@mnmal-ai/substrate-tui 0.0.0 → 1.0.0-alpha.1

package/dist/app-BLOyJcBh.js

@@ -0,0 +1,3690 @@
+#!/usr/bin/env node
+import { i as isKeyRejection, t as adminCapabilityOf } from "./session-C1D5Ermr.js";
+import { resolve } from "node:path";
+import { AdminBackfillError, AuthError, CURRENT_MARK, NetworkError, STEP_MARKS, adminClaimCapabilities, capabilitiesFor, checkRevocable, checkUpdatable, currentStep, decodeList, describeGrant, diagnose, encodeGrant, flattenGrant, grantEntriesConfer, isActiveAdminKeyRow, isEncryptedKey, makeTokenProvider, parseGrantEntries, planOnboarding, resolveAdminCredential } from "@mnmal-ai/substrate/client";
+import { createApp, defineModule, sanitise } from "@mnmal-ai/surface-core";
+import { marathon } from "@mnmal-ai/surface-theme";
+import { complete } from "@mnmal-ai/substrate-nl/complete";
+import { Panel, cellWidth, padCells, sparkline, truncateCells } from "@mnmal-ai/surface-kit";
+import { Box, Text } from "ink";
+import { Fragment, jsx, jsxs } from "react/jsx-runtime";
+import { readFile } from "node:fs/promises";
+import { createHash, createPublicKey } from "node:crypto";
+import { homedir } from "node:os";
+import { readFileSync } from "node:fs";
+
+//#region src/admin/module.ts
+/**
+* `/admin unlock|lock|status`. Unlock resolves the admin credential the way
+* `substrate-admin` does, asks for a passphrase on a masked panel when the key is encrypted, and
+* verifies the identity with `diagnose` before the session holds anything: a key that is not an
+* admin fails here, not at the first write.
+*/
+const STATUS_ID = "admin";
+function badge(deps, now) {
+	const s = deps.admin.state();
+	if (s.kind !== "unlocked") return null;
+	return `admin ${s.kid} · ${Math.max(0, Math.ceil((s.idleUntil - now) / 6e4))}m`;
+}
+/** The first check that answered no, as one printable line with its fix. */
+function refusal$1(r) {
+	const no = r.checks.find((c) => c.status === "no");
+	if (no === void 0) return "admin not confirmed: the admin check did not run";
+	return `${no.name}: ${no.detail}${no.fix !== void 0 ? ` — fix: ${no.fix}` : ""}`;
+}
+function adminModule(deps, io = {}) {
+	const diagnose$2 = io.diagnose ?? diagnose;
+	/**
+	* Bumped by exactly three things: Esc on the passphrase panel, `/admin lock` (whether or not
+	* admin is held) and teardown. An attempt whose captured value is stale grants nothing.
+	*/
+	let generation = 0;
+	/** Verifications awaiting diagnose, so `/admin lock` can say it cancelled one. */
+	let pending = 0;
+	/** Verify, then hold. Resolves to null on success, undefined when abandoned, else the refusal line. */
+	const verifyAndUnlock = async (getAuthorization, label, fallbackKid, getToken) => {
+		const mine = generation;
+		pending += 1;
+		try {
+			return await verify(mine, getAuthorization, label, fallbackKid, getToken);
+		} finally {
+			pending -= 1;
+		}
+	};
+	const verify = async (mine, getAuthorization, label, fallbackKid, getToken) => {
+		let r;
+		try {
+			r = await diagnose$2({
+				baseUrl: deps.endpoint,
+				credential: {
+					authorization: getAuthorization,
+					label
+				},
+				...adminCapabilityOf(deps.adminEnv)
+			});
+		} catch (err) {
+			return mine === generation ? `could not verify: ${err instanceof Error ? err.message : String(err)}` : void 0;
+		}
+		if (mine !== generation) return void 0;
+		if (r.checks.find((c) => c.name === "admin-capability")?.status !== "ok") return refusal$1(r);
+		deps.admin.unlock(r.identity ?? fallbackKid ?? "admin", getToken);
+		return null;
+	};
+	const unlockWithKey = async (keyPath, kid, passphrase) => {
+		const getToken = makeTokenProvider({
+			keyPath,
+			kid
+		}, {
+			capabilities: adminClaimCapabilities(deps.adminEnv),
+			...passphrase !== void 0 ? { passphrase } : {}
+		});
+		return verifyAndUnlock(() => `Bearer ${getToken()}`, keyPath, kid, getToken);
+	};
+	return defineModule("substrate.admin", {
+		commands: [{
+			name: "admin",
+			summary: "unlock or lock the admin identity",
+			args: [{
+				name: "unlock|lock|status",
+				optional: true
+			}],
+			async run([action], ctx) {
+				if (action === "lock") {
+					generation += 1;
+					if (!deps.admin.unlocked()) return ctx.print(pending > 0 ? "admin unlock cancelled" : "admin is already locked", "dim");
+					deps.admin.lock("locked by /admin lock");
+					return;
+				}
+				if (action === void 0 || action === "status") return ctx.print(badge(deps, Date.now()) ?? "admin is locked — /admin unlock");
+				if (action !== "unlock") return ctx.print(`unknown /admin action '${sanitise(action)}'`, "warn");
+				if (deps.admin.unlocked()) return ctx.print("admin is already unlocked", "dim");
+				const cred = resolveAdminCredential(deps.adminEnv);
+				if (cred.kind === "error") return ctx.print(sanitise(cred.error), "error");
+				if (cred.kind === "token") {
+					const authorization = cred.authorization;
+					const bare = authorization.replace(/^Bearer /, "");
+					const why = await verifyAndUnlock(() => authorization, "SUBSTRATE_ADMIN_TOKEN", null, () => bare);
+					if (why !== null && why !== void 0) ctx.print(sanitise(why), "error");
+					return;
+				}
+				let encrypted;
+				try {
+					encrypted = isEncryptedKey(cred.keyPath);
+				} catch (err) {
+					return ctx.print(`cannot read ${sanitise(cred.keyPath)}: ${sanitise(err instanceof Error ? err.message : String(err))}`, "error");
+				}
+				if (encrypted) {
+					ctx.open("passphrase", {
+						keyPath: cred.keyPath,
+						kid: cred.kid,
+						error: null,
+						busy: false
+					});
+					return;
+				}
+				let why;
+				try {
+					why = await unlockWithKey(cred.keyPath, cred.kid, void 0);
+				} catch (err) {
+					why = `could not sign with ${cred.keyPath}: ${err instanceof Error ? err.message : String(err)}`;
+				}
+				if (why !== null && why !== void 0) ctx.print(sanitise(why), "error");
+			}
+		}],
+		panels: { passphrase: {
+			mask: true,
+			view: ({ state, theme }) => [
+				`${theme.glyph.title} admin unlock · ${sanitise(state.kid)}`,
+				`passphrase for ${sanitise(state.keyPath)}${state.busy ? " · checking…" : ""}`,
+				...state.error !== null ? [sanitise(state.error)] : [],
+				"  type it and press enter · esc cancels"
+			].join("\n"),
+			escape: () => {
+				generation += 1;
+			},
+			submit: (state, line, ctx) => {
+				if (state.busy) return void 0;
+				let getToken;
+				try {
+					getToken = makeTokenProvider({
+						keyPath: state.keyPath,
+						kid: state.kid
+					}, {
+						capabilities: adminClaimCapabilities(deps.adminEnv),
+						passphrase: line
+					});
+				} catch {
+					return {
+						...state,
+						error: "wrong passphrase, or the key is unreadable"
+					};
+				}
+				verifyAndUnlock(() => `Bearer ${getToken()}`, state.keyPath, state.kid, getToken).then((why) => {
+					if (why === void 0) return;
+					if (why === null) ctx.close();
+					else ctx.update("passphrase", (s) => ({
+						...s,
+						busy: false,
+						error: why
+					}));
+				});
+				return {
+					...state,
+					busy: true,
+					error: null
+				};
+			}
+		} },
+		init(ctx) {
+			const show = () => ctx.status(STATUS_ID, badge(deps, Date.now()), "warn");
+			const off = deps.admin.onChange((s) => {
+				show();
+				if (s.kind === "locked" && s.reason !== null) ctx.print(sanitise(s.reason.startsWith("admin locked") ? s.reason : `admin locked: ${s.reason}`), "warn");
+			});
+			const tickTimer = setInterval(show, 3e4);
+			return () => {
+				generation += 1;
+				off();
+				clearInterval(tickTimer);
+				deps.admin.dispose();
+			};
+		}
+	});
+}
+
+//#endregion
+//#region src/ask/adapt.ts
+/** End of the whitespace-delimited token the cursor sits in. */
+function tokenEnd(draft, cursor) {
+	let i = Math.max(0, Math.min(cursor, draft.length));
+	while (i < draft.length && !/\s/.test(draft[i])) i++;
+	return i;
+}
+/**
+* A substrate-nl suggestion computed from the text before the cursor, as a core suggestion over the
+* whole draft: its span keeps its start and runs to the end of the token under the cursor
+* so `status:op|p` completes to `status:open`, not `status:openp`.
+*/
+function adapt(draft, cursor, s) {
+	return {
+		label: s.label,
+		insert: s.insert,
+		replace: [s.replace[0], tokenEnd(draft, cursor)],
+		score: s.score,
+		...s.detail !== void 0 ? { detail: s.detail } : {}
+	};
+}
+
+//#endregion
+//#region src/ask/render.tsx
+const KIND = {
+	line: "substrate.line",
+	rows: "substrate.rows",
+	recall: "substrate.recall",
+	clarify: "substrate.clarify",
+	refuse: "substrate.refuse",
+	error: "substrate.error"
+};
+const str = (v) => v === void 0 || v === null ? "" : sanitise(String(v));
+const frameKey = (o) => sanitise(Object.keys(o.frame)[0] ?? "?");
+const errorLines = (errors) => (errors ?? []).map((e) => {
+	const x = e;
+	return sanitise(`${x.code ?? "error"}${x.message !== void 0 ? `: ${x.message}` : ""}`);
+});
+function outcomeChips(o) {
+	if (o.kind !== "rows") return [];
+	const rejected = !Array.isArray(o.data);
+	return [
+		{
+			label: `▸ ${frameKey(o)}`,
+			tone: "query"
+		},
+		{
+			label: o.handoff !== void 0 ? `${o.source} (${sanitise(o.handoff)})` : o.source,
+			tone: o.source === "handoff" ? "warn" : "dim"
+		},
+		{
+			label: rejected ? "rejected" : `${o.data.length} rows`,
+			tone: rejected ? "error" : "dim"
+		}
+	];
+}
+const COLS = {
+	id: 6,
+	status: 10,
+	project: 14,
+	gaps: 6,
+	minTitle: 12
+};
+const titleWidth = (columns) => Math.max(COLS.minTitle, columns - (COLS.id + COLS.status + COLS.project + COLS.gaps));
+const rows = ({ data, theme, size }) => {
+	const titleCols = titleWidth(size.columns);
+	const o = data;
+	if (!Array.isArray(o.data)) return /* @__PURE__ */ jsxs(Box, {
+		flexDirection: "column",
+		children: [/* @__PURE__ */ jsxs(Text, {
+			color: theme.color.error,
+			children: [theme.glyph.fail, " rejected"]
+		}), errorLines(o.errors).map((l, i) => /* @__PURE__ */ jsx(Text, {
+			color: theme.color.error,
+			children: `  ${l}`
+		}, i))]
+	});
+	const list = o.data;
+	if (list.length === 0) return /* @__PURE__ */ jsx(Text, {
+		color: theme.color.dim,
+		children: "no rows"
+	});
+	return /* @__PURE__ */ jsx(Box, {
+		flexDirection: "column",
+		children: list.map((r, i) => /* @__PURE__ */ jsxs(Text, { children: [
+			/* @__PURE__ */ jsx(Text, {
+				color: theme.color.dim,
+				children: padCells(str(r.shortId ?? r.id), COLS.id, true)
+			}),
+			"  ",
+			/* @__PURE__ */ jsx(Text, {
+				color: theme.color.text,
+				children: padCells(str(r.title ?? r.synopsis ?? r.name ?? r.topic ?? r.subject), titleCols)
+			}),
+			"  ",
+			/* @__PURE__ */ jsx(Text, {
+				color: theme.color.info,
+				children: padCells(str(r.status), COLS.status)
+			}),
+			"  ",
+			/* @__PURE__ */ jsx(Text, {
+				color: theme.color.dimMid,
+				children: padCells(str(r.project), COLS.project)
+			})
+		] }, i))
+	});
+};
+const recall = ({ data, theme }) => {
+	const o = data;
+	if (o.hits === void 0) return /* @__PURE__ */ jsxs(Box, {
+		flexDirection: "column",
+		children: [/* @__PURE__ */ jsxs(Text, {
+			color: theme.color.error,
+			children: [theme.glyph.fail, " recall rejected"]
+		}), errorLines(o.errors).map((l, i) => /* @__PURE__ */ jsx(Text, {
+			color: theme.color.error,
+			children: `  ${l}`
+		}, i))]
+	});
+	return /* @__PURE__ */ jsxs(Box, {
+		flexDirection: "column",
+		children: [/* @__PURE__ */ jsxs(Text, {
+			color: theme.color.query,
+			children: [
+				theme.glyph.query,
+				" recall · ",
+				o.hits.length,
+				" hits"
+			]
+		}), o.hits.map((h, i) => /* @__PURE__ */ jsxs(Text, { children: [
+			"  ",
+			padCells(str(h.type), 14),
+			" ",
+			padCells(str(h.id), 38),
+			" ",
+			Number(h.score ?? 0).toFixed(2)
+		] }, i))]
+	});
+};
+const clarify = ({ data, theme }) => {
+	const o = data;
+	return /* @__PURE__ */ jsxs(Box, {
+		flexDirection: "column",
+		children: [
+			/* @__PURE__ */ jsxs(Text, {
+				color: theme.color.warn,
+				children: ["? ", str(o.reason)]
+			}),
+			o.options.map((opt, i) => /* @__PURE__ */ jsxs(Text, { children: [
+				"  ",
+				i + 1,
+				". ",
+				str(opt.label)
+			] }, i)),
+			o.options.length > 0 ? /* @__PURE__ */ jsxs(Text, {
+				color: theme.color.dim,
+				children: [
+					"  ",
+					"press 1–",
+					Math.min(9, o.options.length),
+					" to choose"
+				]
+			}) : null
+		]
+	});
+};
+const refuse = ({ data, theme }) => /* @__PURE__ */ jsxs(Text, {
+	color: theme.color.warn,
+	children: [
+		theme.glyph.fail,
+		" ",
+		str(data.reason)
+	]
+});
+const line$2 = ({ data, theme }) => /* @__PURE__ */ jsx(Text, {
+	color: theme.color.dim,
+	children: str(data)
+});
+const error = ({ data, theme }) => /* @__PURE__ */ jsxs(Text, {
+	color: theme.color.error,
+	children: [
+		theme.glyph.fail,
+		" ",
+		str(data)
+	]
+});
+const renderers = {
+	[KIND.line]: line$2,
+	[KIND.rows]: rows,
+	[KIND.recall]: recall,
+	[KIND.clarify]: clarify,
+	[KIND.refuse]: refuse,
+	[KIND.error]: error
+};
+
+//#endregion
+//#region src/ask/module.ts
+const DIGITS = [
+	"1",
+	"2",
+	"3",
+	"4",
+	"5",
+	"6",
+	"7",
+	"8",
+	"9"
+];
+function explain(err, endpoint) {
+	const e = err;
+	if (e.status === 404 && e.code !== "nl_unknown_namespace") return `substrate-nl is not installed on ${endpoint}`;
+	if (e.serverMessage !== void 0) return e.serverMessage;
+	if (e.status === 401 || e.status === 403) return `not authorised (${e.status}) — check SUBSTRATE_AGENT_KEY_ID / SUBSTRATE_AGENT_KEY_PATH`;
+	return e.message ?? String(err);
+}
+function askModule(deps) {
+	let namespace = deps.namespace;
+	let pack = null;
+	let forceType;
+	let last = { lines: ["no question asked yet"] };
+	let lastPackNote = "";
+	const loadPack = (ctx) => {
+		pack = null;
+		const ns = namespace;
+		deps.nl.pack(ns, { signal: ctx.signal }).then((p) => {
