@ours.network/cli 0.6.0 → 1.0.0

package/dist/chunk-MHVYJY3H.js

@@ -0,0 +1,2530 @@
+import {
+  apiTokenPath,
+  assertConfigNotDrifted,
+  explicitApiToken,
+  loadConfig,
+  resolveApiToken
+} from "./chunk-FXKFSNKS.js";
+
+// ../../src/boot.ts
+import { adapt_wrapper } from "@adapt-toolkit/sdk/executables";
+
+// ../../src/runtime/env.ts
+import { timingSafeEqual } from "node:crypto";
+
+// ../../src/startup-progress.ts
+import * as fs from "node:fs";
+import { join } from "node:path";
+var STARTUP_PROGRESS_FILENAME = "startup-progress.json";
+var STARTUP_PROGRESS_VERSION = 1;
+function startupProgressPath(stateDir) {
+  return join(stateDir, STARTUP_PROGRESS_FILENAME);
+}
+function createStartupProgressReporter(stateDir, opts = {}) {
+  const pid = opts.pid ?? process.pid;
+  const now = opts.now ?? Date.now;
+  const startedAt = now();
+  const path = startupProgressPath(stateDir);
+  const tmp = `${path}.${pid}.tmp`;
+  const heartbeatMs = Math.max(100, opts.heartbeatMs ?? 2e3);
+  let stopped = false;
+  let writeDisabled = false;
+  let progress = {
+    version: STARTUP_PROGRESS_VERSION,
+    pid,
+    bootId: `${pid}-${startedAt}`,
+    phase: "initializing",
+    startedAt,
+    updatedAt: startedAt
+  };
+  const write = () => {
+    if (writeDisabled) return;
+    try {
+      fs.mkdirSync(stateDir, { recursive: true, mode: 448 });
+      fs.writeFileSync(tmp, `${JSON.stringify(progress)}
+`, { mode: 384 });
+      fs.renameSync(tmp, path);
+      try {
+        fs.chmodSync(path, 384);
+      } catch {
+      }
+    } catch {
+      writeDisabled = true;
+      try {
+        fs.rmSync(tmp, { force: true });
+      } catch {
+      }
+    }
+  };
+  const update = (phase, counts) => {
+    progress = {
+      version: STARTUP_PROGRESS_VERSION,
+      pid,
+      bootId: progress.bootId,
+      phase,
+      ...counts ? { completed: counts.completed, total: counts.total } : {},
+      startedAt,
+      updatedAt: now()
+    };
+    write();
+  };
+  write();
+  const heartbeat = setInterval(() => {
+    if (stopped) return;
+    progress = { ...progress, updatedAt: now() };
+    write();
+  }, heartbeatMs);
+  heartbeat.unref?.();
+  const finish = (phase) => {
+    if (stopped) return;
+    update(phase);
+    stopped = true;
+    clearInterval(heartbeat);
+  };
+  return {
+    update,
+    ready: () => finish("ready"),
+    failed: () => finish("failed")
+  };
+}
+
+// ../../src/runtime/env.ts
+var VERSION = typeof __OURS_VERSION__ !== "undefined" ? __OURS_VERSION__ : "0.0.0-dev";
+var CONFIG = loadConfig();
+var STATE_DIR = CONFIG.stateDir;
+var BROKER_URL = CONFIG.brokerUrl;
+var TRANSPORT = process.env.OURS_TRANSPORT ?? "http";
+var PORT = CONFIG.port;
+var GC_INTERVAL_MS = CONFIG.gcIntervalMs;
+var API_VISIBILITY = CONFIG.apiVisibility;
+var startupHeartbeatMs = Number(process.env.OURS_TEST_STARTUP_HEARTBEAT_MS || "") || void 0;
+var startupProgress = TRANSPORT === "http" ? createStartupProgressReporter(STATE_DIR, { heartbeatMs: startupHeartbeatMs }) : null;
+var log = (...parts) => process.stderr.write(`ours: ${parts.join(" ")}
+`);
+function resolveDaemonToken() {
+  if (API_VISIBILITY === "open") return null;
+  if (API_VISIBILITY === "shared") {
+    const explicit = explicitApiToken(CONFIG);
+    if (!explicit) {
+      throw new Error(
+        `apiVisibility=shared requires an operator-supplied token so it can be distributed to cross-user agents \u2014 set OURS_API_TOKEN or "apiToken" in config (${apiTokenPath(CONFIG)} is not used for shared mode). Use apiVisibility=owner for a same-user-only auto-token, or =open to disable auth.`
+      );
+    }
+    return explicit;
+  }
+  return resolveApiToken(CONFIG, { generate: true }).token;
+}
+var API_TOKEN = resolveDaemonToken();
+function tokenFromReq(req) {
+  const direct = req.headers["x-ours-api-token"];
+  if (typeof direct === "string" && direct) return direct;
+  const auth = req.headers["authorization"];
+  if (typeof auth === "string") {
+    const m = /^Bearer\s+(.+)$/i.exec(auth.trim());
+    if (m) return m[1];
+  }
+  return void 0;
+}
+function authOk(req) {
+  if (API_TOKEN === null) return true;
+  const provided = tokenFromReq(req);
+  if (!provided) return false;
+  const a = Buffer.from(provided);
+  const b = Buffer.from(API_TOKEN);
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+function requireAuth(req, res) {
+  if (authOk(req)) return true;
+  res.writeHead(401, { "Content-Type": "application/json" });
+  res.end(JSON.stringify({ error: "unauthorized" }));
+  return false;
+}
+var NAME_RE = /^[A-Za-z0-9 _.@-]{1,64}$/;
+var BOOK_DIR_NAME = "contact-book";
+function validateName(name) {
+  if (!NAME_RE.test(name)) {
+    return "name must be 1-64 chars of letters, digits, space, _ . @ or -";
+  }
+  if (name === "." || name === ".." || name.includes("/") || name.includes("\\")) {
+    return "invalid name";
+  }
+  if (name === BOOK_DIR_NAME) {
+    return `"${BOOK_DIR_NAME}" is reserved for the local contact book`;
+  }
+  if (name === "root.json" || name === "bindings.json") {
+    return `"${name}" is reserved for daemon bookkeeping`;
+  }
+  return null;
+}
+
+// ../../src/runtime/unit.ts
+import { resolve, join as join2, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import * as fs2 from "node:fs";
+function locateUnit() {
+  const here = dirname(fileURLToPath(import.meta.url));
+  const override = process.env.OURS_UNIT_DIR;
+  const noCap = process.env.OURS_ADVERTISE_MIGRATE === "0";
+  const withNoCap = (dir) => noCap ? [`${dir}-nocap`] : [dir];
+  const candidates = override ? withNoCap(resolve(override)) : [join2(here, "mufl_code"), join2(here, "..", "mufl_code")].flatMap(withNoCap);
+  for (const dir of candidates) {
+    if (!fs2.existsSync(dir)) continue;
+    const muflo = fs2.readdirSync(dir).find((f) => f.endsWith(".muflo"));
+    if (muflo) {
+      const hash = muflo.slice(0, -".muflo".length);
+      const contents = new Uint8Array(fs2.readFileSync(join2(dir, muflo)));
+      return { dir, hash, contents };
+    }
+  }
+  throw new Error(
+    `no compiled .muflo packet found (looked in: ${candidates.join(", ")})` + (noCap ? ' \u2014 OURS_ADVERTISE_MIGRATE=0 requires a "<dir>-nocap" packet variant (compiled with $advertise = [core.e2e] only); build it or unset the env.' : "")
+  );
+}
+var UNIT;
+function setUnit(u) {
+  UNIT = u;
+}
+
+// ../../src/identity/model.ts
+import { join as join3 } from "node:path";
+import { createHash } from "node:crypto";
+import * as fs3 from "node:fs";
+
+// ../../src/constants.ts
+var FILE_SELECTION_CAP = 32;
+
+// ../../src/identity/model.ts
+var wrapper;
+function setWrapper(w) {
+  wrapper = w;
+}
+var identities = /* @__PURE__ */ new Map();
+var registrar = null;
+var registrarAdBlob = null;
+function setRegistrar(id) {
+  registrar = id;
+}
+function setRegistrarAdBlob(blob) {
+  registrarAdBlob = blob;
+}
+var identityDir = (name) => join3(STATE_DIR, name);
+var keyPath = (dir) => join3(dir, "identity.key");
+var dataPath = (dir) => join3(dir, "state_data.bin");
+var notifyLogPath = (dir) => join3(dir, "notifications.log");
+var unreadPath = (dir) => join3(dir, "unread.json");
+var filesDirFor = (id) => join3(id.dir, "files");
+var tempMetaPath = (dir) => join3(dir, "temp.json");
+var hashLeaseToken = (token) => createHash("sha256").update(token).digest("hex");
+function writeTempMetaFile(dir, meta) {
+  fs3.writeFileSync(
+    tempMetaPath(dir),
+    JSON.stringify({ v: 1, owner: { token_sha256: meta.owner.tokenHash, pid: meta.owner.pid }, created_at: meta.createdAt }),
+    { mode: 384 }
+  );
+}
+function readTempMetaFile(dir) {
+  try {
+    const raw = JSON.parse(fs3.readFileSync(tempMetaPath(dir), "utf8"));
+    if (raw.v !== 1 || typeof raw.owner?.token_sha256 !== "string" || typeof raw.owner?.pid !== "number") return null;
+    return {
+      owner: { tokenHash: raw.owner.token_sha256, pid: raw.owner.pid },
+      createdAt: typeof raw.created_at === "number" ? raw.created_at : 0
+    };
+  } catch {
+    return null;
+  }
+}
+function tightenIdentityPerms() {
+  for (const name of listPersistedNames()) {
+    const dir = join3(STATE_DIR, name);
+    try {
+      fs3.chmodSync(dir, 448);
+    } catch (err) {
+      log(`[${name}] chmod 0700 failed:`, String(err));
+    }
+    for (const f of [dataPath(dir), keyPath(dir)]) {
+      if (!fs3.existsSync(f)) continue;
+      try {
+        fs3.chmodSync(f, 384);
+      } catch (err) {
+        log(`[${name}] chmod 0600 ${f} failed:`, String(err));
+      }
+    }
+  }
+}
+var isWireId = (s) => /^[A-Za-z0-9]+$/.test(s) && s.length > 0 && s.length <= 128;
+var isSelectableWireId = (s) => /^[A-Fa-f0-9]{64}$/.test(s);
+function findIdentityFile(id, wireId) {
+  if (!isWireId(wireId)) return null;
+  const dir = filesDirFor(id);
+  let entries;
+  try {
+    entries = fs3.readdirSync(dir);
+  } catch {
+    return null;
+  }
+  const prefix = `${wireId}-`;
+  const match = entries.find((name) => name.startsWith(prefix));
+  return match ? join3(dir, match) : null;
+}
+function listPersistedNames() {
+  if (!fs3.existsSync(STATE_DIR)) return [];
+  return fs3.readdirSync(STATE_DIR, { withFileTypes: true }).filter((d) => d.isDirectory() && fs3.existsSync(keyPath(join3(STATE_DIR, d.name)))).map((d) => d.name);
+}
+
+// ../../src/identity/lease.ts
+import { join as join4 } from "node:path";
+import * as fs4 from "node:fs";
+var leases = /* @__PURE__ */ new Map();
+var tombstones = /* @__PURE__ */ new Set();
+var sessionHeaders = /* @__PURE__ */ new Map();
+var outboundRemovalInFlight = /* @__PURE__ */ new Set();
+function pidAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err.code === "EPERM";
+  }
+}
+function leaseByToken(token) {
+  for (const l of leases.values()) if (l.token === token) return l;
+  return void 0;
+}
+var bindingsSnapshotPath = () => join4(STATE_DIR, "bindings.json");
+function persistBindings() {
+  try {
+    fs4.mkdirSync(STATE_DIR, { recursive: true });
+    const tmp = `${bindingsSnapshotPath()}.tmp`;
+    fs4.writeFileSync(tmp, JSON.stringify({
+      pid: process.pid,
+      bound: [...leases.keys()],
+      holders: [...leases.values()].map((l) => ({ identity: l.identity, pid: l.pid }))
+    }));
+    fs4.renameSync(tmp, bindingsSnapshotPath());
+  } catch (err) {
+    log("failed to persist bindings snapshot:", String(err));
+  }
+}
+function resolveBound(sid) {
+  const token = sessionHeaders.get(sid)?.token;
+  if (!token) {
+    return { code: "NOT_BOUND", error: "No identity bound to this session. Call choose_identity (or create_identity) first." };
+  }
+  if (tombstones.has(token)) {
