanceof DirectoryInconsistency) {
-        this.#raise({ kind: "directory", reason: error.message, at: this.#options.now(), evidence: error.evidence });
-      } else if (error instanceof MessagingError && error.code === "directory_inconsistent") {
-        this.#raise({ kind: "directory", reason: error.message, at: this.#options.now() });
-      }
+      this.#inconsistent(error);
+      throw error;
+    }
+  }
+  #succession(earlier, later) {
+    try {
+      checkPersonSuccession(earlier, later);
+    } catch (error) {
+      this.#inconsistent(error);
       throw error;
     }
   }
+  #inconsistent(error) {
+    if (error instanceof DirectoryInconsistency) {
+      this.#raise({ kind: "directory", reason: error.message, at: this.#options.now(), evidence: error.evidence });
+    } else if (error instanceof MessagingError && error.code === "directory_inconsistent") {
+      this.#raise({ kind: "directory", reason: error.message, at: this.#options.now() });
+    }
+  }
   #saveArchive() {
     this.#cache.setArchive(this.#keyring.archive());
   }
@@ -17393,7 +17185,6 @@ class DirectoryHome {
     const started = await this.#login.start({ purpose, label, kind });
     return {
       purpose,
-      verificationUriComplete: started.verificationUriComplete,
       verificationUri: started.verificationUri,
       userCode: started.userCode,
       fingerprint: started.fingerprint,
@@ -17417,7 +17208,6 @@ class DirectoryHome {
     const started = await this.#login.start({ purpose, label: args.label, kind: args.kind });
     return {
       purpose,
-      verificationUriComplete: started.verificationUriComplete,
       verificationUri: started.verificationUri,
       userCode: started.userCode,
       fingerprint: started.fingerprint,
@@ -17849,12 +17639,12 @@ var init_answer_preview = __esm(() => {
 });
 
 // packages/daemon/dist/snapshot.js
-import { createHash as createHash10 } from "crypto";
+import { createHash as createHash9 } from "crypto";
 import { chmodSync as chmodSync4, chownSync as chownSync2, existsSync as existsSync6, lstatSync as lstatSync4, mkdirSync as mkdirSync5, readFileSync as readFileSync8, rmSync as rmSync4, writeFileSync as writeFileSync5 } from "fs";
 import { join as join7 } from "path";
 function sha256File(path) {
   const data = readFileSync8(path);
-  return { bytes: data.length, sha256: createHash10("sha256").update(data).digest("hex") };
+  return { bytes: data.length, sha256: createHash9("sha256").update(data).digest("hex") };
 }
 
 class Snapshots {
@@ -18639,46 +18429,44 @@ var init_storage_errors = __esm(() => {
 });
 
 // packages/daemon/dist/store.js
-import { chmodSync as chmodSync5, closeSync as closeSync7, openSync as openSync3 } from "fs";
+import { chmodSync as chmodSync5, closeSync as closeSync7, existsSync as existsSync7, openSync as openSync3 } from "fs";
 import { DatabaseSync } from "node:sqlite";
-function additiveColumn(decl) {
-  if (/\b(PRIMARY|UNIQUE|CHECK|REFERENCES|COLLATE|GENERATED|AS)\b/i.test(decl))
-    return false;
-  return !/\bNOT\s+NULL\b/i.test(decl) || /\bDEFAULT\b/i.test(decl);
+function checkStore(db, path) {
+  if (db.prepare("SELECT 1 FROM sqlite_master LIMIT 1").get() === undefined)
+    return true;
+  const hasKv = db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'kv'").get() !== undefined;
+  const raw = hasKv ? kvGet(db, "generation") : undefined;
+  if (raw === undefined) {
+    throw new Error(`${path} was written before the store reset (it records no store generation), and this messagingd does not read it. ${RESET_HINT}`);
+  }
+  if (storeNumber(raw) !== STORE_GENERATION) {
+    throw new Error(`${path} is of store generation ${raw.slice(0, 16)}; this messagingd reads generation ${STORE_GENERATION}. ${RESET_HINT}`);
+  }
+  const minReader = kvGet(db, "min_reader") ?? "";
+  if ((storeNumber(minReader) ?? Number.POSITIVE_INFINITY) > STORE_SCHEMA) {
+    throw new Error(`${path} needs a messagingd that reads store schema ${minReader.slice(0, 16) || "(unrecorded)"} or later; this one reads up to ${STORE_SCHEMA}. Run a newer messagingd`);
+  }
+  return false;
+}
+function checkStoreFile(path) {
+  if (!existsSync7(path))
+    return;
+  const db = new DatabaseSync(path, { readOnly: true, timeout: 5000 });
+  try {
+    checkStore(db, path);
+  } finally {
+    db.close();
+  }
 }
-function upgradeStore(db, migrations) {
+function openStore(db, path) {
   db.exec("BEGIN IMMEDIATE");
   try {
-    db.exec("CREATE TABLE IF NOT EXISTS kv (k TEXT PRIMARY KEY, v TEXT NOT NULL) STRICT;");
-    const raw = kvGet(db, "schema");
-    const stored = schemaNumber(raw);
-    const minReader = schemaNumber(kvGet(db, "min_reader")) ?? STORE_MIN_READER;
-    const top = migrations.reduce((max, m) => Math.max(max, m.schema), STORE_SCHEMA);
-    if (raw !== undefined && (stored === undefined || stored < STORE_MIN_READER)) {
-      throw new Error(`messaging.db has schema ${raw.slice(0, 16)}, from before the first released store (schema ${STORE_MIN_READER}); move the Messaging home aside and set it up again`);
-    }
-    if (minReader !== undefined && minReader > top) {
-      throw new Error(`messaging.db needs a messagingd that reads store schema ${minReader} or later; this one reads up to ${top}. Run a newer messagingd`);
-    }
-    db.exec(BASELINE);
-    for (const migration of migrations) {
-      if (migration.ddl) {
-        if (/\b(DROP|RENAME|ALTER)\b|\bCREATE\s+UNIQUE\b/i.test(migration.ddl))
-          throw new Error(`store migration ${migration.schema} is not additive`);
-        db.exec(migration.ddl);
-      }
-      for (const { table, column, decl } of migration.columns ?? []) {
-        if (!/^[a-z_][a-z0-9_]*$/.test(table) || !/^[a-z_][a-z0-9_]*$/.test(column) || !additiveColumn(decl)) {
-          throw new Error(`store migration ${migration.schema} is not additive (${table}.${column})`);
-        }
-        const has = db.prepare(`SELECT name FROM pragma_table_info('${table}')`).all().some((c) => c.name === column);
-        if (!has)
-          db.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${decl}`);
-      }
-    }
-    kvSet(db, "schema", String(Math.max(stored ?? 0, top)));
-    if (kvGet(db, "min_reader") === undefined)
+    if (checkStore(db, path)) {
+      db.exec(BASELINE);
+      kvSet(db, "generation", String(STORE_GENERATION));
+      kvSet(db, "schema", String(STORE_SCHEMA));
       kvSet(db, "min_reader", String(STORE_MIN_READER));
+    }
     db.exec("COMMIT");
   } catch (error) {
     db.exec("ROLLBACK");
@@ -18733,7 +18521,7 @@ class Store {
     this.#db = new DatabaseSync(path, { timeout: 5000 });
     this.#db.exec("PRAGMA journal_mode = WAL; PRAGMA synchronous = FULL;");
     try {
-      upgradeStore(this.#db, MIGRATIONS);
+      openStore(this.#db, path);
     } catch (error) {
       this.#db.close();
       throw error;
@@ -18921,7 +18709,7 @@ class Store {
   }
   insertInbox(row) {
     const { key, stage, ...item } = row.item;
-    this.#run("INSERT INTO inbox (id, key, session, sender, item, message, stage, received_at, bytes) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)", item.id, key, row.session, row.sender, JSON.stringify({ ...item, from: storedPeer(item.from) }), JSON.stringify(storedMessage(row.message)), stage, item.receivedAt, item.bytes);
+    this.#run("INSERT INTO inbox (id, key, session, sender, item, message, stage, received_at, bytes) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)", item.id, key, row.session, row.sender, JSON.stringify(item), JSON.stringify(row.message), stage, item.receivedAt, item.bytes);
   }
   inbox(key, unreadOnly, limit) {
     const sql = `SELECT * FROM inbox WHERE key = ?${unreadOnly ? " AND stage <> 'read'" : ""} ORDER BY received_at DESC, rowid DESC LIMIT ?`;
@@ -19322,7 +19110,7 @@ class Store {
     const prefix = `${peer}@`;
     const take = limit + 1;
     const [inboxBound, inboxArgs] = bound("received_at", "id");
-    const mail = this.#all(`SELECT * FROM inbox WHERE key = ? AND json_extract(item, '$.kind') = 'message' AND json_extract(item, '$.from.person') = ? AND json_extract(item, '$.from.session') = ?${inboxBound} ORDER BY received_at ${order}, id ${order} LIMIT ?`, key, person, session, ...inboxArgs, take).map((r) => ({ source: "inbox", at: Number(r.received_at), id: String(r.id), inbox: inboxRow2(r) }));
+    const mail = this.#all(`SELECT * FROM inbox WHERE key = ? AND json_extract(item, '$.kind') = 'message' AND json_extract(item, '$.from.person') = ? AND json_extract(item, '$.from.agent') = ?${inboxBound} ORDER BY received_at ${order}, id ${order} LIMIT ?`, key, person, session, ...inboxArgs, take).map((r) => ({ source: "inbox", at: Number(r.received_at), id: String(r.id), inbox: inboxRow2(r) }));