+			if (ns === namespace) pack = p;
+		}, (err) => {
+			if (ns !== namespace) return;
+			const note = `completion unavailable for ${ns}: ${explain(err, deps.endpoint)}`;
+			if (note === lastPackNote) return;
+			lastPackNote = note;
+			ctx.print(note, "dim");
+		});
+	};
+	const pick = (i) => (s, ctx) => {
+		const opt = s.options[i];
+		if (opt === void 0) return void 0;
+		forceType = opt.type;
+		ctx.close();
+		ctx.submit(opt.question);
+	};
+	return defineModule("substrate.ask", {
+		init(ctx) {
+			loadPack(ctx);
+			ctx.emit("substrate/ns", { namespace });
+		},
+		commands: [{
+			name: "ns",
+			summary: "switch the namespace questions go to",
+			args: [{ name: "namespace" }],
+			run([ns], ctx) {
+				if (ns === void 0 || ns === "") return ctx.print(`namespace: ${namespace}`);
+				namespace = ns;
+				loadPack(ctx);
+				ctx.emit("substrate/ns", { namespace });
+				ctx.print(`namespace → ${namespace}`);
+			}
+		}, {
+			name: "frame",
+			summary: "show the last answer's query frame, evidence and judge trail",
+			args: [],
+			run: (_a, ctx) => ctx.open("frame", last)
+		}],
+		panels: {
+			clarify: {
+				view: ({ state }) => [
+					`? ${sanitise(state.reason)}`,
+					...state.options.slice(0, 9).map((o, i) => `  ${i + 1}. ${sanitise(o.label)}`),
+					"  1–9 choose · esc dismiss"
+				].join("\n"),
+				keymap: DIGITS.map((d, i) => ({
+					key: d,
+					act: `pick${i}`
+				})),
+				on: Object.fromEntries(DIGITS.map((_d, i) => [`pick${i}`, pick(i)]))
+			},
+			frame: { view: ({ state }) => sanitise(state.lines.join("\n")) }
+		},
+		completers: [{
+			id: "nl",
+			complete: (draft, cursor) => {
+				if (pack === null) return [];
+				return complete(draft.slice(0, cursor), cursor, pack).map((s) => adapt(draft, cursor, s));
+			}
+		}],
+		turns: [{
+			id: "ask",
+			claims: (text) => text.trim() === "" ? false : 1,
+			async *answer(text, ctx, signal) {
+				const type = forceType;
+				forceType = void 0;
+				const lines = [];
+				try {
+					for await (const ev of deps.nl.ask({
+						namespace,
+						question: text,
+						project: deps.project,
+						...type !== void 0 ? { type } : {}
+					}, { signal })) switch (ev.event) {
+						case "parsed": {
+							const key = ev.data.frame !== void 0 ? Object.keys(ev.data.frame)[0] : void 0;
+							lines.push(`parse: ${ev.data.status}${ev.data.reason !== void 0 ? ` — ${ev.data.reason}` : ""}`);
+							if (ev.data.frame !== void 0) lines.push(JSON.stringify(ev.data.frame, null, 2));
+							for (const e of ev.data.evidence) lines.push(`  ${e.span} → ${e.role} (${e.detail})`);
+							yield {
+								phase: "partial",
+								reply: {
+									kind: KIND.line,
+									data: `▸ ${key ?? namespace} · parsing…`
+								}
+							};
+							break;
+						}
+						case "judging":
+							lines.push(`judging: ${ev.data.reason}`);
+							yield {
+								phase: "partial",
+								reply: {
+									kind: KIND.line,
+									data: "judging…"
+								}
+							};
+							break;
+						case "judged":
+							lines.push(`judged: ${ev.data.status}`);
+							for (const step of ev.data.trail) lines.push(`  ${JSON.stringify(step)}`);
+							break;
+						case "rows":
+						case "recall":
+						case "clarify":
+						case "refuse":
+							last = { lines };
+							if (ev.event === "clarify" && ev.data.options.length > 0) ctx.open("clarify", ev.data);
+							else ctx.close();
+							yield {
+								phase: "final",
+								reply: {
+									kind: `substrate.${ev.event}`,
+									data: ev.data,
+									chips: outcomeChips(ev.data)
+								}
+							};
+							return;
+						case "done": return;
+					}
+				} catch (err) {
+					if (signal.aborted) return;
+					yield {
+						phase: "failed",
+						reply: {
+							kind: KIND.error,
+							data: explain(err, deps.endpoint)
+						}
+					};
+				}
+			}
+		}],
+		renderers
+	});
+}
+
+//#endregion
+//#region src/text.ts
+/** Server text on one line: no escape or control bytes, and line breaks collapsed to a space. */
+const clean = (s) => sanitise(s.replace(/[\r\n]+/g, " "));
+
+//#endregion
+//#region src/dash/derive.ts
+/** Polls kept per sparkline. */
+const HISTORY = 30;
+/** Metrics samples closer together than this add no history point: the baseline holds until a
+*  later sample spans a meaningful interval (an `r` right after a tick would spike the rate). */
+const MIN_RATE_INTERVAL_MS = 1e3;
+/** Per-key p99 histories kept, most recently seen first. */
+const MAX_KEYS = 50;
+/** The engine event counted as a policy denial. */
+const DENIAL_EVENT = "engine_policy_denied";
+const SORTS = [
+	"p99",
+	"calls",
+	"errors"
+];
+function initialDash(sort = "p99") {
+	return {
+		health: null,
+		metrics: null,
+		embed: null,
+		errors: null,
+		hist: {
+			queryRate: [],
+			mutateRate: [],
+			queryErr: [],
+			mutateErr: [],
+			denials: [],
+			p99: /* @__PURE__ */ new Map()
+		},
+		eventDelta: {},
+		keyErrRose: /* @__PURE__ */ new Set(),
+		sort
+	};
+}
+/** `hist` plus `v`, keeping the last HISTORY values. */
+function push(hist, v) {
+	const next = [...hist, v];
+	return next.length > 30 ? next.slice(next.length - 30) : next;
+}
+/** Growth of a counter; a counter that went down (a restart) clamps to 0. */
+function delta(prev, next) {
+	return prev === void 0 ? 0 : Math.max(0, next - prev);
+}
+/** Latency bands: below 20 ms ok, below 100 ms warn, else error. */
+function latencyTone(ms) {
+	return ms < 20 ? "ok" : ms < 100 ? "warn" : "error";
+}
+/** Largest first by `by`, ties by key name. */
+function sortKeys(r, by) {
+	const metric = (s) => by === "p99" ? s.p99Ms : by === "calls" ? s.calls : s.errors;
+	return Object.entries(r).sort(([ka, a], [kb, b]) => metric(b) - metric(a) || (ka < kb ? -1 : ka > kb ? 1 : 0));
+}
+function nextSort(by) {
+	return SORTS[(SORTS.indexOf(by) + 1) % SORTS.length] ?? "p99";
+}
+/** Maps a failed fetch to why, from the HTTP status the error carries. */
+function classify(err) {
+	const status = err?.status;
+	if (status === 401) return "auth";
+	if (status === 403) return "admin";
+	if (status === 404) return "absent";
+	return "down";
+}
+const num$2 = (v) => typeof v === "number" && Number.isFinite(v) ? v : 0;
+const round2 = (v) => Math.round(v * 100) / 100;
+function totalsOf(m, at) {
+	const events = Object.fromEntries(Object.entries(m.events ?? {}).map(([k, v]) => [k, num$2(v)]));
+	return {
+		at,
+		query: num$2(m.requests?.query?.total),
+		mutate: num$2(m.requests?.mutate?.total),
+		queryErr: num$2(m.requests?.query?.error),
+		mutateErr: num$2(m.requests?.mutate?.error),
+		events,
+		keyErrors: Object.fromEntries(Object.entries(m.resolvers ?? {}).map(([k, st]) => [k, num$2(st?.errors)]))
+	};
+}
+function foldP99(prev, resolvers) {
+	const seen = Object.entries(resolvers).sort(([ka, a], [kb, b]) => (a.lastAt < b.lastAt ? 1 : a.lastAt > b.lastAt ? -1 : 0) || (ka < kb ? -1 : 1));
+	const next = /* @__PURE__ */ new Map();
+	for (const [key, stat] of seen) {
+		if (next.size >= 50) break;
+		next.set(key, push(prev.get(key) ?? [], num$2(stat.p99Ms)));
+	}
+	for (const [key, hist] of prev) {
+		if (next.size >= 50) break;
+		if (!next.has(key)) next.set(key, hist);
+	}
+	return next;
+}
+/** Folds one poll into the state. Histories grow only once a previous metrics poll gives a baseline. */
+function step(prev, sample, now) {
+	const next = {
+		...prev,
+		health: sample.health,
+		metrics: sample.metrics,
+		embed: sample.embed,
+		errors: sample.errors,
+		lastAt: now
+	};
+	if (!sample.metrics.ok) return next;
+	const m = sample.metrics.value;
+	const at = sample.metricsAt ?? now;
+	const cur = totalsOf(m, at);
+	const was = prev.prevTotals;
+	if (was === void 0) {
+		const p99 = foldP99(prev.hist.p99, m.resolvers ?? {});
+		return {
+			...next,
+			prevTotals: cur,
+			eventDelta: {},
+			hist: {
+				...prev.hist,
+				p99
+			}
+		};
+	}
+	if (at - was.at < 1e3) return next;
+	const p99 = foldP99(prev.hist.p99, m.resolvers ?? {});
+	const secs = (at - was.at) / 1e3;
+	const eventDelta = Object.fromEntries(Object.entries(cur.events).map(([k, v]) => [k, delta(Object.hasOwn(was.events, k) ? was.events[k] : 0, v)]));
+	const keyErrRose = new Set(Object.entries(cur.keyErrors).filter(([k, v]) => delta(Object.hasOwn(was.keyErrors, k) ? was.keyErrors[k] : 0, v) > 0).map(([k]) => k));
+	const h = prev.hist;
+	return {
+		...next,
+		prevTotals: cur,
+		eventDelta,
+		keyErrRose,
+		hist: {
+			queryRate: push(h.queryRate, round2(delta(was.query, cur.query) / secs)),
+			mutateRate: push(h.mutateRate, round2(delta(was.mutate, cur.mutate) / secs)),
+			queryErr: push(h.queryErr, delta(was.queryErr, cur.queryErr)),
+			mutateErr: push(h.mutateErr, delta(was.mutateErr, cur.mutateErr)),
+			denials: push(h.denials, eventDelta["engine_policy_denied"] ?? 0),
+			p99
+		}
+	};
+}
+
+//#endregion
+//#region src/dash/module.tsx
+const DASH_INTERVAL_MS = 5e3;
+/** Per source: one hung source must not hold up the others past this. */
+const DASH_TIMEOUT_MS = 4e3;
+/** TRAFFIC inner width from which a per-key row also shows calls and p50. */
+const WIDE_KEY_ROW = 40;
+const num$1 = (v) => typeof v === "number" && Number.isFinite(v) ? v : 0;
+function healthOf(raw) {
+	const h = raw;
+	return {
+		...typeof h?.version === "string" ? { version: h.version } : {},
+		...typeof h?.uptimeSeconds === "number" ? { uptimeSeconds: h.uptimeSeconds } : {}
+	};
+}
+function embedOf(raw) {
+	const e = raw;
+	return {
+		...typeof e?.enabled === "boolean" ? { enabled: e.enabled } : {},
+		writes: num$1(e?.writes),
+		failures: num$1(e?.failures),
+		expansionFailures: num$1(e?.expansionFailures)
+	};
+}
+const seg = (t, tone = "text") => ({
+	t,
+	tone
+});
+/** Segments cut to `max` cells in total, the cut marked with `…`. */
+function fit(line, max) {
+	const out = [];
+	let used = 0;
+	if (line.reduce((n, s) => n + cellWidth(s.t), 0) <= max) return [...line];
+	for (const s of line) {
+		const room = max - used;
+		if (room <= 0) break;
+		const w = cellWidth(s.t);
+		if (w < room) {
+			out.push(s);
+			used += w;
+		} else {
+			out.push({
+				...s,
+				t: truncateCells(`${s.t}…`, room)
+			});
+			break;
+		}
+	}
+	return out;
+}
+const na = (label, why) => [seg(`${label} `, "dim"), seg(`n/a (${why})`, why === "down" ? "warn" : "dim")];
+const ms = (v) => v >= 100 ? `${Math.round(v)}ms` : `${Math.round(v * 10) / 10}ms`;
+const rate = (v) => v >= 100 ? `${Math.round(v)}/s` : `${Math.round(v * 10) / 10}/s`;
+function uptime(s) {
+	const d = Math.floor(s / 86400);
+	const h = Math.floor(s % 86400 / 3600);
+	const m = Math.floor(s % 3600 / 60);
+	if (d > 0) return `${d}d ${h}h`;
+	if (h > 0) return `${h}h ${m}m`;
+	if (m > 0) return `${m}m`;
+	return `${Math.floor(s)}s`;
+}
+const last = (h) => h[h.length - 1] ?? 0;
+function serviceLines(s, theme) {
+	const out = [];
+	if (s.health === null) out.push([seg("…", "dim")]);
+	else if (s.health.ok) {
+		const h = s.health.value;
+		out.push([
+			seg(`${theme.glyph.live} live`, "ok"),
+			...h.version !== void 0 ? [seg(`  v${clean(h.version)}`, "text")] : [],
+			...h.uptimeSeconds !== void 0 ? [seg(`  up ${uptime(h.uptimeSeconds)}`, "dim")] : []
+		]);
+	} else out.push([seg(`${theme.glyph.fail} offline`, "error"), seg(`  (${s.health.why})`, "dim")]);
+	const m = s.metrics;
+	if (m === null) out.push([seg("metrics …", "dim")]);
+	else if (!m.ok) out.push(na("metrics", m.why));
+	else {
+		const sub = m.value.subscriptions;
+		out.push([
+			seg("subs ", "dim"),
+			seg(String(num$1(sub?.active))),
+			...sub?.maxQueueDepth !== void 0 ? [seg("  queue max ", "dim"), seg(String(num$1(sub.maxQueueDepth)))] : []
+		]);
+	}
+	const e = s.embed;
+	if (e === null) out.push([seg("embed …", "dim")]);
+	else if (!e.ok) out.push(na("embed", e.why));
+	else if (e.value.enabled === false) out.push([seg("embed ", "dim"), seg("off", "dim")]);
+	else {
+		const failures = num$1(e.value.failures);
+		out.push([
+			seg("embed ", "dim"),
+			seg("on ", "ok"),
+			seg(`${theme.glyph.fail}${failures}`, failures > 0 ? "error" : "dim"),
+			seg(` · ${num$1(e.value.writes)} writes`, "dim")
+		]);
+	}
+	const p = m?.ok === true ? m.value.process : void 0;
+	if (p !== void 0) {
+		out.push([
+			seg("rss ", "dim"),
+			seg(`${Math.round(num$1(p.rssMB))}MB`),
+			seg(" heap ", "dim"),
+			seg(`${Math.round(num$1(p.heapUsedMB))}MB`)
+		]);
+		const lag = num$1(p.eventLoopLagP99Ms);
+		out.push([seg("loop p99 ", "dim"), seg(ms(lag), latencyTone(lag))]);
+		const inFlight = num$1(p.inFlight);
+		out.push([seg("in flight ", "dim"), seg(String(inFlight), inFlight > 0 ? "info" : "text")]);
+	}
+	return out;
+}
+function opLines(label, glyph, tone, op, rates, errs, theme, compact) {
+	const total = num$1(op?.total);
+	const mean = total > 0 ? num$1(op?.durationMsSum) / total : 0;
+	const max = num$1(op?.durationMsMax);
+	const newErr = last(errs);
+	if (compact) return [[
+		seg(`${glyph} ${label} `, tone),
+		seg(rate(last(rates))),
+		seg(` ${theme.glyph.fail}${newErr}`, newErr > 0 ? "error" : "dim"),
+		seg(" avg(all) ", "dim"),
+		seg(ms(mean), latencyTone(mean)),
+		seg("  ", "dim"),
+		seg(sparkline(rates, theme.glyph.spark), "spark")
+	]];
+	return [[
+		seg(`${glyph} ${label} `, tone),
+		seg(rate(last(rates))),
+		seg("  ", "dim"),
+		seg(sparkline(rates, theme.glyph.spark), "spark")
+	], [
+		seg(`  ${theme.glyph.fail}${newErr}`, newErr > 0 ? "error" : "dim"),
+		seg(" avg(all) ", "dim"),
+		seg(ms(mean), latencyTone(mean)),
+		seg(" max ", "dim"),
+		seg(ms(max), latencyTone(max))
+	]];
+}
+/**
+* Exported for tests: tones are not visible in a rendered frame. `compact` gives each op one line
+* (no max) and drops the KEYS header, so a short pane still reaches the per-key rows.