+    return { code: "BINDING_REASSIGNED", error: "Your identity binding was reassigned to another session. Call choose_identity again to continue." };
+  }
+  const lease = leaseByToken(token);
+  if (!lease) {
+    return { code: "NOT_BOUND", error: "No identity bound to this session. Call choose_identity (or create_identity) first." };
+  }
+  const id = identities.get(lease.identity);
+  if (!id) {
+    leases.delete(lease.identity);
+    persistBindings();
+    return { code: "BOUND_IDENTITY_GONE", error: `The bound identity "${lease.identity}" no longer exists. Choose another with choose_identity.` };
+  }
+  if (id.temp?.closing) {
+    return {
+      code: "TEMP_CLOSING",
+      error: `The temporary identity "${id.name}" is closing and no longer accepts work. Its contacts are being notified and its local state deleted.`
+    };
+  }
+  lease.sid = sid;
+  const pid = sessionHeaders.get(sid)?.pid;
+  if (pid) lease.pid = pid;
+  return { id };
+}
+function bindSession(sid, name) {
+  const hdr = sessionHeaders.get(sid);
+  const token = hdr?.token;
+  if (!token) return;
+  for (const [n, l] of [...leases]) if (l.token === token && n !== name) leases.delete(n);
+  const prevEpoch = leases.get(name)?.epoch ?? 0;
+  leases.set(name, { identity: name, token, pid: hdr?.pid ?? 0, sid, epoch: prevEpoch + 1, boundAt: Date.now() });
+  tombstones.delete(token);
+  persistBindings();
+}
+
+// ../../src/identity/hierarchy.ts
+import { join as join8 } from "node:path";
+import * as fs9 from "node:fs";
+
+// ../../src/mufl/tx.ts
+import { AdaptObjectLifetime as AdaptObjectLifetime2 } from "@adapt-toolkit/sdk/common";
+import { object_to_adapt_value } from "@adapt-toolkit/sdk/wrapper";
+
+// ../../src/state.ts
+import * as fs8 from "node:fs";
+import { randomBytes as randomBytes2 } from "node:crypto";
+
+// ../../src/identity/provision.ts
+import * as fs7 from "node:fs";
+import { randomBytes } from "node:crypto";
+import { PacketWrapperConfigurator } from "@adapt-toolkit/sdk/wrappers";
+
+// ../../src/mufl/handlers.ts
+import { AdaptObjectLifetime } from "@adapt-toolkit/sdk/common";
+
+// ../../src/notify.ts
+import { join as join6 } from "node:path";
+import * as fs5 from "node:fs";
+
+// ../../src/inbox.ts
+var E2E_RECV_EVENTS = /* @__PURE__ */ new Set(["e2e_app_recv", "migration_deferred_flush"]);
+function e2eWireIdsFromEvents(events) {
+  const out = /* @__PURE__ */ new Set();
+  for (const ev of events) {
+    if (!ev || typeof ev !== "object") continue;
+    const event = ev.event;
+    if (typeof event !== "string" || !E2E_RECV_EVENTS.has(event)) continue;
+    const wire = ev.wire_id;
+    if (typeof wire === "string" && wire.length > 0) out.add(wire);
+  }
+  return out;
+}
+function encryptionFor(wireId, e2eWireIds) {
+  return wireId && e2eWireIds.has(wireId) ? "e2e" : "legacy";
+}
+function toMessageJson(m, e2eWireIds) {
+  const encryption = encryptionFor(m.wire_id, e2eWireIds);
+  return {
+    msg_id: m.msg_id,
+    wire_id: m.wire_id,
+    from: { id: m.sender_id, name: m.sender_name },
+    encryption,
+    transport: encryption === "e2e" ? "double_ratchet" : "legacy_box",
+    text: m.text,
+    date: m.date,
+    status: m.status,
+    reply_to: m.reply_to
+  };
+}
+function buildMessagesPayload(msgs, e2eWireIds) {
+  const messages = msgs.map((m) => toMessageJson(m, e2eWireIds));
+  return { count: messages.length, messages };
+}
+
+// ../../src/events.ts
+var nonEmptyString = (value) => typeof value === "string" && value.length > 0;
+var syncRequired = (source_event) => ({
+  event: "sync_required",
+  reason: "legacy_or_malformed_event",
+  source_event
+});
+function normalizeNotificationEvent(record) {
+  if (!nonEmptyString(record.event)) return syncRequired("unknown");
+  if (record.event === "message_received") {
+    if (!nonEmptyString(record.sender_id) || !nonEmptyString(record.sender_name) || !nonEmptyString(record.msg_id) || !nonEmptyString(record.wire_id) || !nonEmptyString(record.date)) return syncRequired("message_received");
+    return {
+      event: "message_received",
+      sender_id: record.sender_id,
+      sender_name: record.sender_name,
+      from: nonEmptyString(record.from) ? record.from : record.sender_name,
+      msg_id: record.msg_id,
+      wire_id: record.wire_id,
+      date: record.date
+    };
+  }
+  if (record.event === "receipt_received") {
+    const kind = record.kind;
+    const wireIds = record.wire_ids;
+    if (!nonEmptyString(record.sender_id) || kind !== "delivered" && kind !== "read" || !Array.isArray(wireIds) || wireIds.length === 0 || !wireIds.every(nonEmptyString)) {
+      return syncRequired("receipt_received");
+    }
+    return {
+      event: "receipt_received",
+      sender_id: record.sender_id,
+      kind,
+      wire_ids: [...wireIds],
+      // Older receipt callbacks did not carry protocol time. Observation time
+      // is explicitly a fallback, not a claim about when the peer sent it.
+      date: nonEmptyString(record.date) ? record.date : (/* @__PURE__ */ new Date()).toISOString()
+    };
+  }
+  return record;
+}
+var defaults = {
+  event: () => {
+  },
+  notification: () => {
+  }
+};
+var handlers = { ...defaults };
+function setDaemonEventHandler(name, handler) {
+  handlers[name] = handler;
+  return () => {
+    if (handlers[name] === handler) handlers[name] = defaults[name];
+  };
+}
+function emitDaemonEvent(id, record) {
+  const normalized = normalizeNotificationEvent(record);
+  handlers.event({
+    identity: id.name,
+    event: normalized.event,
+    record: normalized
+  });
+}
+function emitDaemonNotification(identityName, summary) {
+  handlers.notification(identityName, summary);
+}
+
+// ../../src/render/adapt-to-json.ts
+import { basename as basename2, join as join5 } from "node:path";
+import { createHash as createHash2, randomUUID } from "node:crypto";
+import { mkdir, open, rename, unlink, lstat } from "node:fs/promises";
+import { brotliCompressSync, brotliDecompressSync } from "node:zlib";
+
+// ../../src/files.ts
+import { basename, extname } from "node:path";
+var FILE_MIME = {
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".svg": "image/svg+xml",
+  ".bmp": "image/bmp",
+  ".ico": "image/x-icon",
+  ".pdf": "application/pdf",
+  ".txt": "text/plain",
+  ".md": "text/markdown",
+  ".json": "application/json",
+  ".csv": "text/csv",
+  ".html": "text/html",
+  ".xml": "application/xml",
+  ".zip": "application/zip",
+  ".gz": "application/gzip",
+  ".tar": "application/x-tar",
+  ".mp3": "audio/mpeg",
+  ".wav": "audio/wav",
+  ".mp4": "video/mp4",
+  ".mov": "video/quicktime"
+};
+function mimeFromExt(p) {
+  return FILE_MIME[extname(p).toLowerCase()] ?? "application/octet-stream";
+}
+function sanitizeFilename(name) {
+  const base = basename(name).replace(/[^A-Za-z0-9._-]/g, "_");
+  return base.length ? base.slice(0, 200) : "file";
+}
+
+// ../../src/transcribe.ts
+var VOICE_MESSAGE_MIME_PARAM = "x-ours-kind=voice-message";
+var VOICE_MESSAGE_FILENAME_PREFIX = "voice-message-";
+function isVoiceMessage(mime, filename) {
+  const parts = (mime ?? "").toLowerCase().split(";").map((p) => p.trim());
+  if (parts[0].startsWith("audio/") && parts.slice(1).includes(VOICE_MESSAGE_MIME_PARAM)) return true;
+  return filename.toLowerCase().startsWith(VOICE_MESSAGE_FILENAME_PREFIX) && parts[0].startsWith("audio/");
+}
+function baseMime(mime) {
+  return (mime ?? "").split(";")[0].trim() || "application/octet-stream";
+}
+var STT_PROVIDERS = ["openai-compatible", "elevenlabs", "deepgram", "custom"];
+var STT_MAX_BYTES_DEFAULT = 5 * 1024 * 1024;
+var STT_TIMEOUT_MS_DEFAULT = 6e4;
+function sttStatus(cfg) {
+  const hint = "configure it in config.json `stt: {}` or via OURS_STT_* env";
+  if (!cfg?.provider) {
+    return { ready: false, reason: `no STT provider configured (stt.provider: ${STT_PROVIDERS.join(" | ")}) \u2014 ${hint}` };
+  }
+  const provider = cfg.provider.trim().toLowerCase();
+  if (!STT_PROVIDERS.includes(provider)) {
+    return { ready: false, reason: `unknown STT provider "${cfg.provider}" (expected: ${STT_PROVIDERS.join(" | ")})` };
+  }
+  if (!cfg.apiKey?.trim()) {
+    return { ready: false, reason: `STT provider "${provider}" is set but the API key is missing (stt.apiKey / OURS_STT_API_KEY)` };
+  }
+  if (provider === "openai-compatible") {
+    if (!cfg.baseUrl?.trim()) {
+      return { ready: false, reason: "openai-compatible STT needs stt.baseUrl / OURS_STT_BASE_URL (e.g. your provider's /v1 root) \u2014 no endpoint is assumed" };
+    }
+    if (!cfg.model?.trim()) {
+      return { ready: false, reason: "openai-compatible STT needs stt.model / OURS_STT_MODEL (passed to the provider verbatim) \u2014 no model is assumed" };
+    }
+  }
+  if (provider === "elevenlabs" && !cfg.model?.trim()) {
+    return { ready: false, reason: "elevenlabs STT needs stt.model / OURS_STT_MODEL (the model_id, e.g. from your ElevenLabs account) \u2014 no model is assumed" };
+  }
+  if (provider === "custom") {
+    if (!cfg.custom?.url?.trim()) {
+      return { ready: false, reason: "custom STT needs stt.custom.url (the full endpoint URL of your provider)" };
+    }
+    const wantsModel = cfg.custom.url.includes("{model}") || cfg.custom.modelField !== void 0 && cfg.custom.modelField !== "";
+    if (wantsModel && !cfg.model?.trim()) {
+      return { ready: false, reason: "the custom STT template references a model (url {model} or modelField) but stt.model / OURS_STT_MODEL is not set" };
+    }
+  }
+  return { ready: true, provider };
+}
+function textAtPath(obj, path) {
+  let cur = obj;
+  for (const seg of path.split(".")) {
+    if (cur === null || typeof cur !== "object") return void 0;
+    cur = cur[seg];
+  }
+  return typeof cur === "string" ? cur : void 0;
+}
+async function request(url, init, timeoutMs, secrets = []) {
+  const aborter = new AbortController();
+  const timer = setTimeout(() => aborter.abort(), timeoutMs);
+  try {
+    const resp = await fetch(url, { ...init, signal: aborter.signal });
+    if (!resp.ok) {
+      let detail = await resp.text().catch(() => "");
+      for (const secret of secrets) {
+        if (secret) detail = detail.split(secret).join("[redacted]");
+      }
+      return { ok: false, error: `STT HTTP ${resp.status}${detail ? `: ${detail.slice(0, 200)}` : ""}` };
+    }
+    return { ok: true, json: await resp.json() };
+  } catch (err) {
+    if (err?.name === "AbortError") {
+      return { ok: false, error: `STT timeout after ${timeoutMs}ms` };
+    }
+    return { ok: false, error: err instanceof Error ? err.message : String(err) };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+var audioBlob = (bytes, mime) => (
+  // Copy into a plain Uint8Array — a Buffer is not a valid BlobPart.
