@ours.network/cli 2.0.3 → 2.0.4

package/dist/{boot-BUGOBQGZ.js → boot-HNJ7ZR5L.js}

@@ -1,7 +1,7 @@
 import {
   bootWrapper,
   wrapperBooted
-} from "./chunk-ZCCCTR27.js";
+} from "./chunk-TSYICL3I.js";
 import "./chunk-FXKFSNKS.js";
 export {
   bootWrapper,

package/dist/{chunk-UIWEBE5K.js → chunk-DZH2YEXT.js}

@@ -99,7 +99,7 @@ function childEnvironment(selection) {
 async function serveDaemon(selection, managed = false) {
   if (selection.endpoint !== void 0) throw new Error("--endpoint selects a running daemon and cannot be used with daemon serve");
   Object.assign(process.env, childEnvironment(selection));
-  const { startDaemon } = await import("./daemon-3C5SDTHJ.js");
+  const { startDaemon } = await import("./daemon-LTJHJDWZ.js");
   const handle = await startDaemon();
   if (managed) {
     const response = await fetch(`http://127.0.0.1:${handle.port}/state-dir`);

package/dist/{chunk-ZCCCTR27.js → chunk-TSYICL3I.js}

@@ -89,7 +89,7 @@ function createStartupProgressReporter(stateDir, opts = {}) {
 }
 
 // ../../src/runtime/env.ts
-var VERSION = true ? "3.0.3" : "0.0.0-dev";
+var VERSION = true ? "3.0.4" : "0.0.0-dev";
 var CONFIG = loadConfig();
 var STATE_DIR = CONFIG.stateDir;
 var BROKER_URL = CONFIG.brokerUrl;
@@ -802,6 +802,7 @@ function setWrapper(w) {
   wrapper = w;
 }
 var identities = /* @__PURE__ */ new Map();
+var quarantinedIdentities = /* @__PURE__ */ new Map();
 var registrar = null;
 var registrarAdBlob = null;
 function setRegistrar(id) {
@@ -894,13 +895,13 @@ var leases = /* @__PURE__ */ new Map();
 var tombstones = /* @__PURE__ */ new Set();
 var sessionHeaders = /* @__PURE__ */ new Map();
 var outboundRemovalInFlight = /* @__PURE__ */ new Set();
-function pidAlive(pid) {
-  if (!Number.isInteger(pid) || pid <= 0) return false;
+function pidDefinitelyDead(pid) {
+  if (!Number.isInteger(pid) || pid <= 1) return false;
   try {
     process.kill(pid, 0);
-    return true;
+    return false;
   } catch (err) {
-    return err.code === "EPERM";
+    return err.code === "ESRCH";
   }
 }
 function leaseByToken(token) {
@@ -1902,6 +1903,85 @@ async function pinRegistrar(id) {
   });
 }
 
+// ../../src/identity/migration.ts
+function wasPublished(id) {
+  return Object.values(readBook()).some((entry) => entry.container_id === id.cid);
+}
+async function finishRestoredActivation(id) {
+  wrapper.expose_packet(id.cid);
+  identities.set(id.name, id);
+  quarantinedIdentities.delete(id.name);
+  log(`[${id.name}] EXPOSED (routing + broker registration) \u2014 hierarchy reconciled after restore`);
+  try {
+    await contactRestoreSweep(id);
+  } catch (err) {
+    log(`[${id.name}] post-activation contact restore sweep failed:`, String(err));
+  }
+  try {
+    refreshUnread(id);
+  } catch (err) {
+    log(`[${id.name}] post-activation unread refresh failed:`, String(err));
+  }
+  return id;
+}
+function quarantine(id, status) {
+  const exposeLocal = wasPublished(id);
+  if (exposeLocal) unpublishFromBook(id);
+  identities.delete(id.name);
+  quarantinedIdentities.set(id.name, { identity: id, status, exposeLocal });
+  log(`[${id.name}] QUARANTINED (${status}) \u2014 management-only, unexposed and unbindable`);
+  return id;
+}
+async function reconcileRestoredIdentity(id) {
+  if (rootName === id.name) return finishRestoredActivation(id);
+  const hostRoot = rootName ? identities.get(rootName) : void 0;
+  let info;
+  try {
+    info = describeIdentity(id);
+  } catch (err) {
+    log(`[${id.name}] hierarchy classification failed:`, String(err));
+    return quarantine(id, "migration-failed");
+  }
+  if (hostRoot) {
+    if (info.hasCert && info.roleId !== "" && info.rootCid !== hostRoot.cid) {
+      log(`[${id.name}] preserved imported delegation from root ${info.rootCid.slice(0, 12)}\u2026`);
+      return finishRestoredActivation(id);
+    }
+    try {
+      await delegateRole(hostRoot, id);
+      return finishRestoredActivation(id);
+    } catch (err) {
+      log(`[${id.name}] root delegation during restore failed:`, String(err));
+      return quarantine(id, "migration-failed");
+    }
+  }
+  if (info.hasCert && info.roleId !== "") return finishRestoredActivation(id);
+  return quarantine(id, "awaiting-root");
+}
+async function adoptQuarantinedIdentities(root) {
+  const adopted = [];
+  const failed = [];
+  for (const [name, held] of [...quarantinedIdentities]) {
+    try {
+      await delegateRole(root, held.identity);
+      if (held.exposeLocal) await publishToBook(held.identity);
+      await finishRestoredActivation(held.identity);
+      quarantinedIdentities.delete(name);
+      adopted.push(name);
+    } catch (err) {
+      try {
+        unpublishFromBook(held.identity);
+      } catch {
+      }
+      held.status = "migration-failed";
+      quarantinedIdentities.set(name, held);
+      log(`[${name}] quarantine adoption failed under root "${root.name}":`, String(err));
+      failed.push(name);
+    }
+  }
+  return { adopted, failed };
+}
+
 // ../../src/identity/provision.ts
 function createPacket(name, seed, dir, track = true, signingSecret, deferExposure = false) {
   const config = new PacketWrapperConfigurator();
@@ -2086,12 +2166,9 @@ async function restoreIdentity(name) {
   } catch (err) {
     tearDownUnexposed("history_open", "FAILED (SQLite history unavailable)", err);
   }
-  wrapper.expose_packet(id.cid);
-  identities.set(name, id);
-  log(`[${name}] EXPOSED (routing + broker registration) \u2014 import phase complete`);
-  await contactRestoreSweep(id);
-  refreshUnread(id);
-  return id;
+  const restoredTemp = readTempMetaFile(id.dir);
+  if (restoredTemp) id.temp = restoredTemp;
+  return reconcileRestoredIdentity(id);
 }
 
