@koed-labs/server 0.0.0-bootstrap.0 → 0.10.3

package/vendor/chunk-J2L726BC.js

@@ -0,0 +1,2497 @@
+import { createRequire as createKoedRequire } from "node:module"; const require = createKoedRequire(import.meta.url);
+import {
+  runApplicationSecretProvider
+} from "./chunk-2S3OGPUC.js";
+import {
+  ensureDeviceIdentity
+} from "./chunk-XNFVSVBS.js";
+import {
+  loadRepoEnv,
+  resolveApiUrl
+} from "./chunk-W2HNI6AA.js";
+import {
+  PDS_PROTOCOL,
+  canonicalizePdsJson,
+  createPdsAuthorizedKeyBundle,
+  createPdsSessionPackageRuntimeContext,
+  decryptPdsKeyBundleSecretSet,
+  isLoopbackHostname,
+  isPrivateNetworkIpv4Address,
+  parseCanonicalPdsJson,
+  pdsEd25519PrivateKey,
+  pdsPublicKeyCommitment,
+  pdsRepositoryKeyHistorySchema,
+  pdsSha256,
+  readDesktopLocalCredentialAuthorization,
+  signPdsGroupDraft,
+  signPdsRecord,
+  validatePdsGroupStatement,
+  validatePdsKeyBundle
+} from "./chunk-473OA62O.js";
+
+// packages/koed-server/dist/personal-sync.js
+import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, createHash as createHash2, generateKeyPairSync, randomBytes as randomBytes2, randomUUID as randomUUID2, scryptSync, sign } from "node:crypto";
+import { spawn } from "node:child_process";
+import { closeSync, existsSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+
+// packages/koed-server/dist/personal-device-pairing-client.js
+import { createCipheriv, createDecipheriv, createHash, hkdfSync, randomBytes, randomUUID } from "node:crypto";
+var isPersonalDevicePairingUuid = (value) => typeof value === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(value);
+var PERSONAL_DEVICE_PAIRING_PROTOCOL = "koed/pds-lan-pair/v1";
+var MAX_PLAINTEXT_BYTES = 256 * 1024;
+var MAX_RESPONSE_BYTES = 1048576;
+var COMPLETION_ATTEMPTS = 3;
+var AmbiguousTransportFailure = class extends Error {
+  originalError;
+  constructor(originalError) {
+    super("Pairing exchange transport failed.");
+    this.name = "AmbiguousTransportFailure";
+    this.originalError = originalError;
+  }
+};
+var exactKeys = (value, expected) => {
+  const actual = Object.keys(value).sort();
+  const sortedExpected = [...expected].sort();
+  return actual.length === sortedExpected.length && actual.every((key, index) => key === sortedExpected[index]);
+};
+var strictBase64url = (value, bytes) => {
+  if (typeof value !== "string" || !/^[A-Za-z0-9_-]+$/.test(value)) {
+    throw new Error("Pairing message is invalid.");
+  }
+  const decoded = Buffer.from(value, "base64url");
+  if (bytes !== void 0 && decoded.length !== bytes || decoded.toString("base64url") !== value) {
+    throw new Error("Pairing message is invalid.");
+  }
+  return decoded;
+};
+var pairingKey = (invitationId, token) => {
+  if (!isPersonalDevicePairingUuid(invitationId) || !/^[A-Za-z0-9_-]{43}$/.test(token)) {
+    throw new Error("Pairing credentials are invalid.");
+  }
+  const tokenBytes = strictBase64url(token, 32);
+  const salt = createHash("sha256").update(`${PERSONAL_DEVICE_PAIRING_PROTOCOL}\0${invitationId}`, "utf8").digest();
+  return Buffer.from(hkdfSync("sha256", tokenBytes, salt, Buffer.from(`${PERSONAL_DEVICE_PAIRING_PROTOCOL}/transport-key`, "utf8"), 32));
+};
+var additionalData = (direction, invitationId, messageId) => Buffer.from(`${PERSONAL_DEVICE_PAIRING_PROTOCOL}/${direction}
+${invitationId}
+${messageId}`, "utf8");
+var parseEnvelope = (value) => {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("Pairing message is invalid.");
+  }
+  const envelope = value;
+  if (!exactKeys(envelope, [
+    "protocol",
+    "message_id",
+    "nonce",
+    "ciphertext",
+    "tag"
+  ]) || envelope.protocol !== PERSONAL_DEVICE_PAIRING_PROTOCOL || !isPersonalDevicePairingUuid(envelope.message_id)) {
+    throw new Error("Pairing message is invalid.");
+  }
+  strictBase64url(envelope.nonce, 12);
+  strictBase64url(envelope.tag, 16);
+  const ciphertext = strictBase64url(envelope.ciphertext);
+  if (ciphertext.length > MAX_PLAINTEXT_BYTES) {
+    throw new Error("Pairing message is too large.");
+  }
+  return envelope;
+};
+var encrypt = (input, options) => {
+  const plaintext = Buffer.from(JSON.stringify(input), "utf8");
+  if (plaintext.length === 0 || plaintext.length > MAX_PLAINTEXT_BYTES) {
+    throw new Error("Pairing message is too large.");
+  }
+  const messageId = randomUUID();
+  const nonce = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", pairingKey(options.invitationId, options.token), nonce);
+  cipher.setAAD(additionalData(options.direction, options.invitationId, messageId));
+  const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+  return {
+    protocol: PERSONAL_DEVICE_PAIRING_PROTOCOL,
+    message_id: messageId,
+    nonce: nonce.toString("base64url"),
+    ciphertext: ciphertext.toString("base64url"),
+    tag: cipher.getAuthTag().toString("base64url")
+  };
+};
+var decrypt = (input, options) => {
+  const envelope = parseEnvelope(input);
+  try {
+    const decipher = createDecipheriv("aes-256-gcm", pairingKey(options.invitationId, options.token), strictBase64url(envelope.nonce, 12));
+    decipher.setAAD(additionalData(options.direction, options.invitationId, envelope.message_id));
+    decipher.setAuthTag(strictBase64url(envelope.tag, 16));
+    const plaintext = Buffer.concat([
+      decipher.update(strictBase64url(envelope.ciphertext)),
+      decipher.final()
+    ]);
+    if (plaintext.length === 0 || plaintext.length > MAX_PLAINTEXT_BYTES) {
+      throw new Error("Pairing message is too large.");
+    }
+    const value = JSON.parse(plaintext.toString("utf8"));
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+      throw new Error("Pairing message is invalid.");
+    }
+    return {
+      messageId: envelope.message_id,
+      value
+    };
+  } catch {
+    throw new Error("Pairing message authentication failed.");
+  }
+};
+var parseLink = (value) => {
+  if (typeof value !== "string" || value.length > 4096) {
+    throw new Error("Pairing link is invalid.");
+  }
+  const normalized = value.trim();
+  const match = /^http:\/\/([^/:?#]+):([1-9][0-9]{0,4})(\/pair\/([0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}))#token=([A-Za-z0-9_-]{43})$/.exec(normalized);
+  if (!match)
+    throw new Error("Pairing link is invalid.");
+  let url;
+  try {
+    url = new URL(normalized);
+  } catch {
+    throw new Error("Pairing link is invalid.");
+  }
+  if (match[1] !== url.hostname || !isPrivateNetworkIpv4Address(url.hostname) || url.protocol !== "http:" || url.username || url.password || url.search || url.pathname !== match[3] || url.hash !== `#token=${match[5]}`) {
+    throw new Error("Same-network pairing requires a private-network or Tailscale link issued by Koed.");
+  }
+  return {
+    invitationUrl: url,
+    invitationId: match[4],
+    token: match[5]
+  };
+};
+var parseLoopbackOrigin = (value) => {
+  if (typeof value !== "string" || value.length > 2048) {
+    throw new Error("Local control URL must be an exact loopback origin.");
+  }
+  let url;
+  try {
+    url = new URL(value.trim());
+  } catch {
+    throw new Error("Local control URL must be an exact loopback origin.");
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:" || !isLoopbackHostname(url.hostname) || url.username || url.password || url.pathname !== "/" || url.search || url.hash) {
+    throw new Error("Local control URL must be an exact loopback origin.");
+  }
+  return url.origin;
+};
+var readBoundedResponseText = async (response, classifyAmbiguousTransportFailure = false) => {
+  const rawContentLength = response.headers.get("content-length");
+  let declaredLength;
+  if (rawContentLength !== null) {
+    const contentLength = rawContentLength.trim();
+    if (!/^\d+$/.test(contentLength)) {
+      await response.body?.cancel().catch(() => void 0);
+      throw new Error("Pairing response is invalid.");
+    }
+    declaredLength = Number(contentLength);
+    if (!Number.isSafeInteger(declaredLength)) {
+      await response.body?.cancel().catch(() => void 0);
+      throw new Error("Pairing response is invalid.");
+    }
+    if (declaredLength > MAX_RESPONSE_BYTES) {
+      await response.body?.cancel().catch(() => void 0);
+      throw new Error("Pairing response exceeds maximum size.");
+    }
+  }
+  if (!response.body) {
+    if (classifyAmbiguousTransportFailure && declaredLength !== 0) {
+      throw new AmbiguousTransportFailure(new Error("Pairing response body was dropped."));
+    }
+    return "";
+  }
+  const reader = response.body.getReader();
+  const chunks = [];
+  let bytes = 0;
+  let overflow = false;
+  try {
+    while (true) {
+      const next = await reader.read();
+      if (next.done)
+        break;
+      if (next.value.byteLength > MAX_RESPONSE_BYTES - bytes) {
+        overflow = true;
+        await reader.cancel().catch(() => void 0);
+        throw new Error("Pairing response exceeds maximum size.");
+      }
+      bytes += next.value.byteLength;
+      chunks.push(next.value);
+    }
+  } catch (error) {
+    if (!overflow)
+      await reader.cancel().catch(() => void 0);
+    if (overflow || !classifyAmbiguousTransportFailure)
+      throw error;
+    throw new AmbiguousTransportFailure(error);
+  } finally {
+    reader.releaseLock();
+  }
+  if (declaredLength !== void 0 && bytes !== declaredLength) {
+    if (bytes < declaredLength && classifyAmbiguousTransportFailure) {
+      throw new AmbiguousTransportFailure(new Error("Pairing response body was truncated."));
+    }
+    throw new Error("Pairing response is invalid.");
+  }
+  if (bytes === 0 && classifyAmbiguousTransportFailure && declaredLength !== 0) {
+    throw new AmbiguousTransportFailure(new Error("Pairing response body was dropped."));
+  }
+  return Buffer.concat(chunks, bytes).toString("utf8");
+};
+var isTruncatedJson = (text, error) => {
+  const trimmed = text.trim();
+  if (!(error instanceof SyntaxError) || !trimmed.startsWith("{") && !trimmed.startsWith("[")) {
+    return false;
+  }
+  if (/unexpected end|unterminated string/i.test(error.message))
+    return true;
+  const position = /position (\d+)/i.exec(error.message)?.[1];
+  return position !== void 0 && Number(position) >= text.length;
+};
+var responseJson = async (response, classifyAmbiguousTransportFailure = false) => {
+  const text = await readBoundedResponseText(response, classifyAmbiguousTransportFailure && response.ok);
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch (error) {
+    if (classifyAmbiguousTransportFailure && response.ok && isTruncatedJson(text, error)) {
+      throw new AmbiguousTransportFailure(error);
+    }
+    throw new Error("Pairing response is invalid.", { cause: error });
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("Pairing response is invalid.");
+  }
+  if (!response.ok) {
+    const error = value;
+    throw new Error(typeof error.error === "string" ? error.error : "Pairing exchange failed.");
+  }
+  return value;
+};
+var redeemPersonalDevicePairing = async (options) => {
+  const { invitationUrl, invitationId, token } = parseLink(options.link);
+  const fetcher = options.fetch ?? globalThis.fetch;
+  if (!fetcher)
+    throw new Error("Pairing network access is unavailable.");
+  const exchange = async (payload, timeoutMs = 1e4, classifyTransportFailure = false) => {
+    const encrypted = encrypt(payload, {
+      invitationId,
+      token,
+      direction: "request"
+    });
+    let response;
+    try {
+      response = await fetcher(new URL(`/v1/pair/${invitationId}/exchange`, invitationUrl.origin), {
+        method: "POST",
+        headers: {
+          accept: "application/json",
+          "content-type": "application/json"
+        },
+        body: JSON.stringify(encrypted),
+        redirect: "error",
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+    } catch (error) {
+      if (classifyTransportFailure)
+        throw new AmbiguousTransportFailure(error);
+      throw error;
+    }
+    const decrypted = decrypt(await responseJson(response, classifyTransportFailure), {