+  new Blob([new Uint8Array(bytes)], { type: baseMime(mime) })
+);
+var openaiCompatible = async (bytes, filename, mime, cfg, timeoutMs) => {
+  const form = new FormData();
+  form.set("file", audioBlob(bytes, mime), filename);
+  form.set("model", cfg.model.trim());
+  form.set("response_format", "json");
+  if (cfg.language?.trim()) form.set("language", cfg.language.trim());
+  const r = await request(
+    `${cfg.baseUrl.trim().replace(/\/$/, "")}/audio/transcriptions`,
+    { method: "POST", headers: { Authorization: `Bearer ${cfg.apiKey.trim()}` }, body: form },
+    timeoutMs,
+    [cfg.apiKey.trim()]
+  );
+  if (!r.ok) return r;
+  const text = textAtPath(r.json, "text");
+  return text !== void 0 ? { ok: true, text } : { ok: false, error: "STT response missing text" };
+};
+var elevenlabs = async (bytes, filename, mime, cfg, timeoutMs) => {
+  const form = new FormData();
+  form.set("file", audioBlob(bytes, mime), filename);
+  form.set("model_id", cfg.model.trim());
+  if (cfg.language?.trim()) form.set("language_code", cfg.language.trim());
+  const r = await request(
+    `${(cfg.baseUrl?.trim() || "https://api.elevenlabs.io").replace(/\/$/, "")}/v1/speech-to-text`,
+    { method: "POST", headers: { "xi-api-key": cfg.apiKey.trim() }, body: form },
+    timeoutMs,
+    [cfg.apiKey.trim()]
+  );
+  if (!r.ok) return r;
+  const text = textAtPath(r.json, "text");
+  return text !== void 0 ? { ok: true, text } : { ok: false, error: "STT response missing text" };
+};
+var deepgram = async (bytes, _filename, mime, cfg, timeoutMs) => {
+  const params = new URLSearchParams();
+  if (cfg.model?.trim()) params.set("model", cfg.model.trim());
+  if (cfg.language?.trim()) params.set("language", cfg.language.trim());
+  const q = params.toString();
+  const r = await request(
+    `${(cfg.baseUrl?.trim() || "https://api.deepgram.com").replace(/\/$/, "")}/v1/listen${q ? `?${q}` : ""}`,
+    {
+      method: "POST",
+      headers: { Authorization: `Token ${cfg.apiKey.trim()}`, "Content-Type": baseMime(mime) },
+      body: new Uint8Array(bytes)
+    },
+    timeoutMs,
+    [cfg.apiKey.trim()]
+  );
+  if (!r.ok) return r;
+  const text = textAtPath(r.json, "results.channels.0.alternatives.0.transcript");
+  return text !== void 0 ? { ok: true, text } : { ok: false, error: "STT response missing transcript" };
+};
+var custom = async (bytes, filename, mime, cfg, timeoutMs) => {
+  const t = cfg.custom;
+  const model = cfg.model?.trim() ?? "";
+  const url = t.url.replaceAll("{model}", encodeURIComponent(model));
+  const headers = {};
+  const authName = t.authHeaderName?.trim() || "Authorization";
+  const authValue = (t.authHeaderTemplate ?? "Bearer {key}").replaceAll("{key}", cfg.apiKey.trim());
+  if (authValue) headers[authName] = authValue;
+  const mode = t.bodyMode ?? "multipart";
+  const fileField = t.fileField?.trim() || "file";
+  const modelField = t.modelField === void 0 ? "model" : t.modelField.trim();
+  let body;
+  if (mode === "multipart") {
+    const form = new FormData();
+    form.set(fileField, audioBlob(bytes, mime), filename);
+    if (modelField && model) form.set(modelField, model);
+    for (const [k, v] of Object.entries(t.extraFields ?? {})) form.set(k, v);
+    body = form;
+  } else if (mode === "raw") {
+    headers["Content-Type"] = baseMime(mime);
+    body = new Uint8Array(bytes);
+  } else {
+    headers["Content-Type"] = "application/json";
+    body = JSON.stringify({
+      [fileField]: bytes.toString("base64"),
+      ...modelField && model ? { [modelField]: model } : {},
+      ...t.extraFields ?? {}
+    });
+  }
+  const r = await request(url, { method: t.method?.trim() || "POST", headers, body }, timeoutMs, [cfg.apiKey.trim()]);
+  if (!r.ok) return r;
+  const text = textAtPath(r.json, t.responseTextPath?.trim() || "text");
+  return text !== void 0 ? { ok: true, text } : { ok: false, error: `STT response has no text at "${t.responseTextPath?.trim() || "text"}"` };
+};
+var ADAPTERS = {
+  "openai-compatible": openaiCompatible,
+  elevenlabs,
+  deepgram,
+  custom
+};
+async function transcribeVoice(bytes, filename, mime, cfg) {
+  const status = sttStatus(cfg);
+  if (!status.ready) return { ok: false, error: status.reason };
+  const maxBytes = cfg.maxBytes ?? STT_MAX_BYTES_DEFAULT;
+  if (bytes.length > maxBytes) {
+    return { ok: false, error: `voice message is ${bytes.length} B \u2014 over the ${maxBytes} B STT limit (stt.maxBytes)` };
+  }
+  const timeoutMs = cfg.timeoutMs ?? STT_TIMEOUT_MS_DEFAULT;
+  try {
+    return await ADAPTERS[status.provider](bytes, filename, mime, cfg, timeoutMs);
+  } catch (err) {
+    return { ok: false, error: err instanceof Error ? err.message : String(err) };
+  }
+}
+function voiceErrorCategory(error) {
+  if (/limit|over .* bytes/i.test(error)) return "size_limit";
+  if (/timeout/i.test(error)) return "timeout";
+  if (/HTTP \d+/i.test(error)) return "provider_http";
+  if (/missing|no text|no transcript/i.test(error)) return "invalid_response";
+  return "provider_error";
+}
+function structuredVoiceOutcome(readiness, outcome, association) {
+  if (!readiness.ready || outcome.kind === "unconfigured") {
+    return {
+      configured: false,
+      attempted: false,
+      status: "unavailable",
+      provider: null,
+      text: null,
+      error_category: "not_configured",
+      audio_path: association.audioPath,
+      file_wire_id: association.wireId
+    };
+  }
+  if (outcome.kind === "transcript") {
+    return {
+      configured: true,
+      attempted: true,
+      status: "succeeded",
+      provider: readiness.provider,
+      text: outcome.text,
+      error_category: null,
+      audio_path: association.audioPath,
+      file_wire_id: association.wireId
+    };
+  }
+  return {
+    configured: true,
+    attempted: true,
+    status: "failed",
+    provider: readiness.provider,
+    text: null,
+    error_category: voiceErrorCategory(outcome.error),
+    audio_path: association.audioPath,
+    file_wire_id: association.wireId
+  };
+}
+function voiceDeliveryLine(args, outcome) {
+  const head = `  \u2022 \u{1F3A4} voice message from ${args.sender} (${args.sizeBytes} B)`;
+  const tail = `audio saved \u2192 ${args.savedPath} {${args.wire}}`;
+  switch (outcome.kind) {
+    case "transcript":
+      return `${head}: "${outcome.text}" \u2014 transcribed from voice message (STT); ${tail}`;
+    case "unconfigured":
+      return `${head}: cannot transcribe \u2014 ${outcome.reason}. Tell the user you can't listen to voice messages until the operator configures transcription on this ours-mcp server, and ask them to send text meanwhile; ${tail}`;
+    case "failed":
+      return `${head}: transcription failed (${outcome.error}). Tell the user their voice message could not be transcribed right now and ask them to send text or retry; ${tail}`;
+  }
+}
+
+// ../../src/render/adapt-to-json.ts
+function renderContacts(v) {
+  const out = [];
+  if (v.IsNil()) return out;
+  for (const key of v.GetKeys()) {
+    const c = v.Reduce(key);
+    if (c.IsNil()) continue;
+    out.push({
+      name: c.Reduce("name").Visualize(),
+      container_id: c.Reduce("container_id").Visualize()
+    });
+  }
+  return out;
+}
+function renderImportRenames(v) {
+  const out = {};
+  if (v.IsNil()) return out;
+  for (const key of v.GetKeys()) {
+    const n = v.Reduce(key);
+    if (!n.IsNil()) out[typeof key === "string" ? key : key.Visualize()] = n.Visualize();
+  }
+  return out;
+}
+function renderInbox(v) {
+  const out = [];
+  if (v.IsNil()) return out;
+  for (let i = 0; ; i++) {
+    const m = v.Reduce(i);
+    if (m.IsNil()) break;
+    const rt = m.Reduce("reply_to");
+    let reply_to = null;
+    if (!rt.IsNil()) {
+      reply_to = { wire_id: rt.Reduce("wire_id").Visualize() };
+      const s = rt.Reduce("sentence");
+      if (!s.IsNil()) reply_to.sentence = parseInt(s.Visualize(), 10);
+    }
+    out.push({
+      msg_id: parseInt(m.Reduce("msg_id").Visualize(), 10),
+      sender_id: m.Reduce("sender_id").Visualize(),
+      sender_name: m.Reduce("sender_name").Visualize(),
+      text: m.Reduce("text").Visualize(),
+      date: m.Reduce("date").Visualize(),
+      status: m.Reduce("status").Visualize(),
+      wire_id: m.Reduce("wire_id").Visualize(),
+      reply_to
+    });
+  }
+  return out;
+}
+function renderFileMetadata(v) {
+  const files = [];
+  if (v.IsNil()) return files;
+  for (let i = 0; ; i++) {
+    const f = v.Reduce(i);
+    if (f.IsNil()) break;
+    const filename = f.Reduce("filename").Visualize();
+    const mime = f.Reduce("mime").Visualize() || "application/octet-stream";
+    const reply = f.Reduce("reply_to");
+    let reply_to = null;
+    if (!reply.IsNil()) {
+      reply_to = { wire_id: reply.Reduce("wire_id").Visualize() };
+      const sentence = parseInt(reply.Reduce("sentence").Visualize(), 10);
+      if (Number.isSafeInteger(sentence) && sentence > 0) reply_to.sentence = sentence;
+    }
+    files.push({
+      file_id: parseInt(f.Reduce("file_id").Visualize(), 10),
+      wire_id: f.Reduce("wire_id").Visualize(),
+      from: { id: f.Reduce("sender_id").Visualize(), name: f.Reduce("sender_name").Visualize() },
+      filename,
+      mime,
+      size: parseInt(f.Reduce("size").Visualize(), 10),
+      size_source: "received_payload",
+      status: f.Reduce("status").Visualize(),
+      date: f.Reduce("date").Visualize(),
+      sha256: null,
+      reply_to,
+      kind: isVoiceMessage(mime, filename) ? "voice_message" : "file"
+    });
+  }
+  return files;
+}
+async function writeReceivedFileSafely(dir, outPath, bytes) {
+  await mkdir(dir, { recursive: true, mode: 448 });
+  const dirStat = await lstat(dir);
+  if (!dirStat.isDirectory() || dirStat.isSymbolicLink()) throw new Error("received-files directory is not a safe directory");
+  const tmp = join5(dir, `.${basename2(outPath)}.${randomUUID()}.tmp`);
+  const handle = await open(tmp, "wx", 384);
+  try {
+    await handle.writeFile(bytes);
+    await handle.sync();
+  } catch (error) {
+    await handle.close().catch(() => {
+    });
+    await unlink(tmp).catch(() => {
+    });
+    throw error;
+  }
+  await handle.close();
+  try {
+    await rename(tmp, outPath);
+  } catch (error) {
+    await unlink(tmp).catch(() => {
+    });
+    throw error;
+  }
+}
+async function writeIncomingFiles(id, v) {
+  const files = [];
+  if (v.IsNil()) return { text: "No new files.", files };
+  const dir = filesDirFor(id);
+  const lines = [];
+  for (let i = 0; ; i++) {
+    const f = v.Reduce(i);
+    if (f.IsNil()) break;
+    const name = f.Reduce("filename").Visualize();
+    const mime = f.Reduce("mime").Visualize() || "application/octet-stream";
+    const sender = f.Reduce("sender_name").Visualize();
+    const senderId = f.Reduce("sender_id").Visualize();
+    const fileId = parseInt(f.Reduce("file_id").Visualize(), 10);
+    const date = f.Reduce("date").Visualize();
+    const wire = f.Reduce("wire_id").Visualize();
+    const bytes = Buffer.from(f.Reduce("data").GetBinary());
+    const sha256 = createHash2("sha256").update(bytes).digest("hex");
+    const outPath = join5(dir, `${wire}-${sanitizeFilename(name)}`);
+    await writeReceivedFileSafely(dir, outPath, bytes);
+    const base = {
+      file_id: fileId,
+      wire_id: wire,
+      from: { id: senderId, name: sender },
+      filename: name,
+      path: outPath,
+      mime,
+      size: bytes.length,
+      sha256,
+      status: "processed",
+      date,
+      kind: isVoiceMessage(mime, name) ? "voice_message" : "file",
+      sender
+    };
+    if (isVoiceMessage(mime, name)) {
+      const st = sttStatus(CONFIG.stt);
+      let outcome;
+      if (!st.ready) {
+        outcome = { kind: "unconfigured", reason: st.reason };
+      } else {
+        const r = await transcribeVoice(bytes, name, mime, CONFIG.stt);
+        outcome = r.ok ? { kind: "transcript", text: r.text } : { kind: "failed", error: r.error };
+      }
+      base.transcription = structuredVoiceOutcome(st, outcome, { audioPath: outPath, wireId: wire });
+      lines.push(voiceDeliveryLine({ sender, wire, savedPath: outPath, sizeBytes: bytes.length }, outcome));
+      files.push(base);
+      continue;
+    }
+    files.push(base);
+    lines.push(`  \u2022 ${name} (${mime}, ${bytes.length} B, sha256 ${sha256}) from ${sender} \u2192 ${outPath} {${wire}}`);
+  }
+  if (lines.length === 0) return { text: "No new files.", files };
+  return {
+    text: `${lines.length} new file(s) written to your identity's files dir \u2014 paths + metadata below (bytes stay on disk, never in this result). If your OS user can read the path, use it directly; otherwise use save_file({ wire_id, dest_path }) to stream a copy to a path you can write:
+${lines.join("\n")}`,
+    files
+  };
+}
+function renderPending(v) {
+  const out = [];
+  if (v.IsNil()) return out;
+  for (const key of v.GetKeys()) {
+    const p = v.Reduce(key);
+    if (p.IsNil()) continue;
+    out.push({
+      container_id: typeof key === "string" ? key : key.Visualize(),
+      name: p.Reduce("name").Visualize(),
+      queued: parseInt(p.Reduce("queued").Visualize(), 10) || 0
+    });
+  }
+  return out;
+}
+function renderContactRoots(v) {
+  const out = {};
+  if (v.IsNil()) return out;
+  for (const key of v.GetKeys()) {
+    const r = v.Reduce(key);
+    if (r.IsNil()) continue;
+    out[typeof key === "string" ? key : key.Visualize()] = {
+      root_cid: r.Reduce("root_cid").Visualize(),
+      root_name: r.Reduce("root_name").Visualize(),
+      role_id: r.Reduce("role_id").Visualize()
+    };
+  }
+  return out;
+}
+function encodeWireBin(raw) {
+  return brotliCompressSync(raw).toString("base64url");
+}
+function decodeWireBin(s) {
+  return brotliDecompressSync(Buffer.from(s.replace(/\s+/g, ""), "base64url"));
+}
+
+// ../../src/notify.ts
+var installed = null;
+function setNotifyHook(fn) {
+  installed?.uninstall();
+  installed = fn === null ? null : { hook: fn, uninstall: setDaemonEventHandler("notification", fn) };
+}
+function clearNotifyHook(fn) {
+  if (installed?.hook === fn) {
+    installed.uninstall();
+    installed = null;
+  }
+}
+function fireNotify(identityName, summary) {
+  emitDaemonNotification(identityName, summary);
+}
+var notifyHooks = {
+  onNotify: (identityName, summary) => fireNotify(identityName, summary)
+};
+var NOTIFY_KIND_SETS = {
+  // Genuine inbound arrivals — something addressed to this identity landed.
+  inbound: ["message_received", "file_received"],
+  // Introduction bookkeeping — not an arrival, but an away agent must act on it.
+  intro: ["local_contact_request", "pending_message"],
+  // What `ours-mcp watch` surfaces: arrivals plus the intro events. This is
+  // 7a7ec16's whitelist exactly, and it is a UNION rather than a third list so
+  // the two cannot drift apart.