 // ../../src/state.ts
@@ -2345,8 +2422,11 @@ async function establishRoot(id) {
   return { adopted, failed };
 }
 
-// ../../src/identity/lifecycle.ts
+// ../../src/identity/reaper.ts
 import { join as join9 } from "node:path";
+import * as fs12 from "node:fs";
+
+// ../../src/identity/lifecycle.ts
 import * as fs11 from "node:fs";
 
 // ../../src/render/adapt-to-json.ts
@@ -2724,31 +2804,46 @@ function closeTemporaryIdentity(id, cause) {
   })();
   return t.closing;
 }
-function sweepStaleTempIdentities() {
-  for (const id of [...identities.values()]) {
+
+// ../../src/identity/reaper.ts
+function sessionReaperIntervalMs(raw = process.env.OURS_SESSION_REAPER_INTERVAL_MS) {
+  if (raw === void 0 || raw.trim() === "") return 5e3;
+  const parsed = Number(raw);
+  if (!Number.isFinite(parsed)) return 5e3;
+  return Math.max(100, Math.trunc(parsed));
+}
+async function reapStaleTemporaryIdentities() {
+  const all = [
+    ...identities.values(),
+    ...[...quarantinedIdentities.values()].map((held) => held.identity)
+  ];
+  const closes = [];
+  for (const id of all) {
     const t = id.temp;
-    if (!t || t.closing) continue;
-    if (pidAlive(t.owner.pid)) continue;
+    if (!t || t.closing || !pidDefinitelyDead(t.owner.pid)) continue;
     const lease = leases.get(id.name);
-    if (lease && pidAlive(lease.pid)) continue;
-    void closeTemporaryIdentity(id, `stale lease \u2014 owner pid ${t.owner.pid} is dead`).catch(
-      (err) => log(`[${id.name}] stale-temp reclaim failed:`, String(err))
+    if (lease && !pidDefinitelyDead(lease.pid)) continue;
+    closes.push(
+      closeTemporaryIdentity(id, `stale lease \u2014 owner pid ${t.owner.pid} is dead`).then(() => {
+        quarantinedIdentities.delete(id.name);
+      }).catch((err) => log(`[${id.name}] stale-temp reclaim failed:`, String(err)))
     );
   }
+  await Promise.all(closes);
 }
-function sweepOrphanTempDirs() {
-  if (!fs11.existsSync(STATE_DIR)) return;
-  for (const d of fs11.readdirSync(STATE_DIR, { withFileTypes: true })) {
-    if (!d.isDirectory() || identities.has(d.name)) continue;
+async function reapOrphanTemporaryDirectories() {
+  if (!fs12.existsSync(STATE_DIR)) return;
+  for (const d of fs12.readdirSync(STATE_DIR, { withFileTypes: true })) {
+    if (!d.isDirectory() || identities.has(d.name) || quarantinedIdentities.has(d.name)) continue;
     const dir = join9(STATE_DIR, d.name);
     const meta = readTempMetaFile(dir);
-    if (!meta || pidAlive(meta.owner.pid)) continue;
+    if (!meta || !pidDefinitelyDead(meta.owner.pid)) continue;
     try {
-      fs11.rmSync(dir, { recursive: true, force: true });
+      fs12.rmSync(dir, { recursive: true, force: true });
       reservedNames.delete(d.name);
-      log(`[${d.name}] removed orphaned temporary-identity dir (owner pid ${meta.owner.pid} dead, no live packet)`);
+      log(`[${d.name}] removed orphaned temporary-identity dir (owner pid ${meta.owner.pid} confirmed dead)`);
     } catch (err) {
-      log(`[${d.name}] failed to remove orphaned temporary-identity dir:`, String(err));
+      throw new Error(`[${d.name}] failed to remove orphaned temporary-identity dir: ${String(err)}`);
     }
   }
 }
@@ -2859,7 +2954,9 @@ async function bootWrapper() {
     log("failed to start the contact-book registrar (local contact book disabled):", String(err));
   }
   tightenIdentityPerms();
-  const names = listPersistedNames();
+  setRootName(readRootMarker());
+  const persistedNames = listPersistedNames();
+  const names = rootName && persistedNames.includes(rootName) ? [rootName, ...persistedNames.filter((name) => name !== rootName)] : persistedNames;
   const fakeRestoreCount = Math.max(0, Number(process.env.OURS_TEST_FAKE_RESTORE_COUNT || "") || 0);
   const fakeRestoreMs = Math.max(0, Number(process.env.OURS_TEST_FAKE_RESTORE_MS || "") || 0);
   const restoreTotal = names.length === 0 && fakeRestoreCount > 0 ? fakeRestoreCount : names.length;
@@ -2945,8 +3042,8 @@ async function bootWrapper() {
     if (refreshedRoles.length > 0) log(`refreshed ${refreshedRoles.length} role delegation cert(s) against the live AD on boot`);
   }
   persistBindings();
-  sweepOrphanTempDirs();
-  sweepStaleTempIdentities();
+  await reapOrphanTemporaryDirectories();
+  await reapStaleTemporaryIdentities();
 }
 
 export {
@@ -2962,6 +3059,8 @@ export {
   requireAuth,
   validateName,
   consumeOutboundHistoryFailure,
+  openHistory,
+  closeHistory,
   listIncomingMessages,
   takeUnreadMessages,
   listIncomingFiles,
@@ -2972,8 +3071,12 @@ export {
   listFileHistory,
   getFileHistoryItem,
   FILE_SELECTION_CAP,
+  wrapper,
   identities,
+  quarantinedIdentities,
   registrar,
+  identityDir,
+  keyPath,
   hashLeaseToken,
   writeTempMetaFile,
   isSelectableWireId,
@@ -2982,7 +3085,7 @@ export {
   tombstones,
   sessionHeaders,
   outboundRemovalInFlight,
-  pidAlive,
+  pidDefinitelyDead,
   leaseByToken,
   persistBindings,
   resolveBound,
@@ -3000,11 +3103,16 @@ export {
   e2eRecoverySweep,
   readBook,
   exportAdBlob,
+  exportSigningSecret,
   publishToBook,
   unpublishFromBook,
+  pinRegistrar,
+  adoptQuarantinedIdentities,
+  createPacket,
   reservedNames,
   provisionIdentity,
   saveState,
+  saveStateFailClosed,
   withScope,
   withScopeAsync,
   readonlyTx,
@@ -3025,7 +3133,8 @@ export {
   decodeWireBin,
   deleteIdentityCompletely,
   closeTemporaryIdentity,
-  sweepStaleTempIdentities,
+  sessionReaperIntervalMs,
+  reapStaleTemporaryIdentities,
   envelopeDispatch,
   PROTOCOL_VERSION,
   clusterSweep,