     const [sentBound, sentArgs] = bound("created_at", "id");
     const sent = this.#all(`SELECT * FROM sent WHERE key = ? AND kind = 'message' AND substr(to_addr, 1, ?) = ?${sentBound} ORDER BY created_at ${order}, id ${order} LIMIT ?`, key, prefix.length, prefix, ...sentArgs, take).map((r) => ({ source: "sent", at: Number(r.created_at), id: String(r.id), sent: sentRow(r) }));
     const [taskBound, taskArgs] = bound("created_at", "task_id");
@@ -19377,7 +19165,7 @@ class Store {
   }
   agentPeers(key, limit) {
     return this.#all(`SELECT peer, SUM(unread) AS unread, MAX(at) AS at FROM (
-         SELECT json_extract(item, '$.from.person') || '/' || json_extract(item, '$.from.session') AS peer, stage <> 'read' AS unread, received_at AS at
+         SELECT json_extract(item, '$.from.person') || '/' || json_extract(item, '$.from.agent') AS peer, stage <> 'read' AS unread, received_at AS at
            FROM inbox WHERE key = ? AND json_extract(item, '$.kind') = 'message'
          UNION ALL
          SELECT substr(to_addr, 1, instr(to_addr || '@', '@') - 1), 0, created_at FROM sent WHERE key = ? AND kind = 'message'
@@ -19404,7 +19192,7 @@ class Store {
        ON CONFLICT (task_id, role) DO UPDATE SET key = excluded.key, session = excluded.session, peer = excluded.peer,
          peer_machine = excluded.peer_machine, peer_address = excluded.peer_address, state = excluded.state,
          context_id = excluded.context_id, task = excluded.task, updated_at = excluded.updated_at,
-         request = COALESCE(excluded.request, tasks.request)`, r.task.id, r.role, r.key, row.session, JSON.stringify(storedPeer(r.peer)), r.peer.device, r.peer.address, r.task.status.state, opt(r.task.contextId), JSON.stringify(taskMessages(r.task, storedMessage)), r.createdAt, r.updatedAt, opt(row.request));
+         request = COALESCE(excluded.request, tasks.request)`, r.task.id, r.role, r.key, row.session, JSON.stringify(r.peer), r.peer.device, r.peer.address, r.task.status.state, opt(r.task.contextId), JSON.stringify(r.task), r.createdAt, r.updatedAt, opt(row.request));
     if (r.chain !== undefined) {
       this.#run("INSERT OR IGNORE INTO delegations (task_id, role, grants, chain) VALUES (?, ?, ?, ?)", r.task.id, r.role, JSON.stringify(row.grants), JSON.stringify(r.chain));
     }
@@ -19507,35 +19295,12 @@ function directoryRow(r) {
 function inboxRow2(r) {
   const item = json(r.item);
   return {
-    item: { ...item, from: peerOf(item.from), key: String(r.key), stage: String(r.stage) },
+    item: { ...item, key: String(r.key), stage: String(r.stage) },
     session: String(r.session),
     sender: String(r.sender),
-    message: messageOf2(json(r.message))
+    message: json(r.message)
   };
 }
-function storedPeer(peer) {
-  const { agent, device, ...rest } = peer;
-  return { ...rest, ...agent !== undefined ? { session: agent } : {}, machine: device };
-}
-function peerOf(stored) {
-  const { session, machine, ...rest } = stored;
-  return { ...rest, ...session !== undefined ? { agent: session } : {}, device: machine };
-}
-function storedMessage(message) {
-  const provenance = message.metadata?.[URI.provenance];
-  return provenance === undefined ? message : { ...message, metadata: { ...message.metadata, [URI.provenance]: storedPeer(provenance) } };
-}
-function taskMessages(task, convert) {
-  return {
-    ...task,
-    status: task.status.message !== undefined ? { ...task.status, message: convert(task.status.message) } : task.status,
-    ...task.history !== undefined ? { history: task.history.map(convert) } : {}
-  };
-}
-function messageOf2(message) {
-  const provenance = message.metadata?.[URI.provenance];
-  return provenance === undefined ? message : { ...message, metadata: { ...message.metadata, [URI.provenance]: peerOf(provenance) } };
-}
 function outboxRow(r) {
   return {
     id: String(r.id),
@@ -19612,10 +19377,10 @@ function matchQuery(query) {
 function taskRow2(r) {
   const row = {
     record: {
-      task: taskMessages(json(r.task), messageOf2),
+      task: json(r.task),
       role: String(r.role),
       key: String(r.key),
-      peer: peerOf(json(r.peer)),
+      peer: json(r.peer),
       createdAt: Number(r.created_at),
       updatedAt: Number(r.updated_at)
     },
@@ -19631,7 +19396,7 @@ function taskRow2(r) {
   }
   return row;
 }
-var CHAT_COUNTER = "chat", STORE_SCHEMA = 9, STORE_MIN_READER = 3, MIGRATIONS, BASELINE = `
+var CHAT_COUNTER = "chat", STORE_GENERATION = 2, STORE_SCHEMA = 1, STORE_MIN_READER = 1, BASELINE = `
 CREATE TABLE IF NOT EXISTS kv (k TEXT PRIMARY KEY, v TEXT NOT NULL) STRICT;
 CREATE TABLE IF NOT EXISTS counters (name TEXT PRIMARY KEY, value INTEGER NOT NULL) STRICT;
 CREATE TABLE IF NOT EXISTS roster (seq INTEGER PRIMARY KEY, hash TEXT NOT NULL, entry TEXT NOT NULL) STRICT;
@@ -19737,7 +19502,8 @@ CREATE TABLE IF NOT EXISTS chat_sent (
   person TEXT NOT NULL,
   stage TEXT NOT NULL,
   code TEXT,
-  exp INTEGER NOT NULL
+  exp INTEGER NOT NULL,
+  held_at INTEGER
 ) STRICT;
 CREATE INDEX IF NOT EXISTS chat_sent_by_line ON chat_sent (line, person);
 CREATE INDEX IF NOT EXISTS chat_sent_pending ON chat_sent (exp) WHERE stage = 'sent';
@@ -19780,6 +19546,7 @@ CREATE TABLE IF NOT EXISTS tasks (
   task TEXT NOT NULL,
   created_at INTEGER NOT NULL,
   updated_at INTEGER NOT NULL,
+  request TEXT,
   PRIMARY KEY (task_id, role)
 ) STRICT;
 CREATE INDEX IF NOT EXISTS tasks_by_key ON tasks (key, updated_at DESC, task_id DESC, role DESC);
@@ -19808,37 +19575,20 @@ CREATE TABLE IF NOT EXISTS idempotency (
   created_at INTEGER NOT NULL,
   PRIMARY KEY (key, ikey)
 ) STRICT;
-`, kvGet = (db, k) => {
-  const row = db.prepare("SELECT v FROM kv WHERE k = ?").get(k);
-  return row?.v === undefined || row.v === null ? undefined : String(row.v);
-}, kvSet = (db, k, v) => {
-  db.prepare("INSERT INTO kv (k, v) VALUES (?, ?) ON CONFLICT (k) DO UPDATE SET v = excluded.v").run(k, v);
-}, schemaNumber = (value) => value !== undefined && /^[1-9][0-9]{0,8}$/.test(value) ? Number(value) : undefined, TASKS = "tasks LEFT JOIN delegations USING (task_id, role)", text2 = (v) => v === null || v === undefined ? undefined : String(v), num = (v) => v === null || v === undefined ? undefined : Number(v), json = (v) => JSON.parse(String(v)), opt = (v) => v === undefined ? null : v, UNSPACED;
-var init_store2 = __esm(() => {
-  init_dist();
-  MIGRATIONS = [
-    { schema: 4, columns: [{ table: "tasks", column: "request", decl: "TEXT" }] },
-    {
-      schema: 5,
-      ddl: `CREATE TABLE IF NOT EXISTS dir_persons (
+-- A directory realm's cache of verified persons (spec \xA715.9); its tree head, Jelly key archive, own record and alarm
+-- are kv rows (dir.*).
+CREATE TABLE IF NOT EXISTS dir_persons (
   person TEXT PRIMARY KEY,
   entries TEXT NOT NULL,
   keys TEXT NOT NULL,
   erased INTEGER NOT NULL DEFAULT 0,
   size INTEGER NOT NULL,
   fetched_at INTEGER NOT NULL
-) STRICT;`
-    },
-    {
-      schema: 6,
-      ddl: `
+) STRICT;
+-- This person's grants, one per subject, as signed; and the widening levels that lapsed with their signer (spec \xA76.9).
 CREATE TABLE IF NOT EXISTS grants (subject TEXT PRIMARY KEY, grant TEXT NOT NULL) STRICT;
 CREATE TABLE IF NOT EXISTS grant_reviews (subject TEXT PRIMARY KEY, id TEXT NOT NULL, levels TEXT NOT NULL, at INTEGER NOT NULL) STRICT;
-`
-    },
-    {
-      schema: 7,
-      ddl: `
+-- Requests held for this person to answer (spec \xA76.9, "Holds"): the envelope as received and its opened payload.
 CREATE TABLE IF NOT EXISTS held (
   id TEXT PRIMARY KEY,
   person TEXT NOT NULL,
@@ -19851,11 +19601,8 @@ CREATE TABLE IF NOT EXISTS held (
 ) STRICT;
 CREATE INDEX IF NOT EXISTS held_person ON held (person);
 CREATE INDEX IF NOT EXISTS held_exp ON held (exp);
-`
-    },
-    {
-      schema: 8,
-      ddl: `
+-- Deployment "jelly" (spec \xA78.11): spent action-grant ids until their expiry, and the Jelly agent each session key
+-- was registered for. Notices (spec \xA78.2, "Notices") name their source (a line, a held request, an alarm).
 CREATE TABLE IF NOT EXISTS act_jti (jti TEXT PRIMARY KEY, exp INTEGER NOT NULL) STRICT;
 CREATE INDEX IF NOT EXISTS act_jti_exp ON act_jti (exp);
 CREATE TABLE IF NOT EXISTS session_agents (key TEXT PRIMARY KEY, agt TEXT NOT NULL) STRICT;
@@ -19870,11 +19617,8 @@ CREATE TABLE IF NOT EXISTS notices (
   acked_at INTEGER
 ) STRICT;
 CREATE INDEX IF NOT EXISTS notices_at ON notices (at);
-`
-    },
-    {
-      schema: 9,
-      ddl: `
+-- Contact cards and message requests (spec \xA76.9): the latest card each other person sent this one; message requests
+-- held for the person to accept, as received and opened; and the contacts this person's agents suggested.