+*/
+function trafficLines(s, theme, width, compact = false) {
+	const m = s.metrics;
+	if (m === null) return [[seg("…", "dim")]];
+	if (!m.ok) return [na("metrics", m.why)];
+	const v = m.value;
+	const out = [...opLines("query", theme.glyph.query, "query", v.requests?.query, s.hist.queryRate, s.hist.queryErr, theme, compact), ...opLines("mutate", theme.glyph.mutation, "mutation", v.requests?.mutate, s.hist.mutateRate, s.hist.mutateErr, theme, compact)];
+	if (!compact) out.push([seg(`KEYS · by ${s.sort}`, "dimMid")]);
+	const empty = compact ? "keys " : "  ";
+	const keys = sortKeys(v.resolvers ?? {}, s.sort);
+	if (v.resolvers === void 0) out.push([seg(`${empty}n/a (server)`, "dim")]);
+	else if (keys.length === 0) out.push([seg(`${empty}none yet`, "dim")]);
+	const wide = width >= 40;
+	const tails = keys.map(([key, st]) => {
+		const p99 = num$1(st.p99Ms);
+		return [
+			...wide ? [seg(` ${num$1(st.calls)}`, "dim"), seg(` ${ms(num$1(st.p50Ms))}/`, "dim")] : [],
+			seg(wide ? ms(p99) : ` ${ms(p99)}`, latencyTone(p99)),
+			seg(` ${theme.glyph.fail}${num$1(st.errors)} `, s.keyErrRose.has(key) ? "error" : "dim"),
+			seg(sparkline((s.hist.p99.get(key) ?? []).slice(wide ? -8 : -6), theme.glyph.spark), "spark")
+		];
+	});
+	const tailW = Math.max(0, ...tails.map((t) => t.reduce((n, sg) => n + cellWidth(sg.t), 0)));
+	const longest = Math.max(0, ...keys.map(([key]) => cellWidth(clean(key))), ...(v.slowest ?? []).slice(0, 5).map((r) => cellWidth(clean(r.key))));
+	const keyW = Math.max(4, Math.min(width - 2 - tailW, longest));
+	keys.forEach(([key], i) => {
+		out.push([
+			seg(`${theme.glyph.query} `, "dim"),
+			seg(padCells(clean(key), keyW)),
+			...tails[i] ?? []
+		]);
+	});
+	const slow = v.slowest ?? [];
+	if (slow.length > 0) {
+		out.push([seg("SLOWEST", "dimMid")]);
+		for (const r of slow.slice(0, 5)) {
+			const d = num$1(r.durationMs);
+			out.push([seg(`  ${padCells(clean(r.key), keyW)} `), seg(ms(d), latencyTone(d))]);
+		}
+	}
+	return out;
+}
+/** `compact` folds denials and errors onto one line, so RECENT ERRORS survives a short pane. */
+function engineLines(s, theme, compact = false) {
+	const out = [];
+	const m = s.metrics;
+	if (m === null) out.push([seg("…", "dim")]);
+	else if (!m.ok) out.push(na("events", m.why));
+	else {
+		const den = last(s.hist.denials);
+		const errHist = s.hist.queryErr.map((q, i) => q + (s.hist.mutateErr[i] ?? 0));
+		const err = last(errHist);
+		if (compact) out.push([
+			seg("denials ", "dim"),
+			seg(`+${den}`, den > 0 ? "error" : "text"),
+			seg(" · errors ", "dim"),
+			seg(`+${err}`, err > 0 ? "error" : "text")
+		]);
+		else {
+			out.push([
+				seg("denials ", "dim"),
+				seg(`+${den} `, den > 0 ? "error" : "text"),
+				seg(sparkline(s.hist.denials, theme.glyph.spark), "spark")
+			]);
+			out.push([
+				seg("errors  ", "dim"),
+				seg(`+${err} `, err > 0 ? "error" : "text"),
+				seg(sparkline(errHist, theme.glyph.spark), "spark")
+			]);
+		}
+	}
+	const e = s.errors;
+	out.push([seg("RECENT ERRORS", "dimMid")]);
+	if (e === null) out.push([seg("  …", "dim")]);
+	else if (!e.ok) out.push(na(" ", e.why));
+	else if ((e.value.errors ?? []).length === 0) out.push([seg("  none", "dim")]);
+	else for (const r of e.value.errors.slice(0, 5)) {
+		const at = typeof r.at === "string" ? clean(r.at).slice(11, 19) : "";
+		out.push([
+			seg(`  ${at} `, "dim"),
+			seg(`${clean(String(r.code))} `, "error"),
+			seg(`${clean(String(r.key))} `),
+			...typeof r.caller === "string" ? [seg(`${clean(r.caller)} `, "dimMid")] : [],
+			seg(clean(String(r.message)), "dim"),
+			...num$1(r.count) > 1 ? [seg(` ×${num$1(r.count)}`, "dim")] : []
+		]);
+	}
+	if (m?.ok === true) {
+		const events = Object.entries(m.value.events ?? {}).filter(([k]) => k !== DENIAL_EVENT).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+		for (const [name, total] of events) {
+			const d = Object.hasOwn(s.eventDelta, name) ? s.eventDelta[name] ?? 0 : 0;
+			out.push([
+				seg(`${clean(name)} `, "dim"),
+				seg(String(num$1(total))),
+				...d > 0 ? [seg(` +${d}`, "warn")] : []
+			]);
+		}
+	}
+	return out;
+}
+function Lines({ lines, width, theme }) {
+	return /* @__PURE__ */ jsx(Fragment, { children: lines.map((line, i) => /* @__PURE__ */ jsx(Text, {
+		wrap: "truncate",
+		children: fit(line, width).map((sg, j) => /* @__PURE__ */ jsx(Text, {
+			color: theme.color[sg.tone],
+			children: sg.t
+		}, j))
+	}, i)) });
+}
+/** SERVICE is short and steady: it never takes more than this many body lines. */
+const SERVICE_CAP = 4;
+/** ENGINE's tallies are the tail of a long list: past this, LIVE TRAFFIC gets the rows. */
+const ENGINE_CAP = 10;
+/** Compact: SERVICE keeps its first three lines (liveness, subscriptions, embed). */
+const COMPACT_SERVICE_CAP = 3;
+/** `total` lines dealt round-robin to sections wanting `want[i]` each, none past `caps[i]`. */
+function share(want, total, caps = []) {
+	const got = want.map(() => 0);
+	let left = Math.max(0, total);
+	let grew = true;
+	while (left > 0 && grew) {
+		grew = false;
+		for (let i = 0; i < want.length && left > 0; i++) {
+			const cap = Math.min(want[i] ?? 0, caps[i] ?? Number.POSITIVE_INFINITY);
+			if ((got[i] ?? 0) < cap) {
+				got[i] = (got[i] ?? 0) + 1;
+				left--;
+				grew = true;
+			}
+		}
+	}
+	return got;
+}
+const TITLES = [
+	"service",
+	"engine",
+	"live traffic"
+];
+const TONES = [
+	"accentAlt",
+	"error",
+	"accent"
+];
+/**
+* The dash panel, never taller than `size.rows`: SERVICE, ENGINE and LIVE TRAFFIC stacked, each
+* the full width. SERVICE and ENGINE are capped and LIVE TRAFFIC takes the rows left over; when
+* the rows cannot give each bordered panel MIN_BODY lines, one compact list with a title line
+* per section.
+*/
+function DashView({ state, theme, size }) {
+	const footer = size.rows >= 2 ? 1 : 0;
+	const room = size.rows - footer;
+	const inner = Math.max(1, size.columns - 4);
+	const stackRoom = room - 9;
+	const bordered = stackRoom >= 9;
+	const lines = [
+		serviceLines(state, theme),
+		engineLines(state, theme, !bordered),
+		trafficLines(state, theme, bordered ? inner : size.columns, !bordered)
+	];
+	const foot = footer === 1 ? /* @__PURE__ */ jsx(Text, {
+		color: theme.color.dim,
+		wrap: "truncate",
+		children: truncateCells(`  r refresh · s sort (${state.sort}) · esc close`, size.columns)
+	}) : null;
+	if (!bordered) {
+		const got = share(lines.map((l) => Math.max(1, l.length)), room, [COMPACT_SERVICE_CAP]);
+		const flat = [];
+		lines.forEach((l, i) => {
+			const n = got[i] ?? 0;
+			if (n === 0) return;
+			const title = seg(`${theme.glyph.title} ${TITLES[i]?.toUpperCase()} `, TONES[i] ?? "accent");
+			flat.push([title, ...l[0] ?? []]);
+			flat.push(...l.slice(1, n));
+		});
+		return /* @__PURE__ */ jsxs(Box, {
+			flexDirection: "column",
+			width: size.columns,
+			children: [/* @__PURE__ */ jsx(Lines, {
+				lines: flat,
+				width: size.columns,
+				theme
+			}), foot]
+		});
+	}
+	const bodies = share(lines.map((l) => l.length), stackRoom, [SERVICE_CAP, ENGINE_CAP]);
+	return /* @__PURE__ */ jsxs(Box, {
+		flexDirection: "column",
+		width: size.columns,
+		children: [lines.map((l, i) => /* @__PURE__ */ jsx(Panel, {
+			title: TITLES[i] ?? "",
+			theme,
+			tone: TONES[i] ?? "accent",
+			width: size.columns,
+			children: /* @__PURE__ */ jsx(Lines, {
+				lines: l.slice(0, Math.max(1, bodies[i] ?? 1)),
+				width: inner,
+				theme
+			})
+		}, TITLES[i])), foot]
+	});
+}
+function dashModule(deps, opts = {}) {
+	const clock = opts.clock ?? (() => performance.now());
+	const every = opts.intervalMs ?? 5e3;
+	const limit = opts.timeoutMs ?? 4e3;
+	let run = null;
+	let disposed = false;
+	const stop = () => {
+		if (run === null) return;
+		clearInterval(run.timer);
+		run.abort.abort();
+		run = null;
+	};
+	/** `f` with its own deadline: it settles by `limit` whether or not it honours the signal. */
+	const within = (f, parents) => {
+		const deadline = new AbortController();
+		let timer;
+		const timeout = new Promise((_res, rej) => {
+			timer = setTimeout(() => {
+				deadline.abort();
+				rej(/* @__PURE__ */ new Error("timed out"));
+			}, limit);
+		});
+		const signal = AbortSignal.any([...parents, deadline.signal]);
+		return Promise.race([Promise.resolve().then(() => f(signal)), timeout]).then((value) => ({
+			ok: true,
+			value
+		}), (err) => ({
+			ok: false,
+			why: classify(err)
+		})).finally(() => clearTimeout(timer));
+	};
+	const sampleOf = async (parents) => {
+		let metricsAt;
+		const metricsP = within(async (sg) => {
+			const m = await deps.metrics(sg);
+			metricsAt = clock();
+			return m;
+		}, parents);
+		const [health, metrics, embed, errors] = await Promise.all([
+			within(async (sg) => healthOf(await deps.getJson("/health", sg)), parents),
+			metricsP,
+			within(async (sg) => embedOf(await deps.getJson("/substrate/v1/embed-stats", sg)), parents),
+			within((sg) => deps.errors(sg), parents)
+		]);
+		return {
+			health,
+			metrics,
+			embed,
+			errors,
+			...metricsAt !== void 0 ? { metricsAt } : {}
+		};
+	};
+	/**
+	* Whether the dash panel is the open one: ctx.update only calls back for an open panel. Core
+	* has no close hook, so this probe is what lets a tick stop BEFORE fetching once the panel has
+	* gone. It costs one re-render per tick (core rebuilds the overlay even for an unchanged
+	* state); folding it into the post-fetch update would leave one fetch after every close.
+	*/
+	const isOpen = (ctx) => {
+		let open = false;
+		ctx.update("dash", (s) => {
+			open = true;
+			return s;
+		});
+		return open;
+	};
+	const tick = async (ctx, queue = false) => {
+		const cur = run;
+		if (cur === null || disposed) return;
+		if (!isOpen(ctx)) return stop();
+		if (cur.busy) {
+			if (queue) cur.again = true;
+			return;
+		}
+		cur.busy = true;
+		try {
+			const sample = await sampleOf([ctx.signal, cur.abort.signal]);
+			if (run !== cur || disposed) return;
+			let applied = false;
+			ctx.update("dash", (s) => {
+				applied = true;
+				return step(s, sample, Date.now());
+			});
+			if (!applied) stop();
+		} finally {
+			cur.busy = false;
+		}
+		if (cur.again && run === cur && !disposed) {
+			cur.again = false;
+			tick(ctx);
+		}
+	};
+	return defineModule("substrate.dash", {
+		commands: [{
+			name: "dash",
+			summary: "service, traffic and engine metrics, live while open",
+			args: [],
+			run(_args, ctx) {
+				if (disposed) return;
+				stop();
+				ctx.open("dash", initialDash());
+				run = {
+					timer: setInterval(() => void tick(ctx), every),
+					abort: new AbortController(),
+					busy: false,
+					again: false
+				};
+				tick(ctx);
+			}
+		}],
+		panels: { dash: {
+			view: ({ state, theme, size }) => /* @__PURE__ */ jsx(DashView, {
+				state,
+				theme,
+				size
+			}),
+			keymap: [{
+				key: "r",
+				act: "refresh"
+			}, {
+				key: "s",
+				act: "sort"
+			}],
+			on: {
+				refresh: (_s, ctx) => {
+					tick(ctx, true);
+				},
+				sort: (s) => ({
+					...s,
+					sort: nextSort(s.sort)
+				})
+			}
+		} },
+		init() {
+			disposed = false;
+			return () => {
+				disposed = true;
+				stop();
+			};
+		}
+	});
+}
+
+//#endregion
+//#region src/doctor/watch.ts
+const PENDING = {
+	text: "doctor …",
+	tone: "dim"
+};
+const oneLine = (s) => s.replace(/\s*[\r\n]+\s*/g, " ").trim();
+function verdictOf$1(steps) {
+	if (steps.find((s) => s.name === "reachable")?.status === "todo") return {
+		text: "doctor ✗ unreachable",
+		tone: "error"
+	};
+	const todo = steps.filter((s) => s.status === "todo" && !s.optional);
+	const first = todo[0];
+	if (first !== void 0) {
+		const more = todo.length > 1 ? ` +${todo.length - 1}` : "";
+		return {
+			text: `doctor ⚠ ${first.name}${more}`,
+			tone: "warn"
+		};
+	}
+	const counted = steps.filter((s) => s.status !== "blocked");
+	return {
+		text: `doctor ✓ ${counted.filter((s) => s.status === "done").length}/${counted.length}`,
+		tone: "dim"
+	};
+}
+/** The baseline after `steps`: a blocked step keeps the status `prev` last measured for it. */
+function statusMap(steps, prev = /* @__PURE__ */ new Map()) {
+	return new Map(steps.map((s) => [s.name, s.status === "blocked" ? prev.get(s.name) ?? "blocked" : s.status]));
+}
+function noticesFor(prev, steps) {
+	const out = [];
+	for (const s of steps) {
+		const before = prev.get(s.name);
+		if (before === "done" && s.status === "todo") out.push({
+			text: `⚠ doctor: ${s.name} went NO — ${oneLine(s.detail)} · /doctor`,
+			tone: "warn"
+		});
+		else if (before === "todo" && s.status === "done") out.push({
+			text: `✓ doctor: ${s.name} recovered`,
+			tone: "dim"
+		});
+	}
+	return out;
+}
+/** A run that missed its deadline, shaped so the planner reads it as an unreachable server. */
+function timedOutResult(deadlineMs) {
+	return {
+		checks: [{
+			name: "reachable",
+			status: "no",
+			detail: `no answer within ${Math.round(deadlineMs / 1e3)}s`,
+			fix: "Check the service (`systemctl status substrate-binary`) and the network path."
+		}],
+		exitCode: 1,
+		identity: null,
+		facts: {}
+	};
+}
+
+//#endregion
+//#region src/doctor/module.ts
+/**
+* `substrate.doctor` — the command centre. diagnose runs in the background for the TUI's
+* lifetime: once at start, then every interval, one run at a time with a deadline. The
+* verdict is a `doctor` status cell, and a step flipping between done and todo prints one
+* line. `/doctor` shows the latest result live. Locked, it diagnoses the agent identity
+* without expecting admin; unlocked, the admin identity, through `run(…, { touch: false })`
+* so that watching never holds the admin session open. It reports and never acts — fixing
+* belongs to `substrate-admin onboard`.