package/dist/{daemon-3C5SDTHJ.js → daemon-LTJHJDWZ.js}

@@ -204,7 +204,7 @@ async function releaseHeld(lock) {
 async function bootKernel() {
   const { lock, acquired } = await ensureLock();
   try {
-    const { bootWrapper } = await import("./boot-BUGOBQGZ.js");
+    const { bootWrapper } = await import("./boot-HNJ7ZR5L.js");
     await bootWrapper();
   } catch (error) {
     if (acquired) await releaseHeld(lock);
@@ -214,7 +214,7 @@ async function bootKernel() {
 async function startDaemon(opts = {}) {
   const { lock, acquired } = await ensureLock();
   try {
-    const runtime = await import("./server-TVV2EZZ6.js");
+    const runtime = await import("./server-35QOYLY4.js");
     const { onRuntimeLoaded, ...daemonOptions } = opts;
     onRuntimeLoaded?.();
     const handle = await runtime.startDaemon({

package/dist/lifecycle.js

@@ -10,7 +10,7 @@ import {
   startDaemonManaged,
   stopDaemonManaged,
   writeManagedRecord
-} from "./chunk-UIWEBE5K.js";
+} from "./chunk-DZH2YEXT.js";
 import "./chunk-6K2JBKHI.js";
 export {
   DAEMON_LOG_FILE,

package/dist/main.js

@@ -44,7 +44,7 @@ import {
   serveDaemon,
   startDaemonManaged,
   stopDaemonManaged
-} from "./chunk-UIWEBE5K.js";
+} from "./chunk-DZH2YEXT.js";
 import {
   attachClient,
   defaultConfigPath,
@@ -55,7 +55,7 @@ import {
 import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
-var CLI_VERSION = false ? "0.0.0-dev" : "2.0.3";
+var CLI_VERSION = false ? "0.0.0-dev" : "2.0.4";
 var COMMON_VALUES = /* @__PURE__ */ new Set(["--endpoint", "--port", "--state-dir", "--config", "--identity"]);
 var COMMON_BOOLEANS = /* @__PURE__ */ new Set(["--json", "--yes", "--help"]);
 var DAEMON_READINESS_TIMEOUT_ENV = "OURS_DAEMON_READINESS_TIMEOUT_MS";

package/dist/{server-TVV2EZZ6.js → server-35QOYLY4.js}

@@ -8,15 +8,18 @@ import {
   PROTOCOL_VERSION,
   STATE_DIR,
   VERSION,
+  adoptQuarantinedIdentities,
   appendNotifyLog,
   bindSession,
   bootWrapper,
   capabilityReconcileSweep,
   clearNotifyHook,
+  closeHistory,
   closeTemporaryIdentity,
   clusterSweep,
   consumeOutboundHistoryFailure,
   contactRestoreSweep,
+  createPacket,
   decodeWireBin,
   delegateRole,
   deleteIdentityCompletely,
@@ -26,13 +29,16 @@ import {
   envelopeDispatch,
   establishRoot,
   exportAdBlob,
+  exportSigningSecret,
   findIdentityFile,
   getFileHistoryItem,
   getMessageHistoryItem,
   getMessageHistorySummary,
   hashLeaseToken,
   identities,
+  identityDir,
   isSelectableWireId,
+  keyPath,
   leaseByToken,
   leases,
   listFileHistory,
@@ -41,13 +47,17 @@ import {
   listMessageHistory,
   log,
   mutatingTx,
+  openHistory,
   outboundRemovalInFlight,
   persistBindings,
-  pidAlive,
+  pidDefinitelyDead,
+  pinRegistrar,
   provisionIdentity,
   publishToBook,
+  quarantinedIdentities,
   readBook,
   readonlyTx,
+  reapStaleTemporaryIdentities,
   refreshUnread,
   registrar,
   renderContactRoots,
@@ -60,14 +70,15 @@ import {
   resolveBound,
   rootName,
   saveState,
+  saveStateFailClosed,
   scheduleCapabilityReconcile,
   serveNotifications,
   sessionHeaders,
+  sessionReaperIntervalMs,
   setNotifyHook,
   startupProgress,
   structuredVoiceOutcome,
   sttStatus,
-  sweepStaleTempIdentities,
   takeUnreadFiles,
   takeUnreadMessages,
   tombstones,
@@ -78,8 +89,9 @@ import {
   voiceDeliveryLine,
   withScope,
   withScopeAsync,
+  wrapper,
   writeTempMetaFile
-} from "./chunk-ZCCCTR27.js";
+} from "./chunk-TSYICL3I.js";
 import {
   buildIdentityFile,
   writeIdentityFile
@@ -88,11 +100,157 @@ import {
 // ../../src/http/server.ts
 import { createServer as createHttpServer } from "node:http";
 import { randomUUID } from "node:crypto";
-import * as fs2 from "node:fs";
+import * as fs3 from "node:fs";
 
 // ../../src/protocol.ts
 var OURS_COMPAT_VERSION = 1;
 