+      invitationId,
+      token,
+      direction: "response"
+    });
+    if (decrypted.messageId !== encrypted.message_id) {
+      throw new Error("Pairing response binding is invalid.");
+    }
+    return decrypted.value;
+  };
+  const invitationResponse = await exchange({ operation: "invitation" });
+  const invitation = invitationResponse.invitation;
+  if (!invitation || typeof invitation !== "object" || Array.isArray(invitation)) {
+    throw new Error("Pairing invitation is invalid.");
+  }
+  const typedInvitation = invitation;
+  const controlUrl = new URL(typedInvitation.control_url);
+  const relayUrl = new URL(typedInvitation.relay_url);
+  if (typedInvitation.protocol !== PERSONAL_DEVICE_PAIRING_PROTOCOL || controlUrl.origin !== invitationUrl.origin || controlUrl.pathname !== `/v1/pair/${invitationId}/exchange` || relayUrl.origin !== invitationUrl.origin || relayUrl.pathname !== "/pds") {
+    throw new Error("Pairing invitation endpoint binding is invalid.");
+  }
+  const controlFetch = (async (input, init) => {
+    const requestedUrl = new URL(input instanceof URL ? input.toString() : typeof input === "string" ? input : input.url);
+    const prefix = controlUrl.toString().replace(/\/$/, "");
+    if (requestedUrl.origin !== controlUrl.origin || !requestedUrl.toString().startsWith(`${prefix}/`)) {
+      throw new Error("Pairing control request escaped its invitation.");
+    }
+    const method = init?.method ?? (input instanceof Request ? input.method : "GET");
+    if (method !== "GET" && method !== "POST")
+      throw new Error("Pairing control method is invalid.");
+    const body = init?.body === void 0 ? void 0 : typeof init.body === "string" ? init.body : (() => {
+      throw new Error("Pairing control body is invalid.");
+    })();
+    const headers = new Headers(init?.headers);
+    const result = await exchange({
+      operation: "control",
+      method,
+      path: requestedUrl.toString().slice(prefix.length),
+      headers: Object.fromEntries(["accept", "content-type"].flatMap((name) => {
+        const value = headers.get(name);
+        return value ? [[name, value]] : [];
+      })),
+      ...body === void 0 ? {} : { body }
+    }, 1e4);
+    if (typeof result.status !== "number" || typeof result.body !== "string") {
+      throw new Error("Pairing control response is invalid.");
+    }
+    return new Response(result.body, {
+      status: result.status,
+      headers: result.headers && typeof result.headers === "object" && !Array.isArray(result.headers) ? result.headers : { "content-type": "application/json; charset=utf-8" }
+    });
+  });
+  const join = await options.withJsonFd(typedInvitation, async (fd) => await options.runPersonalSync([
+    "join",
+    "request",
+    "--group-id",
+    typedInvitation.group_id,
+    "--invitation-fd",
+    String(fd)
+  ], {
+    environment: {
+      ...options.environment,
+      PDS_CONTROL_URL: controlUrl.toString(),
+      PDS_RUNTIME_SECRET_REF: options.environment.PDS_RUNTIME_SECRET_REF?.trim() || "pds-runtime"
+    },
+    pairingToken: token,
+    fetch: controlFetch
+  }));
+  const request = join.request;
+  if (!request || typeof request !== "object" || Array.isArray(request)) {
+    throw new Error("Koed could not create the signed pairing request.");
+  }
+  const joinPairing = join.pairing;
+  if (!joinPairing || typeof joinPairing !== "object" || Array.isArray(joinPairing) || joinPairing.challengeId !== typedInvitation.challenge_id) {
+    throw new Error("Koed could not verify the pairing challenge binding.");
+  }
+  const submitted = await exchange({
+    operation: "request",
+    request,
+    device_label: options.deviceLabel.trim().slice(0, 80) || "SSH device"
+  }, 10 * 60 * 1e3);
+  if (submitted.approved !== true)
+    throw new Error("Pairing approval was not completed.");
+  const completed = await options.runPersonalSync([
+    "join",
+    "complete",
+    "--group-id",
+    typedInvitation.group_id,
+    "--challenge-id",
+    typedInvitation.challenge_id
+  ], {
+    environment: {
+      ...options.environment,
+      PDS_CONTROL_URL: controlUrl.toString(),
+      PDS_RUNTIME_SECRET_REF: options.environment.PDS_RUNTIME_SECRET_REF?.trim() || "pds-runtime"
+    },
+    pairingToken: token,
+    fetch: controlFetch
+  });
+  const reconciliation = completed.localGroupReconciliation;
+  if (!reconciliation || typeof reconciliation !== "object" || Array.isArray(reconciliation)) {
+    throw new Error("Koed could not verify the joining device's local sync state.");
+  }
+  const localCredential = readDesktopLocalCredentialAuthorization(options.koedHome);
+  if (!localCredential) {
+    throw new Error("Koed local Desktop credential is unavailable for SSH enrollment.");
+  }
+  const localRequest = async (path, body) => {
+    const localOrigin = parseLoopbackOrigin(options.localControlUrl);
+    const response = await fetcher(new URL(path, `${localOrigin}/`), {
+      method: "POST",
+      headers: {
+        accept: "application/json",
+        authorization: localCredential.authorization,
+        ...body ? { "content-type": "application/json" } : {}
+      },
+      ...body ? { body: JSON.stringify(body) } : {},
+      redirect: "error",
+      signal: AbortSignal.timeout(3e4)
+    });
+    return await responseJson(response);
+  };
+  const localGroup = await localRequest("/v1/personal-device-sync/local-group-reconciliation", reconciliation);
+  const localUserId = localGroup.local_user_id;
+  if (typeof localUserId !== "string")
+    throw new Error("Local Personal identity binding failed.");
+  await options.runPersonalSync([
+    "join",
+    "bind-local-user",
+    "--group-id",
+    typedInvitation.group_id,
+    "--user-id",
+    localUserId,
+    "--challenge-id",
+    typedInvitation.challenge_id
+  ], {
+    environment: {
+      ...options.environment,
+      PDS_CONTROL_URL: controlUrl.toString(),
+      PDS_RUNTIME_SECRET_REF: options.environment.PDS_RUNTIME_SECRET_REF?.trim() || "pds-runtime"
+    },
+    pairingToken: token,
+    fetch: controlFetch
+  });
+  await localRequest("/v1/personal-device-sync/local-runtime-wake");
+  let completion;
+  for (let attempt = 0; attempt < COMPLETION_ATTEMPTS; attempt += 1) {
+    try {
+      completion = await exchange({ operation: "complete" }, 1e4, true);
+      break;
+    } catch (error) {
+      if (!(error instanceof AmbiguousTransportFailure))
+        throw error;
+      if (attempt === COMPLETION_ATTEMPTS - 1)
+        throw error.originalError;
+    }
+  }
+  if (!completion || completion.completed !== true) {
+    throw new Error("Pairing invitation was not closed after enrollment.");
+  }
+  const publicResult = { ...completed };
+  delete publicResult.localGroupReconciliation;
+  return publicResult;
+};
+
+// packages/koed-server/dist/personal-sync.js
+var KIT_FORMAT = "koed/pds-recovery-kit/v1";
+var PENDING_VERSION = 1;
+var MAX_PASSWORD_BYTES = 4096;
+var MAX_CONTROL_RESPONSE_BYTES = 1048576;
+var MAX_PENDING_REQUESTS = 32;
+var fail = (message) => {
+  throw new Error(message);
+};
+var strictString = (value) => typeof value === "string" && value.length > 0 && value.length <= 1048576;
+var b64 = (value) => value.toString("base64url");
+var relayId = () => b64(randomBytes2(16));
+var isRelayId = (value) => typeof value === "string" && /^[A-Za-z0-9_-]{22}$/.test(value) && Buffer.from(value, "base64url").length === 16 && Buffer.from(value, "base64url").toString("base64url") === value;
+var hash = (value) => createHash2("sha256").update(value).digest("base64url");
+var fingerprint = (value) => hash(value).slice(0, 26);
+var now = (deps) => (deps.now ?? (() => /* @__PURE__ */ new Date()))().toISOString();
+var pendingPath = (paths) => resolve(paths.configDir, "personal-sync-pending.json");
+var exactKeys2 = (value, keys) => {
+  const actual = Object.keys(value).sort();
+  const expected = [...keys].sort();
+  return actual.length === expected.length && actual.every((key, i) => key === expected[i]);
+};
+var strictBase64url2 = (value, bytes) => {
+  if (typeof value !== "string" || !/^[A-Za-z0-9_-]+$/.test(value))
+    fail("Recovery kit encoding is invalid.");
+  const encoded = value;
+  const decoded = Buffer.from(encoded, "base64url");
+  if (decoded.length !== bytes || decoded.toString("base64url") !== encoded)
+    fail("Recovery kit encoding is invalid.");
+  return decoded;
+};
+var recoveryKitMetadata = (kit) => JSON.stringify({
+  cipher: { name: kit.cipher.name, nonce: kit.cipher.nonce },
+  format: kit.format,
+  kdf: {
+    N: kit.kdf.N,
+    name: kit.kdf.name,
+    p: kit.kdf.p,
+    r: kit.kdf.r,
+    salt: kit.kdf.salt
+  },
+  version: kit.version
+});
+var validateRecoveryKit = (kit) => {
+  if (!kit || typeof kit !== "object" || Array.isArray(kit))
+    fail("Recovery kit format is invalid.");
+  const value = kit;
+  if (!exactKeys2(value, ["format", "version", "kdf", "cipher", "fingerprint"]))
+    fail("Recovery kit format is invalid.");
+  const kdf = value.kdf;
+  const cipher = value.cipher;
+  if (value.format !== KIT_FORMAT || value.version !== 1 || typeof value.fingerprint !== "string" || value.fingerprint.length !== 26 || !kdf || typeof kdf !== "object" || Array.isArray(kdf) || !cipher || typeof cipher !== "object" || Array.isArray(cipher) || !exactKeys2(kdf, [
+    "name",
+    "N",
+    "r",
+    "p",
+    "salt"
+  ]) || !exactKeys2(cipher, [
+    "name",
+    "nonce",
+    "ciphertext",
+    "tag"
+  ]) || kdf.name !== "scrypt" || kdf.N !== 32768 || kdf.r !== 8 || kdf.p !== 1 || cipher.name !== "aes-256-gcm")
+    fail("Recovery kit format is invalid.");
+  const parsed = value;
+  strictBase64url2(parsed.kdf.salt, 16);
+  strictBase64url2(parsed.cipher.nonce, 12);
+  strictBase64url2(parsed.cipher.tag, 16);
+  const ciphertext = Buffer.from(parsed.cipher.ciphertext, "base64url");
+  if (!/^[A-Za-z0-9_-]+$/.test(parsed.cipher.ciphertext) || ciphertext.length < 1 || ciphertext.length > MAX_CONTROL_RESPONSE_BYTES || ciphertext.toString("base64url") !== parsed.cipher.ciphertext)
+    fail("Recovery kit encoding is invalid.");
+  return parsed;
+};
+var deriveKey = (password, salt) => scryptSync(password, salt, 32, {
+  N: 32768,
+  r: 8,
+  p: 1,
+  maxmem: 64 * 1024 * 1024
+});
+var encryptRecoveryKit = (plaintext, password) => {
+  if (!password.length || password.length > MAX_PASSWORD_BYTES)
+    fail("Recovery password length is invalid.");
+  const kit = {
+    format: KIT_FORMAT,
+    version: 1,
+    kdf: { name: "scrypt", N: 32768, r: 8, p: 1, salt: b64(randomBytes2(16)) },
+    cipher: {
+      name: "aes-256-gcm",
+      nonce: b64(randomBytes2(12)),
+      ciphertext: "",
+      tag: ""
+    },
+    fingerprint: fingerprint(plaintext)
+  };
+  const cipher = createCipheriv2("aes-256-gcm", deriveKey(password, strictBase64url2(kit.kdf.salt, 16)), strictBase64url2(kit.cipher.nonce, 12));
+  cipher.setAAD(Buffer.from(recoveryKitMetadata(kit), "utf8"));
+  kit.cipher.ciphertext = b64(Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]));
+  kit.cipher.tag = b64(cipher.getAuthTag());
+  return kit;
+};
+var decryptRecoveryKit = (input, password) => {
+  const kit = validateRecoveryKit(input);
+  if (!password.length || password.length > MAX_PASSWORD_BYTES)
+    fail("Recovery password length is invalid.");
+  try {
+    const decipher = createDecipheriv2("aes-256-gcm", deriveKey(password, strictBase64url2(kit.kdf.salt, 16)), strictBase64url2(kit.cipher.nonce, 12));
+    decipher.setAAD(Buffer.from(recoveryKitMetadata(kit), "utf8"));
+    decipher.setAuthTag(strictBase64url2(kit.cipher.tag, 16));
+    const plaintext = Buffer.concat([
+      decipher.update(Buffer.from(kit.cipher.ciphertext, "base64url")),
+      decipher.final()
+    ]).toString("utf8");
+    if (fingerprint(plaintext) !== kit.fingerprint)
+      fail("Recovery kit fingerprint is invalid.");
+    return plaintext;
+  } catch (error) {
+    if (error instanceof Error && error.message === "Recovery kit fingerprint is invalid.")