+  get wake() {
+    return [...NOTIFY_KIND_SETS.inbound, ...NOTIFY_KIND_SETS.intro];
+  }
+};
+function parseNotifyKinds(kindsParam) {
+  if (kindsParam === null || kindsParam === "") return null;
+  const keep = /* @__PURE__ */ new Set();
+  for (const raw of kindsParam.split(",")) {
+    const kind = raw.trim();
+    if (kind === "") continue;
+    const events = NOTIFY_KIND_SETS[kind];
+    if (!events) throw new Error(kind);
+    for (const e of events) keep.add(e);
+  }
+  return keep;
+}
+function notifyEventMatches(event, keep) {
+  if (keep === null) return true;
+  return typeof event.event === "string" && keep.has(event.event);
+}
+var notifyWaiters = /* @__PURE__ */ new Map();
+function fireNotifyWaiters(name) {
+  const set = notifyWaiters.get(name);
+  if (!set || set.size === 0) return;
+  for (const w of [...set]) {
+    try {
+      w();
+    } catch {
+    }
+  }
+}
+function waitForNotify(name, ms) {
+  return new Promise((resolve2) => {
+    let set = notifyWaiters.get(name);
+    if (!set) {
+      set = /* @__PURE__ */ new Set();
+      notifyWaiters.set(name, set);
+    }
+    let done = false;
+    const finish = () => {
+      if (done) return;
+      done = true;
+      set.delete(fn);
+      if (set.size === 0) notifyWaiters.delete(name);
+      clearTimeout(timer);
+      resolve2();
+    };
+    const fn = finish;
+    const timer = setTimeout(finish, ms);
+    set.add(fn);
+  });
+}
+function appendNotifyLog(id, event) {
+  try {
+    fs5.mkdirSync(id.dir, { recursive: true, mode: 448 });
+    fs5.appendFileSync(notifyLogPath(id.dir), JSON.stringify(event) + "\n");
+  } catch (err) {
+    log(`[${id.name}] failed to append notifications.log:`, String(err));
+  }
+  fireNotifyWaiters(id.name);
+  emitDaemonEvent(id, event);
+}
+function readE2eWireIds(id) {
+  const logPath = notifyLogPath(id.dir);
+  let text = "";
+  try {
+    text = fs5.readFileSync(logPath, "utf8");
+  } catch {
+    return /* @__PURE__ */ new Set();
+  }
+  const events = [];
+  for (const line of text.split("\n")) {
+    if (!line.trim()) continue;
+    try {
+      events.push(JSON.parse(line));
+    } catch {
+    }
+  }
+  return e2eWireIdsFromEvents(events);
+}
+function binHexField(av, field) {
+  const x = av.Reduce(field);
+  return x.IsNil() ? "" : Buffer.from(x.GetBinary()).toString("hex");
+}
+var NOTIFY_LONGPOLL_MS = Number(process.env.OURS_NOTIFY_LONGPOLL_MS) > 0 ? Number(process.env.OURS_NOTIFY_LONGPOLL_MS) : 25e3;
+var NOTIFY_RECHECK_MS = 250;
+function notifyLogSize(logPath) {
+  try {
+    return fs5.statSync(logPath).size;
+  } catch {
+    return 0;
+  }
+}
+function readNotifyRange(logPath, from, to) {
+  if (to <= from) return { events: [], cursor: from };
+  const buf = Buffer.alloc(to - from);
+  let read = 0;
+  try {
+    const fd = fs5.openSync(logPath, "r");
+    try {
+      read = fs5.readSync(fd, buf, 0, buf.length, from);
+    } finally {
+      fs5.closeSync(fd);
+    }
+  } catch {
+    return { events: [], cursor: from };
+  }
+  const slice = buf.subarray(0, read);
+  const lastNl = slice.lastIndexOf(10);
+  if (lastNl === -1) return { events: [], cursor: from };
+  const events = [];
+  for (const line of slice.subarray(0, lastNl + 1).toString("utf8").split("\n")) {
+    if (!line.trim()) continue;
+    try {
+      events.push(JSON.parse(line));
+    } catch {
+    }
+  }
+  return { events, cursor: from + lastNl + 1 };
+}
+async function serveNotifications(req, res, name, sinceParam, kindsParam = null) {
+  const logPath = notifyLogPath(join6(STATE_DIR, name));
+  const send = (cursor, events) => {
+    if (res.writableEnded) return;
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ cursor, events }));
+  };
+  let keep;
+  try {
+    keep = parseNotifyKinds(kindsParam);
+  } catch (bad) {
+    if (!res.writableEnded) {
+      res.writeHead(400, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({
+        error: `unknown notification kind "${String(bad.message)}" \u2014 known kinds: ${Object.keys(NOTIFY_KIND_SETS).sort().join(", ")}`
+      }));
+    }
+    return;
+  }
+  if (sinceParam === null || sinceParam === "tip") {
+    send(notifyLogSize(logPath), []);
+    return;
+  }
+  let since = parseInt(sinceParam, 10);
+  if (!Number.isFinite(since) || since < 0) {
+    if (!res.writableEnded) {
+      res.writeHead(400, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "invalid since cursor" }));
+    }
+    return;
+  }
+  let aborted = false;
+  req.on("close", () => {
+    aborted = true;
+  });
+  const deadline = Date.now() + NOTIFY_LONGPOLL_MS;
+  while (!aborted) {
+    const size = notifyLogSize(logPath);
+    if (since > size) since = 0;
+    if (size > since) {
+      const { events, cursor } = readNotifyRange(logPath, since, size);
+      since = cursor;
+      const delivered = keep === null ? events : events.filter((e) => notifyEventMatches(e, keep));
+      if (delivered.length > 0) {
+        send(cursor, delivered);
+        return;
+      }
+    }
+    if (Date.now() >= deadline) break;
+    await waitForNotify(name, Math.min(NOTIFY_RECHECK_MS, deadline - Date.now()));
+  }
+  if (!aborted) send(since, []);
+}
+function refreshUnread(id) {
+  try {
+    const { unread, unreadFiles } = withScope((lt) => {
+      const inbox = renderInbox(readonlyTx(id, "::actor::list_incoming_messages", lt));
+      const unread2 = inbox.filter((m) => m.status === "unread");
+      const filesAv = readonlyTx(id, "::actor::list_incoming_files", lt);
+      const unreadFiles2 = [];
+      if (!filesAv.IsNil()) {
+        for (let i = 0; ; i++) {
+          const f = filesAv.Reduce(i);
+          if (f.IsNil()) break;
+          if (f.Reduce("status").Visualize() !== "unread") continue;
+          unreadFiles2.push({
+            file_id: f.Reduce("file_id").Visualize(),
+            sender_id: f.Reduce("sender_id").Visualize(),
+            from: f.Reduce("sender_name").Visualize(),
+            filename: f.Reduce("filename").Visualize(),
+            mime: f.Reduce("mime").Visualize(),
+            bytes: f.Reduce("size").Visualize(),
+            date: f.Reduce("date").Visualize(),
+            wire_id: f.Reduce("wire_id").Visualize()
+          });
+        }
+      }
+      return { unread: unread2, unreadFiles: unreadFiles2 };
+    });
+    const snapshot = {
+      count: unread.length,
+      recent: unread.slice(-10).map((m) => ({ from: m.sender_name, msg_id: m.msg_id, date: m.date })),
+      files: unreadFiles.length,
+      unread_files: unreadFiles.slice(-10)
+    };
+    fs5.mkdirSync(id.dir, { recursive: true, mode: 448 });
+    const tmp = `${unreadPath(id.dir)}.tmp`;
+    fs5.writeFileSync(tmp, JSON.stringify(snapshot));
+    fs5.renameSync(tmp, unreadPath(id.dir));
+  } catch (err) {
+    log(`[${id.name}] failed to refresh unread snapshot:`, String(err));
+  }
+}
+function unreadSummary() {
+  const out = [];
+  let entries = [];
+  try {
+    entries = fs5.readdirSync(STATE_DIR, { withFileTypes: true });
+  } catch {
+    return { identities: out };
+  }
+  for (const entry of entries) {
+    if (!entry.isDirectory() || validateName(entry.name) !== null) continue;
+    let value;
+    try {
+      value = JSON.parse(fs5.readFileSync(unreadPath(join6(STATE_DIR, entry.name)), "utf8"));
+    } catch {
+      continue;
+    }
+    const count = Number.isSafeInteger(value.count) && Number(value.count) >= 0 ? Number(value.count) : 0;
+    const files = Number.isSafeInteger(value.files) && Number(value.files) >= 0 ? Number(value.files) : 0;
+    if (count === 0 && files === 0) continue;
+    const recent = Array.isArray(value.recent) ? value.recent.slice(-10).flatMap((raw) => {
+      if (!raw || typeof raw !== "object") return [];
+      const m = raw;
+      if (typeof m.from !== "string" || !["string", "number"].includes(typeof m.msg_id) || typeof m.date !== "string") return [];
+      return [{ from: m.from, msg_id: m.msg_id, date: m.date }];
+    }) : [];
+    const unreadFiles = Array.isArray(value.unread_files) ? value.unread_files.slice(-10).flatMap((raw) => {
+      if (!raw || typeof raw !== "object") return [];
+      const f = raw;
+      if (typeof f.from !== "string" || typeof f.filename !== "string" || typeof f.mime !== "string" || typeof f.wire_id !== "string") return [];
+      return [{
+        from: f.from,
+        filename: f.filename,
+        mime: f.mime,
+        wire_id: f.wire_id,
+        ...typeof f.sender_id === "string" ? { sender_id: f.sender_id } : {},
+        ...["string", "number"].includes(typeof f.file_id) ? { file_id: f.file_id } : {},
+        ...["string", "number"].includes(typeof f.bytes) ? { bytes: f.bytes } : {},
+        ...typeof f.date === "string" ? { date: f.date } : {}
+      }];
+    }) : [];
+    out.push({ name: entry.name, count, recent, files, unread_files: unreadFiles });
+  }
+  out.sort((a, b) => String(a.name).localeCompare(String(b.name)));
+  return { identities: out };
+}
+
+// ../../src/sweeps.ts
+function renderDegraded(av) {
+  const out = [];
+  const arr = av.Reduce("degraded");
+  if (arr.IsNil()) return out;
+  for (let i = 0; ; i++) {
+    const e = arr.Reduce(i);
+    if (e.IsNil()) break;
+    out.push({
+      cid: e.Reduce("container_id").Visualize(),
+      name: e.Reduce("name").Visualize(),
+      attempts: Number(e.Reduce("attempts").Visualize()),
+      queued: Number(e.Reduce("queued").Visualize())
+    });
+  }
+  return out;
+}
+function renderDeferredQueues(av) {
+  const out = [];
+  const arr = av.Reduce("queues");
+  if (arr.IsNil()) return out;
+  for (let i = 0; ; i++) {
+    const e = arr.Reduce(i);
+    if (e.IsNil()) break;
+    out.push({
+      cid: e.Reduce("container_id").Visualize(),
+      queued: Number(e.Reduce("queued").Visualize()),
+      degraded: e.Reduce("degraded").GetBoolean()
+    });
+  }
+  return out;
+}
+async function flushDeferredFor(id, contactCid) {
+  try {
+    const flushed = await withScopeAsync(async (lt) => {
+      const r = await mutatingTx(id, "::a2a_messaging::flush_deferred", { contact: contactCid }, lt);
+      return Number(r.Reduce("flushed").Visualize());
+    });
+    if (flushed > 0) log(`[${id.name}] flushed ${flushed} deferred message(s) to ${contactCid.slice(0, 12)}\u2026`);
+  } catch (err) {
+    log(`[${id.name}] deferred flush to ${contactCid.slice(0, 12)}\u2026 failed:`, String(err));
+  }
+}
+async function contactRestoreSweep(id) {
+  try {
+    const requested = await withScopeAsync(async (lt) => {
+      const r = await mutatingTx(id, "::a2a_messaging::restore_degraded_contacts", {}, lt);
+      return Number(r.Reduce("requested").Visualize());
+    });
+    if (requested > 0) log(`[${id.name}] contact restore requested for ${requested} degraded contact(s)`);
+    const queues = withScope((lt) => renderDeferredQueues(readonlyTx(id, "::a2a_messaging::list_deferred_queues", lt)));
+    for (const q of queues) {
+      if (!q.degraded) await flushDeferredFor(id, q.cid);
+    }
+  } catch (err) {
+    log(`[${id.name}] contact-restore sweep failed:`, String(err));
+  }
+}
+async function capabilityReconcileSweep(id) {
+  try {
+    const result = await withScopeAsync(async (lt) => {
+      const r = await mutatingTx(id, "::a2a_messaging::reconcile_advertise", {}, lt);
+      const num = (field) => r.Reduce(field).IsNil() ? 0 : Number(r.Reduce(field).Visualize());
+      return {
+        changed: /true/i.test(r.Reduce("changed").Visualize()),
+        capabilityAdvertised: num("capability_advertised"),
+        legacyReadvertised: num("legacy_readvertised")
+      };
+    });
+    if (result.capabilityAdvertised > 0 || result.legacyReadvertised > 0) {
+      log(`[${id.name}] capability reconcile: changed=${result.changed} advertised=${result.capabilityAdvertised} legacy_migration_bootstrap=${result.legacyReadvertised}`);
+    }
+  } catch (err) {
+    log(`[${id.name}] capability reconcile sweep failed:`, String(err));
+  }
+}
+var capReconcileScheduled = /* @__PURE__ */ new Set();
+function scheduleCapabilityReconcile(id) {
+  if (capReconcileScheduled.has(id.name)) return;
+  capReconcileScheduled.add(id.name);
+  for (const ms of [2e3, 15e3]) {
+    setTimeout(() => {
+      if (ms === 15e3) capReconcileScheduled.delete(id.name);
+      const cur = identities.get(id.name);
+      if (cur) void capabilityReconcileSweep(cur);
+    }, ms);
+  }
+}
+async function e2eRecoverySweep(id) {
+  try {
+    const readvertised = await withScopeAsync(async (lt) => {