+// ../../src/errors.ts
+var OursError = class extends Error {
+  // `details` is PURELY ADDITIVE and optional: every existing construction and
+  // every `e.code` check keeps working untouched. It exists because a refusal a
+  // caller is expected to ACT on (trim N bytes, shorten the filename) cannot be
+  // delivered as prose alone — see errFileTooLarge.
+  constructor(code, message, details) {
+    super(message);
+    this.code = code;
+    this.details = details;
+    this.name = "OursError";
+  }
+};
+var errNameTaken = (tool, name) => new OursError("NAME_TAKEN", `${tool} failed: an identity named "${name}" already exists.`);
+var errNoLeaseHeaders = () => new OursError(
+  "NO_LEASE_HEADERS",
+  "create_temporary_identity failed: this client is not connected through the ours connector (no lease token / client pid headers), so there is no session lease to own the identity. Launch ours via the connector (`ours-mcp proxy`)."
+);
+var errRandomNameExhausted = () => new OursError(
+  "RANDOM_NAME_EXHAUSTED",
+  "create_temporary_identity failed: could not pick a free random name after 5 attempts \u2014 retry."
+);
+var errRootExists = (rootName2) => new OursError(
+  "ROOT_EXISTS",
+  `create_root_identity failed: a root identity already exists ("${rootName2}") \u2014 one root per host. Nothing to do.`
+);
+var errNotBoundNoName = () => new OursError("NOT_BOUND_NO_NAME", "close_temporary_identity failed: no identity is bound to this session and no name was given.");
+var errNotTemporary = (name) => new OursError(
+  "NOT_TEMPORARY",
+  `close_temporary_identity failed: "${name}" is a permanent identity. Use remove_identity if you really mean to delete it.`
+);
+var errTempOwnedElsewhereClose = (name, pid) => new OursError(
+  "TEMP_OWNED_ELSEWHERE",
+  `close_temporary_identity failed: "${name}" is owned by another LIVE session (owner pid ${pid}) \u2014 one session cannot delete another's temporary identity.`
+);
+var errTempClosedWithError = (name, deleteError, remote) => new OursError("DELETE_PARTIAL", `Temporary identity "${name}" closed with an error: ${deleteError}. ${remote}`);
+var errPathNotAbsolute = (path) => new OursError("PATH_NOT_ABSOLUTE", `define_local_identity_file failed: path must be absolute (got "${path}").`);
+var errNoSuchIdentity = (name) => new OursError("NO_SUCH_IDENTITY", `choose_identity failed: no identity named "${name}". Create it with create_identity.`);
+var errNoLeaseToken = () => new OursError(
+  "NO_LEASE_TOKEN",
+  "choose_identity failed: this client is not connected through the ours connector (no lease token header). Launch ours via the connector (`ours-mcp proxy`)."
+);
+var errTempClosingChoose = (name) => new OursError("TEMP_CLOSING", `choose_identity failed: temporary identity "${name}" is closing \u2014 its state is being deleted.`);
+var errTempOwnedLive = (name, pid) => new OursError(
+  "TEMP_OWNED_ELSEWHERE",
+  `choose_identity failed: "${name}" is a TEMPORARY identity owned by another live session (owner pid ${pid}). Ownership is exclusive and cannot be overridden \u2014 not even with force. Create your own with create_temporary_identity.`
+);
+var errTempStale = (name, pid) => new OursError(
+  "TEMP_STALE",
+  `choose_identity failed: temporary identity "${name}" is STALE \u2014 its owning session (pid ${pid}) is gone and it is pending automatic cleanup. It cannot be adopted by another session; use close_temporary_identity to reclaim (clean it up) now.`
+);
+var errBoundElsewhere = (name) => new OursError(
+  "BOUND_ELSEWHERE",
+  `choose_identity declined: "${name}" is currently bound to another live session. Do not retry with force=true on your own \u2014 tell the user it is in use elsewhere and ask whether to forcibly rebind it here; only retry with force=true after they explicitly confirm.`
+);
+var errTempOwnedElsewhereRemove = (name, pid) => new OursError(
+  "TEMP_OWNED_ELSEWHERE",
+  `remove_identity failed: "${name}" is a TEMPORARY identity owned by another LIVE session (owner pid ${pid}) \u2014 one session cannot delete another's temporary identity.`
+);
+var errIdentityClosedWithError = (name, deleteError, remote) => new OursError("DELETE_PARTIAL", `Temporary identity "${name}" closed with an error: ${deleteError}.${remote}`);
+var errRootHasRoles = (name, roles) => new OursError(
+  "ROOT_HAS_ROLES",
+  `remove_identity failed: "${name}" is the root identity and still has ${roles.length} role(s): ${roles.join(", ")}. Remove the roles first.`
+);
+var errIdentityPartiallyRemoved = (name, fail) => new OursError("DELETE_PARTIAL", `Identity "${name}" removed from memory, but ${fail}`);
+var errPublicInviteNamed = () => new OursError(
+  "PUBLIC_INVITE_NAMED",
+  "generate_invite failed: a public invite cannot pre-assign a contact name \u2014 every redeemer would be registered under it. Omit `name` for a public invite."
+);
+var errNoPolicyArgs = () => new OursError("NO_POLICY_ARGS", "set_local_book_policy: pass expose and/or auto_accept.");
+var errSendFileArgs = () => new OursError("SEND_ARGS", "send_file: provide exactly one of `path` or `data_base64`.");
+var errSendFileFilenameRequired = () => new OursError("SEND_ARGS", "send_file: `filename` is required with `data_base64`.");
+var errFileUnreadable = (detail) => new OursError("FILE_UNREADABLE", `send_file: cannot read file: ${detail}`);
+var errSendFileUploadArgs = () => new OursError("SEND_ARGS", "send_file: provide exactly one of `path`, `data_base64` or `upload_id`.");
+var errUploadNotFound = (uploadId) => new OursError(
+  "FILE_UNREADABLE",
+  `send_file: no staged upload "${uploadId}" for the bound identity. Upload the bytes with POST /files/upload first. A staged upload is consumed by the first send that names it \u2014 including a send that failed \u2014 so a retry needs a fresh upload.`
+);
+var errFileTooLarge = (i) => new OursError(
+  "FILE_TOO_LARGE",
+  `send_file: "${i.filename}" is ${i.bytes} bytes. This send's envelope would serialize to ${i.envelopeBytes} bytes, over the transport's ${i.limit}-byte budget \u2014 the largest payload it can carry with this filename, MIME and reply reference is ${i.maxPayloadBytes} bytes. Nothing was sent.`,
+  i
+);
+var errNoRoot = () => new OursError("NO_ROOT", "No root identity exists on this host \u2014 create one with create_root_identity first.");
+var errInvalidSelection = (cap) => new OursError("INVALID_SELECTION", `get_files failed: wire_ids must contain 1-${cap} items.`);
+var errMalformedId = () => new OursError("MALFORMED_ID", "get_files failed: every selected wire_id must be exactly 64 hexadecimal characters.");
+var errDuplicateId = () => new OursError("DUPLICATE_ID", "get_files failed: wire_ids must not contain duplicates.");
+var errUnknownOrStaleId = () => new OursError(
+  "UNKNOWN_OR_STALE_ID",
+  "get_files failed: one or more selected wire_ids is unknown, stale, or no longer unread; no files were retrieved."
+);
+var errTool = (tool, detail, code = "TX_FAILED") => new OursError(code, `${tool} failed: ${detail}`);
+
+// ../../src/identity/release.ts
+async function releaseLeaseByToken(token) {
+  const tokenHash = hashLeaseToken(token);
+  const released = [];
+  for (const [name, lease] of [...leases]) {
+    if (lease.token !== token) continue;
+    leases.delete(name);
+    released.push(name);
+  }
+  const candidates = [
+    ...identities.values(),
+    ...[...quarantinedIdentities.values()].map((held) => held.identity)
+  ];
+  const owned = candidates.filter(
+    (id) => id.temp?.owner.tokenHash === tokenHash
+  );
+  const settled = await Promise.allSettled(
+    owned.map((id) => closeTemporaryIdentity(id, "owning session released its lease"))
+  );
+  const closed = [];
+  let attempted = 0;
+  let notified = 0;
+  let failed = 0;
+  const localFailures = [];
+  for (let i = 0; i < settled.length; i++) {
+    const item = settled[i];
+    const name = owned[i].name;
+    if (item.status === "rejected") {
+      localFailures.push({ name, error: String(item.reason) });
+      continue;
+    }
+    const result2 = item.value;
+    quarantinedIdentities.delete(name);
+    closed.push(name);
+    attempted += result2.attempted;
+    notified += result2.notified;
+    failed += result2.failed;
+    if (result2.deleteError) localFailures.push({ name, error: result2.deleteError });
+  }
+  tombstones.delete(token);
+  persistBindings();
+  log(`lease released by token \u2026${token.slice(-6)} (${closed.length} temporary identity close(s) awaited)`);
+  const result = { released, closed, attempted, notified, failed };
+  if (localFailures.length > 0) {
+    throw new OursError(
+      "DELETE_PARTIAL",
+      `Lease release completed with ${localFailures.length} local cleanup failure(s).`,
+      { result, localFailures }
+    );
+  }
+  return result;
+}
+
 // ../../src/gc.ts
 var gcTimer = null;
 var gcRunning = false;
@@ -350,101 +508,86 @@ function checkFileEnvelope(i) {
   };
 }
 