 CREATE TABLE IF NOT EXISTS contact_cards (person TEXT PRIMARY KEY, card TEXT NOT NULL, seq INTEGER NOT NULL, at INTEGER NOT NULL) STRICT;
 CREATE TABLE IF NOT EXISTS contact_requests (
   id TEXT PRIMARY KEY,
@@ -19887,10 +19631,14 @@ CREATE TABLE IF NOT EXISTS contact_requests (
 ) STRICT;
 CREATE INDEX IF NOT EXISTS contact_requests_person ON contact_requests (person);
 CREATE TABLE IF NOT EXISTS contact_suggestions (id TEXT PRIMARY KEY, session TEXT NOT NULL, email TEXT NOT NULL, at INTEGER NOT NULL) STRICT;
-`,
-      columns: [{ table: "chat_sent", column: "held_at", decl: "INTEGER" }]
-    }
-  ];
+`, kvGet = (db, k) => {
+  const row = db.prepare("SELECT v FROM kv WHERE k = ?").get(k);
+  return row?.v === undefined || row.v === null ? undefined : String(row.v);
+}, kvSet = (db, k, v) => {
+  db.prepare("INSERT INTO kv (k, v) VALUES (?, ?) ON CONFLICT (k) DO UPDATE SET v = excluded.v").run(k, v);
+}, storeNumber = (value) => value !== undefined && /^[1-9][0-9]{0,8}$/.test(value) ? Number(value) : undefined, RESET_HINT = "Nothing was changed. To start over, stop messagingd, move the whole Messaging home aside (it keeps the old messages, and the messagingd that wrote it still opens it), then set the home up again: messaging login, or messaging team create or team join for a self-hosted team", TASKS = "tasks LEFT JOIN delegations USING (task_id, role)", text2 = (v) => v === null || v === undefined ? undefined : String(v), num = (v) => v === null || v === undefined ? undefined : Number(v), json = (v) => JSON.parse(String(v)), opt = (v) => v === undefined ? null : v, UNSPACED;
+var init_store2 = __esm(() => {
+  init_dist();
   UNSPACED = /([\p{Script=Han}\p{Script=Hiragana}\p{Script=Katakana}\p{Script=Hangul}\p{Script=Thai}])/gu;
 });
 
@@ -21213,6 +20961,7 @@ class Daemon {
   static async start(options) {
     const paths = homePaths(options.home, options.jellyHost?.run);
     ensureHome(paths);
+    checkStoreFile(paths.db);
     const jelly = options.jellyHost;
     if (jelly?.realm !== undefined && readConfig(paths.config).realm === undefined) {
       options = { ...options, jellyHost: { ...jelly, realm: await pinRealm(jelly.realm, options.wellKnown) } };
@@ -21895,7 +21644,7 @@ class Daemon {
         type: "presence",
         from: { person: me.person, device: identity.machine },
         to: { team: true },
-        payload: presencePayload(final ? this.#store.sessions().map((s) => ({ ...s, unregisteredAt: s.unregisteredAt ?? this.#now() })) : this.#store.sessions(), me.label, this.#store.next("presence"), this.#transport?.advertise?.(), {
+        payload: presencePayload(final ? this.#store.sessions().map((s) => ({ ...s, unregisteredAt: s.unregisteredAt ?? this.#now() })) : this.#store.sessions(), me.label, this.#store.next("presence"), {
           wake: (s) => this.#wakes(s),
           share: new Set(this.#currentConfig().presence?.share ?? []),
           away: this.#away()
@@ -22045,7 +21794,6 @@ class Daemon {
           kind: p.kind,
           message,
           wake: p.wake ?? true,
-          ...p.external !== undefined ? { external: p.external } : {},
           ...chain !== undefined ? { delegation: chain.grants } : {}
         };
         const replyTo = p.replyTo ?? follow?.request;
@@ -22121,7 +21869,7 @@ class Daemon {
   }
   async#sendLine(p) {
     const session = this.#sessionOf(p.key);
-    const extra = ["contextId", "taskId", "messageId", "metadata", "extensions", "referenceTaskIds", "external", "onBehalfOf", "wake"].filter((name) => p[name] !== undefined);
+    const extra = ["contextId", "taskId", "messageId", "metadata", "extensions", "referenceTaskIds", "onBehalfOf", "wake"].filter((name) => p[name] !== undefined);
     if (p.kind !== "message")
       throw new MessagingError("invalid_request", "a task goes to an agent, person/agent");
     if (extra.length > 0)
@@ -22712,7 +22460,7 @@ ${row.receipt ? "receipt" : "envelope"}`;
       if (payload.kind === "task") {
         const { realm, me } = this.#joined();
         try {
-          inboundChain(payload.delegation, { realm, now, sender, fromSession, me, toSession, task: payload.message.taskId, external: payload.external });
+          inboundChain(payload.delegation, { realm, now, sender, fromSession, me, toSession, task: payload.message.taskId });
         } catch (error) {
           return reject(codeOf(error));
         }
@@ -22742,10 +22490,9 @@ ${row.receipt ? "receipt" : "envelope"}`;
     const recipient = this.#store.sessionByName(toSession);
     const config = this.#currentConfig();
     const code = inboundPolicy({
-      sender: { machine: sender.machine, person: sender.person, role: sender.role, session: fromSession, agent: this.#agentOf(sender.machine, fromSession) },
+      sender: { machine: sender.machine, session: fromSession, agent: this.#agentOf(sender.machine, fromSession) },
       ...recipient ? { recipient: { session: recipient.name, agent: recipient.agent } } : {},
-      task: payload.kind === "task",
-      external: payload.external !== undefined
+      task: payload.kind === "task"
     }, this.#policy, now);
     if (code !== undefined || !recipient)
       return reject(code ?? "unknown_session");
@@ -22763,7 +22510,7 @@ ${row.receipt ? "receipt" : "envelope"}`;
         return reject("invalid_request");
       const { realm, me } = this.#joined();
       try {
-        chain = inboundChain(payload.delegation, { realm, now, sender, fromSession, me, toSession: recipient.name, task: taskId, external: payload.external });
+        chain = inboundChain(payload.delegation, { realm, now, sender, fromSession, me, toSession: recipient.name, task: taskId });
       } catch (error) {
         return reject(codeOf(error));
       }
@@ -22780,7 +22527,7 @@ ${row.receipt ? "receipt" : "envelope"}`;
         return reject("too_large");
     }
     const from = peerRef(sender, fromSession);
-    const message = withProvenance(payload.message, provenanceOf3(env, sender, now, payload.external));
+    const message = withProvenance(payload.message, provenanceOf3(env, sender, now));
     const item = {
       id: env.id,
       key: recipient.key,
@@ -22845,7 +22592,7 @@ ${row.receipt ? "receipt" : "envelope"}`;
       this.#dropped("not_found", env.id);
       return;
     }
-    if (row.request !== undefined && env.replyTo !== row.request) {
+    if (env.replyTo !== row.request) {
       this.#dropped("invalid_request", env.id);
       return;
     }
@@ -23152,9 +22899,6 @@ ${row.receipt ? "receipt" : "envelope"}`;
       onPeer: (machine, online) => this.#onPeer(machine, online),
       onState: (state) => this.#onState(state),
       ...this.#tuning.reconnect ? { reconnect: this.#tuning.reconnect } : {},
-      ...this.#config.transport?.direct ? { direct: this.#config.transport.direct } : {},
-      member: (machine) => this.#removed ? undefined : this.#realm?.device(machine),
-      presence: (machine) => this.#store.directoryRow(machine)?.presence,
       log: this.#log
     });
     this.#transport = transport;
@@ -23287,7 +23031,6 @@ ${row.receipt ? "receipt" : "envelope"}`;
       this.#stopRemoved();
       return;
     }
-    this.#transport?.rosterChanged?.();
     this.#sealedTo.clear();
     const gone = hosted ? "unknown_device" : "not_member";
     this.#tx(() => {
@@ -23739,6 +23482,8 @@ ${row.receipt ? "receipt" : "envelope"}`;
     let last = this.#store.getKv(DEVICE_NOTICES_KEY);
     if (last === undefined) {
       const admitted = changes.find((change) => change.device === me && change.change === "added");
+      if (!start && changes.length === 0)
+        return;
       if (start || admitted === undefined) {
         this.#store.setKv(DEVICE_NOTICES_KEY, String(head));
         return;
@@ -23938,7 +23683,7 @@ ${row.receipt ? "receipt" : "envelope"}`;
       throw new MessagingError("relay_unavailable", "config.json has no relay url");
     let result;
     await this.#append((roster) => {
-      const made = createInvite(roster, identity, { person: p.person, role: p.role ?? "member", ttlMs: p.ttlMs ?? DEFAULT_INVITE_TTL_MS, relay, now: this.#now() });
+      const made = createInvite(roster, identity, { person: p.person, ttlMs: p.ttlMs ?? DEFAULT_INVITE_TTL_MS, relay, now: this.#now() });
       result = { ticket: made.ticket, inviteId: made.entry.body.inviteId, expires: made.entry.body.expires };
       return made.entry;
     });
@@ -23958,8 +23703,8 @@ ${row.receipt ? "receipt" : "envelope"}`;
     const invites = roster.entries().flatMap((entry) => {
       if (entry.kind !== "invite.create")
         return [];
-      const { inviteId, person, role, expires } = entry.body;
-      return [{ inviteId, person, role, expires, state: roster.invite(inviteId, now)?.state ?? "expired" }];
+      const { inviteId, person, expires } = entry.body;
+      return [{ inviteId, person, expires, state: roster.invite(inviteId, now)?.state ?? "expired" }];
     });
     return { team: { id: roster.team, name: roster.name }, members, invites };
   }
@@ -23982,7 +23727,7 @@ ${row.receipt ? "receipt" : "envelope"}`;
   }
   async#teamAdd(p) {
     const { identity } = this.#admin();
-    await this.#append((roster) => createEntry(roster, identity, "member.add", { machine: p.machine, enc: p.enc, person: p.person, role: p.role ?? "member", label: p.label }, this.#now()));
+    await this.#append((roster) => createEntry(roster, identity, "member.add", { machine: p.machine, enc: p.enc, person: p.person, role: "member", label: p.label }, this.#now()));
     this.#log("info", "team.added", { machine: p.machine, person: p.person });
     return { ok: true };
   }
@@ -24099,7 +23844,7 @@ function chainPersons(sender, payload) {
 function peerRef(member, session) {
   return { address: formatAddress(member.person, session, member.label), person: member.person, agent: session, device: member.machine, label: member.label };
 }
-function provenanceOf3(env, sender, now, external) {
+function provenanceOf3(env, sender, now) {
   const session = env.from.agent;
   return {
     envelopeId: env.id,
@@ -24109,8 +23854,7 @@ function provenanceOf3(env, sender, now, external) {
     device: sender.machine,
     label: sender.label,
     verified: "signature",
-    receivedAt: now,
-    ...external !== undefined ? { external: { principal: external.principal, gateway: sender.machine } } : {}
+    receivedAt: now
   };
 }