+      const r = await mutatingTx(id, "::a2a_messaging::readvertise_e2e_recovery", {}, lt);
+      return Number(r.Reduce("readvertised").Visualize());
+    });
+    if (readvertised > 0) log(`[${id.name}] re-advertised fresh AD to ${readvertised} e2e contact(s) (session recovery)`);
+  } catch (err) {
+    log(`[${id.name}] e2e recovery re-advertise failed:`, String(err));
+  }
+  try {
+    await withScopeAsync(async (lt) => {
+      await mutatingTx(id, "::a2a_messaging::sweep_e2e_migrations", {}, lt);
+    });
+  } catch (err) {
+    log(`[${id.name}] e2e migration sweep failed:`, String(err));
+  }
+  try {
+    const s = await withScopeAsync(async (lt) => {
+      const r = await mutatingTx(id, "::a2a_messaging::redrive_unacked_sweep", {}, lt);
+      const num = (f) => r.Reduce(f).IsNil() ? 0 : Number(r.Reduce(f).Visualize());
+      return { redriven: num("redriven_contacts"), purged: num("purged_contacts"), deferred: num("deferred_contacts") };
+    });
+    if (s.redriven > 0 || s.purged > 0 || s.deferred > 0) {
+      log(`[${id.name}] unacked sweep: redriven=${s.redriven} ttl_purged=${s.purged} deferred=${s.deferred} contact(s)`);
+    }
+  } catch (err) {
+    log(`[${id.name}] unacked redrive sweep failed:`, String(err));
+  }
+}
+
+// ../../src/mufl/handlers.ts
+function wireHandlers(id, hooks) {
+  id.pw.on_return_data = (data) => {
+    const lt = new AdaptObjectLifetime();
+    data.Attach(lt);
+    try {
+      const kind = data.Reduce("kind").Visualize();
+      if (kind === "save_state") {
+        saveStateFailClosed(id);
+        return;
+      }
+      if (kind === "notify_agent") {
+        const payload = data.Reduce("payload");
+        const event = payload.Reduce("event").Visualize();
+        if (event === "message_received") {
+          const sender = payload.Reduce("sender_name").Visualize();
+          const senderIdValue = payload.Reduce("sender_id");
+          const senderId = senderIdValue.IsNil() ? "" : senderIdValue.Visualize();
+          const msgId = payload.Reduce("msg_id").Visualize();
+          const wireIdValue = payload.Reduce("wire_id");
+          const wireId = wireIdValue.IsNil() ? "" : wireIdValue.Visualize();
+          const date = payload.Reduce("date").Visualize();
+          appendNotifyLog(id, {
+            event: "message_received",
+            from: sender,
+            sender_name: sender,
+            sender_id: senderId,
+            msg_id: msgId,
+            wire_id: wireId,
+            date
+          });
+          refreshUnread(id);
+          process.nextTick(
+            () => hooks.onNotify(id.name, `[${id.name}] new message from ${sender} (#${msgId})`)
+          );
+        } else if (event === "receipt_received") {
+          const senderIdValue = payload.Reduce("sender_id");
+          const senderId = senderIdValue.IsNil() ? "" : String(senderIdValue.Visualize());
+          const kindValue = payload.Reduce("kind");
+          const receiptKind = kindValue.IsNil() ? "" : String(kindValue.Visualize());
+          const wireIds = [];
+          const wireIdsValue = payload.Reduce("wire_ids");
+          if (!wireIdsValue.IsNil()) {
+            for (let i = 0; ; i++) {
+              const wireId = wireIdsValue.Reduce(i);
+              if (wireId.IsNil()) break;
+              wireIds.push(String(wireId.Visualize()));
+            }
+          }
+          const dateValue = payload.Reduce("date");
+          const date = dateValue.IsNil() ? (/* @__PURE__ */ new Date()).toISOString() : String(dateValue.Visualize());
+          appendNotifyLog(id, {
+            event: "receipt_received",
+            sender_id: senderId,
+            kind: receiptKind,
+            wire_ids: wireIds,
+            date
+          });
+        } else if (event === "file_received") {
+          const sender = payload.Reduce("sender_name").Visualize();
+          const senderId = payload.Reduce("sender_id").Visualize();
+          const fileId = payload.Reduce("file_id").Visualize();
+          const wireId = payload.Reduce("wire_id").Visualize();
+          const filename = payload.Reduce("filename").Visualize();
+          const mime = payload.Reduce("mime").Visualize();
+          const bytes = payload.Reduce("bytes").Visualize();
+          const date = payload.Reduce("date").Visualize();
+          appendNotifyLog(id, {
+            event: "file_received",
+            from: sender,
+            sender_id: senderId,
+            file_id: fileId,
+            wire_id: wireId,
+            filename,
+            mime,
+            bytes,
+            date
+          });
+          refreshUnread(id);
+          process.nextTick(
+            () => hooks.onNotify(
+              id.name,
+              `[${id.name}] new file ${filename} (${bytes} B) from ${sender} (sender_id ${senderId}, file_id ${fileId}, wire_id ${wireId})`
+            )
+          );
+        } else if (event === "contact_accepted") {
+          const name = payload.Reduce("name").Visualize();
+          const cid = payload.Reduce("container_id").Visualize();
+          scheduleCapabilityReconcile(id);
+          process.nextTick(
+            () => hooks.onNotify(id.name, `[${id.name}] contact "${name}" (${cid}) accepted your invite.`)
+          );
+        } else if (event === "local_contact_added") {
+          const name = payload.Reduce("name").Visualize();
+          const cid = payload.Reduce("container_id").Visualize();
+          scheduleCapabilityReconcile(id);
+          process.nextTick(
+            () => hooks.onNotify(id.name, `[${id.name}] local contact "${name}" (${cid}) connected via the contact book.`)
+          );
+        } else if (event === "contact_name_collision") {
+          const message = payload.Reduce("message").Visualize();
+          const desired = payload.Reduce("desired").Visualize();
+          const assigned = payload.Reduce("assigned").Visualize();
+          const existingCid = payload.Reduce("existing_container_id").Visualize();
+          const cid = payload.Reduce("container_id").Visualize();
+          appendNotifyLog(id, { event: "contact_name_collision", desired, assigned, existing_container_id: existingCid, container_id: cid });
+          log(`[${id.name}] CONTACT NAME COLLISION \u2014 ${message}`);
+          process.nextTick(() => hooks.onNotify(id.name, `[${id.name}] \u26A0 ${message}`));
+        } else if (event === "sibling_contact_added") {
+          const name = payload.Reduce("name").Visualize();
+          const cid = payload.Reduce("container_id").Visualize();
+          appendNotifyLog(id, { event: "sibling_contact_added", from: name });
+          scheduleCapabilityReconcile(id);
+          process.nextTick(
+            () => hooks.onNotify(id.name, `[${id.name}] sibling "${name}" (${cid}) connected (intra-root auto-accept).`)
+          );
+        } else if (event === "local_contact_request") {
+          const name = payload.Reduce("name").Visualize();
+          const cid = payload.Reduce("container_id").Visualize();
+          appendNotifyLog(id, { event: "local_contact_request", from: name });
+          process.nextTick(
+            () => hooks.onNotify(
+              id.name,
+              `[${id.name}] pending local introduction from "${name}" (${cid}) \u2014 approve or reject with respond_to_introduction.`
+            )
+          );
+        } else if (event === "pending_message") {
+          const name = payload.Reduce("sender_name").Visualize();
+          const queued = payload.Reduce("queued").Visualize();
+          appendNotifyLog(id, { event: "pending_message", from: name, queued });
+          process.nextTick(
+            () => hooks.onNotify(id.name, `[${id.name}] "${name}" queued a message awaiting introduction approval (${queued} queued).`)
+          );
+        } else if (event === "e2e_restore_rejected") {
+          appendNotifyLog(id, { event: "e2e_restore_rejected" });
+          log(`[${id.name}] E2E RESTORE REJECTED \u2014 corrupt session blob failed pickle_key validation; reset to empty e2e state, self-heal fallback will re-establish`);
+          process.nextTick(
+            () => hooks.onNotify(id.name, `[${id.name}] persisted e2e sessions were corrupt \u2014 rejected cleanly, sessions re-establishing`)
+          );
+        } else if (event === "contact_restored") {
+          const name = payload.Reduce("name").Visualize();
+          const cid = payload.Reduce("container_id").Visualize();
+          appendNotifyLog(id, { event: "contact_restored", from: name });
+          log(`[${id.name}] contact "${name}" restored (re-keyed)`);
+          process.nextTick(() => void flushDeferredFor(id, String(cid)));
+        } else if (event === "migration_active") {
+          const cid = payload.Reduce("cid").Visualize();
+          const role = payload.Reduce("role").Visualize();
+          const epoch = binHexField(payload, "epoch");
+          const sid = binHexField(payload, "session_id");
+          appendNotifyLog(id, { event: "migration_active", cid: String(cid), role: String(role), ...epoch ? { epoch } : {}, ...sid ? { session_id: sid } : {} });
+          log(`[migration] active cid=${cid} role=${role}${epoch ? ` epoch=${epoch}` : ""}${sid ? ` session_id=${sid}` : ""}`);
+        } else if (event === "e2e_app_send") {
+          const cid = payload.Reduce("cid").Visualize();
+          const sid = binHexField(payload, "session_id");
+          const olm = payload.Reduce("olm_type").Visualize();
+          const wireId = payload.Reduce("wire_id").Visualize();
+          const retained = payload.Reduce("retained").IsNil() ? void 0 : payload.Reduce("retained").GetBoolean();
+          const evicted = [];
+          const ev = payload.Reduce("evicted");
+          if (!ev.IsNil()) {
+            for (let i = 0; ; i++) {
+              const e = ev.Reduce(i);
+              if (e.IsNil()) break;
+              evicted.push(String(e.Visualize()));
+            }
+          }
+          appendNotifyLog(id, { event: "e2e_app_send", cid: String(cid), session_id: sid, olm_type: String(olm), wire_id: String(wireId), ...retained === false ? { retained: false } : {}, ...evicted.length ? { evicted } : {} });
+          log(`[${id.name}] [e2e-app] send cid=${cid} session_id=${sid} olm_type=${olm} wire_id=${wireId}${retained === false ? " retained=false" : ""}${evicted.length ? ` evicted=${evicted.join(",")}` : ""}`);
+          if (evicted.length) {
+            process.nextTick(
+              () => hooks.onNotify(id.name, `[${id.name}] redrive window overflow: ${evicted.length} older unacked send(s) lost their auto-resend guarantee (${evicted.join(", ")})`)
+            );
+          }
+        } else if (event === "dedup_degraded") {
+          const cid = payload.Reduce("cid").Visualize();
+          const droppedWire = payload.Reduce("dropped_wire_id").Visualize();
+          appendNotifyLog(id, { event: "dedup_degraded", cid: String(cid), dropped_wire_id: String(droppedWire) });
+          log(`[${id.name}] [e2e-app] DEDUP DEGRADED cid=${cid} dropped_wire_id=${droppedWire} (storage ceiling \u2014 a late redrive of that id could re-deposit)`);
+          process.nextTick(
+            () => hooks.onNotify(id.name, `[${id.name}] dedup window overflowed for ${String(cid).slice(0, 12)}\u2026 \u2014 one oldest entry dropped (guarantee loss surfaced)`)
+          );
+        } else if (event === "e2e_delivery_expired") {
+          const cid = payload.Reduce("cid").Visualize();
+          const wireIds = [];
+          const wl = payload.Reduce("wire_ids");
+          if (!wl.IsNil()) {
+            for (let i = 0; ; i++) {
+              const e = wl.Reduce(i);
+              if (e.IsNil()) break;
+              wireIds.push(String(e.Visualize()));
+            }
+          }
+          appendNotifyLog(id, { event: "e2e_delivery_expired", cid: String(cid), wire_ids: wireIds });
+          log(`[${id.name}] [e2e-app] delivery EXPIRED (2-day TTL, receipt never arrived) cid=${cid} wire_ids=${wireIds.join(",")}`);
+          process.nextTick(
+            () => hooks.onNotify(id.name, `[${id.name}] ${wireIds.length} message(s)/file(s) to ${String(cid).slice(0, 12)}\u2026 expired undelivered (no receipt within 2 days)`)
+          );
+        } else if (event === "e2e_app_recv") {
+          const cid = payload.Reduce("cid").Visualize();
+          const sid = binHexField(payload, "session_id");
+          const ok = payload.Reduce("ok").GetBoolean();