-// ../../src/errors.ts
-var OursError = class extends Error {
-  // `details` is PURELY ADDITIVE and optional: every existing construction and
-  // every `e.code` check keeps working untouched. It exists because a refusal a
-  // caller is expected to ACT on (trim N bytes, shorten the filename) cannot be
-  // delivered as prose alone — see errFileTooLarge.
-  constructor(code, message, details) {
-    super(message);
-    this.code = code;
-    this.details = details;
-    this.name = "OursError";
+// ../../src/api/identity.ts
+import { randomBytes as randomBytes2 } from "node:crypto";
+import { isAbsolute } from "node:path";
+
+// ../../src/identity/staged.ts
+import * as fs2 from "node:fs";
+import { randomBytes } from "node:crypto";
+async function provisionIdentityUnexposed(name, opts) {
+  if (reservedNames.has(name) || identities.has(name)) {
+    throw new Error(`identity name "${name}" is reserved or already present`);
   }
-};
-var errNameTaken = (tool, name) => new OursError("NAME_TAKEN", `${tool} failed: an identity named "${name}" already exists.`);
-var errNoLeaseHeaders = () => new OursError(
-  "NO_LEASE_HEADERS",
-  "create_temporary_identity failed: this client is not connected through the ours connector (no lease token / client pid headers), so there is no session lease to own the identity. Launch ours via the connector (`ours-mcp proxy`)."
-);
-var errRandomNameExhausted = () => new OursError(
-  "RANDOM_NAME_EXHAUSTED",
-  "create_temporary_identity failed: could not pick a free random name after 5 attempts \u2014 retry."
-);
-var errRootExists = (rootName2) => new OursError(
-  "ROOT_EXISTS",
-  `create_root_identity failed: a root identity already exists ("${rootName2}") \u2014 one root per host. Nothing to do.`
-);
-var errNotBoundNoName = () => new OursError("NOT_BOUND_NO_NAME", "close_temporary_identity failed: no identity is bound to this session and no name was given.");
-var errNotTemporary = (name) => new OursError(
-  "NOT_TEMPORARY",
-  `close_temporary_identity failed: "${name}" is a permanent identity. Use remove_identity if you really mean to delete it.`
-);
-var errTempOwnedElsewhereClose = (name, pid) => new OursError(
-  "TEMP_OWNED_ELSEWHERE",
-  `close_temporary_identity failed: "${name}" is owned by another LIVE session (owner pid ${pid}) \u2014 one session cannot delete another's temporary identity.`
-);
-var errTempClosedWithError = (name, deleteError, remote) => new OursError("DELETE_PARTIAL", `Temporary identity "${name}" closed with an error: ${deleteError}. ${remote}`);
-var errPathNotAbsolute = (path) => new OursError("PATH_NOT_ABSOLUTE", `define_local_identity_file failed: path must be absolute (got "${path}").`);
-var errNoSuchIdentity = (name) => new OursError("NO_SUCH_IDENTITY", `choose_identity failed: no identity named "${name}". Create it with create_identity.`);
-var errNoLeaseToken = () => new OursError(
-  "NO_LEASE_TOKEN",
-  "choose_identity failed: this client is not connected through the ours connector (no lease token header). Launch ours via the connector (`ours-mcp proxy`)."
-);
-var errTempClosingChoose = (name) => new OursError("TEMP_CLOSING", `choose_identity failed: temporary identity "${name}" is closing \u2014 its state is being deleted.`);
-var errTempOwnedLive = (name, pid) => new OursError(
-  "TEMP_OWNED_ELSEWHERE",
-  `choose_identity failed: "${name}" is a TEMPORARY identity owned by another live session (owner pid ${pid}). Ownership is exclusive and cannot be overridden \u2014 not even with force. Create your own with create_temporary_identity.`
-);
-var errTempStale = (name, pid) => new OursError(
-  "TEMP_STALE",
-  `choose_identity failed: temporary identity "${name}" is STALE \u2014 its owning session (pid ${pid}) is gone and it is pending automatic cleanup. It cannot be adopted by another session; use close_temporary_identity to reclaim (clean it up) now.`
-);
-var errBoundElsewhere = (name) => new OursError(
-  "BOUND_ELSEWHERE",
-  `choose_identity declined: "${name}" is currently bound to another live session. Do not retry with force=true on your own \u2014 tell the user it is in use elsewhere and ask whether to forcibly rebind it here; only retry with force=true after they explicitly confirm.`
-);
-var errTempOwnedElsewhereRemove = (name, pid) => new OursError(
-  "TEMP_OWNED_ELSEWHERE",
-  `remove_identity failed: "${name}" is a TEMPORARY identity owned by another LIVE session (owner pid ${pid}) \u2014 one session cannot delete another's temporary identity.`
-);
-var errIdentityClosedWithError = (name, deleteError, remote) => new OursError("DELETE_PARTIAL", `Temporary identity "${name}" closed with an error: ${deleteError}.${remote}`);