 function withProvenance(message, provenance) {
@@ -24126,7 +23870,7 @@ function plaintextBytes(env) {
 }
 function requestOf(row) {
   if (row.request === undefined)
-    throw new MessagingError("invalid_state", "this task began before this version of messagingd; its updates cannot be sent");
+    throw new MessagingError("invalid_state", "this task has no request to answer");
   return row.request;
 }
 function recipientSession(env) {
@@ -24258,641 +24002,6 @@ var init_daemon = __esm(() => {
   DEFAULT_INVITE_TTL_MS = DAY3;
 });
 
-// packages/daemon/dist/direct-link.js
-import { createServer } from "http";
-import { WebSocket, WebSocketServer } from "ws";
-function unavailable2(message) {
-  return new MessagingError("relay_unavailable", message);
-}
-
-class Bucket {
-  capacity;
-  #tokens;
-  #at = Date.now();
-  constructor(capacity) {
-    this.capacity = capacity;
-    this.#tokens = capacity;
-  }
-  take(amount = 1) {
-    const now = Date.now();
-    this.#tokens = Math.min(this.capacity, this.#tokens + (now - this.#at) * this.capacity / 60000);
-    this.#at = now;
-    if (this.#tokens < amount)
-      return false;
-    this.#tokens -= amount;
-    return true;
-  }
-}
-
-class Link {
-  peer;
-  role;
-  #ws;
-  #tx;
-  #rx;
-  #owner;
-  #pending = new Map;
-  #deliveries = Promise.resolve();
-  #closed = false;
-  constructor(peer, role, ws, keys, owner) {
-    this.peer = peer;
-    this.role = role;
-    this.#ws = ws;
-    this.#owner = owner;
-    const other = role === "initiator" ? "responder" : "initiator";
-    this.#tx = new DirectCipher(keys.record[role]);
-    this.#rx = new DirectCipher(keys.record[other]);
-    ws.removeAllListeners("message");
-    ws.on("message", (data, isBinary) => {
-      try {
-        this.#onMessage(data, isBinary);
-      } catch {
-        this.close(DIRECT_CLOSE.protocolError);
-      }
-    });
-    ws.on("close", () => this.#onClose());
-  }
-  get open() {
-    return !this.#closed && this.#ws.readyState === WebSocket.OPEN;
-  }
-  send(env, ackMs) {
-    const existing = this.#pending.get(env.id);
-    if (existing)
-      return existing.promise;
-    if (!this.open)
-      return Promise.reject(unavailable2("direct link closed"));
-    const text = JSON.stringify({ t: "send", env });
-    if (Buffer.byteLength(text) > LIMITS.frameBytes)
-      return Promise.reject(new MessagingError("too_large", "envelope exceeds the frame limit"));
-    let entry;
-    const promise = new Promise((resolve, reject) => {
-      const timer = setTimeout(() => this.#settle(env.id, unavailable2("direct peer did not answer in time")), ackMs);
-      timer.unref();
-      entry = { resolve, reject, timer, promise: undefined };
-    });
-    entry.promise = promise;
-    this.#pending.set(env.id, entry);
-    this.#write({ t: "send", env }, text);
-    return promise;
-  }
-  close(code) {
-    if (this.#closed)
-      return;
-    this.#closed = true;
-    this.#failAll();
-    this.#ws.close(code);
-    setTimeout(() => this.#ws.terminate(), 2000).unref();
-  }
-  #onClose() {
-    this.#closed = true;
-    this.#failAll();
-    this.#owner.forget(this);
-  }
-  #failAll() {
-    for (const id of [...this.#pending.keys()])
-      this.#settle(id, unavailable2("direct link closed"));
-  }
-  #settle(id, error) {
-    const entry = this.#pending.get(id);
-    if (!entry)
-      return;
-    this.#pending.delete(id);
-    clearTimeout(entry.timer);
-    if (error)
-      entry.reject(error);
-    else
-      entry.resolve();
-  }
-  #write(record, text = JSON.stringify(record)) {
-    if (this.open)
-      this.#ws.send(this.#tx.seal(Buffer.from(text, "utf8")));
-  }
-  #onMessage(data, isBinary) {
-    if (this.#closed)
-      return;
-    if (!isBinary)
-      return this.close(DIRECT_CLOSE.protocolError);
-    if (!this.#owner.isMember(this.peer))
-      return this.close(DIRECT_CLOSE.notMember);
-    const bytes = bufferOf(data);
-    let raw;
-    try {
-      raw = parseWire(this.#rx.open(bytes).toString("utf8"), { maxBytes: LIMITS.frameBytes });
-    } catch {
-      return this.close(DIRECT_CLOSE.protocolError);
-    }
-    const within = this.#owner.withinRate(this.peer, bytes.length);
-    const parsed = DirectRecord.safeParse(raw);
-    if (!parsed.success) {
-      const id = raw?.env?.id;
-      if (raw?.t === "send" && Ulid.safeParse(id).success)
-        this.#write({ t: "nack", id, code: within ? "invalid_request" : "rate_limited" });
-      return;
-    }
-    const record = parsed.data;
-    if (record.t === "send")
-      return this.#onSend(raw.env, record.env, within);
-    if (!within)
-      return;
-    if (record.t === "ack")
-      this.#settle(record.id);
-    else
-      this.#settle(record.id, new MessagingError(record.code, "refused by the direct peer"));
-  }
-  #onSend(raw, env, within) {
-    const nack = (code) => this.#write({ t: "nack", id: env.id, code });
-    if (!within)
-      return nack("rate_limited");
-    if (env.from.device !== this.peer || env.to.device !== this.#owner.self || env.type === "presence")
-      return nack("invalid_request");
-    this.#deliveries = this.#deliveries.then(async () => {
-      try {
-        await this.#owner.deliver(raw);
-      } catch (error) {
-        return nack(error instanceof MessagingError ? error.code : "internal");
-      }
-      this.#write({ t: "ack", id: env.id });
-    });
-  }
-}
-
-class DirectLinks {
-  #options;
-  #limits;
-  #in = new Map;
-  #out = new Map;
-  #dials = new Map;
-  #rates = new Map;
-  #pendingByAddress = new Map;
-  #handshakes;
-  #sockets = new Set;
-  #dialing = new Set;
-  #pending = 0;
-  #server;
-  #wss;
-  #closed = false;
-  stats = { inbound: 0, outbound: 0, refused: 0, dialFailed: 0, delivered: 0 };
-  constructor(options) {
-    this.#options = options;
-    this.#limits = { ...DEFAULT_DIRECT_LIMITS, ...options.limits };
-    this.#handshakes = new Bucket(this.#limits.handshakesPerMinute);
-  }
-  get self() {
-    return this.#options.identity.machine;
-  }
-  isMember(machine) {
-    return machine !== this.self && this.#options.member(machine) !== undefined;
-  }
-  listen(host, port) {
-    if (this.#server)
-      return Promise.reject(new MessagingError("invalid_state", "already listening"));
-    const server = createServer((_req, res) => {
-      res.writeHead(426, { connection: "close" });
-      res.end();
-    });
-    server.headersTimeout = this.#limits.handshakeMs;
-    server.requestTimeout = this.#limits.handshakeMs;
-    server.maxConnections = this.#limits.pending + 256;
-    const wss = new WebSocketServer({ noServer: true, clientTracking: false, ...SOCKET_OPTIONS });
-    server.on("connection", (socket) => {
-      this.#sockets.add(socket);
-      socket.once("close", () => this.#sockets.delete(socket));
-    });
-    server.on("upgrade", (req, socket, head) => this.#upgrade(wss, req, socket, head));
-    this.#server = server;
-    this.#wss = wss;
-    return new Promise((resolve, reject) => {
-      server.once("error", reject);
-      server.listen({ host, port, exclusive: true }, () => {
-        server.off("error", reject);
-        server.on("error", () => {});
-        const bound = server.address();
-        if (bound === null || typeof bound === "string")
-          return reject(new MessagingError("internal", "listener has no address"));
-        resolve({ host: bound.address, port: bound.port });
-      });
-    });
-  }
-  async close() {
-    this.#closed = true;
-    for (const link of [...this.#in.values(), ...this.#out.values()])
-      link.close(1001);
-    for (const ws of this.#dialing)
-      ws.terminate();
-    this.#in.clear();
-    this.#out.clear();
-    const server = this.#server;
-    this.#server = undefined;
-    this.#wss?.close();
-    if (!server)
-      return;
-    await new Promise((resolve) => {
-      server.close(() => resolve());
-      for (const socket of this.#sockets)
-        socket.destroy();
-    });
-  }
-  hasLink(peer) {
-    return this.#linkTo(peer) !== undefined;
-  }
-  async send(peer, endpoints, env) {
-    if (this.#closed)
-      throw unavailable2("direct links are closed");
-    if (!this.isMember(peer))
-      throw new MessagingError("not_member", "not a current member");
-    let link = this.#linkTo(peer);
-    if (!link) {
-      if (endpoints.length === 0)
-        throw unavailable2("no direct link to this machine");
-      link = await this.#dialOnce(peer, endpoints);
-    }
-    await link.send(env, this.#limits.ackMs);
-  }
-  prune() {
-    for (const link of [...this.#in.values(), ...this.#out.values()])
-      if (!this.isMember(link.peer))
-        link.close(DIRECT_CLOSE.notMember);
-  }
-  forget(link) {
-    if (this.#in.get(link.peer) === link)
-      this.#in.delete(link.peer);
-    if (this.#out.get(link.peer) === link)
-      this.#out.delete(link.peer);
-  }
-  withinRate(peer, bytes) {
-    let rate = this.#rates.get(peer);
-    if (!rate) {
-      rate = { frames: new Bucket(this.#limits.framesPerMinute), bytes: new Bucket(this.#limits.bytesPerMinute) };
-      this.#rates.set(peer, rate);
-    }
-    return rate.frames.take() && rate.bytes.take(bytes);
-  }
-  async deliver(raw) {
-    await this.#options.onDeliver(raw);
-    this.stats.delivered++;
-  }
-  #linkTo(peer) {
-    for (const link of [this.#out.get(peer), this.#in.get(peer)])
-      if (link?.open)
-        return link;
-    return;
-  }
-  #upgrade(wss, req, socket, head) {
-    const address = req.socket.remoteAddress ?? "?";
-    const fromAddress = this.#pendingByAddress.get(address) ?? 0;
-    const path = new URL(req.url ?? "/", "http://direct").pathname;
-    if (this.#closed || path !== DIRECT_PATH || this.#pending >= this.#limits.pending || fromAddress >= this.#limits.pendingPerAddress || !this.#handshakes.take()) {
-      this.stats.refused++;
-      socket.destroy();
-      return;
-    }
-    this.#pending++;
-    this.#pendingByAddress.set(address, fromAddress + 1);
-    let released = false;
-    const release = () => {
-      if (released)
-        return;
-      released = true;
-      this.#pending--;
-      const left = (this.#pendingByAddress.get(address) ?? 1) - 1;
-      if (left > 0)
-        this.#pendingByAddress.set(address, left);
-      else
-        this.#pendingByAddress.delete(address);
-    };
-    const timer = setTimeout(() => {
-      release();
-      socket.destroy();