+      throw error;
+    return fail("Recovery kit password or authentication tag is invalid.");
+  }
+};
+var rejectPasswordArguments = (args) => {
+  if (args.some((arg) => arg === "--password" || arg.startsWith("--password=")))
+    fail("Recovery passwords must use --password-stdin or --password-fd; password arguments are forbidden.");
+};
+var flag = (args, name) => {
+  const index = args.indexOf(name);
+  return index < 0 ? void 0 : args[index + 1];
+};
+var requiredFlag = (args, name) => flag(args, name)?.trim() || fail(`${name} is required.`);
+var readBoundedFd = (raw, label, maximum = MAX_CONTROL_RESPONSE_BYTES) => {
+  const fd = Number.parseInt(raw ?? "", 10);
+  if (!Number.isInteger(fd) || fd < 0)
+    fail(`${label} must be a non-negative file descriptor.`);
+  const buffer = Buffer.allocUnsafe(maximum + 1);
+  let offset = 0;
+  while (offset < buffer.length) {
+    const count = readSync(fd, buffer, offset, buffer.length - offset, null);
+    if (count === 0)
+      break;
+    offset += count;
+  }
+  if (offset > maximum)
+    fail(`${label} exceeds maximum size.`);
+  return Buffer.from(buffer.subarray(0, offset));
+};
+var passwordFrom = (args) => {
+  rejectPasswordArguments(args);
+  const fd = flag(args, "--password-fd");
+  const stdin = args.includes("--password-stdin");
+  if (Boolean(fd) === stdin)
+    fail("Use exactly one of --password-stdin or --password-fd.");
+  const raw = readBoundedFd(stdin ? "0" : fd, "--password-fd", MAX_PASSWORD_BYTES);
+  const password = Buffer.from(raw.toString("utf8").replace(/\r?\n$/, ""));
+  raw.fill(0);
+  if (!password.length || password.length > MAX_PASSWORD_BYTES) {
+    password.fill(0);
+    fail("Recovery password length is invalid.");
+  }
+  return password;
+};
+var secureRegularFile = (path) => {
+  try {
+    const stat = lstatSync(path);
+    return stat.isFile() && !stat.isSymbolicLink() && (stat.mode & 63) === 0;
+  } catch {
+    return false;
+  }
+};
+var fsyncDirectory = (path) => {
+  const fd = openSync(path, "r");
+  try {
+    fsyncSync(fd);
+  } finally {
+    closeSync(fd);
+  }
+};
+var stageRecoveryKit = (path, kit) => {
+  const output = resolve(path);
+  const directory = dirname(output);
+  mkdirSync(directory, { recursive: true, mode: 448 });
+  if (existsSync(output))
+    fail("Recovery kit destination already exists.");
+  const temporary = `${output}.${process.pid}.${b64(randomBytes2(8))}.tmp`;
+  const fd = openSync(temporary, "wx", 384);
+  try {
+    writeFileSync(fd, `${JSON.stringify(kit, null, 2)}
+`, "utf8");
+    fsyncSync(fd);
+  } finally {
+    closeSync(fd);
+  }
+  return {
+    output,
+    finalize: () => {
+      if (existsSync(output))
+        fail("Recovery kit destination already exists.");
+      renameSync(temporary, output);
+      fsyncDirectory(directory);
+      if (!secureRegularFile(output))
+        fail("Recovery kit permissions are unsafe; require 0600.");
+    },
+    abort: () => {
+      if (!existsSync(temporary))
+        return;
+      unlinkSync(temporary);
+    }
+  };
+};
+var writeRecoveryKit = (path, kit) => {
+  const staged = stageRecoveryKit(path, kit);
+  try {
+    staged.finalize();
+  } catch (error) {
+    try {
+      staged.abort();
+    } catch {
+    }
+    throw error;
+  }
+};
+var readPending = (paths) => {
+  const path = pendingPath(paths);
+  if (!existsSync(path))
+    return { version: PENDING_VERSION, pending: [] };
+  if (!secureRegularFile(path))
+    fail("Personal Sync pending state permissions are unsafe.");
+  try {
+    const value = JSON.parse(readFileSync(path, "utf8"));
+    if (value.version !== PENDING_VERSION || !Array.isArray(value.pending))
+      throw new Error();
+    const pending = value.pending.flatMap((entry) => {
+      if (!entry || typeof entry !== "object")
+        return [];
+      const request = entry;
+      return typeof request.requestId === "string" && typeof request.groupId === "string" && typeof request.createdAt === "string" ? [
+        {
+          requestId: request.requestId,
+          groupId: request.groupId,
+          createdAt: request.createdAt
+        }
+      ] : [];
+    });
+    if (pending.length !== value.pending.length || pending.length > MAX_PENDING_REQUESTS)
+      throw new Error();
+    return { version: PENDING_VERSION, pending };
+  } catch {
+    return fail("Personal Sync pending state is unreadable.");
+  }
+};
+var writePending = (paths, state) => {
+  const path = pendingPath(paths);
+  const directory = dirname(path);
+  mkdirSync(directory, { recursive: true, mode: 448 });
+  const temporary = `${path}.${process.pid}.${b64(randomBytes2(8))}.tmp`;
+  const fd = openSync(temporary, "wx", 384);
+  try {
+    writeFileSync(fd, `${JSON.stringify(state)}
+`, "utf8");
+    fsyncSync(fd);
+  } finally {
+    closeSync(fd);
+  }
+  renameSync(temporary, path);
+  fsyncDirectory(directory);
+};
+var controlOrigin = (environment) => {
+  const configured = environment.PDS_CONTROL_URL?.trim();
+  const origin = configured ?? fail("Personal Sync control API is not configured (PDS_CONTROL_URL). ");
+  try {
+    const url = new URL(origin);
+    if (!/^https?:$/.test(url.protocol) || !url.hostname || url.username || url.password || url.search || url.hash)
+      throw new Error();
+    return url.toString().replace(/\/$/, "");
+  } catch {
+    return fail("PDS_CONTROL_URL must be an HTTP(S) origin without credentials.");
+  }
+};
+var browserOrigin = (environment) => {
+  const configured = environment.PDS_BROWSER_ORIGIN?.trim();
+  if (!configured)
+    fail("Personal Sync browser origin is not configured (PDS_BROWSER_ORIGIN).");
+  try {
+    const url = new URL(configured);
+    if (!/^https?:$/.test(url.protocol) || !url.hostname || url.username || url.password || url.pathname !== "/" || url.search || url.hash)
+      throw new Error();
+    return url.origin;
+  } catch {
+    return fail("PDS_BROWSER_ORIGIN must be an HTTP(S) origin.");
+  }
+};
+var browserSession = (environment) => {
+  const raw = environment.PDS_BROWSER_SESSION_FD;
+  if (raw === void 0)
+    fail("PDS browser session FD is required; API Tokens and legacy credentials are rejected.");
+  const bytes = readBoundedFd(raw, "PDS_BROWSER_SESSION_FD", 16384);
+  const value = bytes.toString("utf8").trim();
+  bytes.fill(0);
+  if (!value || /[\r\n\0]/.test(value))
+    fail("PDS browser session FD is invalid.");
+  return value;
+};
+var readBoundedResponseText2 = async (response) => {
+  const rawContentLength = response.headers.get("content-length");
+  if (rawContentLength !== null) {
+    const contentLength = rawContentLength.trim();
+    if (!/^\d+$/.test(contentLength)) {
+      await response.body?.cancel().catch(() => void 0);
+      fail("PDS control response is invalid.");
+    }
+    const declaredLength = Number(contentLength);
+    if (!Number.isSafeInteger(declaredLength)) {
+      await response.body?.cancel().catch(() => void 0);
+      fail("PDS control response is invalid.");
+    }
+    if (declaredLength > MAX_CONTROL_RESPONSE_BYTES) {
+      await response.body?.cancel().catch(() => void 0);
+      fail("PDS control response exceeds maximum size.");
+    }
+  }
+  if (!response.body)
+    return "";
+  const reader = response.body.getReader();
+  const chunks = [];
+  let bytes = 0;
+  let overflow = false;
+  try {
+    while (true) {
+      const next = await reader.read();
+      if (next.done)
+        break;
+      if (next.value.byteLength > MAX_CONTROL_RESPONSE_BYTES - bytes) {
+        overflow = true;
+        await reader.cancel().catch(() => void 0);
+        fail("PDS control response exceeds maximum size.");
+      }
+      bytes += next.value.byteLength;
+      chunks.push(next.value);
+    }
+  } catch (error) {
+    if (!overflow)
+      await reader.cancel().catch(() => void 0);
+    throw error;
+  } finally {
+    reader.releaseLock();
+  }
+  return Buffer.concat(chunks, bytes).toString("utf8");
+};
+var strictResponse = async (response) => {
+  const text = await readBoundedResponseText2(response);
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch {
+    fail("PDS control response is invalid.");
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    fail("PDS control response is invalid.");
+  if (!response.ok) {
+    const body = value;
+    const message = typeof body.message === "string" ? body.message : typeof body.error === "string" ? body.error : null;
+    fail(message ? `PDS control API rejected request: ${message}` : `PDS control API rejected request (${response.status}).`);
+  }
+  return value;
+};
+var control = async (input) => {
+  const fetcher = input.deps.fetch ?? globalThis.fetch;
+  if (!fetcher)
+    fail("PDS control API is unavailable.");
+  const desktopAuthorization = input.deps.desktopAuthorization?.trim();
+  const pairingToken = input.deps.pairingToken?.trim();
+  const sessionCookie = desktopAuthorization || pairingToken ? null : input.deps.sessionCookie ?? browserSession(input.environment);
+  const timeout = AbortSignal.timeout(1e4);
+  const response = await fetcher(`${controlOrigin(input.environment)}${input.path}`, {
+    method: input.method,
+    headers: {
+      accept: "application/json",
+      ...desktopAuthorization ? { authorization: desktopAuthorization } : pairingToken ? {} : {
+        cookie: sessionCookie,
+        origin: browserOrigin(input.environment)
+      },
+      ...input.body ? { "content-type": "application/json" } : {}
+    },
+    ...input.body ? { body: JSON.stringify(input.body) } : {},
+    signal: timeout,
+    redirect: "error"
+  });
+  return strictResponse(response);
+};
+var generatedKey = (kind) => {
+  const pair = kind === "ed25519" ? generateKeyPairSync("ed25519") : generateKeyPairSync("x25519");
+  const publicJwk = pair.publicKey.export({ format: "jwk" });
+  const privateJwk = pair.privateKey.export({ format: "jwk" });
+  const publicKey = publicJwk.x;
+  const privateSeed = privateJwk.d;
+  if (typeof publicKey !== "string" || typeof privateSeed !== "string" || publicKey.length !== 43 || privateSeed.length !== 43)
+    fail(`Generated ${kind} key material is invalid.`);
+  return {
+    publicKey,
+    privateSeed,
+    privateKey: pair.privateKey
+  };
+};
+var personalSyncProviderEnvironment = (environment) => ({
+  PATH: environment.PATH,
+  HOME: environment.HOME,
+  USER: environment.USER,
+  LANG: environment.LANG,
+  LC_ALL: environment.LC_ALL,
+  KOED_HOME: environment.KOED_HOME,
+  ELECTRON_RUN_AS_NODE: environment.ELECTRON_RUN_AS_NODE
+});
+var providerArgs = (environment) => {
+  const raw = environment.PDS_SECRET_PROVIDER_COMMAND_ARGS_JSON;
+  if (!raw)
+    return [];
+  try {
+    const parsed = JSON.parse(raw);
+    if (!Array.isArray(parsed) || parsed.length > 8 || parsed.some((value) => typeof value !== "string" || value.length > 4096)) {
+      throw new Error();
+    }
+    return parsed;
+  } catch {
+    fail("PDS secret provider arguments are invalid.");
+    return [];
+  }
+};
+var validSecretProvider = (environment) => environment.PDS_SECRET_PROVIDER?.trim() === "headless";
+var runSecretProvider = async (operation, reference, environment, value) => {
+  const provider = environment.PDS_SECRET_PROVIDER?.trim();
+  const command = environment.PDS_SECRET_PROVIDER_COMMAND?.trim();
+  if (!provider && !command) {
+    const result = await runApplicationSecretProvider(operation, reference, value, environment);
+    return { ok: result.ok, stdout: result.value ?? "" };
+  }
+  if (!validSecretProvider(environment) || !command || !/^[^\s\r\n\0]+$/.test(command) || !/^[^\r\n\0]{1,240}$/.test(reference))
+    fail("A valid PDS secret provider is required.");
+  return await new Promise((resolvePromise) => {
+    const child = spawn(command, [...providerArgs(environment), operation, reference], {
+      env: personalSyncProviderEnvironment(environment),
+      stdio: ["pipe", "pipe", "ignore"],
+      windowsHide: true
+    });
+    let stdout = "";
+    let settled = false;
+    const finish = (ok) => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timeout);
+      resolvePromise({ ok, stdout });
+    };
+    const timeout = setTimeout(() => {
+      child.kill();
+      finish(false);
+    }, 1e4);
+    child.stdout.setEncoding("utf8");
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk;
+      if (Buffer.byteLength(stdout, "utf8") > MAX_CONTROL_RESPONSE_BYTES) {
+        child.kill();
+        finish(false);
+      }
+    });
+    child.once("error", () => finish(false));
+    child.once("close", (code) => finish(code === 0));
+    child.stdin.end(value ?? "");
+  });
+};
+var putProviderSecret = async (reference, value, environment) => {
+  const result = await runSecretProvider("put", reference, environment, value);
+  if (!result.ok)
+    fail("PDS secret provider rejected runtime material.");
+};
+var getProviderSecret = async (reference, environment) => {
+  const result = await runSecretProvider("get", reference, environment);
+  return result.ok && result.stdout.length > 0 ? result.stdout : null;