-var errRootHasRoles = (name, roles) => new OursError(
-  "ROOT_HAS_ROLES",
-  `remove_identity failed: "${name}" is the root identity and still has ${roles.length} role(s): ${roles.join(", ")}. Remove the roles first.`
-);
-var errIdentityPartiallyRemoved = (name, fail) => new OursError("DELETE_PARTIAL", `Identity "${name}" removed from memory, but ${fail}`);
-var errPublicInviteNamed = () => new OursError(
-  "PUBLIC_INVITE_NAMED",
-  "generate_invite failed: a public invite cannot pre-assign a contact name \u2014 every redeemer would be registered under it. Omit `name` for a public invite."
-);
-var errNoPolicyArgs = () => new OursError("NO_POLICY_ARGS", "set_local_book_policy: pass expose and/or auto_accept.");
-var errSendFileArgs = () => new OursError("SEND_ARGS", "send_file: provide exactly one of `path` or `data_base64`.");
-var errSendFileFilenameRequired = () => new OursError("SEND_ARGS", "send_file: `filename` is required with `data_base64`.");
-var errFileUnreadable = (detail) => new OursError("FILE_UNREADABLE", `send_file: cannot read file: ${detail}`);
-var errSendFileUploadArgs = () => new OursError("SEND_ARGS", "send_file: provide exactly one of `path`, `data_base64` or `upload_id`.");
-var errUploadNotFound = (uploadId) => new OursError(
-  "FILE_UNREADABLE",
-  `send_file: no staged upload "${uploadId}" for the bound identity. Upload the bytes with POST /files/upload first. A staged upload is consumed by the first send that names it \u2014 including a send that failed \u2014 so a retry needs a fresh upload.`
-);
-var errFileTooLarge = (i) => new OursError(
-  "FILE_TOO_LARGE",
-  `send_file: "${i.filename}" is ${i.bytes} bytes. This send's envelope would serialize to ${i.envelopeBytes} bytes, over the transport's ${i.limit}-byte budget \u2014 the largest payload it can carry with this filename, MIME and reply reference is ${i.maxPayloadBytes} bytes. Nothing was sent.`,
-  i
-);
-var errInvalidSelection = (cap) => new OursError("INVALID_SELECTION", `get_files failed: wire_ids must contain 1-${cap} items.`);
-var errMalformedId = () => new OursError("MALFORMED_ID", "get_files failed: every selected wire_id must be exactly 64 hexadecimal characters.");
-var errDuplicateId = () => new OursError("DUPLICATE_ID", "get_files failed: wire_ids must not contain duplicates.");
-var errUnknownOrStaleId = () => new OursError(
-  "UNKNOWN_OR_STALE_ID",
-  "get_files failed: one or more selected wire_ids is unknown, stale, or no longer unread; no files were retrieved."
-);
-var errTool = (tool, detail, code = "TX_FAILED") => new OursError(code, `${tool} failed: ${detail}`);
+  reservedNames.add(name);
+  const dir = identityDir(name);
+  let id;
+  try {
+    fs2.mkdirSync(dir, { recursive: true, mode: 448 });
+    let tempMeta;
+    if (opts.temp) {
+      tempMeta = {
+        owner: { tokenHash: opts.temp.tokenHash, pid: opts.temp.pid },
+        createdAt: Date.now()
+      };
+      writeTempMetaFile(dir, tempMeta);
+    }
+    id = await createPacket(name, randomBytes(24).toString("hex"), dir, false, void 0, true);
+    openHistory(id);
+    if (tempMeta) id.temp = tempMeta;
+    fs2.writeFileSync(keyPath(dir), exportSigningSecret(id), { mode: 384 });
+    await withScopeAsync(async (lt) => {
+      await mutatingTx(id, "::a2a_messaging::set_my_name", { name }, lt);
+    });
+    await pinRegistrar(id);
+    if (!opts.localAutoAccept) {
+      await withScopeAsync(async (lt) => {
+        await mutatingTx(id, "::actor::set_local_policy", { auto_accept: false }, lt);
+      });
+    }
+    saveStateFailClosed(id);
+    log(`[${name}] provisioned UNEXPOSED pending hierarchy reconciliation`);
+    return id;
+  } catch (err) {
+    rollbackUnexposedIdentity(id, name, dir);
+    throw err;
+  }
+}
+async function activateIdentity(id, exposeLocal) {
+  wrapper.expose_packet(id.cid);
+  identities.set(id.name, id);
+  try {
+    if (exposeLocal) await publishToBook(id);
+    log(`[${id.name}] EXPOSED (routing + broker registration) \u2014 hierarchy reconciled`);
+  } catch (err) {
+    rollbackUnexposedIdentity(id, id.name, id.dir);
+    throw err;
+  }
+}
+function rollbackUnexposedIdentity(id, name, dir) {
+  if (id) {
+    try {
+      closeHistory(id);
+    } catch {
+    }
+    try {
+      unpublishFromBook(id);
+    } catch {
+    }
+    try {
+      wrapper.remove_packet(id.cid);
+    } catch {
+    }
+  }
+  identities.delete(name);
+  try {
+    fs2.rmSync(dir, { recursive: true, force: true });
+  } catch {
+  }
+  reservedNames.delete(name);
+}
 