-    }, this.#limits.handshakeMs);
-    timer.unref();
-    socket.once("close", () => {
-      clearTimeout(timer);
-      release();
-    });
-    wss.handleUpgrade(req, socket, head, (ws) => this.#respond(ws, () => {
-      clearTimeout(timer);
-      release();
-    }));
-  }
-  #respond(ws, done) {
-    const { identity, team } = this.#options;
-    let state = { step: "hello" };
-    const refuse = () => {
-      state = { step: "done" };
-      this.stats.refused++;
-      done();
-      ws.close(DIRECT_CLOSE.authFailed);
-      setTimeout(() => ws.terminate(), 2000).unref();
-    };
-    ws.on("error", () => {});
-    ws.on("message", (data, isBinary) => {
-      try {
-        step(data, isBinary);
-      } catch {
-        if (state.step !== "done")
-          refuse();
-      }
-    });
-    ws.on("close", () => done());
-    const step = (data, isBinary) => {
-      if (state.step === "done")
-        return;
-      if (state.step === "hello") {
-        const hello = handshakeFrame(DirectHelloFrame, data, isBinary);
-        if (!hello)
-          return refuse();
-        const own = directEphemeral();
-        const transcript = directTranscript(hello, own.half);
-        let keys;
-        try {
-          keys = directKeys(own.key, hello.epk, transcript);
-        } catch {
-          return refuse();
-        }
-        const sig = sign(identity, DOMAIN.directAuth, directAuthPayload({ transcript, team, role: "responder", machine: identity.machine }));
-        state = { step: "auth", transcript, keys };
-        ws.send(JSON.stringify({ t: "accept", ...own.half, box: sealDirectBox(keys.box.responder, transcript, { team, machine: identity.machine, sig }) }));
-        return;
-      }
-      const { transcript, keys } = state;
-      const auth = handshakeFrame(DirectAuthFrame, data, isBinary);
-      const peer = auth && openIdentity(keys.box.initiator, transcript, auth.box);
-      if (!peer || peer.team !== team || !this.isMember(peer.machine))
-        return refuse();
-      const signed = directAuthPayload({ transcript, team, role: "initiator", machine: peer.machine, peer: identity.machine });
-      if (!verify(peer.machine, DOMAIN.directAuth, signed, peer.sig))
-        return refuse();
-      state = { step: "done" };
-      done();
-      if (this.#closed)
-        return void ws.close(1001);
-      const link = new Link(peer.machine, "responder", ws, keys, this);
-      this.#in.get(peer.machine)?.close(DIRECT_CLOSE.replaced);
-      this.#in.set(peer.machine, link);
-      this.stats.inbound++;
-    };
-  }
-  #dialOnce(peer, endpoints) {
-    let dial = this.#dials.get(peer);
-    if (!dial) {
-      dial = this.#dialAny(peer, endpoints).finally(() => this.#dials.delete(peer));
-      this.#dials.set(peer, dial);
-    }
-    return dial;
-  }
-  async#dialAny(peer, endpoints) {
-    let last;
-    for (const endpoint of endpoints) {
-      try {
-        const link = await this.#dial(peer, endpoint);
-        if (this.#closed) {
-          link.close(1001);
-          break;
-        }
-        this.#out.get(peer)?.close(1000);
-        this.#out.set(peer, link);
-        this.stats.outbound++;
-        return link;
-      } catch (error) {
-        last = error;
-      }
-    }
-    this.stats.dialFailed++;
-    throw last instanceof MessagingError ? last : unavailable2("could not reach the direct peer");
-  }
-  #dial(peer, endpoint) {
-    const { identity, team } = this.#options;
-    const host = endpoint.host.includes(":") ? `[${endpoint.host}]` : endpoint.host;
-    return new Promise((resolve, reject) => {
-      const ws = new WebSocket(`ws://${host}:${endpoint.port}${DIRECT_PATH}`, { ...SOCKET_OPTIONS, handshakeTimeout: this.#limits.dialMs, followRedirects: false });
-      this.#dialing.add(ws);
-      let settled = false;
-      const fail = (message) => {
-        if (settled)
-          return;
-        settled = true;
-        clearTimeout(timer);
-        this.#dialing.delete(ws);
-        ws.removeAllListeners("message");
-        if (ws.readyState === WebSocket.OPEN)
-          ws.close(DIRECT_CLOSE.authFailed);
-        else
-          ws.terminate();
-        reject(unavailable2(message));
-      };
-      const timer = setTimeout(() => fail("direct handshake timed out"), this.#limits.dialMs);
-      timer.unref();
-      const own = directEphemeral();
-      ws.on("error", () => fail("cannot reach the direct peer"));
-      ws.on("close", () => fail("the direct peer closed the link"));
-      ws.on("unexpected-response", () => fail("the direct peer refused the upgrade"));
-      ws.on("open", () => ws.send(JSON.stringify({ t: "hello", proto: DIRECT_PROTOCOL, ...own.half })));
-      ws.on("message", (data, isBinary) => {
-        try {
-          onAccept(data, isBinary);
-        } catch {
-          fail("bad handshake");
-        }
-      });
-      const onAccept = (data, isBinary) => {
-        if (settled)
-          return;
-        const accept = handshakeFrame(DirectAcceptFrame, data, isBinary);
-        if (!accept)
-          return fail("bad handshake frame");
-        const transcript = directTranscript(own.half, accept);
-        let keys;
-        try {
-          keys = directKeys(own.key, accept.epk, transcript);
-        } catch {
-          return fail("unusable handshake key");
-        }
-        const them = openIdentity(keys.box.responder, transcript, accept.box);
-        if (!them || them.team !== team || them.machine !== peer || !this.isMember(peer))
-          return fail("the direct peer is not the expected member");
-        if (!verify(peer, DOMAIN.directAuth, directAuthPayload({ transcript, team, role: "responder", machine: peer }), them.sig))
-          return fail("bad handshake signature");
-        const sig = sign(identity, DOMAIN.directAuth, directAuthPayload({ transcript, team, role: "initiator", machine: identity.machine, peer }));
-        ws.send(JSON.stringify({ t: "auth", box: sealDirectBox(keys.box.initiator, transcript, { team, machine: identity.machine, sig }) }));
-        settled = true;
-        clearTimeout(timer);
-        this.#dialing.delete(ws);
-        ws.removeAllListeners("close");
-        resolve(new Link(peer, "initiator", ws, keys, this));
-      };
-    });
-  }
-}
-function handshakeFrame(schema, data, isBinary) {
-  if (isBinary)
-    return;
-  const bytes = bufferOf(data);
-  if (bytes.length > DIRECT_HANDSHAKE_BYTES)
-    return;
-  try {
-    const parsed = schema.safeParse(parseWire(bytes.toString("utf8"), { maxBytes: DIRECT_HANDSHAKE_BYTES }));
-    return parsed.success ? parsed.data : undefined;
-  } catch {
-    return;
-  }
-}
-function openIdentity(key, transcript, box) {
-  try {
-    const parsed = DirectIdentity.safeParse(openDirectBox(key, transcript, box));
-    return parsed.success ? parsed.data : undefined;
-  } catch {
-    return;
-  }
-}
-function bufferOf(data) {
-  if (Buffer.isBuffer(data))
-    return data;
-  if (Array.isArray(data))
-    return Buffer.concat(data);
-  return Buffer.from(data);
-}
-var DIRECT_PATH = "/v1/direct", DIRECT_CLOSE, DEFAULT_DIRECT_LIMITS, RECORD_BYTES, SOCKET_OPTIONS;
-var init_direct_link = __esm(() => {
-  init_dist();
-  DIRECT_CLOSE = { authFailed: 4001, protocolError: 4002, notMember: 4003, replaced: 4004 };
-  DEFAULT_DIRECT_LIMITS = {
-    pending: 16,
-    pendingPerAddress: 4,
-    handshakeMs: 5000,
-    handshakesPerMinute: 120,
-    dialMs: 2000,
-    ackMs: 5000,
-    framesPerMinute: LIMITS.relayFramesPerMinute,
-    bytesPerMinute: LIMITS.relayBytesPerMinute
-  };
-  RECORD_BYTES = LIMITS.frameBytes + 16;
-  SOCKET_OPTIONS = { maxPayload: RECORD_BYTES, perMessageDeflate: false };
-});
-
-// packages/daemon/dist/direct-transport.js
-function withDirect(relay, tuning = {}) {
-  return (options) => options.direct?.enabled === true && options.team !== undefined ? new DirectTransport(relay, options, options.direct, tuning) : relay(options);
-}
-
-class DirectTransport {
-  #relay;
-  #links;
-  #options;
-  #config;
-  #listen;
-  #backoffMs;
-  #maxBackoffMs;
-  #backoff = new Map;
-  #advertised;
-  #running = false;
-  #counts = { direct: 0, relay: 0, fallback: 0 };
-  constructor(relay, options, config, tuning = {}) {
-    this.#options = options;
-    this.#config = config;
-    const listen = parseHostPort(config.listen ?? DEFAULT_DIRECT_LISTEN);
-    this.#listen = { host: listen.host, port: listen.port ?? 0 };
-    this.#backoffMs = tuning.backoffMs ?? 30000;
-    this.#maxBackoffMs = tuning.maxBackoffMs ?? 600000;
-    this.#links = new DirectLinks({
-      identity: options.identity,
-      team: options.team,
-      member: (machine) => options.member?.(machine),
-      onDeliver: (raw) => options.onDeliver(raw),
-      ...tuning.limits ? { limits: tuning.limits } : {}
-    });
-    this.#relay = relay(options);
-  }
-  start() {
-    if (this.#running)
-      return;
-    this.#running = true;
-    this.#links.listen(this.#listen.host, this.#listen.port).then((bound) => {
-      if (!this.#running)
-        return;
-      this.#advertised = advertisedEndpoints(this.#config, bound);
-      this.#options.log?.("info", "direct.listening", { host: bound.host, port: bound.port, advertised: this.#advertised.length });
-    }).catch((error) => this.#options.log?.("warn", "direct.listen.failed", { code: codeOf(error) })).finally(() => {
-      if (this.#running)
-        this.#relay.start();
-    });
-  }
-  async stop() {
-    this.#running = false;
-    this.#advertised = undefined;
-    await this.#links.close();
-    await this.#relay.stop();
-  }
-  get connected() {
-    return this.#relay.connected;
-  }
-  get stats() {
-    return { ...this.#links.stats, ...this.#counts };
-  }
-  async send(env) {
-    const to = this.#running && env.type !== "presence" && "device" in env.to ? env.to.device : undefined;
-    if (to !== undefined) {
-      const endpoints = this.#dialable(to);
-      if (endpoints.length > 0 || this.#links.hasLink(to)) {
-        try {
-          await this.#links.send(to, endpoints, env);
-          this.#backoff.delete(to);
-          this.#counts.direct++;
-          return;
-        } catch (error) {
-          this.#counts.fallback++;
-          this.#fail(to);
-          this.#options.log?.("info", "direct.fallback", { id: env.id, code: codeOf(error) });
-        }
-      }
-    }
-    await this.#relay.send(env);