+          const wireId = payload.Reduce("wire_id").Visualize();
+          const code = payload.Reduce("code").IsNil() ? void 0 : String(payload.Reduce("code").Visualize());
+          const duplicate = !payload.Reduce("duplicate").IsNil();
+          const isFile = !payload.Reduce("file").IsNil();
+          appendNotifyLog(id, { event: "e2e_app_recv", cid: String(cid), session_id: sid, ok, wire_id: String(wireId), ...code ? { code } : {}, ...duplicate ? { duplicate: true } : {}, ...isFile ? { file: true } : {} });
+          log(`[${id.name}] [e2e-app] recv cid=${cid} session_id=${sid} ok=${ok} wire_id=${wireId}${code ? ` code=${code}` : ""}${duplicate ? " duplicate=true" : ""}${isFile ? " file=true" : ""}`);
+        } else if (event === "e2e_rekey") {
+          const cid = payload.Reduce("cid").Visualize();
+          const role = payload.Reduce("role").Visualize();
+          const sid = binHexField(payload, "session_id");
+          const attempts = payload.Reduce("attempts").IsNil() ? void 0 : String(payload.Reduce("attempts").Visualize());
+          const supports = payload.Reduce("peer_supports").IsNil() ? void 0 : String(payload.Reduce("peer_supports").Visualize());
+          const rejected = payload.Reduce("rejected").IsNil() ? void 0 : String(payload.Reduce("rejected").Visualize());
+          appendNotifyLog(id, { event: "e2e_rekey", cid: String(cid), role: String(role), ...sid ? { session_id: sid } : {}, ...attempts ? { attempts } : {}, ...supports ? { peer_supports: supports } : {}, ...rejected ? { rejected } : {} });
+          log(`[${id.name}] [e2e-rekey] cid=${cid} role=${role}${sid ? ` session_id=${sid}` : ""}${attempts ? ` attempts=${attempts}` : ""}${supports ? ` peer_supports=${supports}` : ""}${rejected ? ` rejected=${rejected}` : ""}`);
+        } else if (event === "migration_deferred_flush") {
+          const cid = payload.Reduce("cid").Visualize();
+          const wireId = payload.Reduce("wire_id").Visualize();
+          appendNotifyLog(id, { event: "migration_deferred_flush", cid: String(cid), wire_id: String(wireId) });
+          log(`[migration] flush-notify cid=${cid} wire_id=${wireId} (deferred\u2192e2e; core delivers)`);
+        } else if (event === "migration_stalled") {
+          const cid = payload.Reduce("cid").Visualize();
+          const phase = payload.Reduce("phase").Visualize();
+          const attempts = payload.Reduce("attempts").Visualize();
+          appendNotifyLog(id, { event: "migration_stalled", cid: String(cid), phase: String(phase), attempts: String(attempts) });
+          log(`[migration] stalled-notify cid=${cid} phase=${phase} attempts=${attempts} (core re-drives via sweep)`);
+        } else if (event === "downgrade_refused") {
+          const cid = payload.Reduce("cid").Visualize();
+          const wireAv = payload.Reduce("wire_id");
+          const wireId = wireAv.IsNil() ? "" : String(wireAv.Visualize());
+          appendNotifyLog(id, { event: "downgrade_refused", cid: String(cid), ...wireId ? { wire_id: wireId } : {} });
+          log(`[e2e-route] downgrade-dropped cid=${cid}${wireId ? ` wire_id=${wireId}` : ""} (legacy plaintext from a migrated peer \u2014 dropped by core)`);
+          process.nextTick(
+            () => hooks.onNotify(id.name, `[${id.name}] a message from a migrated contact was rejected as an unsafe downgrade (dropped).`)
+          );
+        } else if (event === "contact_removed") {
+          const cid = String(payload.Reduce("cid").Visualize());
+          const outbound = outboundRemovalInFlight.has(id.name);
+          appendNotifyLog(id, { event: "contact_removed", cid, by: outbound ? "local" : "peer" });
+          if (!outbound) {
+            log(`[${id.name}] contact ${cid} removed you (authenticated peer removal notice) \u2014 dropped from contacts`);
+            process.nextTick(
+              () => hooks.onNotify(id.name, `[${id.name}] contact ${cid.slice(0, 12)}\u2026 removed you as a contact (the removal was applied locally too).`)
+            );
+          }
+        } else if (event === "monitoring_disabled") {
+          const cid = String(payload.Reduce("cid").Visualize());
+          const causeAv = payload.Reduce("cause");
+          const cause = causeAv.IsNil() ? "" : String(causeAv.Visualize());
+          appendNotifyLog(id, { event: "monitoring_disabled", cid, ...cause ? { cause } : {} });
+          log(`[${id.name}] monitoring disabled (cid=${cid}${cause ? ` cause=${cause}` : ""})`);
+          process.nextTick(
+            () => hooks.onNotify(id.name, `[${id.name}] the monitoring/control-plane binding was disabled${cause === "control_plane_removed_contact" ? " \u2014 the control plane removed you as a contact" : ""}.`)
+          );
+        } else if (event === "control_request" || event === "host_provision_child" || event === "host_destroy_child" || event === "host_mint_child_invite" || event === "host_set_child_monitoring") {
+          log(`[${id.name}] ${event}: the daemon-side control plane is removed \u2014 ignoring`);
+        } else {
+          appendNotifyLog(id, { event });
+        }
+        return;
+      }
+      const p = id.pending.shift();
+      if (!p) return;
+      clearTimeout(p.timer);
+      p.resolve(data.Reduce("payload").Detach());
+    } finally {
+      lt.Finalize();
+    }
+  };
+  id.pw.on_transaction_failure = (message) => {
+    const p = id.pending.shift();
+    if (p) {
+      clearTimeout(p.timer);
+      p.reject(new Error(message));
+    } else {
+      log(`[${id.name}] inbound transaction rejected:`, message);
+      appendNotifyLog(id, { event: "inbound_error", message });
+      process.nextTick(
+        () => hooks.onNotify(id.name, `[${id.name}] inbound transaction rejected: ${message}`)
+      );
+    }
+  };
+}
+
+// ../../src/book.ts
+import { join as join7 } from "node:path";
+import * as fs6 from "node:fs";
+var bookDir = () => join7(STATE_DIR, BOOK_DIR_NAME);
+var registrarKeyPath = () => join7(bookDir(), "registrar.key");
+var bookPath = () => join7(bookDir(), "book.json");
+function readBook() {
+  try {
+    const parsed = JSON.parse(fs6.readFileSync(bookPath(), "utf8"));
+    return parsed && typeof parsed.entries === "object" ? parsed.entries : {};
+  } catch {
+    return {};
+  }
+}
+function writeBook(entries) {
+  fs6.mkdirSync(bookDir(), { recursive: true });
+  const tmp = `${bookPath()}.tmp`;
+  fs6.writeFileSync(tmp, JSON.stringify({ v: 1, entries }, null, 2), { mode: 384 });
+  fs6.renameSync(tmp, bookPath());
+}
+function exportAdBlob(id) {
+  return withScope(
+    (lt) => Buffer.from(readonlyTx(id, "::actor::export_address_document", lt).GetBinary())
+  );
+}
+function exportSigningSecret(id) {
+  return withScope(
+    (lt) => Buffer.from(readonlyTx(id, "::actor::export_signing_secret", lt).Serialize()).toString("hex")
+  );
+}
+async function publishToBook(id) {
+  if (!registrar) throw new Error("registrar is not available");
+  const adBlob = exportAdBlob(id);
+  const registrarSig = await withScopeAsync(async (lt) => {
+    const sigData = await mutatingTx(registrar, "::actor::sign_book_entry", {
+      name: id.name,
+      ad: registrar.pw.packet.NewBinaryFromBuffer(adBlob).Attach(lt)
+    }, lt);
+    return Buffer.from(sigData.Reduce("sig").GetBinary()).toString("base64url");
+  });
+  const entries = readBook();
+  entries[id.name] = {
+    v: 1,
+    name: id.name,
+    container_id: id.cid,
+    address_document: adBlob.toString("base64url"),
+    published_at: (/* @__PURE__ */ new Date()).toISOString(),
+    registrar_sig: registrarSig
+  };
+  writeBook(entries);
+  log(`[${id.name}] published to the local contact book`);
+}
+function unpublishFromBook(id) {
+  const entries = readBook();
+  const hit = Object.entries(entries).find(([, e]) => e.container_id === id.cid);
+  if (!hit) return;
+  delete entries[hit[0]];
+  writeBook(entries);
+  log(`[${id.name}] removed from the local contact book (entry "${hit[0]}")`);
+}
+async function pinRegistrar(id) {
+  if (!registrarAdBlob) throw new Error("registrar is not available");
+  await withScopeAsync(async (lt) => {
+    await mutatingTx(id, "::actor::pin_registrar", {
+      registrar_ad: id.pw.packet.NewBinaryFromBuffer(registrarAdBlob).Attach(lt)
+    }, lt);
+  });
+}
+
+// ../../src/identity/provision.ts
+function createPacket(name, seed, dir, track = true, signingSecret, deferExposure = false) {
+  const config = new PacketWrapperConfigurator();
+  config.deferred_exposure = deferExposure;
+  const args = [
+    "--unit_hash",
+    UNIT.hash,
+    "--seed_phrase",
+    seed,
+    "--unit_dir_path",
+    UNIT.dir
+  ];
+  if (signingSecret) {
+    args.push("--init_trn_argument", JSON.stringify(signingSecret));
+  }
+  config.process_arguments(args);
+  return new Promise((resolveCreate, rejectCreate) => {
+    const timer = setTimeout(
+      () => rejectCreate(new Error(`packet creation for "${name}" timed out`)),
+      3e4
+    );
+    wrapper.packet_manager.create_packet(
+      config,
+      (pw) => {
+        clearTimeout(timer);
+        const id = {
+          name,
+          cid: withScope((lt) => pw.packet.GetContainerID().Attach(lt).Visualize()),
+          pw,
+          dir,
+          pending: [],
+          lock: Promise.resolve()
+        };
+        wireHandlers(id, notifyHooks);
+        if (track) identities.set(name, id);
+        log(`[${name}] packet created \u2014 container id ${id.cid}`);
+        resolveCreate(id);
+      },
+      UNIT.contents
+    );
+  });
+}
+var reservedNames = new Set(listPersistedNames());
+if (reservedNames.size > 0) {
+  log(`reserved ${reservedNames.size} persisted identity name(s) at module load: ${[...reservedNames].join(", ")}`);
+}
+async function provisionIdentity(name, opts = { exposeLocal: true, localAutoAccept: true }) {
+  if (reservedNames.has(name) || identities.has(name)) {
+    throw new Error(
+      `identity name "${name}" is reserved \u2014 a persisted identity with this name is restoring, present, or being provisioned; refusing to provision over it`
+    );
+  }
+  reservedNames.add(name);
+  try {
+    const dir = identityDir(name);
+    fs7.mkdirSync(dir, { recursive: true, mode: 448 });
+    let tempMeta;
+    if (opts.temp) {
+      tempMeta = { owner: { tokenHash: opts.temp.tokenHash, pid: opts.temp.pid }, createdAt: Date.now() };
+      writeTempMetaFile(dir, tempMeta);
+    }
+    const seed = randomBytes(24).toString("hex");
+    const id = await createPacket(name, seed, dir);
+    if (tempMeta) id.temp = tempMeta;
+    fs7.writeFileSync(keyPath(dir), exportSigningSecret(id), { mode: 384 });
+    await withScopeAsync(async (lt) => {
+      await mutatingTx(id, "::a2a_messaging::set_my_name", { name }, lt);
+    });
+    await pinRegistrar(id);
+    if (!opts.localAutoAccept) {
+      await withScopeAsync(async (lt) => {
+        await mutatingTx(id, "::actor::set_local_policy", { auto_accept: false }, lt);
+      });
+    }
+    if (opts.exposeLocal) {
+      await publishToBook(id);
+    }
+    saveStateFailClosed(id);
+    return id;
+  } catch (err) {
+    reservedNames.delete(name);
+    throw err;
+  }
+}
+async function restoreIdentity(name) {
+  const dir = identityDir(name);
+  const secret = fs7.readFileSync(keyPath(dir), "utf8").trim();
+  const id = await createPacket(name, "", dir, false, secret, true);
+  log(`[${name}] created QUARANTINED (no routing/broker registration, not client-bindable) \u2014 importing state before exposure`);
+  const holdMs = Number(process.env.OURS_TEST_RESTORE_HOLD_MS || "") || 0;
+  if (holdMs > 0) {
+    log(`[${name}] TEST HOLD: keeping restore open ${holdMs}ms (OURS_TEST_RESTORE_HOLD_MS)`);
+    await new Promise((r) => setTimeout(r, holdMs));
+  }
+  const isTimeout = (err) => /timed out waiting for the transaction result/.test(String(err));
+  const tearDownUnexposed = (step, why, err) => {
+    log(`[${name}] ${step} ${why} \u2014 identity left UNEXPOSED and UNTRACKED (fail-closed)`);
+    try {
+      appendNotifyLog(id, { event: "restore_fail_closed", step, error: String(err).slice(0, 300) });
+    } catch {
+    }
+    identities.delete(name);
+    try {
+      wrapper.remove_packet(id.cid);
+    } catch (e2) {
+      log(`[${name}] quarantined-packet teardown failed:`, String(e2));
+    }
+    throw new Error(`identity "${name}": ${step} failed during restore (${why}) \u2014 left unexposed (fail-closed)`);
+  };