 // ../../src/api/identity.ts
-import { randomBytes } from "node:crypto";
-import { isAbsolute } from "node:path";
 function describeOrNull(id) {
   try {
     return describeIdentity(id);
@@ -479,7 +622,7 @@ async function createIdentity(ctx, a) {
   const { name, bio, exposeLocal, localAutoAccept } = a;
   const bad = validateName(name);
   if (bad) throw errTool("create_identity", bad, "NAME_INVALID");
-  if (identities.has(name)) throw errNameTaken("create_identity", name);
+  if (identities.has(name) || quarantinedIdentities.has(name)) throw errNameTaken("create_identity", name);
   try {
     const id = await provisionIdentity(name, { exposeLocal, localAutoAccept });
     await setBio(id, bio);
@@ -496,8 +639,9 @@ async function createIdentity(ctx, a) {
     } else {
       hierarchy = "root";
       const res = await establishRoot(id);
-      adopted = res.adopted;
-      failed = res.failed;
+      const held = await adoptQuarantinedIdentities(id);
+      adopted = [...res.adopted, ...held.adopted];
+      failed = [...res.failed, ...held.failed];
     }
     bindSession(ctx.sessionId(), name);
     return { info: identityInfo(id), hierarchy, underRoot, adopted, failed, exposedLocal: exposeLocal, localAutoAccept };
@@ -519,22 +663,34 @@ async function createTemporaryIdentity(ctx, a) {
     }
   } else {
     for (let i = 0; i < 5 && chosen === void 0; i++) {
-      const cand = `tmp-${randomBytes(5).toString("hex")}`;
+      const cand = `tmp-${randomBytes2(5).toString("hex")}`;
       if (!identities.has(cand) && !reservedNames.has(cand)) chosen = cand;
     }
     if (chosen === void 0) throw errRandomNameExhausted();
   }
   const name = chosen;
+  const root = rootName ? identities.get(rootName) : void 0;
+  if (!root) throw errNoRoot();
+  let id;
   try {
-    const id = await provisionIdentity(name, {
-      exposeLocal,
+    id = await provisionIdentityUnexposed(name, {
       localAutoAccept,
       temp: { tokenHash: hashLeaseToken(token), pid }
     });
     await setBio(id, bio);
+    await delegateRole(root, id);
+    await activateIdentity(id, exposeLocal);
     bindSession(ctx.sessionId(), name);
-    return { info: identityInfo(id), ownerPid: pid, exposedLocal: exposeLocal, localAutoAccept };
+    return {
+      info: identityInfo(id),
+      ownerPid: pid,
+      hierarchy: "role",
+      underRoot: root.name,
+      exposedLocal: exposeLocal,
+      localAutoAccept
+    };
   } catch (err) {
+    if (id) rollbackUnexposedIdentity(id, name, id.dir);
     throw errTool("create_temporary_identity", String(err), "PROVISION_FAILED");
   }
 }
@@ -552,7 +708,7 @@ async function closeTemporaryIdentityOp(ctx, a) {
   if (!id.temp) throw errNotTemporary(id.name);
   const owner = id.temp.owner;
   const isOwner = token !== void 0 && owner.tokenHash === hashLeaseToken(token);
-  if (!isOwner && !id.temp.closing && pidAlive(owner.pid)) {
+  if (!isOwner && !id.temp.closing && !pidDefinitelyDead(owner.pid)) {
     throw errTempOwnedElsewhereClose(id.name, owner.pid);
   }
   try {
@@ -578,7 +734,7 @@ async function createRootIdentity(ctx, a) {
   if (skipIfRootExists && existingRootName && identities.has(existingRootName)) {
     throw errRootExists(existingRootName);
   }
-  if (identities.has(name)) throw errNameTaken("create_root_identity", name);
+  if (identities.has(name) || quarantinedIdentities.has(name)) throw errNameTaken("create_root_identity", name);
   try {
     const id = await provisionIdentity(name, { exposeLocal, localAutoAccept });
     await setBio(id, bio);
@@ -598,13 +754,14 @@ async function createRootIdentity(ctx, a) {
       };
     }
     const { adopted, failed } = await establishRoot(id);
+    const held = await adoptQuarantinedIdentities(id);
     bindSession(ctx.sessionId(), name);
     return {
       info: identityInfo(id),
       hierarchy: "root",
       underRoot: null,
-      adopted,
-      failed,
+      adopted: [...adopted, ...held.adopted],
+      failed: [...failed, ...held.failed],
       exposedLocal: exposeLocal,
       localAutoAccept
     };
@@ -633,7 +790,7 @@ async function chooseIdentity(ctx, a) {
     if (target.temp.closing) throw errTempClosingChoose(name);
     const owner = target.temp.owner;
     if (owner.tokenHash !== hashLeaseToken(token)) {
-      if (pidAlive(owner.pid)) throw errTempOwnedLive(name, owner.pid);
+      if (!pidDefinitelyDead(owner.pid)) throw errTempOwnedLive(name, owner.pid);
       throw errTempStale(name, owner.pid);
     }
     const hdrPid = ctx.clientPid();
@@ -648,7 +805,7 @@ async function chooseIdentity(ctx, a) {
   }
   const existing = leases.get(name);
   if (existing && existing.token !== token) {
-    if (!pidAlive(existing.pid)) {
+    if (pidDefinitelyDead(existing.pid)) {
       log(`auto-reclaiming "${name}" from dead client pid ${existing.pid}`);
       leases.delete(name);
     } else if (!force) {
@@ -664,13 +821,13 @@ async function chooseIdentity(ctx, a) {
   return { name, cid: identities.get(name).cid, switchedFrom };
 }
 async function listIdentities(ctx) {
-  if (identities.size === 0) return [];
+  if (identities.size === 0 && quarantinedIdentities.size === 0) return [];
   const myToken = ctx.leaseToken();
   const sessionOf = (name) => {
     const lease = leases.get(name);
     if (!lease) return null;
     if (lease.token === myToken) return "mine";
-    if (!pidAlive(lease.pid)) return null;
+    if (pidDefinitelyDead(lease.pid)) return null;
     return "other-live";
   };
   const tempOf = (id) => {
@@ -680,7 +837,7 @@ async function listIdentities(ctx) {
     if (myToken !== void 0 && id.temp.owner.tokenHash === hashLeaseToken(myToken)) {
       return { state: "mine", ownerPid };
     }
-    return pidAlive(ownerPid) ? { state: "other-live", ownerPid } : { state: "stale", ownerPid };
+    return pidDefinitelyDead(ownerPid) ? { state: "stale", ownerPid } : { state: "other-live", ownerPid };
   };
   const row = (id, kind) => ({
     name: id.name,
@@ -697,13 +854,10 @@ async function listIdentities(ctx) {
       if (id.name === root.name) continue;
       if (describeIdentity(id).roleId !== "") rows.push(row(id, "role"));
     }
-    for (const id of identities.values()) {
-      if (id.name === root.name || describeIdentity(id).roleId !== "") continue;
-      rows.push(row(id, "flat"));
-    }
   } else {
-    for (const id of identities.values()) rows.push(row(id, "flat"));
+    for (const id of identities.values()) rows.push(row(id, "role"));
   }
+  for (const [name, held] of quarantinedIdentities) rows.push({ name, status: held.status });
   return rows;
 }
 async function currentIdentity(ctx) {
@@ -724,16 +878,18 @@ async function currentIdentity(ctx) {
 }
 async function removeIdentity(ctx, a) {
   const { name } = a;
-  const id = identities.get(name);
+  const held = quarantinedIdentities.get(name);
+  const id = identities.get(name) ?? held?.identity;
   if (!id) throw errTool("remove_identity", `no identity named "${name}".`, "NO_SUCH_IDENTITY");
   if (id.temp) {
     const token = ctx.leaseToken();
     const owner = id.temp.owner;
-    if ((token === void 0 || owner.tokenHash !== hashLeaseToken(token)) && !id.temp.closing && pidAlive(owner.pid)) {
+    if ((token === void 0 || owner.tokenHash !== hashLeaseToken(token)) && !id.temp.closing && !pidDefinitelyDead(owner.pid)) {
       throw errTempOwnedElsewhereRemove(name, owner.pid);
     }
     try {
       const res = await closeTemporaryIdentity(id, "remove_identity");
+      quarantinedIdentities.delete(name);
       if (res.deleteError) {
         const remote = res.attempted === 0 ? "" : ` Remove-me notices: ${res.notified}/${res.attempted} queued, ${res.failed} not sent (best effort).`;
         throw errIdentityClosedWithError(name, res.deleteError, remote);
@@ -752,27 +908,13 @@ async function removeIdentity(ctx, a) {
   }
   const fail = deleteIdentityCompletely(id);
   if (fail) throw errIdentityPartiallyRemoved(name, fail);
+  quarantinedIdentities.delete(name);
   return { name, kind: "permanent" };
 }
 async function releaseLease(ctx) {
   const token = ctx.leaseToken();
   if (!token) throw errNoLeaseToken();
-  const released = [];
-  for (const [n, l] of [...leases]) {
-    if (l.token !== token) continue;
-    leases.delete(n);
-    released.push(n);
-    const rid = identities.get(n);
-    if (rid?.temp && rid.temp.owner.tokenHash === hashLeaseToken(token) && !rid.temp.closing) {
-      void closeTemporaryIdentity(rid, "owning session released its lease").catch(
-        (err) => log(`[${n}] close on lease release failed:`, String(err))
-      );
-    }
-  }
-  tombstones.delete(token);
-  persistBindings();
-  log(`lease released by token \u2026${token.slice(-6)}`);
-  return { released };
+  return releaseLeaseByToken(token);
 }
 