+};
+var deleteProviderSecret = async (reference, environment) => {
+  const result = await runSecretProvider("delete", reference, environment);
+  if (!result.ok)
+    fail("PDS secret provider could not delete pending material.");
+};
+var pendingSecretReference = (runtimeReference, challengeId) => `pds-pending-${hash(runtimeReference).slice(0, 20)}-${challengeId}`;
+var parsedSecret = (raw, expectedKeys, label) => {
+  if (!raw || Buffer.byteLength(raw, "utf8") > MAX_CONTROL_RESPONSE_BYTES)
+    fail(`${label} is unavailable.`);
+  try {
+    const value = JSON.parse(raw);
+    if (!value || typeof value !== "object" || Array.isArray(value) || !(Array.isArray(expectedKeys[0]) ? expectedKeys.some((keys) => exactKeys2(value, keys)) : exactKeys2(value, expectedKeys)))
+      fail(`${label} is invalid.`);
+    return value;
+  } catch (error) {
+    if (error instanceof Error && error.message === `${label} is invalid.`)
+      throw error;
+    return fail(`${label} is invalid.`);
+  }
+};
+var runtimeSecret = async (reference, environment, deps) => {
+  const value = parsedSecret(await (deps.getSecret ?? getProviderSecret)(reference, environment), [
+    [
+      "version",
+      "userId",
+      "relayUrl",
+      "groupId",
+      "device",
+      "authority",
+      "recovery",
+      "certificate",
+      "recipientCertificates",
+      "groupSecrets"
+    ],
+    [
+      "version",
+      "userId",
+      "relayUrl",
+      "groupId",
+      "device",
+      "authority",
+      "recovery",
+      "certificate",
+      "recipientCertificates",
+      "historicalOriginCertificates",
+      "groupSecrets"
+    ]
+  ].flatMap((fields) => [fields, [...fields, "historicalProjectKeys"]]), "PDS runtime secret");
+  if (value.version !== 1 || !Object.values(value.device).every(strictString) || !Object.values(value.authority).every(strictString) || !Object.values(value.recovery).every(strictString) || value.historicalProjectKeys !== void 0 && !pdsRepositoryKeyHistorySchema.safeParse(value.historicalProjectKeys).success || !Object.values(value.groupSecrets).every(strictString) || !Array.isArray(value.recipientCertificates) || !value.recipientCertificates.every(strictString) || value.historicalOriginCertificates !== void 0 && (!Array.isArray(value.historicalOriginCertificates) || !value.historicalOriginCertificates.every(strictString)))
+    fail("PDS runtime secret is invalid.");
+  return value;
+};
+var optionalRuntimeSecret = async (reference, environment, deps) => {
+  const raw = await (deps.getSecret ?? getProviderSecret)(reference, environment);
+  if (raw === null)
+    return null;
+  return await runtimeSecret(reference, environment, {
+    ...deps,
+    getSecret: () => raw
+  });
+};
+var certificateDeviceId = (certificate) => {
+  const parsed = parseCanonicalPdsJson(certificate);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    fail("PDS membership certificate is invalid.");
+  }
+  const deviceId = parsed.deviceId;
+  if (typeof deviceId !== "string") {
+    fail("PDS membership certificate is invalid.");
+  }
+  return deviceId;
+};
+var validatedRuntimeSecret = (runtime, certificates) => {
+  if (!isRelayId(runtime.device.originDeploymentId)) {
+    fail("PDS origin deployment identity is invalid.");
+  }
+  const ordered = certificates.map((certificate) => ({
+    certificate,
+    deviceId: certificateDeviceId(certificate)
+  })).sort((left, right) => Buffer.from(left.deviceId, "ascii").compare(Buffer.from(right.deviceId, "ascii")));
+  if (ordered.length === 0 || new Set(ordered.map(({ deviceId }) => deviceId)).size !== ordered.length) {
+    fail("PDS membership certificate set is invalid.");
+  }
+  const own = ordered.find(({ deviceId }) => deviceId === runtime.device.id) ?? fail("PDS local membership certificate is unavailable.");
+  const candidate = {
+    ...runtime,
+    certificate: own.certificate,
+    recipientCertificates: ordered.map(({ certificate }) => certificate)
+  };
+  createPdsSessionPackageRuntimeContext({
+    authorityPublicKey: candidate.authority.publicKey,
+    authorityKeyId: candidate.authority.keyId,
+    groupId: candidate.groupId,
+    authorityHead: candidate.authority.head,
+    currentEpoch: candidate.groupSecrets.currentEpoch,
+    servingCertificate: candidate.certificate,
+    recipientCertificate: candidate.certificate,
+    recipientCertificates: candidate.recipientCertificates,
+    historicalOriginCertificates: candidate.historicalOriginCertificates
+  });
+  return candidate;
+};
+var pendingEnrollmentSecret = async (reference, environment, deps) => {
+  const value = parsedSecret(await (deps.getSecret ?? getProviderSecret)(reference, environment), [
+    "version",
+    "groupId",
+    "userId",
+    "browserDeploymentId",
+    "localDeploymentId",
+    "relayUrl",
+    "originDeploymentId",
+    "deviceId",
+    "signingKeyId",
+    "signingPublicKey",
+    "signingPrivateSeed",
+    "kemKeyId",
+    "kemPublicKey",
+    "kemPrivateSeed",
+    "authorityKeyId",
+    "authorityPublicKey",
+    "challengeId",
+    "challenge",
+    "expiresAt"
+  ], "PDS pending enrollment secret");
+  if (value.version !== 1 || !Object.entries(value).filter(([key]) => key !== "version").every(([, field]) => strictString(field)) || !isRelayId(value.originDeploymentId))
+    fail("PDS pending enrollment secret is invalid.");
+  return value;
+};
+var challengeBinding = async (input) => {
+  const response = await control({
+    environment: input.environment,
+    deps: input.deps,
+    method: "POST",
+    path: "/v1/personal-device-sync/challenges",
+    body: {
+      ...input.groupId ? { group_id: input.groupId } : {},
+      challenge_hash: pdsSha256(Buffer.from(input.challenge, "base64url"))
+    }
+  });
+  const challenge = object(response.challenge, "challenge");
+  const authority = object(challenge.authority, "challenge.authority");
+  const values = {
+    id: challenge.id,
+    expiresAt: challenge.expires_at,
+    browserSubjectId: challenge.browser_subject_id,
+    browserDeploymentId: challenge.browser_deployment_id,
+    authorityKeyId: authority.key_id,
+    authorityPublicKey: authority.public_key
+  };
+  if (!Object.values(values).every((value) => typeof value === "string"))
+    fail("PDS control response challenge binding is invalid.");
+  strictBase64url2(values.authorityPublicKey, 32);
+  return values;
+};
+var pairingInvitationBinding = (invitation, groupId) => {
+  if (!exactKeys2(invitation, [
+    "protocol",
+    "group_id",
+    "challenge_id",
+    "challenge",
+    "expires_at",
+    "browser_subject_id",
+    "browser_deployment_id",
+    "authority",
+    "control_url",
+    "relay_url"
+  ]) || invitation.protocol !== "koed/pds-lan-pair/v1" || invitation.group_id !== groupId) {
+    fail("PDS pairing invitation is invalid.");
+  }
+  const authority = object(invitation.authority, "pairing invitation authority");
+  if (!exactKeys2(authority, ["key_id", "public_key"])) {
+    fail("PDS pairing invitation authority is invalid.");
+  }
+  const values = {
+    challenge: invitation.challenge,
+    id: invitation.challenge_id,
+    expiresAt: invitation.expires_at,
+    browserSubjectId: invitation.browser_subject_id,
+    browserDeploymentId: invitation.browser_deployment_id,
+    authorityKeyId: authority.key_id,
+    authorityPublicKey: authority.public_key
+  };
+  if (!Object.values(values).every(strictString)) {
+    fail("PDS pairing invitation is invalid.");
+  }
+  strictBase64url2(values.challenge, 32);
+  strictBase64url2(values.authorityPublicKey, 32);
+  const expiresAt = new Date(values.expiresAt);
+  const remaining = expiresAt.getTime() - Date.now();
+  if (!Number.isFinite(expiresAt.getTime()) || remaining <= 0 || remaining > 10 * 60 * 1e3) {
+    fail("PDS pairing invitation is expired or has an invalid lifetime.");
+  }
+  for (const [field, value] of [
+    ["control", invitation.control_url],
+    ["relay", invitation.relay_url]
+  ]) {
+    try {
+      const url = new URL(value);
+      if (url.protocol !== "http:" && url.protocol !== "https:" || !url.hostname || url.username || url.password || url.search || url.hash) {
+        throw new Error();
+      }
+    } catch {
+      fail(`PDS pairing invitation ${field} URL is invalid.`);
+    }
+  }
+  return values;
+};
+var createPairingInvitation = async (args, environment, deps) => {
+  const groupId = groupIdFrom(args);
+  const runtimeReference = environment.PDS_RUNTIME_SECRET_REF?.trim() || fail("PDS_RUNTIME_SECRET_REF is required for pairing.");
+  const runtime = await runtimeSecret(runtimeReference, environment, deps);
+  if (runtime.groupId !== groupId) {
+    fail("PDS pairing invitation targets another group.");
+  }
+  const challenge = b64(randomBytes2(32));
+  const binding = await challengeBinding({
+    groupId,
+    challenge,
+    environment,
+    deps
+  });
+  return {
+    ok: true,
+    state: "inviting",
+    message: "Pairing invitation created.",
+    invitation: {
+      protocol: "koed/pds-lan-pair/v1",
+      group_id: groupId,
+      challenge_id: binding.id,
+      challenge,
+      expires_at: binding.expiresAt,
+      browser_subject_id: binding.browserSubjectId,
+      browser_deployment_id: binding.browserDeploymentId,
+      authority: {
+        key_id: binding.authorityKeyId,
+        public_key: binding.authorityPublicKey
+      },
+      relay_url: controlOrigin(environment)
+    }
+  };
+};
+var enrollmentProof = (input) => {
+  const unsigned = {
+    challengeId: input.challengeId,
+    challenge: input.challenge,
+    groupId: input.groupId ?? null,
+    deviceId: input.deviceId,
+    deviceSigningKeyId: input.signingKeyId,
+    deviceSigningPublicKey: input.signingPublicKey,
+    deviceKemKeyId: input.kemKeyId,
+    deviceKemPublicKey: input.kemPublicKey,
+    browserSubjectId: input.browserSubjectId,
+    browserDeploymentId: input.browserDeploymentId,
+    expiresAt: input.expiresAt
+  };
+  return {
+    challenge_id: input.challengeId,
+    challenge: input.challenge,
+    device_id: input.deviceId,
+    signature: sign(null, Buffer.from(`${PDS_PROTOCOL}/enrollment-proof
+${canonicalizePdsJson(unsigned)}`, "utf8"), input.signingPrivateKey).toString("base64url"),
+    expires_at: input.expiresAt
+  };
+};
+var bootstrapGroup = async (args, paths, environment, deps) => {
+  const controlDeps = deps.desktopAuthorization || deps.pairingToken ? deps : {
+    ...deps,
+    sessionCookie: deps.sessionCookie ?? browserSession(environment)
+  };
+  const recoveryKitPath = flag(args, "--recovery-kit");
+  const runtimeSecretRef = flag(args, "--runtime-secret-ref")?.trim() || environment.PDS_RUNTIME_SECRET_REF?.trim() || fail("PDS_RUNTIME_SECRET_REF or --runtime-secret-ref is required for bootstrap.");
+  const password = recoveryKitPath ? passwordFrom(args) : randomBytes2(32);
+  const identity = deps.identity ?? await ensureDeviceIdentity(paths, { environment });
+  if (!identity.remoteOperationsAllowed || !identity.deploymentId || !identity.deviceInstanceId) {
+    password.fill(0);
+    fail("A healthy Koed device identity is required for bootstrap.");
+  }
+  const deviceInstanceId = relayId();
+  const groupId = relayId();
+  const signingKey = generatedKey("ed25519");
+  const kemKey = generatedKey("x25519");
+  const recoverySigningKey = generatedKey("ed25519");
+  const recoveryKemKey = generatedKey("x25519");
+  const challengeValue = b64(randomBytes2(32));
+  const binding = await challengeBinding({
+    challenge: challengeValue,
+    environment,
+    deps: controlDeps
+  });
+  const signingKeyId = relayId();
+  const kemKeyId = relayId();
+  const recoverySigningKeyId = relayId();
+  const recoveryKemKeyId = relayId();
+  const groupSecrets = {
+    currentEpoch: "1",
+    contentKey: b64(randomBytes2(32)),
+    sourceFingerprintKey: b64(randomBytes2(32)),
+    tombstoneFloorKey: b64(randomBytes2(32)),
+    projectAliasKey: b64(randomBytes2(32))
+  };
+  const recoveryPayload = {
+    version: 1,
+    groupId,
+    recoverySigningKeyId,
+    recoverySigningPublicKey: recoverySigningKey.publicKey,
+    recoverySigningPrivateSeed: recoverySigningKey.privateSeed,
+    recoveryKemKeyId,
+    recoveryKemPublicKey: recoveryKemKey.publicKey,
+    recoveryKemPrivateSeed: recoveryKemKey.privateSeed,
+    groupSecrets
+  };
+  const recoveryPlaintext = JSON.stringify(recoveryPayload);
+  const kit = encryptRecoveryKit(recoveryPlaintext, password);
+  let stagedRecoveryKit;
+  try {
+    if (decryptRecoveryKit(kit, password) !== recoveryPlaintext)
+      fail("Recovery kit round-trip verification failed.");
+    if (recoveryKitPath)
+      stagedRecoveryKit = stageRecoveryKit(recoveryKitPath, kit);
+  } finally {
+    password.fill(0);
+  }
+  const draft = {
+    protocol: PDS_PROTOCOL,
+    kind: "genesis",
+    groupId,
+    sequence: "1",
+    previousHash: null,
+    body: {
+      authorityKeyId: binding.authorityKeyId,
+      authorityPublicKey: binding.authorityPublicKey,
+      recoverySigningKeyId,