-    this.#counts.relay++;
-  }
-  presence(env) {
-    this.#relay.presence(env);
-  }
-  retryNow() {
-    this.#relay.retryNow?.();
-  }
-  appendRoster(entry) {
-    return this.#relay.appendRoster(entry);
-  }
-  syncRoster(after) {
-    return this.#relay.syncRoster(after);
-  }
-  rosterChanged() {
-    this.#links.prune();
-  }
-  hasLink(machine) {
-    return this.#links.hasLink(machine);
-  }
-  advertise() {
-    const direct = this.#advertised;
-    return direct && direct.length > 0 ? { features: ["direct"], direct } : undefined;
-  }
-  #dialable(machine) {
-    const backoff = this.#backoff.get(machine);
-    if (backoff && Date.now() < backoff.until)
-      return [];
-    if (!this.#options.member?.(machine))
-      return [];
-    const presence = this.#options.presence?.(machine);
-    if (!presence?.features?.includes("direct") || !presence.direct)
-      return [];
-    return presence.direct.filter((endpoint) => mayDial(endpoint, isLoopback(this.#listen.host)));
-  }
-  #fail(machine) {
-    const prior = this.#backoff.get(machine);
-    const ms = prior ? Math.min(prior.ms * 2, this.#maxBackoffMs) : this.#backoffMs;
-    this.#backoff.set(machine, { until: Date.now() + ms, ms });
-  }
-}
-var init_direct_transport = __esm(() => {
-  init_direct_config();
-  init_direct_link();
-  init_log();
-});
-
 // packages/relay/dist/frames.js
 function text3(data) {
   if (Buffer.isBuffer(data))
@@ -24922,21 +24031,37 @@ var init_pages = __esm(() => {
   ROSTER_PAGE_BYTES = LIMITS.frameBytes - 4096;
   PAGE_CACHE_BYTES = 8 * MIB;
 });
+// packages/relay/dist/metrics.js
+var init_metrics = () => {};
+
 // packages/relay/dist/store.js
 var init_store3 = __esm(() => {
   init_dist();
+  init_metrics();
 });
 
+// packages/relay/dist/backoff.js
+function backoffDelay(attempt, minMs, maxMs, random = Math.random) {
+  const ceiling = Math.min(maxMs, minMs * 2 ** Math.min(attempt, 30));
+  return Math.round(ceiling / 2 + random() * (ceiling / 2));
+}
+
 // packages/relay/dist/directory/jelly.js
 var init_jelly4 = __esm(() => {
   init_dist();
 });
 
+// packages/relay/dist/directory/witness.js
+var init_witness = __esm(() => {
+  init_dist();
+});
+
 // packages/relay/dist/directory/directory.js
 var WARM_MAX_MS;
 var init_directory3 = __esm(() => {
   init_dist();
   init_jelly4();
+  init_witness();
   WARM_MAX_MS = 5 * 60000;
 });
 
@@ -24945,6 +24070,7 @@ var DAY_MS4 = 86400000, FEED_RETENTION_MS;
 var init_feed = __esm(() => {
   init_dist();
   init_jelly4();
+  init_store3();
   FEED_RETENTION_MS = 90 * DAY_MS4;
 });
 
@@ -24977,6 +24103,7 @@ var init_module = __esm(() => {
     "dir.sth",
     "dir.lookup",
     "dir.device",
+    "dir.heads",
     "dir.resolve",
     "dir.search",
     "dir.watch",
@@ -24993,7 +24120,7 @@ var init_store4 = __esm(() => {
 });
 
 // packages/relay/dist/server.js
-var HIGH_WATER, MAX_BUFFERED;
+var FRAME_TYPES, HIGH_WATER, MAX_BUFFERED;
 var init_server2 = __esm(() => {
   init_dist();
   init_frames();
@@ -25001,20 +24128,43 @@ var init_server2 = __esm(() => {
   init_limits();
   init_pages();
   init_store3();
+  init_metrics();
   init_module();
   init_store4();
+  FRAME_TYPES = new Set([
+    "challenge",
+    "hello",
+    "welcome",
+    "ping",
+    "pong",
+    "join",
+    "roster.append",
+    "roster.sync",
+    "roster",
+    "roster.ok",
+    "peer",
+    "send",
+    "presence",
+    "recv.ack",
+    "deliver",
+    "ack",
+    "nack",
+    "error",
+    "dir.ok",
+    "dir.persons",
+    "dir.headsAre",
+    "dir.sthIs",
+    "dir.resolved",
+    "dir.changed",
+    "dir.unbound",
+    ...DIRECTORY_FRAMES
+  ]);
   HIGH_WATER = 1024 * 1024;
   MAX_BUFFERED = 16 * 1024 * 1024;
 });
 
-// packages/relay/dist/backoff.js
-function backoffDelay(attempt, minMs, maxMs, random = Math.random) {
-  const ceiling = Math.min(maxMs, minMs * 2 ** Math.min(attempt, 30));
-  return Math.round(ceiling / 2 + random() * (ceiling / 2));
-}
-
 // packages/relay/dist/client.js
-import { WebSocket as WebSocket2 } from "ws";
+import { WebSocket } from "ws";
 
 class RelayClient {
   #options;
@@ -25071,7 +24221,7 @@ class RelayClient {
     if (!ws)
       return;
     await new Promise((resolve) => {
-      if (ws.readyState === WebSocket2.CLOSED)
+      if (ws.readyState === WebSocket.CLOSED)
         return resolve();
       const force = setTimeout(() => ws.terminate(), 2000);
       ws.once("close", () => {
@@ -25093,7 +24243,7 @@ class RelayClient {
       return existing.promise;
     const ws = this.#socket();
     if (!ws)
-      return Promise.reject(unavailable3("not connected to the relay"));
+      return Promise.reject(unavailable2("not connected to the relay"));
     const text = frameText({ t: "send", env });
     if (text instanceof MessagingError)
       return Promise.reject(text);
@@ -25124,6 +24274,9 @@ class RelayClient {
   dirSth(args = {}) {
     return this.#dir("dir.sthIs", { t: "dir.sth", ...args });
   }
+  dirHeads(persons, size) {
+    return this.#dir("dir.headsAre", { t: "dir.heads", persons, ...size !== undefined ? { size } : {} });
+  }
   dirLookup(persons, size) {
     return this.#dir("dir.persons", { t: "dir.lookup", persons, ...size !== undefined ? { size } : {} });
   }
@@ -25153,7 +24306,7 @@ class RelayClient {
       return Promise.reject(new MessagingError("invalid_request", "this relay link is not to a directory relay"));
     const ws = this.#socket();
     if (!ws)
-      return Promise.reject(unavailable3("not connected to the relay"));
+      return Promise.reject(unavailable2("not connected to the relay"));
     const req = `r${++this.#req}`;
     const text = frameText({ ...frame, req });
     if (text instanceof MessagingError)
@@ -25161,7 +24314,7 @@ class RelayClient {
     const timer = setTimeout(() => {
       const request = this.#dirRequests.get(req);
       this.#dirRequests.delete(req);
-      request?.pending.reject(unavailable3("relay did not answer in time"));
+      request?.pending.reject(unavailable2("relay did not answer in time"));
     }, REQUEST_MS);
     timer.unref();
     const pending = deferred();
@@ -25193,7 +24346,7 @@ class RelayClient {
     this.#helloSent = false;
     this.#error = undefined;
     this.#lastSeen = Date.now();
-    const ws = new WebSocket2(this.#options.url, SOCKET_OPTIONS2);
+    const ws = new WebSocket(this.#options.url, SOCKET_OPTIONS);
     this.#ws = ws;
     this.#welcomeTimer = setTimeout(() => {
       if (this.#ws !== ws || this.#connected)
@@ -25215,7 +24368,7 @@ class RelayClient {
     clearInterval(this.#pingTimer);
     clearTimeout(this.#welcomeTimer);
     this.#connected = false;
-    const lost = unavailable3("relay connection closed");
+    const lost = unavailable2("relay connection closed");
     for (const pending of this.#sends.values())
       pending.reject(lost);
     for (const request of [...this.#requests.values(), ...this.#dirRequests.values()]) {
@@ -25404,12 +24557,12 @@ ${id}`;
   #request(expect, frame) {
     const ws = this.#socket();
     if (!ws)
-      return Promise.reject(unavailable3("not connected to the relay"));
+      return Promise.reject(unavailable2("not connected to the relay"));
     const req = `r${++this.#req}`;
     const text = frameText({ ...frame, req });
     if (text instanceof MessagingError)
       return Promise.reject(text);
-    const timer = setTimeout(() => this.#take(req)?.pending.reject(unavailable3("relay did not answer in time")), REQUEST_MS);
+    const timer = setTimeout(() => this.#take(req)?.pending.reject(unavailable2("relay did not answer in time")), REQUEST_MS);
     timer.unref();
     const request = expect === "roster" ? { expect, pending: deferred(), timer } : { expect, pending: deferred(), timer };
     this.#requests.set(req, request);
@@ -25417,7 +24570,7 @@ ${id}`;
     return request.pending.promise;
   }
   #socket() {
-    return this.#connected && this.#ws?.readyState === WebSocket2.OPEN ? this.#ws : undefined;
+    return this.#connected && this.#ws?.readyState === WebSocket.OPEN ? this.#ws : undefined;
   }
 }
 function createTeamOnRelay(url, genesis) {
@@ -25444,7 +24597,7 @@ function directoryOneShot(url, frame, expect) {
     }
     let settled = false;
     let sent = false;
-    const ws = new WebSocket2(url, SOCKET_OPTIONS2);
+    const ws = new WebSocket(url, SOCKET_OPTIONS);
     const finish = (error, value) => {
       if (settled)
         return;
@@ -25456,7 +24609,7 @@ function directoryOneShot(url, frame, expect) {
       else
         resolve(value);
     };
-    const timer = setTimeout(() => finish(unavailable3("relay did not answer")), ONE_SHOT_MS);
+    const timer = setTimeout(() => finish(unavailable2("relay did not answer")), ONE_SHOT_MS);
     ws.on("message", (data, isBinary) => {
       if (isBinary)
         return;
@@ -25468,7 +24621,10 @@ function directoryOneShot(url, frame, expect) {
       }
       if (raw?.t === "challenge" && !sent) {
         sent = true;
-        const outgoing = frameText({ ...frame, req: "r1" }, LIMITS.preAuthFrameBytes);
+        if (typeof frame === "function" && raw.relay !== relayOrigin(url))
+          return finish(unavailable2("relay id does not match the relay URL origin"));
+        const body = typeof frame === "function" ? frame({ relay: String(raw.relay), nonce: String(raw.nonce) }) : frame;
+        const outgoing = frameText({ ...body, req: "r1" }, LIMITS.preAuthFrameBytes);
         if (outgoing instanceof MessagingError)
           return finish(outgoing);
         ws.send(outgoing);
@@ -25481,18 +24637,26 @@ function directoryOneShot(url, frame, expect) {
         }
       }
     });
-    ws.on("error", (error) => finish(unavailable3(`cannot reach the relay: ${error.message}`)));
-    ws.on("close", () => finish(unavailable3("relay closed the connection")));
+    ws.on("error", (error) => finish(unavailable2(`cannot reach the relay: ${error.message}`)));
+    ws.on("close", () => finish(unavailable2("relay closed the connection")));
   });
 }
 function sthOnRelay(url, args = {}) {
   return directoryOneShot(url, { t: "dir.sth", ...args }, "dir.sthIs");
 }
-function lookupOnRelay(url, persons, size) {
-  return directoryOneShot(url, { t: "dir.lookup", persons, ...size !== undefined ? { size } : {} }, "dir.persons");
+function lookupOnRelay(url, persons, size, identity, realm) {
+  return directoryOneShot(url, (challenge) => ({