+*/
+const DOCTOR_INTERVAL_MS = 6e4;
+const DOCTOR_DEADLINE_MS = 2e4;
+/** diagnose's default advice names the admin env, which is wrong for the agent identity. */
+const AGENT_CREDENTIAL_FIX = "Set SUBSTRATE_AGENT_KEY_ID and SUBSTRATE_AGENT_KEY_PATH in this repo's .claude/settings.local.json env, or /admin unlock to diagnose as the admin identity.";
+function doctorModule(deps, io = {}) {
+	const diagnose$1 = io.diagnose ?? diagnose;
+	const intervalMs = io.intervalMs ?? 6e4;
+	const deadlineMs = io.deadlineMs ?? 2e4;
+	const now = io.now ?? Date.now;
+	const whoNow = () => deps.admin.unlocked() ? "admin" : "agent";
+	let latest;
+	let baseline;
+	let running;
+	let again;
+	/** Set only across the doctor's own 401 lock, so the listener leaves its explanation up. */
+	let selfLocking = false;
+	/** Bumped on every lock: an admin run that saw one, even if since re-unlocked, is discarded. */
+	let locks = 0;
+	const publish = (ctx, patch) => {
+		latest = {
+			...latest,
+			...patch
+		};
+		const snapshot = latest;
+		ctx.update("doctor", () => snapshot);
+	};
+	/** One diagnose under `who`, raced against the deadline. Null means the deadline won. */
+	const attempt = async (ctx, who) => {
+		const deadline = new AbortController();
+		const timer = setTimeout(() => deadline.abort(), deadlineMs);
+		const signal = AbortSignal.any([ctx.signal, deadline.signal]);
+		const fetchWith = ((url, init) => fetch(url, {
+			...init,
+			signal
+		}));
+		const timedOut = new Promise((resolve) => signal.addEventListener("abort", () => resolve(null), { once: true }));
+		const run = who === "admin" ? deps.admin.run(({ authorization }) => diagnose$1({
+			baseUrl: deps.endpoint,
+			credential: {
+				authorization,
+				label: "the unlocked admin identity"
+			},
+			...adminCapabilityOf(deps.adminEnv),
+			fetch: fetchWith
+		}), { touch: false }) : diagnose$1({
+			baseUrl: deps.endpoint,
+			credential: deps.agentAuthorization !== null ? {
+				authorization: deps.agentAuthorization,
+				label: "the agent identity"
+			} : {
+				error: "no agent identity configured (anonymous)",
+				fix: AGENT_CREDENTIAL_FIX
+			},
+			expectAdmin: false,
+			fetch: fetchWith
+		});
+		try {
+			return await Promise.race([run, timedOut]);
+		} finally {
+			clearTimeout(timer);
+			deadline.abort();
+		}
+	};
+	const runOnce = async (ctx) => {
+		if (ctx.signal.aborted) return;
+		if (running) {
+			again = true;
+			return;
+		}
+		running = true;
+		const who = whoNow();
+		const epoch = locks;
+		const stale = () => ctx.signal.aborted || who === "admin" && (locks !== epoch || !deps.admin.unlocked());
+		publish(ctx, {
+			running: true,
+			who
+		});
+		try {
+			const result = await attempt(ctx, who) ?? timedOutResult(deadlineMs);
+			if (stale()) return;
+			const identity = result.checks.find((c) => c.name === "identity");
+			if (who === "admin" && identity?.status === "no" && identity.httpStatus === 401) {
+				selfLocking = true;
+				try {
+					deps.admin.lock("admin locked: 401 — the admin key was rejected");
+				} finally {
+					selfLocking = false;
+				}
+			}
+			const steps = planOnboarding(result, {
+				canBootstrap: false,
+				skipped: /* @__PURE__ */ new Set(),
+				explainNoBootstrap: false
+			});
+			const verdict = verdictOf$1(steps);
+			ctx.status("doctor", verdict.text, verdict.tone);
+			if (baseline !== null && baseline.who === who) for (const n of noticesFor(baseline.map, steps)) ctx.print(sanitise(n.text), n.tone);
+			const carried = baseline !== null && baseline.who === who ? baseline.map : void 0;
+			baseline = {
+				who,
+				map: statusMap(steps, carried)
+			};
+			publish(ctx, {
+				who,
+				steps,
+				error: null,
+				checkedAt: now(),
+				nextAt: now() + intervalMs,
+				running: false
+			});
+		} catch (err) {
+			if (stale()) return;
+			ctx.status("doctor", "doctor ✗ could not run", "error");
+			publish(ctx, {
+				who,
+				error: err instanceof Error ? err.message : String(err),
+				running: false
+			});
+		} finally {
+			running = false;
+			if (latest.running) publish(ctx, { running: false });
+			if (again && !ctx.signal.aborted) {
+				again = false;
+				runOnce(ctx);
+			}
+		}
+	};
+	return defineModule("substrate.doctor", {
+		commands: [{
+			name: "doctor",
+			summary: "live checks for this deployment",
+			args: [],
+			run: (_, ctx) => {
+				ctx.open("doctor", latest);
+				runOnce(ctx);
+			}
+		}],
+		panels: { doctor: {
+			view: ({ state, theme, size }) => {
+				const w = Math.max(1, size.columns - 2);
+				const clock = (t) => new Date(t).toTimeString().slice(0, 8);
+				const when = state.running || state.checkedAt === null ? " · checking…" : ` · checked ${clock(state.checkedAt)}` + (state.nextAt !== null ? ` · next ${clock(state.nextAt)}` : "");
+				const head = truncateCells(`${theme.glyph.title} doctor · ${state.who} identity${when}`, w);
+				if (state.error !== null) return [head, truncateCells(sanitise(`could not run: ${oneLine(state.error)}`), w)].join("\n");
+				if (state.steps === null) return [head, "  checking…"].join("\n");
+				const current = currentStep(state.steps);
+				const nameW = Math.max(...state.steps.map((s) => s.name.length));
+				return [
+					head,
+					...state.steps.flatMap((s) => {
+						const mark = s === current ? CURRENT_MARK : STEP_MARKS[s.status];
+						const tag = s.optional ? " (optional)" : "";
+						return [truncateCells(sanitise(`${mark} ${s.name.padEnd(nameW)}  ${oneLine(s.detail)}${tag}`), w), ...s.status === "todo" && s.fix !== void 0 ? [truncateCells(sanitise(`    fix: ${oneLine(s.fix)}`), w)] : []];
+					}),
+					`${verdictOf$1(state.steps).text} · r re-check · esc close`
+				].join("\n");
+			},
+			keymap: [{
+				key: "r",
+				act: "rerun"
+			}],
+			on: { rerun: (_s, ctx) => {
+				runOnce(ctx);
+			} }
+		} },
+		init(ctx) {
+			latest = {
+				who: whoNow(),
+				steps: null,
+				error: null,
+				checkedAt: null,
+				nextAt: null,
+				running: false
+			};
+			baseline = null;
+			running = false;
+			again = false;
+			ctx.status("doctor", PENDING.text, PENDING.tone);
+			runOnce(ctx);
+			const timer = setInterval(() => {
+				if (!running) runOnce(ctx);
+			}, intervalMs);
+			let lastKind = deps.admin.unlocked() ? "unlocked" : "locked";
+			const off = deps.admin.onChange((st) => {
+				if (st.kind === lastKind) return;
+				lastKind = st.kind;
+				baseline = null;
+				if (st.kind === "locked") {
+					locks += 1;
+					if (!selfLocking) {
+						let adminOpen = false;
+						ctx.update("doctor", (s) => {
+							adminOpen = s.who === "admin";
+							return s;
+						});
+						if (adminOpen) {
+							ctx.close();
+							ctx.print("doctor closed — admin locked", "warn");
+						}
+					}
+				}
+				if (!selfLocking) runOnce(ctx);
+			});
+			return () => {
+				clearInterval(timer);
+				off();
+			};
+		}
+	});
+}
+
+//#endregion
+//#region src/admin/refusal.ts
+/** A server refusal as the server said it: `code: message`, sanitised, never retried. A chunked backfill wraps its failure; the cause is the refusal. */
+function refusalOf(err) {
+	const e = err instanceof AdminBackfillError ? err.cause : err;
+	const known = e instanceof NetworkError || e instanceof AuthError;
+	const code = known ? e.code ?? String(e.status ?? "error") : "error";
+	const message = (known ? e.serverMessage : void 0) ?? (e instanceof Error ? e.message : String(e));
+	return {
+		code: sanitise(code),
+		message: sanitise(message),
+		...known && e.body !== void 0 ? { body: e.body } : {}
+	};
+}
+
+//#endregion
+//#region src/lines.tsx
+/** Lines as a column of `Text`, each in its tone: a joined string view has no tone to give them. */
+function linesView(lines, theme) {
+	return /* @__PURE__ */ jsx(Box, {
+		flexDirection: "column",
+		children: lines.map((l, i) => /* @__PURE__ */ jsx(Text, {
+			...l.tone !== void 0 ? { color: theme.color[l.tone] } : {},
+			children: l.text
+		}, i))
+	});
+}
+
+//#endregion
+//#region src/keys/grant.ts
+const SHORT = {
+	read: "r",
+	mutate: "m",
+	admin: "a"
+};
+/** The legend for {@link compactGrant}'s short forms, one per entry of `SHORT`. */
+const GRANT_LEGEND = Object.entries(SHORT).map(([cap, s]) => `${s}=${cap}`).join(" · ");
+const CANONICAL = Object.keys(SHORT);
+/** read, mutate, admin, then any other capability alphabetically: one order wherever a grant is shown or sent. */
+function canonicalCaps(caps) {
+	const rank = (c) => {
+		const i = CANONICAL.indexOf(c);
+		return i < 0 ? CANONICAL.length : i;
+	};
+	return [...caps].sort((a, b) => rank(a) - rank(b) || (a < b ? -1 : a > b ? 1 : 0));
+}
+/**
+* One cell for the key table: `journal:r+m,*:r+m+a`. A capability without a short form stays
+* spelled out. Like `describeGrant` it is total: an unparseable grant renders as its description.
+*/
+function compactGrant(namespaces, capabilities) {
+	let grant;
+	try {
+		grant = parseGrantEntries(decodeList(namespaces), decodeList(capabilities));
+	} catch {
+		return describeGrant(namespaces, capabilities).join(" ");
+	}
+	if (grant.size === 0) return "(none)";
+	return [...grant].map(([ns, caps]) => `${ns}:${canonicalCaps(caps).map((c) => SHORT[c] ?? c).join("+")}`).join(",");
+}
+/** A stored row's grant, or null when it does not parse (the table still renders it). */
+function rowGrant(row) {
+	try {
+		return parseGrantEntries(decodeList(row.namespaces), decodeList(row.capabilities));
+	} catch {
+		return null;
+	}
+}
+/** The request form: the capability union as the default, so a bare entry reads back as it. */
+function toWire(grant) {
+	const capabilities = canonicalCaps(flattenGrant(grant).capabilities);
+	return {
+		namespaces: encodeGrant(grant, capabilities),
+		capabilities
+	};
+}
+/**
+* The namespaces a `GET /substrate/v1/federated-schema` response hosts. The route adds one key that is
+* not a namespace, `_enumVerdicts`, for a caller who can read `_system`; the server judges
+* unhosted names against the schema without it, so this does too.
+*/
+function hostedNamespaces(schema) {
+	return Object.keys(schema).filter((k) => k !== "_enumVerdicts");
+}
+
+//#endregion
+//#region src/keys/matrix.ts
+/** The grant editor's model: namespaces by capability, edited a cell at a time. */
+const CAPS = [
+	"read",
+	"mutate",
+	"admin"
+];
+const clamp = (n, max) => Math.max(0, Math.min(max, n));
+function openMatrix(before, hosted) {
+	const granted = [...before.keys()];
+	const star = granted.includes("*") ? ["*"] : [];
+	const rest = granted.filter((ns) => ns !== "*");
+	const extra = [...new Set(hosted)].filter((ns) => !before.has(ns)).sort();
+	return {
+		before,
+		grant: before,
+		rows: [
+			...star,
+			...rest,
+			...extra
+		],
+		hosted: new Set(hosted),
+		row: 0,
+		col: 0
+	};
+}
+function move(m, dRow, dCol) {
+	return {
+		...m,
+		row: clamp(m.row + dRow, m.rows.length - 1),
+		col: clamp(m.col + dCol, CAPS.length - 1)
+	};
+}
+function toggle(m) {
+	const ns = m.rows[m.row];
+	const cap = CAPS[m.col];
+	if (ns === void 0 || cap === void 0) return m;
+	const caps = new Set(m.grant.get(ns) ?? []);
+	if (caps.has(cap)) caps.delete(cap);
+	else caps.add(cap);
+	const grant = new Map(m.grant);
+	grant.set(ns, caps);
+	return {
+		...m,
+		grant
+	};
+}
+function addNamespace(m, ns) {
+	const at = m.rows.indexOf(ns);
+	if (at >= 0) return {
+		...m,
+		row: at
+	};
+	const rows = ns === "*" ? ["*", ...m.rows] : [...m.rows, ns];
+	return {
+		...m,
+		rows,
+		row: ns === "*" ? 0 : rows.length - 1
+	};
+}
+const explicit = (g, ns) => {
+	const caps = g.get(ns);
+	return caps !== void 0 && caps.size > 0 ? caps : void 0;
+};
+function cell(m, ns, cap) {
+	const now = explicit(m.grant, ns);
+	const was = explicit(m.before, ns);
+	const on = now?.has(cap) === true;
+	const diff = on === (was?.has(cap) === true) ? "" : on ? "+" : "-";
+	if (on) return {
+		held: "on",
+		diff
+	};
+	return {
+		held: ns !== "*" && now === void 0 && capabilitiesFor(result(m), ns).has(cap) ? "inherited" : "off",
+		diff
+	};
+}
+function result(m) {
+	const out = /* @__PURE__ */ new Map();
+	for (const ns of m.rows) {
+		const caps = m.grant.get(ns);
+		if (caps !== void 0 && caps.size > 0) out.set(ns, new Set(caps));
+	}
+	return out;
+}
+function changed(m) {
+	const a = result(m);
+	const b = result({
+		...m,
+		grant: m.before
+	});
+	if (a.size !== b.size) return true;
+	for (const [ns, caps] of a) {
+		const other = b.get(ns);
+		if (other === void 0 || other.size !== caps.size) return true;
+		for (const c of caps) if (!other.has(c)) return true;
+	}
+	return false;
+}
+
+//#endregion
+//#region src/keys/pubkey.ts
+/** A public key's algorithm and fingerprint, read locally before register sends it. */
+/** PEM armour of a private key, any algorithm prefix (none, RSA, EC, ENCRYPTED, OPENSSH…). */
+const PRIVATE_KEY_ARMOUR = /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY-----/;
+function readPublicKey(pem) {
+	if (PRIVATE_KEY_ARMOUR.test(pem)) return {
+		ok: false,
+		reason: "that file is a PRIVATE key — register takes the public half (.pub)"
+	};
+	let algorithm;
+	try {
+		const key = createPublicKey(pem);
+		const type = key.asymmetricKeyType;
+		const curve = key.asymmetricKeyDetails?.namedCurve;
+		if (type === "ed25519") algorithm = "EdDSA";
+		else if (type === "rsa") algorithm = "RS256";
+		else if (type === "ec" && curve === "prime256v1") algorithm = "ES256";
+		else {
+			const detail = curve !== void 0 ? ` (${curve})` : "";
+			return {
+				ok: false,
+				reason: `a ${type ?? "unknown"}${detail} key — the server takes Ed25519, RSA or P-256`
+			};
+		}
+	} catch {
+		return {
+			ok: false,
+			reason: "not a readable public-key PEM"
+		};
+	}
+	const digest = createHash("sha256").update(pem).digest("base64url");
+	return {
+		ok: true,
+		algorithm,
+		fingerprint: `sha256:${digest.slice(0, 8)}`
+	};
+}
+/** Expands `~` and `~/…` to the home directory. `~user/…` names someone else's home, which this
+*  does not resolve: it is refused rather than rewritten as the current user's. */
+function expandHome(text, home = homedir()) {
+	if (text === "~" || text.startsWith("~/")) return { path: home + text.slice(1) };
+	if (text.startsWith("~")) return { error: "only ~ and ~/… are expanded — give the full path instead of ~user" };
+	return { path: text };
+}
+
+//#endregion
+//#region src/keys/verdict.ts
+const EMPTY = {
+	kind: "refused",
+	code: "empty_grant",
+	message: "a key needs at least one namespace — revoke removes all access"
+};
+const adminKids = (table, cap) => table.filter((r) => isActiveAdminKeyRow(r, cap)).map((r) => r.kid);
+const unhosted = (next, hosted) => flattenGrant(next).namespaces.filter((ns) => ns !== "*" && !hosted.includes(ns));
+const starOf = (g) => [...g.get("*") ?? []].sort().join("+");
+const rowGrantOrEmpty = (row) => rowGrant(row) ?? /* @__PURE__ */ new Map();
+function updateVerdict(i) {
+	if (i.next.size === 0) return EMPTY;
+	const wire = toWire(i.next);
+	const facts = {
+		kid: i.row.kid,
+		exists: true,
+		existingRevokedAt: null,
+		prevNamespaces: decodeList(i.row.namespaces),
+		prevCapabilities: decodeList(i.row.capabilities),
+		nextNamespaces: wire.namespaces,
+		nextCapabilities: wire.capabilities,
+		activeAdminKids: adminKids(i.table, i.adminCapability),
+		adminCapability: i.adminCapability
+	};
+	const flags = [];
+	const reasons = [];
+	let widen = false;
+	let allowAdmin = false;
+	for (;;) {
+		const r = checkUpdatable({
+			...facts,
+			widen,
+			allowAdmin
+		});
+		if (r === null) break;
+		if (r.code === "requires_widen" && !widen) {
+			widen = true;
+			flags.push("widen");
+			reasons.push(r.message);
+		} else if (r.code === "requires_allow_admin" && !allowAdmin) {
+			allowAdmin = true;
+			flags.push("allowAdmin");
+			reasons.push(r.message);
+		} else return {
+			kind: "refused",
+			code: r.code,
+			message: r.message
+		};
+	}
+	const unknown = unhosted(i.next, i.hosted);
+	if (unknown.length > 0) {
+		flags.push("allowUnknownNs");
+		reasons.push(`names namespace(s) this deployment does not host: ${unknown.join(", ")}`);
+	}
+	if (starOf(rowGrantOrEmpty(i.row)) !== starOf(i.next)) reasons.push("changes the * row, which reaches every namespace");
+	if (!allowAdmin && grantEntriesConfer(wire.namespaces, wire.capabilities, i.adminCapability)) reasons.push(`carries '${i.adminCapability}'`);
+	return {
+		kind: "ok",
+		tier: reasons.length > 0 ? 2 : 1,
+		flags,
+		reasons
+	};
+}
+function revokeVerdict(i) {
+	const r = checkRevocable({
+		kid: i.kid,
+		exists: true,
+		existingRevokedAt: null,
+		activeAdminKids: adminKids(i.table, i.adminCapability)
+	});
+	return r === null ? {
+		kind: "ok",
+		tier: 1,
+		flags: [],
+		reasons: []
+	} : {
+		kind: "refused",
+		code: r.code,
+		message: r.message
+	};
+}
+function newKeyVerdict(i) {
+	if (i.next.size === 0) return EMPTY;
+	const wire = toWire(i.next);
+	const flags = [];
+	const reasons = i.kind === "register" ? ["registers a new identity"] : [];
+	if (grantEntriesConfer(wire.namespaces, wire.capabilities, i.adminCapability)) {
+		if (i.kind === "register") flags.push("allowAdmin");
+		reasons.push(`carries '${i.adminCapability}'`);
+	}
+	const unknown = unhosted(i.next, i.hosted);
+	if (unknown.length > 0) {
+		if (i.kind === "register") flags.push("allowUnknownNs");
+		reasons.push(`names namespace(s) this deployment does not host: ${unknown.join(", ")}`);
+	}
+	if (i.next.has("*")) reasons.push("grants the * row, which reaches every namespace");
+	return {
+		kind: "ok",
+		tier: reasons.length > 0 ? 2 : 1,
+		flags,
+		reasons
+	};
+}
+
+//#endregion
+//#region src/keys/editor.tsx
+/**
+* The `/keys` grant editor: the matrix (`edit`), a text prompt (`prompt`) and the
+* review (`review`). Each stage that takes typed text is its own panel, because a panel's keymap
+* wins over the draft (surface-core keys.ts).