+      recoverySigningPublicKey: recoverySigningKey.publicKey,
+      recoveryKemKeyId,
+      recoveryKemPublicKey: recoveryKemKey.publicKey,
+      recoveryKitHash: pdsSha256(recoveryPlaintext),
+      recoveryKitVerified: true,
+      initialDeviceId: deviceInstanceId,
+      initialDeviceSigningKeyId: signingKeyId,
+      initialDeviceSigningPublicKey: signingKey.publicKey,
+      initialDeviceKemKeyId: kemKeyId,
+      initialDeviceKemPublicKey: kemKey.publicKey,
+      operationFamilies: ["pds_relay"],
+      initialEpoch: "1",
+      initialKeyCommitment: pdsSha256(Buffer.from(groupSecrets.contentKey, "base64url"))
+    }
+  };
+  const statement = {
+    draft,
+    authorization: {
+      signerKeyId: signingKeyId,
+      signature: signPdsGroupDraft(draft, signingKey.privateKey)
+    }
+  };
+  validatePdsGroupStatement(statement, {
+    authorizationPublicKey: signingKey.publicKey,
+    expectedAuthorizationKeyId: signingKeyId,
+    expectedGroupId: groupId,
+    expectedPreviousHash: null,
+    expectedSequence: "1"
+  });
+  const proof = enrollmentProof({
+    challengeId: binding.id,
+    challenge: challengeValue,
+    groupId,
+    deviceId: deviceInstanceId,
+    signingKeyId,
+    signingPublicKey: signingKey.publicKey,
+    kemKeyId,
+    kemPublicKey: kemKey.publicKey,
+    browserSubjectId: binding.browserSubjectId,
+    browserDeploymentId: binding.browserDeploymentId,
+    expiresAt: binding.expiresAt,
+    signingPrivateKey: signingKey.privateKey
+  });
+  let created;
+  try {
+    created = await control({
+      environment,
+      deps: controlDeps,
+      method: "POST",
+      path: "/v1/personal-device-sync/groups/genesis",
+      body: {
+        statement: canonicalizePdsJson(statement),
+        proof,
+        first_device: {
+          device_id: deviceInstanceId,
+          signing_key_id: signingKeyId,
+          signing_public_key: signingKey.publicKey,
+          kem_key_id: kemKeyId,
+          kem_public_key: kemKey.publicKey,
+          operation_families: ["pds_relay"]
+        }
+      }
+    });
+    stagedRecoveryKit?.finalize();
+  } catch (error) {
+    try {
+      stagedRecoveryKit?.abort();
+    } catch {
+    }
+    throw error;
+  }
+  const group = object(created.group, "group");
+  const head = object(group.head, "group.head");
+  if (group.group_id !== groupId || typeof head.hash !== "string" || group.current_epoch !== "1")
+    fail("PDS genesis response is invalid.");
+  const headHash = head.hash;
+  const certificateResponse = await control({
+    environment,
+    deps: controlDeps,
+    method: "GET",
+    path: `/v1/personal-device-sync/groups/${encodeURIComponent(groupId)}/certificates/${encodeURIComponent(deviceInstanceId)}`
+  });
+  const certificate = object(certificateResponse.certificate, "certificate");
+  const runtime = validatedRuntimeSecret({
+    version: 1,
+    userId: binding.browserSubjectId,
+    relayUrl: controlOrigin(environment),
+    groupId,
+    device: {
+      id: deviceInstanceId,
+      originDeploymentId: relayId(),
+      signingKeyId,
+      signingPrivateSeed: signingKey.privateSeed,
+      kemKeyId,
+      kemPrivateSeed: kemKey.privateSeed
+    },
+    authority: {
+      keyId: binding.authorityKeyId,
+      publicKey: binding.authorityPublicKey,
+      head: headHash
+    },
+    recovery: {
+      signingKeyId: recoverySigningKeyId,
+      signingPublicKey: recoverySigningKey.publicKey
+    },
+    groupSecrets
+  }, [canonicalizePdsJson(certificate)]);
+  await (deps.putSecret ?? putProviderSecret)(runtimeSecretRef, JSON.stringify(runtime), environment);
+  await control({
+    environment,
+    deps: controlDeps,
+    method: "PUT",
+    path: `/v1/personal-device-sync/groups/${encodeURIComponent(groupId)}/policy`,
+    body: {
+      enabled: true,
+      future_closed_sessions_only: true,
+      historical_backfill_enabled: false
+    }
+  });
+  return {
+    ok: true,
+    state: "active",
+    message: "Personal Device Group created. The secure runtime is active.",
+    groupId,
+    deviceId: deviceInstanceId,
+    ...recoveryKitPath ? { recoveryKit: resolve(recoveryKitPath) } : {}
+  };
+};
+var groupIdFrom = (args) => {
+  const groupId = requiredFlag(args, "--group-id");
+  if (!/^[\x21-\x7e]{1,240}$/.test(groupId))
+    fail("--group-id is invalid.");
+  return groupId;
+};
+var object = (value, field) => {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    fail(`PDS control response ${field} is invalid.`);
+  return value;
+};
+var status = async (environment, deps) => {
+  const runtimeReference = environment.PDS_RUNTIME_SECRET_REF?.trim();
+  const runtime = runtimeReference ? await optionalRuntimeSecret(runtimeReference, environment, deps) : null;
+  try {
+    const response = await control({
+      environment,
+      deps,
+      method: "GET",
+      path: "/v1/personal-device-sync/groups"
+    });
+    if (!Array.isArray(response.groups))
+      fail("PDS control response groups is invalid.");
+    if (!Array.isArray(response.pairing_invitation_group_ids) || response.pairing_invitation_group_ids.some((groupId) => typeof groupId !== "string")) {
+      fail("PDS control response pairing capability is invalid.");
+    }
+    const groups = await Promise.all(response.groups.map(async (entry) => {
+      const group = object(entry, "group");
+      if (typeof group.group_id !== "string")
+        return group;
+      try {
+        const local = await control({
+          environment,
+          deps,
+          method: "GET",
+          path: `/v1/personal-device-sync/groups/${encodeURIComponent(group.group_id)}/local-status`
+        });
+        return { ...group, local_sync: local.status ?? null };
+      } catch {
+        return { ...group, local_sync: null };
+      }
+    }));
+    if (groups.length || !runtime) {
+      return {
+        ok: true,
+        state: "backend",
+        message: "Personal Sync status is Authority-owned.",
+        local_device_id: runtime?.device.id ?? null,
+        groups,
+        pairing_invitation_group_ids: response.pairing_invitation_group_ids
+      };
+    }
+    return {
+      ok: true,
+      state: "local_binding_missing",
+      message: "A protected Personal Sync runtime exists, but this local Personal database is not enrolled in its group.",
+      groups: [],
+      pairing_invitation_group_ids: [],
+      recoveryRequired: true
+    };
+  } catch (error) {
+    if (!runtime)
+      throw error;
+  }
+  const verified = createPdsSessionPackageRuntimeContext({
+    authorityPublicKey: runtime.authority.publicKey,
+    authorityKeyId: runtime.authority.keyId,
+    groupId: runtime.groupId,
+    authorityHead: runtime.authority.head,
+    currentEpoch: runtime.groupSecrets.currentEpoch,
+    servingCertificate: runtime.certificate,
+    recipientCertificate: runtime.certificate,
+    recipientCertificates: runtime.recipientCertificates,
+    historicalOriginCertificates: runtime.historicalOriginCertificates
+  });
+  return {
+    ok: true,
+    state: "runtime_cached",
+    local_device_id: runtime.device.id,
+    message: "Personal Sync status is using the last cryptographically verified Authority state.",
+    pairing_invitation_group_ids: [],
+    groups: [
+      {
+        group_id: runtime.groupId,
+        authority_key_id: runtime.authority.keyId,
+        authority_public_key: runtime.authority.publicKey,
+        current_epoch: runtime.groupSecrets.currentEpoch,
+        pending_epoch: null,
+        head: { hash: runtime.authority.head },
+        state: "active",
+        members: verified.recipients.map((member) => ({
+          device_id: member.deviceId,
+          signing_key_id: member.signingKeyId,
+          signing_public_key: member.signingPublicKey,
+          kem_key_id: member.kemKeyId,
+          kem_public_key: member.kemPublicKey,
+          operation_families: ["pds_relay"],
+          status: "active"
+        })),
+        policy: {
+          enabled: true,
+          future_closed_sessions_only: true,
+          historical_backfill_enabled: false
+        }
+      }
+    ]
+  };
+};
+var createJoinChallenge = async (args, paths, environment, deps) => {
+  const groupId = groupIdFrom(args);
+  const runtimeSecretRef = environment.PDS_RUNTIME_SECRET_REF?.trim() || fail("PDS_RUNTIME_SECRET_REF is required for enrollment.");
+  const identity = deps.identity ?? await ensureDeviceIdentity(paths, { environment });
+  if (!identity.remoteOperationsAllowed || !identity.deviceInstanceId || !identity.deploymentId)
+    fail("A healthy Koed device identity is required for enrollment.");
+  const deploymentId = identity.deploymentId;
+  const invitationFd = flag(args, "--invitation-fd");
+  const suppliedInvitation = invitationFd ? readJsonFd(args, "--invitation-fd") : null;
+  const generatedChallenge = suppliedInvitation ? null : b64(randomBytes2(32));
+  const binding = suppliedInvitation ? pairingInvitationBinding(suppliedInvitation, groupId) : await challengeBinding({
+    groupId,
+    challenge: generatedChallenge,
+    environment,
+    deps
+  });
+  const challengeValue = "challenge" in binding ? binding.challenge : generatedChallenge;
+  const pendingSecretRef = pendingSecretReference(runtimeSecretRef, binding.id);
+  const existingPendingRaw = suppliedInvitation ? await (deps.getSecret ?? getProviderSecret)(pendingSecretRef, environment) : null;
+  const existingPending = existingPendingRaw ? await pendingEnrollmentSecret(pendingSecretRef, environment, deps) : null;
+  if (existingPending && (existingPending.groupId !== groupId || existingPending.userId !== binding.browserSubjectId || existingPending.browserDeploymentId !== binding.browserDeploymentId || existingPending.localDeploymentId !== deploymentId || existingPending.authorityKeyId !== binding.authorityKeyId || existingPending.authorityPublicKey !== binding.authorityPublicKey || existingPending.challengeId !== binding.id || existingPending.challenge !== challengeValue || existingPending.expiresAt !== binding.expiresAt)) {
+    fail("PDS pending enrollment does not match the pairing invitation.");
+  }
+  const deviceInstanceId = existingPending?.deviceId ?? relayId();
+  const originDeploymentId = existingPending?.originDeploymentId ?? relayId();
+  const signingKey = existingPending ? {
+    publicKey: existingPending.signingPublicKey,
+    privateSeed: existingPending.signingPrivateSeed,
+    privateKey: pdsEd25519PrivateKey(existingPending.signingPrivateSeed, existingPending.signingPublicKey)
+  } : generatedKey("ed25519");
+  const kemKey = existingPending ? {
+    publicKey: existingPending.kemPublicKey,
+    privateSeed: existingPending.kemPrivateSeed
+  } : generatedKey("x25519");
+  const signingKeyId = existingPending?.signingKeyId ?? relayId();
+  const kemKeyId = existingPending?.kemKeyId ?? relayId();
+  const proof = enrollmentProof({
+    challengeId: binding.id,
+    challenge: challengeValue,
+    groupId,
+    deviceId: deviceInstanceId,
+    signingKeyId,
+    signingPublicKey: signingKey.publicKey,
+    kemKeyId,
+    kemPublicKey: kemKey.publicKey,
+    browserSubjectId: binding.browserSubjectId,
+    browserDeploymentId: binding.browserDeploymentId,
+    expiresAt: binding.expiresAt,
+    signingPrivateKey: signingKey.privateKey
+  });
+  await (deps.putSecret ?? putProviderSecret)(pendingSecretRef, JSON.stringify({
+    version: 1,
+    groupId,
+    userId: binding.browserSubjectId,
+    browserDeploymentId: binding.browserDeploymentId,
+    localDeploymentId: deploymentId,
+    relayUrl: suppliedInvitation && typeof suppliedInvitation.relay_url === "string" ? suppliedInvitation.relay_url : controlOrigin(environment),
+    originDeploymentId,
+    deviceId: deviceInstanceId,
+    signingKeyId,
+    signingPublicKey: signingKey.publicKey,
+    signingPrivateSeed: signingKey.privateSeed,
+    kemKeyId,
+    kemPublicKey: kemKey.publicKey,
+    kemPrivateSeed: kemKey.privateSeed,
+    authorityKeyId: binding.authorityKeyId,
+    authorityPublicKey: binding.authorityPublicKey,
+    challengeId: binding.id,
+    challenge: challengeValue,
+    expiresAt: binding.expiresAt
+  }), environment);
+  const pending = readPending(paths);
+  const next = pending.pending.filter((entry) => entry.requestId !== binding.id);
+  next.push({ requestId: binding.id, groupId, createdAt: now(deps) });
+  writePending(paths, {
+    version: PENDING_VERSION,
+    pending: next.slice(-MAX_PENDING_REQUESTS)
+  });
+  return {
+    ok: true,
+    state: "pending",
+    message: "Pairing request is pending backend approval.",
+    pairing: {
+      challengeId: binding.id
+    },
+    request: {
+      group_id: groupId,
+      device_id: deviceInstanceId,
+      signing_key_id: signingKeyId,
+      signing_public_key: signingKey.publicKey,
+      kem_key_id: kemKeyId,
+      kem_public_key: kemKey.publicKey,
+      operation_families: ["pds_relay"],
+      proof
+    }
+  };
+};
+var groupMembers = (group) => {
+  if (!Array.isArray(group.members))