+  const failClosed = (step, err) => tearDownUnexposed(step, "outcome UNKNOWN (timeout): the transaction may still execute and exposure would race it", err);
+  if (hasSavedState(dir)) {
+    let imported = false;
+    try {
+      if (process.env.OURS_TEST_FORCE_IMPORT_TIMEOUT === "1") {
+        throw new Error("timed out waiting for the transaction result (forced by OURS_TEST_FORCE_IMPORT_TIMEOUT)");
+      }
+      const buf = fs7.readFileSync(dataPath(dir));
+      await withScopeAsync(async (lt) => {
+        const adaptData = id.pw.packet.ParseValue(new Uint8Array(buf)).Attach(lt);
+        const importTimeoutMs = Number(process.env.OURS_IMPORT_TIMEOUT_MS || "") || void 0;
+        await mutatingTx(id, "::actor::import_state", adaptData, lt, importTimeoutMs);
+      });
+      imported = true;
+      log(`[${name}] state import completed (positively observed)`);
+    } catch (err) {
+      if (isTimeout(err)) failClosed("import_state", err);
+      log(`[${name}] FAILED TO IMPORT SAVED STATE \u2014 continuing with the reseeded identity; surviving contacts (if the blob was partially migrated) self-heal via contact restore:`, String(err));
+      appendNotifyLog(id, { event: "state_import_failed", error: String(err).slice(0, 300) });
+      try {
+        const failedPath = `${dataPath(dir)}.failed-${Date.now()}`;
+        fs7.renameSync(dataPath(dir), failedPath);
+        fs7.chmodSync(failedPath, 384);
+        log(`[${name}] unreadable state blob preserved as state_data.bin.failed-*`);
+      } catch {
+      }
+    }
+    if (imported) {
+      try {
+        const st = await withScopeAsync(async (lt) => {
+          const r = await mutatingTx(id, "::a2a_messaging::commit_e2e_restore", {}, lt);
+          const status = r.Reduce("status").Visualize();
+          const sessions = r.Reduce("sessions").IsNil() ? "0" : r.Reduce("sessions").Visualize();
+          return { status: String(status), sessions: String(sessions) };
+        });
+        log(`[${name}] e2e restore commit: status=${st.status} sessions=${st.sessions}`);
+      } catch (err) {
+        if (isTimeout(err)) failClosed("commit_e2e_restore", err);
+        log(`[${name}] E2E RESTORE REJECTED \u2014 staged session blob failed pickle_key validation; discarding it, fresh account + self-heal fallback take over: ${String(err).slice(0, 260)}`);
+        appendNotifyLog(id, { event: "e2e_restore_rejected", origin: "restore", error: String(err).slice(0, 300) });
+        try {
+          await withScopeAsync(async (lt) => {
+            await mutatingTx(id, "::a2a_messaging::reject_e2e_restore", {}, lt);
+          });
+        } catch (err2) {
+          if (isTimeout(err2)) failClosed("reject_e2e_restore", err2);
+          log(`[${name}] reject_e2e_restore failed (staging is transient; continuing):`, String(err2));
+        }
+      }
+      try {
+        id.pw.refresh_identity_proof_document();
+        log(`[${name}] transport IPD refreshed from post-import state`);
+      } catch (err) {
+        tearDownUnexposed("ipd_refresh", "FAILED (IPD would advertise a stale bundle)", err);
+      }
+      let coherent = false;
+      let ikShort = "";
+      try {
+        if (process.env.OURS_TEST_FORCE_IPD_INCOHERENT === "1") {
+          throw new Error("forced incoherent (OURS_TEST_FORCE_IPD_INCOHERENT)");
+        }
+        const ik = withScope((lt) => String(readonlyTx(id, "::a2a_messaging::e2e_self_fp", lt).Reduce("ik").Visualize()));
+        const ipdVis = id.pw.identity_proof_document.Visualize();
+        const ikHex = ik.replace(/^0x/i, "");
+        coherent = ikHex.length >= 32 && ipdVis.toLowerCase().includes(ikHex.toLowerCase());
+        ikShort = ik.slice(0, 18);
+        appendNotifyLog(id, { event: "ipd_coherence", ik, coherent });
+      } catch (err) {
+        tearDownUnexposed("ipd_coherence", "probe FAILED (coherence unprovable)", err);
+      }
+      log(`[${name}] IPD/e2e coherence: account_ik=${ikShort}\u2026 ipd_advertises_it=${coherent}`);
+      if (!coherent) {
+        tearDownUnexposed("ipd_coherence", "IPD does NOT advertise the live account ik", new Error("incoherent transport IPD"));
+      }
+    }
+  }
+  wrapper.expose_packet(id.cid);
+  identities.set(name, id);
+  log(`[${name}] EXPOSED (routing + broker registration) \u2014 import phase complete`);
+  await contactRestoreSweep(id);
+  refreshUnread(id);
+  return id;
+}
+
+// ../../src/state.ts
+async function ensureRegistrar() {
+  fs8.mkdirSync(bookDir(), { recursive: true });
+  let secret;
+  try {
+    secret = fs8.readFileSync(registrarKeyPath(), "utf8").trim();
+  } catch {
+  }
+  const seed = randomBytes2(24).toString("hex");
+  setRegistrar(await createPacket(BOOK_DIR_NAME, seed, bookDir(), false, secret));
+  if (!secret) {
+    fs8.writeFileSync(registrarKeyPath(), exportSigningSecret(registrar), { mode: 384 });
+  }
+  setRegistrarAdBlob(exportAdBlob(registrar));
+  log(`contact-book registrar ready (${registrar.cid})`);
+}
+function hasSavedState(dir) {
+  try {
+    return fs8.existsSync(dataPath(dir)) && fs8.statSync(dataPath(dir)).size > 0;
+  } catch {
+    return false;
+  }
+}
+function saveState(id) {
+  const bytes = withScope(
+    (lt) => Buffer.from(readonlyTx(id, "::actor::export_state", lt).Serialize())
+  );
+  fs8.mkdirSync(id.dir, { recursive: true, mode: 448 });
+  const final = dataPath(id.dir);
+  const tmp = `${final}.tmp`;
+  let fd;
+  try {
+    fd = fs8.openSync(tmp, "w", 384);
+    fs8.fchmodSync(fd, 384);
+    fs8.writeFileSync(fd, bytes);
+    fs8.fsyncSync(fd);
+    fs8.closeSync(fd);
+    fd = void 0;
+    fs8.renameSync(tmp, final);
+    fs8.chmodSync(final, 384);
+    try {
+      fs8.chmodSync(keyPath(id.dir), 384);
+    } catch {
+    }
+    const dirFd = fs8.openSync(id.dir, "r");
+    try {
+      fs8.fsyncSync(dirFd);
+    } finally {
+      fs8.closeSync(dirFd);
+    }
+  } catch (err) {
+    if (fd !== void 0) {
+      try {
+        fs8.closeSync(fd);
+      } catch {
+      }
+    }
+    try {
+      fs8.rmSync(tmp, { force: true });
+    } catch {
+    }
+    throw err;
+  }
+}
+function saveStateFailClosed(id) {
+  try {
+    saveState(id);
+    if (id.persistFailed) {
+      id.persistFailed = false;
+      log(`[${id.name}] persist recovered \u2014 quarantine lifted`);
+      appendNotifyLog(id, { event: "persist_recovered" });
+    }
+  } catch (err) {
+    id.persistFailed = true;
+    log(`[${id.name}] PERSIST FAILED \u2014 identity quarantined (fail-closed), outbound of this txn withheld:`, String(err));
+    try {
+      appendNotifyLog(id, { event: "persist_failed", error: String(err).slice(0, 300) });
+    } catch {
+    }
+    process.nextTick(
+      () => fireNotify(id.name, `[${id.name}] PERSIST FAILED \u2014 messaging quarantined until the state file is writable again`)
+    );
+    throw err;
+  }
+}
+
+// ../../src/mufl/tx.ts
+function withScope(fn) {
+  const lt = new AdaptObjectLifetime2();
+  try {
+    return fn(lt);
+  } finally {
+    lt.Finalize();
+  }
+}
+async function withScopeAsync(fn) {
+  const lt = new AdaptObjectLifetime2();
+  try {
+    return await fn(lt);
+  } finally {
+    lt.Finalize();
+  }
+}
+function readonlyTx(id, name, lt, targ) {
+  const envelope = object_to_adapt_value({ name, targ });
+  const result = id.pw.packet.ExecuteTransaction(envelope);
+  envelope.Destroy();
+  return lt ? result.Attach(lt) : result;
+}
+async function withLock(id, fn) {
+  const prev = id.lock;
+  let release;
+  id.lock = new Promise((r) => release = r);
+  await prev;
+  try {
+    return await fn();
+  } finally {
+    release();
+  }
+}
+function enqueueMutation(id, envelope, timeoutMs = 25e3) {
+  return new Promise((res, rej) => {
+    const timer = setTimeout(() => {
+      const i = id.pending.findIndex((p) => p.timer === timer);
+      if (i >= 0) id.pending.splice(i, 1);
+      rej(new Error("timed out waiting for the transaction result"));
+    }, timeoutMs);
+    id.pending.push({ resolve: res, reject: rej, timer });
+    id.pw.add_client_message(envelope);
+  });
+}
+function mutatingTx(id, name, targ, lt, timeoutMs) {
+  if (id.persistFailed) {
+    try {
+      saveStateFailClosed(id);
+    } catch (err) {
+      return Promise.reject(new Error(
+        `identity "${id.name}" is quarantined: state persist is failing (${String(err)}) \u2014 mutations are rejected until state_data.bin is writable again`
+      ));
+    }
+  }
+  const envelope = object_to_adapt_value({ name, targ });
+  return withLock(id, () => enqueueMutation(id, envelope, timeoutMs)).then(
+    (payload) => {
+      envelope.Destroy();
+      if (id.persistFailed) {
+        try {
+          payload.Destroy();
+        } catch {
+        }
+        throw new Error(
+          `identity "${id.name}": state persist FAILED \u2014 this transaction's outbound was withheld (fail-closed); fix the state directory and retry`
+        );
+      }
+      return lt ? payload.Attach(lt) : payload;
+    },
+    (err) => {
+      try {
+        envelope.Destroy();
+      } catch {
+      }
+      throw err;
+    }
+  );
+}
+
+// ../../src/identity/hierarchy.ts
+function setRootName(name) {
+  rootName = name;
+}
+var rootMarkerPath = () => join8(STATE_DIR, "root.json");
+var rootName = null;
+function readRootMarker() {
+  try {
+    const parsed = JSON.parse(fs9.readFileSync(rootMarkerPath(), "utf8"));
+    return typeof parsed.name === "string" ? parsed.name : null;
+  } catch {
+    return null;
+  }
+}
+function writeRootMarker(name) {
+  fs9.mkdirSync(STATE_DIR, { recursive: true });
+  const tmp = `${rootMarkerPath()}.tmp`;
+  fs9.writeFileSync(tmp, JSON.stringify({ v: 1, name }));
+  fs9.renameSync(tmp, rootMarkerPath());
+}
+function clearRootMarker() {
+  fs9.rmSync(rootMarkerPath(), { force: true });
+}
+function describeIdentity(id) {
+  return withScope((lt) => {
+    const v = readonlyTx(id, "::actor::describe_identity", lt);
+    return {
+      bio: v.Reduce("bio").Visualize(),
+      persona: v.Reduce("persona").Visualize(),
+      hasCert: v.Reduce("has_cert").GetBoolean(),
+      roleId: v.Reduce("role_id").Visualize(),
+      rootCid: v.Reduce("root_cid").Visualize(),
+      rootName: v.Reduce("root_name").Visualize(),
+      monitoringEnabled: v.Reduce("monitoring_enabled").GetBoolean()
+    };
+  });
+}
+async function delegateRole(root, role) {
+  await withScopeAsync(async (lt) => {
+    const roleAd = exportAdBlob(role);
+    const signed = await mutatingTx(root, "::actor::sign_delegation", {
+      role_ad: root.pw.packet.NewBinaryFromBuffer(roleAd).Attach(lt),
+      role_id: role.name
+    }, lt);
+    const certBlob = Buffer.from(signed.Reduce("cert").GetBinary());
+    const profileData = await mutatingTx(root, "::actor::export_root_profile", {}, lt);
+    const profileBlob = Buffer.from(profileData.Reduce("profile").GetBinary());
+    const rootAdBlob = exportAdBlob(root);
+    const roleAdV1 = Buffer.from(
+      (await mutatingTx(role, "::actor::export_v1_address_document", {}, lt)).Reduce("ad").GetBinary()
+    );
+    const signedV1 = await mutatingTx(root, "::actor::sign_delegation", {
+      role_ad: root.pw.packet.NewBinaryFromBuffer(roleAdV1).Attach(lt),
+      role_id: role.name
+    }, lt);
+    const certV1Blob = Buffer.from(signedV1.Reduce("cert").GetBinary());
+    await mutatingTx(role, "::actor::set_delegation", {
+      cert: role.pw.packet.NewBinaryFromBuffer(certBlob).Attach(lt),
+      root_ad: role.pw.packet.NewBinaryFromBuffer(rootAdBlob).Attach(lt),
+      root_profile: role.pw.packet.NewBinaryFromBuffer(profileBlob).Attach(lt),
+      cert_v1: role.pw.packet.NewBinaryFromBuffer(certV1Blob).Attach(lt)
+    }, lt);
+  });
+  log(`[${role.name}] delegated as a role under root "${root.name}"`);
+}
+async function establishRoot(id) {
+  rootName = id.name;
+  writeRootMarker(id.name);
+  const adopted = [];
+  const failed = [];
+  for (const other of identities.values()) {
+    if (other.name === id.name) continue;
+    if (other.temp) continue;
+    try {
+      await delegateRole(id, other);
+      adopted.push(other.name);
+    } catch (err) {
+      log(`failed to adopt "${other.name}" as a role under new root "${id.name}":`, String(err));
+      failed.push(other.name);
+    }
+  }
+  log(`[${id.name}] established as the host root${adopted.length ? ` (adopted ${adopted.length} role(s))` : ""}`);
+  return { adopted, failed };
+}
+
+// ../../src/identity/lifecycle.ts
+import { join as join9 } from "node:path";
+import * as fs10 from "node:fs";