+*/
+/** Parses `30m`, `12h`, `7d`; '' is the server default (undefined). Null when unreadable. */
+function parseTtl(text) {
+	const t = text.trim();
+	if (t === "") return void 0;
+	const m = /^(\d+)\s*([mhd])$/.exec(t);
+	if (m === null) return null;
+	const n = Number(m[1]);
+	return n > 0 ? n * {
+		m: 6e4,
+		h: 36e5,
+		d: 864e5
+	}[m[2]] : null;
+}
+/** The invites route's ceiling (substrate-compose `_system/routes/shared.ts` MAX_TTL_MS): 30 days. */
+const MAX_INVITE_TTL_MS = 2592e6;
+/** The invite-ttl prompt's reading: a ttl (absent for the server default), or why not. */
+function readInviteTtl(text) {
+	const ttlMs = parseTtl(text);
+	if (ttlMs === null) return { error: "a duration like 30m, 12h or 7d" };
+	if (ttlMs === void 0) return {};
+	return ttlMs > MAX_INVITE_TTL_MS ? { error: "at most 30 days" } : { ttlMs };
+}
+const NS_NAME = /^(\*|[A-Za-z0-9_.-]+)$/;
+const refusal = (text) => ({ error: text });
+/** As the shared toned lines: a refusal in the error tone, anything else untoned. */
+const toned = (lines) => lines.map((l) => typeof l === "string" ? { text: l } : {
+	text: l.error,
+	tone: "error"
+});
+function promptView(s, glyph) {
+	return [
+		`${glyph.title} keys › ${sanitise(s.label)}`,
+		...s.kid !== void 0 ? [`  ${sanitise(s.kid)}`] : [],
+		...s.algorithm !== void 0 && s.fingerprint !== void 0 ? [`  ${s.algorithm} · ${s.fingerprint}`] : [],
+		...s.error !== null ? [refusal(`  ${sanitise(s.error)}`)] : [],
+		"  enter accept · esc back"
+	];
+}
+/** What the tier-2 gesture asks to be typed: the kid, or the word `invite`. Never pre-filled. */
+function targetOf$1(flow) {
+	switch (flow.kind) {
+		case "update":
+		case "revoke": return flow.row.kid;
+		case "register": return flow.kid;
+		case "invite": return "invite";
+	}
+}
+const EMPTY_NOTE = "a key needs at least one namespace — revoke removes all access";
+/** The request's verdict, judged on exactly what apply will send. */
+function verdictOf(deps, s, next) {
+	const hosted = [...s.matrix.hosted];
+	const adminCapability = adminCapabilityOf(deps.adminEnv).adminCapability ?? "admin";
+	return s.flow.kind === "update" ? updateVerdict({
+		row: s.flow.row,
+		next,
+		table: s.table,
+		hosted,
+		adminCapability
+	}) : newKeyVerdict({
+		kind: s.flow.kind,
+		next,
+		hosted,
+		adminCapability
+	});
+}
+function reviewOf(s, next, verdict, ttlMs) {
+	return {
+		flow: s.flow,
+		edit: s,
+		next,
+		verdict,
+		...ttlMs !== void 0 ? { ttlMs } : {},
+		stage: "review",
+		error: null,
+		mismatch: false,
+		table: s.table
+	};
+}
+function ttlText(ms) {
+	for (const [unit, n] of [
+		["d", 864e5],
+		["h", 36e5],
+		["m", 6e4]
+	]) if (ms % n === 0) return `${ms / n}${unit}`;
+	return `${ms}ms`;
+}
+const entry = (ns, caps) => compactGrant(ns, [...caps].join(","));
+/** One line per namespace whose entry changed: removed (−), added (+), or both for a change. */
+function diffLines(before, after) {
+	const out = [];
+	for (const ns of /* @__PURE__ */ new Set([...before.keys(), ...after.keys()])) {
+		const a = before.get(ns);
+		const b = after.get(ns);
+		if (a !== void 0 && b !== void 0 && a.size === b.size && [...a].every((c) => b.has(c))) continue;
+		if (a !== void 0 && a.size > 0) out.push(`  − ${entry(ns, a)}`);
+		if (b !== void 0 && b.size > 0) out.push(`  + ${entry(ns, b)}`);
+	}
+	return out;
+}
+/** `  code <chunk>` then `  | <chunk>` lines, each at most `width` cells; nothing is dropped. */
+function wrapCode(code, width) {
+	const first = "  code ";
+	const next = "  | ";
+	const out = [];
+	let rest = Array.from(code);
+	let prefix = first;
+	do {
+		const room = Math.max(1, width - prefix.length);
+		out.push(prefix + rest.slice(0, room).join(""));
+		rest = rest.slice(room);
+		prefix = next;
+	} while (rest.length > 0);
+	return out;
+}
+function reviewView(s, glyph, armed, size) {
+	const w = Math.max(1, size.columns - 2);
+	const fit = (line) => truncateCells(sanitise(line), w);
+	const f = s.flow;
+	const target = targetOf$1(f);
+	const next = s.next ?? /* @__PURE__ */ new Map();
+	const body = [];
+	switch (f.kind) {
+		case "update":
+			body.push(`  before ${compactGrant(f.row.namespaces, f.row.capabilities)}`, `  after  ${grantLine(next)}`, ...diffLines(rowGrant(f.row) ?? /* @__PURE__ */ new Map(), next));
+			break;
+		case "register":
+			body.push(`  register ${f.kid} · ${f.algorithm} · ${f.fingerprint}`, `  grant ${grantLine(next)}`);
+			break;
+		case "invite":
+			body.push(`  invite for ${grantLine(next)}`, `  expires in ${s.ttlMs !== void 0 ? ttlText(s.ttlMs) : "the server default"}`);
+			break;
+		case "revoke": body.push(`  ${f.row.kid} loses access immediately`);
+	}
+	const v = s.verdict;
+	const verdict = v.kind === "refused" ? [refusal(`  refused: ${v.code}: ${v.message}`)] : v.reasons.map((r) => `  · ${r}`);
+	let tail;
+	switch (s.stage) {
+		case "review":
+			tail = v.kind === "refused" ? ["  esc back"] : v.tier === 1 ? [armed !== void 0 ? `  ${armed.key} — ${armed.label} · enter confirms · esc back` : "  y then enter applies · esc back"] : [`  type ${target} then enter to apply · esc back`, ...s.mismatch ? ["  does not match"] : []];
+			break;
+		case "applying":
+			tail = ["  applying…"];
+			break;
+		case "refused":
+			tail = [
+				refusal(`  ${s.error?.code ?? "error"}: ${s.error?.message ?? ""}`),
+				...s.refreshNote !== void 0 ? [refusal(`  ${s.refreshNote}`)] : [],
+				"  esc back"
+			];
+			break;
+		case "done": tail = s.inviteCode !== void 0 ? [
+			...wrapCode(sanitise(s.inviteCode), w),
+			"  give it to the invitee; it is not shown again",
+			"  esc close"
+		] : ["  esc close"];
+	}
+	const head = fit(`${glyph.title} keys › ${target} · review`);
+	const fitLine = (l) => typeof l === "string" ? fit(l) : refusal(fit(l.error));
+	return [
+		head,
+		...body.map(fit),
+		...verdict.map(fitLine),
+		...tail.map((l) => typeof l === "string" && (l.startsWith("  code ") || l.startsWith("  | ")) ? l : fitLine(l))
+	];
+}
+/** The 422 refusals a verdict can predict and a stale table can get wrong (verdict.ts). */
+const CONFIRMABLE = /* @__PURE__ */ new Set([
+	"requires_widen",
+	"requires_allow_admin",
+	"unknown_namespaces"
+]);
+/** Every panel it opens is an admin panel, so it opens nothing once the session is locked. */
+function switchTo(ctx, deps, panel, state) {
+	if (deps.admin.unlocked()) ctx.open(panel, state);
+}
+/** Opens the matrix for a flow; reads the hosted namespaces first. */
+async function openEditor(ctx, deps, flow, table, from = "keys") {
+	const subject = flow.kind === "invite" ? "new invite" : flow.kind === "update" ? flow.row.kid : flow.kid;
+	let hosted;
+	try {
+		hosted = hostedNamespaces(await deps.federatedSchema());
+	} catch (err) {
+		ctx.print(`cannot edit ${subject}: could not read the hosted namespaces: ${err instanceof Error ? err.message : String(err)}`, "error");
+		return;
+	}
+	let stillThere = false;
+	ctx.update(from, (cur) => {
+		stillThere = true;
+		return cur;
+	});
+	if (!stillThere || !deps.admin.unlocked()) return;
+	let before = /* @__PURE__ */ new Map();
+	if (flow.kind === "update") {
+		const parsed = rowGrant(flow.row);
+		if (parsed === null) {
+			ctx.print(`cannot edit ${flow.row.kid}: its stored grant does not parse`, "error");
+			return;
+		}
+		before = parsed;
+	}
+	ctx.setDraft("");
+	ctx.open("edit", {
+		flow,
+		matrix: openMatrix(before, hosted),
+		table,
+		discardArmed: false,
+		note: null
+	});
+}
+const GLYPH = {
+	on: "■",
+	inherited: "◆",
+	off: "□"
+};
+const DIFF = {
+	"+": "+",
+	"-": "−",
+	"": " "
+};
+function grantLine(g) {
+	const wire = toWire(g);
+	return wire.namespaces.length === 0 ? "(none)" : compactGrant(wire.namespaces.join(","), wire.capabilities.join(","));
+}
+function editView(s, glyph, size) {
+	const w = Math.max(1, size.columns - 2);
+	const fit = (line) => truncateCells(sanitise(line), w);
+	const m = s.matrix;
+	const f = s.flow;
+	const subject = f.kind === "invite" ? "new invite" : f.kind === "update" ? f.row.kid : f.kid;
+	const label = (ns) => ns === "*" ? "* every namespace" : ns;
+	const nsW = Math.min(24, Math.max(9, ...m.rows.map((ns) => label(ns).length)) + 2);
+	const granted = result(m);
+	const visible = Math.max(1, size.rows - 6);
+	const start = Math.max(0, Math.min(m.row - visible + 1, m.rows.length - visible));
+	const grid = m.rows.slice(start, start + visible).map((ns, k) => {
+		const at = start + k === m.row;
+		const cells = CAPS.map((cap, c) => {
+			const x = cell(m, ns, cap);
+			const text = `${GLYPH[x.held]}${DIFF[x.diff]}`;
+			return at && c === m.col ? `[${text}]` : ` ${text} `;
+		}).join("");
+		const tail = ns !== "*" && !m.hosted.has(ns) ? "  unhosted" : m.hosted.has(ns) && !granted.has(ns) ? "  (hosted, not granted)" : "";
+		const name = truncateCells(label(ns), nsW - 2).padEnd(nsW);
+		return fit(`${at ? glyph.cursor : " "} ${name}${cells}${tail}`.trimEnd());
+	});
+	const before = f.kind === "update" ? compactGrant(f.row.namespaces, f.row.capabilities) : "(none)";
+	const foot = s.note !== null ? [s.note === EMPTY_NOTE ? refusal(fit(`  ${s.note}`)) : fit(`  ${s.note}`)] : s.discardArmed ? ["  discard changes? esc again"] : [];
+	return [
+		fit(`${glyph.title} keys › ${subject} · editing`),
+		fit(`  ${"namespace".padEnd(nsW)} r   m   a`),
+		...grid,
+		fit(`  before ${before}`),
+		fit(`  after  ${grantLine(granted)}`),
+		...foot,
+		fit("  ↑↓←→ move · space toggle · + add namespace · enter review · esc discard")
+	];
+}
+function editorPanels(deps) {
+	const act = (fn) => (s, ctx) => {
+		ctx.setDraft("");
+		return fn({
+			...s,
+			discardArmed: false,
+			note: null
+		}, ctx);
+	};
+	const step = (dRow, dCol) => act((s) => ({
+		...s,
+		matrix: move(s.matrix, dRow, dCol)
+	}));
+	return {
+		edit: {
+			view: ({ state, theme, size }) => linesView(toned(editView(state, theme.glyph, size)), theme),
+			keymap: [
+				{
+					key: "up",
+					act: "up"
+				},
+				{
+					key: "down",
+					act: "down"
+				},
+				{
+					key: "left",
+					act: "left"
+				},
+				{
+					key: "right",
+					act: "right"
+				},
+				{
+					key: " ",
+					act: "toggle"
+				},
+				{
+					key: "+",
+					act: "add"
+				},
+				{
+					key: "enter",
+					act: "review"
+				}
+			],
+			on: {
+				up: step(-1, 0),
+				down: step(1, 0),
+				left: step(0, -1),
+				right: step(0, 1),
+				toggle: act((s) => ({
+					...s,
+					matrix: toggle(s.matrix)
+				})),
+				add: act((s, ctx) => {
+					switchTo(ctx, deps, "prompt", {
+						purpose: "add-ns",
+						label: "namespace to add",
+						error: null,
+						back: s,
+						table: s.table
+					});
+				}),
+				review: act((s, ctx) => {
+					if (s.flow.kind === "update" && !changed(s.matrix)) return {
+						...s,
+						note: "no changes to review"
+					};
+					const next = result(s.matrix);
+					if (next.size === 0) return {
+						...s,
+						note: EMPTY_NOTE
+					};
+					if (s.flow.kind === "invite") {
+						switchTo(ctx, deps, "prompt", {
+							purpose: "invite-ttl",
+							label: "expires in (e.g. 30m, 12h, 7d; enter for the server default)",
+							error: null,
+							back: s,
+							table: s.table
+						});
+						return;
+					}
+					switchTo(ctx, deps, "review", reviewOf(s, next, verdictOf(deps, s, next)));
+				})
+			},
+			submit: () => void 0,
+			escape: (s) => changed(s.matrix) && !s.discardArmed ? {
+				...s,
+				discardArmed: true
+			} : void 0
+		},
+		prompt: {
+			view: ({ state, theme }) => linesView(toned(promptView(state, theme.glyph)), theme),
+			submit: (s, line, ctx) => {
+				const text = line.trim();
+				switch (s.purpose) {
+					case "add-ns":
+						if (s.back === null) return void 0;
+						if (!NS_NAME.test(text)) return {
+							...s,
+							error: "a namespace is letters, digits, _ . - or *"
+						};
+						switchTo(ctx, deps, "edit", {
+							...s.back,
+							matrix: addNamespace(s.back.matrix, text),
+							discardArmed: false,
+							note: null
+						});
+						return;
+					case "reg-kid":
+						if (text === "") return {
+							...s,
+							error: "a kid is required"
+						};
+						if (s.table.some((r) => r.kid === text)) return {
+							...s,
+							error: `${text} is already live — revoke it first`
+						};
+						return {
+							...s,
+							purpose: "reg-pubkey",
+							label: "public key path",
+							kid: text,
+							error: null
+						};
+					case "reg-pubkey": {
+						const expanded = expandHome(text);
+						if ("error" in expanded) return {
+							...s,
+							error: expanded.error
+						};
+						const path = expanded.path;
+						const kid = s.kid;
+						readFile(path, "utf8").then((pem) => {
+							const read = readPublicKey(pem);
+							ctx.update("prompt", (cur) => cur.purpose !== "reg-pubkey" || cur.kid !== kid ? cur : read.ok ? {
+								...cur,
+								purpose: "reg-name",
+								label: "name (enter for none)",
+								publicKey: pem,
+								algorithm: read.algorithm,
+								fingerprint: read.fingerprint,
+								error: null
+							} : {
+								...cur,
+								error: read.reason
+							});
+						}, (err) => {
+							const code = err.code;
+							const why = typeof code === "string" ? code : "unreadable";
+							ctx.update("prompt", (cur) => cur.purpose !== "reg-pubkey" || cur.kid !== kid ? cur : {
+								...cur,
+								error: `cannot read ${path}: ${why}`
+							});
+						});
+						return {
+							...s,
+							error: null
+						};
+					}
+					case "reg-name":
+						if (s.kid === void 0 || s.publicKey === void 0 || s.algorithm === void 0 || s.fingerprint === void 0) return;
+						openEditor(ctx, deps, {
+							kind: "register",
+							kid: s.kid,
+							publicKey: s.publicKey,
+							algorithm: s.algorithm,
+							fingerprint: s.fingerprint,
+							...text !== "" ? { name: text } : {}
+						}, s.table, "prompt");
+						return;
+					case "invite-ttl": {
+						if (s.back === null) return void 0;
+						const ttl = readInviteTtl(line);
+						if ("error" in ttl) return {
+							...s,
+							error: ttl.error
+						};
+						const next = result(s.back.matrix);
+						switchTo(ctx, deps, "review", reviewOf(s.back, next, verdictOf(deps, s.back, next), ttl.ttlMs));
+						return;
+					}
+				}
+			},
+			escape: (s, ctx) => {
+				if (s.back !== null) switchTo(ctx, deps, "edit", s.back);
+				else loadKeys(ctx, deps);
+			}
+		},
+		review: {
+			view: ({ state, theme, armed, size }) => linesView(toned(reviewView(state, theme.glyph, armed, size)), theme),
+			confirm: [{
+				key: "y",
+				act: "apply",
+				label: "applies this change"
+			}],
+			on: { apply: (s, ctx) => s.stage === "review" && s.verdict.kind === "ok" && s.verdict.tier === 1 ? apply(s, ctx) : void 0 },
+			submit: (s, line, ctx) => {
+				if (!(s.stage === "review" && s.verdict.kind === "ok" && s.verdict.tier === 2)) return;
+				return line === targetOf$1(s.flow) ? apply(s, ctx) : {
+					...s,
+					mismatch: true
+				};
+			},
+			escape: (s, ctx) => {
+				if (s.stage === "applying") return s;
+				if (s.stage !== "done" && s.edit !== null) switchTo(ctx, deps, "edit", s.edit);
+				else loadKeys(ctx, deps);
+			}
+		}
+	};
+	/** After a confirmable 422 the verdict was judged on state the server no longer holds: the key's
+	*  row, the key table or the hosted set. Re-reads the table and the hosted namespaces, swaps the
+	*  fresh row into the flow and the editor it returns to, and recomputes the verdict, so the next
+	*  review (Esc, Enter) shows the real tier and flags. The refusal stays visible; nothing is sent. */
+	async function refreshReview(ctx, at) {
+		let rows;
+		let hosted;
+		try {
+			rows = await deps.admin.run(({ client }) => client.admin.keys({ signal: ctx.signal }));
+			hosted = hostedNamespaces(await deps.federatedSchema());
+		} catch {
+			ctx.update("review", (x) => x.flow === at.flow && x.stage === "refused" ? {
+				...x,