+    fail("PDS control response group members are invalid.");
+  return group.members.map((member) => object(member, "group member"));
+};
+var responseString = (value, field) => strictString(value[field]) ? value[field] : fail(`PDS control response ${field} is invalid.`);
+var groupMember = (group, deviceId) => groupMembers(group).find((member) => member.device_id === deviceId && member.status === "active") ?? fail("PDS active device is not a current group member.");
+var epochAck = (input) => {
+  const unsigned = {
+    protocol: PDS_PROTOCOL,
+    groupId: input.groupId,
+    bundleHash: input.bundleHash,
+    deviceId: input.deviceId,
+    recipientKemKeyId: input.kemKeyId,
+    recipientKemPublicKeyCommitment: pdsPublicKeyCommitment(input.kemPublicKey),
+    epoch: input.epoch,
+    acknowledgedAt: input.acknowledgedAt
+  };
+  return canonicalizePdsJson({
+    ...unsigned,
+    signature: {
+      signerKeyId: input.signingKeyId,
+      signature: signPdsRecord("key-bundle-ack", unsigned, input.signingPrivateKey)
+    }
+  });
+};
+var requestDeviceMatches = (body, request) => body.deviceId === request.device_id && body.deviceSigningKeyId === request.signing_key_id && body.deviceSigningPublicKey === request.signing_public_key && body.deviceKemKeyId === request.kem_key_id && body.deviceKemPublicKey === request.kem_public_key && Array.isArray(body.operationFamilies) && body.operationFamilies.length === 1 && body.operationFamilies[0] === "pds_relay";
+var pendingApprovalStatement = async (input) => {
+  const sequence = responseString(input.current, "pending_statement_sequence");
+  const statementResponse = await control({
+    environment: input.environment,
+    deps: input.controlDeps,
+    method: "GET",
+    path: `/v1/personal-device-sync/groups/${encodeURIComponent(input.groupId)}/log`
+  });
+  if (!Array.isArray(statementResponse.statements))
+    fail("PDS pending transition statement log is invalid.");
+  const entry = statementResponse.statements.map((value) => object(value, "group statement log entry")).find((value) => value.sequence === sequence) ?? fail("PDS pending transition statement is unavailable.");
+  const statement = parseCanonicalPdsJson(responseString(entry, "canonicalStatement"));
+  const head = object(input.current.head, "group.head");
+  validatePdsGroupStatement(statement, {
+    authorizationPublicKey: responseString(input.sourceMember, "signing_public_key"),
+    authorityPublicKey: input.activeRuntime.authority.publicKey,
+    expectedAuthorizationKeyId: input.activeRuntime.device.signingKeyId,
+    expectedAuthorityKeyId: input.activeRuntime.authority.keyId,
+    expectedGroupId: input.groupId
+  });
+  const statementDraft = object(statement.draft, "pending statement draft");
+  const statementBody = object(statementDraft.body, "pending statement body");
+  const epoch = responseString(input.current, "pending_epoch");
+  const pendingMember = groupMembers(input.current).find((member) => member.device_id === input.request.device_id);
+  const memberMatches = pendingMember?.status === "active" ? requestDeviceMatches({
+    deviceId: pendingMember.device_id,
+    deviceSigningKeyId: pendingMember.signing_key_id,
+    deviceSigningPublicKey: pendingMember.signing_public_key,
+    deviceKemKeyId: pendingMember.kem_key_id,
+    deviceKemPublicKey: pendingMember.kem_public_key,
+    operationFamilies: pendingMember.operation_families
+  }, input.request) : false;
+  if (statementDraft.kind !== "add-device" || statementDraft.sequence !== sequence || statementDraft.groupId !== input.groupId || statementBody.nextEpoch !== epoch || statementBody.previousEpoch !== input.current.current_epoch || statementBody.keyBundleHash !== input.current.pending_bundle_hash || responseString(entry, "statementHash") !== responseString(head, "hash") || responseString(head, "sequence") !== sequence || !requestDeviceMatches(statementBody, input.request) || !memberMatches) {
+    fail("PDS pending membership transition does not match pairing request.");
+  }
+  const bundleResponse = await control({
+    environment: input.environment,
+    deps: input.controlDeps,
+    method: "GET",
+    path: `/v1/personal-device-sync/groups/${encodeURIComponent(input.groupId)}/key-bundles/${encodeURIComponent(epoch)}`
+  });
+  const bundle = object(bundleResponse.key_bundle, "key_bundle");
+  const metadata = validatePdsKeyBundle(bundle, {
+    authorizationPublicKey: responseString(input.sourceMember, "signing_public_key"),
+    authorityPublicKey: input.activeRuntime.authority.publicKey,
+    expectedAuthorizationKeyId: input.activeRuntime.device.signingKeyId,
+    expectedAuthorityKeyId: input.activeRuntime.authority.keyId
+  });
+  if (metadata.authorizationHash !== input.current.pending_bundle_hash || metadata.draft.groupId !== input.groupId || metadata.draft.epoch !== epoch || metadata.draft.transitionKind !== "add-device") {
+    fail("PDS pending key bundle does not match pairing request.");
+  }
+  return { statement, bundle, epoch };
+};
+var approveActiveDevice = async (args, environment, deps) => {
+  const runtimeReference = environment.PDS_RUNTIME_SECRET_REF?.trim() || fail("PDS_RUNTIME_SECRET_REF is required for approval.");
+  const activeRuntime = await runtimeSecret(runtimeReference, environment, deps);
+  const requestContainer = readJsonFd(args, "--request-fd");
+  const request = object(requestContainer.request ?? requestContainer, "pairing request");
+  const groupId = typeof request.group_id === "string" ? request.group_id.trim() : "";
+  if (groupId !== activeRuntime.groupId)
+    fail("PDS pairing request targets another group.");
+  const controlDeps = deps.desktopAuthorization || deps.pairingToken ? deps : {
+    ...deps,
+    sessionCookie: deps.sessionCookie ?? browserSession(environment)
+  };
+  const currentResponse = await control({
+    environment,
+    deps: controlDeps,
+    method: "GET",
+    path: `/v1/personal-device-sync/groups/${encodeURIComponent(groupId)}`
+  });
+  const current = object(currentResponse.group, "group");
+  if (current.state !== "active" || typeof current.current_epoch !== "string")
+    fail("PDS group is not ready for membership transition.");
+  const sourceMember = groupMember(current, activeRuntime.device.id);
+  const recovery = object(current.recovery, "group.recovery");
+  const newDevice = {
+    deviceId: responseString(request, "device_id"),
+    signingKeyId: responseString(request, "signing_key_id"),
+    signingPublicKey: responseString(request, "signing_public_key"),
+    kemKeyId: responseString(request, "kem_key_id"),
+    kemPublicKey: responseString(request, "kem_public_key")
+  };
+  if (!Object.values(newDevice).every(strictString) || !request.proof || typeof request.proof !== "object" || Array.isArray(request.proof))
+    fail("PDS pairing request is invalid.");
+  const existingMember = groupMembers(current).find((member) => member.device_id === newDevice.deviceId && member.status === "active");
+  if (current.pending_epoch === null && existingMember) {
+    if (!requestDeviceMatches({
+      deviceId: existingMember.device_id,
+      deviceSigningKeyId: existingMember.signing_key_id,
+      deviceSigningPublicKey: existingMember.signing_public_key,
+      deviceKemKeyId: existingMember.kem_key_id,
+      deviceKemPublicKey: existingMember.kem_public_key,
+      operationFamilies: existingMember.operation_families
+    }, request)) {
+      fail("PDS active membership does not match pairing request.");
+    }
+    return {
+      ok: true,
+      state: "active",
+      message: "Device approval was already completed.",
+      groupId,
+      deviceId: newDevice.deviceId,
+      epoch: current.current_epoch
+    };
+  }
+  if (current.pending_epoch !== null) {
+    const pending = await pendingApprovalStatement({
+      groupId,
+      current,
+      request,
+      activeRuntime,
+      sourceMember,
+      environment,
+      controlDeps
+    });
+    const sourceSigningKey2 = pdsEd25519PrivateKey(activeRuntime.device.signingPrivateSeed, responseString(sourceMember, "signing_public_key"));
+    const decrypted2 = decryptPdsKeyBundleSecretSet({
+      bundle: pending.bundle,
+      authorizationPublicKey: responseString(sourceMember, "signing_public_key"),
+      authorityPublicKey: activeRuntime.authority.publicKey,
+      recipientId: activeRuntime.device.id,
+      recipientKemKeyId: activeRuntime.device.kemKeyId,
+      recipientKemPublicKey: responseString(sourceMember, "kem_public_key"),
+      recipientKemPrivateSeed: activeRuntime.device.kemPrivateSeed
+    });
+    if (!decrypted2 || typeof decrypted2 !== "object")
+      fail("PDS source device decrypted an invalid group secret set.");
+    const acknowledged2 = await control({
+      environment,
+      deps: controlDeps,
+      method: "POST",
+      path: `/v1/personal-device-sync/groups/${encodeURIComponent(groupId)}/epoch-acks`,
+      body: {
+        ack: epochAck({
+          groupId,
+          bundleHash: responseString(current, "pending_bundle_hash"),
+          epoch: pending.epoch,
+          deviceId: activeRuntime.device.id,
+          kemKeyId: activeRuntime.device.kemKeyId,
+          kemPublicKey: responseString(sourceMember, "kem_public_key"),
+          signingKeyId: activeRuntime.device.signingKeyId,
+          signingPrivateKey: sourceSigningKey2,
+          acknowledgedAt: now(deps)
+        })
+      }
+    });
+    return {
+      ok: true,
+      state: acknowledged2.activated ? "active" : "pending_joining_device",
+      message: acknowledged2.activated ? "Device approval was already completed." : "Device approval was resumed and source epoch acknowledged.",
+      groupId,
+      deviceId: newDevice.deviceId,
+      epoch: pending.epoch
+    };
+  }
+  const nextEpoch = (BigInt(current.current_epoch) + 1n).toString();
+  const nextSecrets = {
+    epochSecret: b64(randomBytes2(32)),
+    sourceFingerprintKey: b64(randomBytes2(32)),
+    tombstoneFloorKey: b64(randomBytes2(32)),
+    projectAliasKey: b64(randomBytes2(32))
+  };
+  const recipients = [
+    ...groupMembers(current).map((member) => ({
+      recipientId: responseString(member, "device_id"),
+      recipientKind: "device",
+      recipientKemKeyId: responseString(member, "kem_key_id"),
+      recipientKemPublicKey: responseString(member, "kem_public_key")
+    })),
+    {
+      recipientId: newDevice.deviceId,
+      recipientKind: "device",
+      recipientKemKeyId: newDevice.kemKeyId,
+      recipientKemPublicKey: newDevice.kemPublicKey
+    },
+    {
+      recipientId: responseString(recovery, "kem_key_id"),
+      recipientKind: "recovery",
+      recipientKemKeyId: responseString(recovery, "kem_key_id"),
+      recipientKemPublicKey: responseString(recovery, "kem_public_key")
+    }
+  ];
+  const sourceSigningKey = pdsEd25519PrivateKey(activeRuntime.device.signingPrivateSeed, responseString(sourceMember, "signing_public_key"));
+  const authorizedBundle = createPdsAuthorizedKeyBundle({
+    groupId,
+    epoch: nextEpoch,
+    transitionKind: "add-device",
+    recipients,
+    secrets: nextSecrets,
+    authorizationKeyId: activeRuntime.device.signingKeyId,
+    authorizationPrivateKey: sourceSigningKey
+  });
+  const head = object(current.head, "group.head");
+  if (typeof head.hash !== "string" || typeof head.sequence !== "string")
+    fail("PDS group head is invalid.");
+  const headHash = head.hash;
+  const headSequence = head.sequence;
+  const draft = {
+    protocol: PDS_PROTOCOL,
+    kind: "add-device",
+    groupId,
+    sequence: (BigInt(headSequence) + 1n).toString(),
+    previousHash: headHash,
+    body: {
+      deviceId: newDevice.deviceId,
+      deviceSigningKeyId: newDevice.signingKeyId,
+      deviceSigningPublicKey: newDevice.signingPublicKey,
+      deviceKemKeyId: newDevice.kemKeyId,
+      deviceKemPublicKey: newDevice.kemPublicKey,
+      operationFamilies: ["pds_relay"],
+      previousEpoch: current.current_epoch,
+      nextEpoch,
+      keyBundleHash: authorizedBundle.authorizationHash
+    }
+  };
+  const statement = {
+    draft,
+    authorization: {
+      signerKeyId: activeRuntime.device.signingKeyId,
+      signature: signPdsGroupDraft(draft, sourceSigningKey)
+    }
+  };
+  const transitioned = await control({
+    environment,
+    deps: controlDeps,
+    method: "POST",
+    path: `/v1/personal-device-sync/groups/${encodeURIComponent(groupId)}/transitions`,
+    body: {
+      statement: canonicalizePdsJson(statement),
+      key_bundle: canonicalizePdsJson(authorizedBundle.bundle),
+      proof: request.proof
+    }
+  });
+  const pendingGroup = object(transitioned.group, "group");
+  const finalizedBundle = object(transitioned.key_bundle, "key_bundle");
+  if (pendingGroup.pending_epoch !== nextEpoch || pendingGroup.pending_bundle_hash !== authorizedBundle.authorizationHash)
+    fail("PDS transition did not enter the expected pending epoch.");
+  const decrypted = decryptPdsKeyBundleSecretSet({
+    bundle: finalizedBundle,