+    t: "dir.lookup",
+    persons,
+    ...size !== undefined ? { size } : {},
+    proof: { device: identity.machine, sig: sign(identity, DOMAIN.dirRead, dirReadPayload({ relay: challenge.relay, realm, device: identity.machine, nonce: challenge.nonce })) }
+  }), "dir.persons");
+}
+function headsOnRelay(url, persons, size) {
+  return directoryOneShot(url, { t: "dir.heads", persons, ...size !== undefined ? { size } : {} }, "dir.headsAre");
 }
 function deviceOnRelay(url, device) {
-  return directoryOneShot(url, { t: "dir.device", device }, "dir.persons");
+  return directoryOneShot(url, { t: "dir.device", device }, "dir.headsAre");
 }
 function redeemOnRelay(url, entry) {
   return oneShot(url, { t: "roster.append", entry }, "roster.ok");
@@ -25510,7 +24674,7 @@ function fetchRosterAsMember(url, team, identity) {
     let welcomed = false;
     let req = 0;
     let page;
-    const ws = new WebSocket2(url, SOCKET_OPTIONS2);
+    const ws = new WebSocket(url, SOCKET_OPTIONS);
     const finish = (error, value) => {
       if (settled)
         return;
@@ -25526,7 +24690,7 @@ function fetchRosterAsMember(url, team, identity) {
       page?.pending.reject(error);
       finish(error);
     };
-    const timer = setTimeout(() => fail(unavailable3("relay did not answer")), ONE_SHOT_MS);
+    const timer = setTimeout(() => fail(unavailable2("relay did not answer")), ONE_SHOT_MS);
     const fetchPage = (after) => {
       const pending = deferred();
       const outgoing = frameText({ t: "roster.sync", req: `r${++req}`, after });
@@ -25575,8 +24739,8 @@ function fetchRosterAsMember(url, team, identity) {
         fail(new MessagingError(reply.code, reply.message));
       }
     });
-    ws.on("error", (error) => fail(unavailable3(`cannot reach the relay: ${error.message}`)));
-    ws.on("close", () => fail(unavailable3("relay closed the connection")));
+    ws.on("error", (error) => fail(unavailable2(`cannot reach the relay: ${error.message}`)));
+    ws.on("close", () => fail(unavailable2("relay closed the connection")));
   });
 }
 function oneShot(url, frame, expect) {
@@ -25590,7 +24754,7 @@ function oneShot(url, frame, expect) {
     const req = "r1";
     let settled = false;
     let sent = false;
-    const ws = new WebSocket2(url, SOCKET_OPTIONS2);
+    const ws = new WebSocket(url, SOCKET_OPTIONS);
     const finish = (error, value) => {
       if (settled)
         return;
@@ -25602,7 +24766,7 @@ function oneShot(url, frame, expect) {
       else
         resolve(value);
     };
-    const timer = setTimeout(() => finish(unavailable3("relay did not answer")), ONE_SHOT_MS);
+    const timer = setTimeout(() => finish(unavailable2("relay did not answer")), ONE_SHOT_MS);
     ws.on("message", (data, isBinary) => {
       if (isBinary)
         return;
@@ -25639,8 +24803,8 @@ function oneShot(url, frame, expect) {
         finish(new MessagingError(reply.code, reply.message));
       }
     });
-    ws.on("error", (error) => finish(unavailable3(`cannot reach the relay: ${error.message}`)));
-    ws.on("close", () => finish(unavailable3("relay closed the connection")));
+    ws.on("error", (error) => finish(unavailable2(`cannot reach the relay: ${error.message}`)));
+    ws.on("close", () => finish(unavailable2("relay closed the connection")));
   });
 }
 async function collectPages(after, pages, fetch2) {
@@ -25676,7 +24840,7 @@ function frameText(frame, limit = LIMITS.frameBytes) {
     return new MessagingError("too_large", `frame exceeds the relay's ${limit}-byte limit`);
   return json;
 }
-function unavailable3(message) {
+function unavailable2(message) {
   return new MessagingError("relay_unavailable", message);
 }
 function deferred() {
@@ -25694,12 +24858,12 @@ function callback(fn) {
     fn();
   } catch {}
 }
-var PING_MS = 20000, DEAD_MS, HANDSHAKE_MS = 1e4, WELCOME_MS = 15000, ONE_SHOT_MS = 15000, REQUEST_MS = 15000, MAX_PAGES = 256, SOCKET_OPTIONS2, RelayRefusal;
+var PING_MS = 20000, DEAD_MS, HANDSHAKE_MS = 1e4, WELCOME_MS = 15000, ONE_SHOT_MS = 15000, REQUEST_MS = 15000, MAX_PAGES = 256, SOCKET_OPTIONS, RelayRefusal;
 var init_client2 = __esm(() => {
   init_dist();
   init_frames();
   DEAD_MS = 2 * PING_MS + 5000;
-  SOCKET_OPTIONS2 = { maxPayload: LIMITS.frameBytes, perMessageDeflate: false, handshakeTimeout: HANDSHAKE_MS };
+  SOCKET_OPTIONS = { maxPayload: LIMITS.frameBytes, perMessageDeflate: false, handshakeTimeout: HANDSHAKE_MS };
   RelayRefusal = class RelayRefusal extends MessagingError {
     retryAfterMs;
     constructor(code, message, retryAfterMs) {
@@ -25839,11 +25003,21 @@ class RelayDirectoryLink {
   }
   async lookup(persons, size) {
     const asks = persons.map((p) => ({ person: p.person, ...p.knownSeq !== undefined ? { knownSeq: p.knownSeq } : {} }));
-    const reply = parse5(DirPersonsFrame, await this.#read((client) => client.dirLookup(asks, size), () => lookupOnRelay(this.#options.url, asks, size)));
+    const { url, identity, realm } = this.#options;
+    const own = this.#options.person();
+    const reply = parse5(DirPersonsFrame, await this.#read((client) => client.dirLookup(asks, size), () => lookupOnRelay(url, asks, size, identity, realm), asks.some((ask) => ask.person !== own)));
     return { sth: reply.sth, persons: reply.persons };
   }
-  async#read(authed, preAuth) {
-    const client = this.#connect();
+  async heads(persons, size) {
+    const reply = parse5(DirHeadsAreFrame, await this.#read((client) => client.dirHeads([...persons], size), () => headsOnRelay(this.#options.url, [...persons], size)));
+    return { sth: reply.sth, head: reply.head, persons: reply.persons };
+  }
+  async#read(authed, preAuth, wait = false) {
+    let client = this.#connect();
+    if (wait && client && !client.connected)
+      client = await this.#authed().catch(() => {
+        return;
+      });
     if (client?.connected) {
       try {
         return await authed(client);
@@ -25855,7 +25029,7 @@ class RelayDirectoryLink {
     return link(preAuth());
   }
   async device(device) {
-    const reply = parse5(DirPersonsFrame, await link(deviceOnRelay(this.#options.url, device)));
+    const reply = parse5(DirHeadsAreFrame, await link(deviceOnRelay(this.#options.url, device)));
     return { sth: reply.sth, persons: reply.persons };
   }
   async resolve(query) {
@@ -25945,18 +25119,15 @@ var init_relay_transport = __esm(() => {
 function startDaemon2(options) {
   return startDaemon({
     ...options,
-    transportFactory: options.transportFactory ?? withDirect(relayTransport),
+    transportFactory: options.transportFactory ?? relayTransport,
     relayOps: options.relayOps ?? relayOps,
     directoryLinkFactory: options.directoryLinkFactory ?? relayDirectoryLink
   });
 }
 var init_dist4 = __esm(() => {
   init_daemon();
-  init_direct_transport();
   init_relay_transport();
   init_relay_transport();
-  init_direct_transport();
-  init_direct_config();
   init_home();
   init_lock();
   init_log();
@@ -27273,7 +26444,7 @@ var devices = {
     "directory, removed ones last.",
     "link: on a new device Jelly does not enrol, shows its link request and a six-digit code (design \xA72.5).",
     "approve: on a device of yours that Jelly bound, shows what the link asks for, then approves it once you type",
-    "the code the new device shows. A device approved by link approves none. Removing devices is not in this CLI."
+    "the code the new device shows. A device approved by link approves none. To remove a device: messaging login --remove <device>."
   ].join(`
 `),
   options: {
@@ -27647,16 +26818,15 @@ async function showSignIn(ctx, started, open) {
     const { bold } = ctx.out.style;
     const lead = started.purpose === "remove" ? "To remove that device, sign in at Jelly ID:" : started.purpose === "replace" ? "To replace your old device, sign in at Jelly ID with this one:" : started.purpose === "erase" ? "To erase your account, sign in at Jelly ID:" : "To sign this device in, open:";
     ctx.out.line(lead);
-    ctx.out.line(`  ${started.verificationUriComplete}`);
-    ctx.out.line(`and check that the page shows the code ${bold(started.userCode)} and the key ${bold(started.fingerprint)}.`);
-    ctx.out.line(`(Or open ${started.verificationUri} and type the code.)`);
+    ctx.out.line(`  ${started.verificationUri}`);
+    ctx.out.line(`and type the code ${bold(started.userCode)} there. Approve only if the page shows this device's key ${bold(started.fingerprint)}.`);
   }
   if (open) {
-    const opened = await (ctx.io.openUrl ?? openInBrowser)(started.verificationUriComplete);
+    const opened = await (ctx.io.openUrl ?? openInBrowser)(started.verificationUri);
     if (!opened)
-      ctx.out.note("Could not open a browser here; open the link on any device.");
+      ctx.out.note("Could not open a browser here; open the page on any device and type the code.");
   } else if (!ctx.json && (ctx.io.env.SSH_CONNECTION !== undefined || ctx.io.env.SSH_TTY !== undefined)) {
-    ctx.out.note("Over SSH: open the link on your laptop or phone; the code ties it to this machine.");
+    ctx.out.note("Over SSH: open the page on your laptop or phone and type the code; the code ties it to this machine.");
   }
 }
 async function waitSignIn(ctx, client, started) {
@@ -27696,9 +26866,9 @@ var login = {
   summary: "Sign this device in to your account through the browser (hosted realm)",
   usage: "[--label <label>] [--kind laptop|server|other] [--open] [--no-wait] [--remove <device> [--reason removed|lost]]",
   details: [
-    "Prints a link to Jelly ID and a code. Open the link on any device (with --open, this machine's browser opens it),",
-    "check that the page shows the same code and key, and approve. This device then binds to your account: the first",
-    "device of your account, or one more. Over SSH, open the link on your laptop or phone.",
+    "Prints Jelly ID's page and a code. Open the page on any device (with --open, this machine's browser opens it),",
+    "type the code, check that the page shows the same key, and approve. This device then binds to your account: the",
+    "first device of your account, or one more. Over SSH, open the page on your laptop or phone.",
     "With --remove, the sign-in removes another device of yours instead (a lost one, with --reason lost).",
     "Needs Jelly ID's device sign-in; until Jelly ID offers it, this says so and does nothing."