+				refreshNote: "could not refresh the key table or hosted namespaces — esc back, then reopen it"
+			} : x);
+			return;
+		}
+		if (!deps.admin.unlocked()) return;
+		ctx.update("review", (x) => {
+			if (x.flow !== at.flow || x.stage !== "refused") return x;
+			const f = x.flow;
+			const gone = (kid) => ({
+				...x,
+				edit: null,
+				table: rows,
+				mismatch: false,
+				refreshNote: `${kid} is no longer in the key table — esc back and reopen it`,
+				verdict: {
+					kind: "refused",
+					code: "not_found",
+					message: `${kid} is no longer in the key table`
+				}
+			});
+			if (f.kind === "revoke") {
+				const row = rows.find((r) => r.kid === f.row.kid);
+				return row === void 0 ? gone(f.row.kid) : {
+					...x,
+					flow: {
+						kind: "revoke",
+						row
+					},
+					table: rows,
+					verdict: revokeVerdict({
+						kid: row.kid,
+						table: rows,
+						adminCapability: adminCapabilityOf(deps.adminEnv).adminCapability ?? "admin"
+					})
+				};
+			}
+			if (x.edit === null || x.next === null) return x;
+			let flow = x.edit.flow;
+			let matrix = {
+				...x.edit.matrix,
+				hosted: new Set(hosted)
+			};
+			if (flow.kind === "update") {
+				const row = rows.find((r) => r.kid === flow.row.kid);
+				if (row === void 0) return gone(flow.row.kid);
+				const before = rowGrant(row);
+				if (before === null) return {
+					...x,
+					edit: null,
+					table: rows,
+					refreshNote: `${row.kid}: its stored grant does not parse — esc back and reopen it`,
+					verdict: {
+						kind: "refused",
+						code: "unparseable_grant",
+						message: "stored grant does not parse"
+					}
+				};
+				flow = {
+					kind: "update",
+					row
+				};
+				const extra = [...before.keys()].filter((ns) => !matrix.rows.includes(ns));
+				matrix = {
+					...matrix,
+					before,
+					rows: [...matrix.rows, ...extra]
+				};
+			}
+			const edit = {
+				...x.edit,
+				flow,
+				matrix,
+				table: rows
+			};
+			return {
+				...x,
+				flow,
+				edit,
+				table: rows,
+				mismatch: false,
+				verdict: verdictOf(deps, edit, x.next)
+			};
+		});
+	}
+	/** Sends exactly what the verdict judged, with only the flags it named; the result lands through `ctx.update`. */
+	function apply(s, ctx) {
+		const v = s.verdict;
+		if (v.kind !== "ok") return s;
+		const flag = (f) => v.flags.includes(f) ? { [f]: true } : {};
+		const f = s.flow;
+		const st = deps.admin.state();
+		const who = st.kind === "unlocked" ? st.kid : "unknown";
+		deps.admin.run(async ({ client }) => {
+			if (f.kind === "revoke") {
+				await client.admin.revoke(f.row.kid);
+				return { line: `✓ revoked ${f.row.kid}` };
+			}
+			const w = toWire(s.next ?? /* @__PURE__ */ new Map());
+			const shown = compactGrant(w.namespaces.join(","), w.capabilities.join(","));
+			if (f.kind === "update") {
+				await client.admin.update({
+					kid: f.row.kid,
+					...w,
+					...flag("widen"),
+					...flag("allowAdmin"),
+					...flag("allowUnknownNs")
+				});
+				return {
+					line: `✓ granted ${f.row.kid} ${shown}`,
+					select: f.row.kid
+				};
+			}
+			if (f.kind === "register") {
+				const out = await client.admin.register({
+					kid: f.kid,
+					publicKey: f.publicKey,
+					algorithm: f.algorithm,
+					...f.name !== void 0 ? { name: f.name } : {},
+					...w,
+					...flag("allowAdmin"),
+					...flag("allowUnknownNs")
+				});
+				return {
+					line: `✓ registered ${f.kid} ${shown} ${out.fingerprint}`,
+					select: f.kid
+				};
+			}
+			const out = await client.admin.invite({
+				...w,
+				...s.ttlMs !== void 0 ? { ttlMs: s.ttlMs } : {}
+			});
+			return {
+				line: `✓ invite minted for ${shown}, expires ${out.expiresAt}`,
+				code: out.code
+			};
+		}).then((r) => {
+			ctx.print(sanitise(`${r.line} (admin: ${who})`), "ok");
+			let open = false;
+			ctx.update("review", (x) => {
+				open = true;
+				return r.code !== void 0 ? {
+					...x,
+					stage: "done",
+					inviteCode: r.code
+				} : {
+					...x,
+					stage: "done"
+				};
+			});
+			if (open && r.code === void 0 && deps.admin.unlocked()) loadKeys(ctx, deps, r.select);
+		}, (err) => {
+			const error = refusalOf(err);
+			let open = false;
+			ctx.update("review", (x) => {
+				open = true;
+				return {
+					...x,
+					stage: "refused",
+					error
+				};
+			});
+			if (!open) ctx.print(`${error.code}: ${error.message}`, "error");
+			else if (CONFIRMABLE.has(error.code)) refreshReview(ctx, s);
+		});
+		return {
+			...s,
+			stage: "applying"
+		};
+	}
+}
+
+//#endregion
+//#region src/keys/module.ts
+/**
+* `/keys`: the active key table. Unlocked it reads as the admin identity: Enter edits a
+* row's grant (editor.tsx), `x` revokes it, `i` mints an invite and `n` registers a new key, each
+* through a review. Locked, it reads as the agent, which a 403 turns into "admin required", and
+* Enter shows a row's grant read-only. Locking closes the table and every editor panel.
+*/
+/** Opens the table and reads it; `select` is a kid whose row takes the cursor once the read lands. */
+async function loadKeys(ctx, deps, select) {
+	const source = deps.admin.unlocked() ? "admin" : "agent";
+	ctx.open("keys", {
+		source,
+		rows: null,
+		note: null,
+		cursor: 0,
+		detail: false
+	});
+	try {
+		const rows = source === "admin" ? await deps.admin.run(({ client }) => client.admin.keys({ signal: ctx.signal })) : await deps.keys(ctx.signal);
+		const at = select === void 0 ? -1 : rows.findIndex((r) => r.kid === select);
+		const cursor = Math.max(0, at);
+		ctx.update("keys", (s) => s.source === source ? {
+			...s,
+			rows,
+			cursor
+		} : s);
+	} catch (err) {
+		const note = source === "admin" && err instanceof AuthError && err.code !== void 0 && err.code !== "forbidden" ? `could not read keys: ${err.code}: ${err.serverMessage ?? err.message}` : err instanceof AuthError ? "admin required — /admin unlock" : `could not read keys: ${err instanceof Error ? err.message : String(err)}`;
+		ctx.update("keys", (s) => s.source === source ? {
+			...s,
+			rows: null,
+			note
+		} : s);
+	}
+}
+function keysModule(deps) {
+	const move = (d) => (s) => s.rows === null || s.detail ? void 0 : {
+		...s,
+		cursor: Math.max(0, Math.min(s.rows.length - 1, s.cursor + d))
+	};
+	return defineModule("substrate.keys", {
+		commands: [{
+			name: "keys",
+			summary: "the active key table",
+			args: [],
+			run: (_, ctx) => loadKeys(ctx, deps)
+		}],
+		panels: {
+			keys: {
+				view: ({ state, theme, size }) => {
+					const w = Math.max(1, size.columns - 2);
+					const count = state.rows === null ? "" : ` · ${state.rows.length} active`;
+					const head = `${theme.glyph.title} keys${count} · ${state.source}`;
+					if (state.note !== null) return [head, `  ${sanitise(state.note)}`].join("\n");
+					if (state.rows === null) return [head, "  reading…"].join("\n");
+					const pick = state.rows[state.cursor];
+					if (state.detail && pick !== void 0) return [
+						head,
+						truncateCells(sanitise(`  ${pick.kid}  ${pick.name}  ${pick.algorithm}`), w),
+						...describeGrant(pick.namespaces, pick.capabilities).map((g) => truncateCells(sanitise(`    ${g}`), w)),
+						"  backspace back · esc close"
+					].join("\n");
+					const kidW = Math.min(40, Math.max(4, ...state.rows.map((r) => r.kid.length)));
+					const nameW = Math.min(24, Math.max(4, ...state.rows.map((r) => r.name.length)));
+					const max = Math.max(1, size.rows - 3);
+					const start = Math.max(0, Math.min(state.cursor - max + 1, state.rows.length - max));
+					return [
+						head,
+						...state.rows.slice(start, start + max).map((r, k) => {
+							const mark = start + k === state.cursor ? theme.glyph.cursor : " ";
+							const grant = compactGrant(r.namespaces, r.capabilities);
+							return truncateCells(sanitise(`${mark} ${r.kid.padEnd(kidW)}  ${r.name.padEnd(nameW)}  ${grant}`), w);
+						}),
+						truncateCells(`  ${GRANT_LEGEND}`, w),
+						state.source === "admin" && deps.admin.unlocked() ? "  ↑↓/jk move · enter edit · x revoke · i invite · n register · esc close" : "  ↑↓/jk move · enter grant · esc close"
+					].join("\n");
+				},
+				keymap: [
+					{
+						key: "up",
+						act: "up"
+					},
+					{
+						key: "k",
+						act: "up"
+					},
+					{
+						key: "down",
+						act: "down"
+					},
+					{
+						key: "j",
+						act: "down"
+					},
+					{
+						key: "enter",
+						act: "in"
+					},
+					{
+						key: "backspace",
+						act: "out"
+					},
+					{
+						key: "n",
+						act: "register"
+					},
+					{
+						key: "i",
+						act: "invite"
+					},
+					{
+						key: "x",
+						act: "revoke"
+					}
+				],
+				on: {
+					up: move(-1),
+					down: move(1),
+					in: (s, ctx) => {
+						if (s.rows === null || s.rows.length === 0) return void 0;
+						if (deps.admin.unlocked() && s.source === "admin") {
+							openEditor(ctx, deps, {
+								kind: "update",
+								row: s.rows[s.cursor]
+							}, s.rows);
+							return;
+						}
+						return {
+							...s,
+							detail: true
+						};
+					},
+					out: (s) => s.detail ? {
+						...s,
+						detail: false
+					} : void 0,
+					register: (s, ctx) => {
+						if (!(deps.admin.unlocked() && s.source === "admin" && s.rows !== null && !s.detail)) return;
+						ctx.setDraft("");
+						switchTo(ctx, deps, "prompt", {
+							purpose: "reg-kid",
+							label: "kid to register",
+							error: null,
+							back: null,
+							table: s.rows
+						});
+					},
+					invite: (s, ctx) => {
+						if (!(deps.admin.unlocked() && s.source === "admin" && s.rows !== null && !s.detail)) return;
+						openEditor(ctx, deps, { kind: "invite" }, s.rows);
+					},
+					revoke: (s, ctx) => {
+						if (!(deps.admin.unlocked() && s.source === "admin" && s.rows !== null && !s.detail)) return;
+						const row = s.rows[s.cursor];
+						if (row === void 0) return void 0;
+						ctx.setDraft("");
+						switchTo(ctx, deps, "review", {
+							flow: {
+								kind: "revoke",
+								row
+							},
+							edit: null,
+							next: null,
+							verdict: revokeVerdict({
+								kid: row.kid,
+								table: s.rows,
+								adminCapability: adminCapabilityOf(deps.adminEnv).adminCapability ?? "admin"
+							}),
+							stage: "review",
+							error: null,
+							mismatch: false,
+							table: s.rows
+						});
+					}
+				}
+			},
+			...editorPanels(deps)
+		},
+		init(ctx) {
+			const off = deps.admin.onChange((st) => {
+				if (st.kind !== "locked") return;
+				let adminOpen = false;
+				ctx.update("keys", (s) => {
+					adminOpen = s.source === "admin";
+					return s;
+				});
+				for (const p of [
+					"edit",
+					"prompt",
+					"review"
+				]) ctx.update(p, (x) => {
+					if (!(p === "review" && "inviteCode" in x && x.inviteCode !== void 0)) adminOpen = true;
+					return x;
+				});
+				if (adminOpen) {
+					ctx.close();
+					ctx.print("keys closed — admin locked", "warn");
+				}
+			});
+			return () => {
+				off();
+			};
+		}
+	});
+}
+
+//#endregion
+//#region src/schema/module.tsx
+/** `rec[key]` only when `key` is the record's own property: names come from the server and the user. */
+const own = (rec, key) => rec !== void 0 && key !== void 0 && Object.hasOwn(rec, key) ? rec[key] : void 0;
+const typesOf = (s) => own(s.schema, s.ns)?.types ?? {};
+const items = (s) => {
+	if (s.level === "ns") return Object.keys(s.schema).sort();
+	const types = typesOf(s);
+	if (s.level === "type") return Object.keys(types).sort();
+	const fields = own(types, s.type)?.fields;
+	return Object.keys(fields ?? {}).sort();
+};
+function fieldLine(s, name) {
+	const def = own(own(typesOf(s), s.type)?.fields, name);
+	const pf = own(own(s.pack?.types, s.type)?.fields, name);
+	const parts = [name, `${String(def?.kind ?? "?")}${def?.type !== void 0 ? `/${String(def.type)}` : ""}`];
+	if (def?.indexed === true) parts.push("indexed");
+	const en = def?.enum ?? pf?.enum;
+	if (en !== void 0 && en.length > 0) parts.push(`enum: ${en.join(", ")}`);
+	if (pf?.aliases !== void 0 && Object.keys(pf.aliases).length > 0) parts.push(`aliases: ${Object.entries(pf.aliases).map(([a, c]) => `${a}→${c}`).join(" ")}`);
+	if (pf !== void 0 && pf.operators.length > 0) parts.push(`ops: ${pf.operators.join(" ")}`);
+	return parts.join("  ");
+}
+function schemaModule(deps) {
+	const loadPack = (ns, ctx) => {
+		deps.nl.pack(ns, { signal: ctx.signal }).then((pack) => ctx.update("schema", (s) => s.ns === ns ? {
+			...s,
+			pack
+		} : s), () => void 0);
+	};
+	const move = (d) => (s) => ({
+		...s,
+		cursor: Math.max(0, Math.min(items(s).length - 1, s.cursor + d))
+	});
+	const into = (s, ctx) => {
+		const pick = items(s)[s.cursor];
+		if (pick === void 0) return void 0;
+		if (s.level === "ns") {
+			loadPack(pick, ctx);
+			const { pack: _drop, ...rest } = s;
+			return {
+				...rest,
+				level: "type",
+				ns: pick,
+				cursor: 0
+			};
+		}
+		if (s.level === "type") return {
+			...s,
+			level: "field",
+			type: pick,
+			cursor: 0
+		};
+	};
+	const out = (s) => {
+		if (s.level === "field") {
+			const back = {
+				...s,
+				level: "type"
+			};
+			return {
+				...back,
+				cursor: Math.max(0, items(back).indexOf(s.type ?? ""))
+			};
+		}
+		if (s.level === "type") {
+			const { ns: _ns, pack: _p, type: _t, ...rest } = s;
+			const back = {
+				...rest,
+				level: "ns",
+				cursor: 0
+			};
+			return {
+				...back,
+				cursor: Math.max(0, items(back).indexOf(s.ns ?? ""))
+			};
+		}
+	};
+	return defineModule("substrate.schema", {
+		commands: [{
+			name: "schema",
+			summary: "browse namespaces, types and fields",
+			args: [{
+				name: "namespace",
+				optional: true
+			}, {
+				name: "type",
+				optional: true
+			}],
+			async run([ns, type], ctx) {
+				let schema;
+				try {
+					schema = await deps.federatedSchema();
+				} catch (err) {
+					ctx.print(`schema unavailable: ${sanitise(err instanceof Error ? err.message : String(err))}`, "error");
+					return;
+				}
+				if (ns !== void 0 && !Object.hasOwn(schema, ns)) return ctx.print(`unknown namespace '${sanitise(ns)}'`, "warn");
+				if (ns !== void 0 && type !== void 0 && !Object.hasOwn(schema[ns]?.types ?? {}, type)) return ctx.print(`unknown type '${sanitise(type)}' in ${sanitise(ns)}`, "warn");
+				const state = ns === void 0 ? {
+					level: "ns",
+					schema,
+					cursor: 0
+				} : type === void 0 ? {
+					level: "type",
+					schema,
+					ns,
+					cursor: 0
+				} : {
+					level: "field",
+					schema,
+					ns,
+					type,
+					cursor: 0
+				};
+				ctx.open("schema", state);
+				if (ns !== void 0) loadPack(ns, ctx);
+			}
+		}],
+		panels: { schema: {
+			view: ({ state, theme, size }) => {
+				const head = state.level === "ns" ? "namespaces" : state.level === "type" ? `${state.ns} · types` : `${state.ns}/${state.type} · fields`;
+				const all = items(state);
+				const max = Math.max(1, size.rows - 2);
+				const start = Math.max(0, Math.min(state.cursor - max + 1, all.length - max));
+				const lines = all.slice(start, start + max).map((name, k) => {
+					const mark = start + k === state.cursor ? theme.glyph.cursor : " ";
+					const body = state.level === "ns" ? `${name}  ${Object.keys(state.schema[name]?.types ?? {}).length} types` : state.level === "type" ? `${name}  ${Object.keys(typesOf(state)[name]?.fields ?? {}).length} fields` : fieldLine(state, name);
+					return truncateCells(sanitise(`${mark} ${body}`), Math.max(1, size.columns - 2));
+				});
+				return [
+					truncateCells(sanitise(`${theme.glyph.title} ${head}`), size.columns),
+					...lines,
+					truncateCells("  ↑↓/jk move · enter open · backspace up · esc close", size.columns)
+				].join("\n");
+			},
+			keymap: [
+				{
+					key: "up",
+					act: "up"
+				},
+				{
+					key: "k",
+					act: "up"
+				},
+				{
+					key: "down",
+					act: "down"
+				},
+				{
+					key: "j",
+					act: "down"
+				},
+				{
+					key: "enter",
+					act: "in"
+				},
+				{