+function deleteIdentityCompletely(id) {
+  try {
+    wrapper.remove_packet(id.cid);
+  } catch (err) {
+    log(`remove_packet(${id.cid}) failed:`, String(err));
+  }
+  identities.delete(id.name);
+  try {
+    unpublishFromBook(id);
+  } catch (err) {
+    log(`failed to unpublish "${id.name}" from the contact book:`, String(err));
+  }
+  if (leases.has(id.name)) {
+    leases.delete(id.name);
+    persistBindings();
+  }
+  if (id.name === rootName) {
+    setRootName(null);
+    clearRootMarker();
+  }
+  try {
+    fs10.rmSync(id.dir, { recursive: true, force: true });
+    reservedNames.delete(id.name);
+  } catch (err) {
+    return `deleting ${id.dir} failed: ${String(err)}`;
+  }
+  return null;
+}
+function closeTemporaryIdentity(id, cause) {
+  const t = id.temp;
+  if (!t) return Promise.reject(new Error(`identity "${id.name}" is not temporary`));
+  if (t.closing) return t.closing;
+  t.closing = (async () => {
+    log(`[${id.name}] closing temporary identity (${cause})`);
+    let contacts = [];
+    try {
+      contacts = withScope((lt) => renderContacts(readonlyTx(id, "::a2a_messaging::list_contacts", lt)));
+    } catch (err) {
+      log(`[${id.name}] contact snapshot failed during close (continuing with local cleanup):`, String(err));
+    }
+    let notified = 0;
+    let failed = 0;
+    outboundRemovalInFlight.add(id.name);
+    try {
+      for (const c of contacts) {
+        try {
+          const queued = await withScopeAsync(async (lt) => {
+            const data = await mutatingTx(id, "::a2a_messaging::remove_contact", { contact: c.container_id }, lt);
+            const nv = data.Reduce("notified");
+            return nv.IsNil() ? false : nv.GetBoolean();
+          });
+          if (queued) notified++;
+          else failed++;
+        } catch (err) {
+          failed++;
+          log(`[${id.name}] remove-me to ${c.container_id} failed (continuing):`, String(err));
+        }
+      }
+    } finally {
+      outboundRemovalInFlight.delete(id.name);
+    }
+    const deleteError = deleteIdentityCompletely(id);
+    if (deleteError) {
+      log(`[${id.name}] temporary identity close: LOCAL DELETE FAILED \u2014 ${deleteError}`);
+    } else {
+      log(
+        `[${id.name}] temporary identity closed: ${contacts.length} contact(s), ${notified} remove-me notice(s) queued, ${failed} not sent (delivery unverified by design)`
+      );
+    }
+    return { attempted: contacts.length, notified, failed, deleteError };
+  })();
+  return t.closing;
+}
+function sweepStaleTempIdentities() {
+  for (const id of [...identities.values()]) {
+    const t = id.temp;
+    if (!t || t.closing) continue;
+    if (pidAlive(t.owner.pid)) continue;
+    const lease = leases.get(id.name);
+    if (lease && pidAlive(lease.pid)) continue;
+    void closeTemporaryIdentity(id, `stale lease \u2014 owner pid ${t.owner.pid} is dead`).catch(
+      (err) => log(`[${id.name}] stale-temp reclaim failed:`, String(err))
+    );
+  }
+}
+function sweepOrphanTempDirs() {
+  if (!fs10.existsSync(STATE_DIR)) return;
+  for (const d of fs10.readdirSync(STATE_DIR, { withFileTypes: true })) {
+    if (!d.isDirectory() || identities.has(d.name)) continue;
+    const dir = join9(STATE_DIR, d.name);
+    const meta = readTempMetaFile(dir);
+    if (!meta || pidAlive(meta.owner.pid)) continue;
+    try {
+      fs10.rmSync(dir, { recursive: true, force: true });
+      reservedNames.delete(d.name);
+      log(`[${d.name}] removed orphaned temporary-identity dir (owner pid ${meta.owner.pid} dead, no live packet)`);
+    } catch (err) {
+      log(`[${d.name}] failed to remove orphaned temporary-identity dir:`, String(err));
+    }
+  }
+}
+
+// ../../src/cluster/manifest.ts
+function manifestCapabilities(id) {
+  try {
+    return withScope((lt) => {
+      const caps = readonlyTx(id, "::a2a_capabilities::get_manifest", lt).Reduce("capabilities");
+      if (caps.IsNil()) return [];
+      return [...caps.GetKeys()].map((k) => typeof k === "string" ? k : k.Visualize());
+    });
+  } catch {
+    return [];
+  }
+}
+
+// ../../src/cluster/control.ts
+var envelopeDispatch = () => ENVELOPE_DISPATCH;
+var ENVELOPE_DISPATCH = true;
+var PROTOCOL_VERSION = ENVELOPE_DISPATCH ? 2 : 1;
+function enumerateChildren(root, lt) {
+  const children = [];
+  for (const id of identities.values()) {
+    if (id.name === root.name) continue;
+    const info = describeIdentity(id);
+    if (info.rootCid !== root.cid) continue;
+    const childAd = readonlyTx(id, "::actor::export_address_document_native", lt);
+    children.push({
+      cid: childAd.Reduce("identity").Reduce("container_id"),
+      role_id: info.roleId,
+      name: id.name,
+      bio: info.bio,
+      persona: info.persona,
+      caps: manifestCapabilities(id),
+      // RR-4: real caps, so a backfilled member isn't hard-blocked
+      child_ad: childAd
+    });
+  }
+  return children;
+}
+var sweepBusy = /* @__PURE__ */ new Set();
+async function clusterSweep(root) {
+  if (sweepBusy.has(root.name)) return;
+  sweepBusy.add(root.name);
+  try {
+    await withScopeAsync(async (lt) => {
+      await mutatingTx(root, "::a2a_cluster::reconcile", { pending_handle: "", children: enumerateChildren(root, lt) }, lt);
+    });
+  } catch (err) {
+    log(`[${root.name}] cluster sweep failed:`, String(err));
+  } finally {
+    sweepBusy.delete(root.name);
+  }
+}
+var SWEEP_INTERVAL_MS = 6e4;
+function startClusterSweep() {
+  setInterval(() => {
+    if (!ENVELOPE_DISPATCH) return;
+    for (const id of identities.values()) {
+      if (describeIdentity(id).roleId === "") void clusterSweep(id);
+    }
+  }, SWEEP_INTERVAL_MS).unref();
+}
+
+// ../../src/boot.ts
+var booted = false;
+function wrapperBooted() {
+  return booted;
+}
+function guardBoot() {
+  if (booted) {
+    throw new Error(
+      'bootWrapper() has already run in this process. It boots the ADAPT environment, which can only be initialised once \u2014 a second call fails inside the native layer with "Failed to invoke initializer in ADAPT environment", which names neither the double init nor the caller. NOTE THAT startDaemon() CALLS bootWrapper() ITSELF: the two are alternatives, not steps. Use startDaemon() for the HTTP daemon, or bootWrapper() alone for a stdio/in-process host \u2014 never both.'
+    );
+  }
+  booted = true;
+  assertConfigNotDrifted();
+}
+async function bootWrapper() {
+  guardBoot();
+  startupProgress?.update("wrapper");
+  setUnit(locateUnit());
+  const argv = [
+    "--broker_address",
+    BROKER_URL,
+    "--test_mode",
+    "--logger_config",
+    "--level",
+    "INFO",
+    "--stdout",
+    "stderr",
+    "--logger_config_end"
+  ];
+  log(`booting wrapper (unit ${UNIT.hash.slice(0, 12)}\u2026, broker ${BROKER_URL})`);
+  setWrapper(await adapt_wrapper.start(argv));
+  wrapper.on_packet_created_cb = (cid) => log(`wrapper: packet ready ${cid.slice(0, 12)}\u2026`);
+  wrapper.start();
+  const bootHoldMs = Number(process.env.OURS_TEST_BOOT_HOLD_MS || "") || 0;
+  if (bootHoldMs > 0) {
+    log(`TEST HOLD: boot window open ${bootHoldMs}ms (OURS_TEST_BOOT_HOLD_MS)`);
+    await new Promise((r) => setTimeout(r, bootHoldMs));
+  }
+  startupProgress?.update("registrar");
+  try {
+    await ensureRegistrar();
+  } catch (err) {
+    log("failed to start the contact-book registrar (local contact book disabled):", String(err));
+  }
+  tightenIdentityPerms();
+  const names = listPersistedNames();
+  const fakeRestoreCount = Math.max(0, Number(process.env.OURS_TEST_FAKE_RESTORE_COUNT || "") || 0);
+  const fakeRestoreMs = Math.max(0, Number(process.env.OURS_TEST_FAKE_RESTORE_MS || "") || 0);
+  const restoreTotal = names.length === 0 && fakeRestoreCount > 0 ? fakeRestoreCount : names.length;
+  startupProgress?.update("identities", { completed: 0, total: restoreTotal });
+  for (const n of names) reservedNames.add(n);
+  if (names.length === 0 && fakeRestoreCount > 0) {
+    log(`TEST: simulating ${fakeRestoreCount} fake identity restore(s), ${fakeRestoreMs}ms each`);
+    for (let i = 0; i < fakeRestoreCount; i++) {
+      if (fakeRestoreMs > 0) await new Promise((r) => setTimeout(r, fakeRestoreMs));
+      startupProgress?.update("identities", { completed: i + 1, total: fakeRestoreCount });
+    }
+  } else if (names.length === 0) {
+    log("no persisted identities \u2014 start with create_identity");
+  } else {
+    log(`restoring ${names.length} identit${names.length === 1 ? "y" : "ies"}: ${names.join(", ")}`);
+    for (const [index, name] of names.entries()) {
+      try {
+        const id = await restoreIdentity(name);
+        if (registrar) {
+          await pinRegistrar(id);
+        }
+        const tempMeta = readTempMetaFile(id.dir);
+        if (tempMeta) id.temp = tempMeta;
+      } catch (err) {
+        log(`failed to restore "${name}":`, String(err));
+      }
+      startupProgress?.update("identities", { completed: index + 1, total: names.length });
+    }
+  }
+  startupProgress?.update("reconciliation");
+  startClusterSweep();
+  setRootName(readRootMarker());
+  if (rootName && !identities.has(rootName)) {
+    log(`root marker names a missing identity "${rootName}" \u2014 clearing it`);
+    setRootName(null);
+    clearRootMarker();
+  }
+  if (rootName) log(`root identity: ${rootName}`);
+  {
+    const hostRoot = rootName ? identities.get(rootName) : void 0;
+    if (rootName && !hostRoot) {
+      log(`re-delegation on upgrade DEGRADED: root "${rootName}" is not among the restored identities \u2014 role certs not refreshed this boot`);
+    }
+    const refreshedRoles = [];
+    if (hostRoot) {
+      for (const id of identities.values()) {
+        if (id.name === hostRoot.name) continue;
+        let info;
+        try {
+          info = describeIdentity(id);
+        } catch {
+          info = void 0;
+        }
+        if (!info || !info.hasCert) continue;
+        if (info.rootCid !== hostRoot.cid) {
+          log(`[${id.name}] re-delegation skipped: delegated by a different root (${info.rootCid.slice(0, 12)}\u2026), not this host root \u2014 left as-is`);
+          continue;
+        }
+        try {
+          await delegateRole(hostRoot, id);
+          refreshedRoles.push(id);
+        } catch (err) {
+          appendNotifyLog(id, { event: "redelegation_failed", error: String(err).slice(0, 300) });
+          log(`[${id.name}] boot re-delegation (upgrade cert refresh) failed:`, String(err));
+        }
+      }
+    }
+    for (const id of identities.values()) {
+      await capabilityReconcileSweep(id);
+      await e2eRecoverySweep(id);
+      for (const ms of [1e4, 3e4, 9e4]) {
+        setTimeout(() => {
+          capabilityReconcileSweep(id).catch(() => {
+          });
+        }, ms);
+        setTimeout(() => {
+          e2eRecoverySweep(id).catch(() => {
+          });
+        }, ms);
+      }
+    }
+    if (refreshedRoles.length > 0) log(`refreshed ${refreshedRoles.length} role delegation cert(s) against the live AD on boot`);
+  }
+  persistBindings();
+  sweepOrphanTempDirs();
+  sweepStaleTempIdentities();
+}
+
+export {
+  VERSION,
+  CONFIG,
+  STATE_DIR,
+  BROKER_URL,
+  PORT,
+  GC_INTERVAL_MS,
+  API_VISIBILITY,
+  startupProgress,
+  log,
+  requireAuth,
+  validateName,
+  FILE_SELECTION_CAP,
+  identities,
+  registrar,
+  hashLeaseToken,
+  writeTempMetaFile,
+  isSelectableWireId,
+  findIdentityFile,
+  leases,
+  tombstones,
+  sessionHeaders,
+  outboundRemovalInFlight,
+  pidAlive,
+  leaseByToken,
+  persistBindings,
+  resolveBound,
+  bindSession,
+  buildMessagesPayload,
+  mimeFromExt,
+  renderContacts,
+  renderImportRenames,
+  renderInbox,
+  renderFileMetadata,
+  writeIncomingFiles,
+  renderPending,
+  renderContactRoots,
+  encodeWireBin,
+  decodeWireBin,
+  setNotifyHook,
+  clearNotifyHook,
+  appendNotifyLog,
+  readE2eWireIds,
+  serveNotifications,
+  refreshUnread,
+  unreadSummary,
+  renderDegraded,
+  contactRestoreSweep,
+  capabilityReconcileSweep,
+  scheduleCapabilityReconcile,
+  e2eRecoverySweep,
+  readBook,
+  exportAdBlob,
+  publishToBook,
+  unpublishFromBook,
+  reservedNames,
+  provisionIdentity,
+  saveState,
+  withScope,
+  withScopeAsync,
+  readonlyTx,
+  mutatingTx,
+  rootName,
+  describeIdentity,
+  delegateRole,
+  establishRoot,
+  deleteIdentityCompletely,
+  closeTemporaryIdentity,
+  sweepStaleTempIdentities,
+  envelopeDispatch,
+  PROTOCOL_VERSION,
+  clusterSweep,
+  wrapperBooted,
+  bootWrapper
+};