+    authorizationPublicKey: responseString(sourceMember, "signing_public_key"),
+    authorityPublicKey: activeRuntime.authority.publicKey,
+    recipientId: activeRuntime.device.id,
+    recipientKemKeyId: activeRuntime.device.kemKeyId,
+    recipientKemPublicKey: responseString(sourceMember, "kem_public_key"),
+    recipientKemPrivateSeed: activeRuntime.device.kemPrivateSeed
+  });
+  if (canonicalizePdsJson(decrypted) !== canonicalizePdsJson(nextSecrets))
+    fail("PDS source device decrypted an unexpected group secret set.");
+  const acknowledged = await control({
+    environment,
+    deps: controlDeps,
+    method: "POST",
+    path: `/v1/personal-device-sync/groups/${encodeURIComponent(groupId)}/epoch-acks`,
+    body: {
+      ack: epochAck({
+        groupId,
+        bundleHash: authorizedBundle.authorizationHash,
+        epoch: nextEpoch,
+        deviceId: activeRuntime.device.id,
+        kemKeyId: activeRuntime.device.kemKeyId,
+        kemPublicKey: responseString(sourceMember, "kem_public_key"),
+        signingKeyId: activeRuntime.device.signingKeyId,
+        signingPrivateKey: sourceSigningKey,
+        acknowledgedAt: now(deps)
+      })
+    }
+  });
+  if (acknowledged.activated !== false)
+    fail("PDS epoch activated before the joining device acknowledged it.");
+  return {
+    ok: true,
+    state: "pending_joining_device",
+    message: "Device approved and source epoch acknowledged. Complete enrollment on the joining device.",
+    groupId,
+    deviceId: newDevice.deviceId,
+    epoch: nextEpoch
+  };
+};
+var completeDeviceJoin = async (args, paths, environment, deps) => {
+  const groupId = groupIdFrom(args);
+  const challengeId = requiredFlag(args, "--challenge-id");
+  const runtimeReference = environment.PDS_RUNTIME_SECRET_REF?.trim() || fail("PDS_RUNTIME_SECRET_REF is required for enrollment.");
+  const pendingReference = pendingSecretReference(runtimeReference, challengeId);
+  const pending = await pendingEnrollmentSecret(pendingReference, environment, deps);
+  if (pending.groupId !== groupId || pending.challengeId !== challengeId)
+    fail("PDS pending enrollment does not match completion request.");
+  const controlDeps = deps.desktopAuthorization || deps.pairingToken ? deps : {
+    ...deps,
+    sessionCookie: deps.sessionCookie ?? browserSession(environment)
+  };
+  const groupResponse = await control({
+    environment,
+    deps: controlDeps,
+    method: "GET",
+    path: `/v1/personal-device-sync/groups/${encodeURIComponent(groupId)}`
+  });
+  const group = object(groupResponse.group, "group");
+  const member = groupMember(group, pending.deviceId);
+  const alreadyActivated = group.state === "active" && group.pending_epoch === null && typeof group.current_epoch === "string" && member.status === "active";
+  let pendingEpoch;
+  let activeGroup;
+  let nextRuntime;
+  if (alreadyActivated) {
+    pendingEpoch = group.current_epoch;
+    const currentRuntime = await runtimeSecret(runtimeReference, environment, deps);
+    if (currentRuntime.groupId !== groupId || currentRuntime.device.id !== pending.deviceId || currentRuntime.groupSecrets.currentEpoch !== pendingEpoch) {
+      fail("PDS activated enrollment cannot be resumed safely.");
+    }
+    activeGroup = group;
+    nextRuntime = currentRuntime;
+  } else {
+    if (typeof group.pending_epoch !== "string" || typeof group.pending_bundle_hash !== "string") {
+      fail("PDS group has no pending enrollment epoch.");
+    }
+    pendingEpoch = group.pending_epoch;
+    const pendingBundleHash = group.pending_bundle_hash;
+    const bundleResponse = await control({
+      environment,
+      deps: controlDeps,
+      method: "GET",
+      path: `/v1/personal-device-sync/groups/${encodeURIComponent(groupId)}/key-bundles/${encodeURIComponent(pendingEpoch)}`
+    });
+    const bundle = object(bundleResponse.key_bundle, "key_bundle");
+    const authorization = object(bundle.authorization, "key_bundle.authorization");
+    const author = groupMembers(group).find((candidate) => candidate.signing_key_id === authorization.signerKeyId && candidate.status === "active");
+    if (!author)
+      fail("PDS Key Bundle author is not an active member.");
+    const secrets = decryptPdsKeyBundleSecretSet({
+      bundle,
+      authorizationPublicKey: responseString(author, "signing_public_key"),
+      authorityPublicKey: pending.authorityPublicKey,
+      recipientId: pending.deviceId,
+      recipientKemKeyId: pending.kemKeyId,
+      recipientKemPublicKey: pending.kemPublicKey,
+      recipientKemPrivateSeed: pending.kemPrivateSeed
+    });
+    const joiningSigningKey = pdsEd25519PrivateKey(pending.signingPrivateSeed, pending.signingPublicKey);
+    const ackResponse = await control({
+      environment,
+      deps: controlDeps,
+      method: "POST",
+      path: `/v1/personal-device-sync/groups/${encodeURIComponent(groupId)}/epoch-acks`,
+      body: {
+        ack: epochAck({
+          groupId,
+          bundleHash: pendingBundleHash,
+          epoch: pendingEpoch,
+          deviceId: pending.deviceId,
+          kemKeyId: pending.kemKeyId,
+          kemPublicKey: pending.kemPublicKey,
+          signingKeyId: pending.signingKeyId,
+          signingPrivateKey: joiningSigningKey,
+          acknowledgedAt: now(deps)
+        })
+      }
+    });
+    if (ackResponse.activated !== true)
+      fail("PDS epoch did not activate after all device acknowledgements.");
+    activeGroup = object(ackResponse.group, "group");
+    nextRuntime = {
+      version: 1,
+      userId: pending.userId,
+      relayUrl: pending.relayUrl,
+      groupId,
+      device: {
+        id: pending.deviceId,
+        originDeploymentId: pending.originDeploymentId,
+        signingKeyId: pending.signingKeyId,
+        signingPrivateSeed: pending.signingPrivateSeed,
+        kemKeyId: pending.kemKeyId,
+        kemPrivateSeed: pending.kemPrivateSeed
+      },
+      authority: {
+        keyId: pending.authorityKeyId,
+        publicKey: pending.authorityPublicKey,
+        head: ""
+      },
+      recovery: {
+        signingKeyId: responseString(object(activeGroup.recovery, "group.recovery"), "signing_key_id"),
+        signingPublicKey: responseString(object(activeGroup.recovery, "group.recovery"), "signing_public_key")
+      },
+      groupSecrets: {
+        currentEpoch: pendingEpoch,
+        contentKey: secrets.epochSecret,
+        sourceFingerprintKey: secrets.sourceFingerprintKey,
+        tombstoneFloorKey: secrets.tombstoneFloorKey,
+        projectAliasKey: secrets.projectAliasKey
+      },
+      certificate: "",
+      recipientCertificates: []
+    };
+  }
+  const activeHead = object(activeGroup.head, "group.head");
+  if (activeGroup.current_epoch !== pendingEpoch || activeGroup.pending_epoch !== null || typeof activeHead.hash !== "string")
+    fail("PDS activated group response is invalid.");
+  const activeHeadHash = activeHead.hash;
+  const certificates = await Promise.all(groupMembers(activeGroup).map(async (activeMember) => {
+    const response = await control({
+      environment,
+      deps: controlDeps,
+      method: "GET",
+      path: `/v1/personal-device-sync/groups/${encodeURIComponent(groupId)}/certificates/${encodeURIComponent(responseString(activeMember, "device_id"))}`
+    });
+    return canonicalizePdsJson(object(response.certificate, "certificate"));
+  }));
+  const logResponse = await control({
+    environment,
+    deps: controlDeps,
+    method: "GET",
+    path: `/v1/personal-device-sync/groups/${encodeURIComponent(groupId)}/log`
+  });
+  const statementEntries = logResponse.statements;
+  if (!Array.isArray(statementEntries)) {
+    return fail("PDS activated group statement log is invalid.");
+  }
+  const statements = statementEntries.map((value) => {
+    const statement = object(value, "group statement log entry");
+    if (!exactKeys2(statement, [
+      "sequence",
+      "statementHash",
+      "canonicalStatement"
+    ]) || !["sequence", "statementHash", "canonicalStatement"].every((field) => strictString(statement[field]))) {
+      fail("PDS activated group statement log is invalid.");
+    }
+    return {
+      sequence: statement.sequence,
+      statementHash: statement.statementHash,
+      canonicalStatement: statement.canonicalStatement
+    };
+  });
+  nextRuntime = validatedRuntimeSecret({
+    ...nextRuntime,
+    authority: {
+      keyId: pending.authorityKeyId,
+      publicKey: pending.authorityPublicKey,
+      head: activeHeadHash
+    }
+  }, certificates);
+  await (deps.putSecret ?? putProviderSecret)(runtimeReference, JSON.stringify(nextRuntime), environment);
+  return {
+    ok: true,
+    state: "active",
+    message: "Joining device activated. The secure runtime is active.",
+    groupId,
+    deviceId: pending.deviceId,
+    epoch: pendingEpoch,
+    localGroupReconciliation: {
+      local_device_id: pending.deviceId,
+      group: activeGroup,
+      statements,
+      certificates
+    }
+  };
+};
+var bindLocalRuntimeUser = async (args, paths, environment, deps) => {
+  const groupId = groupIdFrom(args);
+  const userId = requiredFlag(args, "--user-id");
+  const challengeId = flag(args, "--challenge-id")?.trim();
+  if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(userId)) {
+    fail("--user-id is invalid.");
+  }
+  const runtimeReference = environment.PDS_RUNTIME_SECRET_REF?.trim() || fail("PDS_RUNTIME_SECRET_REF is required for local identity binding.");
+  const runtime = await runtimeSecret(runtimeReference, environment, deps);
+  if (runtime.groupId !== groupId) {
+    fail("PDS local identity binding targets another group.");
+  }
+  const rebound = validatedRuntimeSecret({
+    version: runtime.version,
+    userId,
+    relayUrl: runtime.relayUrl,
+    groupId: runtime.groupId,
+    device: runtime.device,
+    authority: runtime.authority,
+    recovery: runtime.recovery,
+    ...runtime.historicalOriginCertificates ? {
+      historicalOriginCertificates: runtime.historicalOriginCertificates
+    } : {},
+    groupSecrets: runtime.groupSecrets
+  }, runtime.recipientCertificates);
+  await (deps.putSecret ?? putProviderSecret)(runtimeReference, JSON.stringify(rebound), environment);
+  if (challengeId) {
+    await (deps.deleteSecret ?? deleteProviderSecret)(pendingSecretReference(runtimeReference, challengeId), environment);
+    const pendingState = readPending(paths);
+    writePending(paths, {
+      version: PENDING_VERSION,
+      pending: pendingState.pending.filter((entry) => entry.requestId !== challengeId)
+    });
+  }
+  return {
+    ok: true,
+    state: "active",
+    message: "Personal Device Sync is bound to the local User.",
+    groupId,
+    deviceId: runtime.device.id
+  };
+};
+var refreshActiveDevice = async (environment, deps) => {
+  const runtimeReference = environment.PDS_RUNTIME_SECRET_REF?.trim() || fail("PDS_RUNTIME_SECRET_REF is required for refresh.");
+  const runtime = await runtimeSecret(runtimeReference, environment, deps);
+  const controlDeps = deps.desktopAuthorization || deps.pairingToken ? deps : {
+    ...deps,
+    sessionCookie: deps.sessionCookie ?? browserSession(environment)
+  };
+  const groupResponse = await control({
+    environment,
+    deps: controlDeps,
+    method: "GET",
+    path: `/v1/personal-device-sync/groups/${encodeURIComponent(runtime.groupId)}`
+  });
+  const group = object(groupResponse.group, "group");
+  if (group.state !== "active" || group.pending_epoch !== null || typeof group.current_epoch !== "string")
+    fail("PDS group is not ready for runtime refresh.");
+  const currentEpoch = group.current_epoch;
+  if (BigInt(currentEpoch) < BigInt(runtime.groupSecrets.currentEpoch))
+    fail("PDS Authority epoch is behind the local runtime.");
+  if (currentEpoch === runtime.groupSecrets.currentEpoch)
+    return {
+      ok: true,
+      state: "current",
+      message: "PDS runtime already uses the current epoch.",
+      groupId: runtime.groupId,
+      deviceId: runtime.device.id,
+      epoch: currentEpoch
+    };
+  if (responseString(group, "authority_key_id") !== runtime.authority.keyId || responseString(group, "authority_public_key") !== runtime.authority.publicKey)
+    fail("PDS Authority identity changed unexpectedly.");
+  const member = groupMember(group, runtime.device.id);
+  const bundleResponse = await control({
+    environment,
+    deps: controlDeps,
+    method: "GET",
+    path: `/v1/personal-device-sync/groups/${encodeURIComponent(runtime.groupId)}/key-bundles/${encodeURIComponent(currentEpoch)}`
+  });
+  const bundle = object(bundleResponse.key_bundle, "key_bundle");
+  const authorization = object(bundle.authorization, "key_bundle.authorization");
+  const author = groupMembers(group).find((candidate) => candidate.signing_key_id === authorization.signerKeyId && candidate.status === "active");
+  const activeAuthor = author ?? fail("PDS Key Bundle author is not an active member.");
+  const secrets = decryptPdsKeyBundleSecretSet({
+    bundle,