+					key: "backspace",
+					act: "out"
+				}
+			],
+			on: {
+				up: move(-1),
+				down: move(1),
+				in: into,
+				out: (s) => out(s)
+			}
+		} }
+	});
+}
+
+//#endregion
+//#region src/status/module.ts
+const HEALTH_INTERVAL_MS = 1e4;
+const HEALTH_TIMEOUT_MS = 5e3;
+function statusModule(deps, opts = {}) {
+	let conn = "connecting";
+	let namespace = deps.namespace;
+	let inFlight = 0;
+	const presenceText = () => {
+		const parts = [conn === "live" ? "● live" : conn === "offline" ? "○ offline" : conn === "reconnecting" ? "◌ reconnecting" : "◌ …", clean(namespace)];
+		if (conn === "live" && inFlight > 0) parts.push(`${inFlight} in flight`);
+		return parts.join(" · ");
+	};
+	return defineModule("substrate.status", {
+		presence: {
+			name: "s u b s t r a t e",
+			view: presenceText
+		},
+		init(ctx) {
+			conn = "connecting";
+			namespace = deps.namespace;
+			inFlight = 0;
+			const repaint = () => ctx.status("presence-tick", null);
+			let everLive = false;
+			let stopped = false;
+			let polling = false;
+			let needWho = false;
+			ctx.status("version", "…", "dim");
+			ctx.status("who", "…", "dim");
+			const fetchWho = () => deps.getJson("/substrate/v1/whoami", ctx.signal).then((w) => {
+				if (stopped) return;
+				const id = w?.identity?.id;
+				ctx.status("who", typeof id === "string" ? clean(id) : "anon", "dim");
+			}, () => {
+				if (!stopped) ctx.status("who", "anon?", "dim");
+			});
+			let metricsPending = false;
+			const fetchInFlight = async () => {
+				if (metricsPending) return;
+				metricsPending = true;
+				const timeout = new AbortController();
+				const timer = setTimeout(() => timeout.abort(), HEALTH_TIMEOUT_MS);
+				try {
+					const n = (await deps.getJson("/substrate/v1/metrics", AbortSignal.any([ctx.signal, timeout.signal])))?.process?.inFlight;
+					if (!stopped && conn === "live") inFlight = typeof n === "number" && Number.isFinite(n) && n > 0 ? n : 0;
+				} catch {
+					inFlight = 0;
+				} finally {
+					clearTimeout(timer);
+					metricsPending = false;
+					if (!stopped) repaint();
+				}
+			};
+			const poll = async () => {
+				if (polling) return;
+				polling = true;
+				const timeout = new AbortController();
+				const timer = setTimeout(() => timeout.abort(), HEALTH_TIMEOUT_MS);
+				try {
+					const h = await deps.getJson("/health", AbortSignal.any([ctx.signal, timeout.signal]));
+					if (stopped) return;
+					everLive = true;
+					conn = "live";
+					repaint();
+					fetchInFlight();
+					if (typeof h.version === "string") ctx.status("version", clean(`v${h.version}`), "dim");
+					if (needWho) {
+						needWho = false;
+						fetchWho();
+					}
+				} catch {
+					if (stopped) return;
+					needWho = true;
+					conn = everLive ? "reconnecting" : "offline";
+					inFlight = 0;
+					repaint();
+					ctx.status("version", "…", "dim");
+				} finally {
+					clearTimeout(timer);
+					polling = false;
+				}
+			};
+			poll();
+			fetchWho();
+			const off = ctx.on("substrate/ns", (e) => {
+				namespace = e.namespace;
+				repaint();
+			});
+			const timer = setInterval(() => void poll(), opts.intervalMs ?? 1e4);
+			return () => {
+				stopped = true;
+				clearInterval(timer);
+				off();
+			};
+		}
+	});
+}
+
+//#endregion
+//#region src/surgery/args.ts
+const NS = /^[A-Za-z_][\w-]*$/;
+const TYPE = /^([A-Za-z_][\w-]*)\/([A-Za-z_]\w*)$/;
+const FIELD = /^([A-Za-z_][\w-]*)\/([A-Za-z_]\w*)\.([A-Za-z_]\w*)$/;
+const USAGE = {
+	"drop-namespace": "usage: /drop-namespace <ns> [--cascade]",
+	"drop-type": "usage: /drop-type <ns>/<Type> [--cascade]",
+	backfill: "usage: /backfill <ns>/<Type>.<field> --values <file.json> [--overwrite]",
+	normalise: "usage: /normalise <ns>/<Type>.<field> [--reject a,b]",
+	reindex: "usage: /reindex [<ns>/<Type> …]"
+};
+/** The deployment's own namespace. The server refuses to drop it too; this fails earlier and says why. */
+const SUBSTRATE = "_system";
+const OWN = "_system is the deployment's own namespace and cannot be dropped";
+/** Flags each command takes; `true` means the flag carries a value. */
+const FLAGS = {
+	"drop-namespace": { "--cascade": false },
+	"drop-type": { "--cascade": false },
+	backfill: {
+		"--values": true,
+		"--overwrite": false
+	},
+	normalise: { "--reject": true },
+	reindex: {}
+};
+function parseOp(command, args) {
+	const usage = { error: USAGE[command] };
+	const allowed = FLAGS[command];
+	const positional = [];
+	const flags = /* @__PURE__ */ new Map();
+	for (let i = 0; i < args.length; i++) {
+		const a = args[i];
+		if (!a.startsWith("--")) {
+			positional.push(a);
+			continue;
+		}
+		if (!(a in allowed)) return { error: `unknown flag '${a}' for /${command}` };
+		if (flags.has(a)) return { error: `flag '${a}' given twice for /${command}` };
+		if (allowed[a]) {
+			const v = args[i + 1];
+			if (v === void 0 || v.startsWith("--")) return usage;
+			flags.set(a, v);
+			i++;
+		} else flags.set(a, true);
+	}
+	switch (command) {
+		case "drop-namespace": {
+			const [ns, ...rest] = positional;
+			if (ns === void 0 || rest.length > 0 || !NS.test(ns)) return usage;
+			if (ns === SUBSTRATE) return { error: OWN };
+			return {
+				kind: "drop-namespace",
+				namespace: ns,
+				cascade: flags.has("--cascade")
+			};
+		}
+		case "drop-type": {
+			const m = positional.length === 1 ? TYPE.exec(positional[0]) : null;
+			if (m === null) return usage;
+			if (m[1] === SUBSTRATE) return { error: OWN };
+			return {
+				kind: "drop-type",
+				namespace: m[1],
+				type: m[2],
+				cascade: flags.has("--cascade")
+			};
+		}
+		case "backfill": {
+			const m = positional.length === 1 ? FIELD.exec(positional[0]) : null;
+			const values = flags.get("--values");
+			if (m === null || typeof values !== "string") return usage;
+			return {
+				kind: "backfill",
+				namespace: m[1],
+				type: m[2],
+				field: m[3],
+				valuesPath: values,
+				overwrite: flags.has("--overwrite")
+			};
+		}
+		case "normalise": {
+			const m = positional.length === 1 ? FIELD.exec(positional[0]) : null;
+			if (m === null) return usage;
+			const csv = flags.get("--reject");
+			return {
+				kind: "normalise",
+				namespace: m[1],
+				type: m[2],
+				field: m[3],
+				reject: typeof csv === "string" ? csv.split(",").map((s) => s.trim()).filter((s) => s !== "") : []
+			};
+		}
+		case "reindex": {
+			const targets = [];
+			for (const p of positional) {
+				const m = TYPE.exec(p);
+				if (m === null) return usage;
+				if (targets.some((t) => t.namespace === m[1] && t.type === m[2])) return { error: `${p} named twice` };
+				targets.push({
+					namespace: m[1],
+					type: m[2]
+				});
+			}
+			return {
+				kind: "reindex",
+				targets
+			};
+		}
+	}
+}
+/** What the tier-2 gesture asks to be typed. Never pre-filled. */
+function targetOf(op) {
+	switch (op.kind) {
+		case "drop-namespace": return op.namespace;
+		case "drop-type": return `${op.namespace}/${op.type}`;
+		case "backfill":
+		case "normalise": return `${op.namespace}/${op.type}.${op.field}`;
+		case "reindex": return "reindex";
+	}
+}
+
+//#endregion
+//#region src/surgery/preview.ts
+/** Previews: what each surgery op would do, computed against the admin client before the operator types the target. */
+const line$1 = (text, tone) => ({
+	text: sanitise(text),
+	...tone !== void 0 ? { tone } : {}
+});
+const ready = (lines, apply) => ({
+	kind: "ready",
+	lines,
+	apply
+});
+function refused(refusal, extra = []) {
+	return {
+		kind: "refused",
+		refusal,
+		lines: [line$1(`${refusal.code}: ${refusal.message}`, "error"), ...extra]
+	};
+}
+const local = (code, message) => refused({
+	code,
+	message: sanitise(message)
+});
+const sig = (env) => env.signal !== void 0 ? { signal: env.signal } : {};
+const num = (v) => typeof v === "number" ? v : Number(v ?? 0);
+async function previewOf(op, admin, env) {
+	try {
+		switch (op.kind) {
+			case "drop-namespace":
+			case "drop-type": return await dropPreview(op, admin, env);
+			case "backfill": return await backfillPreview(op, admin, env);
+			case "normalise": return await normalisePreview(op, admin, env);
+			case "reindex": return await reindexPreview(op, admin, env);
+		}
+	} catch (err) {
+		if (isKeyRejection(err)) throw err;
+		return refusedFrom(err, op);
+	}
+}
+function refusedFrom(err, op) {
+	const refusal = refusalOf(err);
+	return refused(refusal, refusalDetail(refusal, op));
+}
+/** The route-specific detail of a server refusal, sanitised: the preview and the apply both show it. */
+function refusalDetail(refusal, op) {
+	const extra = [];
+	const body = refusal.body;
+	if (refusal.code === "dangling_edges" && body !== void 0) {
+		extra.push(line$1(`${num(body.edgeCount)} dangling edges — pass --cascade to delete them`, "warn"));
+		const samples = Array.isArray(body.sampleEdges) ? body.sampleEdges.slice(0, 5) : [];
+		for (const s of samples) {
+			const id = s?.id;
+			if (id !== void 0) extra.push(line$1(`  ${String(id)}`, "dim"));
+		}
+	} else if (refusal.code === "destructive_ops_disabled") extra.push(line$1("this deployment refuses destructive operations (SUBSTRATE_HARD_DELETE=refuse)", "warn"));
+	else if (op.kind === "backfill" && body !== void 0 && Array.isArray(body.invalid)) for (const i of body.invalid.slice(0, 8)) {
+		const e = i;
+		extra.push(line$1(`${String(e.id)}: ${String(e.value)} (${String(e.reason)})`, "dim"));
+	}
+	else if (op.kind === "normalise" && body !== void 0 && Array.isArray(body.unmapped)) {
+		for (const u of body.unmapped.slice(0, 8)) {
+			const e = u;
+			extra.push(line$1(`${String(e.value)} · ${num(e.count)}`, "warn"));
+		}
+		if (body.unmapped.length > 8) extra.push(line$1(`… ${body.unmapped.length - 8} more values`, "dim"));
+	}
+	return extra;
+}
+async function dropPreview(op, admin, env) {
+	const base = {
+		confirm: targetOf(op),
+		cascade: op.cascade ? "delete" : "refuse",
+		dryRun: true
+	};
+	const r = op.kind === "drop-namespace" ? await admin.dropNamespace({
+		namespace: op.namespace,
+		...base
+	}, sig(env)) : await admin.dropType({
+		namespace: op.namespace,
+		type: op.type,
+		...base
+	}, sig(env));
+	const lines = [line$1(`would delete ${r.rowsDeleted} rows · ${r.edgesDeleted} edges · ${r.shortIdsDeleted} shortIds`), line$1(`cascade: ${base.cascade}`, "dim")];
+	if (op.kind === "drop-type") lines.push(line$1("drops data only — a type still declared reappears on the next boot", "warn"));
+	return ready(lines, { kind: op.kind });
+}
+async function backfillPreview(op, admin, env) {
+	const p = expandHome(op.valuesPath, env.home);
+	if ("error" in p) return local("bad_path", p.error);
+	let raw;
+	try {
+		raw = env.readFile(p.path);
+	} catch (err) {
+		return local("unreadable", `cannot read ${p.path}: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		return local("not_json", `${p.path} is not valid JSON`);
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return local("not_an_object", `${p.path} must hold a JSON object of row id → value`);
+	const values = parsed;
+	const r = await admin.backfill({
+		namespace: op.namespace,
+		type: op.type,
+		field: op.field,
+		values,
+		overwrite: op.overwrite
+	}, sig(env));
+	const lines = [line$1(`values: ${resolve(p.path)} · ${Object.keys(values).length} entries`), line$1(`${r.requested} requested · would write ${r.write}`)];
+	const counts = Object.entries(r.counts).sort((a, b) => b[1] - a[1]);
+	for (const [value, n] of counts.slice(0, 8)) lines.push(line$1(`  ${value} · ${n}`, "dim"));
+	if (counts.length > 8) lines.push(line$1(`  … ${counts.length - 8} more values`, "dim"));
+	if (r.kept > 0 && !op.overwrite) lines.push(line$1(`kept ${r.kept} existing (pass --overwrite to replace)`));
+	if (r.unchanged > 0) lines.push(line$1(`unchanged ${r.unchanged}`));
+	if (r.missing.length > 0) lines.push(line$1(`missing ${r.missing.length} id(s)`, "warn"));
+	if (r.chunks > 1) lines.push(line$1(`${r.chunks} requests of up to 5000 rows — apply is NOT atomic: a refusal part-way leaves earlier chunks written`, "warn"));
+	return ready(lines, {
+		kind: "backfill",
+		values
+	});
+}
+async function normalisePreview(op, admin, env) {
+	const r = await admin.normalise({
+		namespace: op.namespace,
+		type: op.type,
+		field: op.field,
+		reject: op.reject
+	}, sig(env));
+	const lines = [line$1(`scanned ${r.scanned}`)];
+	if (r.truncated) lines.push(line$1("scan stopped at its row cap — counts are partial", "warn"));
+	for (const p of r.plan) lines.push(line$1(`${p.from} → ${p.to} · ${p.count}`));
+	for (const u of r.unmapped) lines.push(line$1(`${u.value} · ${u.count}`, "warn"));
+	const unlisted = r.unmapped.filter((u) => !op.reject.includes(String(u.value)));
+	if (r.strict && unlisted.length > 0) return refused({
+		code: "unmapped_values",
+		message: "strict field: values no alias explains must be listed in --reject"
+	}, [...lines, line$1(`not in --reject: ${unlisted.map((u) => u.value).join(", ")}`, "warn")]);
+	if (r.plan.length === 0 && r.unmapped.length === 0) lines.push(line$1("nothing to normalise"));
+	return ready(lines, { kind: "normalise" });
+}
+async function reindexPreview(op, admin, env) {
+	const s = await admin.embedStats(sig(env));
+	if (s.enabled !== true) return local("embedder_disabled", "the server has no embedder enabled");
+	if (s.embeddedTypes === void 0) return local("no_embedded_types", "the server did not report its embedded types");
+	const embedded = s.embeddedTypes;
+	const name = (t) => `${t.namespace}/${t.type}`;
+	const has = (t) => embedded.some((e) => e.namespace === t.namespace && e.type === t.type);
+	const missing = op.targets.filter((t) => !has(t));
+	if (missing.length > 0) return refused({
+		code: "not_embedded",
+		message: `not embedded: ${missing.map(name).join(", ")}`
+	}, [line$1(`embedded types: ${embedded.map(name).join(", ") || "(none)"}`, "dim")]);
+	const types = op.targets.length === 0 ? embedded : op.targets;
+	return ready([
+		line$1(`will re-embed ${types.length} type(s): ${types.map(name).join(", ")}`),
+		line$1("row counts are not known until it runs — this re-embeds for real", "warn"),
+		line$1("esc stops between pages", "warn")
+	], {
+		kind: "reindex",
+		types
+	});
+}
+
+//#endregion
+//#region src/surgery/reindex.ts
+const PAGE_LIMIT = 200;
+async function runReindex(types, page, hooks) {
+	const progress = types.map((ref) => ({
+		ref,
+		scanned: 0,
+		embedded: 0,
+		unindexable: 0,
+		failed: 0,
+		pages: 0,
+		done: false
+	}));
+	for (const p of progress) {
+		let cursor;
+		for (;;) {
+			let r;
+			try {
+				r = await page({
+					namespace: p.ref.namespace,
+					type: p.ref.type,
+					limit: PAGE_LIMIT,
+					...cursor !== void 0 ? { cursor } : {}
+				});
+				if (r.hasMore && typeof r.nextCursor !== "string") throw new Error("server reported hasMore with no nextCursor");
+			} catch (error) {
+				return {
+					kind: "failed",
+					progress,
+					at: p.ref,
+					error
+				};
+			}
+			p.scanned += r.scanned;
+			p.embedded += r.embedded;
+			p.unindexable += r.unindexable;
+			p.failed += r.failed;
+			p.pages += 1;
+			if (!r.hasMore) {
+				p.done = true;
+				hooks.onProgress(progress);
+				const next = progress[progress.indexOf(p) + 1];
+				if (next !== void 0 && hooks.stopRequested()) return {
+					kind: "stopped",
+					progress,
+					at: next.ref,
+					cursor: void 0
+				};
+				break;
+			}
+			cursor = r.nextCursor;
+			hooks.onProgress(progress);
+			if (hooks.stopRequested()) return {
+				kind: "stopped",
+				progress,
+				at: p.ref,
+				cursor
+			};
+		}
+	}
+	return {
+		kind: "done",
+		progress
+	};
+}
+
+//#endregion
+//#region src/surgery/module.tsx
+/**
+* The surgery commands: `/drop-namespace`, `/drop-type`, `/backfill`, `/normalise` and
+* `/reindex` each open the one `surgery` panel, which previews, then applies only once the exact
+* target is typed (tier 2). Stages: previewing → preview → applying → done | refused | stopped.