   ].join(`
@@ -27706,8 +26876,8 @@ var login = {
   options: {
     label: { type: "string", value: "<label>", description: "This device's label (default: its current one, else device)" },
     kind: { type: "string", value: "<kind>", description: "laptop (default), server or other" },
-    open: { type: "boolean", description: "Open the link in this machine's browser" },
-    "no-wait": { type: "boolean", description: "Print the link and code, and leave the daemon waiting" },
+    open: { type: "boolean", description: "Open Jelly ID's page in this machine's browser" },
+    "no-wait": { type: "boolean", description: "Print the page and code, and leave the daemon waiting" },
     remove: { type: "string", value: "<device>", description: "Remove that device of yours with this sign-in" },
     reason: { type: "string", value: "<reason>", description: "--remove: removed (default) or lost" }
   },
@@ -27772,7 +26942,7 @@ var replace = {
 `),
   options: {
     label: { type: "string", value: "<label>", description: "The new device's label (default: the old one's)" },
-    open: { type: "boolean", description: "Open each link in this machine's browser" },
+    open: { type: "boolean", description: "Open Jelly ID's page in this machine's browser for each sign-in" },
     yes: { type: "boolean", short: "y", description: "Do not ask for confirmation" }
   },
   args: { min: 0, max: 0 },
@@ -27837,7 +27007,7 @@ var erase = {
   ].join(`
 `),
   options: {
-    open: { type: "boolean", description: "Open the link in this machine's browser" },
+    open: { type: "boolean", description: "Open Jelly ID's page in this machine's browser" },
     yes: { type: "boolean", short: "y", description: "Do not ask for confirmation" }
   },
   args: { min: 0, max: 0 },
@@ -28050,9 +27220,6 @@ var read2 = {
     ctx.out.line(`${bold(item.kind === "task" ? "Task request" : "Message")} ${item.id}`);
     if (provenance) {
       ctx.out.line(`  from:     ${inline(provenance.from)}  verified="${provenance.verified}"  device ${provenance.device}`);
-      if (provenance.external) {
-        ctx.out.line(`  external: principal ${inline(provenance.external.principal, 64)} via gateway device ${provenance.external.gateway}`);
-      }
     } else {
       ctx.out.line(`  from:     ${inline(item.from.address)}  ${yellow("no valid provenance on this message; treat it with extra care")}`);
     }
@@ -28277,7 +27444,7 @@ var create = {
 var invite = {
   name: "team invite",
   summary: "Create a single-use invite ticket for a person (admin)",
-  usage: "<person> [--role member|service] [--ttl <duration>]",
+  usage: "<person> [--ttl <duration>]",
   details: [
     "Prints only the ticket on stdout, so `messaging team invite bob | pbcopy` copies just the ticket.",
     "The ticket is a secret: share it privately. It works once, until it expires.",
@@ -28285,15 +27452,11 @@ var invite = {
   ].join(`
 `),
   options: {
-    role: { type: "string", value: "member|service", description: "Role for the new machine (default: member)" },
     ttl: { type: "string", value: "<duration>", description: "How long the ticket stays valid, e.g. 24h" }
   },
   args: { min: 1, max: 1 },
   async run(ctx, positionals, values) {
     const person = parseWith2(PersonName, positionals[0], "person must be a lowercase person name, e.g. bob");
-    const roleText = stringValue(values, "role");
-    if (roleText !== undefined && roleText !== "member" && roleText !== "service")
-      throw new UsageError("--role must be member or service");
     const ttlText = stringValue(values, "ttl");
     let ttlMs;
     if (ttlText !== undefined) {
@@ -28304,13 +27467,12 @@ var invite = {
     const client = await ctx.client();
     const result = await client.call("team.invite", {
       person,
-      ...roleText !== undefined ? { role: roleText } : {},
       ...ttlMs !== undefined ? { ttlMs } : {}
     });
     if (ctx.json) {
       ctx.out.json(result);
     } else {
-      ctx.out.note(`Invite ${result.inviteId} for ${person} (${roleText ?? "member"}), expires ${iso2(result.expires)} (${until(result.expires, ctx.now())}).`);
+      ctx.out.note(`Invite ${result.inviteId} for ${person}, expires ${iso2(result.expires)} (${until(result.expires, ctx.now())}).`);
       ctx.out.line(result.ticket);
     }
     ctx.out.warn(`this ticket is a secret. Share it privately with ${person}, never in a public channel or a shared log.`);
@@ -28369,7 +27531,7 @@ var members2 = {
       const now = ctx.now();
       ctx.out.line();
       ctx.out.line(`Invites (${result.invites.length})`);
-      ctx.out.lines(table(["INVITE", "PERSON", "ROLE", "STATE", "EXPIRES"], result.invites.map((i) => [i.inviteId, i.person, i.role, i.state, i.state === "open" ? until(i.expires, now) : iso2(i.expires)]), style));
+      ctx.out.lines(table(["INVITE", "PERSON", "STATE", "EXPIRES"], result.invites.map((i) => [i.inviteId, i.person, i.state, i.state === "open" ? until(i.expires, now) : iso2(i.expires)]), style));
     }
   }
 };
@@ -28431,10 +27593,10 @@ var remove = {
 var role = {
   name: "team role",
   summary: "Change a member's role (admin)",
-  usage: "<machine|person/label> <admin|member|service>",
+  usage: "<machine|person/label> <admin|member>",
   args: { min: 2, max: 2 },
   async run(ctx, positionals) {
-    const newRole = parseWith2(MemberRole, positionals[1], "role must be admin, member or service");
+    const newRole = parseWith2(MemberRole, positionals[1], "role must be admin or member");
     const { member } = await resolveMember(ctx, positionals[0]);
     const client = await ctx.client();
     const result = await client.call("team.role", { machine: member.machine, role: newRole });
@@ -28482,17 +27644,13 @@ var card2 = {
 var add = {
   name: "team add",
   summary: "Admit a machine by its public admit card (admin)",
-  usage: "<card|-> [--role member|service] [--yes]",
+  usage: "<card|-> [--yes]",
   details: "Pass `-` to read the card from stdin (then pass --yes). The card has public keys only. You are admitting that exact machine. Asks for confirmation unless --yes.",
   options: {
-    role: { type: "string", value: "member|service", description: "Role for the new machine (default: member)" },
     yes: { type: "boolean", short: "y", description: "Do not ask for confirmation" }
   },
   args: { min: 1, max: 1 },
   async run(ctx, positionals, values) {
-    const roleText = stringValue(values, "role");
-    if (roleText !== undefined && roleText !== "member" && roleText !== "service")
-      throw new UsageError("--role must be member or service");
     const fromStdin = positionals[0] === "-";
     const text = (fromStdin ? await readAll(ctx.io.stdin, 8192) : positionals[0]).trim();
     const card = decodeAdmitCard(text);
@@ -28509,8 +27667,7 @@ var add = {
       machine: card.machine,
       enc: card.enc,
       person: card.person,
-      label: card.label,
-      ...roleText !== undefined ? { role: roleText } : {}
+      label: card.label
     });
     if (ctx.json)
       ctx.out.json({ ok: true, person: card.person, label: card.label, machine: card.machine });
@@ -28872,6 +28029,37 @@ function cliMain(argv, start) {
 // packages/daemon/dist/bin/daemon-main.js
 init_dist2();
 import { resolve as resolve4 } from "path";
+
+// packages/daemon/dist/bin/fatal.js
+import { writeSync as writeSync2 } from "fs";
+var sink;
+function setFatalLog(log) {
+  sink = log;
+}
+function installFatalPolicy(name) {
+  const fatal = (origin) => (error) => {
+    const fields = { origin, error: error instanceof Error ? error.name : typeof error, ...frameOf(error) };
+    try {
+      sink?.("error", "daemon.fatal", fields);
+    } catch {}
+    const frames = error instanceof Error ? error.stack?.split(`
+`).slice(1).join(`
+`) ?? "" : "";
+    writeSync2(2, `${name}: fatal ${fields.origin}: ${fields.error}
+${frames}
+`);
+    process.exit(70);
+  };
+  process.on("uncaughtException", fatal("uncaughtException"));
+  process.on("unhandledRejection", fatal("unhandledRejection"));
+}
+function frameOf(error) {
+  const frame = error instanceof Error ? error.stack?.split(`
+`).find((line) => line.trimStart().startsWith("at ")) : undefined;
+  return frame ? { at: frame.trim().slice(3, 240) } : {};
+}
+
+// packages/daemon/dist/bin/daemon-main.js
 var USAGE = `usage: messagingd [--home <dir>]
        messagingd --deployment jelly --home <dir> --act-key <path> --label <label>
                   [--kind jelly-host] [--run <dir>] [--socket-group <gid>]
@@ -29002,6 +28190,7 @@ ${USAGE}`);
     stderr: process.stderr.isTTY === true,
     level: level === "debug" || level === "warn" || level === "error" ? level : "info"
   });
+  setFatalLog(log);
   let daemon;
   try {
     const jellyHost = fromEnv ? {
@@ -29072,6 +28261,8 @@ function filterSqliteWarning() {
 // packages/daemon/dist/bin/standalone.js
 filterSqliteWarning();
 var { mode, args } = dispatch(process.argv0, process.argv.slice(2));
+if (mode !== "cli")
+  installFatalPolicy("messagingd");
 var done = mode === "cli" ? cliMain(args, { daemonCommand: [process.execPath] }) : daemonMain(args);
 done.then((code) => {
   process.exitCode = code;