+    authorizationPublicKey: responseString(activeAuthor, "signing_public_key"),
+    authorityPublicKey: runtime.authority.publicKey,
+    recipientId: runtime.device.id,
+    recipientKemKeyId: runtime.device.kemKeyId,
+    recipientKemPublicKey: responseString(member, "kem_public_key"),
+    recipientKemPrivateSeed: runtime.device.kemPrivateSeed
+  });
+  const members = groupMembers(group);
+  const certificates = await Promise.all(members.map(async (activeMember) => {
+    const response = await control({
+      environment,
+      deps: controlDeps,
+      method: "GET",
+      path: `/v1/personal-device-sync/groups/${encodeURIComponent(runtime.groupId)}/certificates/${encodeURIComponent(responseString(activeMember, "device_id"))}`
+    });
+    return canonicalizePdsJson(object(response.certificate, "certificate"));
+  }));
+  const head = object(group.head, "group.head");
+  if (typeof head.hash !== "string")
+    fail("PDS refreshed group response is invalid.");
+  const runtimeWithoutCertificates = Object.fromEntries(Object.entries(runtime).filter(([key]) => key !== "certificate" && key !== "recipientCertificates"));
+  const nextRuntime = validatedRuntimeSecret({
+    ...runtimeWithoutCertificates,
+    historicalOriginCertificates: [
+      .../* @__PURE__ */ new Set([
+        ...runtime.historicalOriginCertificates ?? [],
+        ...runtime.recipientCertificates
+      ])
+    ],
+    historicalProjectKeys: {
+      ...runtime.historicalProjectKeys,
+      [runtime.groupSecrets.currentEpoch]: runtime.groupSecrets.projectAliasKey
+    },
+    authority: { ...runtime.authority, head: head.hash },
+    groupSecrets: {
+      currentEpoch,
+      contentKey: secrets.epochSecret,
+      sourceFingerprintKey: secrets.sourceFingerprintKey,
+      tombstoneFloorKey: secrets.tombstoneFloorKey,
+      projectAliasKey: secrets.projectAliasKey
+    }
+  }, certificates);
+  await (deps.putSecret ?? putProviderSecret)(runtimeReference, JSON.stringify(nextRuntime), environment);
+  return {
+    ok: true,
+    state: "refreshed",
+    message: "PDS runtime refreshed to the current Authority epoch.",
+    groupId: runtime.groupId,
+    deviceId: runtime.device.id,
+    epoch: currentEpoch
+  };
+};
+var readJsonFd = (args, name) => {
+  const raw = readBoundedFd(requiredFlag(args, name), name);
+  try {
+    const parsed = JSON.parse(raw.toString("utf8"));
+    return object(parsed, name);
+  } finally {
+    raw.fill(0);
+  }
+};
+var withTransientJsonFd = async (paths, payload, operation) => {
+  mkdirSync(paths.runDir, { recursive: true, mode: 448 });
+  const path = resolve(paths.runDir, `pds-cli-${process.pid}-${randomUUID2()}.json`);
+  writeFileSync(path, JSON.stringify(payload), { flag: "wx", mode: 384 });
+  const fd = openSync(path, "r");
+  unlinkSync(path);
+  try {
+    return await operation(fd);
+  } finally {
+    closeSync(fd);
+  }
+};
+var submitTransition = async (args, environment, deps) => {
+  const groupId = groupIdFrom(args);
+  const body = {
+    statement: requiredFlag(args, "--statement-fd") && readJsonFd(args, "--statement-fd").statement,
+    key_bundle: flag(args, "--key-bundle-fd") ? readJsonFd(args, "--key-bundle-fd").key_bundle : void 0,
+    proof: flag(args, "--proof-fd") ? readJsonFd(args, "--proof-fd").proof : void 0
+  };
+  if (typeof body.statement !== "string")
+    fail("--statement-fd must contain a statement field.");
+  if (body.key_bundle !== void 0 && typeof body.key_bundle !== "string")
+    fail("--key-bundle-fd must contain a key_bundle field.");
+  if (body.proof !== void 0 && (!body.proof || typeof body.proof !== "object" || Array.isArray(body.proof)))
+    fail("--proof-fd must contain a proof object.");
+  const response = await control({
+    environment,
+    deps,
+    method: "POST",
+    path: `/v1/personal-device-sync/groups/${encodeURIComponent(groupId)}/transitions`,
+    body
+  });
+  return {
+    ok: true,
+    state: response.group ? "pending_activation" : "backend",
+    message: "Authority accepted transition; poll backend durable status.",
+    ...response
+  };
+};
+var pairingLinkFromArgs = (args) => {
+  if (args.some((arg) => arg === "--link" || arg.startsWith("--link=")))
+    fail("--link is obsolete; use --link-stdin or --link-fd.");
+  const stdin = args.includes("--link-stdin");
+  const fd = flag(args, "--link-fd");
+  if (Number(stdin) + Number(fd !== void 0) !== 1) {
+    fail("Use exactly one of --link-stdin or --link-fd.");
+  }
+  const raw = readBoundedFd(stdin ? "0" : fd, "--link-fd", 4096);
+  try {
+    return raw.toString("utf8").trim();
+  } finally {
+    raw.fill(0);
+  }
+};
+var redeemPairingFromCli = async (args, paths, environment, deps) => {
+  return redeemPairingLink(pairingLinkFromArgs(args), flag(args, "--device-label")?.trim() || "SSH device", paths, environment, deps);
+};
+var redeemPairingLink = async (link, deviceLabel, paths, environment, deps = {}) => {
+  if (deviceLabel.length > 80 || /[\r\n\0]/.test(deviceLabel)) {
+    fail("--device-label is invalid.");
+  }
+  const localControlUrl = parseLoopbackOrigin(environment.PDS_LOCAL_CONTROL_URL?.trim() || resolveApiUrl(environment, loadRepoEnv(paths.repoRoot, environment)));
+  return await redeemPersonalDevicePairing({
+    link,
+    deviceLabel,
+    requestId: randomUUID2(),
+    localControlUrl,
+    koedHome: paths.koedHome,
+    environment,
+    fetch: deps.fetch,
+    runPersonalSync: async (nestedArgs, options) => await runPersonalSyncCommand(nestedArgs, paths, options.environment, {
+      ...deps,
+      desktopAuthorization: void 0,
+      pairingToken: options.pairingToken,
+      fetch: options.fetch
+    }),
+    withJsonFd: async (payload, operation) => await withTransientJsonFd(paths, payload, operation)
+  });
+};
+var runPersonalSyncCommand = async (args, paths, environment = process.env, deps = {}) => {
+  rejectPasswordArguments(args);
+  const [area, action] = args;
+  if (area === "group" && action === "bootstrap")
+    return bootstrapGroup(args.slice(2), paths, environment, deps);
+  if (area === "status") {
+    if (!deps.desktopAuthorization && !deps.pairingToken && !deps.sessionCookie && environment.PDS_BROWSER_SESSION_FD === void 0) {
+      let runtime;
+      try {
+        runtime = JSON.parse(readFileSync(paths.runtimeStatePath, "utf8"));
+      } catch {
+        return fail("Start Koed first with koed start --daemon, then retry personal-sync status.");
+      }
+      if (runtime.runtimeMode !== "local-personal" || !runtime.apiUrl)
+        return fail("Automatic Personal Sync status requires a local Personal installation. Advanced remote access requires a browser session FD.");
+      const origin = parseLoopbackOrigin(runtime.apiUrl);
+      if (environment.PDS_CONTROL_URL?.trim() && parseLoopbackOrigin(environment.PDS_CONTROL_URL.trim()) !== origin)
+        return fail("PDS_CONTROL_URL does not match this installation\u2019s local API. Local credentials cannot be sent there.");
+      const credential = readDesktopLocalCredentialAuthorization(paths.koedHome);
+      if (!credential)
+        return fail("Local Personal credentials are unavailable. Run koed setup core and retry.");
+      return status({
+        ...environment,
+        PDS_CONTROL_URL: origin,
+        PDS_RUNTIME_SECRET_REF: environment.PDS_RUNTIME_SECRET_REF?.trim() || "pds-runtime"
+      }, { ...deps, desktopAuthorization: credential.authorization });
+    }
+    return status(environment, deps);
+  }
+  if (area === "invite" && action === "create")
+    return createPairingInvitation(args.slice(2), environment, deps);
+  if (area === "join" && action === "request")
+    return createJoinChallenge(args.slice(2), paths, environment, deps);
+  if (area === "join" && action === "redeem")
+    return redeemPairingFromCli(args.slice(2), paths, environment, deps);
+  if (area === "join" && action === "complete")
+    return completeDeviceJoin(args.slice(2), paths, environment, deps);
+  if (area === "join" && action === "bind-local-user")
+    return bindLocalRuntimeUser(args.slice(2), paths, environment, deps);
+  if (area === "join" && action === "challenge")
+    return {
+      ok: true,
+      state: "pending",
+      message: "Pending pairing artifacts are local redacted request IDs only.",
+      requests: readPending(paths).pending
+    };
+  if (area === "active-device" && action === "approve")
+    return approveActiveDevice(args.slice(2), environment, deps);
+  if (area === "active-device" && action === "refresh")
+    return refreshActiveDevice(environment, deps);
+  if (area === "recovery" && action === "approve")
+    return submitTransition(args.slice(2), environment, deps);
+  if (area === "device" && action === "list") {
+    const groupId = groupIdFrom(args.slice(2));
+    const response = await control({
+      environment,
+      deps,
+      method: "GET",
+      path: `/v1/personal-device-sync/groups/${encodeURIComponent(groupId)}`
+    });
+    const group = object(response.group, "group");
+    return {
+      ok: true,
+      state: "backend",
+      message: "Devices are Authority-owned.",
+      devices: group.members ?? []
+    };
+  }
+  if (area === "device" && action === "revoke")
+    return submitTransition(args.slice(2), environment, deps);
+  if (area === "policy" && ["enable", "pause", "resume"].includes(action ?? "")) {
+    const groupId = groupIdFrom(args.slice(2));
+    const enabled = action === "enable" || action === "resume";
+    const response = action === "pause" || action === "resume" ? await control({
+      environment,
+      deps,
+      method: "PUT",
+      path: `/v1/personal-device-sync/groups/${encodeURIComponent(groupId)}/pause`,
+      body: { paused: !enabled }
+    }) : await control({
+      environment,
+      deps,
+      method: "PUT",
+      path: `/v1/personal-device-sync/groups/${encodeURIComponent(groupId)}/policy`,
+      body: {
+        enabled,
+        future_closed_sessions_only: true,
+        historical_backfill_enabled: false
+      }
+    });
+    return {
+      ok: true,
+      state: "backend",
+      message: "Policy result is backend-owned; poll status for durable outcome.",
+      ...response
+    };
+  }
+  if (area === "retry") {
+    const groupId = groupIdFrom(args.slice(1));
+    const response = await control({
+      environment,
+      deps,
+      method: "POST",
+      path: `/v1/personal-device-sync/groups/${encodeURIComponent(groupId)}/retry`
+    });
+    return {
+      ok: true,
+      state: "backend",
+      message: "Retry submitted to backend.",
+      ...response
+    };
+  }
+  if (area === "replica" && action === "status") {
+    const groupId = groupIdFrom(args.slice(2));
+    const response = await control({
+      environment,
+      deps,
+      method: "GET",
+      path: `/v1/personal-device-sync/groups/${encodeURIComponent(groupId)}/local-status`
+    });
+    return {
+      ok: true,
+      state: "backend",
+      message: "Replica status is backend-owned.",
+      ...response
+    };
+  }
+  if (area === "recovery" && action === "guidance")
+    return {
+      ok: true,
+      state: "guidance",
+      message: "Use active-device signed transition when possible. Otherwise use recovery signer through protected FD. Browser sessions only bind requests; API Tokens and legacy credentials are rejected."
+    };
+  if (area === "recovery-kit" && action === "verify") {
+    const kitPath = requiredFlag(args.slice(2), "--recovery-kit");
+    if (!secureRegularFile(kitPath))
+      fail("Recovery kit permissions are unsafe; require 0600.");
+    const password = passwordFrom(args.slice(2));
+    try {
+      const plaintext = decryptRecoveryKit(JSON.parse(readFileSync(kitPath, "utf8")), password);
+      return {
+        ok: true,
+        state: "verified",
+        message: "Recovery kit cryptographically verified. Backend transition remains required.",
+        fingerprint: fingerprint(plaintext)
+      };
+    } finally {
+      password.fill(0);
+    }
+  }
+  if (area === "recovery-kit" && action === "create") {
+    const output = requiredFlag(args.slice(2), "--output");
+    const payload = readJsonFd(args.slice(2), "--payload-fd");
+    const password = passwordFrom(args.slice(2));
+    try {
+      const plaintext = JSON.stringify(payload);
+      const kit = encryptRecoveryKit(plaintext, password);
+      if (decryptRecoveryKit(kit, password) !== plaintext)
+        fail("Recovery kit round-trip verification failed.");
+      writeRecoveryKit(output, kit);
+      return {
+        ok: true,
+        state: "created",
+        message: "Recovery kit encrypted and verified.",
+        fingerprint: kit.fingerprint
+      };
+    } finally {
+      password.fill(0);
+    }
+  }
+  return fail("personal-sync command is invalid or requires backend signed transition input.");
+};
+
+export {
+  parseLoopbackOrigin,
+  encryptRecoveryKit,
+  decryptRecoveryKit,
+  personalSyncProviderEnvironment,
+  redeemPairingLink,
+  runPersonalSyncCommand
+};