 // ../../src/api/contacts.ts
@@ -1621,7 +1763,13 @@ async function serveApiOperation(req, res, pathname, readBody2) {
     sendJson(res, 200, await handler(session.ctx, body));
   } catch (err) {
     if (err instanceof OursError) {
-      sendJson(res, 400, { error: { code: err.code, message: err.message } });
+      sendJson(res, 400, {
+        error: {
+          code: err.code,
+          message: err.message,
+          ...err.details ? { details: err.details } : {}
+        }
+      });
       return;
     }
     log("api handler error:", name, String(err));
@@ -1776,7 +1924,7 @@ async function startHttpDaemon(opts) {
     for (const sid of [...serversBySession.keys()]) {
       if (sid === "stdio") continue;
       const pid = sessionHeaders.get(sid)?.pid;
-      if (pid === void 0 || pid <= 1 || pidAlive(pid)) continue;
+      if (pid === void 0 || !pidDefinitelyDead(pid)) continue;
       const inf = inflight.get(sid);
       if (inf && inf.n > 0 && Date.now() - inf.since < STUCK_MS) continue;
       const srv = serversBySession.get(sid);
@@ -1792,11 +1940,16 @@ async function startHttpDaemon(opts) {
     }
     return reaped;
   };
+  let reaperRunning = false;
   const sessionReaper = setInterval(() => {
+    if (reaperRunning) return;
+    reaperRunning = true;
     reapDeadSessions();
-    sweepStaleTempIdentities();
     sweepStaleUploads();
-  }, 6e4);
+    void reapStaleTemporaryIdentities().finally(() => {
+      reaperRunning = false;
+    });
+  }, sessionReaperIntervalMs());
   sessionReaper.unref?.();
   const REQ_META_MAX = 1e3;
   const REQ_META_TTL_MS = 10 * 6e4;
@@ -1863,8 +2016,8 @@ async function startHttpDaemon(opts) {
       res.end(JSON.stringify({
         identities: [...identities.values()].map((i) => ({
           name: i.name,
-          ...i.temp ? { temporary: true, stale: !pidAlive(i.temp.owner.pid) } : {}
-        }))
+          ...i.temp ? { temporary: true, stale: pidDefinitelyDead(i.temp.owner.pid) } : {}
+        })).concat([...quarantinedIdentities.entries()].map(([name, held]) => ({ name, status: held.status })))
       }));
       return;
     }
@@ -1884,6 +2037,11 @@ async function startHttpDaemon(opts) {
           res.end(JSON.stringify({ error: "invalid identity name" }));
           return;
         }
+        if (!identities.has(name)) {
+          res.writeHead(404, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "no active identity with that name" }));
+          return;
+        }
         await serveNotifications(req, res, name, url.searchParams.get("since"), url.searchParams.get("kinds"));
         return;
       }
@@ -1939,9 +2097,9 @@ async function startHttpDaemon(opts) {
           return;
         }
         try {
-          const stat = fs2.statSync(filePath);
+          const stat = fs3.statSync(filePath);
           res.writeHead(200, { "Content-Type": "application/octet-stream", "Content-Length": String(stat.size) });
-          const stream = fs2.createReadStream(filePath);
+          const stream = fs3.createReadStream(filePath);
           stream.on("error", () => {
             try {
               res.destroy();
@@ -2043,19 +2201,7 @@ async function startHttpDaemon(opts) {
         }
         const token = sessionHeaders.get(sessionId)?.token ?? req.headers["x-ours-lease-token"];
         if (token) {
-          for (const [n, l] of [...leases]) {
-            if (l.token !== token) continue;
-            leases.delete(n);
-            const rid = identities.get(n);
-            if (rid?.temp && rid.temp.owner.tokenHash === hashLeaseToken(token) && !rid.temp.closing) {
-              void closeTemporaryIdentity(rid, "owning session released its lease").catch(
-                (err) => log(`[${n}] close on lease release failed:`, String(err))
-              );
-            }
-          }
-          tombstones.delete(token);
-          persistBindings();
-          log(`lease released by token \u2026${token.slice(-6)}`);
+          await releaseLeaseByToken(token);
         }
         await transports[sessionId].handleRequest(req, res);
       } else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/cli",
-  "version": "2.0.3",
+  "version": "2.0.4",
   "description": "Transport-neutral operator CLI for the ours shared daemon",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",