+* Every update after an await goes through `ours`, which writes only into the panel this op opened:
+* a closed panel, or a later command's, is never written by an earlier request.
+*
+* One surgery write at a time: while an apply is in flight every surgery command is unavailable,
+* until that apply settles, even if a lock closed its panel. Opening any other panel stops a
+* running reindex between pages (its loop reads "is my panel still open?" as its stop check), and
+* the transcript says where: `■ reindex stopped at <ns>/<Type> (cursor …)`.
+* An apply request that never returns keeps that flag set: a lock does not cancel a request
+* already in flight (the admin session's contract), so only restarting the TUI clears it.
+*/
+const line = (text, tone) => ({
+	text: sanitise(text),
+	...tone !== void 0 ? { tone } : {}
+});
+const SUMMARY = {
+	"drop-namespace": "delete every row of a namespace (admin; previews first, then type the target)",
+	"drop-type": "delete every row of a type (admin; previews first, then type the target)",
+	backfill: "write a field from a JSON file of row id → value (admin)",
+	normalise: "migrate a field's aliases to their canonical values (admin)",
+	reindex: "re-embed every row of the embedded types, page by page (admin)"
+};
+const name = (t) => `${t.namespace}/${t.type}`;
+function progressLines(progress) {
+	const w = Math.max(...progress.map((p) => name(p.ref).length));
+	return progress.map((p) => line(`  ${name(p.ref).padEnd(w)}  scanned ${p.scanned} · embedded ${p.embedded} · unindexable ${p.unindexable} · failed ${p.failed}${p.done ? " ✓" : ""}`, p.failed > 0 ? "warn" : void 0));
+}
+const zero = (ref) => ({
+	ref,
+	scanned: 0,
+	embedded: 0,
+	unindexable: 0,
+	failed: 0,
+	pages: 0,
+	done: false
+});
+/** A 4xx guarantees the failing backfill chunk wrote nothing (substrate-client AdminBackfillError). */
+function is4xx(err) {
+	const s = err instanceof NetworkError || err instanceof AuthError ? err.status : void 0;
+	return s !== void 0 && s >= 400 && s < 500;
+}
+function surgeryView(s, theme, size) {
+	const w = Math.max(1, size.columns - 2);
+	const fit = (l) => ({
+		...l,
+		text: truncateCells(l.text, w)
+	});
+	const target = sanitise(targetOf(s.op));
+	const head = line(`${theme.glyph.title} surgery › ${target} · ${s.stage}`);
+	const body = [...s.preview?.lines ?? []];
+	const foot = [];
+	switch (s.stage) {
+		case "previewing":
+			body.push(line("previewing…", "dim"));
+			foot.push(line("esc closes", "dim"));
+			break;
+		case "preview":
+			if (s.preview?.kind === "ready") {
+				foot.push(line(`type ${target} then enter to apply · esc closes`));
+				if (s.mismatch) foot.push(line("doesn't match", "error"));
+			} else foot.push(line("apply is unavailable — esc closes"));
+			break;
+		case "applying":
+			if (s.op.kind === "reindex") {
+				foot.push(...s.result);
+				foot.push(line(s.stopping ? "  stopping after this page…" : "  esc stops after this page", "dim"));
+			} else foot.push(...s.result, line("applying…", "dim"));
+			break;
+		case "done":
+		case "refused":
+		case "stopped": foot.push(...s.result, line("esc closes", "dim"));
+	}
+	const room = Math.max(0, size.rows - 1 - foot.length);
+	const shown = body.length <= room ? body : [...body.slice(0, Math.max(0, room - 1)), line(`… ${body.length - room + 1} more`, "dim")];
+	return linesView([
+		head,
+		...shown,
+		...foot
+	].map(fit), theme);
+}
+function surgeryModule(deps, io = {}) {
+	const readFile = io.readFile ?? ((p) => readFileSync(p, "utf8"));
+	let generation = 0;
+	let writing = false;
+	const settled = () => {
+		writing = false;
+	};
+	/** Runs `fn` on the panel only if it is still the one `op` opened; says whether it was. */
+	const ours = (ctx, op, fn) => {
+		let open = false;
+		ctx.update("surgery", (s) => {
+			if (s.op !== op) return s;
+			open = true;
+			return fn(s);
+		});
+		return open;
+	};
+	async function open(command, args, ctx) {
+		const op = parseOp(command, args);
+		if ("error" in op) {
+			ctx.print(op.error, "error");
+			return;
+		}
+		ctx.open("surgery", {
+			op,
+			stage: "previewing",
+			preview: null,
+			result: [],
+			mismatch: false,
+			stopping: false
+		});
+		const env = {
+			readFile,
+			...io.home !== void 0 ? { home: io.home } : {},
+			signal: ctx.signal
+		};
+		try {
+			const preview = await deps.admin.run(({ client }) => previewOf(op, client.admin, env));
+			ours(ctx, op, (s) => s.stage === "previewing" ? {
+				...s,
+				stage: "preview",
+				preview
+			} : s);
+		} catch (err) {
+			const r = refusalOf(err);
+			ours(ctx, op, (s) => s.stage === "previewing" ? {
+				...s,
+				stage: "refused",
+				result: [line(`${r.code}: ${r.message}`, "error")]
+			} : s);
+		}
+	}
+	/** Starts the apply the preview planned; the panel moves through `ours`. */
+	function apply(s, typed, ctx) {
+		const preview = s.preview;
+		if (preview?.kind !== "ready") return s;
+		const op = s.op;
+		const plan = preview.apply;
+		const st = deps.admin.state();
+		const by = `(admin: ${st.kind === "unlocked" ? st.kid : "unknown"})`;
+		/** A refusal: into the panel, or to the transcript when the panel has gone. */
+		const refuse = (lines) => {
+			if (!ours(ctx, op, (x) => ({
+				...x,
+				stage: "refused",
+				result: [...x.result, ...lines]
+			}))) for (const l of lines) ctx.print(l.text, "error");
+		};
+		/** A write that landed: always to the transcript, and into the panel while it is open. */
+		const done = (text) => {
+			const l = line(text, "ok");
+			ctx.print(l.text, "ok");
+			ours(ctx, op, (x) => ({
+				...x,
+				stage: "done",
+				result: [...x.result, l]
+			}));
+		};
+		const refusalLines = (err) => {
+			const r = refusalOf(err);
+			return [line(`${r.code}: ${r.message}`, "error"), ...refusalDetail(r, op)];
+		};
+		/** The planner and the op disagree: unreachable, so it throws to surface-core's guard rather than hide. */
+		const mismatched = () => {
+			throw new Error(`surgery: a ${plan.kind} plan for a ${op.kind} apply`);
+		};
+		switch (op.kind) {
+			case "drop-namespace":
+			case "drop-type": {
+				const cascade = op.cascade ? "delete" : "refuse";
+				writing = true;
+				deps.admin.run(({ client }) => op.kind === "drop-namespace" ? client.admin.dropNamespace({
+					namespace: op.namespace,
+					confirm: typed,
+					cascade,
+					dryRun: false
+				}) : client.admin.dropType({
+					namespace: op.namespace,
+					type: op.type,
+					confirm: typed,
+					cascade,
+					dryRun: false
+				})).then((r) => done(`✓ dropped ${op.kind === "drop-namespace" ? "namespace" : "type"} ${targetOf(op)}: ${r.rowsDeleted} rows, ${r.edgesDeleted} edges ${by}`), (err) => refuse(refusalLines(err))).finally(settled);
+				break;
+			}
+			case "backfill":
+				if (plan.kind !== "backfill") return mismatched();
+				writing = true;
+				deps.admin.run(({ client }) => client.admin.backfill({
+					namespace: op.namespace,
+					type: op.type,
+					field: op.field,
+					values: plan.values,
+					overwrite: op.overwrite,
+					apply: true
+				}, { onChunk: (c) => {
+					ours(ctx, op, (x) => ({
+						...x,
+						result: [line(`chunk ${c.index + 1}/${c.chunks} written`, "dim")]
+					}));
+				} })).then((r) => done(`✓ backfilled ${targetOf(op)}: wrote ${r.write} of ${r.requested} ${by}`), (err) => {
+					const lines = refusalLines(err);
+					if (err instanceof AdminBackfillError) {
+						if (err.chunksDone > 0) lines.push(line(`  ${err.chunksDone} of ${err.chunks} chunk(s) were written before the refusal ${by}`, "warn"));
+						if (!is4xx(err.cause)) lines.push(line("the failing chunk's own state is unknown — re-running is safe", "warn"));
+					}
+					for (const l of lines) ctx.print(l.text, "error");
+					ours(ctx, op, (x) => ({
+						...x,
+						stage: "refused",
+						result: [...x.result, ...lines]
+					}));
+				}).finally(settled);
+				break;
+			case "normalise":
+				writing = true;
+				deps.admin.run(({ client }) => client.admin.normalise({
+					namespace: op.namespace,
+					type: op.type,
+					field: op.field,
+					reject: op.reject,
+					apply: true
+				})).then((r) => {
+					const sum = (xs) => (xs ?? []).reduce((a, x) => a + x.count, 0);
+					done(`✓ normalised ${targetOf(op)}: migrated ${sum(r.migrated)}, stranded ${sum(r.stranded)} ${by}`);
+				}, (err) => {
+					const lines = refusalLines(err);
+					if (is4xx(err)) return refuse(lines);
+					lines.push(line("the server-side state is unknown — re-run the preview to see what changed", "warn"));
+					for (const l of lines) ctx.print(l.text, "error");
+					ours(ctx, op, (x) => ({
+						...x,
+						stage: "refused",
+						result: [...x.result, ...lines]
+					}));
+				}).finally(settled);
+				break;
+			case "reindex": {
+				if (plan.kind !== "reindex") return mismatched();
+				writing = true;
+				const gen = generation;
+				runReindex(plan.types, (input) => deps.admin.run(({ client }) => client.admin.reindexPage(input)), {
+					stopRequested: () => {
+						if (gen !== generation) return true;
+						let stop = true;
+						ours(ctx, op, (x) => {
+							stop = x.stopping;
+							return x;
+						});
+						return stop;
+					},
+					onProgress: (p) => {
+						ours(ctx, op, (x) => ({
+							...x,
+							result: progressLines(p)
+						}));
+					}
+				}).then((o) => {
+					const embedded = o.progress.reduce((a, p) => a + p.embedded, 0);
+					const failed = o.progress.reduce((a, p) => a + p.failed, 0);
+					const settle = (stage, l) => {
+						ctx.print(l.text, l.tone);
+						ours(ctx, op, (x) => ({
+							...x,
+							stage,
+							result: [...progressLines(o.progress), l]
+						}));
+					};
+					switch (o.kind) {
+						case "done":
+							settle("done", line(`✓ reindexed ${o.progress.length} type(s): embedded ${embedded}, failed ${failed} ${by}`, "ok"));
+							break;
+						case "stopped":
+							settle("stopped", line(o.cursor !== void 0 ? `■ reindex stopped at ${name(o.at)} (cursor ${o.cursor}) — embedded ${embedded} so far ${by}` : `■ reindex stopped before ${name(o.at)} — embedded ${embedded} so far ${by}`, "warn"));
+							break;
+						case "failed": {
+							const r = refusalOf(o.error);
+							settle("refused", line(`reindex failed at ${name(o.at)}: ${r.code}: ${r.message} — embedded ${embedded} so far ${by}`, "error"));
+							break;
+						}
+					}
+				}).finally(settled);
+				return {
+					...s,
+					stage: "applying",
+					mismatch: false,
+					result: progressLines(plan.types.map(zero))
+				};
+			}
+		}
+		return {
+			...s,
+			stage: "applying",
+			mismatch: false
+		};
+	}
+	const command = (c) => ({
+		name: c,
+		summary: SUMMARY[c],
+		args: [{
+			name: "target",
+			optional: c === "reindex"
+		}],
+		unavailable: () => !deps.admin.unlocked() ? "admin is locked — /admin unlock" : writing ? "a surgery write is in progress — wait for it to report" : null,
+		run: (args, ctx) => open(c, args, ctx)
+	});
+	return defineModule("substrate.surgery", {
+		commands: [
+			"drop-namespace",
+			"drop-type",
+			"backfill",
+			"normalise",
+			"reindex"
+		].map(command),
+		panels: { surgery: {
+			view: ({ state, theme, size }) => surgeryView(state, theme, size),
+			submit: (s, typed, ctx) => {
+				if (!(s.stage === "preview" && s.preview?.kind === "ready")) return void 0;
+				return typed === targetOf(s.op) ? apply(s, typed, ctx) : {
+					...s,
+					mismatch: true
+				};
+			},
+			escape: (s) => {
+				if (s.stage !== "applying") return void 0;
+				return s.op.kind === "reindex" ? {
+					...s,
+					stopping: true
+				} : s;
+			}
+		} },
+		init(ctx) {
+			const off = deps.admin.onChange((st) => {
+				if (st.kind !== "locked") return;
+				generation++;
+				let open = false;
+				let inFlight = null;
+				ctx.update("surgery", (s) => {
+					open = true;
+					inFlight = s.stage === "applying" ? s.op : null;
+					return s;
+				});
+				if (!open) return;
+				ctx.close();
+				const op = inFlight;
+				ctx.print(op === null ? "surgery closed — admin locked" : op.kind === "reindex" ? "surgery closed — admin locked; the reindex requests no further page" : `surgery closed — admin locked; the ${sanitise(targetOf(op))} ${op.kind} in flight reports its outcome below`, "warn");
+			});
+			return () => {
+				off();
+			};
+		}
+	});
+}
+
+//#endregion
+//#region src/app.ts
+function buildModules(deps, opts = {}) {
+	return [
+		statusModule(deps, opts),
+		adminModule(deps),
+		doctorModule(deps, opts.doctorIntervalMs !== void 0 ? { intervalMs: opts.doctorIntervalMs } : {}),
+		keysModule(deps),
+		surgeryModule(deps),
+		askModule(deps),
+		schemaModule(deps),
+		dashModule(deps, opts.dashIntervalMs !== void 0 ? { intervalMs: opts.dashIntervalMs } : {})
+	];
+}
+function substrateAppOptions(deps, opts = {}) {
+	return {
+		theme: marathon,
+		modules: buildModules(deps, opts),
+		defaultTurn: "substrate.ask:ask",
+		band: true,
+		gutter: 2,
+		terminal: false
+	};
+}
+function createTui(deps, opts = {}) {
+	return createApp(substrateAppOptions(deps, opts));
+}
+
+//#endregion
+export { buildModules, createTui, substrateAppOptions };